bindery-cli 0.41.0__tar.gz → 0.41.1__tar.gz

{bindery_cli-0.41.0 → bindery_cli-0.41.1}/.github/workflows/publish.yml

@@ -74,7 +74,13 @@ jobs:
       # The tag message IS the release's patchnotes entry (verbatim, per the
       # tagging procedure), so the release body is extracted from the tag
       # object rather than paraphrased here. Without it the release page
-      # renders blank beside the zip.
+      # renders blank beside the zip. The checkout is depth-1 and carries no
+      # tag objects, so the tag ref is fetched explicitly first (without
+      # this, `git tag -l` lists nothing and the release body silently falls
+      # back to the commit message).
+      - name: Fetch the tag object
+        run: git fetch --no-tags origin "refs/tags/${GITHUB_REF_NAME}:refs/tags/${GITHUB_REF_NAME}"
+
       - name: Extract the release body from the tag message
         run: git tag -l --format='%(contents)' "${GITHUB_REF_NAME}" > release-body.md
 

{bindery_cli-0.41.0 → bindery_cli-0.41.1}/CLAUDE.md

@@ -82,7 +82,7 @@ Born from the 2026 library audit (see the user memory `calibre-library-epubcheck
 
 ## Layout
 
-- `src/bindery/transforms.py`: pure `str -> (str, int)` text transforms (including `strip_broken_tags`). Since v0.32.0: `strip_attrs_in_start_tags` anchors attribute edits on the quote-aware start-tag matcher, `_outside_protected` forwards arguments (context-carrying transforms can be decorated), `fix_id_colons` matches only the bare `id` attribute and only internal fragments (`fix_ncx_src_fragments` carries renames into the NCX), `fix_ncx_playorder` is anchored to `<navPoint>` start tags, and the css selector boundary covers namespaced and functional selector forms. Since v0.37.0: `fix_ncx_playorder` strips quotes before its already-correct comparison (regex groups carry quote characters; comparing quoted values against bare numbers counted phantom fixes on every sequential NCX and rewrote single-quoted correct attributes to double quotes).
+- `src/bindery/transforms.py`: pure `str -> (str, int)` text transforms (including `strip_broken_tags`). Since v0.32.0: `strip_attrs_in_start_tags` anchors attribute edits on the quote-aware start-tag matcher, `_outside_protected` forwards arguments (context-carrying transforms can be decorated), `fix_id_colons` matches only the bare `id` attribute and only internal fragments (`fix_ncx_src_fragments` carries renames into the NCX), `fix_ncx_playorder` is anchored to `<navPoint>` start tags, and the css selector boundary covers namespaced and functional selector forms. HAZARD (the 0.41.0 spin): the quote-aware tag-prefix alternation (double-quoted | single-quoted | [^>]) OVERLAPS ([^>] matches quotes too), so a plain `*` re-partitions exponentially on failing candidates; every such loop must carry the possessive `*+` (re 3.11+, the plugin's minimum Calibre). Since v0.37.0: `fix_ncx_playorder` strips quotes before its already-correct comparison (regex groups carry quote characters; comparing quoted values against bare numbers counted phantom fixes on every sequential NCX and rewrote single-quoted correct attributes to double quotes).
 - `src/bindery/pagination.py`: the opt-in lossy page-number strip (runhead detection, page-layer decision, block-centric removal/merge, safety nets).
 - `src/bindery/watermark.py`: the opt-in lossy watermark strip (anchored and anchorless signature removal).
 - `src/bindery/reserialize.py`: structural repair via `html5lib`.

{bindery_cli-0.41.0 → bindery_cli-0.41.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: bindery-cli
-Version: 0.41.0
+Version: 0.41.1
 Summary: Audit EPUB body text and repair broken EPUBs with deterministic, epubcheck-gated fixes; atomic in-place replacement in a Calibre library.
 Project-URL: Homepage, https://github.com/VirInvictus/bindery-cli
 Project-URL: Repository, https://github.com/VirInvictus/bindery-cli

{bindery_cli-0.41.0 → bindery_cli-0.41.1}/patchnotes.md

@@ -1,4 +1,42 @@
 # bindery-cli Patch Notes
+## v0.41.1 (2026-09-15)
+
+### The 0.41.0 CPU-spin regression: possessive bounds on the quote-aware tag matchers
+
+- **The regression.** `repair --all` spun CPU indefinitely on real
+  books (found on a Hackett Aristotle *Physics* whose 843k-character
+  back-matter document is full of apostrophes and span candidates
+  whose closer never comes). 0.40.0 repaired the same book in seconds.
+  Brandon bisected it to 0.41.0 and root-caused it to the wheel diff:
+  the 0.41.0 quote-aware rewrite of `unwrap_block_in_inline`'s start
+  tag replaced the linear prefix with an overlapping alternation
+  (double-quoted | single-quoted | any-non-bracket), and because the
+  non-bracket branch also matches quote characters, every failing
+  candidate let the engine re-partition the prefix across the branches
+  exponentially. The flag-bisect had looked interaction-shaped because
+  earlier transforms move where the failing candidates sit; the regex
+  was input-sensitive, not the flags broken.
+- **The fix: possessive quantifiers.** The repeated group is now
+  possessive (`*+`, Python 3.11's `re`, the same floor as the plugin's
+  minimum Calibre): the engine commits to its first-alternative
+  consumption, which is the nearest-paired-quote path ending at the
+  first unquoted `>` (the correct tag end), and never re-partitions.
+  Failure becomes linear; successful matches are unchanged. Applied to
+  all three patterns the 0.41.0 commit rewrote:
+  `unwrap_block_in_inline` (the spinner), `unwrap_illegal_tags`, and
+  `downgrade_epub3_tags`. The pre-existing quote-aware matchers
+  (`_VOID_RE`, the OPF tag matchers) were tested against the same
+  shape and do not spin; their audit is a recorded follow-up box.
+- **Verified on the fixture.** The transform went from still-spinning
+  at 15 seconds to 0.01 seconds; the recorded reproduction
+  (`repair --all --force`) completes in 7.7 seconds (epubcheck's own
+  time) with output identical to the 0.40.0 shape
+  (cover_meta_repointed:1, pagelist_class_added:1, ncx_uid_synced).
+  Two regression tests pin it: the spin shape itself (a span followed
+  by a 40k-character apostrophe run with no `>`: the old pattern
+  provably cannot finish it) and the quote-aware function the rewrite
+  was for (a `>` inside an attribute value).
+
 ## v0.41.0 (2026-09-15)
 
 ### The final-audit blitz: robust analyzers, the stub-docs strip, and a privacy untrack

bindery_cli-0.41.1/project.done

@@ -0,0 +1,57 @@
+# bindery-cli: project.done
+
+Completed: 2026-09-15 (THE FINAL BLITZ, repo agent lane)
+Range: 2b9f24e (analyzer trio) through f47fc8f (ci tag-fetch fix), on main,
+pushed; CI green throughout; v0.41.0 tagged and published to PyPI.
+
+## What shipped
+
+- The analyzer-robustness trio: spineless-EPUB verdicts, per-book try
+  coverage, the corrupt-container CORRUPT verdict, the DRM false-EMPTY fix.
+- The phase3 aggregate-summary fix (applied/equal states only,
+  rejected_projection line, Ghost Brigades regression test).
+- Six features: `bindery doctor`, `repair --json FILE`, `--strip-stub-docs`
+  (the lossy lane's live fixture, Brandon-approved), plugin log rotation,
+  `--backup-keep N` ring, the fast_sweep count-scale pin.
+- The robustness LOW batch (quote-aware matchers, raw-name resolution,
+  atomic backups, rglob filter, mojibake-uid guard, daemon tempdir sweep,
+  apply-failure accounting, relative_to guard).
+- The privacy untrack of testing_facility/top500candidates/REPORT.md
+  (forward-only; Brandon's ruling).
+- The GitHub batch: release bodies via body_path + three backfills, the
+  description rewrite, [project.urls], topics swap, wiki off, the
+  redundant suite run removed, concurrency blocks, checkout alignment,
+  the release action SHA-pinned; plus a v*.*.* tag ruleset (admin bypass)
+  and the pypi environment restricted to tag pushes (Brandon's rulings).
+- Docs truth batches: one canonical repair inventory in spec.md, the audit
+  exit-code contract, the epubcheck install paragraph, the flag-list move,
+  the mimetype-fix counts, the degrades-safely correction, the
+  comment/docstring truth pass, the em-dash sweep and the "honest" tic.
+- Dead code removed on a recorded go: validate's `_daemon` alias, cli's
+  `done_count`, audit's `sys.path.insert`.
+- Hygiene: REPORT-12-Sept.md retired per the BINDERY_REPORT precedent; the
+  derived litter deleted (test_facility/__pycache__, FastSweepExtract.class,
+  venv/ + .venv_ci/).
+- Tests: 445 -> 474, all green; ruff 0.16.2 clean.
+
+## Reopen conditions (recorded future work)
+
+1. top500candidates/REPORT.md history strip: declined (forward-only only).
+   If ever wanted: filter-repo the file out, re-tag every affected release
+   verbatim, disable publish.yml around the push (force-push class).
+2. Stranger-facing XML hardening (dependency ask pending): a stdlib
+   per-entry size cap in load_book plus defusedxml-style entity-expansion
+   gating. Trigger: a real 3.12/3.13 stranger audience. Roadmap boxed.
+3. MobileRead listing for the Bindery Repair plugin: Brandon's manual
+   posting step; roadmap boxed with the material listed.
+4. README screenshot regeneration against a synthetic library: pending
+   Brandon's call; the current PNG still shows real library rows.
+5. Boxed M feature set: --encode-url-spaces entry renames (280-book
+   PKG-010 class), the cover advisory analyzer, the audit-refresh
+   deep-dive, the NCX<->nav drift detector.
+6. Boxed internal refactors: RepairFlags dataclass for the triplicated
+   kwarg signature; shared roman/arabic number helpers for pagination.py
+   and audit.py.
+7. Cross-repo note under decision #117: cquarry, CalibreQuarry, and
+   vir-tui should mirror the tag ruleset + pypi environment policy this
+   repo adopted.

{bindery_cli-0.41.0 → bindery_cli-0.41.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bindery-cli"
-version = "0.41.0"
+version = "0.41.1"
 description = "Audit EPUB body text and repair broken EPUBs with deterministic, epubcheck-gated fixes; atomic in-place replacement in a Calibre library."
 readme = "README.md"
 classifiers = [

{bindery_cli-0.41.0 → bindery_cli-0.41.1}/roadmap.md

@@ -1849,3 +1849,35 @@ four interpreter families.
       stdlib-only rule and adds a vendored plugin dep): trigger is a
       real 3.12/3.13 stranger audience, not a hypothetical.
 - [x] **vir-tui floor >=2.5.0 + lock refresh** (2026-09-14, no release cut: upstream 2.4.0/2.5.0 are additive terminal-safety and session-awareness releases; only the vir-tui resolution moved in the lock, the cquarry lag rule is untouched). *(Mention the floor bump in the next release's patchnotes.)*
+
+- [x] **REGRESSION (0.41.0) FIXED in v0.41.1: the repair --all CPU
+      spin on the Physics fixture was catastrophic backtracking in the
+      rewritten `unwrap_block_in_inline` regex** (SHIPPED 2026-09-15,
+      176906f): the quote-aware alternation's branches overlap ([^>]
+      also matches quotes), so failing candidates re-partitioned the
+      prefix exponentially. All three patterns the 0.41.0 commit
+      rewrote (`unwrap_block_in_inline`, `unwrap_illegal_tags`,
+      `downgrade_epub3_tags`) are now possessive-bounded (`*+`, re
+      3.11+ = the plugin's minimum Calibre floor): the committed
+      first-alternative path is the correct tag end, failure is
+      linear, successful matches are unchanged. Verified on Brandon's
+      fixture: the transform went from still-spinning at 15s to
+      0.01s; the recorded repro (`repair --all --force`) completes in
+      7.7s with output identical to the 0.40.0 shape. Regression
+      tests: the spin shape (the old pattern provably cannot finish
+      it) and the quote-aware function. Root-cause note preserved from
+      the report: the flag-bisect looked interaction-shaped because
+      earlier transforms move where failing candidates sit; the regex
+      was input-sensitive, not the flags broken. Unpin 0.40.0 once
+      0.41.1 is installed.
+- [ ] **Audit the remaining quote-aware tag matchers for the same
+      overlap ambiguity** (follow-up from the 0.41.1 hotfix): _VOID_RE
+      and the OPF matchers (cover meta, guide reference,
+      spine/item/itemref) share the overlapping-alternation shape but
+      were tested against the spin shape and do not blow up (the lazy
+      loop and always-matching candidates behave differently;
+      _VOID_RE's failure mode on a quote-run with no reachable `>` is
+      quadratic at worst, and it can match surprisingly far across
+      quoted spans, pre-existing since 0.40.0). Decide per matcher:
+      possessive-bound for uniformity, or document why the shape is
+      safe there. Never a third grammar copy.

{bindery_cli-0.41.0 → bindery_cli-0.41.1}/src/bindery/__init__.py

@@ -11,7 +11,7 @@ Calibre plugin built from this core.
 Single source of truth for the version. pyproject.toml must match VERSION below.
 """
 
-VERSION = "0.41.0"
+VERSION = "0.41.1"
 __version__ = VERSION
 
 from .epub import RepairReport, repair_epub  # noqa: E402

{bindery_cli-0.41.0 → bindery_cli-0.41.1}/src/bindery/epub.py

@@ -588,9 +588,12 @@ def downgrade_epub3_tags(
             return f"</{new}>"
 
         # quote-aware attrs group (same shape as the manifest matchers): a
-        # `>` inside an attribute value must not end the tag early
+        # `>` inside an attribute value must not end the tag early. The
+        # branches overlap ([^>] also matches quotes), so the possessive
+        # `*+` bounds the re-partitioning that spun CPU on failing
+        # candidates in 0.41.0 (see transforms.unwrap_block_in_inline).
         text = re.sub(
-            rf"""<{tag}\b((?:"[^"]*"|'[^']*'|[^>])*)>""",
+            rf"""<{tag}\b((?:"[^"]*"|'[^']*'|[^>])*+)>""",
             repl_open,
             text,
             flags=re.IGNORECASE,

{bindery_cli-0.41.0 → bindery_cli-0.41.1}/src/bindery/transforms.py

@@ -374,8 +374,19 @@ def unwrap_block_in_inline(s: str) -> tuple[str, int]:
         return m.group(1)
 
     s, n = re.subn(
-        r"""<span(?:(?:"[^"]*"|'[^']*'|[^>])*)>\s*"""
-        r"""(<(div|p|blockquote)(?:(?:"[^"]*"|'[^']*'|[^>])*)>.*?</\2>)\s*</span>""",
+        # The quote-aware branches OVERLAP ([^>] also matches quote
+        # characters), so a plain `*` lets the engine re-partition the start
+        # tag exponentially across them on every failing candidate: on a
+        # 843k-char doc full of <span>s whose closer never comes, 0.41.0
+        # spun CPU indefinitely (the Physics-fixture regression,
+        # roadmap 2026-09-15). The possessive `*+` commits to the
+        # first-alternative consumption (ending at the first unquoted `>`,
+        # which is the correct tag end) and never re-partitions: linear on
+        # failure, same matches on success. `re` has had possessive
+        # quantifiers since 3.11, the same floor as the plugin's minimum
+        # Calibre.
+        r"""<span(?:(?:"[^"]*"|'[^']*'|[^>])*+)>\s*"""
+        r"""(<(div|p|blockquote)(?:(?:"[^"]*"|'[^']*'|[^>])*+)>.*?</\2>)\s*</span>""",
         repl,
         s,
         flags=re.IGNORECASE | re.DOTALL,
@@ -503,9 +514,15 @@ def unwrap_illegal_tags(
             continue
         # quote-aware start-tag match (same shape as _VOID_RE): a `>` inside
         # an attribute value would otherwise end the match early and mangle
-        # the tag into a malformed edit the gate then rejects
+        # the tag into a malformed edit the gate then rejects. The branches
+        # overlap ([^>] also matches quotes), so the possessive `*+` bounds
+        # the re-partitioning that spun CPU on failing candidates in 0.41.0
+        # (see unwrap_block_in_inline).
         s, n1 = re.subn(
-            rf"""<{tag}\b(?:(?:"[^"]*"|'[^']*'|[^>])*)>""", "", s, flags=re.IGNORECASE
+            rf"""<{tag}\b(?:(?:"[^"]*"|'[^']*'|[^>])*+)>""",
+            "",
+            s,
+            flags=re.IGNORECASE,
         )
         s, n2 = re.subn(rf"</{tag}\s*>", "", s, flags=re.IGNORECASE)
         count += n1 + n2

{bindery_cli-0.41.0 → bindery_cli-0.41.1}/tests/test_transforms.py

@@ -389,6 +389,38 @@ class TestProtectedSpans(unittest.TestCase):
         out, n = unwrap_illegal_tags("<p>a<w>x</w>b<st>c</st></p>")
         self.assertEqual((out, n), ("<p>axbc</p>", 4))
 
+    def test_span_wrapping_block_with_gt_in_attribute_unwraps(self):
+        # the reason the start-tag match is quote-aware at all: the `>` of
+        # "a>b" is attribute content, and the span still wraps a block
+        text = '<p><span title="a>b"><div class="k">x</div></span>tail</p>'
+        out, n = unwrap_block_in_inline(text)
+        self.assertEqual((out, n), ('<p><div class="k">x</div>tail</p>', 1))
+
+    def test_failing_span_candidate_cannot_backtrack_explode(self):
+        # REGRESSION (0.41.0, the Physics fixture): the quote-aware prefix
+        # branches overlap ([^>] also matches quote characters), so in a
+        # long apostrophe-rich run with no `>` after a <span, the engine
+        # re-partitioned the prefix exponentially on the failing match and
+        # spun CPU indefinitely (an 843k-char back-matter document never
+        # finished). The possessive `*+` commits to the first partition and
+        # makes failure linear. This shape is the guard: the old pattern
+        # cannot finish this function call at all.
+        import signal
+        import time
+
+        run = "don't can't won't it's a>kind of prose, isn't it " * 2000
+        doc = "<p><span class='broken " + run + "and no closer.</p>"
+        signal.alarm(20)  # belt: fail the test, never hang the suite
+        try:
+            t0 = time.perf_counter()
+            out, n = unwrap_block_in_inline(doc)
+            elapsed = time.perf_counter() - t0
+        finally:
+            signal.alarm(0)
+        self.assertEqual(n, 0)
+        self.assertEqual(out, doc)  # nothing matched: byte-for-byte
+        self.assertLess(elapsed, 5.0)
+
     def test_illegal_tag_with_gt_in_attribute_value_is_removed_whole(self):
         # a bare [^>]* matcher ended the start tag at the `>` inside the
         # attribute value, mangled the edit, and the gate rejected the run

{bindery_cli-0.41.0 → bindery_cli-0.41.1}/uv.lock

@@ -8,7 +8,7 @@ resolution-markers = [
 
 [[package]]
 name = "bindery-cli"
-version = "0.41.0"
+version = "0.41.1"
 source = { editable = "." }
 dependencies = [
     { name = "cquarry", marker = "python_full_version >= '3.14'" },