gitpr-cli 1.4.2__py3-none-any.whl → 1.4.3__py3-none-any.whl

{gitpr_cli-1.4.2.dist-info → gitpr_cli-1.4.3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitpr-cli
-Version: 1.4.2
+Version: 1.4.3
 Summary: AI-powered PR automation, commit messages, and code review (Gemini, DeepSeek, and Ollama)
 Author-email: Natan Fiuza <contato@natanfiuza.dev.br>
 Requires-Python: >=3.10

{gitpr_cli-1.4.2.dist-info → gitpr_cli-1.4.3.dist-info}/RECORD

@@ -1,4 +1,4 @@
-gitpr_cli-1.4.2.dist-info/licenses/LICENSE,sha256=UQzLC6mwqb-ZNDkBBAqOxC-SMQcEID0gaM6oFcu6u48,27030
+gitpr_cli-1.4.3.dist-info/licenses/LICENSE,sha256=UQzLC6mwqb-ZNDkBBAqOxC-SMQcEID0gaM6oFcu6u48,27030
 src/__init__.py,sha256=WZW9x8P5CYnru29UiarFa8q1nQzuwYWyIodSOlruCWI,29
 src/ai_providers.py,sha256=QyFEOsXyA59lZziO5bl-4nlYFJpxBcxU9aLhcTBnkWE,14633
 src/blame_engine.py,sha256=Zov1hxrt7Dcmf56ovJKz3QmHIfzDKtSub2iItXeg9-A,17104
@@ -17,7 +17,7 @@ src/issue_engine.py,sha256=RmZsQVg6N1vCcpMdv_5FX-cMGgQ3I0vwMN4parQ4zFg,10974
 src/ledger.py,sha256=s10Sm0qcA1b916X7m8d2osDThCmSK0UQnmUrkyj8Eao,43663
 src/linter_engine.py,sha256=hIxht8M09Fnm6NiJZOqjI6dyqnFoHUDVA8Ve4dWZV4s,25214
 src/linter_wizard.py,sha256=7J_nQFghVwCaKG6QI3K45KcOaxHSH1oTCAvP_6tnCQM,7424
-src/main.py,sha256=qWtf9ryGOS_elZgfV1I2rOWUzW9U7HD0XqnOGwwGu4o,214873
+src/main.py,sha256=71K36Q_35gEDU9vfNDCQJSljFSXc9NpOjYMUuWV4BSo,215874
 src/mcp_server.py,sha256=gi4LmMYVN4CZWHQgb-5aV5UD2O-tRYzc_BqNg7t-EFA,111654
 src/metrics.py,sha256=M4Yqa__giuhmkElT-XOWrTfHGsjK_URVLhIZvErD2f0,39560
 src/net.py,sha256=f0MOkXyIxi4HVetsybtWpV_yHjiC17T2JMWySBdoV2I,2774
@@ -29,7 +29,7 @@ src/security_ruleset.py,sha256=L754S4RlVoZGWm0nuCoeli9-49mKydZpwi31V319DQ0,4337
 src/spinner.py,sha256=63pEotiDa3TVwBr-sn0MJoDPQ_uWJTTwINXieJIDDKc,8964
 src/suggest_reviewers.py,sha256=-wRe0HYksx4FWQZ-eDvU9Ghdk5gqtEt457KQP7sE31Y,5181
 src/tui_issue.py,sha256=WEFxT4kzWQ_KbSDsOnS_iuYXasZySB-68jryGNm0peg,10331
-src/updater.py,sha256=8AGxl_Lil9K3Laydw3f7yDipuuy6p3XokCOidfUyVR0,4771
+src/updater.py,sha256=WdlaW2QTjSjSj-pXwT7paa7zeL0YZqDHTMTS2fpU-iE,9210
 src/usage_log.py,sha256=FdfSmZKL_I5BcG750rD4gl3pNHx0jqV8Shij5XkAnzc,4381
 src/version_bump.py,sha256=OjqJe9OL1-1dT5od7-SgU5ZN_dTtR_aKX_oSjSY64YQ,2954
 src/application/__init__.py,sha256=0GADzpCB3CdCzw-d3az0DVOtTvXfCppt-0hY-Js5a1U,29
@@ -44,7 +44,7 @@ src/application/use_cases/generate_mentor_explanation.py,sha256=KNj5cDm-i7aPJxxb
 src/application/use_cases/generate_pr_explanation.py,sha256=Xbn1b9G57O18pT-_FLA_wAEJmyeLCv1n80p49WVxxjo,3336
 src/application/use_cases/generate_test_file.py,sha256=r8kpNFPD5zU0vsshAzqqspU9stlCnopQzS9cwP5XT-I,9410
 src/application/use_cases/install_policy_pack.py,sha256=U1XvkHt0elXvyM2VRc6TPNukhUomSI2BSWj09hmLC_8,2745
-src/application/use_cases/publish_pull_request.py,sha256=DPK8ERbO2fsjoWUhcLQs10z1WhHVhsfTvtGumn50uIA,9369
+src/application/use_cases/publish_pull_request.py,sha256=QtPx6a4oFYaUsYecVokcMNWWL9VomzmqbnHJNBGWSHA,9490
 src/application/use_cases/resolve_effective_policy.py,sha256=nTbjRR4di1GnCRV7l3yDNw27CQV3heAd45sftHxNyNc,7563
 src/application/use_cases/run_check.py,sha256=NEhuOZmdWgPFrOPWNku6MwS1Lp0OArk3OMd78M8_EcE,15246
 src/application/use_cases/suppress_finding.py,sha256=juj2jjk2BLjrAcx6WTKJNr5VMTJQ4Gb3GaEjDNGjM64,17809
@@ -166,8 +166,8 @@ src/ui/demo/__init__.py,sha256=PGXenIwpS1lVDE164CZ55q8_65XtJq5H300NIpnqOh0,58
 src/ui/demo/demo_app.py,sha256=EDeuqxh_v9KrPhib49TyirmFlHZN7I5NQkg9AjDGhcs,3074
 src/ui/demo/demo_help_screen.py,sha256=m8SuvhzGmkMsahUBA6Aq7ull4W65nS0KOX4hLx-GGps,2056
 src/ui/demo/demo_screens.py,sha256=3Ntp-A7OB43yEtniRqV1UKWc-p5lHRyxeadpe8bxJpM,1937
-gitpr_cli-1.4.2.dist-info/METADATA,sha256=rdUlN_BJSULMQ64zu-PNoDrxHaaTlmCoSTxqRdSF_wc,51553
-gitpr_cli-1.4.2.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
-gitpr_cli-1.4.2.dist-info/entry_points.txt,sha256=TstGnMUzdOI5qNmpM97EPDBPuMqOZxoo6EoLxHSOMSQ,71
-gitpr_cli-1.4.2.dist-info/top_level.txt,sha256=74rtVfumQlgAPzR5_2CgYN24MB0XARCg0t-gzk6gTrM,4
-gitpr_cli-1.4.2.dist-info/RECORD,,
+gitpr_cli-1.4.3.dist-info/METADATA,sha256=65g6lyhixY8BoxcWT43zWKu811J92hec2eKCvmholUM,51553
+gitpr_cli-1.4.3.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+gitpr_cli-1.4.3.dist-info/entry_points.txt,sha256=TstGnMUzdOI5qNmpM97EPDBPuMqOZxoo6EoLxHSOMSQ,71
+gitpr_cli-1.4.3.dist-info/top_level.txt,sha256=74rtVfumQlgAPzR5_2CgYN24MB0XARCg0t-gzk6gTrM,4
+gitpr_cli-1.4.3.dist-info/RECORD,,

src/application/use_cases/publish_pull_request.py

@@ -129,20 +129,20 @@ def publish_pull_request_use_case(
             message=__("PR description must not be empty."),
         )
 
-    if not getattr(provider, "token", ""):
-        return PublishPrOutcome(
-            status="auth_required",
-            provider=provider.name,
-            source_branch=source_branch,
-            target_branch=target_branch,
-            http_status=401,
-            message=__(
-                "{provider} token is not configured. Run 'gitpr' in a terminal to authenticate.",
-                provider=label,
-            ),
-        )
-
     if check_remote_state:
+        if not getattr(provider, "token", ""):
+            return PublishPrOutcome(
+                status="auth_required",
+                provider=provider.name,
+                source_branch=source_branch,
+                target_branch=target_branch,
+                http_status=401,
+                message=__(
+                    "{provider} token is not configured. Run 'gitpr' in a terminal to authenticate.",
+                    provider=label,
+                ),
+            )
+
         try:
             existing: Optional[PullRequestResult] = provider.check_existing_pull_request(
                 repo_ref, source_branch
@@ -254,10 +254,12 @@ def publish_pull_request_use_case(
             message=mask_sensitive_text(str(exc)),
         )
 
+    pr_url = getattr(result, "url", "")
+    pr_number = getattr(result, "number", 0)
     return PublishPrOutcome(
         status="success",
-        url=result.url,
-        number=result.number,
+        url=pr_url,
+        number=pr_number,
         provider=provider.name,
         source_branch=source_branch,
         target_branch=target_branch,
@@ -265,6 +267,6 @@ def publish_pull_request_use_case(
         message=__(
             "PR successfully created on {provider}: {pr_url}",
             provider=label,
-            pr_url=result.url,
+            pr_url=pr_url,
         ),
     )

src/main.py

@@ -75,6 +75,18 @@ def _may_ask_the_user(quiet=False, hook=False, mcp=False):
         return False
 
 
+def _subcommand_help_in_argv(argv=None):
+    """Whether the raw command line asks for help.
+
+    Click clears the group context arguments before this callback runs, so by
+    the time the update gate below executes, ``gitpr release -h`` is
+    indistinguishable from ``gitpr release``. The raw tokens are the only
+    surviving record. The scan fails open, which costs at most one skipped gate.
+    """
+    tokens = sys.argv[1:] if argv is None else argv
+    return any(token in ("-h", "--help") for token in tokens)
+
+
 def print_banner():
     """Displays the project ASCII Art signature"""
     banner = r"""
@@ -677,6 +689,13 @@ def cli(
     # first, so everything below runs only when NO subcommand was requested —
     # the legacy flag surface stays byte-for-byte intact (ADR-002).
     if ctx.invoked_subcommand is not None:
+        # The mandatory update gate covers subcommands too, but only when the
+        # run may stop and ask the user: a release in CI, a pipe or a hook must
+        # never be blocked. Help tokens are read from the raw argv because
+        # Click clears the context arguments before this callback runs.
+        if may_ask and not update and not help_flag and not _subcommand_help_in_argv():
+            if enforce_update_required():
+                sys.exit(1)
         return
 
     # ============================================================

src/updater.py

@@ -1,25 +1,38 @@
-import urllib.request
 import json
 import os
-import click
+import tempfile
 from datetime import datetime
 
+import click
+from packaging.version import InvalidVersion, Version
+
 # Current version of your local executable (Update this on every new build!)
 # ── Must stay ABOVE the i18n import: i18n.py lazily imports __lang_version__
 #     from here, and pyproject.toml reads __version__ via setuptools attr:.
-__version__ = "1.4.2"  # GitPR current version
+__version__ = "1.4.3"  # GitPR current version
 __lang_version__ = "v0.0.35"  # Language dictionary version control
 __scripts_version__ = (
     "v0.0.4"  # Git Hook scripts version control (independent from __lang_version__)
 )
 
 from src.i18n import __
+from src.net import bounded_urlopen
 
 PYPI_API_URL = "https://pypi.org/pypi/gitpr-cli/json"
 
+# How long a PyPI answer is trusted before the next check goes back online.
+# A rolling window, not the local calendar day: a release published after the
+# first run of the day used to stay invisible until midnight.
+UPDATE_CACHE_TTL_SECONDS = 3600
+
+# Wall-clock ceiling for the PyPI fetch, DNS resolution included.
+UPDATE_FETCH_HARD_TIMEOUT = 3.0
+
 # Environment switch used to mute the mandatory update check (test harness and
-# offline automation). Read as a plain flag: any non-empty value disables it.
+# offline automation). Parsed as a strict boolean: only _SKIP_TRUTHY_VALUES
+# disable it, so `GITPR_SKIP_UPDATE_CHECK=false` still checks.
 SKIP_UPDATE_CHECK_ENV = "GITPR_SKIP_UPDATE_CHECK"
+_SKIP_TRUTHY_VALUES = ("1", "true", "yes", "on", "y")
 
 
 def get_gitpr_dir():
@@ -32,72 +45,188 @@ def get_update_cache_file():
     return os.path.join(get_gitpr_dir(), "update_cache.json")
 
 
-def parse_version(version_str):
-    """Converts 'v0.1.0' or '0.1.0' into a tuple (0, 1, 0) for version math."""
-    clean_version = version_str.lower().replace("v", "")
+def _coerce_version(value):
+    """Parses *value* as a PEP 440 version, or returns None when it is not one."""
+    if not isinstance(value, str):
+        return None
+    text = value.strip()
+    # packaging rejects a leading "v"; the old helper stripped every "v" in the
+    # string, which corrupted suffixes such as 1.2.3-dev.
+    if text[:1] in ("v", "V"):
+        text = text[1:]
+    if not text:
+        return None
     try:
-        return tuple(map(int, clean_version.split(".")))
-    except ValueError:
-        return (0, 0, 0)
+        return Version(text)
+    except InvalidVersion:
+        return None
+
+
+def parse_version(version_str):
+    """Converts 'v0.1.0' or '0.1.0' into a tuple (0, 1, 0) for version math.
+
+    Kept for compatibility with outside callers. The tuple is lossy for
+    pre/post/dev markers, so the update gate itself compares Version objects
+    through _is_newer() instead.
+    """
+    parsed = _coerce_version(version_str)
+    return parsed.release if parsed is not None else (0, 0, 0)
 
 
 def is_update_check_disabled():
     """Returns True when the update check must be muted for this execution."""
-    return bool(os.environ.get(SKIP_UPDATE_CHECK_ENV, "").strip())
+    value = os.environ.get(SKIP_UPDATE_CHECK_ENV, "")
+    return value.strip().lower() in _SKIP_TRUTHY_VALUES
 
 
-def get_latest_remote_version():
-    """Fetches the latest version published on PyPI, with a daily cache."""
-    cache_file = get_update_cache_file()
-    today = datetime.now().strftime("%Y-%m-%d")
+def _cache_is_fresh(cache_data, now=None):
+    """Whether *cache_data* carries a timestamp inside the freshness window.
+
+    A timestamp in the future (the clock moved backwards) counts as stale, so
+    a clock jump can never freeze the cache on an old answer indefinitely.
+    """
+    checked_at = cache_data.get("checked_at")
+    if not isinstance(checked_at, str):
+        return False
+    try:
+        written_at = datetime.fromisoformat(checked_at)
+        current = datetime.now() if now is None else now
+        age = (current - written_at).total_seconds()
+    except (TypeError, ValueError):
+        # Not a valid timestamp, or a timezone-aware stamp this cache never writes.
+        return False
+    return 0 <= age < UPDATE_CACHE_TTL_SECONDS
+
+
+def _read_cached_version(cache_file):
+    """Returns the cached PyPI version while it is still fresh, else "".
+
+    Only the current schema is read: a document from the former calendar-day
+    cache has no ``checked_at`` and therefore counts as expired.
+    """
+    try:
+        with open(cache_file, "r", encoding="utf-8", errors="replace") as f:
+            cache_data = json.load(f)
+    except Exception:
+        return ""
+
+    if not isinstance(cache_data, dict) or not _cache_is_fresh(cache_data):
+        return ""
+
+    version = cache_data.get("version")
+    if isinstance(version, str) and version.strip():
+        return version.strip()
+    return ""
+
 
-    # Try to read from cache to avoid slowing down the user's terminal
-    if os.path.exists(cache_file):
+def _write_cached_version(cache_file, version):
+    """Writes the cache atomically; the caller treats a failure as non-fatal."""
+    folder = os.path.dirname(cache_file)
+    if folder:
+        os.makedirs(folder, exist_ok=True)
+
+    payload = {"checked_at": datetime.now().isoformat(), "version": version}
+    handle = tempfile.NamedTemporaryFile(
+        "w",
+        encoding="utf-8",
+        dir=folder or ".",
+        prefix=".update-cache-",
+        suffix=".tmp",
+        delete=False,
+    )
+    try:
+        with handle:
+            json.dump(payload, handle)
+        os.replace(handle.name, cache_file)
+    except Exception:
         try:
-            with open(cache_file, "r", encoding="utf-8", errors="replace") as f:
-                cache_data = json.load(f)
-            if cache_data.get("date") == today:
-                return cache_data.get("version", "")
-        except Exception:
+            os.unlink(handle.name)
+        except OSError:
             pass
+        raise
+
 
-    # Fetch from Web if cache expired
-    latest_version = ""
+def _fetch_pypi_version():
+    """Returns the version published on PyPI, or "" when it cannot be read."""
+    raw = bounded_urlopen(
+        PYPI_API_URL,
+        timeout=3,
+        hard_timeout=UPDATE_FETCH_HARD_TIMEOUT,
+        headers={"User-Agent": "GitPR-Updater"},
+    )
+    if not raw:
+        return ""
 
     try:
-        req = urllib.request.Request(PYPI_API_URL, headers={"User-Agent": "GitPR-Updater"})
-        with urllib.request.urlopen(req, timeout=3) as response:
-            data = json.loads(response.read().decode())
-        latest_version = data.get("info", {}).get("version", "")
+        data = json.loads(raw.decode("utf-8", errors="replace"))
+        version = data["info"]["version"]
+    except Exception:
+        return ""
 
-        if latest_version:
-            os.makedirs(get_gitpr_dir(), exist_ok=True)
-            with open(cache_file, "w", encoding="utf-8") as f:
-                json.dump({"date": today, "version": latest_version}, f)
+    # Only a parseable version is trusted: a captive portal or a malformed
+    # mirror must not poison the cache for a whole hour.
+    if _coerce_version(version) is None:
+        return ""
+    return version.strip()
 
-    except Exception:
-        pass  # Silent failure in case of no internet
 
+def get_latest_remote_version(force=False):
+    """Fetches the latest version published on PyPI, with a one-hour cache.
+
+    ``force=True`` (the ``--update`` flag) always asks PyPI: that command
+    promises an immediate verification, so it must not answer from the cache.
+    Returns "" when the remote version is unknown — offline, stalled DNS, or a
+    body that is not a version — and the caller then lets the run proceed.
+    """
+    cache_file = get_update_cache_file()
+
+    if not force:
+        cached = _read_cached_version(cache_file)
+        if cached:
+            return cached
+
+    latest_version = _fetch_pypi_version()
+    if latest_version:
+        try:
+            _write_cached_version(cache_file, latest_version)
+        except Exception:
+            pass  # A read-only home or a locked file must not hide the answer
     return latest_version
 
 
+def _is_newer(remote_version, local_version=None):
+    """Whether *remote_version* is a version this install should upgrade to.
+
+    PEP 440 ordering instead of a tuple comparison, so 1.4.10 > 1.4.9 and
+    pre/post/dev markers follow the standard. A remote pre-release is ignored
+    while the local install is stable: pip will not install it without --pre,
+    so blocking would tell the user to run a command that does nothing. An
+    unparseable version on either side is "unknown", never "newer".
+    """
+    remote = _coerce_version(remote_version)
+    local = _coerce_version(__version__ if local_version is None else local_version)
+    if remote is None or local is None:
+        return False
+    if remote.is_prerelease and not local.is_prerelease:
+        return False
+    return remote > local
+
+
 def enforce_update_required():
     """Blocks execution while a newer GitPR version is published on PyPI.
 
     Prints the upgrade instructions and returns True when the caller must stop.
     Returns False when the local version is current, when the remote version is
-    unknown (offline, so the user could not upgrade anyway) or when the check is
-    disabled via GITPR_SKIP_UPDATE_CHECK.
+    unknown (offline, so the user could not upgrade anyway), when it is a
+    pre-release a stable install cannot move to, or when the check is disabled
+    via GITPR_SKIP_UPDATE_CHECK.
     """
     if is_update_check_disabled():
         return False
 
     latest_version = get_latest_remote_version()
 
-    if not latest_version:
-        return False
-
-    if parse_version(latest_version) <= parse_version(__version__):
+    if not _is_newer(latest_version):
         return False
 
     click.echo("")
@@ -121,13 +250,13 @@ def enforce_update_required():
 
 def check_and_update():
     """Function triggered only when the user forces the --update flag."""
-    latest_version = get_latest_remote_version()
+    latest_version = get_latest_remote_version(force=True)
 
     if not latest_version:
         click.secho(__("❌ Could not check for updates at this moment."), fg="red")
         return
 
-    if parse_version(latest_version) > parse_version(__version__):
+    if _is_newer(latest_version):
         click.secho(
             __(
                 "\n🚀 New GitPR version found (v{latest_version})!",