tanglebrain 0.22.0__tar.gz → 0.24.0__tar.gz

{tanglebrain-0.22.0/tanglebrain.egg-info → tanglebrain-0.24.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tanglebrain
-Version: 0.22.0
+Version: 0.24.0
 Summary: A local-first, config-driven LLM router across OpenAI-compatible backends you own.
 Author: Jason Vaughan
 License: MIT
@@ -30,8 +30,8 @@ Requires-Dist: PyYAML<7,>=6.0
 Provides-Extra: delegate
 Requires-Dist: mcp<3,>=2; extra == "delegate"
 Provides-Extra: dev
-Requires-Dist: ruff<0.17,>=0.16; extra == "dev"
-Requires-Dist: mypy<2.4,>=2.3; extra == "dev"
+Requires-Dist: ruff<0.17,>=0.16.6; extra == "dev"
+Requires-Dist: mypy<2.4,>=2.3.1; extra == "dev"
 Requires-Dist: types-PyYAML<7,>=6; extra == "dev"
 Dynamic: license-file
 
@@ -295,8 +295,13 @@ A thin **localhost-only** web panel over the config — zero extra dependencies
 .venv/bin/tanglebrain-gui --port 3260   # override the port if 3250 is busy
 ```
 
-The panel **views** the roster, the pricing reference, and the cost-avoided rollup, and lets you
-**run a prompt** through the router (showing which tier/model served it). The **pricing card is
+The panel has two views, switched from the sidebar and addressable by fragment. **Chat**
+(`#/chat`, where it opens) lets you **run a prompt** through the router, showing which tier/model
+served it. **Settings** (`#/settings`) holds the knobs: the cost-avoided rollup, the roster, and the
+pricing reference. A **status footer** sits beneath both, carrying the signals that qualify every
+figure on the page — the placeholder-pricing caveat and any measurement-health finding — so they
+do not depend on which view you are on. It is absent when there is nothing to report, and says so
+plainly when the figures could not be read at all. The **pricing card is
 editable** — change the rates / reference label / placeholder flag and Save; it writes the tracked
 `tanglebrain/config/pricing.yaml` (strict validation, atomic write, a backup to the state dir, and
 the methodology header preserved), so the edit is git-visible for you to commit. The **roster is
@@ -500,9 +505,9 @@ order and never paid-routes a roster that has no orchestrators to exhaust first.
    `key_ref` = the env/file reference above, `enabled: true`, and `budget_usd_month: 25`
    (display-only — match what you capped at the source).
 4. **Flip the global gate**: set `api_billing_enabled: true` in `tanglebrain/config/settings.yaml`.
-5. **Verify** in the knob panel (`tanglebrain-gui`): the roster card shows a **Paid-API billing: ON**
-   banner and the entry's `budget: $25.00/mo` note; or run `tanglebrain --model <id> "…"` for an
-   explicit paid call. To pause spend without editing keys, set the entry's `enabled: false` (a
+5. **Verify** in the knob panel (`tanglebrain-gui`): open **Settings** in the sidebar — the panel
+   opens on Chat — and the roster card there shows a **Paid-API billing: ON** banner and the entry's
+   `budget: $25.00/mo` note; or run `tanglebrain --model <id> "…"` for an explicit paid call. To pause spend without editing keys, set the entry's `enabled: false` (a
    per-key kill-switch) or flip the global gate back to `false`.
 
 ## Develop

{tanglebrain-0.22.0 → tanglebrain-0.24.0}/README.md

@@ -258,8 +258,13 @@ A thin **localhost-only** web panel over the config — zero extra dependencies
 .venv/bin/tanglebrain-gui --port 3260   # override the port if 3250 is busy
 ```
 
-The panel **views** the roster, the pricing reference, and the cost-avoided rollup, and lets you
-**run a prompt** through the router (showing which tier/model served it). The **pricing card is
+The panel has two views, switched from the sidebar and addressable by fragment. **Chat**
+(`#/chat`, where it opens) lets you **run a prompt** through the router, showing which tier/model
+served it. **Settings** (`#/settings`) holds the knobs: the cost-avoided rollup, the roster, and the
+pricing reference. A **status footer** sits beneath both, carrying the signals that qualify every
+figure on the page — the placeholder-pricing caveat and any measurement-health finding — so they
+do not depend on which view you are on. It is absent when there is nothing to report, and says so
+plainly when the figures could not be read at all. The **pricing card is
 editable** — change the rates / reference label / placeholder flag and Save; it writes the tracked
 `tanglebrain/config/pricing.yaml` (strict validation, atomic write, a backup to the state dir, and
 the methodology header preserved), so the edit is git-visible for you to commit. The **roster is
@@ -463,9 +468,9 @@ order and never paid-routes a roster that has no orchestrators to exhaust first.
    `key_ref` = the env/file reference above, `enabled: true`, and `budget_usd_month: 25`
    (display-only — match what you capped at the source).
 4. **Flip the global gate**: set `api_billing_enabled: true` in `tanglebrain/config/settings.yaml`.
-5. **Verify** in the knob panel (`tanglebrain-gui`): the roster card shows a **Paid-API billing: ON**
-   banner and the entry's `budget: $25.00/mo` note; or run `tanglebrain --model <id> "…"` for an
-   explicit paid call. To pause spend without editing keys, set the entry's `enabled: false` (a
+5. **Verify** in the knob panel (`tanglebrain-gui`): open **Settings** in the sidebar — the panel
+   opens on Chat — and the roster card there shows a **Paid-API billing: ON** banner and the entry's
+   `budget: $25.00/mo` note; or run `tanglebrain --model <id> "…"` for an explicit paid call. To pause spend without editing keys, set the entry's `enabled: false` (a
    per-key kill-switch) or flip the global gate back to `false`.
 
 ## Develop

{tanglebrain-0.22.0 → tanglebrain-0.24.0}/pyproject.toml

@@ -1,10 +1,43 @@
 [build-system]
-requires = ["setuptools>=68", "wheel"]
+# setuptools carries a floor because `>= 68` admits two advisories this project has no reason to
+# keep accepting:
+#   * GHSA-5rjg-fvgr-3xxf / CVE-2025-47273 (HIGH) — path traversal in `PackageIndex.download`,
+#     fixed in 78.1.1.
+#   * GHSA-h35f-9h28-mq5c / CVE-2026-59890 (MODERATE) — a `MANIFEST.in` exclusion bypass when
+#     building an sdist, via a Unicode NFC/NFD normalization collision, fixed in 83.0.0. That one
+#     is a defect in the exact operation this requirement governs.
+#
+# This is a BUILD requirement, not a runtime one: it is resolved when building from an sdist, never
+# by someone installing the wheel. So it owes no announcement under
+# docs/design/deprecation-policy.md § Dependency floors, which governs what a *user* may install.
+# That asymmetry is the rule, recorded in that document: a build requirement carries the ceiling and
+# is exempt from the announcement, and it is why this floor could move while a runtime floor raise
+# has to earn its way past an announcement first.
+#
+# WHY 84 AND NOT 83, since the change that justifies this is fixed in 83.0.0: 83 is the security
+# minimum and `>= 83, < 85` would be equally safe. 84 is simply the current major, which keeps the
+# floor and the ceiling one window apart. The security argument buys 83; the extra step to 84 is a
+# convention choice and is not claimed as security.
+#
+# THE CEILING'S COST, stated because it is real: setuptools ships majors every few weeks (77
+# through 84 inside a year), so `< 85` will produce a Dependabot pull request often. It is kept
+# because the upper-bound rule has no exemption for build requirements. Note what does NOT justify
+# it — the weekly CI canary cannot help here, because with this cap in force an isolated build only
+# ever resolves 84.x, so a breaking *major* is precisely what the canary cannot see. What catches
+# that is CI on the Dependabot pull request that raises the cap, which is the model
+# docs/design/nonfunctional-requirements.md already describes.
+#
+# `wheel` is bounded rather than dropped. setuptools has declared it itself since v70, so at this
+# floor it is redundant and could go — but removing a build requirement is a packaging change with
+# its own blast radius, not a version bump, and this change is scoped to the floors. Tracked
+# separately rather than left as a comment. The floor is the current minor and the ceiling the
+# major boundary; `wheel` had no constraint at all before this.
+requires = ["setuptools >= 84, < 85", "wheel >= 0.45, < 1"]
 build-backend = "setuptools.build_meta"
 
 [project]
 name = "tanglebrain"
-version = "0.22.0"
+version = "0.24.0"
 description = "A local-first, config-driven LLM router across OpenAI-compatible backends you own."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -55,7 +88,7 @@ delegate = ["mcp >= 2, < 3"]
 # an API break. The canary argument that justifies a wide range for a runtime dependency does not
 # transfer here — no user resolves a dev tool, so an unannounced upgrade is pure noise. Bump these
 # deliberately; a tool release that reds the gate is fixed, not un-gated.
-dev = ["ruff >= 0.16, < 0.17", "mypy >= 2.3, < 2.4", "types-PyYAML >= 6, < 7"]
+dev = ["ruff >= 0.16.6, < 0.17", "mypy >= 2.3.1, < 2.4", "types-PyYAML >= 6, < 7"]
 
 [project.urls]
 Homepage = "https://github.com/Jason-Vaughan/TangleBrain"

{tanglebrain-0.22.0 → tanglebrain-0.24.0}/tanglebrain/cli.py

@@ -31,6 +31,7 @@ from tanglebrain.measurement import (
     rollup,
 )
 from tanglebrain.roster import RosterEntry, RosterError, load_roster
+from tanglebrain.integrity import warn_if_migration_incomplete
 from tanglebrain.router import Router, RouterError, migrate_state_root
 from tanglebrain.selector import SelectionError, build_adapter, select_by_id, select_local
 from tanglebrain.settings import load_settings
@@ -445,6 +446,9 @@ def main(argv: list[str] | None = None) -> int:
     # Move a pre-0.21 cache-tier state root forward before anything reads it. Idempotent,
     # never raises; the notice goes to stderr so a piped answer stays clean.
     migrate_state_root()
+    # Then say so if that move — or the v0.21.0 one that predates the unique staging name —
+    # left the log short. Read-only: it reports, and never touches the operator's data.
+    warn_if_migration_incomplete()
     parser = build_parser()
     args = parser.parse_args(argv)
 

{tanglebrain-0.22.0 → tanglebrain-0.24.0}/tanglebrain/gui/server.py

@@ -15,6 +15,7 @@ import json
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from importlib import resources
 
+from tanglebrain.integrity import warn_if_migration_incomplete
 from tanglebrain.router import migrate_state_root
 from tanglebrain.gui.views import (
     DEFAULT_PORT,
@@ -159,9 +160,13 @@ def main(argv: list[str] | None = None) -> int:
     # Move a pre-0.21 cache-tier state root forward before anything reads it. Idempotent,
     # never raises; the notice goes to stderr so a piped answer stays clean.
     migrate_state_root()
+    # Then say so if that move — or the v0.21.0 one that predates the unique staging name —
+    # left the log short. Read-only: it reports, and never touches the operator's data.
+    warn_if_migration_incomplete()
     parser = argparse.ArgumentParser(
         prog="tanglebrain-gui",
-        description="Serve the TangleBrain knob panel (read-only) on localhost.",
+        description="Serve the TangleBrain knob panel on localhost. Reads the roster, pricing and\n"
+                    "spend-avoided rollup; can run prompts and edit pricing and roster fields.",
     )
     parser.add_argument(
         "--port", type=int, default=DEFAULT_PORT,