kanon-cli 3.2.0__tar.gz → 3.3.2__tar.gz

{kanon_cli-3.2.0 → kanon_cli-3.3.2}/.github/actions/setup-kanon/action.yml

@@ -3,11 +3,17 @@ description: |
   Composite action shared by every job in pr-validation.yml and
   main-validation.yml. Handles checkout, optional simulate-merge,
   Python install, asdf bootstrap (plus plugin install per
-  .tool-versions), pip dependency cache, dev dependency install via
-  `make install-dev`, and uv install. Each parallel CI job calls this
-  action once before invoking its own singular Make target / pytest
-  invocation, so the per-job step list stays minimal and the setup
-  drift between jobs is impossible.
+  .tool-versions), uv install with an uv.lock-keyed cache, and the
+  dependency install itself (`uv sync --locked --all-groups`). Each
+  parallel CI job calls this action once before invoking its own
+  singular Make target, so the per-job step list stays minimal and
+  setup drift between jobs is impossible.
+
+  Every job resolves dependencies from uv.lock and nowhere else. Jobs
+  must invoke Make targets rather than calling pytest/ruff/bandit
+  directly, because those targets run tools through `uv run`; a bare
+  invocation picks up whatever is on PATH and reintroduces the drift
+  this action exists to prevent.
 
 inputs:
   base-ref:
@@ -108,15 +114,20 @@ runs:
         asdf install
         asdf reshim
 
-    - name: Cache Python dependencies
-      uses: actions/cache@v5
+    - name: Install uv
+      # uv must be installed BEFORE the dependency step, because that step is
+      # now `uv sync`. It is also required at test time:
+      # `tests/unit/repo/test_wheel_contents.py`,
+      # `tests/integration/test_wheel_e2e.py`, and
+      # `tests/integration/test_ci_validation.py` shell out to `uv build` to
+      # produce the wheel under test.
+      # `enable-cache` replaces the previous actions/cache pip step; keying on
+      # uv.lock means the cache is invalidated by exactly the file that decides
+      # which versions get installed.
+      uses: astral-sh/setup-uv@v6
       with:
-        path: |
-          ~/.cache/pip
-          ~/.local/lib/python*/site-packages
-        key: ${{ runner.os }}-pip-${{ hashFiles('requirements-dev.txt', 'pyproject.toml') }}
-        restore-keys: |
-          ${{ runner.os }}-pip-
+        enable-cache: true
+        cache-dependency-glob: uv.lock
 
     - name: Install zsh (for shell-completion integration tests)
       if: runner.os == 'Linux'
@@ -140,22 +151,15 @@ runs:
       shell: bash
       run: |
         set -euo pipefail
-        pip install --upgrade pip
-        # `make install-dev` is `pip install -r requirements-dev.txt`. GNU make
-        # is not guaranteed on the windows-latest runner image, so the Windows
-        # leg invokes pip directly (same dependency set, no make dependency)
-        # while Linux keeps the make target for parity with local dev.
-        if [ "$RUNNER_OS" = "Linux" ]; then
-          make install-dev
-        else
-          pip install -r requirements-dev.txt
-        fi
-
-    - name: Install uv
-      # `tests/unit/repo/test_wheel_contents.py`,
-      # `tests/integration/test_wheel_e2e.py`, and
-      # `tests/integration/test_ci_validation.py` shell out to
-      # `uv build` to produce the wheel under test; uv must be on
-      # PATH for any job that runs those suites (including the
-      # full-suite regression job that runs every test together).
-      uses: astral-sh/setup-uv@v6
+        # Single dependency-resolution path for every job. Previously this was
+        # `pip install -r requirements-dev.txt`, which resolved from PyPI at run
+        # time and ignored uv.lock, while `make test` / `make test-scenarios`
+        # ran under `uv run` and honoured it. The two disagreed -- the pip leg
+        # installed pytest 8.3 and an unbounded shtab, so a shtab release broke
+        # the completion golden fixtures in the pip-based jobs only.
+        #
+        # `--locked` fails the job if uv.lock is stale rather than silently
+        # re-resolving, so a dependency change cannot reach CI unlocked.
+        # `uv sync` needs no GNU make, so the Windows leg no longer needs a
+        # separate branch.
+        uv sync --locked --all-groups

{kanon_cli-3.2.0 → kanon_cli-3.3.2}/.github/workflows/main-validation.yml

@@ -103,17 +103,14 @@ jobs:
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup-kanon
-      - name: Run unit tests with 90% coverage gate
+      - name: Run unit tests with coverage gate
         shell: bash
-        run: |
-          python -m pytest -n auto --dist loadscope -m "unit" --cov=kanon_cli --cov-report=term-missing
-          coverage json
-          coverage_percent=$(python -c "import json; f=open('coverage.json'); print(json.load(f)['totals']['percent_covered'])")
-          echo "Coverage: $coverage_percent%"
-          if (( $(echo "$coverage_percent < 90" | bc -l) )); then
-            echo "Error: Code coverage is below 90% threshold ($coverage_percent%)"
-            exit 1
-          fi
+        # Delegates to the Make target so the threshold lives in one place
+        # (Makefile: COVERAGE_MIN) instead of being duplicated across both
+        # workflow files, and so the run resolves from uv.lock like every other
+        # job. pytest-cov's own --cov-fail-under replaces the hand-rolled
+        # coverage-json + bc comparison.
+        run: make test-unit-cov
 
   integration-tests-linux:
     name: Integration tests (Linux)
@@ -127,7 +124,7 @@ jobs:
       - uses: ./.github/actions/setup-kanon
       - name: Run integration tests
         shell: bash
-        run: python -m pytest -n auto --dist loadscope -m "integration"
+        run: make test-integration
 
   functional-tests-linux:
     name: Functional tests (Linux)
@@ -141,7 +138,7 @@ jobs:
       - uses: ./.github/actions/setup-kanon
       - name: Run functional tests
         shell: bash
-        run: SMOKE_TEST_TIMEOUT=300 python -m pytest -n auto --dist loadscope -m "functional"
+        run: make test-functional
 
   scenario-tests-linux:
     name: Scenario tests (Linux, docs/integration-testing.md)
@@ -276,22 +273,19 @@ jobs:
           asdf install
           asdf reshim
 
-      - name: Cache Python dependencies for release
-        uses: actions/cache@v5
+      - name: Install uv
+        # Same single resolution path as .github/actions/setup-kanon: deps come
+        # from uv.lock via `make install-dev` (`uv sync --locked`). Replaces the
+        # previous pip cache, which keyed on a requirements-dev.txt that no
+        # longer exists.
+        uses: astral-sh/setup-uv@v6
         with:
-          path: |
-            ~/.cache/pip
-            ~/.local/lib/python*/site-packages
-          key: ${{ runner.os }}-pip-release-${{ hashFiles('requirements-dev.txt', 'pyproject.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-release-
-            ${{ runner.os }}-pip-
+          enable-cache: true
+          cache-dependency-glob: uv.lock
 
       - name: Install dependencies
         shell: bash
-        run: |
-          pip install --upgrade pip
-          make install-dev
+        run: make install-dev
 
       - name: Compute next version
         id: semantic-release
@@ -299,7 +293,7 @@ jobs:
           GH_TOKEN: ${{ steps.generate_token.outputs.token }}
         shell: bash
         run: |
-          NEW_VERSION=$(python -m semantic_release version --print | sed 's/^v//')
+          NEW_VERSION=$(uv run python -m semantic_release version --print | sed 's/^v//')
           echo "New version: $NEW_VERSION"
           if [[ -z "$NEW_VERSION" ]]; then
             echo "No new version detected, using current version"
@@ -313,7 +307,7 @@ jobs:
           GH_TOKEN: ${{ steps.generate_token.outputs.token }}
         shell: bash
         run: |
-          python -m semantic_release version --no-push --no-vcs-release --no-commit
+          uv run python -m semantic_release version --no-push --no-vcs-release --no-commit
 
           NEW_VERSION=$(grep '^version = ' pyproject.toml | sed 's/.*version = "\([^"]*\)".*/\1/')
           echo "Updated version: $NEW_VERSION"
@@ -321,6 +315,13 @@ jobs:
           sed -i "s/__version__ = \"[^\"]*\"/__version__ = \"$NEW_VERSION\"/" src/kanon_cli/__init__.py
           echo "Updated __init__.py to version: $NEW_VERSION"
 
+          # uv.lock records the project's own version, so a bump leaves it stale.
+          # Every job installs with `uv sync --locked`, which refuses a stale lock,
+          # so the refresh has to land in the same commit as the version bump --
+          # otherwise the tag build fails in "Build and publish to PyPI".
+          uv lock
+          echo "Refreshed uv.lock to version: $NEW_VERSION"
+
           sed -i 's/[[:space:]]*$//' CHANGELOG.md pyproject.toml src/kanon_cli/__init__.py
 
           rm -rf dist/ build/ src/kanon_cli.egg-info/
@@ -346,7 +347,7 @@ jobs:
           echo "Git status before staging:"
           git status --porcelain
 
-          git add CHANGELOG.md pyproject.toml src/kanon_cli/__init__.py
+          git add CHANGELOG.md pyproject.toml src/kanon_cli/__init__.py uv.lock
 
           echo "Git status after staging:"
           STAGED=$(git status --porcelain)

{kanon_cli-3.2.0 → kanon_cli-3.3.2}/.github/workflows/pr-validation.yml

@@ -130,17 +130,14 @@ jobs:
         with:
           base-ref: ${{ github.base_ref }}
           head-sha: ${{ github.event.pull_request.head.sha }}
-      - name: Run unit tests with 90% coverage gate
+      - name: Run unit tests with coverage gate
         shell: bash
-        run: |
-          python -m pytest -n auto --dist loadscope -m "unit" --cov=kanon_cli --cov-report=term-missing
-          coverage json
-          coverage_percent=$(python -c "import json; f=open('coverage.json'); print(json.load(f)['totals']['percent_covered'])")
-          echo "Coverage: $coverage_percent%"
-          if (( $(echo "$coverage_percent < 90" | bc -l) )); then
-            echo "Error: Code coverage is below 90% threshold ($coverage_percent%)"
-            exit 1
-          fi
+        # Delegates to the Make target so the threshold lives in one place
+        # (Makefile: COVERAGE_MIN) instead of being duplicated across both
+        # workflow files, and so the run resolves from uv.lock like every other
+        # job. pytest-cov's own --cov-fail-under replaces the hand-rolled
+        # coverage-json + bc comparison.
+        run: make test-unit-cov
 
   integration-tests-linux:
     name: Integration tests (Linux)
@@ -157,7 +154,7 @@ jobs:
           head-sha: ${{ github.event.pull_request.head.sha }}
       - name: Run integration tests
         shell: bash
-        run: python -m pytest -n auto --dist loadscope -m "integration"
+        run: make test-integration
 
   functional-tests-linux:
     name: Functional tests (Linux)
@@ -174,7 +171,7 @@ jobs:
           head-sha: ${{ github.event.pull_request.head.sha }}
       - name: Run functional tests
         shell: bash
-        run: SMOKE_TEST_TIMEOUT=300 python -m pytest -n auto --dist loadscope -m "functional"
+        run: make test-functional
 
   scenario-tests-linux:
     name: Scenario tests (Linux, docs/integration-testing.md)

{kanon_cli-3.2.0 → kanon_cli-3.3.2}/.github/workflows/publish.yml

@@ -84,19 +84,18 @@ jobs:
         with:
           python-version: '3.14'
 
-      - name: Cache Python dependencies
-        uses: actions/cache@v5
+      - name: Install uv
+        # Same single resolution path as .github/actions/setup-kanon: deps come
+        # from uv.lock via `make install-dev` (`uv sync --locked`). Replaces the
+        # previous pip cache, which keyed on a requirements-dev.txt that no
+        # longer exists.
+        uses: astral-sh/setup-uv@v6
         with:
-          path: |
-            ~/.cache/pip
-            ~/.local/lib/python*/site-packages
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements-dev.txt', 'pyproject.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-
+          enable-cache: true
+          cache-dependency-glob: uv.lock
 
       - name: Install build dependencies
         run: |
-          pip install --upgrade pip
           make install-dev
           asdf reshim
         shell: bash

{kanon_cli-3.2.0 → kanon_cli-3.3.2}/.gitignore

@@ -31,3 +31,6 @@ tmp/
 
 # Deleted bundled catalog -- guard against accidental re-addition (E6-F2-S1-T1)
 src/kanon_cli/catalog/
+
+# Local settings files
+*.local.json

{kanon_cli-3.2.0 → kanon_cli-3.3.2}/.tool-versions

@@ -1,2 +1,3 @@
 jq 1.8.1
 pre-commit 4.3.0
+uv 0.12.1

{kanon_cli-3.2.0 → kanon_cli-3.3.2}/CHANGELOG.md

@@ -2,8 +2,329 @@
 
 
 
+## v3.3.2 (2026-08-05)
+
+### Fix
+
+* fix(ci): refresh uv.lock during the release version bump (#107)
+
+`Build and publish to PyPI` failed on the 3.3.1 tag:
+
+    uv sync --locked --all-groups
+    error: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided.
+
+uv.lock records the project's own version alongside its dependencies.
+semantic-release bumps `pyproject.toml` and `src/kanon_cli/__init__.py`
+via version_toml / version_variable, but knows nothing about uv.lock, and
+the release job staged only those two files plus CHANGELOG.md. Every
+release therefore left uv.lock one version behind: after 3.3.1,
+pyproject.toml said 3.3.1 and uv.lock still said 3.3.0.
+
+The drift is not new -- before #97, uv.lock said 2.1.0 against a
+pyproject at 3.3.0, six releases of silent skew. What is new is that
+`make install-dev` is now `uv sync --locked`, which refuses a stale lock
+instead of quietly re-resolving, so a latent inconsistency became a hard
+failure at tag-build time.
+
+The release job now runs `uv lock` immediately after the version bump and
+stages uv.lock with the other version files, so the release commit is
+self-consistent and the tag it points at can be installed. Verified that
+`uv lock` against the current tree changes exactly one line
+(kanon-cli 3.3.0 -> 3.3.1) with no dependency churn, so this does not turn
+a release into an unrelated dependency update.
+
+uv.lock is also corrected here so main is self-consistent again.
+
+Adds `test_uv_lock_records_the_declared_project_version`, which compares
+the kanon-cli entry in uv.lock against `[project] version`. Verified RED
+against the stale lock, failing with the same mismatch the publish job
+hit. It has to be run without `uv run` to fail, which is the reason this
+class of drift stays invisible in local development: `uv run` implicitly
+re-locks before executing, so a developer never sees the inconsistency
+that a `--locked` install in CI rejects.
+
+Note the existing 3.3.1 tag still points at a commit carrying the stale
+lock, so republishing that exact tag will keep failing until the tag is
+moved or a further release is cut. ([`00714e6`](https://github.com/caylent-solutions/kanon/commit/00714e648a42bea706945e7a38a66fa6dca8df28))
+
+
+## v3.3.1 (2026-08-04)
+
+### Chore
+
+* chore(release): 3.3.1 ([`71621d5`](https://github.com/caylent-solutions/kanon/commit/71621d50a72c412cae40b1886f6c73adc08e9fc0))
+
+* chore(git): ignore local settings files ([`61ceade`](https://github.com/caylent-solutions/kanon/commit/61ceade79f79a73b11316866572a71b3abce3052))
+
+* chore: add uv to toolchain via asdf
+
+Pin uv 0.12.1 in .tool-versions alongside the project's existing
+asdf-managed tools, and refresh uv.lock's kanon-cli editable entry
+to match the current pyproject.toml version. ([`300b979`](https://github.com/caylent-solutions/kanon/commit/300b979ae0dae98f200efd21be99fad0b5106658))
+
+### Fix
+
+* fix: let repo sync own <linkfile>, removing the duplicate copy pass (#105)
+
+* fix: skip linkfile copy when dest already resolves to src
+
+repo sync materializes every <linkfile> as a symlink before
+_process_manifest_linkfiles runs. For a file-level src the helper then
+called shutil.copy2 on the same inode pair, raising SameFileError and
+aborting the install with exit 1.
+
+Closes #93
+
+* fix: let repo sync own <linkfile>, removing the duplicate copy pass
+
+`_process_manifest_linkfiles` re-processed the same `<linkfile>` elements
+`repo sync` had just materialized. It read only the root manifest's direct
+`<project>` children (no `<include>` traversal) and skipped any non-file
+`src`, so in a real install it covered a strict subset of what sync had
+already done. Its three possible outcomes were: crash on the same inode
+(issue 93), write through a foreign symlink and clobber that link's target,
+or nothing. It had no branch that produced a correct result sync had not
+already produced.
+
+It existed to compensate for tests that replace `repo_sync` with a no-op,
+which its own docstring stated. The compensation belongs in the double, not
+in production, so it moves to `tests.conftest.materialize_linkfiles_for_sync`
+-- delegating to the production `_LinkFile` so the double cannot drift from
+what `repo` does. Mocked-sync tests now leave a symlink where a real sync
+leaves one, instead of a copy.
+
+Runtime behaviour is unchanged for every input except the crash: with
+`repo sync` succeeding, the deleted pass was already a no-op. No exported
+symbol is removed; `__all__` is byte-identical.
+
+Replaces the unit-level regression test, which imported the deleted
+function, with one that drives a real `repo init` + `repo sync` against
+local file:// fixtures. Verified RED against the pre-fix code: it reproduces
+`shutil.SameFileError` on the flagged/file-src case only, matching the scope
+table in issue 93.
+
+`test_only_flagged_source_registers_marketplace` asserted that an unflagged
+source cannot register a marketplace. Under a sync that behaves like the real
+one it registers anyway: `run_repo_sync` is unconditional, `_LinkFile._Link`
+knows nothing about kanon flags, `CLAUDE_MARKETPLACES_DIR` is exported to
+every source, and `install_marketplace_plugins` scans the directory once with
+no per-source attribution. The flag genuinely gates only
+`register_direct_checkout_marketplaces`, so the fixture now uses
+direct-checkout entries and the docstring records what the flag does not gate.
+
+Closes #93
+
+* ci: resolve every job from uv.lock, deleting the pip dependency path
+
+CI resolved dependencies two ways. The tiered test jobs ran bare
+`python -m pytest` against a `pip install -r requirements-dev.txt`
+environment, which resolves from PyPI at run time; `make test` and
+`make test-scenarios` ran under `uv run`, which honours uv.lock. The two
+manifests disagreed -- requirements-dev.txt pinned pytest ~=8.3.0 while
+[dependency-groups] dev asked for >=9.0.3, so the same suite ran on two
+different runners depending on the job.
+
+That split is what let a shtab release break CI. `shtab>=1.7.0` had no
+upper bound, shtab 1.9.0 (2026-07-31) changed its generated output, and
+the pip-based jobs installed 1.9.3 against completion golden fixtures
+generated with 1.8.0. The uv-based jobs stayed on uv.lock's 1.8.0 and
+passed. main has not run CI since 2026-07-17, before that release, so it
+is green in history and broken in fact; every PR branched from it fails
+the same two tests.
+
+Reproduced directly: a venv built from requirements-dev.txt resolves
+shtab 1.9.3 and pytest 8.3.5, and fails
+test_completion_stdout_matches_committed_golden[bash,zsh] with the same
+16098-vs-15657 byte mismatch CI reports. Installing shtab==1.8.0 into
+that same venv turns it green.
+
+9869ee7 pins shtab, which fixes the instance. This removes the cause:
+
+- [dependency-groups] dev absorbs ruff, bandit, twine, pre-commit and
+  python-semantic-release, the tools only requirements-dev.txt declared.
+  Existing pins carry over unchanged. ruff stays ~=0.11.0 for the same
+  reason shtab is pinned: `ruff format --check` is a byte-level gate.
+- requirements-dev.txt is deleted rather than kept in sync.
+- requirements.txt is deleted too. It declared packaging and nothing
+  else, one of three runtime dependencies, and `make install` was
+  referenced nowhere; pyproject's [project] dependencies supersedes it.
+- Every Makefile target invokes its tools through `uv run`. Previously
+  `make security-scan` was `uv run bandit` with bandit in no dependency
+  group, so uv fell through to PATH and silently ran a system-wide
+  bandit -- verified resolving to /usr/local/py-utils/bin/bandit.
+- The unit coverage gate moves into `make test-unit-cov` behind a
+  COVERAGE_MIN variable, replacing the coverage-json + bc comparison
+  duplicated across both workflow files with pytest-cov's own
+  --cov-fail-under.
+- setup-kanon installs uv before dependencies and runs
+  `uv sync --locked --all-groups`; --locked fails the job on a stale
+  lock instead of silently re-resolving. setup-uv's cache, keyed on
+  uv.lock, replaces the pip cache. The Windows leg no longer needs its
+  own branch because uv sync does not require GNU make.
+- The release and publish jobs move to the same path, and
+  `python -m semantic_release` becomes `uv run python -m semantic_release`.
+
+The CI-shape tests are updated rather than loosened. The tier assertions
+followed the existing `make test-scenarios` precedent and now check both
+halves of the contract: the workflow invokes the tier's Make target
+exactly once with no per-OS override, and that target selects the bare
+marker. Previously the marker was asserted but the delegation was not;
+now both are. test_ci_includes_repo_tests searches the Makefile as well,
+since --cov=kanon_cli moved there.
+
+Verified from a clean `uv sync --locked --all-groups`: ruff, bandit,
+twine, pre-commit and pytest all resolve inside .venv with no PATH
+fallthrough. All ten CI jobs pass locally with counts identical to the
+pre-change baseline -- full suite 17168 passed / 0 failed / 95%, unit
+11712 passed / 93.22%, integration 1947, functional 3089, scenario 413.
+
+---------
+
+Co-authored-by: Ryan Gross <ryan.gross@caylent.com> ([`23b320e`](https://github.com/caylent-solutions/kanon/commit/23b320e7818bf564cbc3b9dcb65acc3e7f4626ef))
+
+* fix: pin shtab to exact version to stop completion-fixture CI drift
+
+pyproject.toml declared shtab>=1.7.0 with no upper bound. CI installs
+dependencies via `pip install -r requirements-dev.txt` (-e .), resolving
+shtab independently of uv.lock's exact pin; PyPI's latest shtab (1.9.2)
+changed its generated output, breaking the byte-for-byte comparison
+against the committed completion golden fixtures in both the
+integration and functional test suites. Exact-pinning to 1.8.0 (already
+locked in uv.lock) makes both install paths deterministic. ([`9869ee7`](https://github.com/caylent-solutions/kanon/commit/9869ee7b720829c329ad3c1afdcf2057a14427aa))
+
+* fix(test): put safeguards in place for pre-commit failures in devcontainer environment on macos ([`1f38b25`](https://github.com/caylent-solutions/kanon/commit/1f38b25ea3205cac983c0952baed76c4a976b3ee))
+
+* fix(tests): patch to avoid ioctl environment issues when running tests in devcontainer under uv ([`4931c10`](https://github.com/caylent-solutions/kanon/commit/4931c101c4cec06e778958e62b1af68ee9ada022))
+
+### Unknown
+
+* Merge pull request #106 from caylent-solutions/release-3.3.1
+
+Release 3.3.1 ([`35f709f`](https://github.com/caylent-solutions/kanon/commit/35f709f1f5e0c26a2bcf6317e573ca56303e49bd))
+
+* Merge pull request #97 from caylent-solutions/chore/add-uv-tool-version
+
+chore: add uv toolchain support and fix progress-bar ioctl crash
+
+Includes the issue-93 linkfile fix and the CI dependency-resolution
+consolidation merged into this branch via #105. ([`bfab7a3`](https://github.com/caylent-solutions/kanon/commit/bfab7a319ade76111057696ee049b6d6ab5c41ab))
+
+
+## v3.3.0 (2026-07-17)
+
+### Chore
+
+* chore(release): 3.3.0 ([`5100db5`](https://github.com/caylent-solutions/kanon/commit/5100db56a01818a5914474d7ddb95c96b7ab6de9))
+
+### Feature
+
+* feat: kanon list command + usage telemetry, full install-graph capture, and update-warning enhancement (#91)
+
+* feat: add usage telemetry, full install-graph capture, and update-warning enhancement
+
+Emit one structured usage-telemetry event per CLI command to the Caylent
+collector, fully capturing what was installed (every direct source plus every
+transitive repo package with URLs and resolved content SHAs), and enhance the
+"update available" warning.
+
+Telemetry (new core/telemetry.py):
+- Hooked via try/finally around dispatch in cli.py; captures command, subcommand,
+  boolean flag names, allowlisted flag values, outcome (exit code/status/error
+  class/duration), runtime environment, and credential-stripped git provenance.
+- OTLP/HTTP logs JSON with one log record whose body is a flat
+  {tool,timestamp,event_type,payload} object (payload a JSON string); POSTed via
+  stdlib urllib in a detached, non-blocking, silent, never-fail background
+  process (utils/spawn.spawn_detached), HTTPS-only guard, timeouts + body cap.
+- Auto opted-in by default; the only opt-out is KANON_TELEMETRY_DISABLED (no
+  --no-telemetry flag). KANON_TELEMETRY_ENDPOINT / --telemetry-endpoint and
+  KANON_TELEMETRY_DEBUG / --telemetry-debug are supported.
+- Zero-secret allowlist: never raw argv, keys, tokens, credentials, env-var
+  values, or file contents; every URL is credential-stripped.
+
+Full install-graph capture (core/install.py):
+- Populate SourceEntry.projects on install by resolving project -> remote -> URL
+  from the already-synced manifests (walk_includes_collecting_remotes +
+  join_project_repo_url + canonicalize_repo_url) joined with the captured content
+  pins. This also fixes `kanon why` showing an empty project layer on
+  install-written lockfiles. Telemetry emits payload.install_graph and a
+  flattened payload.installed_packages[] (direct + transitive), capped under the
+  collector body limit with install_graph_truncated on overflow.
+
+Update-warning enhancement (core/update_check.py):
+- Yellow banner with the current version in red and the latest in green; a red
+  "no internet access -- could not check for updates" notice on a failed fetch,
+  shown at most once per window; default KANON_UPDATE_CHECK_TTL lowered to 3h.
+
+Docs: new docs/privacy.md (collected fields, encryption, opt-out) linked from
+README; telemetry rows in docs/cli-reference.md and docs/configuration.md;
+regenerated help + completion snapshots.
+
+* test: include telemetry global flags in bash completion expectation
+
+The new --telemetry-debug / --telemetry-endpoint global flags now appear in the
+top-level bash completion, so the exact-match global_flags row in
+test_completion_bash.py is extended to include them.
+
+* test: use provider-neutral remote name in build_project_entries fixture
+
+The provider-agnostic host gate forbids the bare token 'gh'; rename the fixture
+manifest remote from 'gh' to 'origin' so the manifest XML fixtures carry no
+provider-specific reference.
+
+* fix: record real command outcome in telemetry and emit for --version/--help/bare invocations
+
+* feat: add kanon list command (declared vs installed source inventory)
+
+Add `kanon list`, the flat inventory command that reconciles the sources
+declared in .kanon against those installed in .kanon.lock and tags each one
+installed / not-installed / orphan -- the kanon analogue of `pip list` /
+`npm ls` / `poetry show`.
+
+Flags: --declared, --tree, --status <installed|not-installed|orphan>,
+--format <table|json>, --kanon-file, --lock-file. Every failure path yields a
+clean single-prefixed ERROR (no traceback). The command emits usage telemetry
+like every other command (command=list, --tree flag, --format/--status values
+via the flag-value allowlist).
+
+The declared-vs-installed partition reuses a new non-raising
+reconcile_declared_installed() extracted from check_lockfile_consistency (one
+source of truth). Covered by unit/functional/integration/scenario tests plus a
+real-git add->install->edit->list journey; list.py at 100% coverage. Help and
+shell-completion snapshots and docs updated.
+
+The 3.0.0 list->search rename left guards asserting `list` is an unknown
+command; those are updated to reflect `list` now being a distinct command.
+
+* test: isolate test subprocesses from coverage subprocess measurement
+
+Under `pytest --cov` (make test) pytest-cov and coverage export COV_CORE_* /
+COVERAGE_PROCESS_* so spawned subprocesses auto-start coverage. A measured
+`kanon` subprocess then writes a .coverage-data directory into its working
+directory -- resolved relative to the child CWD on some filesystems -- which
+behavioural subprocess tests that inspect the child filesystem
+(`kanon repo status --orphans`) or parse its stderr (`--telemetry-debug` JSON)
+then trip over, non-deterministically across OS / filesystem.
+
+Strip the coverage subprocess-trigger variables from the child environment in
+the functional and scenario subprocess runners and the telemetry-journey env
+builder via a shared strip_subprocess_coverage_env helper. Behavioural CLI
+subprocess tests do not need coverage of the child; the 90% coverage gate is
+measured in-process on the unit tier, which uses its own runner and is
+unaffected. ([`57246f8`](https://github.com/caylent-solutions/kanon/commit/57246f8a8a46b99ad2b35a954289d7a9e7d1966c))
+
+### Unknown
+
+* Merge pull request #92 from caylent-solutions/release-3.3.0
+
+Release 3.3.0 ([`56f49b9`](https://github.com/caylent-solutions/kanon/commit/56f49b9c98b2dfd9b5fac5d847fcb6350a6fafe4))
+
+
 ## v3.2.0 (2026-07-13)
 
+### Chore
+
+* chore(release): 3.2.0 ([`b503e3c`](https://github.com/caylent-solutions/kanon/commit/b503e3cf92479b6192b186ad6b2481563c916074))
+
 ### Feature
 
 * feat(clean): ~/.kanon-home store rename, .kanon-dir guard, --purge/--purge-all (store-only teardown with no .kanon), no unconditional .gitignore (#89)
@@ -85,6 +406,12 @@ lifecycle also documents clean --purge-all running without a .kanon.
 
 Co-authored-by: t <t@e.x> ([`d9b0ad1`](https://github.com/caylent-solutions/kanon/commit/d9b0ad1856ab58487b7ed3efdc3ff9d87b60b193))
 
+### Unknown
+
+* Merge pull request #90 from caylent-solutions/release-3.2.0
+
+Release 3.2.0 ([`fb944e2`](https://github.com/caylent-solutions/kanon/commit/fb944e251cf650020070e29cb28a26cbffc886da))
+
 
 ## v3.1.1 (2026-06-27)
 

{kanon_cli-3.2.0 → kanon_cli-3.3.2}/CONTRIBUTING.md

@@ -15,6 +15,12 @@ Thank you for your interest in contributing to the Kanon CLI! This document prov
    make install-dev
    ```
 
+   This runs `uv sync --locked --all-groups`, so the toolchain comes from
+   `uv.lock` and matches CI exactly. [uv](https://docs.astral.sh/uv/) is a
+   prerequisite. Every `make` target invokes its tools through `uv run`; running
+   `ruff`, `pytest`, or `bandit` directly picks up whatever is on your `PATH`
+   instead of the locked version, which is how CI and local results drift apart.
+
 3. Set up git hooks to ensure code quality:
    ```bash
    make install-hooks