ixt-cli 0.8.1__tar.gz → 0.9.0__tar.gz

{ixt_cli-0.8.1 → ixt_cli-0.9.0}/.gitignore

@@ -150,3 +150,4 @@ ixt.egg-info
 
 .memsearch/
 .pyscn/
+.pi/

ixt_cli-0.9.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gaëtan Montury
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{ixt_cli-0.8.1 → ixt_cli-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ixt-cli
-Version: 0.8.1
+Version: 0.9.0
 Summary: Universal CLI tool isolator - manage Python, Node, and binary tools with per-tool isolation
 Project-URL: Homepage, https://gitlab.com/pytgaen-group/ixt
 Project-URL: Repository, https://gitlab.com/pytgaen-group/ixt.git
@@ -8,6 +8,7 @@ Project-URL: Issues, https://gitlab.com/pytgaen-group/ixt/-/issues
 Project-URL: Documentation, https://ixt-39f604.gitlab.io
 Author-email: Gaëtan Montury <10528250-pytgaen@users.noreply.gitlab.com>
 License: MIT
+License-File: LICENSE
 Keywords: cli,github,isolation,npm,package-manager,pypi,tool
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
@@ -33,8 +34,10 @@ Description-Content-Type: text/markdown
 <h1 align="center">ixt — Universal CLI Tool Isolator</h1>
 
 <p align="center">
-  <a href="https://gitlab.com/pytgaen-group/ixt/-/releases"><img src="https://img.shields.io/gitlab/v/release/pytgaen-group/ixt?label=release" alt="Release"></a>
-  <a href="https://gitlab.com/pytgaen-group/ixt/-/pipelines"><img src="https://img.shields.io/gitlab/pipeline-status/pytgaen-group/ixt?branch=main" alt="Pipeline"></a>
+  <a href="https://gitlab.com/pytgaen-group/ixt/-/tags"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fgitlab.com%2Fapi%2Fv4%2Fprojects%2F81169049%2Frepository%2Ftags%3Fper_page%3D1&amp;query=%24%5B0%5D.name&amp;label=release" alt="Release"></a>
+  <a href="https://gitlab.com/pytgaen-group/ixt/-/blob/main/.gitlab-ci.yml"><img src="https://img.shields.io/badge/build-GitLab%20CI-blue?logo=gitlab" alt="Build: GitLab CI"></a>
+  <a href="https://pypi.org/project/ixt-cli/"><img src="https://img.shields.io/pypi/v/ixt-cli?label=pypi" alt="PyPI"></a>
+  <a href="https://pepy.tech/projects/ixt-cli"><img src="https://static.pepy.tech/badge/ixt-cli/month" alt="PyPI Downloads"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.10%2B-blue.svg" alt="Python 3.10+">
 </p>
@@ -183,6 +186,24 @@ ixt tool install sharkdp/fd@10              # latest 10.x.x
 ixt tool install ruff>=0.5.0                # PEP 508 (Python)
 ```
 
+## 🔒 Declarative locks
+
+`ixt.toml` is the human-edited intent: which tools you want, with optional
+version bounds, exposure rules, and injections. `ixt.lock` is generated from
+that intent and records the exact resolved versions and binary release assets.
+
+For teams and CI, commit both files:
+
+```bash
+ixt lock write
+ixt lock check
+ixt tool apply --locked --strict
+```
+
+`--locked` replays the exact lock instead of resolving newer versions.
+`--strict` fails before changing the machine if `ixt.toml` and `ixt.lock`
+diverge.
+
 ## 🧰 Commands
 
 | Command                                        | Description                                                           |
@@ -196,7 +217,11 @@ ixt tool install ruff>=0.5.0                # PEP 508 (Python)
 | `ixt tool upgrade <pkg>`                            | Upgrade a tool                                                        |
 | `ixt tool upgrade --all`                            | Upgrade all tools                                                     |
 | `ixt tool apply`                                    | Sync tools from declarative config                                    |
+| `ixt tool apply --locked --strict`                   | Sync using exact versions and assets from ixt.lock                    |
 | `ixt tool export`                             | Export installed tools as ixt.toml (stdout), preserves install intent |
+| `ixt lock write`                              | Resolve ixt.toml and write ixt.lock                                   |
+| `ixt lock check`                              | Fail if ixt.lock is missing or stale                                  |
+| `ixt lock diff`                               | Show semantic differences between ixt.toml and ixt.lock               |
 | `ixt asset-index export`                       | Export portable binary-resolution metadata as JSON                    |
 | `ixt tool config <pkg> expose <rules...>`           | Change exposed binaries                                               |
 | `ixt tool config <pkg> inject <dep>`                | Inject a package into the tool's env                                  |
@@ -219,7 +244,8 @@ ixt tool install ruff>=0.5.0                # PEP 508 (Python)
 ```
 $IXT_HOME/                # default ~/.local/share/ixt (respects $XDG_DATA_HOME)
 ├── config/
-│   ├── ixt.toml
+│   ├── ixt.toml          # global declarative manifest fallback
+│   ├── ixt.lock          # global lock when using the global ixt.toml
 │   ├── registry.toml
 │   └── heuristics.toml
 └── installed/
@@ -266,10 +292,10 @@ uv run ruff format src/ tests/ # format
 
 ## 🤝 Contributing
 
-Development happens on **GitLab**: <https://gitlab.com/pytgaen-group/ixt>. The GitHub repository (if present) is a **read-only mirror** — please open issues and merge requests on GitLab.
+Development happens on **GitLab**: <https://gitlab.com/pytgaen-group/ixt>. Any GitHub repository for this project is a **read-only mirror** of GitLab; it is not the review or issue tracker. Please open issues and merge requests on GitLab.
 
 Bug reports and reproduction recipes are welcome. See [`CONTRIBUTING.md`](CONTRIBUTING.md) for details, or open an issue to start a discussion.
 
 ## 📄 License
 
-MIT
+MIT. See [`LICENSE`](LICENSE).

{ixt_cli-0.8.1 → ixt_cli-0.9.0}/README.md

@@ -5,8 +5,10 @@
 <h1 align="center">ixt — Universal CLI Tool Isolator</h1>
 
 <p align="center">
-  <a href="https://gitlab.com/pytgaen-group/ixt/-/releases"><img src="https://img.shields.io/gitlab/v/release/pytgaen-group/ixt?label=release" alt="Release"></a>
-  <a href="https://gitlab.com/pytgaen-group/ixt/-/pipelines"><img src="https://img.shields.io/gitlab/pipeline-status/pytgaen-group/ixt?branch=main" alt="Pipeline"></a>
+  <a href="https://gitlab.com/pytgaen-group/ixt/-/tags"><img src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fgitlab.com%2Fapi%2Fv4%2Fprojects%2F81169049%2Frepository%2Ftags%3Fper_page%3D1&amp;query=%24%5B0%5D.name&amp;label=release" alt="Release"></a>
+  <a href="https://gitlab.com/pytgaen-group/ixt/-/blob/main/.gitlab-ci.yml"><img src="https://img.shields.io/badge/build-GitLab%20CI-blue?logo=gitlab" alt="Build: GitLab CI"></a>
+  <a href="https://pypi.org/project/ixt-cli/"><img src="https://img.shields.io/pypi/v/ixt-cli?label=pypi" alt="PyPI"></a>
+  <a href="https://pepy.tech/projects/ixt-cli"><img src="https://static.pepy.tech/badge/ixt-cli/month" alt="PyPI Downloads"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.10%2B-blue.svg" alt="Python 3.10+">
 </p>
@@ -155,6 +157,24 @@ ixt tool install sharkdp/fd@10              # latest 10.x.x
 ixt tool install ruff>=0.5.0                # PEP 508 (Python)
 ```
 
+## 🔒 Declarative locks
+
+`ixt.toml` is the human-edited intent: which tools you want, with optional
+version bounds, exposure rules, and injections. `ixt.lock` is generated from
+that intent and records the exact resolved versions and binary release assets.
+
+For teams and CI, commit both files:
+
+```bash
+ixt lock write
+ixt lock check
+ixt tool apply --locked --strict
+```
+
+`--locked` replays the exact lock instead of resolving newer versions.
+`--strict` fails before changing the machine if `ixt.toml` and `ixt.lock`
+diverge.
+
 ## 🧰 Commands
 
 | Command                                        | Description                                                           |
@@ -168,7 +188,11 @@ ixt tool install ruff>=0.5.0                # PEP 508 (Python)
 | `ixt tool upgrade <pkg>`                            | Upgrade a tool                                                        |
 | `ixt tool upgrade --all`                            | Upgrade all tools                                                     |
 | `ixt tool apply`                                    | Sync tools from declarative config                                    |
+| `ixt tool apply --locked --strict`                   | Sync using exact versions and assets from ixt.lock                    |
 | `ixt tool export`                             | Export installed tools as ixt.toml (stdout), preserves install intent |
+| `ixt lock write`                              | Resolve ixt.toml and write ixt.lock                                   |
+| `ixt lock check`                              | Fail if ixt.lock is missing or stale                                  |
+| `ixt lock diff`                               | Show semantic differences between ixt.toml and ixt.lock               |
 | `ixt asset-index export`                       | Export portable binary-resolution metadata as JSON                    |
 | `ixt tool config <pkg> expose <rules...>`           | Change exposed binaries                                               |
 | `ixt tool config <pkg> inject <dep>`                | Inject a package into the tool's env                                  |
@@ -191,7 +215,8 @@ ixt tool install ruff>=0.5.0                # PEP 508 (Python)
 ```
 $IXT_HOME/                # default ~/.local/share/ixt (respects $XDG_DATA_HOME)
 ├── config/
-│   ├── ixt.toml
+│   ├── ixt.toml          # global declarative manifest fallback
+│   ├── ixt.lock          # global lock when using the global ixt.toml
 │   ├── registry.toml
 │   └── heuristics.toml
 └── installed/
@@ -238,10 +263,10 @@ uv run ruff format src/ tests/ # format
 
 ## 🤝 Contributing
 
-Development happens on **GitLab**: <https://gitlab.com/pytgaen-group/ixt>. The GitHub repository (if present) is a **read-only mirror** — please open issues and merge requests on GitLab.
+Development happens on **GitLab**: <https://gitlab.com/pytgaen-group/ixt>. Any GitHub repository for this project is a **read-only mirror** of GitLab; it is not the review or issue tracker. Please open issues and merge requests on GitLab.
 
 Bug reports and reproduction recipes are welcome. See [`CONTRIBUTING.md`](CONTRIBUTING.md) for details, or open an issue to start a discussion.
 
 ## 📄 License
 
-MIT
+MIT. See [`LICENSE`](LICENSE).

{ixt_cli-0.8.1 → ixt_cli-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ixt-cli"
-version = "0.8.1" # to bump
+version = "0.9.0" # to bump
 description = "Universal CLI tool isolator - manage Python, Node, and binary tools with per-tool isolation"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -37,10 +37,6 @@ dev = [
     "pytest-cov>=4.1",
     "pyright>=1.1",
 ]
-# Standalone binary build (Nuitka). Not a runtime dependency — install with
-# `uv sync --group build`. [onefile] pulls zstandard for payload compression.
-# See notes/standalone-build.md.
-build = ["nuitka[onefile]>=2.5"]
 
 [project.scripts]
 ixt = "ixt.cli:main"

{ixt_cli-0.8.1 → ixt_cli-0.9.0}/src/ixt/backends/binary.py

@@ -23,6 +23,7 @@ from ixt.config.heuristics import (
 )
 
 if TYPE_CHECKING:
+    from ixt.config.lockfile import BinaryLockMetadata
     from ixt.config.setup_toml import SetupConfig
 from ixt.config.settings import Settings, get_settings
 from ixt.core.backend import BackendType
@@ -30,10 +31,12 @@ from ixt.core.discover import find_executables
 from ixt.core.extract import extract, is_archive
 from ixt.libs.logger import get_logger, get_verbosity
 from ixt.net.source import Asset, Release, ReleaseSource, RepoSpec, parse_spec
+from ixt.platform import get_arch, get_os
 
 __all__ = [
     "AssetSelectionError",
     "BinaryBackend",
+    "BinaryPlatformError",
     "BinarySpecError",
     "HookEntry",
     "SetupMetadata",
@@ -89,6 +92,31 @@ class AssetSelectionError(RuntimeError):
         )
 
 
+class BinaryPlatformError(RuntimeError):
+    """Raised when extracted executables are incompatible with the current platform."""
+
+    def __init__(
+        self,
+        spec: str,
+        release_tag: str,
+        asset_name: str,
+        rejected: list[tuple[Path, str]],
+    ):
+        self.spec = spec
+        self.release_tag = release_tag
+        self.asset_name = asset_name
+        self.rejected = rejected
+        platform = f"{get_os().value}/{get_arch().value}"
+        details = ", ".join(
+            f"{path.name} ({format_label})"
+            for path, format_label in sorted(rejected, key=lambda item: str(item[0]))
+        )
+        super().__init__(
+            f"No executable compatible with {platform} found for '{spec}' "
+            f"(release {release_tag}, asset {asset_name}). Rejected: {details}"
+        )
+
+
 class BinarySpecError(ValueError):
     """Raised when a spec cannot be parsed as a binary backend spec."""
 
@@ -396,6 +424,7 @@ class BinaryBackend:
         setup_path: Path | None = None,
         asset_pattern: str | None = None,
         known_tag: str | None = None,
+        locked_binary: BinaryLockMetadata | None = None,
         use_cache: bool = True,
     ) -> dict | None:
         """Compatibility adapter for the shared backend protocol."""
@@ -410,6 +439,7 @@ class BinaryBackend:
             setup_path=setup_path,
             asset_pattern=asset_pattern,
             known_tag=known_tag,
+            locked_binary=locked_binary,
             use_cache=use_cache,
         )
 
@@ -422,6 +452,7 @@ class BinaryBackend:
         setup_path: Path | None = None,
         asset_pattern: str | None = None,
         known_tag: str | None = None,
+        locked_binary: BinaryLockMetadata | None = None,
         use_cache: bool = True,
     ) -> dict | None:
         """Resolve, download, extract, and discover one atomic binary tool.
@@ -460,24 +491,34 @@ class BinaryBackend:
         )
         release_pattern_name = setup.name if setup and setup.name else None
 
-        # Reuse the release already fetched during version resolution (e.g. an
-        # upgrade or a dry-run within the TTL window). This skips a second API
-        # call — the only option for GitLab, whose asset URLs can't be rebuilt
-        # from a pattern like GitHub's.
-        release = self._cached_release(spec) if use_cache and not repo_spec.version else None
-        if release is not None:
-            log.debug(f"release (resolve cache): {release.tag} ({len(release.assets)} assets)")
-        else:
-            release = self._fetch_release(
-                source,
-                repo_spec,
-                env_dir=env_dir,
-                upgrade=upgrade,
-                known_tag=known_tag,
-                asset_pattern=release_pattern,
-                pattern_name=release_pattern_name,
+        if locked_binary is not None:
+            if not repo_spec.version:
+                raise BinarySpecError("locked binary install requires a pinned release tag")
+            release = Release(
+                tag=repo_spec.version,
+                assets=[Asset(name=locked_binary.asset, url=locked_binary.url)],
+                resolution_source="lockfile",
             )
-            log.debug(f"release: {release.tag} ({len(release.assets)} assets)")
+            log.debug(f"release (lockfile): {release.tag} ({locked_binary.asset})")
+        else:
+            # Reuse the release already fetched during version resolution (e.g. an
+            # upgrade or a dry-run within the TTL window). This skips a second API
+            # call — the only option for GitLab, whose asset URLs can't be rebuilt
+            # from a pattern like GitHub's.
+            release = self._cached_release(spec) if use_cache and not repo_spec.version else None
+            if release is not None:
+                log.debug(f"release (resolve cache): {release.tag} ({len(release.assets)} assets)")
+            else:
+                release = self._fetch_release(
+                    source,
+                    repo_spec,
+                    env_dir=env_dir,
+                    upgrade=upgrade,
+                    known_tag=known_tag,
+                    asset_pattern=release_pattern,
+                    pattern_name=release_pattern_name,
+                )
+                log.debug(f"release: {release.tag} ({len(release.assets)} assets)")
 
         if setup is None and not setup_resolved:
             setup = self._resolve_setup(
@@ -491,7 +532,10 @@ class BinaryBackend:
         if asset_pattern:
             log.debug(f"user-forced asset_pattern: {asset_pattern!r}")
         selection_pattern = _selection_pattern(effective_pattern, release.tag)
-        asset = self._select_asset(release, selection_pattern, tool_name, spec)
+        if locked_binary is None:
+            asset = self._select_asset(release, selection_pattern, tool_name, spec)
+        else:
+            asset = release.assets[0]
         log.debug(f"selected asset: {asset.name}")
 
         archive_path = self._download_asset(
@@ -512,8 +556,16 @@ class BinaryBackend:
         log.debug(f"extracted to: {result.root}")
 
         heuristics = load_heuristics()
-        executables = find_executables(result.root, expose=heuristics.expose, log=log)
+        rejected_executables: list[tuple[Path, str]] = []
+        executables = find_executables(
+            result.root,
+            expose=heuristics.expose,
+            log=log,
+            rejected=rejected_executables,
+        )
         log.debug(f"executables: {[e.name for e in executables]}")
+        if not executables and rejected_executables:
+            raise BinaryPlatformError(spec, release.tag, asset.name, rejected_executables)
 
         binaries = {exe.name: str(exe) for exe in executables}
 

{ixt_cli-0.8.1 → ixt_cli-0.9.0}/src/ixt/cli/cmd_apply.py

@@ -33,16 +33,21 @@ if TYPE_CHECKING:
 
 
 def cmd_apply(args: argparse.Namespace) -> int:
-    from ixt.core.apply import RemovalsRefused, apply_config
+    from ixt.core.apply import LockedApplyError, RemovalsRefused, apply_config
 
     logger = get_logger("apply")
     dry_run = getattr(args, "dry_run", False)
     yes = getattr(args, "yes", False)
+    locked = getattr(args, "locked", False)
+    strict = getattr(args, "strict", False)
 
     config_path = Path(args.config_file) if args.config_file else None
+    if strict and not locked:
+        logger.error("--strict requires --locked")
+        return 1
 
     if dry_run:
-        return _cmd_apply_dry_run(config_path, args.remove, logger)
+        return _cmd_apply_dry_run(config_path, args.remove, logger, locked=locked, strict=strict)
 
     confirm: Callable[[list[str]], bool] | None = None
     if args.remove and not yes:
@@ -53,6 +58,8 @@ def cmd_apply(args: argparse.Namespace) -> int:
         result = apply_config(
             config_path=config_path,
             remove_unlisted=args.remove,
+            locked=locked,
+            strict=strict,
             confirm_removals=confirm,
             progress=_make_apply_progress(logger),
         )
@@ -63,6 +70,11 @@ def cmd_apply(args: argparse.Namespace) -> int:
     except RemovalsRefused:
         logger.info("aborted by user")
         return 0
+    except LockedApplyError as exc:
+        logger.error(str(exc))
+        if str(exc) == "No ixt.lock found":
+            logger.error(f"  {dim('Hint: create one with ixt lock write')}")
+        return 1
 
     total = len(result.installed) + len(result.updated) + len(result.removed)
     if not total and not result.errors:
@@ -226,11 +238,21 @@ def _make_remove_confirmer(logger) -> Callable[[list[str]], bool]:
 
 
 def _load_apply_plan(
-    config_path: Path | None, remove_unlisted: bool, logger
+    config_path: Path | None,
+    remove_unlisted: bool,
+    logger,
+    *,
+    locked: bool = False,
+    strict: bool = False,
 ) -> tuple[ApplyPlan, Path] | int:
     """Load the ixt.toml and build an ApplyPlan, or return an exit code on error."""
     from ixt.config.toml import find_config_file, load_config
-    from ixt.core.apply import _get_installed_tools, _normalize_config_for_apply, plan_apply
+    from ixt.core.apply import (
+        LockedApplyError,
+        _get_installed_tools,
+        _prepare_config_for_apply,
+        plan_apply,
+    )
 
     path = config_path or find_config_file()
     if path is None:
@@ -246,7 +268,19 @@ def _load_apply_plan(
 
     settings = get_settings()
     installed = _get_installed_tools(settings)
-    config = _normalize_config_for_apply(config, settings)
+    try:
+        config, _locked_tools = _prepare_config_for_apply(
+            config,
+            path,
+            settings,
+            locked=locked,
+            strict=strict,
+        )
+    except LockedApplyError as exc:
+        logger.error(str(exc))
+        if str(exc) == "No ixt.lock found":
+            logger.error(f"  {dim('Hint: create one with ixt lock write')}")
+        return 1
     plan = plan_apply(config, installed, remove_unlisted=remove_unlisted)
     return plan, path
 
@@ -346,8 +380,21 @@ def _print_apply_summary(plan, logger) -> None:
         logger.info(f"  {dim('total: ' + ', '.join(parts))}")
 
 
-def _cmd_apply_dry_run(config_path: Path | None, remove_unlisted: bool, logger) -> int:
-    result = _load_apply_plan(config_path, remove_unlisted, logger)
+def _cmd_apply_dry_run(
+    config_path: Path | None,
+    remove_unlisted: bool,
+    logger,
+    *,
+    locked: bool = False,
+    strict: bool = False,
+) -> int:
+    result = _load_apply_plan(
+        config_path,
+        remove_unlisted,
+        logger,
+        locked=locked,
+        strict=strict,
+    )
     if isinstance(result, int):
         return result
     plan, path = result

ixt_cli-0.9.0/src/ixt/cli/cmd_lock.py

@@ -0,0 +1,89 @@
+"""``ixt lock`` command handlers."""
+
+from __future__ import annotations
+
+import argparse
+
+from ixt.libs.logger import get_logger
+from ixt.libs.output import data
+from ixt.libs.style import dim
+
+
+def cmd_lock(args: argparse.Namespace) -> int:
+    """Dispatch ``ixt lock`` subcommands."""
+
+    action = getattr(args, "lock_action", None)
+    if action == "write":
+        return _cmd_lock_write()
+    if action == "check":
+        return _cmd_lock_check()
+    if action == "diff":
+        return _cmd_lock_diff()
+    get_logger("lock").error("Specify a lock action: write, check, diff")
+    return 1
+
+
+def _cmd_lock_write() -> int:
+    from ixt.core.lockfile import write_lockfile
+
+    logger = get_logger("lock")
+    try:
+        result = write_lockfile()
+    except FileNotFoundError:
+        logger.error("No ixt.toml found")
+        logger.error(f"  {dim('Hint: create one with ixt tool export > ixt.toml')}")
+        return 1
+    except Exception as exc:
+        logger.error(f"Failed to write ixt.lock: {exc}")
+        return 1
+
+    logger.info(f"Wrote {result.path} ({len(result.lock.tools)} tool(s))")
+    return 0
+
+
+def _cmd_lock_check() -> int:
+    from ixt.core.lockfile import check_lockfile
+
+    logger = get_logger("lock")
+    try:
+        result = check_lockfile()
+    except Exception as exc:
+        return _log_lock_check_error(exc)
+
+    if result.ok:
+        logger.info(f"{result.path} is up to date")
+        return 0
+
+    logger.error(f"{result.path} is out of date")
+    for difference in result.differences:
+        logger.error(f"  - {difference.message}")
+    return 1
+
+
+def _cmd_lock_diff() -> int:
+    from ixt.core.lockfile import check_lockfile
+
+    try:
+        result = check_lockfile()
+    except Exception as exc:
+        return _log_lock_check_error(exc)
+
+    if result.ok:
+        data("ixt.lock is up to date")
+        return 0
+
+    data("ixt.lock differs from ixt.toml:")
+    for difference in result.differences:
+        data(f"- {difference.message}")
+    return 1
+
+
+def _log_lock_check_error(exc: Exception) -> int:
+    logger = get_logger("lock")
+    message = str(exc)
+    logger.error(message)
+    if message == "No ixt.toml found":
+        logger.error(f"  {dim('Hint: create one with ixt tool export > ixt.toml')}")
+    elif message == "No ixt.lock found":
+        logger.error(f"  {dim('Hint: create one with ixt lock write')}")
+    return 1

{ixt_cli-0.8.1 → ixt_cli-0.9.0}/src/ixt/cli/commands.py

@@ -15,6 +15,7 @@ from ixt.cli.cmd_cache import cmd_cache
 from ixt.cli.cmd_config import cmd_config
 from ixt.cli.cmd_info import cmd_info, cmd_list
 from ixt.cli.cmd_install import _log_not_found_hint, cmd_add, cmd_install, cmd_uninstall
+from ixt.cli.cmd_lock import cmd_lock
 from ixt.cli.cmd_misc import (
     cmd_doctor,
     cmd_environment,
@@ -39,6 +40,7 @@ __all__ = [
     "cmd_info",
     "cmd_install",
     "cmd_list",
+    "cmd_lock",
     "cmd_registry",
     "cmd_runtimes",
     "cmd_setup",
@@ -61,6 +63,7 @@ COMMANDS: dict[str, Callable] = {
     "where": cmd_where,
     "apply": cmd_apply,
     "export": cmd_export,
+    "lock": cmd_lock,
     "cache": cmd_cache,
     "registry": cmd_registry,
     "runtime": cmd_runtimes,

{ixt_cli-0.8.1 → ixt_cli-0.9.0}/src/ixt/cli/parser.py

@@ -392,6 +392,16 @@ def build_parser() -> argparse.ArgumentParser:
         dest="dry_run",
         help="Show what would change without installing, reinstalling, or removing",
     )
+    p_apply.add_argument(
+        "--locked",
+        action="store_true",
+        help="Install exact versions and assets from ixt.lock",
+    )
+    p_apply.add_argument(
+        "--strict",
+        action="store_true",
+        help="With --locked, fail if ixt.toml and ixt.lock diverge",
+    )
 
     # -- tool export -----------------------------------------------------------
     p_export_tools = tool_sub.add_parser(
@@ -433,6 +443,24 @@ def build_parser() -> argparse.ArgumentParser:
         help="Generate the initial linux/macos x86_64/aarch64 platform matrix",
     )
 
+    # -- lock ------------------------------------------------------------------
+    p_lock = sub.add_parser("lock", help="Manage ixt.lock")
+    p_lock.set_defaults(command="lock")
+    lock_sub = p_lock.add_subparsers(dest="lock_action", metavar="ACTION", required=True)
+
+    lock_sub.add_parser(
+        "write",
+        help="Resolve the effective ixt.toml and write ixt.lock",
+    )
+    lock_sub.add_parser(
+        "check",
+        help="Check whether ixt.lock matches the effective ixt.toml",
+    )
+    lock_sub.add_parser(
+        "diff",
+        help="Show differences between ixt.lock and the effective ixt.toml",
+    )
+
     # -- cache -----------------------------------------------------------------
     p_cache = sub.add_parser("cache", help="Inspect and prune ixt caches")
     p_cache.set_defaults(command="cache")