kanon-cli 3.3.0__tar.gz → 3.3.3__tar.gz

{kanon_cli-3.3.0 → kanon_cli-3.3.3}/.github/actions/setup-kanon/action.yml

@@ -3,11 +3,17 @@ description: |
   Composite action shared by every job in pr-validation.yml and
   main-validation.yml. Handles checkout, optional simulate-merge,
   Python install, asdf bootstrap (plus plugin install per
-  .tool-versions), pip dependency cache, dev dependency install via
-  `make install-dev`, and uv install. Each parallel CI job calls this
-  action once before invoking its own singular Make target / pytest
-  invocation, so the per-job step list stays minimal and the setup
-  drift between jobs is impossible.
+  .tool-versions), uv install with an uv.lock-keyed cache, and the
+  dependency install itself (`uv sync --locked --all-groups`). Each
+  parallel CI job calls this action once before invoking its own
+  singular Make target, so the per-job step list stays minimal and
+  setup drift between jobs is impossible.
+
+  Every job resolves dependencies from uv.lock and nowhere else. Jobs
+  must invoke Make targets rather than calling pytest/ruff/bandit
+  directly, because those targets run tools through `uv run`; a bare
+  invocation picks up whatever is on PATH and reintroduces the drift
+  this action exists to prevent.
 
 inputs:
   base-ref:
@@ -108,15 +114,20 @@ runs:
         asdf install
         asdf reshim
 
-    - name: Cache Python dependencies
-      uses: actions/cache@v5
+    - name: Install uv
+      # uv must be installed BEFORE the dependency step, because that step is
+      # now `uv sync`. It is also required at test time:
+      # `tests/unit/repo/test_wheel_contents.py`,
+      # `tests/integration/test_wheel_e2e.py`, and
+      # `tests/integration/test_ci_validation.py` shell out to `uv build` to
+      # produce the wheel under test.
+      # `enable-cache` replaces the previous actions/cache pip step; keying on
+      # uv.lock means the cache is invalidated by exactly the file that decides
+      # which versions get installed.
+      uses: astral-sh/setup-uv@v6
       with:
-        path: |
-          ~/.cache/pip
-          ~/.local/lib/python*/site-packages
-        key: ${{ runner.os }}-pip-${{ hashFiles('requirements-dev.txt', 'pyproject.toml') }}
-        restore-keys: |
-          ${{ runner.os }}-pip-
+        enable-cache: true
+        cache-dependency-glob: uv.lock
 
     - name: Install zsh (for shell-completion integration tests)
       if: runner.os == 'Linux'
@@ -140,22 +151,15 @@ runs:
       shell: bash
       run: |
         set -euo pipefail
-        pip install --upgrade pip
-        # `make install-dev` is `pip install -r requirements-dev.txt`. GNU make
-        # is not guaranteed on the windows-latest runner image, so the Windows
-        # leg invokes pip directly (same dependency set, no make dependency)
-        # while Linux keeps the make target for parity with local dev.
-        if [ "$RUNNER_OS" = "Linux" ]; then
-          make install-dev
-        else
-          pip install -r requirements-dev.txt
-        fi
-
-    - name: Install uv
-      # `tests/unit/repo/test_wheel_contents.py`,
-      # `tests/integration/test_wheel_e2e.py`, and
-      # `tests/integration/test_ci_validation.py` shell out to
-      # `uv build` to produce the wheel under test; uv must be on
-      # PATH for any job that runs those suites (including the
-      # full-suite regression job that runs every test together).
-      uses: astral-sh/setup-uv@v6
+        # Single dependency-resolution path for every job. Previously this was
+        # `pip install -r requirements-dev.txt`, which resolved from PyPI at run
+        # time and ignored uv.lock, while `make test` / `make test-scenarios`
+        # ran under `uv run` and honoured it. The two disagreed -- the pip leg
+        # installed pytest 8.3 and an unbounded shtab, so a shtab release broke
+        # the completion golden fixtures in the pip-based jobs only.
+        #
+        # `--locked` fails the job if uv.lock is stale rather than silently
+        # re-resolving, so a dependency change cannot reach CI unlocked.
+        # `uv sync` needs no GNU make, so the Windows leg no longer needs a
+        # separate branch.
+        uv sync --locked --all-groups

{kanon_cli-3.3.0 → kanon_cli-3.3.3}/.github/workflows/main-validation.yml

@@ -103,17 +103,14 @@ jobs:
         with:
           fetch-depth: 0
       - uses: ./.github/actions/setup-kanon
-      - name: Run unit tests with 90% coverage gate
+      - name: Run unit tests with coverage gate
         shell: bash
-        run: |
-          python -m pytest -n auto --dist loadscope -m "unit" --cov=kanon_cli --cov-report=term-missing
-          coverage json
-          coverage_percent=$(python -c "import json; f=open('coverage.json'); print(json.load(f)['totals']['percent_covered'])")
-          echo "Coverage: $coverage_percent%"
-          if (( $(echo "$coverage_percent < 90" | bc -l) )); then
-            echo "Error: Code coverage is below 90% threshold ($coverage_percent%)"
-            exit 1
-          fi
+        # Delegates to the Make target so the threshold lives in one place
+        # (Makefile: COVERAGE_MIN) instead of being duplicated across both
+        # workflow files, and so the run resolves from uv.lock like every other
+        # job. pytest-cov's own --cov-fail-under replaces the hand-rolled
+        # coverage-json + bc comparison.
+        run: make test-unit-cov
 
   integration-tests-linux:
     name: Integration tests (Linux)
@@ -127,7 +124,7 @@ jobs:
       - uses: ./.github/actions/setup-kanon
       - name: Run integration tests
         shell: bash
-        run: python -m pytest -n auto --dist loadscope -m "integration"
+        run: make test-integration
 
   functional-tests-linux:
     name: Functional tests (Linux)
@@ -141,7 +138,7 @@ jobs:
       - uses: ./.github/actions/setup-kanon
       - name: Run functional tests
         shell: bash
-        run: SMOKE_TEST_TIMEOUT=300 python -m pytest -n auto --dist loadscope -m "functional"
+        run: make test-functional
 
   scenario-tests-linux:
     name: Scenario tests (Linux, docs/integration-testing.md)
@@ -276,22 +273,19 @@ jobs:
           asdf install
           asdf reshim
 
-      - name: Cache Python dependencies for release
-        uses: actions/cache@v5
+      - name: Install uv
+        # Same single resolution path as .github/actions/setup-kanon: deps come
+        # from uv.lock via `make install-dev` (`uv sync --locked`). Replaces the
+        # previous pip cache, which keyed on a requirements-dev.txt that no
+        # longer exists.
+        uses: astral-sh/setup-uv@v6
         with:
-          path: |
-            ~/.cache/pip
-            ~/.local/lib/python*/site-packages
-          key: ${{ runner.os }}-pip-release-${{ hashFiles('requirements-dev.txt', 'pyproject.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-release-
-            ${{ runner.os }}-pip-
+          enable-cache: true
+          cache-dependency-glob: uv.lock
 
       - name: Install dependencies
         shell: bash
-        run: |
-          pip install --upgrade pip
-          make install-dev
+        run: make install-dev
 
       - name: Compute next version
         id: semantic-release
@@ -299,7 +293,7 @@ jobs:
           GH_TOKEN: ${{ steps.generate_token.outputs.token }}
         shell: bash
         run: |
-          NEW_VERSION=$(python -m semantic_release version --print | sed 's/^v//')
+          NEW_VERSION=$(uv run python -m semantic_release version --print | sed 's/^v//')
           echo "New version: $NEW_VERSION"
           if [[ -z "$NEW_VERSION" ]]; then
             echo "No new version detected, using current version"
@@ -313,7 +307,7 @@ jobs:
           GH_TOKEN: ${{ steps.generate_token.outputs.token }}
         shell: bash
         run: |
-          python -m semantic_release version --no-push --no-vcs-release --no-commit
+          uv run python -m semantic_release version --no-push --no-vcs-release --no-commit
 
           NEW_VERSION=$(grep '^version = ' pyproject.toml | sed 's/.*version = "\([^"]*\)".*/\1/')
           echo "Updated version: $NEW_VERSION"
@@ -321,6 +315,13 @@ jobs:
           sed -i "s/__version__ = \"[^\"]*\"/__version__ = \"$NEW_VERSION\"/" src/kanon_cli/__init__.py
           echo "Updated __init__.py to version: $NEW_VERSION"
 
+          # uv.lock records the project's own version, so a bump leaves it stale.
+          # Every job installs with `uv sync --locked`, which refuses a stale lock,
+          # so the refresh has to land in the same commit as the version bump --
+          # otherwise the tag build fails in "Build and publish to PyPI".
+          uv lock
+          echo "Refreshed uv.lock to version: $NEW_VERSION"
+
           sed -i 's/[[:space:]]*$//' CHANGELOG.md pyproject.toml src/kanon_cli/__init__.py
 
           rm -rf dist/ build/ src/kanon_cli.egg-info/
@@ -346,7 +347,7 @@ jobs:
           echo "Git status before staging:"
           git status --porcelain
 
-          git add CHANGELOG.md pyproject.toml src/kanon_cli/__init__.py
+          git add CHANGELOG.md pyproject.toml src/kanon_cli/__init__.py uv.lock
 
           echo "Git status after staging:"
           STAGED=$(git status --porcelain)

{kanon_cli-3.3.0 → kanon_cli-3.3.3}/.github/workflows/pr-validation.yml

@@ -130,17 +130,14 @@ jobs:
         with:
           base-ref: ${{ github.base_ref }}
           head-sha: ${{ github.event.pull_request.head.sha }}
-      - name: Run unit tests with 90% coverage gate
+      - name: Run unit tests with coverage gate
         shell: bash
-        run: |
-          python -m pytest -n auto --dist loadscope -m "unit" --cov=kanon_cli --cov-report=term-missing
-          coverage json
-          coverage_percent=$(python -c "import json; f=open('coverage.json'); print(json.load(f)['totals']['percent_covered'])")
-          echo "Coverage: $coverage_percent%"
-          if (( $(echo "$coverage_percent < 90" | bc -l) )); then
-            echo "Error: Code coverage is below 90% threshold ($coverage_percent%)"
-            exit 1
-          fi
+        # Delegates to the Make target so the threshold lives in one place
+        # (Makefile: COVERAGE_MIN) instead of being duplicated across both
+        # workflow files, and so the run resolves from uv.lock like every other
+        # job. pytest-cov's own --cov-fail-under replaces the hand-rolled
+        # coverage-json + bc comparison.
+        run: make test-unit-cov
 
   integration-tests-linux:
     name: Integration tests (Linux)
@@ -157,7 +154,7 @@ jobs:
           head-sha: ${{ github.event.pull_request.head.sha }}
       - name: Run integration tests
         shell: bash
-        run: python -m pytest -n auto --dist loadscope -m "integration"
+        run: make test-integration
 
   functional-tests-linux:
     name: Functional tests (Linux)
@@ -174,7 +171,7 @@ jobs:
           head-sha: ${{ github.event.pull_request.head.sha }}
       - name: Run functional tests
         shell: bash
-        run: SMOKE_TEST_TIMEOUT=300 python -m pytest -n auto --dist loadscope -m "functional"
+        run: make test-functional
 
   scenario-tests-linux:
     name: Scenario tests (Linux, docs/integration-testing.md)

{kanon_cli-3.3.0 → kanon_cli-3.3.3}/.github/workflows/publish.yml

@@ -84,19 +84,18 @@ jobs:
         with:
           python-version: '3.14'
 
-      - name: Cache Python dependencies
-        uses: actions/cache@v5
+      - name: Install uv
+        # Same single resolution path as .github/actions/setup-kanon: deps come
+        # from uv.lock via `make install-dev` (`uv sync --locked`). Replaces the
+        # previous pip cache, which keyed on a requirements-dev.txt that no
+        # longer exists.
+        uses: astral-sh/setup-uv@v6
         with:
-          path: |
-            ~/.cache/pip
-            ~/.local/lib/python*/site-packages
-          key: ${{ runner.os }}-pip-${{ hashFiles('requirements-dev.txt', 'pyproject.toml') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-
+          enable-cache: true
+          cache-dependency-glob: uv.lock
 
       - name: Install build dependencies
         run: |
-          pip install --upgrade pip
           make install-dev
           asdf reshim
         shell: bash

{kanon_cli-3.3.0 → kanon_cli-3.3.3}/.gitignore

@@ -31,3 +31,6 @@ tmp/
 
 # Deleted bundled catalog -- guard against accidental re-addition (E6-F2-S1-T1)
 src/kanon_cli/catalog/
+
+# Local settings files
+*.local.json

{kanon_cli-3.3.0 → kanon_cli-3.3.3}/.tool-versions

@@ -1,2 +1,3 @@
 jq 1.8.1
 pre-commit 4.3.0
+uv 0.12.1

{kanon_cli-3.3.0 → kanon_cli-3.3.3}/CHANGELOG.md

@@ -2,8 +2,355 @@
 
 
 
+## v3.3.3 (2026-08-06)
+
+### Fix
+
+* fix: scope linkfile dest rule by entry type, exempt direct-checkout marketplaces (#109)
+
+* fix: scope marketplace linkfile dest rule to claude-marketplace entries
+
+validate_linkfile_dest required every <linkfile dest> in every catalog
+entry to start with ${CLAUDE_MARKETPLACES_DIR}/, ignoring the declared
+<catalog-metadata><type>. Non-marketplace entries that install correctly
+could not pass validation.
+
+Closes #94
+
+* fix: exempt direct-checkout entries, de-duplicate errors, align tests
+
+Builds on ryano144's 0e75e27 (#99), which correctly identified issue #94:
+validate_linkfile_dest required every <linkfile dest> to start with
+${CLAUDE_MARKETPLACES_DIR}/ regardless of <catalog-metadata><type>, so a
+non-marketplace entry that `kanon install` places correctly could not pass
+validation. Scoping that rule by entry type is right and is kept as is.
+
+Three problems remained.
+
+1. The new "a claude-marketplace entry must land a dest under
+   ${CLAUDE_MARKETPLACES_DIR}/" rule rejected an entry that declares no
+   <linkfile> at all. That is the direct-checkout shape:
+   register_direct_checkout_marketplaces registers a project whose checkout
+   carries .claude-plugin/marketplace.json and which has no <linkfile>
+   children, covered end to end by test_marketplace_direct_checkout.py. The
+   old validator accepted it, so the rule as written was a regression, and it
+   reproduced the very validator/install contradiction #94 reports, aimed at a
+   different entry shape. The rule now applies only when the entry declares at
+   least one <linkfile>; an entry declaring none is exempt. The useful half is
+   unchanged: an entry whose links all land elsewhere is still caught, and the
+   diagnostic now names the direct-checkout way out.
+
+2. Linkfile checks follow each entry's <include> chain, so a defect in a
+   manifest shared by several entries was reported once per consumer. Three
+   entries including one broken packages.xml produced three identical errors
+   and a count of three for a single defect. Errors are de-duplicated within a
+   call (a manifest reachable by two include paths) and across the run.
+   Identical message text means the same file, project and reason, so
+   collapsing exact duplicates cannot hide a second real defect.
+
+3. tests/functional/test_validate_marketplace.py still asserted the old
+   contract and was not touched by #99, so three parametrized cases failed:
+   relative/path, CLAUDE_MARKETPLACES_DIR/missing-dollar-brace and
+   ${OTHER_VAR}/proj are contained dests on an entry with no <type> and are
+   now legal. Rather than delete the coverage, the class is split: the three
+   contained dests assert exit 0, and a new negative case asserts exit 1 for
+   the three shapes that escape the workspace (absolute, '..', empty).
+
+Adds docs/integration-testing.md Category 11b (ET-01..ET-07) with runnable
+manual reproductions, and tests/scenarios/test_et.py automating them through
+the real `kanon validate marketplace` subprocess: the full 3x4 entry-type by
+linkfile-shape matrix, containment across all three entry types, a linkfile
+inside an <include>, a marketplace dest supplied by an include, single
+reporting of a shared-include defect, and the mixed plugin-plus-standards
+package from #94 with its negative counterpart.
+
+Every documented scenario was also executed by hand against the built CLI and
+matched its stated pass criteria.
+
+Closes #94
+
+* test: guard the single dependency-resolution path
+
+Adds automated coverage for four invariants that were only ever verified by
+hand while diagnosing the shtab CI drift and the 3.3.1 publish failure. Each
+corresponds to a defect this repository actually hit, and none had a test.
+
+1. A tool invoked through `uv run` is declared in [dependency-groups].
+   `make security-scan` was `uv run bandit` while bandit was declared nowhere,
+   so uv fell through to PATH and silently ran a system-wide bandit -- an
+   undeclared dependency deciding a security gate. `uv run` does not fail on an
+   undeclared executable, so nothing surfaced it.
+
+2. No Make recipe invokes a tool directly. A bare `ruff check .` or
+   `pytest -m unit` resolves from PATH rather than uv.lock, which is precisely
+   the two-path split that let shtab 1.9.0 break the tiered CI jobs while the
+   uv-based jobs stayed green. Only the scenario target was previously guarded.
+
+3. A dependency whose generated output is byte-compared against a committed
+   fixture carries an upper bound. `shtab>=1.7.0` allowed 1.9.0 to change its
+   completion output and break CI with no change to this repository.
+
+4. The release job re-locks and stages uv.lock. semantic-release bumps
+   pyproject.toml and __init__.py but knows nothing about uv.lock, so without
+   the explicit refresh every release leaves the lock a version behind and
+   `uv sync --locked` fails on the tag -- how 3.3.1 failed to publish. Its
+   symptom is already guarded by test_uv_lock_records_the_declared_project_version;
+   this guards the mechanism that prevents it.
+
+Each was verified RED by reverting the invariant it protects: removing bandit
+from the dev group, rewriting `uv run ruff` as `ruff`, restoring `shtab>=1.7.0`,
+dropping `uv lock` from the release job, and dropping uv.lock from its `git add`.
+All five produce a message naming the file and the remedy.
+
+* fix(test): replace the uv-run regex with linear tokenization
+
+CodeQL flagged py/redos (high) on the pattern added in the previous commit:
+
+    \buv\s+run\s+(?:--[\w-]+(?:[= ]\S+)?\s+)*([A-Za-z][\w.-]*)
+
+The repeated group holds an optional sub-match, so input with many repetitions
+of ' --- ---' backtracks exponentially. Skipping uv's own flags is awkward to
+express as a pattern and easy to get wrong in exactly this way.
+
+Walking tokens does the same job in linear time and reads more plainly: find
+`uv run`, skip following tokens that begin with '-', take the next one. A flag
+with a detached value would misreport that value as the tool; no target uses
+that form, and the assertion names the offending line, so it would be obvious
+rather than silent. Documented on the helper.
+
+Not suppressed: CLAUDE.md forbids annotating away a security finding, and the
+finding was correct. Both guards were re-verified RED afterwards, and the
+tokenizer returns in single-digit milliseconds on 40k adversarial tokens.
+
+---------
+
+Co-authored-by: Ryan Gross <ryan.gross@caylent.com> ([`ccfdfec`](https://github.com/caylent-solutions/kanon/commit/ccfdfecdbd7b3e366e1ca9c0579bd84aa70e66ae))
+
+
+## v3.3.2 (2026-08-05)
+
+### Chore
+
+* chore(release): 3.3.2 ([`6f5ffe7`](https://github.com/caylent-solutions/kanon/commit/6f5ffe7c01553820a2e091cdc996151b5100c6cb))
+
+### Fix
+
+* fix(ci): refresh uv.lock during the release version bump (#107)
+
+`Build and publish to PyPI` failed on the 3.3.1 tag:
+
+    uv sync --locked --all-groups
+    error: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided.
+
+uv.lock records the project's own version alongside its dependencies.
+semantic-release bumps `pyproject.toml` and `src/kanon_cli/__init__.py`
+via version_toml / version_variable, but knows nothing about uv.lock, and
+the release job staged only those two files plus CHANGELOG.md. Every
+release therefore left uv.lock one version behind: after 3.3.1,
+pyproject.toml said 3.3.1 and uv.lock still said 3.3.0.
+
+The drift is not new -- before #97, uv.lock said 2.1.0 against a
+pyproject at 3.3.0, six releases of silent skew. What is new is that
+`make install-dev` is now `uv sync --locked`, which refuses a stale lock
+instead of quietly re-resolving, so a latent inconsistency became a hard
+failure at tag-build time.
+
+The release job now runs `uv lock` immediately after the version bump and
+stages uv.lock with the other version files, so the release commit is
+self-consistent and the tag it points at can be installed. Verified that
+`uv lock` against the current tree changes exactly one line
+(kanon-cli 3.3.0 -> 3.3.1) with no dependency churn, so this does not turn
+a release into an unrelated dependency update.
+
+uv.lock is also corrected here so main is self-consistent again.
+
+Adds `test_uv_lock_records_the_declared_project_version`, which compares
+the kanon-cli entry in uv.lock against `[project] version`. Verified RED
+against the stale lock, failing with the same mismatch the publish job
+hit. It has to be run without `uv run` to fail, which is the reason this
+class of drift stays invisible in local development: `uv run` implicitly
+re-locks before executing, so a developer never sees the inconsistency
+that a `--locked` install in CI rejects.
+
+Note the existing 3.3.1 tag still points at a commit carrying the stale
+lock, so republishing that exact tag will keep failing until the tag is
+moved or a further release is cut. ([`00714e6`](https://github.com/caylent-solutions/kanon/commit/00714e648a42bea706945e7a38a66fa6dca8df28))
+
+### Unknown
+
+* Merge pull request #108 from caylent-solutions/release-3.3.2
+
+Release 3.3.2 ([`fc48540`](https://github.com/caylent-solutions/kanon/commit/fc48540a5fc082e64c81ef9809f68d583a3a16e8))
+
+
+## v3.3.1 (2026-08-04)
+
+### Chore
+
+* chore(release): 3.3.1 ([`71621d5`](https://github.com/caylent-solutions/kanon/commit/71621d50a72c412cae40b1886f6c73adc08e9fc0))
+
+* chore(git): ignore local settings files ([`61ceade`](https://github.com/caylent-solutions/kanon/commit/61ceade79f79a73b11316866572a71b3abce3052))
+
+* chore: add uv to toolchain via asdf
+
+Pin uv 0.12.1 in .tool-versions alongside the project's existing
+asdf-managed tools, and refresh uv.lock's kanon-cli editable entry
+to match the current pyproject.toml version. ([`300b979`](https://github.com/caylent-solutions/kanon/commit/300b979ae0dae98f200efd21be99fad0b5106658))
+
+### Fix
+
+* fix: let repo sync own <linkfile>, removing the duplicate copy pass (#105)
+
+* fix: skip linkfile copy when dest already resolves to src
+
+repo sync materializes every <linkfile> as a symlink before
+_process_manifest_linkfiles runs. For a file-level src the helper then
+called shutil.copy2 on the same inode pair, raising SameFileError and
+aborting the install with exit 1.
+
+Closes #93
+
+* fix: let repo sync own <linkfile>, removing the duplicate copy pass
+
+`_process_manifest_linkfiles` re-processed the same `<linkfile>` elements
+`repo sync` had just materialized. It read only the root manifest's direct
+`<project>` children (no `<include>` traversal) and skipped any non-file
+`src`, so in a real install it covered a strict subset of what sync had
+already done. Its three possible outcomes were: crash on the same inode
+(issue 93), write through a foreign symlink and clobber that link's target,
+or nothing. It had no branch that produced a correct result sync had not
+already produced.
+
+It existed to compensate for tests that replace `repo_sync` with a no-op,
+which its own docstring stated. The compensation belongs in the double, not
+in production, so it moves to `tests.conftest.materialize_linkfiles_for_sync`
+-- delegating to the production `_LinkFile` so the double cannot drift from
+what `repo` does. Mocked-sync tests now leave a symlink where a real sync
+leaves one, instead of a copy.
+
+Runtime behaviour is unchanged for every input except the crash: with
+`repo sync` succeeding, the deleted pass was already a no-op. No exported
+symbol is removed; `__all__` is byte-identical.
+
+Replaces the unit-level regression test, which imported the deleted
+function, with one that drives a real `repo init` + `repo sync` against
+local file:// fixtures. Verified RED against the pre-fix code: it reproduces
+`shutil.SameFileError` on the flagged/file-src case only, matching the scope
+table in issue 93.
+
+`test_only_flagged_source_registers_marketplace` asserted that an unflagged
+source cannot register a marketplace. Under a sync that behaves like the real
+one it registers anyway: `run_repo_sync` is unconditional, `_LinkFile._Link`
+knows nothing about kanon flags, `CLAUDE_MARKETPLACES_DIR` is exported to
+every source, and `install_marketplace_plugins` scans the directory once with
+no per-source attribution. The flag genuinely gates only
+`register_direct_checkout_marketplaces`, so the fixture now uses
+direct-checkout entries and the docstring records what the flag does not gate.
+
+Closes #93
+
+* ci: resolve every job from uv.lock, deleting the pip dependency path
+
+CI resolved dependencies two ways. The tiered test jobs ran bare
+`python -m pytest` against a `pip install -r requirements-dev.txt`
+environment, which resolves from PyPI at run time; `make test` and
+`make test-scenarios` ran under `uv run`, which honours uv.lock. The two
+manifests disagreed -- requirements-dev.txt pinned pytest ~=8.3.0 while
+[dependency-groups] dev asked for >=9.0.3, so the same suite ran on two
+different runners depending on the job.
+
+That split is what let a shtab release break CI. `shtab>=1.7.0` had no
+upper bound, shtab 1.9.0 (2026-07-31) changed its generated output, and
+the pip-based jobs installed 1.9.3 against completion golden fixtures
+generated with 1.8.0. The uv-based jobs stayed on uv.lock's 1.8.0 and
+passed. main has not run CI since 2026-07-17, before that release, so it
+is green in history and broken in fact; every PR branched from it fails
+the same two tests.
+
+Reproduced directly: a venv built from requirements-dev.txt resolves
+shtab 1.9.3 and pytest 8.3.5, and fails
+test_completion_stdout_matches_committed_golden[bash,zsh] with the same
+16098-vs-15657 byte mismatch CI reports. Installing shtab==1.8.0 into
+that same venv turns it green.
+
+9869ee7 pins shtab, which fixes the instance. This removes the cause:
+
+- [dependency-groups] dev absorbs ruff, bandit, twine, pre-commit and
+  python-semantic-release, the tools only requirements-dev.txt declared.
+  Existing pins carry over unchanged. ruff stays ~=0.11.0 for the same
+  reason shtab is pinned: `ruff format --check` is a byte-level gate.
+- requirements-dev.txt is deleted rather than kept in sync.
+- requirements.txt is deleted too. It declared packaging and nothing
+  else, one of three runtime dependencies, and `make install` was
+  referenced nowhere; pyproject's [project] dependencies supersedes it.
+- Every Makefile target invokes its tools through `uv run`. Previously
+  `make security-scan` was `uv run bandit` with bandit in no dependency
+  group, so uv fell through to PATH and silently ran a system-wide
+  bandit -- verified resolving to /usr/local/py-utils/bin/bandit.
+- The unit coverage gate moves into `make test-unit-cov` behind a
+  COVERAGE_MIN variable, replacing the coverage-json + bc comparison
+  duplicated across both workflow files with pytest-cov's own
+  --cov-fail-under.
+- setup-kanon installs uv before dependencies and runs
+  `uv sync --locked --all-groups`; --locked fails the job on a stale
+  lock instead of silently re-resolving. setup-uv's cache, keyed on
+  uv.lock, replaces the pip cache. The Windows leg no longer needs its
+  own branch because uv sync does not require GNU make.
+- The release and publish jobs move to the same path, and
+  `python -m semantic_release` becomes `uv run python -m semantic_release`.
+
+The CI-shape tests are updated rather than loosened. The tier assertions
+followed the existing `make test-scenarios` precedent and now check both
+halves of the contract: the workflow invokes the tier's Make target
+exactly once with no per-OS override, and that target selects the bare
+marker. Previously the marker was asserted but the delegation was not;
+now both are. test_ci_includes_repo_tests searches the Makefile as well,
+since --cov=kanon_cli moved there.
+
+Verified from a clean `uv sync --locked --all-groups`: ruff, bandit,
+twine, pre-commit and pytest all resolve inside .venv with no PATH
+fallthrough. All ten CI jobs pass locally with counts identical to the
+pre-change baseline -- full suite 17168 passed / 0 failed / 95%, unit
+11712 passed / 93.22%, integration 1947, functional 3089, scenario 413.
+
+---------
+
+Co-authored-by: Ryan Gross <ryan.gross@caylent.com> ([`23b320e`](https://github.com/caylent-solutions/kanon/commit/23b320e7818bf564cbc3b9dcb65acc3e7f4626ef))
+
+* fix: pin shtab to exact version to stop completion-fixture CI drift
+
+pyproject.toml declared shtab>=1.7.0 with no upper bound. CI installs
+dependencies via `pip install -r requirements-dev.txt` (-e .), resolving
+shtab independently of uv.lock's exact pin; PyPI's latest shtab (1.9.2)
+changed its generated output, breaking the byte-for-byte comparison
+against the committed completion golden fixtures in both the
+integration and functional test suites. Exact-pinning to 1.8.0 (already
+locked in uv.lock) makes both install paths deterministic. ([`9869ee7`](https://github.com/caylent-solutions/kanon/commit/9869ee7b720829c329ad3c1afdcf2057a14427aa))
+
+* fix(test): put safeguards in place for pre-commit failures in devcontainer environment on macos ([`1f38b25`](https://github.com/caylent-solutions/kanon/commit/1f38b25ea3205cac983c0952baed76c4a976b3ee))
+
+* fix(tests): patch to avoid ioctl environment issues when running tests in devcontainer under uv ([`4931c10`](https://github.com/caylent-solutions/kanon/commit/4931c101c4cec06e778958e62b1af68ee9ada022))
+
+### Unknown
+
+* Merge pull request #106 from caylent-solutions/release-3.3.1
+
+Release 3.3.1 ([`35f709f`](https://github.com/caylent-solutions/kanon/commit/35f709f1f5e0c26a2bcf6317e573ca56303e49bd))
+
+* Merge pull request #97 from caylent-solutions/chore/add-uv-tool-version
+
+chore: add uv toolchain support and fix progress-bar ioctl crash
+
+Includes the issue-93 linkfile fix and the CI dependency-resolution
+consolidation merged into this branch via #105. ([`bfab7a3`](https://github.com/caylent-solutions/kanon/commit/bfab7a319ade76111057696ee049b6d6ab5c41ab))
+
+
 ## v3.3.0 (2026-07-17)
 
+### Chore
+
+* chore(release): 3.3.0 ([`5100db5`](https://github.com/caylent-solutions/kanon/commit/5100db56a01818a5914474d7ddb95c96b7ab6de9))
+
 ### Feature
 
 * feat: kanon list command + usage telemetry, full install-graph capture, and update-warning enhancement (#91)
@@ -100,6 +447,12 @@ subprocess tests do not need coverage of the child; the 90% coverage gate is
 measured in-process on the unit tier, which uses its own runner and is
 unaffected. ([`57246f8`](https://github.com/caylent-solutions/kanon/commit/57246f8a8a46b99ad2b35a954289d7a9e7d1966c))
 
+### Unknown
+
+* Merge pull request #92 from caylent-solutions/release-3.3.0
+
+Release 3.3.0 ([`56f49b9`](https://github.com/caylent-solutions/kanon/commit/56f49b9c98b2dfd9b5fac5d847fcb6350a6fafe4))
+
 
 ## v3.2.0 (2026-07-13)