shape-doctor.py: the members row prints a mount url and a stranger's origin raw, so an ESC in either reaches the terminal as a control, where make siblings spells the same values in its WRONG ORIGIN finding #673

Goal: no value the members row quotes from a manifest, a disk or git reaches the terminal as a control character.

Filed by lane openRepoShape-3 on Brett Heap's word of 2026-10-16T12:24:41Z ("give #460 to lane 3").

What happens (measured on main d4a7fab9):

• The setup. A holder from the suite's holder fixture has its member's url in .gitmodules rewritten to <remotes>/caf\x1b[31m/IRRS.git (mount_through in tests/test_doctor_gitmodules_not_utf8.py). A clone of the member's real remote sits beside it.
• The result. shape-doctor.py --root <holder> exits 0. Its printed members row reads: IRRS: <dir> is a clone of <remotes>/IRRS.git, not of <remotes>/caf, then a raw ESC, then [31m/IRRS.git, so it is not counted as its working clone.
• Why it matters. A terminal reads that ESC as a colour change. A CR, a line break or U+202E in the same place would overwrite or reorder the line.
• make siblings already spells these values. Its WRONG ORIGIN finding names the same directory and the same two urls, and since siblings.py and the family-root README: make siblings, park and resume print the family's name and every member row spelled and never end in a traceback on name: "a\ud83db" or a dash under PYTHONIOENCODING=ascii, and the holder's README names its folder after the repository, so --family Quill --name QuillWorks lays out as its README says (#454, #629) #642 (family-root siblings.py: make siblings, park and resume print the family's name with a plain print, so name: "a\ud83db" ends each in a UnicodeEncodeError, and the literal dash ends every name under PYTHONIOENCODING=ascii #454) it spells each one: templates/family-root/scripts/siblings.py:474-489 uses spelled(project), spelled(target), spelled(origin or '(no origin)') and spelled(repository or url).
• Pinned shape copies: one bump, so AGENTS-shape.md is true of every root, the scaffold's chain WARNING offers only its own sources and spells --pin-source, the root's not-used note spells it too, and THE LOCKSTEP RULE's bump runs (#610) #634 (Pinned shape copies: AGENTS-shape.md's CONTRACTS_DIR sentence is false for every scaffolded root, and the chain WARNING offers remedies the scaffold lacks (one shape bump before the v1.1.0 tag) #610, open) does not reach it.
  • Pinned shape copies: one bump, so AGENTS-shape.md is true of every root, the scaffold's chain WARNING offers only its own sources and spells --pin-source, the root's not-used note spells it too, and THE LOCKSTEP RULE's bump runs (#610) #634 spells repo_shape.git_out's git-failed refusal (shown_path(cwd), spelled(stderr)), and some prints in validate-pins.py, the naming gate, the scaffold and validate-family.py.
  • It touches no line of shape-doctor.py.
  • This row's urls come from git's STDOUT, through submodule_config and origin_url, never from a refusal.

Where it is (main d4a7fab9), in shape-doctor.py:

• :7322-7328 (members_verdict). The stranger sentence interpolates entry['project'], ctx.root.parent / entry['project'], entry['other_origin'] and entry['mounted_from'] raw.
• :7186 and :7230 (working_clone, member_state) apply only redacted(...), which keeps controls (scripts/repo_shape.py:2740-2752).
• :814 (Row.__init__) applies only ascii_text(reason) (:624-636), whose encode("ascii", "replace") keeps every ASCII control.

The change:

• Spell every quoted value. Spell each value the members row quotes from family.yaml, the disk or git with repo_shape.spelled: the project, the directory, the origin and the mount url, as siblings.py spells the same four.
  • spelled has been on main since templates/assembly-root/scripts/bootstrap.py and templates/family-root/scripts/bootstrap.py: main prints the manifest's name with a plain print before any step runs, so name: "a\ud83db" (a lone surrogate) ends make bootstrap in a UnicodeEncodeError traceback, exit 1 (make: 2), and the validator that names the problem is never reached; a valid name the stdout cannot encode ends the same way #391.
  • The doctor already imports from its own checkout's scripts/repo_shape.py, which is not a pinned copy of any project.
  • A plain value prints byte for byte as before.
• --json keeps the raw values. They are data, and json.dumps escapes them.
• Out of scope:
  • other rows that quote a value raw (Pinned shape copies: AGENTS-shape.md's CONTRACTS_DIR sentence is false for every scaffolded root, and the chain WARNING offers remedies the scaffold lacks (one shape bump before the v1.1.0 tag) #610's class, across the doctor);
  • a general guard in Row for reason and why but never next, where an escape would not run as typed. That is a separate decision.
• No dependency on Pinned shape copies: one bump, so AGENTS-shape.md is true of every root, the scaffold's chain WARNING offers only its own sources and spells --pin-source, the root's not-used note spells it too, and THE LOCKSTEP RULE's bump runs (#610) #634. It can land before or after.
• Pinned shape copies: none. shape-doctor.py is not one.

Tests, in a new file such as tests/test_doctor_members_spelled.py (it can import the fixtures of tests/test_doctor_gitmodules_not_utf8.py):

• A mount url and a stranger's origin, each holding ESC, CR, NEL and U+202E:
  • the printed row holds each one as Python's escape and no raw control, on a UTF-8 stdout and under PYTHONIOENCODING=ascii;
  • the --json detail holds the raw url.
• A plain url leaves the row's text unchanged.

From #460, #460 (comment) (L24)

🤖 Generated with Claude Code