splent-cli 1.24.0__tar.gz → 1.25.0__tar.gz

{splent_cli-1.24.0/src/splent_cli.egg-info → splent_cli-1.25.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splent_cli
-Version: 1.24.0
+Version: 1.25.0
 Summary: SPLENT-CLI is a CLI to be able to work on your development more easily.
 Author-email: DiversoLab <diversolab@us.es>
 Project-URL: Homepage, https://github.com/diverso-lab/splent_cli
@@ -14,7 +14,7 @@ Requires-Dist: packaging>=24.0
 Requires-Dist: python-dotenv>=1.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: requests>=2.31.0
-Requires-Dist: splent_framework<2,>=1.15.0
+Requires-Dist: splent_framework<2,>=1.15.1
 Requires-Dist: tomli_w>=1.0.0
 Provides-Extra: dev
 Requires-Dist: setuptools==80.3.1; extra == "dev"

{splent_cli-1.24.0 → splent_cli-1.25.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "splent_cli"
-version = "1.24.0"
+version = "1.25.0"
 description = "SPLENT-CLI is a CLI to be able to work on your development more easily."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -24,7 +24,7 @@ dependencies = [
     "requests>=2.31.0",
     # The CLI drives the framework (paths, feature order, migrations, the
     # app factory) and only works with the same major version of it.
-    "splent_framework>=1.15.0,<2",
+    "splent_framework>=1.15.1,<2",
     "tomli_w>=1.0.0",
 ]
 

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/check/check_features.py

@@ -11,6 +11,8 @@ import tomllib
 
 from splent_cli.services import context
 from splent_cli.utils.feature_utils import normalize_namespace, read_features_from_data
+from splent_cli.utils.lifecycle import state_rank
+from splent_cli.utils.manifest import feature_key, get_feature_state
 
 
 def _pkg_installed(name: str) -> bool:
@@ -125,11 +127,17 @@ def check_features():
         else:
             _fail("No symlink in product/features/")
 
-        # 3. Pip install
-        if _pkg_installed(name):
+        # 3. Pip install. Features are installed in the product's web
+        # container, not in the CLI's, so the manifest the install script
+        # updates is what says so. Checking this interpreter alone flagged
+        # every feature of a running product as not installed.
+        state = get_feature_state(product_path, feature_key(org_safe, name, version))
+        if state_rank(state) >= state_rank("installed"):
+            _ok(f"Installed in the product container ({state})")
+        elif _pkg_installed(name):
             _ok("pip installed")
         else:
-            _warn("Not pip-installed (run product:run to install)")
+            _warn("Not installed yet (product:derive installs it)")
 
         # 4. Git state (editable only)
         if not version:

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/check/check_github.py

@@ -1,4 +1,3 @@
-import os
 import urllib.request
 import urllib.error
 import json
@@ -7,32 +6,29 @@ import click
 from splent_cli.utils import forge
 
 
-@click.command(
-    "check:github",
-    short_help="Verify forge credentials from .env (GITHUB_USER / forge token)",
-)
-def check_github():
-    # The command keeps its name, but the forge it checks is whatever the
-    # workspace is configured against: github.com by default, a self-hosted
-    # Forgejo when SPLENT_FORGE_HOST says so.
+def _check_forge():
+    # The forge checked is whatever the workspace is configured against:
+    # git.splent.io by default, another Forgejo, Gitea or github.com when
+    # SPLENT_FORGE_HOST says so.
     forge_host = forge.host()
     token_var = forge.token_env_name()
+    user_var = forge.user_env_name()
 
     click.echo(click.style(f"\n{forge_host} Credentials Check\n", fg="cyan", bold=True))
 
-    user = os.getenv("GITHUB_USER", "").strip()
+    user = (forge.user() or "").strip()
     # Resolved through forge so a self-hosted forge reads SPLENT_FORGE_TOKEN
     # while GitHub keeps reading GITHUB_TOKEN, as it always has.
     token = (forge.token() or "").strip()
 
     # --- presence checks ---
     if not user:
-        click.echo(click.style("[✖] ", fg="red") + "GITHUB_USER not set in .env")
+        click.echo(click.style("[✖] ", fg="red") + f"{user_var} not set in .env")
         click.secho(
             "   Run 'splent tokens:setup' for setup instructions.", fg="bright_black"
         )
         raise SystemExit(1)
-    click.echo(click.style("[✔] ", fg="green") + f"GITHUB_USER = {user}")
+    click.echo(click.style("[✔] ", fg="green") + f"{user_var} = {user}")
 
     if not token:
         click.echo(click.style("[✖] ", fg="red") + f"{token_var} not set in .env")
@@ -98,7 +94,7 @@ def check_github():
     if api_login.lower() != user.lower():
         click.echo(
             click.style("[⚠] ", fg="yellow")
-            + f"Token belongs to '{api_login}', but GITHUB_USER is '{user}'"
+            + f"Token belongs to '{api_login}', but {user_var} is '{user}'"
         )
     else:
         click.echo(click.style("[✔] ", fg="green") + f"Authenticated as {api_login}")
@@ -123,4 +119,22 @@ def check_github():
     click.secho(f"Credentials for {forge_host} OK.", fg="green")
 
 
-cli_command = check_github
+@click.command(
+    "check:forge",
+    short_help="Verify the git forge credentials (SPLENT_FORGE_USER / token).",
+)
+def check_forge():
+    """Check that the forge user and token in .env work against the forge's
+    API (git.splent.io unless SPLENT_FORGE_HOST says otherwise)."""
+    _check_forge()
+
+
+# The name it had while the features lived on github.com. Kept so scripts and
+# older docs keep working, but out of the help listing.
+@click.command("check:github", hidden=True)
+def check_github():
+    """Alias of check:forge."""
+    _check_forge()
+
+
+cli_commands = [check_forge, check_github]

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/check/check_releases.py

@@ -1,5 +1,5 @@
 """
-check:releases — Report GitHub/PyPI divergence across the workspace.
+check:releases — Report forge/PyPI divergence across the workspace.
 
 Answers, without anyone having to read a published index by hand, the two
 questions a two-channel release can go wrong in:
@@ -28,6 +28,7 @@ import click
 
 from splent_cli.services import context, registry, release_gate
 from splent_cli.services.release import extract_repo, read_project_name
+from splent_cli.utils import forge
 
 
 CORE_PACKAGES = ("splent_cli", "splent_framework")
@@ -142,7 +143,7 @@ def discover_packages(
 
 @click.command(
     "check:releases",
-    short_help="Report GitHub/PyPI divergence for every package in the workspace.",
+    short_help="Report forge/PyPI divergence for every package in the workspace.",
 )
 @click.option("--feature", "only", default=None, help="Check one package by name.")
 @click.option(
@@ -168,7 +169,7 @@ def discover_packages(
 def check_releases(only, include_core, include_products, divergent_only):
     """Compare git tags against PyPI releases for the whole workspace."""
     workspace = str(context.workspace())
-    token = os.getenv("GITHUB_TOKEN")
+    token = forge.token()
 
     packages = discover_packages(
         workspace,
@@ -224,12 +225,12 @@ def check_releases(only, include_core, include_products, divergent_only):
 
         org, repo_name = repo.split("/", 1)
         wants_pypi = release_gate.PYPI in channels
-        wants_github = release_gate.GITHUB in channels
+        wants_github = release_gate.FORGE in channels
 
         try:
             tags = registry.list_semver_tags(org, repo_name, token, quiet=False)
         except registry.RegistryError as e:
-            reason = _reason(e, "GitHub")
+            reason = _reason(e, "the forge")
             unanswered.append((name, reason))
             click.echo(click.style("  [!] ", fg="yellow") + f"{name}: {reason}")
             continue
@@ -249,7 +250,7 @@ def check_releases(only, include_core, include_products, divergent_only):
             try:
                 release_tags = registry.list_release_tags(org, repo_name, token)
             except registry.RegistryError as e:
-                reason = _reason(e, "GitHub") + " when listing releases"
+                reason = _reason(e, "the forge") + " when listing releases"
                 unanswered.append((name, reason))
                 click.echo(click.style("  [!] ", fg="yellow") + f"{name}: {reason}")
                 continue
@@ -277,7 +278,7 @@ def check_releases(only, include_core, include_products, divergent_only):
             if missing:
                 tag_without_release.append((name, missing))
                 problems.append(
-                    f"{len(missing)} tag(s) with no GitHub release: "
+                    f"{len(missing)} tag(s) with no release on the forge: "
                     + ", ".join(missing[:6])
                     + (" ..." if len(missing) > 6 else "")
                 )
@@ -290,7 +291,7 @@ def check_releases(only, include_core, include_products, divergent_only):
             if not wants_pypi:
                 click.echo(
                     click.style("  [OK] ", fg="green")
-                    + f"{name}: github only by declaration, {len(tags)} tag(s)"
+                    + f"{name}: forge only by declaration, {len(tags)} tag(s)"
                 )
             elif not tags and not pypi_versions:
                 click.echo(
@@ -310,7 +311,8 @@ def check_releases(only, include_core, include_products, divergent_only):
     if not total and not unanswered:
         checked = len(packages) - len(no_remote)
         click.secho(
-            f"  GitHub and PyPI agree for all {checked} package(s) checked.", fg="green"
+            f"  The forge and PyPI agree for all {checked} package(s) checked.",
+            fg="green",
         )
         if no_remote:
             click.secho(
@@ -320,7 +322,8 @@ def check_releases(only, include_core, include_products, divergent_only):
         click.echo()
         if not token:
             click.secho(
-                "  Set GITHUB_TOKEN to avoid rate limits on this command.", fg="yellow"
+                f"  Set {forge.token_env_name()} to avoid rate limits on this command.",
+                fg="yellow",
             )
             click.echo()
         return
@@ -358,7 +361,7 @@ def check_releases(only, include_core, include_products, divergent_only):
 
     if tag_without_release:
         click.secho(
-            f"  {len(tag_without_release)} package(s) tagged with no GitHub release",
+            f"  {len(tag_without_release)} package(s) tagged with no release on the forge",
             fg="red",
             bold=True,
         )
@@ -384,7 +387,8 @@ def check_releases(only, include_core, include_products, divergent_only):
 
     if not token:
         click.secho(
-            "  Set GITHUB_TOKEN to avoid rate limits on this command.", fg="yellow"
+            f"  Set {forge.token_env_name()} to avoid rate limits on this command.",
+            fg="yellow",
         )
         click.echo()
 

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/database/db_migrate.py

@@ -61,6 +61,22 @@ def _format_migration(path: str) -> None:
     subprocess.run([ruff, "format", "--quiet", path], check=False)
 
 
+def _hand_to_directory_owner(path: str) -> None:
+    """Give a generated migration the owner of the directory it lands in.
+
+    The CLI runs as root inside its container, so Alembic wrote the file as
+    root:root 0644. On the host that is a file the user cannot save, and a
+    blank ``--empty`` migration exists precisely to be edited by hand.
+    """
+    if not (hasattr(os, "geteuid") and os.geteuid() == 0):
+        return
+    try:
+        st = os.stat(os.path.dirname(path))
+        os.chown(path, st.st_uid, st.st_gid)
+    except OSError:
+        pass
+
+
 @requires_db
 @click.command(
     "db:migrate",
@@ -190,6 +206,7 @@ def db_migrate(feature, message, empty):
         if empty:
             if newest:
                 _format_migration(newest)
+                _hand_to_directory_owner(newest)
                 click.echo(
                     click.style(
                         f"  📝 {feat}: blank migration generated — "
@@ -208,6 +225,7 @@ def db_migrate(feature, message, empty):
                 click.echo(click.style(f"  ✔ {feat}: up to date", fg="green"))
             else:
                 _format_migration(newest)
+                _hand_to_directory_owner(newest)
                 click.echo(
                     click.style(f"  📝 {feat}: new migration generated", fg="cyan")
                 )

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/database/db_reset.py

@@ -114,6 +114,7 @@ def _entry_lookup() -> dict:
 @click.argument("feature_name", required=False)
 @click.option("-y", "--yes", is_flag=True, help="Confirm without prompting.")
 @context.requires_product
+@context.refuses_production
 def db_reset(feature_name, yes):
     """Reset the database.
 

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/database/db_rollback.py

@@ -69,6 +69,7 @@ def _find_dependents(feature: str, product_dir: str) -> list[str]:
 )
 @click.option("--cascade", is_flag=True, help="Also rollback dependent features.")
 @context.requires_product
+@context.refuses_production
 def db_rollback(feature, steps, cascade):
     app = current_app
     product_path = PathUtils.get_app_base_dir()

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/database/db_seed.py

@@ -177,6 +177,7 @@ def _truncate_data():
 @click.option("-y", "--yes", is_flag=True, help="Skip confirmation prompts.")
 @click.argument("module", required=False)
 @context.requires_product
+@context.refuses_production
 def db_seed(reset, yes, module):
     if reset:
         if yes or click.confirm(

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/doctor.py

@@ -12,7 +12,7 @@ from splent_cli.commands.check.check_env import check_env
 from splent_cli.commands.check.check_pyproject import check_pyproject
 from splent_cli.commands.check.check_features import check_features
 from splent_cli.commands.check.check_docker import check_docker
-from splent_cli.commands.check.check_github import check_github
+from splent_cli.commands.check.check_github import check_forge
 from splent_cli.commands.check.check_pypi import check_pypi
 from splent_cli.commands.check.check_infra import check_infra
 from splent_cli.commands.check.check_product import check_product
@@ -49,7 +49,7 @@ SECTIONS = [
     (
         "Credentials",
         [
-            ("check:github", check_github, False, True),
+            ("check:forge", check_forge, False, True),
             ("check:pypi", check_pypi, False, True),
         ],
     ),
@@ -110,10 +110,10 @@ def doctor(fast):
       Environment   — Python, env vars, pyproject, Docker, infrastructure
       Product       — product health, feature cache/symlinks, feature status
       Services      — containers, database migrations
-      Credentials   — GitHub and PyPI tokens (skipped with --fast)
+      Credentials   — git forge and PyPI tokens (skipped with --fast)
 
     \b
-    Use --fast to skip network checks (GitHub, PyPI) and database checks.
+    Use --fast to skip network checks (git forge, PyPI) and database checks.
 
     \b
     For full product validation (UVL + contracts + imports), run:

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/env/env_set.py

@@ -1,5 +1,6 @@
 import click
 from splent_cli.services import context
+from splent_cli.utils import forge
 
 
 # -------------------------
@@ -67,16 +68,19 @@ def set_mode_interactive():
 
 
 def set_github_interactive():
-    user = click.prompt("GitHub username", type=str)
-    token = click.prompt("GitHub personal access token", hide_input=True)
+    """Ask for the forge user and token and store them under the variables
+    this forge reads (SPLENT_FORGE_* on git.splent.io, GITHUB_* on github.com)."""
+    host = forge.host()
+    user = click.prompt(f"{host} username", type=str)
+    token = click.prompt(f"{host} access token", hide_input=True)
 
-    user = _validate_env_value(user, "GitHub username")
-    token = _validate_env_value(token, "GitHub token")
+    user = _validate_env_value(user, f"{host} username")
+    token = _validate_env_value(token, f"{host} token")
 
-    set_var("GITHUB_USER", user)
-    set_var("GITHUB_TOKEN", token)
+    set_var(forge.user_env_name(), user)
+    set_var(forge.token_env_name(), token)
 
-    click.secho("✔ GitHub configuration updated.", fg="green")
+    click.secho(f"✔ {host} configuration updated.", fg="green")
     remind_source()
 
 
@@ -124,8 +128,15 @@ def env_set_mode():
     set_mode_interactive()
 
 
-@env_set_group.command("github")
+@env_set_group.command("forge")
+def env_set_forge():
+    """Set the git forge user and token."""
+    set_github_interactive()
+
+
+@env_set_group.command("github", hidden=True)
 def env_set_github():
+    """Alias of `env:set forge`."""
     set_github_interactive()
 
 
@@ -143,7 +154,7 @@ def run_wizard():
     while True:
         click.echo("\n=== SPLENT ENV CONFIG WIZARD ===")
         click.echo("1. Set mode (dev/prod)")
-        click.echo("2. Configure GitHub credentials")
+        click.echo("2. Configure git forge credentials")
         click.echo("3. Configure PyPI token")
         click.echo("4. Exit")
         click.echo("--------------------------------")

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/feature/feature_attach.py

@@ -10,7 +10,9 @@ from splent_cli.utils.feature_utils import (
     product_namespace_spelling,
     prune_feature_links,
     read_feature_list,
+    read_project_name,
     remove_feature_link,
+    set_feature_distribution,
     write_features_to_data,
 )
 from splent_cli.utils.io_utils import load_toml, atomic_write
@@ -147,6 +149,18 @@ def feature_attach(feature_identifier, version, env_scope):
         scope_label = f" ({env_scope} only)" if env_scope else ""
         click.echo(f"  {short}@{version} attached{scope_label}")
 
+    # ── PyPI name, when it is not the feature's own ──────────────────
+    # The production image installs pinned features from PyPI, so it has to
+    # know the name this version was published under. A release under a name
+    # of one's own (splent-feature-notes-alice) keeps the import package, and
+    # this pin, as splent_feature_notes.
+    distribution = read_project_name(versioned_dir)
+    data = load_toml(pyproject_path, what="pyproject.toml")
+    if set_feature_distribution(data, feature_name, distribution):
+        atomic_write(pyproject_path, tomli_w.dumps(data))
+        if distribution and distribution != feature_name:
+            click.echo(f"  pypi     {short} is published on PyPI as {distribution}")
+
     # ── Create/update symlink ─────────────────────────────────────────
     product_features_dir = os.path.join(product_path, "features", namespace_fs)
     os.makedirs(product_features_dir, exist_ok=True)

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/feature/feature_contract.py

@@ -22,6 +22,7 @@ from pathlib import Path
 from splent_cli.services import context
 from splent_cli.commands.feature.feature_release import infer_contract, write_contract
 from splent_cli.utils.feature_utils import normalize_namespace
+from splent_cli.utils.contract_freshness import mark_contract_fresh
 from splent_cli.utils.io_utils import load_toml
 
 
@@ -351,6 +352,8 @@ def feature_contract(feature_ref, write):
 
     if not has_changes:
         click.secho("  ✅ Contract is already up to date.", fg="green")
+        if write:
+            mark_contract_fresh(str(cache_path))
         # Reported here too: a settings gap has nothing to do with whether
         # the contract changed, and an up to date contract is exactly when
         # nobody would think to look.

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/feature/feature_create.py

@@ -58,6 +58,10 @@ def _build_file_map(feature_type, short_name, docker=False):
     base_common = {
         ".gitignore": f"{T}feature_.gitignore.j2",
         "MANIFEST.in": f"{T}feature_MANIFEST.in.j2",
+        # pyproject.toml names it as the readme, and the package build reads
+        # it as the long description PyPI shows. Without the file the build
+        # warned and the published page was blank.
+        "README.md": f"{T}feature_README.md.j2",
     }
 
     if feature_type == "full":

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/feature/feature_detach.py

@@ -9,6 +9,7 @@ from splent_cli.utils.feature_utils import (
     parse_feature_entry,
     read_feature_list,
     remove_feature_link,
+    set_feature_distribution,
     write_features_to_data,
 )
 from splent_cli.utils.io_utils import load_toml, atomic_write
@@ -108,6 +109,8 @@ def feature_detach(feature_identifier, version, force):
             changed = True
 
     if changed:
+        # Back to the editable checkout, which is never installed from PyPI.
+        set_feature_distribution(data, feature_name, None)
         atomic_write(pyproject_path, tomli_w.dumps(data))
 
     click.echo(f"  {short}@{version} removed from pyproject.toml")

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/feature/feature_fork.py

@@ -24,11 +24,12 @@ def _forge_label() -> str:
 )
 def feature_fork(feature_name, version):
     token = forge.token()
-    github_user = os.getenv("GITHUB_USER")
+    github_user = forge.user()
 
     if not token or not github_user:
         click.secho(
-            f"✖ Error: {forge.token_env_name()} and GITHUB_USER must be set", fg="red"
+            f"✖ Error: {forge.token_env_name()} and {forge.user_env_name()} must be set",
+            fg="red",
         )
         raise SystemExit(1)
 

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/feature/feature_pip_install.py

@@ -28,6 +28,10 @@ Three things about this are worth stating plainly rather than discovering:
   * the summary says which features came from which channel. An image built
     from git tags is reproducible, but you should know that is what you have.
 
+A feature published on PyPI under a name of its own (its [project].name is
+not its directory name) is listed in [tool.splent.distributions], which
+feature:attach writes, and is installed by that name.
+
 Example:
     splent-io/splent_feature_auth@v1.2.7  ->  pip install splent_feature_auth==1.2.7
                                           ->  or git+https://github.com/…@v1.2.7
@@ -41,6 +45,7 @@ import click
 import tomllib
 
 from splent_cli.services import context
+from splent_cli.utils.feature_utils import feature_distribution
 from splent_cli.utils.git_url import https_url, namespace_spellings
 from splent_cli.utils.proc import run
 
@@ -100,7 +105,9 @@ def _pypi_does_not_have_it(output: str) -> bool:
     )
 
 
-def _git_candidates(namespace: str, name: str, ref: str) -> list[tuple[str, str]]:
+def _git_candidates(
+    namespace: str, name: str, ref: str, dist: str | None = None
+) -> list[tuple[str, str]]:
     """Ordered (real, display) pip requirements for the tag, one per spelling.
 
     The entry carries the Python namespace (``splent_io``) while the repo
@@ -110,7 +117,9 @@ def _git_candidates(namespace: str, name: str, ref: str) -> list[tuple[str, str]
     candidates = []
     for spelling in namespace_spellings(namespace):
         real, display = https_url(spelling, name)
-        candidates.append((f"{name} @ git+{real}@{ref}", f"git+{display}@{ref}"))
+        candidates.append(
+            (f"{dist or name} @ git+{real}@{ref}", f"git+{display}@{ref}")
+        )
     return candidates
 
 
@@ -190,7 +199,8 @@ def feature_pip_install(pypi_only):
     from_git = []
     for entry in features:
         namespace, name, version, ref = _parse_feature_entry(entry)
-        spec = f"{name}=={version}" if version else name
+        dist = feature_distribution(data, name)
+        spec = f"{dist}=={version}" if version else dist
         if not version:
             unpinned.append(name)
 
@@ -216,7 +226,7 @@ def feature_pip_install(pypi_only):
             fg="yellow",
         )
         git_output = ""
-        for real_spec, display_spec in _git_candidates(namespace, name, ref):
+        for real_spec, display_spec in _git_candidates(namespace, name, ref, dist):
             ok, git_output = _pip_install(real_spec)
             if ok:
                 click.echo(f"  ok {display_spec}")

{splent_cli-1.24.0 → splent_cli-1.25.0}/src/splent_cli/commands/feature/feature_refine.py

@@ -14,7 +14,12 @@ import click
 
 from splent_cli.services import context
 from splent_cli.utils.feature_utils import normalize_namespace, read_features_from_data
-from splent_cli.utils.io_utils import atomic_write, backup_file, load_toml
+from splent_cli.utils.io_utils import (
+    atomic_write,
+    backup_file,
+    give_tree_to_its_owner,
+    load_toml,
+)
 
 
 DEFAULT_NAMESPACE = os.getenv("SPLENT_DEFAULT_NAMESPACE", "splent_io")
@@ -1040,6 +1045,10 @@ def feature_refinement(refiner_name):
     except Exception:
         pass
 
+    # Everything above ran as root in the CLI container. templates/hooks/ was
+    # left root's, and Tutorial 7 asks the reader to add files to it.
+    give_tree_to_its_owner(refiner_path)
+
     # ── Register the refinement in the active product ───────────────
     # A refinement only takes effect once the feature is part of the product
     # (migrations, composition, feature:xray). Add it now so the user does not