muninn-cli 0.3.0__tar.gz → 0.3.1__tar.gz

{muninn_cli-0.3.0 → muninn_cli-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: muninn-cli
-Version: 0.3.0
+Version: 0.3.1
 Summary: Muninn - The Extensible Reciting CLI
 Project-URL: Repository, https://github.com/a1fredbao/muninn
 Project-URL: Issues, https://github.com/a1fredbao/muninn/issues

{muninn_cli-0.3.0 → muninn_cli-0.3.1}/docs/commands.md

@@ -24,6 +24,20 @@ The pack is copied to `~/.muninn/packs/<pack_id>/`.  Installing the same
 Muninn records the installation source in the pack's `manifest.json` so
 that `muninn upgrade` knows where to check for updates later.
 
+### Dependencies
+
+If a pack includes a `requirements.txt` at its root, Muninn creates an
+isolated virtual environment at `~/.muninn/venvs/<pack_id>/` and
+installs the declared packages there.  Each pack gets its own venv, so
+two packs can depend on different versions of the same library without
+conflict.  No manual `pip install` step is required — the next
+`muninn run` will find the installed packages automatically.
+
+This is designed for packs that need third-party libraries (e.g. `openai`
+for AI-powered answer checking, `requests` for fetching live data).  The
+per-pack venv keeps plugin dependencies isolated from your system Python
+and from each other.
+
 ## `muninn upgrade`
 
 Check for and install newer versions of installed packs.

{muninn_cli-0.3.0 → muninn_cli-0.3.1}/docs/pack-spec.md

@@ -7,8 +7,9 @@ a `plugin.py`.
 
 ``` bash
 my-pack/
-├── manifest.json      # Required: pack metadata
+├── manifest.json       # Required: pack metadata
 ├── plugin.py           # Required: plugin logic
+├── requirements.txt    # Optional: pip dependencies
 ├── data.csv            # Optional: static data
 └── data.json           # Optional: static data
 ```
@@ -65,3 +66,22 @@ When a pack is installed, Muninn records the installation source in
 Pack authors should [bump the `version` field](https://semver.org/)
 whenever they publish changes — that is the signal Muninn uses to
 determine whether an upgrade is available.
+
+## Dependencies
+
+If your plugin needs third-party Python packages, place a standard
+`requirements.txt` at the root of your pack:
+
+``` text
+openai>=1.0.0
+httpx>=0.27.0
+```
+
+Muninn creates an isolated virtual environment at
+`~/.muninn/venvs/<pack_id>/` for each pack and installs the declared
+packages there automatically during `muninn install` and
+`muninn upgrade`.  No action is needed from the user.
+
+If dependency installation fails (e.g. a typo in the package name, a
+network error), Muninn does **not** replace the pack.  The existing
+version stays in place and an error message is printed.

{muninn_cli-0.3.0 → muninn_cli-0.3.1}/docs/plugin-dev.md

@@ -23,10 +23,11 @@ full control.
 
 ``` bash
 my-pack/
-├── manifest.json   # Package metadata
-├── plugin.py        # Core logic
-├── data.csv         # Static data (optional — whatever your plugin needs)
-└── data.json        # Alternative data format
+├── manifest.json       # Package metadata
+├── plugin.py           # Core logic
+├── requirements.txt    # Optional: pip dependencies
+├── data.csv            # Static data (optional — whatever your plugin needs)
+└── data.json           # Alternative data format
 ```
 
 ## manifest.json

{muninn_cli-0.3.0 → muninn_cli-0.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "muninn-cli"
-version = "0.3.0"
+version = "0.3.1"
 description = "Muninn - The Extensible Reciting CLI"
 readme = "README.md"
 requires-python = ">=3.12"

{muninn_cli-0.3.0 → muninn_cli-0.3.1}/src/cli/manager.py

@@ -3,7 +3,9 @@ import json
 import os
 import re
 import shutil
+import subprocess
 import sys
+import sysconfig
 import tempfile
 import urllib.request
 import zipfile
@@ -13,6 +15,9 @@ from ..core.base_plugin import BaseRecitePlugin
 # Timeout for remote pack downloads (in seconds)
 DOWNLOAD_TIMEOUT = 30
 
+# Timeout for subprocess operations (venv creation, pip install) in seconds
+SUBPROCESS_TIMEOUT = 300
+
 
 class PackageManager:
     def __init__(self):
@@ -23,6 +28,36 @@ class PackageManager:
     # Public API
     # ------------------------------------------------------------------
 
+    @staticmethod
+    def _validate_pack_id(pack_id: str) -> None:
+        """Validate that pack_id is safe to use in filesystem paths.
+
+        Raises ValueError if pack_id contains path traversal sequences
+        or other unsafe characters.
+        """
+        if not isinstance(pack_id, str):
+            raise TypeError(f"pack_id must be a string, got {type(pack_id).__name__}")
+
+        if not pack_id:
+            raise ValueError("pack_id cannot be empty")
+
+        # Check for path traversal attempts
+        if pack_id in (".", ".."):
+            raise ValueError(f"Invalid pack_id: '{pack_id}' is not allowed")
+
+        # Check for path separators
+        if os.sep in pack_id or "/" in pack_id or "\\" in pack_id:
+            raise ValueError(
+                f"Invalid pack_id: '{pack_id}' must not contain path separators"
+            )
+
+        # Enforce alphanumeric, dots, underscores, and hyphens only
+        if not re.match(r"^[A-Za-z0-9._-]+$", pack_id):
+            raise ValueError(
+                f"Invalid pack_id: '{pack_id}' must contain only alphanumeric characters, "
+                "dots, underscores, and hyphens"
+            )
+
     def install_pack(self, source: str) -> str:
         """Install a pack from a local directory, a zip file, or a GitHub URL.
 
@@ -53,10 +88,17 @@ class PackageManager:
 
     def uninstall_pack(self, pack_id: str):
         """Remove a pack from the local packs directory."""
+        self._validate_pack_id(pack_id)
         pack_dir = self._get_pack_dir(pack_id)
         if not os.path.exists(pack_dir):
             raise FileNotFoundError(f"Pack '{pack_id}' is not installed.")
         shutil.rmtree(pack_dir)
+
+        # Also remove the per-pack virtual environment if it exists
+        venv_dir = self._get_pack_venv_dir(pack_id)
+        if os.path.exists(venv_dir):
+            shutil.rmtree(venv_dir, ignore_errors=True)
+
         print(f"🗑️  Pack '{pack_id}' has been uninstalled.")
 
     def upgrade_pack(self, pack_id: str) -> bool:
@@ -64,6 +106,7 @@ class PackageManager:
 
         Returns ``True`` if an upgrade was performed, ``False`` otherwise.
         """
+        self._validate_pack_id(pack_id)
         manifest = self._read_installed_manifest(pack_id)
         if manifest is None:
             raise FileNotFoundError(f"Pack '{pack_id}' is not installed.")
@@ -120,6 +163,7 @@ class PackageManager:
 
     def load_plugin(self, pack_id: str) -> BaseRecitePlugin:
         """Dynamically load the plugin.py from the pack_id directory."""
+        self._validate_pack_id(pack_id)
         pack_dir = self._get_pack_dir(pack_id)
         if not os.path.exists(pack_dir):
             raise FileNotFoundError(f"Pack '{pack_id}' not found.")
@@ -128,6 +172,12 @@ class PackageManager:
         if not os.path.exists(plugin_path):
             raise FileNotFoundError(f"plugin.py not found in {pack_id}.")
 
+        orig_sys_path = sys.path.copy()
+        # Make packages from the pack's isolated virtual environment importable (e.g. openai, httpx)
+        venv_site = self._get_pack_site_packages(pack_id)
+        if os.path.isdir(venv_site):
+            sys.path.insert(0, venv_site)
+
         src_dir = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
         sys.path.insert(0, src_dir)
 
@@ -152,7 +202,7 @@ class PackageManager:
                 f"No valid BaseRecitePlugin subclass found in {plugin_path}"
             )
         finally:
-            sys.path.pop(0)
+            sys.path[:] = orig_sys_path
 
     def list_packs(self):
         packs = []
@@ -382,12 +432,24 @@ class Plugin(DataPlugin):
             shutil.rmtree(temp_dir, ignore_errors=True)
             raise ValueError("Invalid manifest: missing 'id'")
 
+        # Validate pack_id to prevent path traversal attacks
+        try:
+            self._validate_pack_id(pack_id)
+        except ValueError as e:
+            shutil.rmtree(temp_dir, ignore_errors=True)
+            raise ValueError(f"Invalid manifest: {e}") from e
+
         # Inject source tracking info before writing
         if source_info:
             manifest["source"] = source_info
             with open(manifest_path, "w", encoding="utf-8") as f:
                 json.dump(manifest, f, indent=4, ensure_ascii=False)
 
+        # Install dependencies *before* replacing the existing pack so
+        # that a failed pip install does not leave the pack in a broken
+        # state or destroy the previous version.
+        self._install_pack_dependencies(temp_dir, pack_id)
+
         target_dir = self._get_pack_dir(pack_id)
         if os.path.exists(target_dir):
             print(f"🔄 Updating existing pack: {pack_id}")
@@ -395,12 +457,101 @@ class Plugin(DataPlugin):
 
         # Ensure temp_dir parent is writable for shutil.move
         shutil.move(temp_dir, target_dir)
+
         return pack_id
 
+    # ------------------------------------------------------------------
+    # Internal: per-pack dependency management
+    # ------------------------------------------------------------------
+    # Each pack that declares a ``requirements.txt`` gets its own
+    # isolated venv under ``~/.muninn/venvs/<pack_id>/``.  This
+    # prevents version conflicts between packs.
+
+    def _get_pack_venv_dir(self, pack_id: str) -> str:
+        """Return the path to the isolated venv for *pack_id*."""
+        return os.path.join(os.path.expanduser("~/.muninn/venvs"), pack_id)
+
+    def _ensure_pack_venv(self, pack_id: str) -> str:
+        """Return the path to the Python interpreter inside *pack_id*'s
+        isolated venv, creating the venv if it doesn't already exist."""
+        venv_dir = self._get_pack_venv_dir(pack_id)
+        exe_name = os.path.basename(sys.executable)
+        python_exe = os.path.join(
+            venv_dir,
+            "Scripts" if os.name == "nt" else "bin",
+            exe_name,
+        )
+        if os.path.isfile(python_exe):
+            return python_exe
+
+        try:
+            subprocess.run(
+                [sys.executable, "-m", "venv", "--clear", venv_dir],
+                check=True,
+                capture_output=True,
+                text=True,
+                timeout=SUBPROCESS_TIMEOUT,
+            )
+        except subprocess.TimeoutExpired as exc:
+            raise RuntimeError(
+                f"Timed out creating dependency environment at '{venv_dir}' "
+                f"after {SUBPROCESS_TIMEOUT} seconds"
+            ) from exc
+        except subprocess.CalledProcessError as exc:
+            raise RuntimeError(
+                "Failed to create dependency environment at "
+                f"'{venv_dir}'.  Your Python installation may "
+                "not include 'venv' (try 'apt install python3-venv' "
+                f"on Debian/Ubuntu).  Original error: {exc.stderr.strip()}"
+            ) from exc
+        return python_exe
+
+    def _get_pack_site_packages(self, pack_id: str) -> str:
+        """Return the site-packages directory for *pack_id*'s venv."""
+        return sysconfig.get_path(
+            "purelib",
+            scheme="venv",
+            vars={"base": self._get_pack_venv_dir(pack_id)},
+        )
+
+    def _install_pack_dependencies(self, pack_dir: str, pack_id: str) -> None:
+        """If *pack_dir* contains a ``requirements.txt``, install its
+        contents into the pack's isolated venv."""
+        req_path = os.path.join(pack_dir, "requirements.txt")
+        if not os.path.isfile(req_path):
+            return
+
+        # Skip empty requirements files --- venv creation would be wasteful.
+        if os.path.getsize(req_path) == 0:
+            return
+
+        venv_python = self._ensure_pack_venv(pack_id)
+        pip = os.path.join(os.path.dirname(venv_python), "pip")
+
+        print(f"📦 Installing dependencies for '{pack_id}' ...")
+        try:
+            subprocess.run(
+                [pip, "install", "--quiet", "-r", req_path],
+                check=True,
+                capture_output=True,
+                text=True,
+                timeout=SUBPROCESS_TIMEOUT,
+            )
+        except subprocess.TimeoutExpired as exc:
+            raise RuntimeError(
+                f"Timed out installing dependencies for '{pack_id}' after {SUBPROCESS_TIMEOUT} seconds"
+            ) from exc
+        except subprocess.CalledProcessError as exc:
+            raise RuntimeError(
+                f"Failed to install dependencies for '{pack_id}': {exc.stderr.strip()}"
+            ) from exc
+
     # ------------------------------------------------------------------
     # Internal: upgrade helpers
     # ------------------------------------------------------------------
 
+    # ------------------------------------------------------------------
+
     def _read_installed_manifest(self, pack_id: str) -> dict | None:
         manifest_path = os.path.join(self._get_pack_dir(pack_id), "manifest.json")
         if not os.path.exists(manifest_path):

muninn_cli-0.3.1/tests/cli/test_dependencies.py

@@ -0,0 +1,270 @@
+"""Tests for per-pack venv dependency management."""
+
+import json
+import os
+import subprocess
+import sys
+
+import pytest
+
+from src.cli.manager import PackageManager
+
+# -----------------------------------------------------------------------
+# Helpers
+# -----------------------------------------------------------------------
+
+
+def _make_pack_with_deps(path, pack_id, version="1.0.0", requirements=None):
+    """Create a minimal pack with an optional requirements.txt."""
+    os.makedirs(path, exist_ok=True)
+    (path / "manifest.json").write_text(
+        json.dumps(
+            {
+                "id": pack_id,
+                "name": f"{pack_id} Name",
+                "version": version,
+                "description": "Test pack",
+            }
+        )
+    )
+    (path / "plugin.py").write_text(
+        "from core.base_plugin import BaseRecitePlugin\n"
+        "class Plugin(BaseRecitePlugin):\n"
+        "    def load_data(self): pass\n"
+        "    def get_all_problem_ids(self): return []\n"
+        "    def render_statement(self, pid): return ''\n"
+        "    def check_answer(self, pid, ui): return False\n"
+        "    def get_expected_display(self, pid): return ''\n"
+    )
+    if requirements:
+        (path / "requirements.txt").write_text(requirements)
+
+
+# -----------------------------------------------------------------------
+# Tests
+# -----------------------------------------------------------------------
+
+
+class TestEnsurePackVenv:
+    # These two tests are the only ones that create *real* venvs,
+    # because they're testing the venv creation logic itself.
+
+    def test_creates_venv_for_pack(self, monkeypatch, tmp_path):
+        venvs_base = tmp_path / "venvs"
+        m = PackageManager()
+        monkeypatch.setattr(m, "_get_pack_venv_dir", lambda pid: str(venvs_base / pid))
+
+        python_exe = m._ensure_pack_venv("p1")
+
+        assert os.path.isfile(python_exe)
+        assert os.path.isdir(str(venvs_base / "p1"))
+
+    def test_separate_venvs_for_different_packs(self, monkeypatch, tmp_path):
+        venvs_base = tmp_path / "venvs"
+        m = PackageManager()
+        monkeypatch.setattr(m, "_get_pack_venv_dir", lambda pid: str(venvs_base / pid))
+
+        py_a = m._ensure_pack_venv("pack_a")
+        py_b = m._ensure_pack_venv("pack_b")
+
+        assert os.path.isfile(py_a)
+        assert os.path.isfile(py_b)
+        assert py_a != py_b
+
+
+class TestGetPackSitePackages:
+    def test_returns_distinct_paths(self, monkeypatch, tmp_path):
+        venvs_base = tmp_path / "venvs"
+        m = PackageManager()
+        monkeypatch.setattr(m, "_get_pack_venv_dir", lambda pid: str(venvs_base / pid))
+
+        site_a = m._get_pack_site_packages("x")
+        site_b = m._get_pack_site_packages("y")
+
+        assert site_a != site_b
+        assert "site-packages" in site_a
+        assert "site-packages" in site_b
+
+
+class TestInstallPackDependencies:
+    def test_noop_when_no_requirements(self, monkeypatch, tmp_path):
+        pack_dir = tmp_path / "pack"
+        os.makedirs(pack_dir)
+        m = PackageManager()
+        monkeypatch.setattr(
+            m, "_get_pack_venv_dir", lambda pid: str(tmp_path / "venvs" / pid)
+        )
+        m._install_pack_dependencies(str(pack_dir), "nopkg")
+
+    def test_noop_when_empty_requirements(self, monkeypatch, tmp_path):
+        pack_dir = tmp_path / "pack"
+        os.makedirs(pack_dir)
+        (pack_dir / "requirements.txt").write_text("")
+        m = PackageManager()
+        monkeypatch.setattr(
+            m, "_get_pack_venv_dir", lambda pid: str(tmp_path / "venvs" / pid)
+        )
+        m._install_pack_dependencies(str(pack_dir), "emptypkg")
+
+    def test_pip_called_in_correct_venv(self, monkeypatch, tmp_path):
+        """pip install is invoked inside the pack's own venv.
+
+        ``_ensure_pack_venv`` is mocked so this test does not pay the
+        cost of a real ``python -m venv`` call.
+        """
+        venvs_base = tmp_path / "venvs"
+        pack_dir = tmp_path / "p1"
+        os.makedirs(pack_dir)
+        (pack_dir / "requirements.txt").write_text("foo>=1.0\n")
+
+        fake_python = str(venvs_base / "p1" / "bin" / os.path.basename(sys.executable))
+        m = PackageManager()
+        monkeypatch.setattr(m, "_get_pack_venv_dir", lambda pid: str(venvs_base / pid))
+        monkeypatch.setattr(m, "_ensure_pack_venv", lambda pid: fake_python)
+
+        calls = []
+        real_run = subprocess.run
+
+        def fake_run(args, **kwargs):
+            if any("pip" in str(a) for a in args):
+                calls.append((args, kwargs))
+                return subprocess.CompletedProcess(args, 0)
+            return real_run(args, **kwargs)
+
+        monkeypatch.setattr(subprocess, "run", fake_run)
+
+        m._install_pack_dependencies(str(pack_dir), "p1")
+
+        assert len(calls) == 1
+        pip_args = calls[0][0]
+        assert "install" in pip_args
+        assert str(pack_dir / "requirements.txt") in pip_args
+
+
+class TestConflictingVersions:
+    def test_install_two_packs_with_conflicting_pins(self, monkeypatch, tmp_path):
+        venvs_base = tmp_path / "venvs"
+        packs_dir = tmp_path / "packs"
+        os.makedirs(packs_dir)
+
+        src_a = tmp_path / "src_a"
+        _make_pack_with_deps(src_a, "pack_a", "1.0.0", "foo==1.0.0\n")
+        src_b = tmp_path / "src_b"
+        _make_pack_with_deps(src_b, "pack_b", "1.0.0", "foo==2.0.0\n")
+
+        m = PackageManager()
+        monkeypatch.setattr(m, "packs_dir", str(packs_dir))
+        monkeypatch.setattr(m, "_get_pack_venv_dir", lambda pid: str(venvs_base / pid))
+        monkeypatch.setattr(
+            m,
+            "_ensure_pack_venv",
+            lambda pid: str(
+                venvs_base / pid / "bin" / os.path.basename(sys.executable)
+            ),
+        )
+
+        pip_calls = []
+        real_run = subprocess.run
+
+        def fake_run(args, **kwargs):
+            if any("pip" in str(a) for a in args):
+                pip_calls.append((args, kwargs))
+                return subprocess.CompletedProcess(args, 0)
+            return real_run(args, **kwargs)
+
+        monkeypatch.setattr(subprocess, "run", fake_run)
+
+        m.install_pack(str(src_a))
+        m.install_pack(str(src_b))
+
+        assert len(pip_calls) == 2
+        pip0 = pip_calls[0][0]
+        pip1 = pip_calls[1][0]
+        assert pip0[0] != pip1[0]
+
+        req_paths = {str(pip_calls[i][0][-1]) for i in range(2)}
+        assert all(r.endswith("requirements.txt") for r in req_paths)
+
+    def test_isolated_site_packages_after_install(self, monkeypatch, tmp_path):
+        venvs_base = tmp_path / "venvs"
+        packs_dir = tmp_path / "packs"
+        os.makedirs(packs_dir)
+
+        src_a = tmp_path / "src_a"
+        _make_pack_with_deps(src_a, "iso_a", "1.0.0", "foo==1.0")
+        src_b = tmp_path / "src_b"
+        _make_pack_with_deps(src_b, "iso_b", "1.0.0", "foo==2.0")
+
+        m = PackageManager()
+        monkeypatch.setattr(m, "packs_dir", str(packs_dir))
+        monkeypatch.setattr(m, "_get_pack_venv_dir", lambda pid: str(venvs_base / pid))
+        monkeypatch.setattr(m, "_install_pack_dependencies", lambda *a: None)
+
+        m.install_pack(str(src_a))
+        m.install_pack(str(src_b))
+
+        site_a = m._get_pack_site_packages("iso_a")
+        site_b = m._get_pack_site_packages("iso_b")
+        assert site_a != site_b
+
+
+class TestNoDepsDoesNotCreateVenv:
+    def test_pack_without_requirements(self, monkeypatch, tmp_path):
+        venvs_base = tmp_path / "venvs"
+        packs_dir = tmp_path / "packs"
+        os.makedirs(packs_dir)
+
+        src = tmp_path / "src"
+        _make_pack_with_deps(src, "nopkg", "1.0.0")
+
+        m = PackageManager()
+        monkeypatch.setattr(m, "packs_dir", str(packs_dir))
+        monkeypatch.setattr(m, "_get_pack_venv_dir", lambda pid: str(venvs_base / pid))
+
+        m.install_pack(str(src))
+        assert not os.path.isdir(str(venvs_base / "nopkg"))
+
+
+class TestFailedDependencyPreservesPack:
+    def test_existing_pack_survives_failed_install(self, monkeypatch, tmp_path):
+        venvs_base = tmp_path / "venvs"
+        packs_dir = tmp_path / "packs"
+        os.makedirs(packs_dir)
+
+        src_old = tmp_path / "src_old"
+        _make_pack_with_deps(src_old, "survivor", "1.0.0")
+        m = PackageManager()
+        monkeypatch.setattr(m, "packs_dir", str(packs_dir))
+        monkeypatch.setattr(m, "_get_pack_venv_dir", lambda pid: str(venvs_base / pid))
+        monkeypatch.setattr(
+            m,
+            "_ensure_pack_venv",
+            lambda pid: str(
+                venvs_base / pid / "bin" / os.path.basename(sys.executable)
+            ),
+        )
+        m.install_pack(str(src_old))
+        old_manifest = json.loads(
+            (packs_dir / "survivor" / "manifest.json").read_text()
+        )
+        assert old_manifest["version"] == "1.0.0"
+
+        src_bad = tmp_path / "src_bad"
+        _make_pack_with_deps(src_bad, "survivor", "2.0.0", "nonexistent_pkg==999\n")
+
+        real_run = subprocess.run
+
+        def fake_run(args, **kwargs):
+            if any("pip" in str(a) for a in args):
+                raise subprocess.CalledProcessError(
+                    1, args, stderr="No matching distribution"
+                )
+            return real_run(args, **kwargs)
+
+        monkeypatch.setattr(subprocess, "run", fake_run)
+
+        with pytest.raises(RuntimeError, match="Failed to install dependencies"):
+            m.install_pack(str(src_bad))
+
+        surviving = json.loads((packs_dir / "survivor" / "manifest.json").read_text())
+        assert surviving["version"] == "1.0.0"

{muninn_cli-0.3.0 → muninn_cli-0.3.1}/tests/cli/test_manager.py

@@ -170,6 +170,44 @@ class TestUninstallPack:
         with pytest.raises(FileNotFoundError, match="not installed"):
             m.uninstall_pack("nonexistent")
 
+    def test_uninstall_removes_venv(self, tmp_workspace, monkeypatch):
+        """Verify that uninstall_pack removes the per-pack virtual environment."""
+        src = os.path.join(tmp_workspace, "packwithvenv")
+        _make_minimal_pack(src, pack_id="packwithvenv")
+
+        # Add a requirements.txt to trigger venv creation
+        with open(os.path.join(src, "requirements.txt"), "w") as f:
+            f.write("# empty requirements\n")
+
+        packs_dir = os.path.join(tmp_workspace, "fake_muninn", "packs")
+        venvs_dir = os.path.join(tmp_workspace, "fake_muninn", "venvs")
+        os.makedirs(packs_dir, exist_ok=True)
+        os.makedirs(venvs_dir, exist_ok=True)
+
+        m = PackageManager()
+        monkeypatch.setattr(m, "packs_dir", packs_dir)
+
+        # Mock _get_pack_venv_dir to use our test venvs_dir
+
+        def mock_get_venv(pack_id):
+            return os.path.join(venvs_dir, pack_id)
+
+        monkeypatch.setattr(m, "_get_pack_venv_dir", mock_get_venv)
+
+        # Install the pack (this will create the venv if requirements.txt exists)
+        m.install_pack(src)
+
+        # Verify venv was created
+        venv_dir = os.path.join(venvs_dir, "packwithvenv")
+        assert os.path.isdir(venv_dir), "venv should exist after install"
+
+        # Uninstall the pack
+        m.uninstall_pack("packwithvenv")
+
+        # Verify both pack_dir and venv_dir are removed
+        assert not os.path.exists(os.path.join(packs_dir, "packwithvenv"))
+        assert not os.path.exists(venv_dir), "venv should be removed after uninstall"
+
 
 class TestUpgrade:
     def test_upgrade_no_source_skips(self, monkeypatch, tmp_workspace):
@@ -322,3 +360,133 @@ class TestVersion:
         assert not PackageManager._is_newer("0.9.0", "1.0.0")
         assert PackageManager._is_newer("1.0.1", "1.0.0")
         assert PackageManager._is_newer("1.1.0", "1.0.9")
+
+    def test_version_tuple_corner_cases(self):
+        # Prefix handling
+        assert PackageManager._version_tuple("v1.0.0") == (1, 0, 0)
+        assert PackageManager._version_tuple("V2.1.3") == (2, 1, 3)
+        # Suffix handling
+        assert PackageManager._version_tuple("1.0.0-beta") == (1, 0, 0)
+        assert PackageManager._version_tuple("1.2.3.alpha4") == (1, 2, 3)
+        # Short versions
+        assert PackageManager._version_tuple("1.0") == (1, 0, 0)
+        assert PackageManager._version_tuple("2") == (2, 0, 0)
+        # Invalid / unexpected formats gracefully falling back
+        assert PackageManager._version_tuple("v.1.0") == (0, 0, 0)
+        assert PackageManager._version_tuple("version-1.0") == (0, 0, 0)
+        assert PackageManager._version_tuple("1.b.c") == (1, 0, 0)
+
+
+class TestPackIdValidation:
+    def test_valid_pack_ids(self):
+        """Test that valid pack_ids are accepted."""
+        m = PackageManager()
+        # These should not raise
+        m._validate_pack_id("my-pack")
+        m._validate_pack_id("my_pack")
+        m._validate_pack_id("my.pack")
+        m._validate_pack_id("MyPack123")
+        m._validate_pack_id("pack-1.0.0")
+        m._validate_pack_id("pack_with_underscores")
+
+    def test_rejects_path_traversal(self):
+        """Test that path traversal attempts are rejected."""
+        m = PackageManager()
+        with pytest.raises(ValueError, match="not allowed"):
+            m._validate_pack_id("..")
+        with pytest.raises(ValueError, match="not allowed"):
+            m._validate_pack_id(".")
+
+    def test_rejects_path_separators(self):
+        """Test that pack_ids with path separators are rejected."""
+        m = PackageManager()
+        with pytest.raises(ValueError, match="path separators"):
+            m._validate_pack_id("../malicious")
+        with pytest.raises(ValueError, match="path separators"):
+            m._validate_pack_id("path/to/pack")
+        with pytest.raises(ValueError, match="path separators"):
+            m._validate_pack_id("path\\to\\pack")
+
+    def test_rejects_invalid_characters(self):
+        """Test that pack_ids with invalid characters are rejected."""
+        m = PackageManager()
+        with pytest.raises(ValueError, match="alphanumeric"):
+            m._validate_pack_id("pack with spaces")
+        with pytest.raises(ValueError, match="alphanumeric"):
+            m._validate_pack_id("pack@version")
+        with pytest.raises(ValueError, match="alphanumeric"):
+            m._validate_pack_id("pack$name")
+
+    def test_rejects_empty_pack_id(self):
+        """Test that empty pack_id is rejected."""
+        m = PackageManager()
+        with pytest.raises(ValueError, match="cannot be empty"):
+            m._validate_pack_id("")
+
+    def test_uninstall_validates_pack_id(self, tmp_workspace, monkeypatch):
+        """Test that uninstall_pack validates pack_id."""
+        packs_dir = os.path.join(tmp_workspace, "packs")
+        os.makedirs(packs_dir, exist_ok=True)
+        m = PackageManager()
+        monkeypatch.setattr(m, "packs_dir", packs_dir)
+        with pytest.raises(ValueError, match="path separators"):
+            m.uninstall_pack("../malicious")
+
+    def test_load_plugin_validates_pack_id(self):
+        """Test that load_plugin validates pack_id."""
+        m = PackageManager()
+        with pytest.raises(ValueError, match="path separators"):
+            m.load_plugin("../malicious")
+
+    def test_upgrade_pack_validates_pack_id(self):
+        """Test that upgrade_pack validates pack_id."""
+        m = PackageManager()
+        with pytest.raises(ValueError, match="path separators"):
+            m.upgrade_pack("../malicious")
+
+    def test_install_rejects_malicious_manifest(self, tmp_workspace, monkeypatch):
+        """Test that install_pack rejects packs with malicious pack_id in manifest."""
+        src = os.path.join(tmp_workspace, "malicious")
+        os.makedirs(src, exist_ok=True)
+        # Create manifest with path traversal in id
+        manifest = {
+            "id": "../escape",
+            "name": "Malicious Pack",
+            "author": "Attacker",
+            "version": "1.0.0",
+            "description": "Malicious pack",
+        }
+        with open(os.path.join(src, "manifest.json"), "w", encoding="utf-8") as f:
+            json.dump(manifest, f, indent=4)
+
+        packs_dir = os.path.join(tmp_workspace, "fake_muninn", "packs")
+        os.makedirs(packs_dir, exist_ok=True)
+        m = PackageManager()
+        monkeypatch.setattr(m, "packs_dir", packs_dir)
+
+        with pytest.raises(ValueError, match="Invalid manifest"):
+            m.install_pack(src)
+
+
+class TestLoadPluginCornerCases:
+    def test_raises_if_no_valid_subclass(self, tmp_workspace, monkeypatch):
+        src = os.path.join(tmp_workspace, "badpack")
+        os.makedirs(src, exist_ok=True)
+        manifest = {"id": "badpack", "version": "1.0.0"}
+        with open(os.path.join(src, "manifest.json"), "w") as f:
+            json.dump(manifest, f)
+
+        # Plugin that doesn't subclass BaseRecitePlugin
+        with open(os.path.join(src, "plugin.py"), "w") as f:
+            f.write("class Plugin:\n    pass\n")
+
+        packs_dir = os.path.join(tmp_workspace, "fake_muninn", "packs")
+        os.makedirs(packs_dir, exist_ok=True)
+        m = PackageManager()
+        monkeypatch.setattr(m, "packs_dir", packs_dir)
+        m.install_pack(src)
+
+        with pytest.raises(
+            ValueError, match="No valid BaseRecitePlugin subclass found"
+        ):
+            m.load_plugin("badpack")

{muninn_cli-0.3.0 → muninn_cli-0.3.1}/tests/core/test_helpers.py

@@ -278,3 +278,37 @@ class TestFlashcardPlugin:
 
         with pytest.raises(ValueError, match="Unsupported DATA_FILE"):
             BadFlashcard(tmp_workspace)
+
+    def test_missing_back_key_raises_keyerror(self, tmp_workspace):
+        json_path = os.path.join(tmp_workspace, "words.json")
+        with open(json_path, "w", encoding="utf-8") as f:
+            json.dump([{"front": "cat"}], f)  # Missing "back"
+
+        p = _JsonFlashcard(tmp_workspace)
+        # render_statement and get_expected_display use .get("back", ""), so they won't raise
+        assert p.render_statement("0") == "【闪卡】 cat"
+        assert p.get_expected_display("0") == ""
+
+        # But check_answer uses Matchers.exact("back") which accesses data_item["back"] directly
+        with pytest.raises(KeyError):
+            p.check_answer("0", "anything")
+
+
+class TestMatchersCornerCases:
+    def test_missing_key_raises_keyerror(self):
+        m1 = Matchers.exact("key")
+        m2 = Matchers.exact_integer("key")
+        m3 = Matchers.case_insensitive("key")
+        m4 = Matchers.chinese_symbol_pair("key1", "key2")
+        m5 = Matchers.any_order("key1", "key2")
+
+        with pytest.raises(KeyError):
+            m1({}, "val")
+        with pytest.raises(KeyError):
+            m2({}, "123")
+        with pytest.raises(KeyError):
+            m3({}, "val")
+        with pytest.raises(KeyError):
+            m4({"key1": "A"}, "val")  # Missing key2
+        with pytest.raises(KeyError):
+            m5({"key1": "A"}, "val")  # Missing key2

{muninn_cli-0.3.0 → muninn_cli-0.3.1}/uv.lock

@@ -127,7 +127,7 @@ wheels = [
 
 [[package]]
 name = "muninn-cli"
-version = "0.3.0"
+version = "0.3.1"
 source = { editable = "." }
 
 [package.dev-dependencies]