augplot 0.1.1__tar.gz → 0.2.0__tar.gz

augplot-0.2.0/CHANGELOG.md

@@ -0,0 +1,37 @@
+# Changelog
+
+All notable changes to Augplot are documented in this file.
+
+## [0.2.0] - 2026-09-23
+
+### Changed
+
+- Replace the plotting capability manifest with a smaller security-focused validator.
+  Common Pandas/NumPy transformations, local assignments, and data-sized loops now work
+  without method-by-method approval.
+- Keep checks for imports, file and network access, subprocess and dynamic execution,
+  reflection, active rendering options, and obvious resource bombs.
+- Shorten generation guidance and invalidate cached code accepted under the old policy.
+- Report generation and repair progress, including a notice after 20 seconds of waiting.
+- Improve chart guidance for titles, legends, labels, uncertainty notes, and spacing.
+- Refresh the quickstart notebook and add an anonymized cross-validation walkthrough.
+
+## [0.1.1] - 2026-09-23
+
+### Changed
+
+- Broaden guarded plotting compatibility for timeline annotations, axis styling,
+  data-sized positions, and additional Pandas and NumPy data shapes.
+
+## [0.1.0] - 2026-09-22
+
+Initial beta release.
+
+### Added
+
+- Notebook-first `plot`, `refine`, `render`, and `to_python` workflow.
+- Support for Pandas objects, NumPy arrays, lists, and nested dictionaries.
+- Persistent visualization history for replaying and revising generated plots.
+- Validated local execution of generated Matplotlib and Seaborn code.
+- Strict JSON Schema model responses with explicit provider capability checks.
+- Seaborn example-dataset loading and a quickstart notebook.

{augplot-0.1.1 → augplot-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: augplot
-Version: 0.1.1
+Version: 0.2.0
 Summary: Turn notebook data into visualizations and reusable Python with an LLM.
 Project-URL: Repository, https://github.com/egpand/augplot
 Project-URL: Documentation, https://github.com/egpand/augplot/tree/main/docs
@@ -78,6 +78,11 @@ viz.to_python(function_name="plot_monthly_passengers")
 Open or download the [example notebook](examples/quickstart.ipynb) to try the complete
 workflow.
 
+For nested cross-validation results, try the
+[model comparison notebook](examples/cross-validation-model-comparison.ipynb). It starts
+with an inline results dictionary, successive refinements, and an intentional
+`ScopeError` example.
+
 ## What can `data` be?
 
 `ap.plot(data)` accepts these nonempty, in-memory Python objects:
@@ -173,7 +178,7 @@ but does not train models or return predictions, forecasts, or other analytical
 
 ## Beta and security
 
-Augplot 0.1.1 is a beta release; APIs and saved-history formats may change before 1.0.
+Augplot 0.2.0 is a beta release; APIs and saved-history formats may change before 1.0.
 Review generated code before sensitive or security-critical use, and report
 vulnerabilities through the [security policy](SECURITY.md).
 

{augplot-0.1.1 → augplot-0.2.0}/README.md

@@ -40,6 +40,11 @@ viz.to_python(function_name="plot_monthly_passengers")
 Open or download the [example notebook](examples/quickstart.ipynb) to try the complete
 workflow.
 
+For nested cross-validation results, try the
+[model comparison notebook](examples/cross-validation-model-comparison.ipynb). It starts
+with an inline results dictionary, successive refinements, and an intentional
+`ScopeError` example.
+
 ## What can `data` be?
 
 `ap.plot(data)` accepts these nonempty, in-memory Python objects:
@@ -135,7 +140,7 @@ but does not train models or return predictions, forecasts, or other analytical
 
 ## Beta and security
 
-Augplot 0.1.1 is a beta release; APIs and saved-history formats may change before 1.0.
+Augplot 0.2.0 is a beta release; APIs and saved-history formats may change before 1.0.
 Review generated code before sensitive or security-critical use, and report
 vulnerabilities through the [security policy](SECURITY.md).
 

{augplot-0.1.1 → augplot-0.2.0}/SECURITY.md

@@ -2,12 +2,13 @@
 
 ## Supported versions
 
-Augplot is currently in beta. Security fixes are provided for the latest `0.1.x`
+Augplot is currently in beta. Security fixes are provided for the latest `0.2.x`
 release and the `main` branch.
 
 | Version | Supported |
 | --- | --- |
-| 0.1.x | Yes |
+| 0.2.x | Yes |
+| 0.1.x | No |
 | Earlier versions | No |
 
 ## Reporting a vulnerability

{augplot-0.1.1 → augplot-0.2.0}/docs/api.md

@@ -48,6 +48,10 @@ plt = ap.plot(
 | `show` | Display the resulting figure in the notebook. |
 | `regenerate` | Request new code instead of replaying the matching saved step. |
 
+Fresh generations print the current attempt (`plotting` or `repairing`) and when returned
+code is checked. A request still waiting after 20 seconds prints another status line.
+Saved-history replays do not make model requests or print these progress messages.
+
 ## Refine the current chart
 
 ```python

augplot-0.2.0/docs/generated-code-guardrails.md

@@ -0,0 +1,66 @@
+# Generated-code guardrails
+
+Augplot validates model-generated Python before running it in the notebook process.
+The 0.2.0 validator focuses on security-sensitive operations and obvious resource
+bombs. It is a defense-in-depth check, **not an operating-system sandbox**. Python
+libraries can have side effects that static checks cannot reliably identify.
+
+## Generated-code contract
+
+Code defines one undecorated `plot_data(data, *, title=None, figsize=None)` function,
+imports approved plotting/data libraries inside it, and returns a Matplotlib Figure.
+The returned value is checked at runtime. Augplot passes a copy of the input data
+and closes figures opened during execution. Generated source may use ordinary Pandas
+and NumPy transformations, assignment to local data, loops, comprehensions, and
+Matplotlib or Seaborn plotting APIs. There is no chart-type or artist-method manifest.
+
+## Security checks
+
+The validator rejects:
+
+- Imports outside NumPy, Pandas, Matplotlib pyplot/ticker/dates, and Seaborn; Seaborn
+  imports also require a compatible backend.
+- File, network, subprocess, environment, serialization, and plot-export APIs,
+  including read/write/save methods and module-internal traversal.
+- Dynamic execution, indirect calls, private/dunder access, nested definitions,
+  reflection routes, and active rendering options such as external URLs or `usetex`.
+- Pandas string dispatch to arbitrary method names and explicit plotting-backend
+  selection. Simple aggregation names and direct safe NumPy functions are accepted.
+- Oversized source, ASTs, literals, numeric ranges, static array allocations,
+  subplot grids, figure dimensions, and format widths.
+
+For example, these are rejected before compilation:
+
+```python
+pd.read_csv("https://example.invalid/data.csv")
+frame.to_pickle("chart.pkl")
+fig.savefig("chart.png")
+```
+
+The checks are intentionally modest. Data-sized loops and allocations are allowed,
+so a large input or expensive plotting operation can still use substantial CPU or
+memory. The AST rules reduce obvious side effects but cannot guarantee that every
+public third-party method is side-effect free. Do not use Augplot with sensitive data
+where executing model-produced Python is unacceptable.
+
+## Validation failures and saved plots
+
+Fresh model output receives at most the configured repair attempt (`max_repairs=1` by
+default). The repair request contains a sanitized validation diagnostic, not data
+values or a runtime exception message. If repair fails, `ap.plot()` raises
+`GenerationError`; rejected source is not executed, displayed, exported, or saved.
+
+```python
+try:
+    viz = ap.plot(data, prompt="...")
+except ap.GenerationError as exc:
+    print(exc)
+    print(exc.violations)
+    print(exc.code)
+```
+
+Saved source is revalidated on every replay. The validator version is part of the
+cache identity and metadata, so code accepted under an older policy is not silently
+reused. A cache checksum establishes file integrity, not trust. If saved code is
+rejected, Augplot does not make an automatic model request; use `regenerate=True`
+when you want new code.