igittigitt 2.2.2__tar.gz → 2.2.4__tar.gz

{igittigitt-2.2.2 → igittigitt-2.2.4}/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "igittigitt",
   "description": "Parse .gitignore files and filter/whitelist large numbers of paths in .gitignore style from Python or the shell. Ships the python-gitignore skill: install, configure (config-deploy + config.d overrides), library API (IgnoreParser/IncludeParser, shutil.copytree filter), the CLI, and bash piping.",
-  "version": "1.0.1",
+  "version": "2.2.6",
   "author": {
     "name": "bitranox"
   },

{igittigitt-2.2.2 → igittigitt-2.2.4}/.env.example

@@ -11,83 +11,6 @@ PYPI_API_TOKEN=
 GITHUB_TOKEN=
 
 
-# ==============================================================================
-# Email Configuration (SMTP)
-# ==============================================================================
-#
-# Naming Convention
-# -----------------
-# Format: <SECTION>__<KEY>=value (double underscore separates section from key)
-# Lists use comma-separated values, booleans use true/false, floats use decimal notation.
-#
-# Full environment variable (outside .env):
-#   IGITTIGITT___EMAIL__<KEY>=value
-#   (triple underscore separates the application slug from the section)
-
-# Purpose: SMTP servers for email delivery, tried in order (host:port, comma-separated)
-# Type: comma-separated strings in "host[:port]" format
-# Default: (empty, must be configured to send email)
-# Environment Variable: IGITTIGITT___EMAIL__SMTP_HOSTS=smtp.example.com:587
-# .env: EMAIL__SMTP_HOSTS=smtp.example.com:587
-# EMAIL__SMTP_HOSTS=smtp.example.com:587
-
-# Purpose: Default sender address for outgoing emails
-# Type: string (valid email address)
-# Default: (empty, must be configured or passed via --from)
-# Environment Variable: IGITTIGITT___EMAIL__FROM_ADDRESS=noreply@example.com
-# .env: EMAIL__FROM_ADDRESS=noreply@example.com
-# EMAIL__FROM_ADDRESS=noreply@example.com
-
-# Purpose: Default recipient addresses (comma-separated)
-# Type: comma-separated strings (valid email addresses)
-# Default: (empty, must be configured or passed via --to)
-# Environment Variable: IGITTIGITT___EMAIL__RECIPIENTS=admin@example.com,ops@example.com
-# .env: EMAIL__RECIPIENTS=admin@example.com,ops@example.com
-# EMAIL__RECIPIENTS=admin@example.com,ops@example.com
-
-# Purpose: SMTP authentication username
-# Type: string
-# Default: (empty, no authentication)
-# Environment Variable: IGITTIGITT___EMAIL__SMTP_USERNAME=noreply@example.com
-# .env: EMAIL__SMTP_USERNAME=noreply@example.com
-# EMAIL__SMTP_USERNAME=noreply@example.com
-
-# Purpose: SMTP authentication password
-# Type: string
-# Default: (empty, no authentication)
-# Environment Variable: IGITTIGITT___EMAIL__SMTP_PASSWORD=your-app-password
-# .env: EMAIL__SMTP_PASSWORD=your-app-password
-# EMAIL__SMTP_PASSWORD=your-app-password
-
-# Purpose: Enable STARTTLS negotiation before authentication
-# Type: boolean (true/false)
-# Default: true
-# Environment Variable: IGITTIGITT___EMAIL__USE_STARTTLS=true
-# .env: EMAIL__USE_STARTTLS=true
-# EMAIL__USE_STARTTLS=true
-
-# Purpose: Socket timeout in seconds for SMTP operations
-# Type: float
-# Default: 30.0
-# Environment Variable: IGITTIGITT___EMAIL__TIMEOUT=30.0
-# .env: EMAIL__TIMEOUT=30.0
-# EMAIL__TIMEOUT=30.0
-
-# Purpose: Raise FileNotFoundError when attachment files are missing
-# Type: boolean (true/false)
-# Default: true
-# Environment Variable: IGITTIGITT___EMAIL__RAISE_ON_MISSING_ATTACHMENTS=true
-# .env: EMAIL__RAISE_ON_MISSING_ATTACHMENTS=true
-# EMAIL__RAISE_ON_MISSING_ATTACHMENTS=true
-
-# Purpose: Raise ValueError when recipient addresses are invalid
-# Type: boolean (true/false)
-# Default: true
-# Environment Variable: IGITTIGITT___EMAIL__RAISE_ON_INVALID_RECIPIENT=true
-# .env: EMAIL__RAISE_ON_INVALID_RECIPIENT=true
-# EMAIL__RAISE_ON_INVALID_RECIPIENT=true
-
-
 # ==============================================================================
 # Logging Configuration (lib_log_rich)
 # ==============================================================================
@@ -95,7 +18,14 @@ GITHUB_TOKEN=
 # Naming Convention
 # -----------------
 # Format: <SECTION>__<KEY>=value (double underscore separates section from key)
-# Strings need no quotes. Booleans: true/false. Floats: 1.0. Lists: comma-separated.
+# Strings need no quotes. An unquoted value is converted (in .env and in the environment
+# alike): true/false become booleans, null/none become None, a JSON array or object is parsed,
+# and a number becomes a number only when it converts back to the same text (007 and 1.50 stay
+# text); quote a .env value to keep it as text. A list is a JSON array and a table a JSON
+# object, written UNQUOTED in .env (LIB_LOG_RICH__CONSOLE_STYLES={"ERROR":"bold red"}), or one
+# key per entry (LIB_LOG_RICH__SCRUB_PATTERNS__API_KEY=.+). A comma-separated value is NOT a
+# list or a table: it arrives as ONE string and is refused. In the environment, quote a JSON
+# value for the shell: IGITTIGITT___LIB_LOG_RICH__RATE_LIMIT='[100,60]'.
 #
 # Full environment variable (outside .env):
 #   IGITTIGITT___LIB_LOG_RICH__<KEY>=value
@@ -157,12 +87,12 @@ GITHUB_TOKEN=
 # .env: LIB_LOG_RICH__CONSOLE_THEME=dark
 # LIB_LOG_RICH__CONSOLE_THEME=dark
 
-# Purpose: Override Rich styles per severity level (comma-separated LEVEL=style pairs)
-# Type: comma-separated LEVEL=style pairs
+# Purpose: Override Rich styles per severity level
+# Type: table of LEVEL = style (a JSON object keeps the level names upper case)
 # Default: (empty, uses theme defaults)
-# Environment Variable: IGITTIGITT___LIB_LOG_RICH__CONSOLE_STYLES=DEBUG=dim,ERROR=bold red
-# .env: LIB_LOG_RICH__CONSOLE_STYLES=DEBUG=dim,ERROR=bold red
-# LIB_LOG_RICH__CONSOLE_STYLES=DEBUG=dim,ERROR=bold red
+# Environment Variable: IGITTIGITT___LIB_LOG_RICH__CONSOLE_STYLES='{"DEBUG":"dim","ERROR":"bold red"}'
+# .env: LIB_LOG_RICH__CONSOLE_STYLES={"DEBUG":"dim","ERROR":"bold red"}
+# LIB_LOG_RICH__CONSOLE_STYLES={"DEBUG":"dim","ERROR":"bold red"}
 
 # Purpose: Force ANSI color output even when stderr is not a TTY
 # Type: boolean (true/false)
@@ -210,12 +140,12 @@ GITHUB_TOKEN=
 # .env: LIB_LOG_RICH__ENABLE_GRAYLOG=true
 # LIB_LOG_RICH__ENABLE_GRAYLOG=true
 
-# Purpose: Graylog server address (host:port)
-# Type: string "host:port"
+# Purpose: Graylog server address
+# Type: JSON array [host, port]; a "host:port" string is refused
 # Default: (none, must be configured to enable Graylog)
-# Environment Variable: IGITTIGITT___LIB_LOG_RICH__GRAYLOG_ENDPOINT=graylog.example.com:12201
-# .env: LIB_LOG_RICH__GRAYLOG_ENDPOINT=graylog.example.com:12201
-# LIB_LOG_RICH__GRAYLOG_ENDPOINT=graylog.example.com:12201
+# Environment Variable: IGITTIGITT___LIB_LOG_RICH__GRAYLOG_ENDPOINT='["graylog.example.com",12201]'
+# .env: LIB_LOG_RICH__GRAYLOG_ENDPOINT=["graylog.example.com",12201]
+# LIB_LOG_RICH__GRAYLOG_ENDPOINT=["graylog.example.com",12201]
 
 # Purpose: Transport protocol for Graylog (tcp, udp); TLS only supported with tcp
 # Type: string: "tcp", "udp"
@@ -309,19 +239,19 @@ GITHUB_TOKEN=
 
 # --- Security & Payload ---
 
-# Purpose: Regex patterns to redact sensitive data (comma-separated field=regex pairs)
-# Type: comma-separated field=regex pairs
-# Default: password=.+,secret=.+,token=.+
-# Environment Variable: IGITTIGITT___LIB_LOG_RICH__SCRUB_PATTERNS=password=.+,secret=.+,token=.+,api_key=.+
-# .env: LIB_LOG_RICH__SCRUB_PATTERNS=password=.+,secret=.+,token=.+,api_key=.+
-# LIB_LOG_RICH__SCRUB_PATTERNS=password=.+,secret=.+,token=.+,api_key=.+
+# Purpose: Regex patterns to redact sensitive data (field = regex)
+# Type: table of field = regex; merged with the defaults
+# Default: password = .+, secret = .+, token = .+
+# Environment Variable, one key per field: IGITTIGITT___LIB_LOG_RICH__SCRUB_PATTERNS__API_KEY=.+
+# .env, one key per field: LIB_LOG_RICH__SCRUB_PATTERNS__API_KEY=.+
+# LIB_LOG_RICH__SCRUB_PATTERNS__API_KEY=.+
 
-# Purpose: Throttle log emissions (MAX_EVENTS:WINDOW_SECONDS)
-# Type: string "max_events:window_seconds"
+# Purpose: Throttle log emissions (max_events per window_seconds)
+# Type: JSON array [max_events, window_seconds]; a "100:60" string is refused
 # Default: (none, no rate limiting)
-# Environment Variable: IGITTIGITT___LIB_LOG_RICH__RATE_LIMIT=100:60
-# .env: LIB_LOG_RICH__RATE_LIMIT=100:60
-# LIB_LOG_RICH__RATE_LIMIT=100:60
+# Environment Variable: IGITTIGITT___LIB_LOG_RICH__RATE_LIMIT='[100,60]'
+# .env: LIB_LOG_RICH__RATE_LIMIT=[100,60]
+# LIB_LOG_RICH__RATE_LIMIT=[100,60]
 
 # --- Payload Limits ---
 

{igittigitt-2.2.2 → igittigitt-2.2.4}/.gitignore

@@ -47,7 +47,8 @@ tmp_*
 __pycache__/
 src/igittigitt/__pycache__/
 *.py[cod]
-*$py.class     # other compiled artifacts
+# other compiled artifacts
+*$py.class
 
 # pytest, coverage, MyPy, Hypothesis
 .pytest_cache/
@@ -73,12 +74,15 @@ coverage.xml
 # source/package builds
 build/
 dist/
-*.egg-info/    # metadata for pip installs
+# metadata for pip installs
+*.egg-info/
 *.egg
 *.whl
 pip-wheel-metadata/
-*.manifest     # PyInstaller metadata
-*.spec         # PyInstaller spec files
+# PyInstaller metadata
+*.manifest
+# PyInstaller spec files
+*.spec
 
 # Eggs, parts, wheels, sdist, etc.
 develop-eggs/

igittigitt-2.2.4/CHANGELOG.md

@@ -0,0 +1,242 @@
+# Changelog
+
+All notable changes to this project will be documented in this file following
+the [Keep a Changelog](https://keepachangelog.com/) format.
+
+This project adheres to semantic versioning: MAJOR for incompatible API changes,
+MINOR for backwards-compatible functionality, PATCH for backwards-compatible fixes.
+
+## [Unreleased]
+
+## [2.2.4] 2026-10-08 10:19:56
+
+### Fixed
+
+- **`build_testing()` can run a command.** Every CLI command except `check` and `filter` binds job
+  context onto the process-global lib_log_rich runtime, but the testing composition's
+  `init_logging` was a no-op, so `info`, `config` and the deploy commands raised
+  `RuntimeError('lib_log_rich.init() must be called before using the logging API')` under
+  `build_testing()`. The in-memory initializer now starts a quiet runtime: journald, event log,
+  Graylog and the queue off, console at ERROR, and no `.env` loading.
+- **`main()` keeps the exit code of a command that exits through click's context.** rich_click's
+  `main()` returns the code of a `ctx.exit(N)` under `standalone_mode=False`; `main()` discarded
+  that return value and reported 0, and its `except click.exceptions.Exit` branch could never
+  fire. It now returns the code (exit code change: such a command exits N instead of 0).
+- **Conflicting `--set` overrides are a usage error.** `--set a.b=1 --set a.b.c=2` escaped as a
+  `TypeError` from the override nesting, and the other order, `--set a.b.c=2 --set a.b=1`,
+  silently dropped the earlier override. All `--set` values are now checked together and a key
+  that one gives a value and another puts a key under is refused, naming both (exit code change:
+  exit 2 for every command, where the second order used to exit 0). The same key given twice still
+  takes the last value; `a.b` and `a.bc` stay siblings.
+- **A broken configuration file no longer disables every command.** The root group loaded the
+  configuration before any subcommand option was parsed and let a load error escape, so a
+  malformed `config.toml`, a `.env` that is not UTF-8 or an unreadable file made every command,
+  `--help` and `config-deploy` (the command that replaces the file) exit 1. The root now records
+  the failure (`adapters/cli/config_load.py`): `config`, `check` and `filter`, which read the
+  configuration, refuse with exit 78 and one line naming the file, after the loader's traceback
+  with `--traceback`; `info`, `config-deploy`, `config-generate-examples` and help still run
+  (exit code change: 78 or 0 where every command exited 1). What the command line gets wrong is
+  checked before loading, so a broken file cannot hide it: a malformed or conflicting `--set` or
+  an invalid `--profile` name is a usage error (exit 2) for every command, where an invalid
+  root `--profile` used to exit 22 and an invalid `config-deploy --profile` failed inside the
+  deploy with exit 1. Any other exception from the loader is a bug and propagates as one.
+  `config --profile X` reloads with the root's `--env-file` instead of searching for another
+  `.env`.
+- **Logging takes only `LOG_*` lines from a `.env`.** `init_logging` called lib_log_rich's
+  `enable_dotenv()`, which copied every line of the nearest `.env` into the process environment,
+  so a later configuration load (`config --profile`, the deploy's permission read) took an
+  app-prefixed `.env` line for the environment layer: a prefixed `default_permissions` line in the
+  working directory's `.env` refused `config-deploy`, and a prefixed `[performance]` value showed
+  up in `config --profile`. Logging now copies only `LOG_*` lines, never over a variable that is
+  already set, from `--env-file` when given, otherwise from the nearest `.env` up to the project
+  root, without `chdir` and passing over unreadable directories; a `.env` that is not UTF-8 no
+  longer stops logging.
+- **An invalid `[lib_log_rich]` value is a configuration failure, not a crash of every command.**
+  A value lib_log_rich refuses (a wrong type, or its own range checks such as `queue_maxsize = 0`)
+  stopped every command with exit 22 and pydantic's multi-line report. It is now recorded like a load
+  failure: logging starts with its defaults, `config`, `check` and `filter` exit 78 with one
+  `Error:` line per problem naming the key, never the value, and `info`, `config-deploy` and help
+  run (exit code change). The `InitLogging` port takes `dotenv_path`, and the root types the
+  services factory instead of ignoring the type.
+- **A refused `LOG_*` variable no longer disables every command (exit code change).** A value
+  lib_log_rich refuses in a `LOG_*` variable, set in the environment or in the `.env` logging reads
+  (`LOG_CONSOLE_LEVEL=bogus`), made every command but a bare `--help` exit 22 with lib_log_rich's
+  `ValueError`. Logging now falls back to its defaults with every `LOG_*` variable hidden for that
+  start (and put back afterwards), so only `config`, `check` and `filter` exit 78, and `info`,
+  `config-deploy` and the help of every command run with exit 0. The 78 carries lib_log_rich's own
+  message, `Error: lib_log_rich: Unknown log level: 'bogus'`, which may name neither the variable
+  nor where it was set. A refused `[lib_log_rich]` value still leaves every valid `LOG_*` variable
+  in force for the fallback: only a refused variable hides them.
+- **`config-deploy` leaves every permission decision to lib_layered_config.** The command read
+  `[lib_layered_config.default_permissions]` from its own merged configuration, so a `.env` found
+  upward from the working directory decided or blocked a system deploy, and of the whole section
+  only `enabled` was ever used: the configured per-layer modes never reached a deploy, and a
+  section that was not a table crashed with `AttributeError`. It now passes its options and any
+  `--set` of that section to `deploy_config` unchanged; the library reads the section from the
+  bundled defaults, the files the deploy does not overwrite and the environment, never from
+  `.env`, and applies each target's own layer modes. A refused setting exits 78 with one `Error:`
+  line per problem naming the key and its source, plus a hint in the CLI's spelling when both mode
+  options would get past it (exit code change: 78 where an invalid section used to exit 1 or
+  deploy). "Deployed configuration" is logged after the deploy, and the report says
+  "(permissions not set)" only for an explicit `--no-permissions`.
+- **The documented `.env` and environment syntax for lists and tables works.** `.env.example`,
+  `90-logging.toml` and `CONFIG.md` showed comma-separated `LEVEL=style` and `field=regex` pairs
+  for `console_styles` and `scrub_patterns` and `host:port` / `100:60` strings for
+  `graylog_endpoint` and `rate_limit`; each arrives as ONE string and is refused. They now show
+  a JSON array or object (unquoted in `.env`, shell-quoted in the environment) or one key per entry
+  (`LIB_LOG_RICH__SCRUB_PATTERNS__API_KEY=.+`), and say how an unquoted value is converted.
+- **Tests no longer depend on test order, colour or terminal width.** An autouse fixture shuts the
+  logging runtime down and restores the root logger's handlers, level and propagate flag after
+  every test (production `init_logging` attaches a stdlib handler and raises the root level, which
+  `runtime.shutdown()` does not undo). A second one pins rich-click's colour and width globals,
+  which it reads from the terminal and from GITHUB_ACTIONS once at import, so a usage-error box
+  no longer wraps a message the test looks for on a narrow terminal.
+
+### Changed
+
+- **Requires lib_layered_config 7.0.1**, whose `deploy_config` reads and validates the permission
+  section itself. An unquoted `.env` value now converts like the environment layer, so
+  `ENABLED=false` arrives as the boolean `false`.
+- **`--no-permissions` together with `--dir-mode` or `--file-mode` is a usage error** (exit 2):
+  a mode cannot be applied while permission setting is off.
+- **`python-dotenv` is a declared dependency** (logging reads the `LOG_*` lines of a `.env` with
+  it), and lib_log_rich is required at 6.3.9, the version the logging refusal is tested against.
+- **`click` is a declared dependency.** The package imports it directly (`adapters/cli/main.py`)
+  but only had it through rich-click. A new test fails when a module imported at run time is
+  missing from `[project].dependencies`.
+
+### Removed
+
+- `adapters.config.permissions` (`PermissionDefaults`, `parse_mode`, `get_permission_defaults`,
+  `get_modes_for_target`): lib_layered_config reads and validates the section now. `parse_mode`
+  silently fell back to the default on a malformed value, and `get_modes_for_target` had no
+  production caller, which is why the configured modes never took effect.
+
+### Security
+
+- **`config-deploy` refuses unsafe and malformed modes.** `--dir-mode -1` passed the unbounded
+  octal parser and reached the deploy as mode -1, and `--dir-mode 777` or `--file-mode 666` were
+  applied as given. `--dir-mode`/`--file-mode` and the configured modes are now parsed by
+  lib_layered_config's `DeployMode`: only a plain octal literal inside 0..0o7777 is accepted, and
+  setuid/setgid/sticky, group or world write, an execute bit on a file and a mode that takes away
+  the owner's access are refused (exit 2 for an option, 78 for a configured value). A bare integer
+  in the configuration is refused because it is read as decimal (`400` is `0o620`).
+
+## [2.2.3] 2026-07-30 18:08:55
+
+### Changed
+
+- **The shipped skill's plugin version now tracks the package version.** bmk 3.14.0 raises
+  `.claude-plugin/plugin.json` to the package version on bump, push and release, and never lowers
+  it. An install re-fetches a skill only when that version changes, so the two numbers drifting
+  apart meant a skill edit could ship to nobody. No functional change to the library.
+
+## [2.2.2] 2026-07-24 18:15:33
+
+### Fixed
+- Latest `ruff` (0.16+) widened default rule coverage; the project's curated
+  `[tool.ruff.lint]` blanket ignore list (`RUF002`, `RUF022`, `PLC0415`, `TC001-3`,
+  `TC006`) is removed and every violation it was masking is fixed at the root
+  instead: keyword-only params on the six flagged Click callbacks/helpers
+  (`build_ignore_parser`, `cli_check`, `cli_filter`, `cli_config_deploy`,
+  `_execute_deploy`, `create_rule_variations`) rather than adding rule
+  suppressions, an ASCII hyphen in place of an ambiguous en-dash in a docstring,
+  and top-level (rather than deferred) imports where no circular-import or
+  lazy-load reason applied. A doctest in `adapters/config/permissions.py` that
+  relied on `DeployTarget` moving out of `TYPE_CHECKING` is made self-contained.
+- Deferred imports in `tests/*.py` are now a declared per-file ignore
+  (`PLC0415`) rather than silently unflagged - they are a deliberate test idiom
+  (exercising import/cache behaviour), not an oversight.
+
+### Changed
+- CI (template-managed, from `default_cicd_public`): `pip-audit` now audits this
+  project's own resolved dependency tree instead of the whole `--system`
+  environment, so runner-image packages we neither declare nor ship (`setuptools`,
+  `pip`, `wheel`) can no longer report findings against us. `actions/cache` moves
+  to v6 in the same distribution.
+- Dev dependency floor: `httpx2>=2.7.0` (was `>=2.6.0`).
+- `[tool.ruff.lint.flake8-type-checking].runtime-evaluated-base-classes` now
+  lists `pydantic.BaseModel`, so the `TC00x` autofix leaves Pydantic model base
+  classes importable at runtime instead of moving them into `TYPE_CHECKING`.
+- `skills/python-gitignore/SKILL.md` example code blocks reformatted to match
+  ruff's latest formatting (cosmetic only; no semantic change to the skill).
+  `.claude-plugin/plugin.json` bumped to `1.0.1` to ship the change.
+
+## [2.2.1] - 2026-07-14
+
+A maintenance release: no library or CLI behaviour changes beyond the profile
+validation fix below. The public API is unchanged.
+
+### Fixed
+- `validate_profile()` raises `ValueError` for every invalid profile again. Newer
+  `lib_layered_config` raises its own `ValidationError`, which escaped the
+  documented `ValueError` contract and slipped past callers' `except ValueError`
+  guards; the dependency's exception is now normalised back to `ValueError`.
+- Pyright strict passes against click 8.3+. The `argument` decorator's re-exported
+  signature carries an unknown `type` parameter, so it joins `option` and
+  `version_option` behind a fully-typed wrapper in `adapters/cli/typed_click`
+  instead of the rule being disabled.
+
+### Documentation
+- `ExitCode`'s docstring no longer claims the application never exits with a
+  signal code. `BROKEN_PIPE` (141) is raised directly by `check` and `filter` when
+  their output pipe closes early; only 130 and 143 are informational.
+- `INSTALL.md`: the install-from-tag example pointed at `v1.1.0`, a tag that was
+  never cut, and the closing line named the installed command twice. Both fixed.
+
+### Changed
+- `codecov-cli` is disabled as a dev dependency. It pins `click<8.3.0`, which both
+  held click at a version with a known `click.edit()` command-injection flaw and
+  silently backtracked `bmk` to 3.1.7. CI uploads coverage via
+  `codecov/codecov-action`, so nothing is lost.
+- The bmk-managed `Makefile` regenerates at 3.6.0 (from 2.9.5), and bmk now lives
+  in a per-project `.venv-bmk` tool environment rather than a shared one. This is
+  the first bmk update the repo has picked up since the `click` pin was removed.
+- The `[tool.pip-audit]` ignore list is now empty. Every entry it carried had
+  become inert (fixed upstream, or naming a package absent from the dependency
+  tree), and a stale entry silently suppresses any future advisory filed under the
+  same id.
+
+## [2.2.0] - 2026-06-26
+
+Full rebuild of the project scaffolding on the `bitranox_template_py_cli` template
+(src layout, hatchling, ruff + pyright strict, clean-architecture CLI). The public
+library API (`import igittigitt; igittigitt.IgnoreParser`) is unchanged.
+
+### Added
+- **`IncludeParser`** - a directory-aware include / whitelist mode with
+  `shutil_include` for use as a `shutil.copytree` filter.
+- **Scriptable CLI** built on rich-click: `check` (mirrors `git check-ignore`,
+  including `-v`) and `filter` (a streaming Unix filter reading paths from stdin),
+  with newline- or NUL-separated (`-z`) I/O and clean SIGPIPE handling. Plus
+  `info`, `config`, `config-deploy`, `config-generate-examples` and `logdemo`.
+- **Layered configuration** (`lib_layered_config`) and **structured logging**
+  (`lib_log_rich`). All engine/CLI tuning knobs are exposed and documented in the
+  `[performance]` config section (`dir_cache_max`, `pattern_cache_max`,
+  `stdin_chunk_bytes`, `max_token_bytes`) and overridable via file / `.env` / env
+  var / `--set`.
+- Differential test suite comparing igittigitt against real `git check-ignore`,
+  plus memory-boundedness, include, config-knob and real-pipe/SIGPIPE tests.
+
+### Changed
+- **Matching is now 100% git-compatible.** The engine performs a single ordered
+  pass (last-matching-pattern-wins) with correct negations, parent-directory
+  exclusion blocking re-inclusion, and per-directory `.gitignore` precedence. This
+  resolves the long-standing negation and nested-precedence limitations.
+- Matching is memory-bounded: per-path cost is `O(depth x rules)` and memory scales
+  with the number of rules, not the number of files.
+- Matching is ~5x faster: globs are translated and compiled to `re.Pattern` once
+  (cached), and the ancestor-directory decision is memoized in a bounded LRU - both
+  keep memory bounded and preserve 100% git compatibility.
+- Dropped the `attrs` runtime dependency in favour of `dataclasses` and `pydantic`.
+- Python baseline raised to **3.10+** (was 3.8).
+- CLI migrated from `click` to `rich-click` with `lib_cli_exit_tools`.
+- Documentation moved from reStructuredText to Markdown.
+
+### Removed
+- The old two-phase (sort-and-deduplicate) rule evaluation that broke negations.
+
+## [2.1.5] - 2024-10-16
+- Final release on the previous (PizzaCutter / setuptools-scm) scaffolding.
+- Earlier history: a spec-compliant gitignore parser whose negation and nested
+  precedence handling was known to be incomplete (see this release's README).

igittigitt-2.2.4/CONFIG.md

@@ -0,0 +1,131 @@
+# Configuration
+
+igittigitt is configured with [lib_layered_config](https://github.com/bitranox/lib_layered_config).
+Settings are merged from several layers; later layers win:
+
+```
+bundled defaults -> app -> host -> user -> .env file -> environment variables -> --set
+```
+
+- **Inspect** the merged result (with provenance for each value): `igittigitt config`
+- **Deploy** editable copies into the standard config directories: `igittigitt config-deploy`
+- **Examples** to copy and edit: `igittigitt config-generate-examples`
+
+## Where config files live
+
+| Layer | Linux                                            | macOS                                                        |
+|-------|--------------------------------------------------|--------------------------------------------------------------|
+| app   | `/etc/xdg/igittigitt/config.*` (+ `config.d/*`)  | `/Library/Application Support/bitranox/igittigitt/config.*`  |
+| user  | `~/.config/igittigitt/config.*` (+ `config.d/*`) | `~/Library/Application Support/bitranox/igittigitt/config.*` |
+
+`.env` files (`SECTION__KEY=value`, found by searching upward from the working directory)
+and environment variables (`IGITTIGITT___SECTION__KEY=value`) override the files. A single
+value can be overridden per run with `--set SECTION.KEY=VALUE`.
+
+Value coercion (in `.env` and the environment alike): an unquoted `true`/`false` -> bool,
+`null`/`none` -> None, a number -> int/float only when it converts back to the same text (`007`
+stays text), and a JSON array or object is parsed. Quote a `.env` value to keep it as text. A
+list or table is that JSON written unquoted in `.env` (quoted for the shell in the environment),
+or one key per entry (`LIB_LOG_RICH__SCRUB_PATTERNS__API_KEY=.+`); a comma-separated value is ONE
+string, not a list.
+
+A configuration file that cannot be loaded (invalid TOML, not UTF-8, unreadable) does not stop
+every command. `config`, `check` and `filter`, which read the configuration, refuse with exit 78
+and one line naming the file (`--traceback` adds the loader's traceback); `info`,
+`config-deploy` (the command that replaces the broken file), `config-generate-examples` and
+`--help` still run. A malformed or conflicting `--set` and an invalid `--profile` name are usage
+errors (exit 2) for every command, whether or not the configuration loads.
+
+## Settings reference
+
+The authoritative, fully-commented reference is the set of bundled TOML files (one key per
+documented block); `config-deploy` / `config-generate-examples` write them out:
+
+- `defaultconfig.d/50-performance.toml` - the `[performance]` engine/CLI tuning knobs.
+- `defaultconfig.d/90-logging.toml` - the `[lib_log_rich]` logging settings.
+- `defaultconfig.d/40-layered-config.toml` - config-deploy permission defaults.
+
+### `[performance]`
+
+Only affects speed and cache memory, never which paths match. All defaults keep memory
+bounded and were chosen by measurement.
+
+| Key                 | Default   | Meaning                                                                                                               |
+|---------------------|-----------|-----------------------------------------------------------------------------------------------------------------------|
+| `dir_cache_max`     | `8192`    | Directory-decision LRU capacity per parser (`0` disables). Main speed-up on trees; memory `O(this)`, not `O(#files)`. |
+| `pattern_cache_max` | `4096`    | Process-wide compiled-regex cache capacity (keyed by distinct pattern).                                               |
+| `stdin_chunk_bytes` | `65536`   | Stdin read granularity for the streaming commands.                                                                    |
+| `max_token_bytes`   | `1048576` | Per-token safety bound; a separator-less token larger than this is rejected, not buffered unbounded.                  |
+
+```bash
+igittigitt --set performance.dir_cache_max=32768 filter -C repo
+IGITTIGITT___PERFORMANCE__MAX_TOKEN_BYTES=4096 igittigitt check -C repo --stdin < paths
+```
+
+### `[lib_layered_config.default_permissions]`
+
+The Unix modes `config-deploy` gives the directories and files it writes (POSIX only), per layer:
+`app_directory`/`app_file`, `host_directory`/`host_file`, `user_directory`/`user_file`, and
+`enabled`. Built-in modes are 755/644 for app and host, 700/600 for user.
+
+`config-deploy` decides none of this itself: it passes its options and any `--set` of this
+section to lib_layered_config, which applies each target's own layer modes. The library reads the
+section from the bundled defaults, the configuration files this deploy does not overwrite and the
+environment, with the `--set` values laid over them. It never reads `.env` for it (neither one
+found from the working directory nor an explicit `--env-file`), so a `.env` can neither change a
+deployed mode nor block a deploy. `--dir-mode`/`--file-mode` override the configured modes for
+every target. Without `--permissions`/`--no-permissions`, `enabled` decides; `enabled = false`
+behaves like `--no-permissions`, and `--permissions` sets the modes anyway. `--no-permissions`
+cannot be combined with a mode option (exit 2).
+
+A mode is a plain octal STRING (`"0o750"`, `"750"`) inside 0..0o7777, never setuid/setgid/sticky,
+group or world write, an execute bit on a file, or less than owner rwx (directory) / rw (file).
+A bare integer is refused because TOML, the environment and `--set` all read `400` as the DECIMAL
+number 400, which is `0o620`. Quote it in TOML (`user_file = "640"`); in an environment variable
+or `--set` use the `0o` prefix (`0o640`). `enabled` must be a real boolean; `"no"`, `"off"`, `0`
+or `1` are refused. An unknown key is refused rather than ignored. `--dir-mode`/`--file-mode`
+follow the same rules and are refused as a usage error (exit 2). Any refused setting stops
+`config-deploy` before it writes anything, with exit 78, one line per problem naming the key and
+where it was set, and a hint, for example:
+
+```text
+Error: lib_layered_config.default_permissions.user_file: a bare integer is read as decimal (400 = 0o620); write the mode as an octal string: "0o640" (quoted) in a file, 0o640 in the environment or a runtime override (such as an application's --set) (source: env)
+Hint: to deploy anyway, pass both --dir-mode and --file-mode (the built-in modes are 700 and 600 for user, 755 and 644 for app and host); --no-permissions also deploys, but leaves every mode to the umask, which can make a user file that holds secrets readable by other accounts.
+```
+
+A refused `--set` of the section names `(source: override)` and has no hint, since no option gets
+past it: fix or drop the `--set`. The files a deploy writes are never read for it, so
+`config-deploy --force` replaces a destination that carries a bad value, or does not parse at all,
+without further options.
+
+### `[lib_log_rich]`
+
+Logging configuration (console level/theme, journald/eventlog/Graylog backends, queueing,
+scrubbing, payload limits). Each key is documented inline in `90-logging.toml`. Common ones:
+
+| Key                                   | Example                    | Meaning                                |
+|---------------------------------------|----------------------------|----------------------------------------|
+| `console_level`                       | `DEBUG`                    | Minimum level shown on the console.    |
+| `console_theme`                       | `dark`                     | Console colour theme.                  |
+| `enable_journald`                     | `true`                     | Also emit to systemd-journald (Linux). |
+| `enable_graylog` / `graylog_endpoint` | `true` / `["host", 12201]` | Ship logs to Graylog (GELF).           |
+
+```bash
+igittigitt --set lib_log_rich.console_level=DEBUG info
+IGITTIGITT___LIB_LOG_RICH__CONSOLE_LEVEL=DEBUG igittigitt info
+```
+
+lib_log_rich also reads its own `LOG_*` variables. Logging takes those, and only those, from a
+`.env`: from `--env-file` when given, otherwise from the nearest `.env` from the working directory
+up to the project root, never replacing a variable that is already set. No other `.env` line
+reaches the process environment.
+
+A `[lib_log_rich]` value or `LOG_*` variable lib_log_rich refuses (a wrong type, its own range
+checks such as `queue_maxsize = 0`, or an unknown level such as `LOG_CONSOLE_LEVEL=bogus`) is a
+configuration failure like a broken file: logging starts with its defaults, `config`, `check` and
+`filter` exit 78, and the other commands run. A refused `[lib_log_rich]` value leaves every valid
+`LOG_*` variable in force; only a refused `LOG_*` variable makes logging start without all of them.
+A problem the type check of the section finds gets one `Error:` line naming the key, never its
+value; a value only lib_log_rich itself refuses is reported in lib_log_rich's own words
+(`Error: lib_log_rich: Unknown log level: 'bogus'`), which may name neither the setting nor where
+it was set.

{igittigitt-2.2.2 → igittigitt-2.2.4}/DEVELOPMENT.md

@@ -95,7 +95,7 @@ make menu
 
 ## Running Integration Tests
 
-Some tests require external resources (SMTP servers, databases) and are excluded from the default test run. These are marked with `@pytest.mark.local_only`.
+Some tests require external resources and are excluded from the default test run. These are marked with `@pytest.mark.local_only`.
 
 ### Quick Reference
 
@@ -105,39 +105,6 @@ Some tests require external resources (SMTP servers, databases) and are excluded
 | `make test-slow` | ONLY `local_only` integration tests |
 | `pytest tests/` | ALL tests (no marker filter) |
 
-### Email Integration Tests
-
-To run email tests that actually send messages:
-
-1. **Create a `.env` file** in the project root with your SMTP settings:
-
-```bash
-# .env (copy from .env.example)
-EMAIL__SMTP_HOSTS=smtp.example.com:587
-EMAIL__FROM_ADDRESS=sender@example.com
-EMAIL__RECIPIENTS=recipient@example.com
-EMAIL__SMTP_USER=your_username
-EMAIL__SMTP_PASSWORD=your_password
-```
-
-   Alternatively, use `--env-file` to point at an existing `.env` file:
-
-```bash
-igittigitt --env-file /path/to/my/.env send-notification --subject "Test" --message "Hello"
-```
-
-2. **Run the integration tests**:
-
-```bash
-make test-slow
-```
-
-3. **Or run specific email tests**:
-
-```bash
-pytest tests/test_cli_email_smtp.py -v
-```
-
 ### Adding New Integration Tests
 
 Mark tests that require external resources: