pyselfupdate 0.3.2__tar.gz → 0.4.1__tar.gz

{pyselfupdate-0.3.2 → pyselfupdate-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: pyselfupdate
-Version: 0.3.2
+Version: 0.4.1
 Summary: Self-update and update notification for Python CLIs installed with uv tool
 Keywords: uv,cli,self-update,update-notifier,release
 Author: Chris Birch
@@ -18,7 +18,7 @@ Requires-Dist: typer>=0.12.0 ; extra == 'typer'
 Requires-Python: >=3.11
 Project-URL: Repository, https://github.com/datapointchris/pyselfupdate
 Project-URL: Issues, https://github.com/datapointchris/pyselfupdate/issues
-Project-URL: Changelog, https://github.com/datapointchris/pyselfupdate/blob/main/CHANGELOG.md
+Project-URL: Changelog, https://github.com/datapointchris/pyselfupdate/releases
 Provides-Extra: typer
 Description-Content-Type: text/markdown
 
@@ -218,7 +218,8 @@ command, and nothing above the `Source` protocol learns either name.
 
 ## State
 
-`${XDG_STATE_HOME:-~/.local/state}/<tool>/autoupdate.json`, written atomically:
+`${XDG_STATE_HOME:-~/.local/state}/<tool>/autoupdate-<machine>.json`, written
+atomically:
 
 ```json
 {
@@ -233,10 +234,17 @@ command, and nothing above the `Source` protocol learns either name.
 ```
 
 State, not config and not cache: it persists across runs, it is not authored by
-the user, and deleting it changes behaviour rather than merely costing a
+the user, and deleting it changes behavior rather than merely costing a
 recompute. That is `XDG_STATE_HOME` by the Base Directory specification, and it
 is where `gh` puts the same thing.
 
+`<machine>` is the bare lowercased hostname, from `state.machine()`. It is in
+the name because both fields that vary — the version installed here, and the
+instant this box last checked — describe one machine. A state directory shared
+between machines, by a file syncer or a network home directory, otherwise has
+two writers on one path and reports whichever wrote last as the state of all of
+them.
+
 The timestamp is written **before** the network call. `gh` stamps only on
 success, so a rate-limited or offline user re-hits the API on every invocation
 until the window resets; an interval exists to bound the request rate, and only
@@ -244,11 +252,10 @@ this ordering actually does that.
 
 ## Siblings
 
-The same two-layer design in other languages. **`update` exists in all three;
-the `notify` layer, the shared `autoupdate.json` schema and the
-`NO_AUTO_UPDATE` contract are implemented in this library and in its bash
-sibling, and are still to be added to goselfupdate** — until then goselfupdate
-provides the update half only.
+The same two-layer design in other languages. All three carry both layers, and
+they share the `autoupdate-<machine>.json` schema, the machine derivation that
+names it, and the `NO_AUTO_UPDATE` contract. They do not share an API, because
+"update" means a different operation in each.
 
 - [goselfupdate](https://github.com/datapointchris/goselfupdate) — replaces a Go binary
 - [bashselfupdate](https://github.com/datapointchris/bashselfupdate) — moves a git checkout to its newest tag
@@ -256,6 +263,6 @@ provides the update half only.
 Version precedence is deliberately identical across all three, so a tool and
 its siblings never disagree about which release is newer.
 
-## Licence
+## License
 
 MIT

{pyselfupdate-0.3.2 → pyselfupdate-0.4.1}/README.md

@@ -194,7 +194,8 @@ command, and nothing above the `Source` protocol learns either name.
 
 ## State
 
-`${XDG_STATE_HOME:-~/.local/state}/<tool>/autoupdate.json`, written atomically:
+`${XDG_STATE_HOME:-~/.local/state}/<tool>/autoupdate-<machine>.json`, written
+atomically:
 
 ```json
 {
@@ -209,10 +210,17 @@ command, and nothing above the `Source` protocol learns either name.
 ```
 
 State, not config and not cache: it persists across runs, it is not authored by
-the user, and deleting it changes behaviour rather than merely costing a
+the user, and deleting it changes behavior rather than merely costing a
 recompute. That is `XDG_STATE_HOME` by the Base Directory specification, and it
 is where `gh` puts the same thing.
 
+`<machine>` is the bare lowercased hostname, from `state.machine()`. It is in
+the name because both fields that vary — the version installed here, and the
+instant this box last checked — describe one machine. A state directory shared
+between machines, by a file syncer or a network home directory, otherwise has
+two writers on one path and reports whichever wrote last as the state of all of
+them.
+
 The timestamp is written **before** the network call. `gh` stamps only on
 success, so a rate-limited or offline user re-hits the API on every invocation
 until the window resets; an interval exists to bound the request rate, and only
@@ -220,11 +228,10 @@ this ordering actually does that.
 
 ## Siblings
 
-The same two-layer design in other languages. **`update` exists in all three;
-the `notify` layer, the shared `autoupdate.json` schema and the
-`NO_AUTO_UPDATE` contract are implemented in this library and in its bash
-sibling, and are still to be added to goselfupdate** — until then goselfupdate
-provides the update half only.
+The same two-layer design in other languages. All three carry both layers, and
+they share the `autoupdate-<machine>.json` schema, the machine derivation that
+names it, and the `NO_AUTO_UPDATE` contract. They do not share an API, because
+"update" means a different operation in each.
 
 - [goselfupdate](https://github.com/datapointchris/goselfupdate) — replaces a Go binary
 - [bashselfupdate](https://github.com/datapointchris/bashselfupdate) — moves a git checkout to its newest tag
@@ -232,6 +239,6 @@ provides the update half only.
 Version precedence is deliberately identical across all three, so a tool and
 its siblings never disagree about which release is newer.
 
-## Licence
+## License
 
 MIT

{pyselfupdate-0.3.2 → pyselfupdate-0.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyselfupdate"
-version = "0.3.2"
+version = "0.4.1"
 description = "Self-update and update notification for Python CLIs installed with uv tool"
 readme = "README.md"
 keywords = [
@@ -36,7 +36,7 @@ typer = ["typer>=0.12.0"]
 [project.urls]
 Repository = "https://github.com/datapointchris/pyselfupdate"
 Issues = "https://github.com/datapointchris/pyselfupdate/issues"
-Changelog = "https://github.com/datapointchris/pyselfupdate/blob/main/CHANGELOG.md"
+Changelog = "https://github.com/datapointchris/pyselfupdate/releases"
 
 [dependency-groups]
 dev = [
@@ -66,6 +66,9 @@ skips = [
 [tool.codespell]
 skip = "*.lock"
 check-filenames = true
+check-hidden = true
+builtin = "clear,rare"
+uri-ignore-words-list = "*"
 
 [tool.mypy]
 pretty = true
@@ -212,6 +215,18 @@ managed = [
     [
     "codespell",
     "check-filenames",
+],
+    [
+    "codespell",
+    "check-hidden",
+],
+    [
+    "codespell",
+    "builtin",
+],
+    [
+    "codespell",
+    "uri-ignore-words-list",
 ],
     [
     "pytest",

{pyselfupdate-0.3.2 → pyselfupdate-0.4.1}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "pyselfupdate"
-version = "0.3.2"
+version = "0.4.1"
 description = "Self-update and update notification for Python CLIs installed with uv tool"
 authors = [{ name = "Chris Birch", email = "datapointchris@gmail.com" }]
 license = { text = "MIT" }
@@ -34,7 +34,7 @@ typer = ["typer>=0.12.0"]
 [project.urls]
 Repository = "https://github.com/datapointchris/pyselfupdate"
 Issues = "https://github.com/datapointchris/pyselfupdate/issues"
-Changelog = "https://github.com/datapointchris/pyselfupdate/blob/main/CHANGELOG.md"
+Changelog = "https://github.com/datapointchris/pyselfupdate/releases"
 
 [dependency-groups]
 dev = [
@@ -58,6 +58,9 @@ skips = ["B311", "B404", "B603"]
 [tool.codespell]
 skip = '*.lock'
 check-filenames = true
+check-hidden = true
+builtin = "clear,rare"
+uri-ignore-words-list = "*"
 
 
 [tool.mypy]
@@ -138,7 +141,7 @@ typeCheckingMode = "standard"
 analyzeUnannotatedFunctions = true  # or pylance stops analyzing in vscode
 
 [tool.forge]
-# Keys the standard owns, written by `forge repos apply pyproject`.
+# Keys the shared toolchain standard owns, written by its generator.
 # Dropping one from the template removes it here on the next sync; a key absent
 # from this list belongs to the project and is never touched. Do not hand-edit.
 managed = [
@@ -159,6 +162,9 @@ managed = [
     ["pyright", "typeCheckingMode"],
     ["pyright", "analyzeUnannotatedFunctions"],
     ["codespell", "check-filenames"],
+    ["codespell", "check-hidden"],
+    ["codespell", "builtin"],
+    ["codespell", "uri-ignore-words-list"],
     ["pytest", "ini_options", "verbosity_assertions"],
     ["pytest", "ini_options", "minversion"],
     ["pytest", "ini_options", "testpaths"],

{pyselfupdate-0.3.2 → pyselfupdate-0.4.1}/src/pyselfupdate/errors.py

@@ -18,7 +18,7 @@ class LocalInstallError(SelfUpdateError):
     """The tool was installed from a local path or as an editable checkout.
 
     Reinstalling would discard a working copy for a release that may be older,
-    with no way to tell which is newer. This is the analogue of goselfupdate's
+    with no way to tell which is newer. This is the analog of goselfupdate's
     ErrDevBuild.
     """
 

{pyselfupdate-0.3.2 → pyselfupdate-0.4.1}/src/pyselfupdate/github.py

@@ -6,6 +6,7 @@ this package is that adding it to a project adds nothing else.
 
 from __future__ import annotations
 
+import http.client
 import json
 import os
 import shlex
@@ -19,6 +20,7 @@ from dataclasses import dataclass
 from dataclasses import field
 from datetime import UTC
 from datetime import datetime
+from typing import IO
 
 from pyselfupdate.errors import NoReleaseError
 from pyselfupdate.errors import SelfUpdateError
@@ -29,6 +31,49 @@ API = 'https://api.github.com'
 DEFAULT_TIMEOUT = 10.0
 
 
+def _origin(url: str) -> tuple[str, str]:
+    """Scheme and authority, which is what decides whether a credential travels.
+
+    Port is part of it. Two ports on one host are two origins, and treating them
+    as one is how a redirect to a service sharing a hostname gets the token.
+    """
+    split = urllib.parse.urlsplit(url)
+    return split.scheme, split.netloc
+
+
+class _CredentialScopedRedirects(urllib.request.HTTPRedirectHandler):
+    """Drop `Authorization` when a redirect leaves the origin it was sent to.
+
+    `urllib.request` carries the header to the new host instead. Measured across
+    3.11, 3.13 and 3.14 with two local servers: a `Bearer` sent to the first
+    arrives intact at the second on every one of them. So this is the library's
+    to do, at every version it supports, rather than something a floor bump ends.
+
+    It matters here because `API` is a reassignable module attribute and
+    `headers` is caller-supplied, which is what makes a redirect off GitHub
+    something other than hypothetical.
+    """
+
+    def redirect_request(
+        self,
+        req: urllib.request.Request,
+        fp: IO[bytes],
+        code: int,
+        msg: str,
+        headers: http.client.HTTPMessage,
+        newurl: str,
+    ) -> urllib.request.Request | None:
+        redirected = super().redirect_request(req, fp, code, msg, headers, newurl)
+        if redirected is None or _origin(req.full_url) == _origin(newurl):
+            return redirected
+        redirected.headers = {name: value for name, value in redirected.headers.items() if name.lower() != 'authorization'}
+        return redirected
+
+
+_OPENER = urllib.request.build_opener(_CredentialScopedRedirects)
+"""Built once. Passing a `HTTPRedirectHandler` subclass replaces the default one."""
+
+
 # B105 reads any name carrying "token" as a credential. Both hold the name of a
 # variable and the text of a command; neither ever holds a secret.
 TOKEN_COMMAND_ENV = 'GITHUB_TOKEN_COMMAND'  # nosec B105
@@ -215,7 +260,7 @@ class GitHubSource:
     def _get(self, path: str):
         url = f'{API}{path}'
 
-        # urlopen honours file:, ftp: and data: as readily as http:. API is a
+        # urlopen honors file:, ftp: and data: as readily as http:. API is a
         # constant here, but it is a module attribute a caller can reassign --
         # tests do exactly that -- so the scheme is checked rather than assumed.
         # Without this, setting it to a file: URL turns a release check into an
@@ -235,10 +280,7 @@ class GitHubSource:
             request.add_header(name, value)
 
         try:
-            # B310 is a call blacklist rather than a dataflow check, so it fires
-            # on urlopen regardless of the scheme guard above. That guard, and
-            # test_a_non_http_scheme_is_refused, are the actual defence.
-            with urllib.request.urlopen(request, timeout=self.timeout) as response:  # noqa: S310  # nosec B310
+            with _OPENER.open(request, timeout=self.timeout) as response:
                 return json.load(response)
         except urllib.error.HTTPError as error:
             raise _http_error(self.owner, self.repo, error, authenticated=bool(token)) from error

{pyselfupdate-0.3.2 → pyselfupdate-0.4.1}/src/pyselfupdate/install.py

@@ -1,6 +1,6 @@
 """Reading and rewriting a uv tool installation.
 
-This is the part with no analogue in goselfupdate. A Go tool updates by
+This is the part with no analog in goselfupdate. A Go tool updates by
 replacing one file; a uv tool updates by rebuilding the virtual environment its
 own interpreter is running inside, which is why `update` must be the last thing
 a process does before it exits or re-execs.

{pyselfupdate-0.3.2 → pyselfupdate-0.4.1}/src/pyselfupdate/state.py

@@ -1,11 +1,11 @@
-"""The per-tool state file.
+"""The per-tool, per-machine state file.
 
 One schema, shared byte-for-byte with goselfupdate and bashselfupdate, so that
 any tool can read any other tool's state and a single dashboard can glob
-`~/.local/state/*/autoupdate.json` with no per-tool knowledge.
+`~/.local/state/*/autoupdate-*.json` with no per-tool knowledge.
 
 State, not config and not cache: it persists across runs, it is not authored by
-the user, and deleting it changes behaviour rather than merely costing a
+the user, and deleting it changes behavior rather than merely costing a
 recompute. That is `XDG_STATE_HOME` by the Base Directory specification, and it
 is where `gh` puts the same thing.
 """
@@ -14,6 +14,7 @@ from __future__ import annotations
 
 import json
 import os
+import socket
 from dataclasses import asdict
 from dataclasses import dataclass
 from datetime import UTC
@@ -21,7 +22,45 @@ from datetime import datetime
 from pathlib import Path
 
 SCHEMA = 1
-FILENAME = 'autoupdate.json'
+
+#: Names the file when the host cannot be read, so a filename is always
+#: well-formed and two unidentifiable boxes collide only with each other.
+UNKNOWN_MACHINE = 'unknown'
+
+
+def machine() -> str:
+    """The box this process runs on: bare hostname, no domain, lowercased.
+
+    goselfupdate and bashselfupdate derive it the same way, so the three write
+    interleaved files a single reader can enumerate.
+    """
+    try:
+        return canonical_machine(socket.gethostname())
+    except OSError:
+        return UNKNOWN_MACHINE
+
+
+def canonical_machine(name: str) -> str:
+    """A hostname from any source, reduced to the form `machine` records.
+
+    A hostname reaches a reader fully qualified as often as bare, so a
+    comparison against a recorded name has to canonicalize both sides or it
+    fails on every host.
+    """
+    return name.strip().lower().split('.')[0] or UNKNOWN_MACHINE
+
+
+def filename(machine_name: str) -> str:
+    """The file one machine writes inside a tool's state directory.
+
+    The machine is part of the name because a state directory is a synced
+    directory on some installations, and a file syncer has no merge: two boxes
+    writing one path leaves one winner plus a conflict copy nobody reads. Both
+    fields this file carries — the version installed here and the instant this
+    box last checked — describe one machine, so the split costs nothing and
+    makes the collision unreachable.
+    """
+    return f'autoupdate-{machine_name}.json'
 
 
 @dataclass
@@ -54,7 +93,8 @@ def state_home() -> Path:
 
 
 def state_path(tool: str) -> Path:
-    return state_home() / tool / FILENAME
+    """Where this machine's state for a tool lives."""
+    return state_home() / tool / filename(machine())
 
 
 def read(tool: str) -> State:

{pyselfupdate-0.3.2 → pyselfupdate-0.4.1}/src/pyselfupdate/updater.py

@@ -23,7 +23,7 @@ from pyselfupdate.source import Release
 class Result:
     """What an update found, whether or not it installed anything."""
 
-    # The running version, canonicalised with a leading "v".
+    # The running version, canonicalized with a leading "v".
     current: str
 
     # The version now installed, or the one `update` would install after a
@@ -129,7 +129,7 @@ def changelog(config: Config, from_version: str, to_version: str) -> list[str]:
 
 
 def _current_version(config: Config) -> str:
-    """The running version, canonicalised, rejecting one that is not a release.
+    """The running version, canonicalized, rejecting one that is not a release.
 
     An install that tracks a git branch rather than a tag reports whatever
     version was in pyproject.toml when it was built, which says nothing about

{pyselfupdate-0.3.2 → pyselfupdate-0.4.1}/src/pyselfupdate/version.py

@@ -2,12 +2,12 @@
 
 Implemented here rather than taken from `packaging` so that this package has no
 third-party dependencies. `packaging` also implements PEP 440, whose precedence
-rules differ from semver's in ways that matter: it normalises `1.0.0-rc.1` to
+rules differ from semver's in ways that matter: it normalizes `1.0.0-rc.1` to
 `1.0.0rc1` and orders `1.0.0.post1` above `1.0.0`, neither of which describes a
 git tag.
 
 Precedence follows https://semver.org section 11, and is byte-for-byte the same
-behaviour as goselfupdate's semver.go so that the two libraries never disagree
+behavior as goselfupdate's semver.go so that the two libraries never disagree
 about which of two releases is newer.
 """