ambitgraph 0.8.2__tar.gz → 0.8.4__tar.gz

{ambitgraph-0.8.2/ambitgraph.egg-info → ambitgraph-0.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ambitgraph
-Version: 0.8.2
+Version: 0.8.4
 Summary: Read-only codebase scan: reusable units, families, roles, ownership candidates, duplication.
 Author: AmbitGraph
 License: Proprietary

{ambitgraph-0.8.2 → ambitgraph-0.8.4}/ambit_telegraph/responsibility.py

@@ -17,6 +17,17 @@ the exact chain, latest line wins, so a transfer is an off record plus an
 on record and the file itself is the transfer history. Two different
 chains both on for one node are two owners, not a conflict.
 
+A node ending with "/" is a folder node; any other node is a file node
+(queries for a file path never end with "/"). A file's own exact record
+does not replace the nearest covering folder's record -- it ADDS to it:
+a file answers through its own on-records first, then through the on-
+records standing at the nearest folder that covers it. A sub-folder's own
+claim is itself a folder node, so it carves its subtree out of any outer
+folder's reach. Turning a file's exact chain off closes only that
+chain's claim on the file; the folder's owners are untouched. Querying a
+folder node itself is unaffected: the longest matching folder prefix
+still wins alone.
+
 Authorship law: a record's `set_by` must already stand in the chain
 strictly before the first element the record changes relative to the
 standing lineage it extends or supersedes; a chain's root is changed only
@@ -185,36 +196,77 @@ def _covers(rec_node: str, node: str) -> bool:
     return rec_node.endswith("/") and node.startswith(rec_node)
 
 
+def _resolve_one(rec, *, now, gone) -> "Resolution":
+    """One standing on-record turned into its Resolution: the holder is the
+    deepest chain element that is neither departed nor (for the acting,
+    last element) past its expiry."""
+    live = []
+    # pair each holder with its root-first depth, so the acting (last)
+    # holder can be singled out below for the expiry check
+    for position, holder in enumerate(rec.chain):
+        if holder in gone:
+            break
+        # only the chain's last element is the acting holder -- an expiry
+        # never applies to a delegator further up the chain
+        acting = position == len(rec.chain) - 1
+        if acting and rec.expires is not None \
+                and now >= _parse_ts(rec.expires, "expires"):
+            break
+        live.append(holder)
+    # the deepest surviving holder answers; an empty walk means nobody does
+    return Resolution(record=rec, chain=rec.chain,
+                      holder=live[-1] if live else None)
+
+
 def resolve_owners(records, node, *, now, gone=frozenset()) -> tuple:
     """Who owns `node` right now? Pure: the clock arrives as `now`, the
     departed arrive as `gone`, and nothing here touches the file system.
 
-    The longest matching node prefix wins; every on-record standing at that
-    winning node is one owner. Each owner's holder is the deepest chain
-    element that is neither in `gone` nor past its expiry (the expiry
-    applies to the acting holder alone) — the longest surviving prefix
-    answers, so a departure never orphans an area."""
+    A folder query (`node` ends with "/") keeps the plain longest-prefix
+    rule: every on-record standing at the longest matching folder node is
+    one owner. A file query answers with every on-record standing at the
+    file's own exact node, PLUS every on-record standing at the nearest
+    covering folder (the longest folder node that reaches it) -- a file
+    claim adds an owner beside its folder's, it does not replace it, and a
+    sub-folder's own claim still carves that sub-folder out of any outer
+    folder. The exact owners come first, then the folder owners, each
+    group in its own standing order -- one Resolution per standing
+    on-record, always: two records whose chains both resolve to the same
+    holder are two owners sharing that holder, never merged into one.
+    Each owner's holder is the deepest chain element that is neither in
+    `gone` nor past its expiry (the expiry applies to the acting holder
+    alone) -- the longest surviving prefix answers, so a departure never
+    orphans an area."""
     node = _require_node(node)
     standing = _latest_by_lineage(records)
-    matches = [rec for rec in standing.values() if _covers(rec.node, node)]
-    if not matches:
-        return ()
-    winning = max(len(rec.node) for rec in matches)
-    out = []
-    for rec in matches:
-        if len(rec.node) != winning or rec.state != "on":
-            continue
-        live = []
-        for position, holder in enumerate(rec.chain):
-            if holder in gone:
-                break
-            acting = position == len(rec.chain) - 1
-            if acting and rec.expires is not None \
-                    and now >= _parse_ts(rec.expires, "expires"):
-                break
-            live.append(holder)
-        out.append(Resolution(record=rec, chain=rec.chain,
-                              holder=live[-1] if live else None))
+    if node.endswith("/"):
+        # Folder query: today's rule, unchanged -- the longest covering
+        # node wins alone, whatever its depth.
+        matches = [rec for rec in standing.values() if _covers(rec.node, node)]
+        if not matches:
+            return ()
+        winning = max(len(rec.node) for rec in matches)
+        return tuple(_resolve_one(rec, now=now, gone=gone)
+                    for rec in matches
+                    if len(rec.node) == winning and rec.state == "on")
+    # File query: every record standing at the exact node...
+    exact = [rec for rec in standing.values() if rec.node == node]
+    # ...plus every folder node that covers this file, ON OR OFF -- an off
+    # record must still be counted here, or a nearer folder that is off
+    # would stop masking the outer folder and an outer on-record would
+    # wrongly reach past the nearer one
+    folders = [rec for rec in standing.values()
+              if rec.node.endswith("/") and _covers(rec.node, node)]
+    # the exact owners resolve first, in their own standing order, on-only
+    out = [_resolve_one(rec, now=now, gone=gone)
+          for rec in exact if rec.state == "on"]
+    if folders:
+        # only the longest (nearest) covering folder node is consulted --
+        # an outer folder never reaches past a nearer one
+        nearest = max(len(rec.node) for rec in folders)
+        out.extend(_resolve_one(rec, now=now, gone=gone)
+                   for rec in folders
+                   if len(rec.node) == nearest and rec.state == "on")
     return tuple(out)
 
 

{ambitgraph-0.8.2 → ambitgraph-0.8.4}/ambitgraph/cli.py

@@ -2560,10 +2560,11 @@ def build_parser() -> argparse.ArgumentParser:
                     "read by construction, and a derived default would trade "
                     "that guarantee for a convention")
 
-    ow = tsub.add_parser("owner", help="name who answers for a node -- the "
-                         "holder and the full chain, read from the repo's "
-                         "own responsibility record; an unowned node is an "
-                         "answer, never an error")
+    ow = tsub.add_parser("owner", help="who answers for this node: every "
+                         "owner, the file's own claim first, then its "
+                         "folder's, each through its chain -- read from "
+                         "the repo's own responsibility record; an unowned "
+                         "node is an answer, never an error")
     ow.add_argument("node", help="the node whose owner to name (a file or "
                     "folder path as the map writes it)")
     ow.add_argument("--repo", default=".",

{ambitgraph-0.8.2 → ambitgraph-0.8.4}/ambitgraph/omniscient_next/__init__.py

@@ -140,7 +140,13 @@ def render_screen(run_path: str) -> str:
     scripts (modules + payload + wiring). The caller (shell.py) owns the
     absence branch; calling this without data is a build error."""
     data = build_data(run_path)
-    payload = json.dumps(data, separators=(",", ":")).replace("</", "<\\/")
+    # EVERY `<` becomes an escaped unicode point, not just the ones that open a
+    # closing tag. Replacing `</` alone defends against `</script>` and against
+    # nothing else: a scanned name containing `<!--` opens a comment inside the
+    # script block and swallows the payload after it, and `<script` opens a
+    # second one. The escape is invisible to JSON.parse, so the data a reader
+    # gets is unchanged -- this is the cockpit's own pattern, not a new one.
+    payload = json.dumps(data, separators=(",", ":")).replace("<", "\\u003c")
     return (
         '<div class="cp-next-shell">'
         '<div class="sh-top">'

{ambitgraph-0.8.2 → ambitgraph-0.8.4}/ambitgraph/omniscient_next/graph.js

@@ -153,7 +153,13 @@ class SingleGraph {
   destroy(){ this.container.innerHTML=""; }
 
   /* ---------------- internals ---------------- */
-  _esc(s){ return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;"); }
+  /* All five characters that change how markup is read. This pane writes a
+     folder's name into data-expand="...", so an unescaped quote in a directory
+     name ends that attribute early and the rest of the name is read as markup.
+     The ampersand is replaced FIRST, or a later substitution's own output is
+     escaped a second time. */
+  _esc(s){ return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;")
+    .replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;"); }
 
   _neigh(applyFilter=true){
     // inbound/outbound entries, deduped per file, weights summed
@@ -214,7 +220,7 @@ class SingleGraph {
          '<div class="sg-e-name"><span class="sg-e-dot" style="background:'+
            (FC[n.f]||"#8b96a8")+'"></span>'+esc(n.id.split("/").pop())+'</div>'+
          '<div class="sg-e-path">'+esc(n.id)+'</div>'+
-         '<div class="sg-e-meta">'+n.d+' links · '+n.in+' inbound · '+n.f+'/</div></div>'; });
+         '<div class="sg-e-meta">'+n.d+' links · '+n.in+' inbound · '+esc(n.f)+'/</div></div>'; });
     h+='</div></div>';
     this._canvas.innerHTML=h;
   }

{ambitgraph-0.8.2 → ambitgraph-0.8.4}/ambitgraph/omniscient_next/library.js

@@ -74,7 +74,13 @@ class LibraryView {
     if (i >= 0) { this._state = {...this._state, level:"file", file:i}; this._render(); } }
   home() { this._state = {...this._state, level:"home"}; this._render(); }
 
-  _esc(s){ return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;"); }
+  /* All five characters that change how markup is read. Two are enough for
+     text between tags and are no defence at all for a value placed inside a
+     quoted attribute, where one unescaped quote ends the attribute early and
+     everything after it is read as markup. The ampersand is replaced FIRST,
+     or a later substitution's own output is escaped a second time. */
+  _esc(s){ return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;")
+    .replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;"); }
   _cat(key){ return this._CATS.find(c => c[0] === key); }
 
   _click(e) {

{ambitgraph-0.8.2 → ambitgraph-0.8.4}/ambitgraph/omniscient_next/search.js

@@ -61,7 +61,12 @@ class SearchDrop {
     if (m.syms.length) { return this._data.nodes[m.syms[0][1]].id; }
     return null;
   }
-  _esc(s) { return String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;"); }
+  /* All five characters that change how markup is read. Two are enough for
+     text between tags and are no defence at all for a value placed inside a
+     quoted attribute. The ampersand is replaced FIRST, or a later
+     substitution's own output is escaped a second time. */
+  _esc(s) { return String(s).replace(/&/g, "&amp;").replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;"); }
   _render() {
     const SEARCH_ROW_CAP = 12;
     const m = this.matches(this._input.value);

{ambitgraph-0.8.2 → ambitgraph-0.8.4}/ambitgraph/omniscient_next/siderail.js

@@ -3,6 +3,17 @@
    navigation lands (a test pins that retirement). Architecture constraints:
    one view, one class, all CSS class names prefixed to avoid collisions,
    and only the documented public surface is used. */
+/* All five characters that change how markup is read. This module had none:
+   its labels and notes are file and folder names from the scanned repository
+   and they were written straight into innerHTML, so a name decided markup on
+   a page that opens by default. The ampersand is replaced FIRST, or a later
+   substitution's own output is escaped a second time.
+   The name is module-local because every module is concatenated into one
+   script and a bare `esc` would collide; one shared escaper replacing all of
+   these is the next release's work, not this patch's. */
+function _srEsc(s){ return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;")
+  .replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;"); }
+
 /* ============================================================
    SideRail — the left rail with NESTED quick-nav: entry points
    nested under Graph, categories under Library, each group
@@ -36,8 +47,8 @@ class SideRail {
       b.className = "sr-item"; b.tabIndex = 0; b.setAttribute("role", "button");
       b.innerHTML =
         (it.children ? "<span class='sr-caret'>▸</span>" : "<span class='sr-caret sr-blank'></span>") +
-        "<span class='sr-label'>" + it.label + "</span>" +
-        (it.note ? "<span class='sr-note'>" + it.note + "</span>" : "");
+        "<span class='sr-label'>" + _srEsc(it.label) + "</span>" +
+        (it.note ? "<span class='sr-note'>" + _srEsc(it.note) + "</span>" : "");
       const switchTo = () => { if (typeof opts.onSwitch === "function") opts.onSwitch(it.key); };
       b.querySelector(".sr-label").onclick = switchTo;
       if (it.note) b.querySelector(".sr-note").onclick = switchTo;
@@ -58,9 +69,9 @@ class SideRail {
         it.children.forEach(c => {
           const k = document.createElement("div");
           k.className = "sr-kid"; k.tabIndex = 0; k.setAttribute("role", "button");
-          k.innerHTML = (c.color ? "<span class='sr-dot' style='background:"+c.color+"'></span>" : "") +
-            "<span class='sr-klabel'>" + c.label + "</span>" +
-            (c.note ? "<span class='sr-note'>" + c.note + "</span>" : "");
+          k.innerHTML = (c.color ? "<span class='sr-dot' style='background:"+_srEsc(c.color)+"'></span>" : "") +
+            "<span class='sr-klabel'>" + _srEsc(c.label) + "</span>" +
+            (c.note ? "<span class='sr-note'>" + _srEsc(c.note) + "</span>" : "");
           k.onclick = () => c.onClick && c.onClick();
           k.addEventListener("keydown", e => { if (e.key === "Enter") k.onclick(); });
           kids.appendChild(k);

{ambitgraph-0.8.2 → ambitgraph-0.8.4}/ambitgraph/omniscient_next/wholemap.js

@@ -2,6 +2,17 @@
    implementation and is expected to be retired once the map product view
    ships (a test pins this until then). Architecture constraints: one view,
    one class, CSS prefixed to this module, public surface only. */
+/* All five characters that change how markup is read. This module had none:
+   the folder legend wrote a scanned folder's name straight into innerHTML, on
+   the pane the page opens on, so the name decided markup with no click at all.
+   The ampersand is replaced FIRST, or a later substitution's own output is
+   escaped a second time.
+   The name is module-local because every module is concatenated into one
+   script and a bare `esc` would collide; one shared escaper replacing all of
+   these is the next release's work, not this patch's. */
+function _wmEsc(s){ return String(s).replace(/&/g,"&amp;").replace(/</g,"&lt;")
+  .replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;"); }
+
 /* ============================================================
    WholeMap — the whole-graph view, as its own module.
 
@@ -471,8 +482,8 @@ class WholeMap {
     /* chips — computed from THIS repo's data, never assumed */
     data.folders.forEach(f=>{ const [name,count]=f;
       const el=document.createElement("span"); el.className="wm-chip"; el.tabIndex=0;
-      el.innerHTML="<span class='wm-sw' style='background:"+folderColor[name]+"'></span>"
-        +name+" "+count;
+      el.innerHTML="<span class='wm-sw' style='background:"+_wmEsc(folderColor[name])+"'></span>"
+        +_wmEsc(name)+" "+count;
       el.onclick=()=>{ traced = traced===name? null : name;
         chipbar.querySelectorAll(".wm-chip").forEach(c=>c.classList.remove("wm-on"));
         if(traced) el.classList.add("wm-on");

{ambitgraph-0.8.2 → ambitgraph-0.8.4}/ambitgraph/responsibility.py

@@ -16,7 +16,16 @@ Absence is not an alarm: a repository with no record yields an empty
 overlay and the map renders exactly as it always did. A torn record
 yields only a damaged marker under "__damaged__", never a crash and never
 rows -- a half-read record could mis-assign, so a damaged file assigns
-nothing and says why."""
+nothing and says why.
+
+A node ending with "/" is a folder node; any other node is a file node.
+A file's own exact record does not replace the nearest covering folder's
+record -- it ADDS to it: the unit's rows carry its own on-records first,
+then the nearest covering folder's on-records. A sub-folder's own claim
+is itself a folder node, so it carves its subtree out of any outer
+folder's reach; turning a file's exact chain off closes only that
+chain's row, leaving the folder's rows untouched. A folder unit query is
+unaffected: the longest matching folder prefix still wins alone."""
 
 from __future__ import annotations
 
@@ -76,6 +85,39 @@ def _covers(rec_node: str, unit: str) -> bool:
                                 and unit.startswith(rec_node))
 
 
+def _row_for(rec, now):
+    """One standing on-record turned into its overlay row: holder is the
+    deepest chain element still live against `now`, expiry applying only
+    to the acting (last) element."""
+    # the record's chain arrives as a plain JSON list; make it a tuple so
+    # every row's chain is the same immutable shape the record library uses
+    chain = tuple(rec["chain"])
+    expires = rec.get("expires")
+    # Walk root-first; the expiry applies to the acting holder alone, so a
+    # passed expiry ends the walk before the last element and the answer
+    # rolls up the surviving prefix.
+    live = []
+    for position, holder in enumerate(chain):
+        # only the chain's last element is the acting holder -- an expiry
+        # never applies to a delegator further up the chain
+        acting = position == len(chain) - 1
+        if acting and expires is not None \
+                and now >= _parse_ts(expires):
+            break
+        live.append(holder)
+    # the row this record answers with: the deepest surviving holder (None
+    # when the whole walk broke before adding one), the full chain, the
+    # reason, the node that covered the query, and the guest-term fields
+    return {
+        "holder": live[-1] if live else None,
+        "chain": chain,
+        "why": rec.get("why", ""),
+        "via": rec["node"],
+        "guest": expires is not None,
+        "expires": expires,
+    }
+
+
 def load_ownership(repo_root, unit_ids, *, now) -> dict:
     """{unit_id: (owner_row, ...)} for every unit the record covers; units
     the record does not reach are absent, never present-and-empty.
@@ -84,8 +126,15 @@ def load_ownership(repo_root, unit_ids, *, now) -> dict:
     element is gone), chain, why, via (the record node that covered the
     unit -- a folder when ownership is inherited), guest (an expiry is
     set) and expires. The reduction mirrors the record library: latest
-    line wins per (node, exact chain); the longest matching node prefix
-    owns the unit; two chains both on are two owners; an expiry on the
+    line wins per (node, exact chain). A folder unit (ends with "/") keeps
+    the plain longest-prefix rule. A file unit answers with its own
+    exact on-records first, then the on-records standing at the nearest
+    covering folder (the longest folder node reaching it) -- a file claim
+    adds a row beside its folder's, it does not replace it, and a
+    sub-folder's own claim carves its subtree out of any outer folder --
+    one row per standing on-record, always: two records whose chains both
+    resolve to the same holder are two owners sharing that holder, never
+    merged into one. Two chains both on are two owners; an expiry on the
     acting holder rolls the answer up the surviving prefix against the
     caller's `now` -- this function reads no clock of its own."""
     path = Path(repo_root) / RESPONSIBILITY_RELPATH
@@ -101,40 +150,38 @@ def load_ownership(repo_root, unit_ids, *, now) -> dict:
         standing[(rec["node"], tuple(rec["chain"]))] = rec
     overlay = {}
     for unit in unit_ids:
-        # Every standing record whose node reaches this unit, any state --
-        # an OFF standing at a deeper node must still take the winning
-        # length, masking a shallower ON, exactly as the record library
-        # decides it.
-        matches = [rec for rec in standing.values()
-                   if _covers(rec["node"], unit)]
-        if not matches:
-            continue
-        # The longest matching node string owns the unit.
-        winning = max(len(rec["node"]) for rec in matches)
-        rows = []
-        for rec in matches:
-            if len(rec["node"]) != winning or rec["state"] != "on":
+        if unit.endswith("/"):
+            # Folder query: today's rule, unchanged -- the longest
+            # covering node wins alone, whatever its depth.
+            matches = [rec for rec in standing.values()
+                       if _covers(rec["node"], unit)]
+            if not matches:
                 continue
-            chain = tuple(rec["chain"])
-            expires = rec.get("expires")
-            # Walk root-first; the expiry applies to the acting holder
-            # alone, so a passed expiry ends the walk before the last
-            # element and the answer rolls up the surviving prefix.
-            live = []
-            for position, holder in enumerate(chain):
-                acting = position == len(chain) - 1
-                if acting and expires is not None \
-                        and now >= _parse_ts(expires):
-                    break
-                live.append(holder)
-            rows.append({
-                "holder": live[-1] if live else None,
-                "chain": chain,
-                "why": rec.get("why", ""),
-                "via": rec["node"],
-                "guest": expires is not None,
-                "expires": expires,
-            })
+            winning = max(len(rec["node"]) for rec in matches)
+            rows = [_row_for(rec, now) for rec in matches
+                    if len(rec["node"]) == winning and rec["state"] == "on"]
+        else:
+            # File query: every record standing at the exact node...
+            exact = [rec for rec in standing.values() if rec["node"] == unit]
+            # ...plus every folder node that covers this file, ON OR OFF --
+            # an off record must still be counted here, or a nearer folder
+            # that is off would stop masking the outer folder and an outer
+            # on-record would wrongly reach past the nearer one
+            folders = [rec for rec in standing.values()
+                       if rec["node"].endswith("/")
+                       and _covers(rec["node"], unit)]
+            # the exact rows resolve first, in their own standing order,
+            # on-only
+            rows = [_row_for(rec, now) for rec in exact
+                    if rec["state"] == "on"]
+            if folders:
+                # only the longest (nearest) covering folder node is
+                # consulted -- an outer folder never reaches past a nearer
+                # one
+                nearest = max(len(rec["node"]) for rec in folders)
+                rows.extend(_row_for(rec, now) for rec in folders
+                            if len(rec["node"]) == nearest
+                            and rec["state"] == "on")
         if rows:
             overlay[unit] = tuple(rows)
     return overlay

{ambitgraph-0.8.2 → ambitgraph-0.8.4/ambitgraph.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ambitgraph
-Version: 0.8.2
+Version: 0.8.4
 Summary: Read-only codebase scan: reusable units, families, roles, ownership candidates, duplication.
 Author: AmbitGraph
 License: Proprietary

{ambitgraph-0.8.2 → ambitgraph-0.8.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ambitgraph"
-version = "0.8.2"
+version = "0.8.4"
 description = "Read-only codebase scan: reusable units, families, roles, ownership candidates, duplication."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -67,3 +67,8 @@ ambit_map = ["ambit-map-enrich.md", "ambit-mapllm-contract.md"]
 [tool.pytest.ini_options]
 testpaths = ["tests"]
 pythonpath = ["."]
+# an unregistered mark refuses instead of silently selecting nothing
+addopts = "--strict-markers"
+markers = [
+    "timing: asserts on a measured duration, a deadline wait, or a product timing constant; runs in the timing leg under a machine window",
+]