remo-cli 4.4.0__tar.gz → 4.4.1__tar.gz

{remo_cli-4.4.0 → remo_cli-4.4.1}/.github/workflows/smoke-test.yml

@@ -1,10 +1,26 @@
 name: Smoke Tests
 
+# These provision real instances, so what triggers them is a cost decision as
+# much as a coverage one:
+#
+#   pull_request            -> `incus` only (local container, free)
+#   push to main / weekly   -> aws + hetzner + incus (aws and hetzner are billable)
+#   workflow_dispatch       -> whichever `provider` is chosen
+#
+# The paid providers are gated off pull_request in each job's `if:` below.
+#
+# `src/remo_cli/web/**` is excluded: the web service plays no part in
+# provisioning, so a console-only change (#184, #187, #189) should not provision
+# anything. Negation is order-sensitive — the `!` line must follow the broad
+# `src/remo_cli/**` it narrows.
+#
+# tests/unit/test_smoke_test_scope.py pins all of this.
 on:
   pull_request:
     branches: [main]
     paths:
       - 'src/remo_cli/**'
+      - '!src/remo_cli/web/**'
       - 'ansible/**'
       - 'pyproject.toml'
       - 'uv.lock'
@@ -13,6 +29,7 @@ on:
     branches: [main]
     paths:
       - 'src/remo_cli/**'
+      - '!src/remo_cli/web/**'
       - 'ansible/**'
       - 'pyproject.toml'
       - 'uv.lock'
@@ -38,8 +55,13 @@ jobs:
   # AWS EC2 — SSM access
   # ===========================================================================
   aws:
+    # Not on pull requests: this provisions a real, billable instance.
+    # PRs are covered by the `incus` job below, which exercises the same
+    # create -> configure -> destroy path in a local container for free.
+    # aws/hetzner run on push to main, weekly, and on manual dispatch.
     if: >-
       github.actor != 'dependabot[bot]' &&
+      github.event_name != 'pull_request' &&
       (github.event_name != 'workflow_dispatch' ||
        github.event.inputs.provider == 'all' ||
        github.event.inputs.provider == 'aws')
@@ -207,8 +229,13 @@ jobs:
   # Hetzner Cloud
   # ===========================================================================
   hetzner:
+    # Not on pull requests: this provisions a real, billable instance.
+    # PRs are covered by the `incus` job below, which exercises the same
+    # create -> configure -> destroy path in a local container for free.
+    # aws/hetzner run on push to main, weekly, and on manual dispatch.
     if: >-
       github.actor != 'dependabot[bot]' &&
+      github.event_name != 'pull_request' &&
       (github.event_name != 'workflow_dispatch' ||
        github.event.inputs.provider == 'all' ||
        github.event.inputs.provider == 'hetzner')
@@ -327,6 +354,9 @@ jobs:
   # Incus / LXC (local on runner)
   # ===========================================================================
   incus:
+    # DOES run on pull requests, unlike aws/hetzner: the container is local
+    # to the runner, so it costs nothing beyond runner minutes while still
+    # proving the real provisioning path end to end.
     if: >-
       github.actor != 'dependabot[bot]' &&
       (github.event_name != 'workflow_dispatch' ||

remo_cli-4.4.1/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "4.4.1"
+}

{remo_cli-4.4.0 → remo_cli-4.4.1}/AGENTS.md

@@ -392,6 +392,22 @@ made conditional to get a build green — fix the code or amend the gate by PR.
 | Packaging | wheel install smoke, Docker amd64+arm64 | Distribution integrity |
 | Security | CodeQL, dependency review | Supply chain |
 
+Provider smoke tests (`smoke-test.yml`) are deliberately **not** in that table —
+they are not all merge gates, because they provision real instances and what runs
+when is a cost decision:
+
+| Trigger | Providers | Cost |
+|---------|-----------|------|
+| pull request | `incus` only | runner minutes (local container) |
+| push to `main`, weekly cron | `aws` + `hetzner` + `incus` | aws/hetzner are billable |
+| `workflow_dispatch` | whichever `provider` is chosen | as chosen |
+
+So a PR still proves the real create → configure → destroy path, for free, while
+the billable providers validate `main` right after merge. Paths exclude
+`src/remo_cli/web/**` — the web service has no part in provisioning.
+`tests/unit/test_smoke_test_scope.py` pins the split; the asymmetry between the
+jobs is intentional and must not be "made consistent".
+
 `ruff` and `mypy` share the one `Lint & Types` job. That job must keep
 installing the `web` extra (`uv sync --all-extras`): with
 `ignore_missing_imports = true`, an uninstalled FastAPI/pydantic would degrade

{remo_cli-4.4.0 → remo_cli-4.4.1}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [4.4.1](https://github.com/get2knowio/remo/compare/v4.4.0...v4.4.1) (2026-09-30)
+
+
+### Bug Fixes
+
+* **install:** upgrade an existing install instead of silently doing nothing ([#236](https://github.com/get2knowio/remo/issues/236)) ([b3dac8c](https://github.com/get2knowio/remo/commit/b3dac8ce51e99300129e4e21bbf946a63a4f1cc8))
+
 ## [4.4.0](https://github.com/get2knowio/remo/compare/v4.3.6...v4.4.0) (2026-09-30)
 
 

{remo_cli-4.4.0 → remo_cli-4.4.1}/CLAUDE.md

@@ -393,6 +393,22 @@ made conditional to get a build green — fix the code or amend the gate by PR.
 | Packaging | wheel install smoke, Docker amd64+arm64 | Distribution integrity |
 | Security | CodeQL, dependency review | Supply chain |
 
+Provider smoke tests (`smoke-test.yml`) are deliberately **not** in that table —
+they are not all merge gates, because they provision real instances and what runs
+when is a cost decision:
+
+| Trigger | Providers | Cost |
+|---------|-----------|------|
+| pull request | `incus` only | runner minutes (local container) |
+| push to `main`, weekly cron | `aws` + `hetzner` + `incus` | aws/hetzner are billable |
+| `workflow_dispatch` | whichever `provider` is chosen | as chosen |
+
+So a PR still proves the real create → configure → destroy path, for free, while
+the billable providers validate `main` right after merge. Paths exclude
+`src/remo_cli/web/**` — the web service has no part in provisioning.
+`tests/unit/test_smoke_test_scope.py` pins the split; the asymmetry between the
+jobs is intentional and must not be "made consistent".
+
 `ruff` and `mypy` share the one `Lint & Types` job. That job must keep
 installing the `web` extra (`uv sync --all-extras`): with
 `ignore_missing_imports = true`, an uninstalled FastAPI/pydantic would degrade

{remo_cli-4.4.0 → remo_cli-4.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: remo-cli
-Version: 4.4.0
+Version: 4.4.1
 Summary: Remote development environment CLI
 License-Expression: MIT
 License-File: LICENSE
@@ -51,6 +51,10 @@ set up shell completion.
 Nothing is installed silently — it prints what it is about to run, and
 `--dry-run` prints it without running anything.
 
+**Re-run the same command to upgrade.** It reports what changed
+(`Updated remo-cli: 4.3.6 -> 4.4.0`), or says so plainly when you are already
+current.
+
 ### Or install it yourself
 
 ```bash

{remo_cli-4.4.0 → remo_cli-4.4.1}/README.md

@@ -16,6 +16,10 @@ set up shell completion.
 Nothing is installed silently — it prints what it is about to run, and
 `--dry-run` prints it without running anything.
 
+**Re-run the same command to upgrade.** It reports what changed
+(`Updated remo-cli: 4.3.6 -> 4.4.0`), or says so plainly when you are already
+current.
+
 ### Or install it yourself
 
 ```bash

{remo_cli-4.4.0 → remo_cli-4.4.1}/install.sh

@@ -316,6 +316,22 @@ install_spec() {
 }
 
 # Install remo-cli
+# Currently-installed version, or empty if not installed. Best-effort: never
+# fails the install, and both spellings are normalised (uv prints `v4.4.0`,
+# pipx prints `4.4.0`).
+#
+# Exists so a run is legible. The silent-no-upgrade bug this guards against was
+# invisible precisely because nothing reported the before and after — uv printed
+# "Installed 2 executables" either way.
+installed_version() {
+    local v=""
+    case "${INSTALLER}" in
+        uv)   v=$(uv tool list 2>/dev/null | awk -v p="${PACKAGE}" '$1==p {print $2; exit}') ;;
+        pipx) v=$(pipx list --short 2>/dev/null | awk -v p="${PACKAGE}" '$1==p {print $2; exit}') ;;
+    esac
+    printf '%s' "${v#v}"
+}
+
 install_remo() {
     local spec
     spec="$(install_spec)"
@@ -327,10 +343,19 @@ install_remo() {
         *)    print_error "No installer selected (internal error)."; exit 1 ;;
     esac
 
-    # --force only when a version was asked for: switching between versions
-    # needs it, while a bare re-run stays the no-op it is today.
-    [ -n "${VERSION}" ] && cmd+=(--force)
-    cmd+=("${spec}")
+    # ALWAYS --force, including a bare run with no version.
+    #
+    # Without it, `uv tool install remo-cli` over an existing install keeps the
+    # installed version and still prints "Installed 2 executables", so the run
+    # looks successful and upgrades nothing. Someone on 4.3.6 re-running the
+    # installer to pick up 4.4.0 stays on 4.3.6 with no indication why. `pipx
+    # install` behaves the same way.
+    #
+    # This does re-do work on every run, which is the point: the *outcome* is
+    # idempotent — after any run you have the version you asked for — and that
+    # is what Principle VII asks for. Skipping the work to make the run itself a
+    # no-op is what produced the silent-no-upgrade bug.
+    cmd+=(--force "${spec}")
 
     if [ "${DRY_RUN}" = true ]; then
         printf '%s "%s"\n' "${cmd[*]:0:${#cmd[@]}-1}" "${spec}"
@@ -338,13 +363,34 @@ install_remo() {
     fi
 
     echo ""
-    print_info "Installing ${PACKAGE}${VERSION:+ ${VERSION}}..."
+    local before
+    before="$(installed_version)"
+    if [ -n "${before}" ]; then
+        print_info "Installing ${PACKAGE}${VERSION:+ ${VERSION}} (replacing ${before})..."
+    else
+        print_info "Installing ${PACKAGE}${VERSION:+ ${VERSION}}..."
+    fi
 
     if ! "${cmd[@]}"; then
         print_error "Installation failed."
         printf '  Try running manually: %s "%s"\n' "${cmd[*]:0:${#cmd[@]}-1}" "${spec}"
         exit 1
     fi
+
+    # Say what actually happened. An unchanged version after an upgrade run is
+    # the symptom of the bug the --force above exists to prevent, so name it
+    # rather than leaving the reader to compare two numbers.
+    local after
+    after="$(installed_version)"
+    if [ -n "${after}" ]; then
+        if [ -z "${before}" ]; then
+            print_success "Installed ${PACKAGE} ${after}."
+        elif [ "${before}" = "${after}" ]; then
+            print_info "${PACKAGE} ${after} was already installed — nothing changed."
+        else
+            print_success "Updated ${PACKAGE}: ${before} -> ${after}."
+        fi
+    fi
 }
 
 # Offer to install shell completion.

{remo_cli-4.4.0 → remo_cli-4.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "remo-cli"
-version = "4.4.0"
+version = "4.4.1"
 description = "Remote development environment CLI"
 readme = "README.md"
 license = "MIT"

{remo_cli-4.4.0 → remo_cli-4.4.1}/tests/unit/test_install_script.py

@@ -103,12 +103,41 @@ class TestChannelRouting:
     def test_no_version_installs_the_package_from_pypi(self, fake_path) -> None:
         result = _run(path=fake_path(uv=True))
         assert result.returncode == 0, result.stderr
-        assert result.stdout.strip() == 'uv tool install "remo-cli"'
+        assert result.stdout.strip() == 'uv tool install --force "remo-cli"'
 
-    def test_no_version_does_not_force(self, fake_path) -> None:
-        """A bare re-run stays the no-op it is today (Principle VII)."""
-        result = _run(path=fake_path(uv=True))
-        assert "--force" not in result.stdout
+    @pytest.mark.parametrize(
+        "args",
+        [[], ["--version", "4.3.6"], ["--prerelease", "4.4.0rc3"]],
+        ids=["bare", "version", "prerelease"],
+    )
+    def test_force_is_always_passed(self, fake_path, args: list[str]) -> None:
+        """Including a bare run with no version — this assertion was inverted,
+        and the inversion was a real bug.
+
+        `uv tool install remo-cli` over an existing install keeps the installed
+        version and still prints "Installed 2 executables", so a user on 4.3.6
+        re-running the installer to pick up 4.4.0 stayed on 4.3.6 with the run
+        looking successful. `pipx install` behaves the same way.
+
+        Re-doing the work on every run is the point: the *outcome* is idempotent,
+        which is what Principle VII asks for. Making the run itself a no-op is
+        what produced the silent-no-upgrade.
+        """
+        result = _run(*args, path=fake_path(uv=True))
+        assert result.returncode == 0, result.stderr
+        assert "--force" in result.stdout, (
+            "without --force an existing install is never upgraded, and the run "
+            "still reports success"
+        )
+
+    def test_reports_what_changed(self) -> None:
+        """A version that did not move after an upgrade run is the symptom of the
+        bug above, so the script has to say which version it ended on rather than
+        leaving the reader to infer it."""
+        source = _script()
+        assert "installed_version()" in source
+        assert "nothing changed" in source, "a no-change run must say so"
+        assert "Updated" in source, "a version change must be reported"
 
     def test_final_version_pins_against_pypi(self, fake_path) -> None:
         result = _run("--version", "4.3.6", path=fake_path(uv=True))

remo_cli-4.4.1/tests/unit/test_smoke_test_scope.py

@@ -0,0 +1,137 @@
+"""What the provider smoke tests run on, and why.
+
+These jobs provision real instances, so their triggers are a cost decision as
+much as a coverage one:
+
+- ``aws`` and ``hetzner`` create **billable** cloud resources. They do not run on
+  pull requests.
+- ``incus`` creates a container local to the runner, so it is free beyond runner
+  minutes, and it exercises the same create → configure → destroy path. It *does*
+  run on pull requests, and is what keeps a PR from merging with a broken
+  provisioning path.
+
+Before this split, a change touching only ``cli/main.py`` (PR #226, a Windows
+error message) provisioned an EC2 instance, a Hetzner server and a container —
+about 39 minutes of runner time plus real spend, to prove a string.
+
+The asymmetry between the jobs is deliberate and easy to "tidy up" into
+consistency, which would either restore the cost or drop PR coverage entirely.
+Hence these tests.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+SMOKE_YML = REPO_ROOT / ".github" / "workflows" / "smoke-test.yml"
+
+PAID_PROVIDERS = ["aws", "hetzner"]
+FREE_PROVIDERS = ["incus"]
+
+
+def _job_block(name: str) -> str:
+    """The YAML for one top-level job, up to the next job at the same indent."""
+    lines = SMOKE_YML.read_text(encoding="utf-8").splitlines()
+    start = next((i for i, ln in enumerate(lines) if ln == f"  {name}:"), None)
+    assert start is not None, f"job {name!r} not found in smoke-test.yml"
+
+    block = [lines[start]]
+    for ln in lines[start + 1 :]:
+        if re.fullmatch(r"  [A-Za-z0-9_-]+:", ln):
+            break
+        block.append(ln)
+    return "\n".join(block)
+
+
+def _if_condition(name: str) -> str:
+    """The job's `if:` expression, comments stripped."""
+    block = _job_block(name)
+    match = re.search(r"if: >-\n((?:\s+(?!#).*\n)+)", block)
+    assert match, f"no `if:` block found for job {name!r}"
+    return " ".join(match.group(1).split())
+
+
+def _trigger_paths(event: str) -> list[str]:
+    """The `paths:` list for one `on:` event."""
+    text = SMOKE_YML.read_text(encoding="utf-8")
+    match = re.search(rf"^  {event}:\n(.*?)(?=^  [a-z_]+:$)", text, re.S | re.M)
+    assert match, f"event {event!r} not found"
+    return re.findall(r"^      - '([^']+)'", match.group(1), re.M)
+
+
+class TestPaidProvidersSkipPullRequests:
+    @pytest.mark.parametrize("provider", PAID_PROVIDERS)
+    def test_not_run_on_pull_request(self, provider: str) -> None:
+        """A PR must never provision a billable instance."""
+        assert "github.event_name != 'pull_request'" in _if_condition(provider), (
+            f"the {provider} job would run on pull requests, provisioning a "
+            "billable instance for every PR that touches provider code"
+        )
+
+    @pytest.mark.parametrize("provider", PAID_PROVIDERS)
+    def test_still_runs_elsewhere(self, provider: str) -> None:
+        """Excluding PRs must not exclude push-to-main, the weekly schedule, or a
+        manual dispatch — otherwise the coverage is simply gone."""
+        condition = _if_condition(provider)
+        assert "github.event_name != 'workflow_dispatch'" in condition
+        assert f"github.event.inputs.provider == '{provider}'" in condition
+        # No blanket push/schedule exclusion crept in alongside.
+        assert "github.event_name != 'push'" not in condition
+        assert "github.event_name != 'schedule'" not in condition
+
+    @pytest.mark.parametrize("provider", PAID_PROVIDERS)
+    def test_dependabot_still_excluded(self, provider: str) -> None:
+        assert "github.actor != 'dependabot[bot]'" in _if_condition(provider)
+
+
+class TestFreeProviderCoversPullRequests:
+    @pytest.mark.parametrize("provider", FREE_PROVIDERS)
+    def test_runs_on_pull_request(self, provider: str) -> None:
+        """This is the whole reason the paid ones can skip PRs. If incus also
+        stopped running on PRs, a provisioning regression would reach main
+        unchecked."""
+        assert "github.event_name != 'pull_request'" not in _if_condition(provider), (
+            f"the {provider} job has been excluded from pull requests, leaving "
+            "PRs with no end-to-end provisioning coverage at all"
+        )
+
+    def test_the_local_provider_is_the_one_kept(self) -> None:
+        """incus is free because the container is local to the runner. If that
+        ever changes, this split stops being free and needs revisiting."""
+        block = _job_block("incus")
+        assert "remo incus create" in block
+        assert "runs-on: ubuntu-latest" in block
+
+
+class TestPathFilters:
+    @pytest.mark.parametrize("event", ["pull_request", "push"])
+    def test_web_subtree_is_excluded(self, event: str) -> None:
+        """The web service plays no part in provisioning, so a console-only
+        change should provision nothing."""
+        paths = _trigger_paths(event)
+        assert "!src/remo_cli/web/**" in paths, (
+            f"the {event} trigger still provisions for web-only changes"
+        )
+
+    @pytest.mark.parametrize("event", ["pull_request", "push"])
+    def test_negation_follows_what_it_narrows(self, event: str) -> None:
+        """GitHub evaluates path patterns in order, so a `!` before the broad
+        pattern it narrows has no effect — it would silently do nothing."""
+        paths = _trigger_paths(event)
+        broad = paths.index("src/remo_cli/**")
+        negation = paths.index("!src/remo_cli/web/**")
+        assert negation > broad, (
+            "'!src/remo_cli/web/**' must come AFTER 'src/remo_cli/**' or it is ignored"
+        )
+
+    @pytest.mark.parametrize("event", ["pull_request", "push"])
+    def test_provisioning_relevant_paths_still_trigger(self, event: str) -> None:
+        """The exclusion must stay surgical. Provider logic, shared core, the
+        Ansible layer and dependency changes all affect provisioning."""
+        paths = _trigger_paths(event)
+        for required in ("src/remo_cli/**", "ansible/**", "pyproject.toml", "uv.lock"):
+            assert required in paths, f"{required} no longer triggers smoke tests"

{remo_cli-4.4.0 → remo_cli-4.4.1}/uv.lock

@@ -1039,7 +1039,7 @@ wheels = [
 
 [[package]]
 name = "remo-cli"
-version = "4.4.0"
+version = "4.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "ansible-core" },

remo_cli-4.4.0/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "4.4.0"
-}