datalegion-cli 1.5.0__tar.gz → 1.5.2__tar.gz

datalegion_cli-1.5.2/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Data Legion
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{datalegion_cli-1.5.0 → datalegion_cli-1.5.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: datalegion-cli
-Version: 1.5.0
+Version: 1.5.2
 Summary: CLI for the Data Legion API — agent-friendly, fully async
 Project-URL: Homepage, https://www.datalegion.ai
 Project-URL: Documentation, https://www.datalegion.ai/docs
@@ -8,6 +8,7 @@ Project-URL: Repository, https://github.com/datalegion-ai/datalegion-cli
 Project-URL: Issues, https://github.com/datalegion-ai/datalegion-cli/issues
 Author-email: Data Legion <engineering@datalegion.ai>
 License-Expression: MIT
+License-File: LICENSE
 Keywords: b2b,cli,company-enrichment,contact-data,data-enrichment,datalegion,enrichment,person-enrichment
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
@@ -19,8 +20,8 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: 3.15
-Classifier: Typing :: Typed
 Requires-Python: >=3.11
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: cryptography>=44.0.0
 Requires-Dist: httpx>=0.28.0
 Requires-Dist: loguru>=0.7.0
@@ -29,7 +30,6 @@ Requires-Dist: pydantic-settings>=2.6.0
 Requires-Dist: pydantic>=2.9.0
 Requires-Dist: rich>=13.9.0
 Requires-Dist: tomli-w>=1.0.0
-Requires-Dist: tomli>=2.0.0; python_version < '3.11'
 Requires-Dist: typer>=0.15.0
 Description-Content-Type: text/markdown
 
@@ -50,7 +50,7 @@ datalegion-cli person enrich --email john@example.com
 - **Fully async** — async from entry point to HTTP client, powered by `asyncio` and `httpx`
 - **Agent-friendly** — all output is JSON to stdout, logs go to stderr, supports `--stdin` for piping
 - **Encrypted config** — API keys are stored encrypted at rest (Fernet + PBKDF2, machine-tied)
-- **Auto-update** — checks GitHub releases and self-updates via Homebrew, GitHub release, git pull, or pip/uv
+- **Auto-update** — checks PyPI for a newer release and self-updates via Homebrew, GitHub release, git pull, or pip/uv
 - **Multiple install methods** — Homebrew, GitHub release, pip/uv (with private index support), or from source
 
 ## Installation
@@ -143,9 +143,9 @@ The `update` command auto-detects how the CLI was installed:
 
 | Method | Detection | Update strategy |
 |--------|-----------|-----------------|
-| `brew` | `brew list` finds the formula | `brew upgrade` |
+| `brew` | The running Python is the formula's own venv under Homebrew's Cellar | `brew upgrade` |
 | `github` | Set via config | Downloads `.whl` from GitHub release |
-| `git` | `.git` directory in parent tree | `git pull --ff-only` + `uv sync` |
+| `git` | An editable install from a git checkout (its `direct_url.json`) | `git pull --ff-only` + `uv sync` in that checkout |
 | `pip` | Default fallback | `uv pip install --upgrade` |
 
 You can override detection by setting `install_method` in config. For pip installs from a private index, set the `LEGION_PIP_INDEX_URL` environment variable.

{datalegion_cli-1.5.0 → datalegion_cli-1.5.2}/README.md

@@ -15,7 +15,7 @@ datalegion-cli person enrich --email john@example.com
 - **Fully async** — async from entry point to HTTP client, powered by `asyncio` and `httpx`
 - **Agent-friendly** — all output is JSON to stdout, logs go to stderr, supports `--stdin` for piping
 - **Encrypted config** — API keys are stored encrypted at rest (Fernet + PBKDF2, machine-tied)
-- **Auto-update** — checks GitHub releases and self-updates via Homebrew, GitHub release, git pull, or pip/uv
+- **Auto-update** — checks PyPI for a newer release and self-updates via Homebrew, GitHub release, git pull, or pip/uv
 - **Multiple install methods** — Homebrew, GitHub release, pip/uv (with private index support), or from source
 
 ## Installation
@@ -108,9 +108,9 @@ The `update` command auto-detects how the CLI was installed:
 
 | Method | Detection | Update strategy |
 |--------|-----------|-----------------|
-| `brew` | `brew list` finds the formula | `brew upgrade` |
+| `brew` | The running Python is the formula's own venv under Homebrew's Cellar | `brew upgrade` |
 | `github` | Set via config | Downloads `.whl` from GitHub release |
-| `git` | `.git` directory in parent tree | `git pull --ff-only` + `uv sync` |
+| `git` | An editable install from a git checkout (its `direct_url.json`) | `git pull --ff-only` + `uv sync` in that checkout |
 | `pip` | Default fallback | `uv pip install --upgrade` |
 
 You can override detection by setting `install_method` in config. For pip installs from a private index, set the `LEGION_PIP_INDEX_URL` environment variable.

{datalegion_cli-1.5.0 → datalegion_cli-1.5.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "datalegion-cli"
-version = "1.5.0"
+version = "1.5.2"
 description = "CLI for the Data Legion API — agent-friendly, fully async"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -27,15 +27,16 @@ classifiers = [
     "Programming Language :: Python :: 3.14",
     "Programming Language :: Python :: 3.15",
     "Environment :: Console",
-    "Typing :: Typed",
 ]
 dependencies = [
     "typer>=0.15.0",
     "httpx>=0.28.0",
+    # httpx verifies TLS against certifi's bundle. 2026.10.19 drops emSign ECC Root CA - G3, whose
+    # intermediates were compromised (GHSA-6q48-6c7w-9gw2), so upgrading the CLI fixes it.
+    "certifi>=2026.10.19",
     "pydantic>=2.9.0",
     "pydantic-settings>=2.6.0",
     "rich>=13.9.0",
-    "tomli>=2.0.0; python_version < '3.11'",
     "tomli-w>=1.0.0",
     "packaging>=24.0",
     "loguru>=0.7.0",
@@ -58,9 +59,12 @@ build-backend = "hatchling.build"
 [tool.hatch.build.targets.wheel]
 packages = ["src/datalegion_cli"]
 
-# The sdist carries the source and tests, never repo tooling (.github/, .claude/, lefthook.yml).
+# The sdist carries the source, tests and license, never repo tooling (.github/, .claude/,
+# lefthook.yml). Its tests must pass from the sdist alone, so the conventions tests, which read
+# the git index, stay out.
 [tool.hatch.build.targets.sdist]
-only-include = ["src/datalegion_cli", "tests"]
+only-include = ["src/datalegion_cli", "tests", "LICENSE"]
+exclude = ["tests/test_conventions.py", "tests/_conventions.py"]
 
 [dependency-groups]
 dev = [
@@ -91,6 +95,10 @@ ignore = [
     "E501",  # line length (handled by formatter)
 ]
 
+[tool.ruff.lint.per-file-ignores]
+# A byte-identical copy of datalegion-shared's module, held to shared's lint, not edited here
+"tests/_conventions.py" = ["SIM", "TC"]
+
 [tool.ruff.lint.isort]
 known-first-party = ["datalegion_cli"]
 

{datalegion_cli-1.5.0 → datalegion_cli-1.5.2}/src/datalegion_cli/commands/company.py

@@ -63,7 +63,7 @@ async def enrich(
     Examples:
         datalegion-cli company enrich --domain google.com
         datalegion-cli company enrich --name "Acme Corp" --industry "Software"
-        datalegion-cli company enrich --ticker AAPL --fields "name,industry,revenue"
+        datalegion-cli company enrich --ticker AAPL --fields "name,industry,legion_employee_count"
         echo '{"domain":"stripe.com"}' | datalegion-cli company enrich --stdin
     """
     if stdin:
@@ -104,12 +104,12 @@ async def search(
     include_fields: FieldsInclude = None,
     exclude_fields: FieldsExclude = None,
 ) -> None:
-    """Search for companies using SQL WHERE syntax (Beta).
+    """Search for companies with a SQL SELECT over the companies table, no LIMIT (Beta).
 
     Examples:
-        datalegion-cli company search "industry = 'Software' AND employee_count > 100"
-        datalegion-cli company search "name LIKE '%tech%'" --limit 20
-        datalegion-cli company search "revenue > 1000000" --fields "name,revenue,domain"
+        datalegion-cli company search "SELECT * FROM companies WHERE industry ILIKE '%software%' AND legion_employee_count > 100"
+        datalegion-cli company search "SELECT * FROM companies WHERE name ILIKE '%tech%'" --limit 20
+        datalegion-cli company search "SELECT * FROM companies WHERE domain = 'stripe.com'" --fields "name,domain,industry"
     """
     client = LegionClient()
     try:

{datalegion_cli-1.5.0 → datalegion_cli-1.5.2}/src/datalegion_cli/commands/person.py

@@ -78,7 +78,7 @@ async def enrich(
     Examples:
         datalegion-cli person enrich --email john@example.com
         datalegion-cli person enrich --name "Jane Doe" --company "Acme Corp"
-        datalegion-cli person enrich --phone "+14155551234" --fields "name,email,title"
+        datalegion-cli person enrich --phone "+14155551234" --fields "full_name,work_email,job_title"
         echo '{"email":"jane@example.com"}' | datalegion-cli person enrich --stdin
     """
     if stdin:
@@ -130,12 +130,11 @@ async def search(
     include_fields: FieldsInclude = None,
     exclude_fields: FieldsExclude = None,
 ) -> None:
-    """Search for people using SQL WHERE syntax (Beta).
+    """Search for people with a SQL SELECT over the people table, no LIMIT (Beta).
 
     Examples:
-        datalegion-cli person search "job_title = 'CEO' AND company = 'Acme Corp'"
-        datalegion-cli person search "city = 'San Francisco'" --limit 20
-        datalegion-cli person search "school = 'MIT'" --fields "name,email,company"
+        datalegion-cli person search "SELECT * FROM people WHERE job_title = 'ceo' AND company_name ILIKE '%acme%'"
+        datalegion-cli person search "SELECT * FROM people WHERE city = 'san francisco'" --limit 20
     """
     client = LegionClient()
     try:

{datalegion_cli-1.5.0 → datalegion_cli-1.5.2}/src/datalegion_cli/config.py

@@ -7,18 +7,13 @@ import getpass
 import hashlib
 import os
 import platform
+import tomllib
 from pathlib import Path
 
+import tomli_w
 from cryptography.fernet import Fernet, InvalidToken
 from loguru import logger
 
-try:
-    import tomllib
-except ModuleNotFoundError:  # Python < 3.11
-    import tomli as tomllib  # type: ignore[no-redef]
-
-import tomli_w
-
 CONFIG_DIR = Path(os.environ.get("LEGION_CONFIG_DIR", Path.home() / ".datalegion"))
 CONFIG_FILE = CONFIG_DIR / "config.toml"
 

{datalegion_cli-1.5.0 → datalegion_cli-1.5.2}/src/datalegion_cli/update.py

@@ -1,13 +1,17 @@
-"""Auto-update — checks GitHub releases and self-updates via brew, github, git, uv, or pip."""
+"""Auto-update — checks PyPI for a newer release and self-updates via brew, github, git, uv, or pip."""
 
 from __future__ import annotations
 
 import asyncio
+import json
 import os
 import shutil
 import sys
 import tempfile
+from importlib.metadata import PackageNotFoundError, distribution
 from pathlib import Path
+from urllib.parse import urlparse
+from urllib.request import url2pathname
 
 import httpx
 from loguru import logger
@@ -22,6 +26,38 @@ GITHUB_REPO_URL = f"https://github.com/{GITHUB_REPO}.git"
 BREW_TAP = "datalegion-ai/tap"
 BREW_FORMULA = "datalegion-cli"
 PKG_NAME = "datalegion_cli"
+DIST_NAME = "datalegion-cli"
+
+
+def _source_checkout() -> Path | None:
+    """The git checkout this CLI is installed from in editable mode, or None.
+
+    Read from the install's own record (PEP 610 ``direct_url.json``), never by walking up from
+    the package: a wheel installed into a project's ``.venv`` sits inside that project's git
+    repo, and treating it as a checkout would ``git pull`` and ``uv sync`` the customer's project.
+    """
+    try:
+        raw = distribution(DIST_NAME).read_text("direct_url.json")
+    except PackageNotFoundError:
+        return None
+    if not raw:
+        return None
+    try:
+        record = json.loads(raw)
+    except ValueError:
+        return None
+    if not record.get("dir_info", {}).get("editable"):
+        return None
+    url = urlparse(record.get("url", ""))
+    if url.scheme != "file":
+        return None
+    root = Path(url2pathname(url.path))
+    return root if (root / ".git").exists() else None
+
+
+def _installed_by_brew() -> bool:
+    """True when this interpreter is the formula's own venv under Homebrew's Cellar."""
+    return f"/Cellar/{BREW_FORMULA}/" in Path(sys.prefix).resolve().as_posix()
 
 
 async def check_for_update(*, quiet: bool = False) -> str | None:
@@ -57,25 +93,12 @@ async def _detect_install_method() -> str:
     if method in ("brew", "github", "git", "pip"):
         return method
 
-    # Check if installed via Homebrew
-    if brew := shutil.which("brew"):
-        proc = await asyncio.create_subprocess_exec(
-            brew,
-            "list",
-            BREW_FORMULA,
-            stdout=asyncio.subprocess.DEVNULL,
-            stderr=asyncio.subprocess.DEVNULL,
-        )
-        await proc.wait()
-        if proc.returncode == 0:
-            return "brew"
-
-    # Check if running from a git clone
-    pkg_dir = Path(__file__).resolve().parent
-    for parent in pkg_dir.parents:
-        if (parent / ".git").exists():
-            return "git"
-
+    # The running interpreter decides, not what else is on the machine: a pip copy on a
+    # machine that also has the formula is still a pip copy.
+    if _installed_by_brew():
+        return "brew"
+    if _source_checkout() is not None:
+        return "git"
     return "pip"
 
 
@@ -168,13 +191,7 @@ async def _download_asset(url: str, dest_dir: str) -> Path:
 
 async def _update_git() -> None:
     """Update a local git clone via git pull + uv sync."""
-    pkg_dir = Path(__file__).resolve().parent
-    repo_root: Path | None = None
-    for parent in pkg_dir.parents:
-        if (parent / ".git").exists():
-            repo_root = parent
-            break
-
+    repo_root = _source_checkout()
     if repo_root is None:
         logger.error("Could not find git repo root.")
         raise SystemExit(1)

{datalegion_cli-1.5.0 → datalegion_cli-1.5.2}/tests/test_client.py

@@ -248,9 +248,12 @@ def test_sandbox_flag_turns_it_on(monkeypatch):
 
     from datalegion_cli.main import app
 
-    monkeypatch.delenv("LEGION_SANDBOX", raising=False)
+    # setenv first so monkeypatch records the variable's original state and restores it. A
+    # delenv after the CLI set it would record "1" as the value to put back, leaking sandbox
+    # mode into every later test.
+    monkeypatch.setenv("LEGION_SANDBOX", "")
+    monkeypatch.delenv("LEGION_SANDBOX")
     CliRunner().invoke(app, ["--sandbox", "version"])
     import os
 
     assert os.environ.get("LEGION_SANDBOX") == "1"
-    monkeypatch.delenv("LEGION_SANDBOX", raising=False)

datalegion_cli-1.5.2/tests/test_package_contents.py

@@ -0,0 +1,112 @@
+"""What the published wheel and sdist contain.
+
+Customers install the wheel: it must hold only the ``datalegion_cli`` package, and its only
+command is ``datalegion-cli``. The sdist carries the source and tests, never repo tooling.
+"""
+
+import os
+import subprocess
+import sys
+import tarfile
+import zipfile
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+@pytest.fixture(scope="module")
+def dist(tmp_path_factory: pytest.TempPathFactory) -> Path:
+    out = tmp_path_factory.mktemp("dist")
+    # Each straight from the source tree: a default build makes the wheel from the sdist, which
+    # would hide a wheel misconfiguration behind the sdist's own include list.
+    for target in ("--sdist", "--wheel"):
+        subprocess.run(
+            ["uv", "build", target, "--quiet", "--out-dir", str(out)], cwd=ROOT, check=True
+        )
+    return out
+
+
+def test_wheel_ships_only_the_cli(dist: Path) -> None:
+    (wheel,) = dist.glob("*.whl")
+    with zipfile.ZipFile(wheel) as archive:
+        names = archive.namelist()
+        commands = next(
+            (archive.read(n).decode() for n in names if n.endswith("entry_points.txt")), ""
+        )
+    top_level = {n.split("/")[0] for n in names if not n.split("/")[0].endswith(".dist-info")}
+    assert top_level == {"datalegion_cli"}
+    assert any(n.endswith(".dist-info/licenses/LICENSE") for n in names)
+    assert commands.split() == [
+        "[console_scripts]",
+        "datalegion-cli",
+        "=",
+        "datalegion_cli.main:run",
+    ]
+
+
+def test_sdist_carries_no_repo_tooling(dist: Path) -> None:
+    (sdist,) = dist.glob("*.tar.gz")
+    with tarfile.open(sdist) as archive:
+        names = archive.getnames()
+    leaked = [
+        n
+        for n in names
+        if any(part in n.split("/") for part in (".claude", ".github", "scripts", "lefthook.yml"))
+    ]
+    assert leaked == []
+    assert any(n.endswith("src/datalegion_cli/main.py") for n in names)
+
+
+def test_sdist_carries_the_license_and_no_git_bound_tests(dist: Path) -> None:
+    (sdist,) = dist.glob("*.tar.gz")
+    with tarfile.open(sdist) as archive:
+        names = {n.split("/", 1)[1] for n in archive.getnames() if "/" in n}
+    assert "LICENSE" in names
+    assert "tests/test_conventions.py" not in names
+    assert "tests/_conventions.py" not in names
+
+
+def test_sdist_tests_pass_from_the_sdist_alone(dist: Path, tmp_path: Path) -> None:
+    (sdist,) = dist.glob("*.tar.gz")
+    with tarfile.open(sdist) as archive:
+        archive.extractall(tmp_path, filter="data")
+    (root,) = [p for p in tmp_path.iterdir() if p.is_dir()]
+    # A clean environment: nothing from this run (LEGION_* settings an earlier test left, the
+    # user's own config) may reach the sdist's tests.
+    env = {k: v for k, v in os.environ.items() if not k.startswith(("LEGION_", "DATALEGION_"))}
+    env["HOME"] = str(tmp_path / "home")
+    # The sdist's own source first on the path, on the interpreter running these tests (it has
+    # every dependency already), so nothing is installed or fetched: no network, no resolution.
+    # Code comes from the sdist; package metadata (version, direct_url.json) still comes from the
+    # running environment's install, so a test here must not rely on how the package was installed.
+    env["PYTHONPATH"] = str(root / "src")
+    result = subprocess.run(
+        [
+            sys.executable,
+            "-m",
+            "pytest",
+            "-q",
+            "-p",
+            "no:cacheprovider",
+            "tests",
+            "--ignore",
+            "tests/test_package_contents.py",
+        ],
+        cwd=root,
+        env=env,
+        capture_output=True,
+        text=True,
+    )
+    imported = subprocess.run(
+        [sys.executable, "-c", "import datalegion_cli; print(datalegion_cli.__file__)"],
+        cwd=root,
+        env=env,
+        capture_output=True,
+        text=True,
+        check=True,
+    ).stdout.strip()
+    # The tests exercised the sdist's copy, not this checkout's installed one.
+    assert Path(imported).resolve().is_relative_to((root / "src").resolve())
+    assert result.returncode == 0, result.stdout[-2000:]

{datalegion_cli-1.5.0 → datalegion_cli-1.5.2}/tests/test_update.py

@@ -2,12 +2,20 @@
 
 from __future__ import annotations
 
+import json
 from unittest.mock import AsyncMock, patch
 
 import httpx
 import pytest
 
-from datalegion_cli.update import _detect_install_method, _run, check_for_update, self_update
+from datalegion_cli.update import (
+    _detect_install_method,
+    _run,
+    _source_checkout,
+    _update_git,
+    check_for_update,
+    self_update,
+)
 
 
 @pytest.mark.asyncio
@@ -74,9 +82,16 @@ class TestRun:
         mock_proc.communicate = AsyncMock(return_value=(b"output", b""))
         mock_proc.returncode = 0
 
-        with patch("datalegion_cli.update.asyncio.create_subprocess_exec", return_value=mock_proc):
+        with patch(
+            "datalegion_cli.update.asyncio.create_subprocess_exec", return_value=mock_proc
+        ) as exec_:
             await _run(["echo", "hello"])
 
+        exec_.assert_awaited_once()
+        assert exec_.await_args.args == ("echo", "hello")
+        assert exec_.await_args.kwargs["cwd"] is None
+        mock_proc.communicate.assert_awaited_once()
+
     async def test_failed_command_raises(self):
         mock_proc = AsyncMock()
         mock_proc.communicate = AsyncMock(return_value=(b"", b"some error"))
@@ -95,28 +110,115 @@ class TestDetectInstallMethod:
         with patch("datalegion_cli.config.load_config", return_value={"install_method": "github"}):
             assert await _detect_install_method() == "github"
 
-    async def test_detects_git_when_in_repo(self):
-        # Running from a git clone, should detect "git"
+    async def test_detects_brew_from_the_running_interpreter(self, tmp_path):
+        prefix = tmp_path / "Cellar" / "datalegion-cli" / "1.5.2" / "libexec" / "venv"
+        prefix.mkdir(parents=True)
         with (
             patch("datalegion_cli.config.load_config", return_value={"install_method": ""}),
-            patch("datalegion_cli.update.shutil.which", return_value=None),
+            patch("datalegion_cli.update.sys.prefix", str(prefix)),
+        ):
+            assert await _detect_install_method() == "brew"
+
+    async def test_pip_copy_is_pip_even_when_brew_has_the_formula(self, tmp_path):
+        # brew on PATH says nothing about which copy is running.
+        with (
+            patch("datalegion_cli.config.load_config", return_value={"install_method": ""}),
+            patch("datalegion_cli.update.sys.prefix", str(tmp_path / ".venv")),
+            patch("datalegion_cli.update.shutil.which", return_value="/opt/homebrew/bin/brew"),
+            patch("datalegion_cli.update._source_checkout", return_value=None),
+        ):
+            assert await _detect_install_method() == "pip"
+
+    async def test_detects_git_for_an_editable_checkout(self, tmp_path):
+        with (
+            patch("datalegion_cli.config.load_config", return_value={"install_method": ""}),
+            patch("datalegion_cli.update.sys.prefix", str(tmp_path / ".venv")),
+            patch("datalegion_cli.update._source_checkout", return_value=tmp_path),
         ):
             assert await _detect_install_method() == "git"
 
-    async def test_falls_back_to_pip(self, tmp_path):
-        # Point __file__ to a path with no .git parent
-        fake_file = tmp_path / "pkg" / "update.py"
+    async def test_wheel_inside_a_customers_repo_is_pip(self, tmp_path):
+        # A wheel installed into a project's .venv sits under that project's .git; updating
+        # must never git pull or uv sync the customer's own repository.
+        (tmp_path / ".git").mkdir()
+        fake_file = tmp_path / ".venv" / "lib" / "site-packages" / "datalegion_cli" / "update.py"
         fake_file.parent.mkdir(parents=True)
         fake_file.touch()
-
         with (
             patch("datalegion_cli.config.load_config", return_value={"install_method": ""}),
-            patch("datalegion_cli.update.shutil.which", return_value=None),
+            patch("datalegion_cli.update.sys.prefix", str(tmp_path / ".venv")),
             patch("datalegion_cli.update.__file__", str(fake_file)),
+            patch("datalegion_cli.update._source_checkout", return_value=None),
         ):
             assert await _detect_install_method() == "pip"
 
 
+class _Dist:
+    def __init__(self, direct_url: str | None) -> None:
+        self._direct_url = direct_url
+
+    def read_text(self, name: str) -> str | None:
+        return self._direct_url if name == "direct_url.json" else None
+
+
+class TestSourceCheckout:
+    def _with(self, direct_url: str | None) -> object:
+        return patch("datalegion_cli.update.distribution", return_value=_Dist(direct_url))
+
+    def test_editable_install_from_a_git_checkout(self, tmp_path):
+        (tmp_path / ".git").mkdir()
+        record = {"url": tmp_path.as_uri(), "dir_info": {"editable": True}}
+        with self._with(json.dumps(record)):
+            assert _source_checkout() == tmp_path
+
+    @pytest.mark.parametrize(
+        "record",
+        [
+            None,
+            "not json",
+            json.dumps({"url": "https://files.pythonhosted.org/x.whl", "archive_info": {}}),
+            json.dumps({"url": "file:///tmp/x", "dir_info": {}}),
+        ],
+        ids=["wheel-from-pypi", "unreadable", "archive", "non-editable-dir"],
+    )
+    def test_anything_but_an_editable_checkout_is_none(self, record):
+        with self._with(record):
+            assert _source_checkout() is None
+
+    def test_editable_install_without_git_is_none(self, tmp_path):
+        record = {"url": tmp_path.as_uri(), "dir_info": {"editable": True}}
+        with self._with(json.dumps(record)):
+            assert _source_checkout() is None
+
+
+@pytest.mark.asyncio
+class TestUpdateGit:
+    async def test_pulls_and_syncs_the_checkout_it_came_from(self, tmp_path):
+        with (
+            patch("datalegion_cli.update._source_checkout", return_value=tmp_path),
+            patch("datalegion_cli.update.shutil.which", return_value="/usr/bin/uv"),
+            patch("datalegion_cli.update._run", new_callable=AsyncMock) as mock_run,
+        ):
+            await _update_git()
+            assert mock_run.call_args_list[0][0][0] == [
+                "git",
+                "-C",
+                str(tmp_path),
+                "pull",
+                "--ff-only",
+            ]
+            assert mock_run.call_args_list[1].kwargs["cwd"] == tmp_path
+
+    async def test_refuses_without_a_checkout(self):
+        with (
+            patch("datalegion_cli.update._source_checkout", return_value=None),
+            patch("datalegion_cli.update._run", new_callable=AsyncMock) as mock_run,
+            pytest.raises(SystemExit),
+        ):
+            await _update_git()
+        mock_run.assert_not_called()
+
+
 @pytest.mark.asyncio
 class TestSelfUpdate:
     async def test_uses_uv_when_pip_method(self):

datalegion_cli-1.5.0/tests/test_package_contents.py

@@ -1,56 +0,0 @@
-"""What the published wheel and sdist contain.
-
-Customers install the wheel: it must hold only the ``datalegion_cli`` package, and its only
-command is ``datalegion-cli``. The sdist carries the source and tests, never repo tooling.
-"""
-
-import subprocess
-import tarfile
-import zipfile
-from pathlib import Path
-
-import pytest
-
-ROOT = Path(__file__).resolve().parents[1]
-
-
-@pytest.fixture(scope="module")
-def dist(tmp_path_factory: pytest.TempPathFactory) -> Path:
-    out = tmp_path_factory.mktemp("dist")
-    # Each straight from the source tree: a default build makes the wheel from the sdist, which
-    # would hide a wheel misconfiguration behind the sdist's own include list.
-    for target in ("--sdist", "--wheel"):
-        subprocess.run(
-            ["uv", "build", target, "--quiet", "--out-dir", str(out)], cwd=ROOT, check=True
-        )
-    return out
-
-
-def test_wheel_ships_only_the_cli(dist: Path) -> None:
-    (wheel,) = dist.glob("*.whl")
-    with zipfile.ZipFile(wheel) as archive:
-        names = archive.namelist()
-        commands = next(
-            (archive.read(n).decode() for n in names if n.endswith("entry_points.txt")), ""
-        )
-    top_level = {n.split("/")[0] for n in names if not n.split("/")[0].endswith(".dist-info")}
-    assert top_level == {"datalegion_cli"}
-    assert commands.split() == [
-        "[console_scripts]",
-        "datalegion-cli",
-        "=",
-        "datalegion_cli.main:run",
-    ]
-
-
-def test_sdist_carries_no_repo_tooling(dist: Path) -> None:
-    (sdist,) = dist.glob("*.tar.gz")
-    with tarfile.open(sdist) as archive:
-        names = archive.getnames()
-    leaked = [
-        n
-        for n in names
-        if any(part in n.split("/") for part in (".claude", ".github", "scripts", "lefthook.yml"))
-    ]
-    assert leaked == []
-    assert any(n.endswith("src/datalegion_cli/main.py") for n in names)