envknit 0.1.0__tar.gz

envknit-0.1.0/.github/workflows/build-cli.yml

@@ -0,0 +1,158 @@
+name: Build CLI Binary
+
+# Triggers:
+#   push/PR to main — build for smoke testing
+#   tag push vX.Y.Z — build and upload to GitHub Release
+on:
+  push:
+    branches: [main]
+    tags: ["v*.*.*"]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test-rust:
+    name: Test Rust CLI
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Cargo registry and build
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
+
+      - name: Run tests
+        run: cargo test --manifest-path crates/envknit-cli/Cargo.toml
+
+  build-rust:
+    name: Build Rust CLI (${{ matrix.os }})
+    needs: test-rust
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Linux amd64 (glibc)
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            artifact_name: envknit-linux-amd64
+            binary_path: target/x86_64-unknown-linux-gnu/release/envknit
+          # Linux amd64 (musl — portable, no glibc dep)
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-musl
+            artifact_name: envknit-linux-amd64-musl
+            binary_path: target/x86_64-unknown-linux-musl/release/envknit
+          # macOS amd64
+          - os: macos-latest
+            target: x86_64-apple-darwin
+            artifact_name: envknit-macos-amd64
+            binary_path: target/x86_64-apple-darwin/release/envknit
+          # macOS arm64 (Apple Silicon)
+          - os: macos-latest
+            target: aarch64-apple-darwin
+            artifact_name: envknit-macos-arm64
+            binary_path: target/aarch64-apple-darwin/release/envknit
+          # Windows amd64
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            artifact_name: envknit-windows-amd64.exe
+            binary_path: target/x86_64-pc-windows-msvc/release/envknit.exe
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Cargo registry and build
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target/
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
+
+      - name: Install musl tools (Ubuntu / musl target)
+        if: matrix.target == 'x86_64-unknown-linux-musl'
+        run: |
+          sudo apt-get install -y musl-tools
+          rustup target add x86_64-unknown-linux-musl
+
+      - name: Add macOS cross-compile targets
+        if: runner.os == 'macOS'
+        run: |
+          rustup target add aarch64-apple-darwin
+          rustup target add x86_64-apple-darwin
+
+      - name: Build release binary
+        run: >
+          cargo build --release
+          --manifest-path crates/envknit-cli/Cargo.toml
+          --target ${{ matrix.target }}
+
+      - name: Smoke test (native Linux/macOS)
+        if: runner.os != 'Windows' && matrix.target != 'aarch64-apple-darwin' && matrix.target != 'x86_64-apple-darwin'
+        run: |
+          "${{ matrix.binary_path }}" --version
+          "${{ matrix.binary_path }}" --help
+
+      - name: Smoke test (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          & "${{ matrix.binary_path }}" --version
+          & "${{ matrix.binary_path }}" --help
+
+      - name: Rename artifact
+        shell: bash
+        run: cp "${{ matrix.binary_path }}" "${{ matrix.artifact_name }}"
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ matrix.artifact_name }}
+          path: ${{ matrix.artifact_name }}
+          retention-days: 7
+
+  # ── Release upload ──────────────────────────────────────────────────────────
+  # Only runs on version tag pushes (e.g., v1.0.0)
+  release:
+    name: Upload to GitHub Release
+    needs: [build-rust]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: artifacts/
+
+      - name: Upload binaries to release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            artifacts/envknit-linux-amd64/envknit-linux-amd64
+            artifacts/envknit-linux-amd64-musl/envknit-linux-amd64-musl
+            artifacts/envknit-macos-amd64/envknit-macos-amd64
+            artifacts/envknit-macos-arm64/envknit-macos-arm64
+            artifacts/envknit-windows-amd64.exe/envknit-windows-amd64.exe
+          draft: false
+          generate_release_notes: true

envknit-0.1.0/.github/workflows/publish-python.yml

@@ -0,0 +1,34 @@
+name: Publish Python Library
+
+# Publishes the `envknit` Python package to PyPI on version tag pushes.
+# Requires PYPI_TOKEN secret to be set in repository settings.
+on:
+  push:
+    tags: ["v*.*.*"]
+
+jobs:
+  publish:
+    name: Build and publish to PyPI
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build distribution
+        run: python -m build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_TOKEN }}

envknit-0.1.0/.github/workflows/test.yml

@@ -0,0 +1,36 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: pip install -e ".[dev,cli]"
+
+      - name: Run tests
+        run: pytest --tb=short -q
+
+      - name: Upload coverage report
+        if: matrix.python-version == '3.11'
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-report
+          path: htmlcov/
+          if-no-files-found: ignore

envknit-0.1.0/.gitignore

@@ -0,0 +1,86 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# PyInstaller — ignore generated artifacts but keep the committed spec file
+*.manifest
+# *.spec intentionally NOT ignored — envknit-cli.spec is committed source
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+
+# Translations
+*.mo
+*.pot
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Project specific
+.envknit/
+envknit-lock.yaml
+*.lock
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# ruff
+.ruff_cache/
+.claude/
+/target/

envknit-0.1.0/CHANGELOG.md

@@ -0,0 +1,74 @@
+# Changelog
+
+All notable changes to EnvKnit are documented here.
+
+---
+
+## [0.1.0] — 2026-02-27
+
+### Added
+
+#### Core architecture
+- **Split CLI/library architecture**: `envknit-cli` (standalone binary) and `envknit` (pip library) communicate only through `envknit.lock.yaml` — no shared Python environment
+- **PubGrub dependency resolver** with transitive dependency resolution enabled by default, semantic conflict detection (not just syntactic), and cache invalidation on backtrack
+- **Lock file contract** (`envknit.lock.yaml`): `schema_version` gate, `install_path` field per package, schema forward-compatibility check (`SchemaVersionError` for future major versions)
+
+#### Runtime import isolation
+- **`VersionedFinder`** — `sys.meta_path` hook that routes `import` to versioned install paths
+- **`VersionContext`** — context manager implementing per-context module isolation via `ContextVar` (`_active_versions`, `_ctx_modules`); async-safe and thread-safe
+- **`_CachedModuleLoader` + `_CtxCachingLoader`** — fast-path cache for repeated imports within the same context; modules are cached on first load
+- **`configure_from_lock()`** — loads `envknit.lock.yaml`, registers all versioned install paths, auto-installs import hook; supports `env` filter and deduplication
+
+#### Hybrid C extension detection
+- **`_has_c_extensions(path)`** — scans install path for `.so`/`.pyd` files; process-global cache (`_c_ext_detection_cache`)
+- **`CExtensionError(ImportError)`** — raised by `use()` when C extensions detected; message includes ready-to-use `worker()` snippet
+- Pure-Python packages use `use()` transparently; C extension packages require `worker()`
+
+#### Subprocess worker pool
+- **`worker()`** context manager — routes C extension packages through isolated subprocesses
+- **`ProcessPool`** — lazy spawn, health checks, graceful SIGTERM → SIGKILL shutdown, `atexit` handler for zombie/SharedMemory cleanup
+- **`WorkerContext`** — IPC over `multiprocessing.Pipe`; large arrays via `multiprocessing.shared_memory`
+
+#### CLI (`envknit-cli`)
+- Commands: `init`, `add`, `resolve`, `lock`, `install`, `status`, `tree`, `graph`, `why`, `remove`, `run`, `env`, `store`, `shim`, `init-shell`, `auto`, `export`, `security`, `activate`, `deactivate`
+- Backends: **conda** (conda/mamba search), **pip** (`pip index versions` + PyPI JSON API fallback), **poetry** (PyPI JSON API)
+- `--dry-run` for `resolve`; `--update <pkg>` for `lock`
+
+#### Standalone binary distribution
+- **PyInstaller spec** (`envknit-cli.spec`) — single-file binary bundling click, rich, pyyaml, and all EnvKnit internals
+- **Build script** (`scripts/build-cli.sh`) — `--clean`, `--strip`, `--upx` flags; ~29 MB output
+- **CI workflow** (`.github/workflows/build-cli.yml`) — builds linux/macos/windows artifacts on `v*.*.*` tag push; uploads to GitHub Release
+
+#### Security scanning
+- **`VulnerabilityScanner`** — `scan_package()`, `scan_all()`, `check_updates()`
+- **`PipAuditBackend`** (preferred) — wraps `pip-audit` CLI, batch scan via stdin
+- **`PyPIAPIBackend`** (fallback) — OSV API + PyPI JSON API; CVSS → LOW/MEDIUM/HIGH/CRITICAL mapping
+- Result cache: SHA-256 key, 1-hour TTL, disk + memory layers
+
+#### AI context export
+- **`AIContextGenerator`** — analyzes `Config` + `LockFile` to produce `AIContext` with dependency summaries, issue detection, and recommendations
+- Export formats: Markdown (LLM-ready), `requirements.txt`, conda `environment.yml`, JSON
+
+#### Shim system
+- **`ShimGenerator`** — generates Python `__init__.py` shims that redirect imports to versioned install paths
+- **`CLIShimGenerator`** — generates executable shim scripts for CLI tools (conda, pip, python, etc.)
+- **`ShellIntegration`** — installs `eval "$(envknit init-shell)"` blocks into `.bashrc`/`.zshrc`/`config.fish`; idempotent install/uninstall
+- **`ToolDispatcher`** — resolves correct tool path from lock file at runtime, dispatches subprocess
+
+### Infrastructure
+- **CI test workflow** (`.github/workflows/test.yml`) — runs `pytest` on Python 3.10–3.13 matrix on push/PR to `main`
+- `.gitignore` updated to exclude `.claude/` worktree and session cache
+
+### Tests
+- **474 tests** across 17 test files
+- Coverage: `ai/context.py` 100%, `config/schema.py` 100%, `security/models.py` 97%, `security/scanner.py` 84%, `storage/cache.py` 90%, `storage/store.py` 66%, `resolver.py` 87%, `lock.py` 82%, `worker.py` 75%, `shim.py` ~55%, overall **51%**
+
+---
+
+## [Unreleased]
+
+### Known limitations
+- `isolation/shim.py` 19% → 55% (partial; env management methods require real backend)
+- `cli/main.py` 20% → 30% (partial; install/lock commands require real backend)
+- C extension in-process multi-version loading permanently impossible; subprocess worker is the only viable path (see `DESIGN_NOTES.md` #5)
+- `VersionContext` Category B limitations (global registries, retained references) are fundamental to the Python process model; subprocess isolation required for affected packages (see `DESIGN_NOTES.md` #6)

envknit-0.1.0/Cargo.toml

@@ -0,0 +1,3 @@
+[workspace]
+members = ["crates/envknit-cli"]
+resolver = "2"