squackit 0.8.1__tar.gz → 0.8.2__tar.gz

{squackit-0.8.1 → squackit-0.8.2}/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 0.8.2
+
+### Fixed — AST tools could not read a source outside the working directory
+
+`find` / `view` / `find_names` / `complexity` build their own connection with
+no root, so fledgling's sandbox confined them to the process working
+directory. An absolute source anywhere else — `find(source="/srv/code/x/**/*.py")`
+— raised a permission error. The connection is now rooted at the source's own
+directory, which is the scope the caller named. Relative sources are untouched:
+they already resolve against the working directory, and re-rooting them would
+double-prefix the path.
+
+Each rooted plucker gets its own AST cache file, keyed by root. DuckDB's
+filesystem allow-list belongs to the database *instance*, not the connection,
+and every connection to one file shares an instance — so a single shared cache
+meant the first lockdown won for the life of the process and later roots were
+silently ignored. The cache lives in the temp directory rather than inside the
+root, since a served corpus is mounted read-only.
+
+### Fixed — de-vendoring aborted the transaction and blamed the next query
+
+When a glob's tree had no `.git`/`.gitmodules` ancestor, the walk up degraded
+to `/` and `_submodule_prefixes('')` read the filesystem root — refused under
+the sandbox. The failure was swallowed by design (de-vendoring is an
+optimization, not a correctness gate), but the aborted DuckDB transaction was
+not rolled back, so the *next* statement failed with "Current transaction is
+aborted" — pointing at the AST cache, which had done nothing wrong. Submodule
+exclusion is now skipped when there is no repository to read, and the fallback
+rolls back so the connection stays usable.
+
+### Fixed — `read_source` output was double-spaced
+
+Rows carry each line's own trailing newline, and the text renderer joined them
+with another, so every second line was blank. That also broke head/tail
+truncation, whose omission message is inserted by row index.
+
 ## 0.8.1
 
 ### Fixed — every code query returned "not found" under fledgling >= 0.13

{squackit-0.8.1 → squackit-0.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: squackit
-Version: 0.8.1
+Version: 0.8.2
 Summary: Semi-QUalified Agent Companion Kit — the stateful intelligence + MCP server layer for fledgling-equipped agents.
 Project-URL: Homepage, https://github.com/teaguesterling/squackit
 Project-URL: Documentation, https://squackit.readthedocs.io

{squackit-0.8.1 → squackit-0.8.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "squackit"
-version = "0.8.1"
+version = "0.8.2"
 description = "Semi-QUalified Agent Companion Kit — the stateful intelligence + MCP server layer for fledgling-equipped agents."
 readme = "README.md"
 license = "Apache-2.0"

{squackit-0.8.1 → squackit-0.8.2}/squackit/server.py

@@ -296,7 +296,12 @@ def _register_executor_tool(mcp, presentation: ToolPresentation):
             if is_text:
                 lines = []
                 for row in rows:
-                    parts = [str(v) for v in row if v is not None]
+                    # Strip each value's own line terminator: this branch joins
+                    # rows with "\n" itself, so a source line that already ends
+                    # in one renders double-spaced, every second line blank.
+                    # Only \r and \n come off — leading indentation is content,
+                    # and so is any trailing space a line genuinely carries.
+                    parts = [str(v).rstrip("\r\n") for v in row if v is not None]
                     lines.append("  ".join(parts))
                 if omission:
                     lines.append(omission)
@@ -594,16 +599,29 @@ def _register_tool(
 
         # Format output
         if is_text:
+            def _cell(value) -> str:
+                """Render one value as a line fragment.
+
+                Drops the value's own line terminator: this branch joins rows
+                with "\\n" itself, and `read_source` returns each line's content
+                WITH its trailing newline. Keeping both renders the file
+                double-spaced — every second line blank — which also breaks
+                head/tail truncation's line accounting, since the omission
+                message is inserted by row index. Only \\r and \\n come off;
+                leading indentation is content and must survive.
+                """
+                return str(value).rstrip("\r\n") if value is not None else ""
+
             if len(cols) == 1:
-                lines = [str(r[0]) for r in rows]
+                lines = [_cell(r[0]) for r in rows]
             elif "line_number" in cols and "content" in cols:
                 ln_idx = cols.index("line_number")
                 ct_idx = cols.index("content")
-                lines = [f"{r[ln_idx]:4d}  {r[ct_idx]}" for r in rows]
+                lines = [f"{r[ln_idx]:4d}  {_cell(r[ct_idx])}" for r in rows]
             else:
                 lines = []
                 for row in rows:
-                    parts = [str(v) for v in row if v is not None]
+                    parts = [_cell(v) for v in row if v is not None]
                     lines.append("  ".join(parts))
             if omission:
                 lines.insert(_HEAD_TAIL, omission)

{squackit-0.8.1 → squackit-0.8.2}/squackit/tools.py

@@ -8,7 +8,10 @@ fledgling macro tools. They take priority over fledgling equivalents
 
 from __future__ import annotations
 
+import hashlib
 import os
+import re
+import tempfile
 
 from fledgling.tools import ToolInfo
 from squackit.tool_config import ToolPresentation
@@ -79,27 +82,41 @@ def _filtered_source(plucker, source: str, peek: str = DEFAULT_PEEK) -> str:
         # prefix (the path before the first wildcard) and walk up to the nearest
         # .gitmodules / .git. The denylist is absolute-pattern based, no root needed.
         prefix = resolved.split("*", 1)[0]
-        root = prefix if prefix.endswith("/") else os.path.dirname(prefix)
-        while root and root != "/":
-            if os.path.exists(os.path.join(root, ".gitmodules")) or os.path.exists(
-                os.path.join(root, ".git")
+        candidate = prefix if prefix.endswith("/") else os.path.dirname(prefix)
+        # Walk up to the repository that owns these files. If there ISN'T one,
+        # leave root empty and skip submodule exclusion entirely: there are no
+        # submodules to exclude, and the walk otherwise degrades to "/", whose
+        # rstrip("/") is the empty string. `_submodule_prefixes('')` then reads
+        # the filesystem root — which a sandboxed connection refuses, aborting
+        # the transaction and taking down every later query on this connection.
+        root = ""
+        while candidate and candidate != "/":
+            if os.path.exists(os.path.join(candidate, ".gitmodules")) or os.path.exists(
+                os.path.join(candidate, ".git")
             ):
+                root = candidate
                 break
-            root = os.path.dirname(root)
+            candidate = os.path.dirname(candidate)
         rq = resolved.replace("'", "''")
-        rootq = root.rstrip("/").replace("'", "''")
 
         total = db.sql(f"SELECT count(*) FROM glob('{rq}')").fetchone()[0]
         if total <= 1:
             return source
 
+        submodule_clause = ""
+        if root:
+            rootq = root.rstrip("/").replace("'", "''")
+            submodule_clause = (
+                f"AND NOT EXISTS (SELECT 1 FROM _submodule_prefixes('{rootq}') s "
+                f"WHERE file LIKE s.prefix || '%') "
+            )
+
         kept = [
             r[0]
             for r in db.sql(
                 f"SELECT file FROM glob('{rq}') "
                 f"WHERE NOT _is_vendored_path(file) "
-                f"AND NOT EXISTS (SELECT 1 FROM _submodule_prefixes('{rootq}') s "
-                f"WHERE file LIKE s.prefix || '%') "
+                f"{submodule_clause}"
                 f"ORDER BY file"
             ).fetchall()
         ]
@@ -115,9 +132,81 @@ def _filtered_source(plucker, source: str, peek: str = DEFAULT_PEEK) -> str:
     except Exception:
         # Ignore-policy macros unavailable / SQL error — fall back to the raw
         # glob. Unfiltered (flooded) results beat a broken tool.
+        #
+        # ROLL BACK FIRST. A failed statement leaves the DuckDB transaction in
+        # an aborted state, so swallowing the error without clearing it poisons
+        # every later query on this connection with "Current transaction is
+        # aborted (please ROLLBACK)" — including the AST cache lookup that runs
+        # moments later. The caller then sees a transaction error from a
+        # statement that never failed, pointing at the wrong subsystem entirely.
+        # Degrading gracefully means the connection is still usable afterwards,
+        # which is the whole promise of this except clause.
+        try:
+            db = plucker._ctx.db
+            if db is not None:
+                db.execute("ROLLBACK")
+        except Exception:
+            pass  # no transaction open, or the connection is beyond saving
         return source
 
 
+def _source_root(source: str) -> str | None:
+    """The directory that must be readable for *source* to resolve.
+
+    A fledgling connection is sandboxed to its root (fledgling >= 0.13), so a
+    Plucker built without one is confined to the process working directory and
+    cannot read a source anywhere else: ``find(source="/srv/code/x/**/*.py")``
+    raised a permission error instead of returning results. These tools take
+    their target as an argument, so the target is the scope — rooting the
+    connection at the source's own directory keeps the sandbox meaningful while
+    letting an explicit path resolve.
+
+    Returns None when there is nothing to root at (a bare table/view name, or a
+    directory that does not exist), leaving pluckit's default behaviour alone.
+    """
+    if not source:
+        return None
+    # A bare identifier is a DuckDB table/view name, not a path.
+    if not any(sep in source for sep in ("/", os.sep)):
+        return None
+    # RELATIVE sources are already handled: they resolve against the working
+    # directory, which is what an un-rooted Plucker sandboxes to. Re-rooting
+    # them would be actively wrong — _filtered_source joins a relative source
+    # onto the connection's repo, so pointing that repo at the source's own
+    # directory turns `squackit/**/*.py` into `.../squackit/squackit/**/*.py`
+    # and the tool finds nothing.
+    if not os.path.isabs(source):
+        return None
+    head = re.split(r"[*?\[]", source, maxsplit=1)[0]
+    directory = head if head.endswith(("/", os.sep)) else os.path.dirname(head)
+    if not directory:
+        return None
+    directory = os.path.abspath(directory)
+    return directory if os.path.isdir(directory) else None
+
+
+def _cache_path(root: str | None) -> str:
+    """Where the AST cache database lives for a Plucker rooted at *root*.
+
+    DuckDB's filesystem allow-list is a property of the database INSTANCE, not
+    of the connection, and every connection to the same file shares one
+    instance. A single shared cache file therefore means the FIRST lockdown
+    wins for the life of the process: a plucker rooted at /srv/code/x reuses
+    the instance already locked to the working directory and is refused access
+    to its own source, with no indication that its root was ignored.
+
+    So a rooted plucker gets its own cache file, keyed by the root. It goes in
+    the temp directory rather than inside the root: a served corpus is mounted
+    read-only, and writing a database into a tree we were only asked to read is
+    rude even where it succeeds. Keying by root keeps the cache reusable across
+    processes, which is the point of persisting it at all.
+    """
+    if root is None:
+        return os.path.join(os.getcwd(), ".pluckit.duckdb")
+    digest = hashlib.sha256(os.path.abspath(root).encode()).hexdigest()[:16]
+    return os.path.join(tempfile.gettempdir(), f"squackit-ast-{digest}.duckdb")
+
+
 def _make_plucker(source: str, peek: str = DEFAULT_PEEK):
     """Create a Plucker with AstViewer and Search for tool execution.
 
@@ -135,7 +224,21 @@ def _make_plucker(source: str, peek: str = DEFAULT_PEEK):
     # parses with ``peek := 'none'`` and can only ever return NULL. Enabling the
     # cache moves the un-filtered path onto ``ast_select_from`` too, so both
     # paths return source text. It also stops re-parsing on every call.
-    p = Plucker(plugins=[AstViewer, Search], cache=True, peek=peek)
+    #
+    # The cache path is passed EXPLICITLY rather than left to `cache=True`.
+    # pluckit derives the default cache file from the repo (`<repo>/.pluckit.duckdb`),
+    # so rooting the connection at the source would also move the cache into the
+    # tree being analysed — which for a served corpus is a read-only mount, and
+    # for anyone else means writing a database into a repo they only asked us to
+    # read. Keeping it under the working directory preserves the location this
+    # had before the connection gained a root.
+    root = _source_root(source)
+    p = Plucker(
+        plugins=[AstViewer, Search],
+        cache=_cache_path(root),
+        peek=peek,
+        repo=root,
+    )
     p._code_source = _filtered_source(p, source, peek)
     return p
 

{squackit-0.8.1 → squackit-0.8.2}/tests/test_truncation.py

@@ -279,7 +279,12 @@ class TestMarkdownTruncation:
         assert omission_idx == 7  # 0:header, 1:sep, 2-6:head, 7:omission
 
     @pytest.mark.anyio
+    @requires_fledgling_source
     async def test_max_results_zero_disables(self, mcp):
+        # recent_changes queries git history, so the dog-food corpus has to be
+        # a repository. An installed wheel in site-packages has no .git and the
+        # macro raises "No git repository found" — a fact about the corpus, not
+        # about truncation.
         result = _text(await mcp.call_tool("recent_changes", {
             "max_results": 0,
         }))

{squackit-0.8.1 → squackit-0.8.2}/tests/test_workflows.py

@@ -9,7 +9,7 @@ from pathlib import Path
 
 import pytest
 
-from conftest import PROJECT_ROOT
+from conftest import PROJECT_ROOT, requires_fledgling_source
 
 try:
     import fastmcp  # noqa: F401
@@ -174,7 +174,18 @@ class TestExplore:
 
 @requires_fastmcp
 class TestInvestigate:
-    """Test the investigate compound tool."""
+    """Test the investigate compound tool.
+
+    The section assertions below need a fledgling SOURCE checkout as the
+    dog-food corpus. Against an installed wheel the corpus is site-packages,
+    where the bundled sql/ outnumbers the Python, so the inferred code_pattern
+    is legitimately `**/*.sql` and investigating a Python symbol finds nothing
+    — the briefing then has no Definition/Source/Called-by sections. That is a
+    fact about the corpus, not about investigate, and asserting it against a
+    wheel sends anyone debugging it into squackit's scoping logic instead. The
+    tests that hold either way (registration, unknown-name handling, project
+    scoping) stay unmarked.
+    """
 
     @pytest.fixture(scope="class")
     def text(self, mcp):
@@ -185,12 +196,15 @@ class TestInvestigate:
     def test_returns_non_empty(self, text):
         assert len(text) > 0
 
+    @requires_fledgling_source
     def test_contains_definition_section(self, text):
         assert "Definition" in text
 
+    @requires_fledgling_source
     def test_contains_source_section(self, text):
         assert "Source" in text
 
+    @requires_fledgling_source
     def test_contains_called_by_section(self, text):
         assert "Called by" in text