solvent-agent 0.2.1__tar.gz → 0.2.2__tar.gz

{solvent_agent-0.2.1/solvent_agent.egg-info → solvent_agent-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: solvent-agent
-Version: 0.2.1
+Version: 0.2.2
 Summary: A self-funding analyst agent: earns on Stripe, fulfils with NVIDIA Nemotron, spends within guardrails.
 License: MIT
 Project-URL: Homepage, https://github.com/ianalloway/solvent-agent

{solvent_agent-0.2.1 → solvent_agent-0.2.2}/solvent/__init__.py

@@ -1,3 +1,3 @@
 """SOLVENT — a self-funding analyst agent. See run_demo.py."""
 
-__version__ = "0.2.1"
+__version__ = "0.2.2"

{solvent_agent-0.2.1 → solvent_agent-0.2.2}/solvent/agent.py

@@ -22,7 +22,7 @@ from collections.abc import Callable
 from .calibration import calibration_factor
 from .guardrails import Guardrails
 from .pricing import PricingPolicy
-from .stages import StageRunner, _job_id_of, validate_and_coerce_job
+from .stages import StageRunner, _job_id_of, coerce_job, screen_and_record
 from .stripe_client import StripeClient
 from .treasury import Treasury
 
@@ -79,10 +79,21 @@ class Solvent:
         return self._runner.advance_job(job_id)
 
     def enqueue_job(self, job: dict) -> dict:
-        """Validate and persist a job for async worker processing."""
-        validated, err = validate_and_coerce_job(job, self.t)
+        """Validate and persist a new job for async worker processing.
+
+        Invalid input is declined before anything is written. A valid job then
+        claims its id with an atomic insert, so a submission can never
+        overwrite or restart an existing job.
+        """
+        coerced, err = coerce_job(job)
+        if err:
+            return self._emit(stage="declined", job_id=_job_id_of(job, None), reason=err)
+        assert coerced is not None
+        if not self.t.insert_job(coerced["id"], "received"):
+            return {"stage": "declined", "job_id": coerced["id"], "reason": "job id already exists"}
+        validated, err = screen_and_record(coerced, self.t)
         if err:
-            return self._emit(stage="declined", job_id=_job_id_of(job, validated), reason=err)
+            return self._emit(stage="declined", job_id=coerced["id"], reason=err)
         assert validated is not None
         q = self._runner._stage_quote(validated)
         if q.get("stage") == "declined" or not q.get("accept"):

{solvent_agent-0.2.1 → solvent_agent-0.2.2}/solvent/dashboard.py

@@ -38,6 +38,8 @@ def _script_json(value: object) -> str:
         .replace("<", "\\u003c")
         .replace(">", "\\u003e")
         .replace("&", "\\u0026")
+        .replace("\u2028", "\\u2028")
+        .replace("\u2029", "\\u2029")
     )
 
 
@@ -1367,15 +1369,6 @@ def render(snapshot: dict, log: list[dict], *, live: bool = False) -> Path:
     let jobsData = {_script_json(jobs_data)};
     let currentOpenJobId = null;
 
-    function esc(value) {{
-      return String(value ?? "")
-        .replace(/&/g, "&amp;")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;")
-        .replace(/"/g, "&quot;")
-        .replace(/'/g, "&#39;");
-    }}
-
     function openBriefModal(jobId) {{
       document.getElementById("modal-title").innerText = "Research Brief Preview: " + jobId;
       const iframe = document.getElementById("brief-iframe");
@@ -1398,21 +1391,28 @@ def render(snapshot: dict, log: list[dict], *, live: bool = False) -> Path:
         return;
       }}
 
-      let html = "";
+      container.replaceChildren();
       jobIds.forEach(jobId => {{
         const job = jobsData[jobId] || {{}};
-        const title = job.title || `Research Brief (${{jobId}})`;
-        html += `
-          <div style="display:flex; justify-content:space-between; align-items:center; background:rgba(255,255,255,0.02); border:1px solid var(--color-border); padding:10px 14px; border-radius:10px; margin-bottom: 8px;">
-            <div style="display:flex; flex-direction:column; gap:2px; max-width:70%;">
-              <span style="font-size:11px; font-family:var(--font-mono); color:var(--color-text-muted);">${{esc(jobId)}}</span>
-              <span style="font-size:13px; font-weight:600; color:var(--color-text-primary); text-overflow:ellipsis; overflow:hidden; white-space:nowrap;">${{esc(title)}}</span>
-            </div>
-            <button class="btn btn-outline btn-sm" onclick="openBriefModal(${{esc(JSON.stringify(jobId))}})" style="padding:4px 8px; font-size:11px;">Preview</button>
-          </div>
-        `;
+        const row = document.createElement("div");
+        row.style.cssText = "display:flex; justify-content:space-between; align-items:center; background:rgba(255,255,255,0.02); border:1px solid var(--color-border); padding:10px 14px; border-radius:10px; margin-bottom: 8px;";
+        const labels = document.createElement("div");
+        labels.style.cssText = "display:flex; flex-direction:column; gap:2px; max-width:70%;";
+        const idEl = document.createElement("span");
+        idEl.style.cssText = "font-size:11px; font-family:var(--font-mono); color:var(--color-text-muted);";
+        idEl.textContent = jobId;
+        const titleEl = document.createElement("span");
+        titleEl.style.cssText = "font-size:13px; font-weight:600; color:var(--color-text-primary); text-overflow:ellipsis; overflow:hidden; white-space:nowrap;";
+        titleEl.textContent = job.title || `Research Brief (${{jobId}})`;
+        labels.append(idEl, titleEl);
+        const button = document.createElement("button");
+        button.className = "btn btn-outline btn-sm";
+        button.style.cssText = "padding:4px 8px; font-size:11px;";
+        button.textContent = "Preview";
+        button.addEventListener("click", () => openBriefModal(jobId));
+        row.append(labels, button);
+        container.appendChild(row);
       }});
-      container.innerHTML = html;
     }}
 
     // Auto-scroll terminal log to the bottom
@@ -1431,28 +1431,43 @@ def render(snapshot: dict, log: list[dict], *, live: bool = False) -> Path:
 
       document.getElementById("drawer-title").innerText = "Job Details: " + jobId;
 
-      let metaHTML = `
-        <div class="meta-row"><strong>Title:</strong> <span>${{esc(job.title || 'N/A')}}</span></div>
-        <div class="meta-row"><strong>Status:</strong> <span class="badge badge-${{esc(job.status)}}">${{esc(String(job.status).toUpperCase())}}</span></div>
-        <div class="meta-row"><strong>Client Budget:</strong> <span>${{formatCents(job.price)}}</span></div>
-        <div class="meta-row"><strong>Incurred COGS:</strong> <span>${{formatCents(getExpensesTotal(job.expenses))}}</span></div>
-        <div class="meta-row"><strong>Net P&L:</strong> <span class="${{job.pnl >= 0 ? 'green' : 'red'}}">${{job.pnl >= 0 ? '+' : ''}}${{formatCents(job.pnl)}}</span></div>
-        <div class="meta-row"><strong>Est. Margin:</strong> <span>${{esc(job.margin_pct)}}%</span></div>
-      `;
+      const meta = document.getElementById("drawer-metadata");
+      meta.replaceChildren();
+      const metaRow = (label, value, className) => {{
+        const row = document.createElement("div");
+        row.className = "meta-row";
+        const strong = document.createElement("strong");
+        strong.textContent = label;
+        const span = document.createElement("span");
+        if (className) span.className = className;
+        span.textContent = value;
+        row.append(strong, " ", span);
+        meta.appendChild(row);
+      }};
+      const status = String(job.status);
+      metaRow("Title:", job.title || "N/A");
+      metaRow("Status:", status.toUpperCase(), "badge badge-" + status.replace(/[^a-z_]/gi, ""));
+      metaRow("Client Budget:", formatCents(job.price));
+      metaRow("Incurred COGS:", formatCents(getExpensesTotal(job.expenses)));
+      metaRow("Net P&L:", (job.pnl >= 0 ? "+" : "") + formatCents(job.pnl), job.pnl >= 0 ? "green" : "red");
+      metaRow("Est. Margin:", String(job.margin_pct) + "%");
 
       if (job.expenses.length > 0) {{
-        metaHTML += `
-          <h4 style="margin-top: 16px; margin-bottom: 8px; font-size:12px; color:var(--color-text-muted)">ITEMIZED EXPENSES</h4>
-          <ul class="drawer-expenses-list">
-        `;
+        const heading = document.createElement("h4");
+        heading.style.cssText = "margin-top: 16px; margin-bottom: 8px; font-size:12px; color:var(--color-text-muted)";
+        heading.textContent = "ITEMIZED EXPENSES";
+        const list = document.createElement("ul");
+        list.className = "drawer-expenses-list";
         job.expenses.forEach(e => {{
-          metaHTML += `<li><strong>${{esc(e.vendor)}}:</strong> -${{formatCents(e.amount)}} (${{esc(e.memo)}})</li>`;
+          const item = document.createElement("li");
+          const vendor = document.createElement("strong");
+          vendor.textContent = String(e.vendor) + ":";
+          item.append(vendor, ` -${{formatCents(e.amount)}} (${{e.memo}})`);
+          list.appendChild(item);
         }});
-        metaHTML += '</ul>';
+        meta.append(heading, list);
       }}
 
-      document.getElementById("drawer-metadata").innerHTML = metaHTML;
-
       const hasBrief = Object.prototype.hasOwnProperty.call(briefs || {{}}, jobId);
       const reportText = hasBrief
         ? "_Brief generated. Use the hosted brief link with a delivery token to view full contents._"
@@ -1503,13 +1518,13 @@ def render(snapshot: dict, log: list[dict], *, live: bool = False) -> Path:
       html = html.replace(/\\*(.*?)\\*/g, '<em>$1</em>');
 
       // Double line breaks to paragraphs
-      const paragraphs = html.split(/\n\n+/);
+      const paragraphs = html.split(/\\n\\n+/);
       html = paragraphs.map(p => {{
         p = p.trim();
         if (!p) return '';
         if (p.startsWith('<h') || p.startsWith('<ul') || p.startsWith('<li')) return p;
-        return `<p>${{p.replace(/\n/g, '<br>')}}</p>`;
-      }}).join('\n');
+        return `<p>${{p.replace(/\\n/g, '<br>')}}</p>`;
+      }}).join("\\n");
 
       return html;
     }}

{solvent_agent-0.2.1 → solvent_agent-0.2.2}/solvent/export.py

@@ -228,8 +228,44 @@ _TABLES = {
 }
 
 
+#: Free-text columns that can carry customer- or vendor-supplied strings. Only
+#: these are neutralised, so numeric columns stay numeric for the spreadsheet.
+_UNTRUSTED_TEXT_COLUMNS = {
+    "ledger": frozenset(
+        {"memo", "job_id", "vendor", "stripe_ref", "stripe_session_id", "stripe_link_id"}
+    ),
+    "jobs": frozenset(
+        {"id", "status", "topic", "customer_email", "current_stage", "error_reason", "deliverable_url"}
+    ),
+    "metrics": frozenset({"job_id", "decline_reason", "block_rule"}),
+    "customers": frozenset({"email"}),
+}
+
+_FORMULA_TRIGGERS = ("=", "+", "-", "@", "\t", "\r")
+_LEADING_NOISE = re.compile(r"^[\s\x00-\x1f\x7f\u200b-\u200f\u2060\ufeff]*")
+
+
+def neutralise_cell(value: Any) -> Any:
+    """Stop a spreadsheet from evaluating a text cell as a formula.
+
+    A string whose first significant character (after any leading whitespace
+    or control characters) is ``= + - @``, or that starts with a tab or
+    carriage return, is prefixed with a single quote. Non-strings pass through.
+    """
+    if not isinstance(value, str) or not value:
+        return value
+    significant = _LEADING_NOISE.sub("", value, count=1)
+    if value.startswith(_FORMULA_TRIGGERS) or significant.startswith(_FORMULA_TRIGGERS):
+        return "'" + value
+    return value
+
+
 def write_csv(data: dict[str, Any], out_dir: Path) -> list[Path]:
-    """Write one CSV per table; returns the files written."""
+    """Write one CSV per table; returns the files written.
+
+    Untrusted text columns are passed through `neutralise_cell` so a job topic
+    or memo like ``=HYPERLINK(...)`` is shown as text, not run as a formula.
+    """
     out_dir.mkdir(parents=True, exist_ok=True)
     written = []
     for table, columns in _TABLES.items():
@@ -237,8 +273,14 @@ def write_csv(data: dict[str, Any], out_dir: Path) -> list[Path]:
         with path.open("w", encoding="utf-8", newline="") as fh:
             writer = csv.DictWriter(fh, fieldnames=list(columns), extrasaction="ignore")
             writer.writeheader()
+            text_columns = _UNTRUSTED_TEXT_COLUMNS.get(table, frozenset())
             for row in data[table]:
-                writer.writerow(row)
+                writer.writerow(
+                    {
+                        key: neutralise_cell(value) if key in text_columns else value
+                        for key, value in row.items()
+                    }
+                )
         written.append(path)
     return written
 

{solvent_agent-0.2.1 → solvent_agent-0.2.2}/solvent/gateway.py

@@ -38,6 +38,11 @@ def notify(channel: str, external_id: str, text: str) -> None:
             pass
 
 
+#: Commands that answer from local state without calling the model; only these
+#: skip the per-user rate limit. Everything else, /quote included, is counted.
+RATE_EXEMPT_COMMANDS = frozenset({"/help", "/status", "/jobs"})
+
+
 def _rate_ok(user_key: str) -> bool:
     allowed, _reason = _rate_limiter.check(user_key)
     return allowed
@@ -56,10 +61,16 @@ class Gateway:
         *,
         user_label: str | None = None,
     ) -> str:
+        user_key = f"{channel}:{external_id}"
+        if _rate_limiter.is_banned(user_key):
+            return "You are temporarily blocked from messaging this bot."
+
         session = self.memory.get_or_create(channel, external_id, user_label)
-        is_command = text.strip().startswith("/")
+        stripped = text.strip()
+        is_command = stripped.startswith("/")
+        command = stripped.split(maxsplit=1)[0].lower() if is_command else ""
 
-        if not is_command and not _rate_ok(f"{channel}:{external_id}"):
+        if command not in RATE_EXEMPT_COMMANDS and not _rate_ok(user_key):
             return "Rate limit exceeded. Please wait before sending more messages."
 
         if channel == "telegram" and not pairing.is_allowed(external_id, user_label):
@@ -83,7 +94,7 @@ class Gateway:
         cmd = parts[0].lower()
         arg = parts[1] if len(parts) > 1 else ""
 
-        if cmd == "/help":
+        if cmd in ("/help", "/start"):
             return (
                 "SOLVENT research business bot.\n"
                 "/status — treasury snapshot\n"
@@ -130,13 +141,14 @@ class Gateway:
                 port = 443
             return _qr.render_token(token, host=host, port=port)
 
-        if cmd == "/quote" and "|" in arg:
+        if cmd == "/quote":
+            if "|" not in arg:
+                return "Usage: /quote topic | 50.00"
             topic, budget_s = [x.strip() for x in arg.split("|", 1)]
             try:
                 cents = dollars_to_cents(budget_s)
             except ValueError:
                 return "Usage: /quote topic | 50.00"
-            from .chat import handle_message
 
             prompt = f"Quote a brief on '{topic}' with budget_cents={cents}. Use quote_brief tool."
             return handle_message(
@@ -147,9 +159,7 @@ class Gateway:
                 channel=channel,
             )
 
-        return handle_message(
-            session["id"], text, agent=self.agent, memory=self.memory, channel=channel
-        )
+        return f"Unknown command {cmd[:32]}. Send /help for the list of commands."
 
     def on_job_event(self, event: dict) -> None:
         """Push job lifecycle updates to sessions watching a job."""

{solvent_agent-0.2.1 → solvent_agent-0.2.2}/solvent/stages.py

@@ -29,51 +29,50 @@ def _job_id_of(submitted: Any, validated: dict | None) -> str:
     for candidate in (validated, submitted):
         if isinstance(candidate, dict):
             job_id = candidate.get("id")
-            if isinstance(job_id, str) and job_id.strip():
+            if isinstance(job_id, str) and delivery.is_safe_job_id(job_id):
                 return job_id
     return "unknown"
 
 
-def validate_and_coerce_job(job: dict, treasury: Treasury) -> tuple[dict | None, str | None]:
-    """Return (coerced_job, error_reason)."""
+def _coerce_job(job: Any) -> tuple[dict | None, str | None, str | None]:
+    """Field validation with no side effects.
+
+    Returns ``(coerced_job, error, recorded_reason)``; ``recorded_reason`` is
+    what the worker path stores on the job row for that error, or ``None`` when
+    the error has never been recorded.
+    """
     if not isinstance(job, dict):
-        return None, "job must be a dictionary"
+        return None, "job must be a dictionary", None
     job_id = job.get("id")
-    if not job_id or not isinstance(job_id, str):
-        return None, "missing or invalid job ID"
+    if not job_id or not isinstance(job_id, str) or not delivery.is_safe_job_id(job_id):
+        return None, "missing or invalid job ID", None
     try:
         job = dict(job)
         sanitise_job(job)
     except SOLVENTSecurityError as exc:
-        treasury.upsert_job(job_id, "failed", error_reason=str(exc))
-        return None, f"security violation: {exc}"
+        return None, f"security violation: {exc}", str(exc)
 
     # A job may name a product instead of pricing itself; the product fills in
     # the scope and list price, and everything below validates it as normal.
     try:
         job = apply_product(job)
     except UnknownProduct as exc:
-        treasury.upsert_job(job_id, "failed", error_reason=str(exc))
-        return None, str(exc)
+        return None, str(exc), str(exc)
 
     topic = job.get("topic")
     if not topic or not isinstance(topic, str) or not topic.strip():
-        treasury.upsert_job(job_id, "failed", error_reason="missing or blank topic")
-        return None, "missing or blank topic"
+        return None, "missing or blank topic", "missing or blank topic"
 
     budget_cents = job.get("budget_cents")
     if budget_cents is None:
-        treasury.upsert_job(job_id, "failed", error_reason="missing budget_cents")
-        return None, "missing budget_cents"
+        return None, "missing budget_cents", "missing budget_cents"
     try:
         budget_cents = int(float(budget_cents))
-        if budget_cents < 0 or budget_cents > 1_000_000:
-            treasury.upsert_job(job_id, "failed", error_reason="invalid budget")
-            return None, "invalid budget"
-        job["budget_cents"] = budget_cents
     except (ValueError, TypeError):
-        treasury.upsert_job(job_id, "failed", error_reason="budget_cents must be numeric")
-        return None, "budget_cents must be a valid numeric value"
+        return None, "budget_cents must be a valid numeric value", "budget_cents must be numeric"
+    if budget_cents < 0 or budget_cents > 1_000_000:
+        return None, "invalid budget", "invalid budget"
+    job["budget_cents"] = budget_cents
 
     for param, default_val in [
         ("est_tokens", 8_000),
@@ -85,18 +84,29 @@ def validate_and_coerce_job(job: dict, treasury: Treasury) -> tuple[dict | None,
             val = default_val
         try:
             val = int(float(val))
-            if val < 0:
-                return None, f"{param} cannot be negative"
-            if param == "est_tokens" and val > 100_000:
-                return None, "est_tokens exceeds maximum limit"
-            if param in ("market_data_calls", "web_search_calls") and val > 50:
-                return None, f"{param} exceeds maximum limit"
-            job[param] = val
         except (ValueError, TypeError):
-            return None, f"{param} must be a valid numeric value"
+            return None, f"{param} must be a valid numeric value", None
+        if val < 0:
+            return None, f"{param} cannot be negative", None
+        if param == "est_tokens" and val > 100_000:
+            return None, "est_tokens exceeds maximum limit", None
+        if param in ("market_data_calls", "web_search_calls") and val > 50:
+            return None, f"{param} exceeds maximum limit", None
+        job[param] = val
 
     job.setdefault("customer_email", "client@example.com")
+    return job, None, None
+
+
+def coerce_job(job: Any) -> tuple[dict | None, str | None]:
+    """Validate and normalise a submitted job without writing anything."""
+    coerced, err, _recorded = _coerce_job(job)
+    return coerced, err
 
+
+def screen_and_record(job: dict, treasury: Treasury) -> tuple[dict | None, str | None]:
+    """Run the intake screen on a coerced job and record the outcome on its row."""
+    job_id = job["id"]
     # Commercial screen: duplicates, bursts, oversized orders, unreachable
     # customers. Runs before pricing, so a screened-out job costs nothing.
     screen = screen_job(job, treasury)
@@ -128,6 +138,17 @@ def validate_and_coerce_job(job: dict, treasury: Treasury) -> tuple[dict | None,
     return job, None
 
 
+def validate_and_coerce_job(job: dict, treasury: Treasury) -> tuple[dict | None, str | None]:
+    """Return (coerced_job, error_reason), recording failures on the job row."""
+    coerced, err, recorded = _coerce_job(job)
+    if err:
+        if recorded is not None:
+            treasury.upsert_job(job["id"], "failed", error_reason=recorded)
+        return None, err
+    assert coerced is not None
+    return screen_and_record(coerced, treasury)
+
+
 class StageRunner:
     """Runs idempotent stages for a single job."""
 

{solvent_agent-0.2.1 → solvent_agent-0.2.2}/solvent/treasury.py

@@ -486,19 +486,34 @@ class Treasury:
                 params.append(job_id)
                 conn.execute(f"UPDATE jobs SET {', '.join(fields)} WHERE id = ?", params)
             else:
-                cols = ["id", "status", "created_at", "updated_at"]
-                vals = [job_id, status, ts, ts]
-                for col in self._JOB_COLS:
-                    cols.append(col)
-                    val = kwargs.get(col)
-                    if col == "job_payload_json" and isinstance(val, dict):
-                        val = json.dumps(val)
-                    vals.append(val)
-                placeholders = ", ".join(["?"] * len(cols))
-                conn.execute(
-                    f"INSERT INTO jobs ({', '.join(cols)}) VALUES ({placeholders})",
-                    vals,
-                )
+                self._insert_job_row(conn, job_id, status, ts, kwargs, verb="INSERT")
+
+    def _insert_job_row(
+        self, conn: sqlite3.Connection, job_id: str, status: str, ts: float, kwargs: dict, *, verb: str
+    ) -> int:
+        cols = ["id", "status", "created_at", "updated_at"]
+        vals = [job_id, status, ts, ts]
+        for col in self._JOB_COLS:
+            cols.append(col)
+            val = kwargs.get(col)
+            if col == "job_payload_json" and isinstance(val, dict):
+                val = json.dumps(val)
+            vals.append(val)
+        placeholders = ", ".join(["?"] * len(cols))
+        cur = conn.execute(f"{verb} INTO jobs ({', '.join(cols)}) VALUES ({placeholders})", vals)
+        return cur.rowcount
+
+    def insert_job(self, job_id: str, status: str, **kwargs) -> bool:
+        """Create a new job row atomically; return False if the id is already taken.
+
+        Unlike `upsert_job` this never touches an existing record, so it is the
+        only write a fresh submission may make before it owns the row.
+        """
+        with self.lock(), self._conn() as conn, conn:
+            inserted = self._insert_job_row(
+                conn, job_id, status, time.time(), kwargs, verb="INSERT OR IGNORE"
+            )
+            return inserted == 1
 
     def get_job(self, job_id: str) -> dict | None:
         with self.lock(), self._conn() as conn:

{solvent_agent-0.2.1 → solvent_agent-0.2.2/solvent_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: solvent-agent
-Version: 0.2.1
+Version: 0.2.2
 Summary: A self-funding analyst agent: earns on Stripe, fulfils with NVIDIA Nemotron, spends within guardrails.
 License: MIT
 Project-URL: Homepage, https://github.com/ianalloway/solvent-agent

{solvent_agent-0.2.1 → solvent_agent-0.2.2}/tests/test_dashboard_ops_xss.py

@@ -78,3 +78,51 @@ def test_inline_script_json_cannot_close_script_tag(tmp_path, monkeypatch):
     assert "</script><script>globalThis" not in page
     # The data still round-trips as JSON for the client.
     assert json.loads(dashboard._script_json({"t": breakout}))["t"] == breakout
+
+
+def test_inline_script_json_escapes_js_line_terminators():
+    encoded = dashboard._script_json({"t": "a
b
c"})
+    assert "
" not in encoded and "
" not in encoded
+    assert json.loads(encoded)["t"] == "a
b
c"
+
+
+def _js_function(page: str, name: str) -> str:
+    start = page.index(f"function {name}(")
+    return page[start : page.index("\n    }\n", start)]
+
+
+def test_client_renders_job_fields_as_text_not_markup(tmp_path, monkeypatch):
+    monkeypatch.setenv("SOLVENT_HOME", str(tmp_path))
+    monkeypatch.setattr(dashboard, "OUT", tmp_path / "treasury_dashboard.html")
+    page = dashboard.render(_snapshot(), []).read_text()
+
+    for name in ("updateBriefsList", "updateDrawerContent"):
+        body = _js_function(page, name)
+        assert "textContent" in body
+        assert "metaHTML" not in body
+        assert "container.innerHTML = html" not in body
+        assert "onclick=" not in body
+
+
+def test_rendered_inline_scripts_parse_as_javascript(tmp_path, monkeypatch):
+    import re
+    import shutil
+    import subprocess
+
+    import pytest
+
+    node = shutil.which("node")
+    if node is None:
+        pytest.skip("node is not installed")
+    monkeypatch.setenv("SOLVENT_HOME", str(tmp_path))
+    monkeypatch.setattr(dashboard, "OUT", tmp_path / "treasury_dashboard.html")
+    page = dashboard.render(_snapshot(), []).read_text()
+
+    scripts = re.findall(r"<script>(.*?)</script>", page, re.S)
+    assert scripts
+    for index, script in enumerate(scripts):
+        path = tmp_path / f"inline-{index}.js"
+        path.write_text(script, encoding="utf-8")
+        result = subprocess.run([node, "--check", str(path)], capture_output=True, text=True)
+        assert result.returncode == 0, result.stderr
+    assert "html.split(/\\n\\n+/)" in page

{solvent_agent-0.2.1 → solvent_agent-0.2.2}/tests/test_export.py

@@ -14,6 +14,7 @@ from solvent.export import (
     collect,
     format_summary,
     ledger_rows,
+    neutralise_cell,
     parse_period,
     period_summary,
     write_csv,
@@ -179,3 +180,50 @@ def test_format_summary_reports_the_close_and_the_files(treasury, tmp_path):
     assert "PERIOD CLOSE" in rendered
     assert "$49.00" in rendered
     assert "ledger.csv" in rendered
+
+
+@pytest.mark.parametrize(
+    "raw",
+    [
+        "=HYPERLINK(\"http://evil.example\",\"x\")",
+        "+1+cmd|' /C calc'!A0",
+        "-2+3",
+        "@SUM(A1:A9)",
+        "\t=1+1",
+        "\r=1+1",
+        "   =1+1",
+        "\x00\u200b=1+1",
+    ],
+)
+def test_formula_like_text_is_neutralised(raw):
+    assert neutralise_cell(raw) == "'" + raw
+
+
+@pytest.mark.parametrize("value", ["a brief", "a@x.example", "", None, 4_900, -600, 12.5])
+def test_ordinary_values_pass_through(value):
+    assert neutralise_cell(value) == value
+
+
+def test_write_csv_neutralises_untrusted_text_but_keeps_numbers(tmp_path):
+    t = Treasury(path=tmp_path / "ledger.db")
+    t.seed(10_000)
+    t.upsert_job(
+        "J1",
+        "completed",
+        topic='=HYPERLINK("http://evil.example","open")',
+        budget_cents=4_900,
+        customer_email="a@x.example",
+    )
+    t.spend(600, "@SUM(1+1)", job_id="J1", vendor="-vendor")
+    write_csv(collect(t), tmp_path / "books")
+
+    with (tmp_path / "books" / "jobs.csv").open(encoding="utf-8") as fh:
+        job = next(csv.DictReader(fh))
+    assert job["topic"] == '\'=HYPERLINK("http://evil.example","open")'
+    assert job["budget_cents"] == "4900"
+
+    with (tmp_path / "books" / "ledger.csv").open(encoding="utf-8") as fh:
+        expense = next(r for r in csv.DictReader(fh) if r["kind"] == "expense")
+    assert expense["memo"] == "'@SUM(1+1)"
+    assert expense["vendor"] == "'-vendor"
+    assert expense["signed_cents"] == "-600"