splent-cli 1.49.0__tar.gz → 1.50.0__tar.gz

{splent_cli-1.49.0/src/splent_cli.egg-info → splent_cli-1.50.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splent_cli
-Version: 1.49.0
+Version: 1.50.0
 Summary: SPLENT-CLI is a CLI to be able to work on your development more easily.
 Author-email: DiversoLab <diversolab@us.es>
 License-Expression: LGPL-3.0-or-later
@@ -16,7 +16,7 @@ Requires-Dist: packaging>=24.0
 Requires-Dist: python-dotenv>=1.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: requests>=2.31.0
-Requires-Dist: splent_framework<2,>=1.22.0
+Requires-Dist: splent_framework<2,>=1.30.0
 Requires-Dist: tomli_w>=1.0.0
 Provides-Extra: dev
 Requires-Dist: setuptools==80.3.1; extra == "dev"

{splent_cli-1.49.0 → splent_cli-1.50.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "splent_cli"
-version = "1.49.0"
+version = "1.50.0"
 description = "SPLENT-CLI is a CLI to be able to work on your development more easily."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -12,10 +12,6 @@ authors = [{ name = "DiversoLab", email = "diversolab@us.es" }]
 license = "LGPL-3.0-or-later"
 license-files = ["COPYING", "COPYING.LESSER"]
 
-# Everything the CLI imports at module level must be listed here (or come
-# with splent_framework, see tests/unit/test_declared_dependencies.py):
-# startup imports every command module, so one undeclared import breaks
-# `splent --help` on a clean `pip install splent_cli`.
 dependencies = [
     "click==8.1.8",
     "jinja2>=3.1",
@@ -23,15 +19,7 @@ dependencies = [
     "python-dotenv>=1.0",
     "pyyaml>=6.0",
     "requests>=2.31.0",
-    # The CLI drives the framework (paths, feature order, migrations, the
-    # app factory) and only works with the same major version of it. 1.22.0
-    # brings splent_framework.params, the [tool.splent.config_schema] reader
-    # product:validate, product:env and product:build share with the boot;
-    # 1.18.0 resolves a feature to the copy feature:test names
-    # (SPLENT_FEATURE_SOURCES) and brings the production defaults the deploy
-    # templates explain; 1.17.0 the refinement rules product:validate shares
-    # with the boot.
-    "splent_framework>=1.22.0,<2",
+    "splent_framework>=1.30.0,<2",
     "tomli_w>=1.0.0",
 ]
 
@@ -76,10 +64,6 @@ package-dir = { "" = "src" }
 [tool.setuptools.packages.find]
 where = ["src"]
 
-# The templates product:create, feature:create and the rest render. They are
-# data, not modules, so without this a wheel from PyPI shipped none of them.
-# The build context of the frontend toolchain image too, so a CLI installed
-# from PyPI can build the image a feature with frontend/ builds in.
 [tool.setuptools.package-data]
 splent_cli = ["templates/**/*", "toolchain/**/*"]
 
@@ -87,9 +71,6 @@ splent_cli = ["templates/**/*", "toolchain/**/*"]
 testpaths = ["tests"]
 pythonpath = ["src"]
 
-# Canonical formatter/linter is Ruff (`splent lint` runs `ruff check` +
-# `ruff format`). Ruff's default line length (88) is the project standard;
-# set explicitly here so it is unambiguous.
 [tool.ruff]
 line-length = 88
 

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/check/check_infra.py

@@ -366,7 +366,7 @@ def check_infra():
 
     data = load_toml(pyproject_path, what="pyproject.toml")
 
-    env = os.getenv("SPLENT_ENV", "dev")
+    env = context.resolve_env()
     features = read_features_from_data(data, env)
 
     # Every compose file is read through the product's merged .env, the same one

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/clear/clear_uploads.py

@@ -32,6 +32,13 @@ _SYSTEM_DIRS = {
     "/tmp",
     "/usr",
     "/var",
+    # macOS: its own top level, and /private, where /etc, /tmp and /var lead.
+    "/Applications",
+    "/Library",
+    "/System",
+    "/Users",
+    "/Volumes",
+    "/private",
 }
 
 # What a directory of code has at its top and a directory of uploads never
@@ -77,6 +84,12 @@ def _configured_dir(app) -> str:
     return os.getenv("PROTECTED_UPLOADS_DIR", "").strip()
 
 
+def _system_dirs() -> set:
+    """The system directories, and where each leads: on macOS /etc is a link
+    to /private/etc, which the realpath of a configured /etc gives."""
+    return _SYSTEM_DIRS | {os.path.realpath(path) for path in _SYSTEM_DIRS}
+
+
 def _refuse(path: str, real: str, why: str):
     shown = path if path == real else f"{path} (resolves to {real})"
     raise UploadsDirError(f"{shown} {why}. Nothing was deleted.")
@@ -124,7 +137,7 @@ def resolve_uploads_dir(app=None) -> str:
         )
 
     real = os.path.realpath(uploads_dir)
-    if real == os.sep or real in _SYSTEM_DIRS:
+    if real == os.sep or real in _system_dirs():
         _refuse(uploads_dir, real, "is a system directory")
     if real == os.path.realpath(os.path.expanduser("~")):
         _refuse(uploads_dir, real, "is the home directory")

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/feature/feature_compat.py

@@ -735,7 +735,7 @@ def run_all_product_check(
     if not labeled_paths:
         return []
     if env is None:
-        env = os.getenv("SPLENT_ENV") or "dev"
+        env = context.resolve_env()
     labeled_contracts = [(lbl, _read_contract(path)) for lbl, path in labeled_paths]
     findings = _analyse_all(labeled_contracts) + version_floor_findings(
         labeled_paths

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/feature/feature_compile.py

@@ -1,4 +1,5 @@
 import dataclasses
+import hashlib
 import logging
 import os
 import posixpath
@@ -553,6 +554,31 @@ def _find_webpack(workspace, product, org_safe, base_name, version):
     return None
 
 
+def _one_watcher(webpack_file: str, product_root: str, shell_cmd: str) -> str:
+    """The shell line that watches ``webpack_file`` and stops its watcher
+    before, where webpack runs.
+
+    Each start of a product in development (product:run --dev) compiles
+    with --watch again, and a watcher used to outlive the one that started
+    it: eight starts left eight generations of npm, sh and webpack, 2.4 GB
+    of a 7.8 GB Docker VM. The watcher now runs in a session of its own
+    (setsid), whose id it leaves in a file named after its bundle, and the
+    next start ends that whole group first, if it is still a webpack one.
+    """
+    folder = "/tmp/splent-watch-$(id -u)"
+    name = hashlib.sha1(webpack_file.encode()).hexdigest()[:16]
+    pidfile = f"{folder}/{name}.pid"
+    inner = f'echo $$ > "{pidfile}"; exec {shell_cmd}'
+    return (
+        f'mkdir -p "{folder}"; '
+        f'if [ -f "{pidfile}" ]; then '
+        f'old="$(cat "{pidfile}")"; '
+        f'if grep -qa webpack "/proc/$old/cmdline" 2>/dev/null; then '
+        f'kill -TERM -- "-$old" 2>/dev/null || true; fi; fi; '
+        f"cd {shlex.quote(product_root)} && exec setsid bash -c {shlex.quote(inner)}"
+    )
+
+
 def _compile_in_container(
     container_id,
     feature,
@@ -645,6 +671,8 @@ def _compile_in_container(
 
     shell_cmd = " ".join(shlex.quote(p) for p in cmd_parts)
     cd_cmd = f"cd {shlex.quote(product_root)} && {shell_cmd}"
+    if watch and not production:
+        cd_cmd = _one_watcher(webpack_file, product_root, shell_cmd)
 
     # Inside a container: run webpack directly.
     # From the host: run via `docker exec` so webpack uses the container's

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/feature/feature_install.py

@@ -230,7 +230,7 @@ def feature_install(feature_identifier, env_scope, mode, version):
     """
     product = context.require_app()
     workspace = str(context.workspace())
-    env_name = os.getenv("SPLENT_ENV", "dev")
+    env_name = context.resolve_env()
 
     # ── Parse identifier ──────────────────────────────────────────────
     namespace, namespace_github, namespace_fs, feature_name = (

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/feature/feature_release.py

@@ -1505,8 +1505,14 @@ def _local_strings(function, names: dict[str, str]) -> dict[str, str]:
     return found
 
 
+#: The framework's lookups of a module whose feature the product may not have
+#: (splent_framework.optional): what they name is always an optional feature.
+_OPTIONAL_LOOKUPS = ("optional_module", "optional_attr")
+
+
 def _import_module_calls(tree, constants: dict[str, str]):
     """``(call, names)`` for every ``importlib.import_module`` call of TREE,
+    and every call of the framework's ``optional_module``/``optional_attr``,
     NAMES being what its module may be spelled through: the module's string
     constants, and the names the function around the call binds."""
 
@@ -1515,9 +1521,9 @@ def _import_module_calls(tree, constants: dict[str, str]):
             if isinstance(child, (ast.FunctionDef, ast.AsyncFunctionDef)):
                 yield from visit(child, {**names, **_local_strings(child, names)})
                 continue
-            if isinstance(child, ast.Call) and _call_name(child) in (
-                "import_module",
-                "importlib.import_module",
+            if isinstance(child, ast.Call) and (
+                _call_name(child) in ("import_module", "importlib.import_module")
+                or _call_name(child).rsplit(".", 1)[-1] in _OPTIONAL_LOOKUPS
             ):
                 yield child, names
             yield from visit(child, names)
@@ -1583,8 +1589,9 @@ def _presence_guards(
 def _extract_dynamic_imports(
     src_dir: Path, own_feature_name: str
 ) -> tuple[set[str], set[str]]:
-    """Other features imported by name with ``importlib.import_module``,
-    split into ``(hard, soft)`` short names.
+    """Other features imported by name with ``importlib.import_module``, or
+    looked up with the framework's ``optional_module``/``optional_attr``
+    (always soft), split into ``(hard, soft)`` short names.
 
     A feature that wants another one only when the product has it imports
     it by name inside a ``try`` whose handler catches ``ImportError`` (or
@@ -1610,9 +1617,12 @@ def _extract_dynamic_imports(
             module = _spelled_module(node.args[0], names) if node.args else None
             if not module:
                 continue
+            looked_up = _call_name(node).rsplit(".", 1)[-1] in _OPTIONAL_LOOKUPS
             for short in _named_features(module, own_feature_name):
-                optional = _in_ranges(node.lineno, ranges) or _in_ranges(
-                    node.lineno, present.get(short, ())
+                optional = (
+                    looked_up
+                    or _in_ranges(node.lineno, ranges)
+                    or _in_ranges(node.lineno, present.get(short, ()))
                 )
                 (soft if optional else hard).add(short)
     return hard, soft - hard
@@ -1890,6 +1900,11 @@ def infer_contract(
     docker = _extract_docker(feature_root)
     docker_contract = _extract_docker_contract(feature_root)
     req_features, env_vars = _scan_dependencies(src_dir, feature_name)
+    # A key declared in [tool.splent.config_schema] is read from the
+    # environment by the framework on the feature's behalf, with no
+    # os.getenv left in its code to find: it is as much an environment
+    # variable of the feature as one it reads itself.
+    env_vars = sorted(set(env_vars) | declared_param_keys(feature_root))
     # And the settings it reads from app.config, which are as much its
     # parameters as what it reads from the environment, but are not
     # environment variables: check:product requires every env_var, and a
@@ -2088,8 +2103,8 @@ def _contract_comments(region: str) -> dict:
     ``{(table, key): (lines above, inline comment)}``, where ``key`` is None
     for the comments above a subtable's header. The contract is written
     again from the source, so the comments go with what they are about: the
-    key under or after them in the same table. The banner above
-    ``[tool.splent.contract]`` is the writer's own and is written anyway.
+    key under or after them in the same table. The banner earlier writers
+    put above ``[tool.splent.contract]`` is not kept.
     """
     comments: dict = {}
     table = None
@@ -2333,13 +2348,6 @@ def write_contract(pyproject_path: str, contract: dict, feature_name: str) -> No
 
     contract_block = (
         "\n\n"
-        "# ── Feature Contract (auto-generated) ────────────────────────────────────────\n"
-        "# Run `splent feature:contract --write` to refresh it from the source.\n"
-        "# A refresh keeps description, category, tags, env,\n"
-        "# requires.features_manual (dependencies invisible to static analysis),\n"
-        "# requires.features_optional (what the scan infers is added to it)\n"
-        "# and provides.routes_manual (routes built from configuration at\n"
-        "# registration time, which have no literal path to find in source).\n"
         "[tool.splent.contract]\n"
         f"description = {_toml_value(existing_description)}\n"
         + (
@@ -2954,6 +2962,9 @@ def feature_release(
     _refuse_invalid_requirements(feature_path, namespace, feature_name)
     # A migration no database can record, refused the same way.
     _refuse_long_revision_ids(feature_path, feature_name)
+    # SQL or markup built from a variable string, and a template that runs
+    # inline code, refused the same way.
+    _refuse_security_findings(feature_path, feature_name)
 
     release.confirm_single_channel(channels, no_forge=no_forge, no_pypi=no_pypi)
 
@@ -3209,6 +3220,31 @@ def _refuse_long_revision_ids(feature_path, feature_name) -> None:
     raise SystemExit(1)
 
 
+def _refuse_security_findings(feature_path, feature_name) -> None:
+    """Stop the release, before it changes anything, when the feature's
+    sources build SQL or markup from a variable string, render a template
+    from one, or have a template that escapes nothing or runs inline code
+    (splent_cli.services.security_scan). --skip-checks does not skip it.
+    """
+    from splent_cli.services import security_scan
+
+    findings = security_scan.scan_feature(feature_path)
+    if not findings:
+        return
+    click.echo()
+    click.secho(
+        f"  error: {feature_name} has {len(findings)} SQL or XSS sink(s) the "
+        "toolchain refuses, so the release did not start.",
+        fg="red",
+    )
+    security_scan.echo_findings(findings)
+    click.echo(
+        f"  {security_scan.ALLOW_HINT}\n"
+        "  Nothing was changed. No version bump, no commit, no tag, no release."
+    )
+    raise SystemExit(1)
+
+
 def _interactive() -> bool:
     """Whether someone can answer a prompt on stdin."""
     import sys

splent_cli-1.50.0/src/splent_cli/commands/feature/feature_security.py

@@ -0,0 +1,114 @@
+"""
+feature:security, the SQL and XSS sinks of one feature or of every one.
+
+The scan is splent_cli.services.security_scan, the one product:validate
+runs in its Security phase and feature:release runs before it changes
+anything.
+"""
+
+from pathlib import Path
+
+import click
+
+from splent_cli.services import context, security_scan
+from splent_cli.utils.feature_resolution import resolve_feature_ref
+from splent_cli.utils.feature_utils import editable_feature_dirs
+
+
+def _targets(workspace: Path, identifiers) -> list[tuple[str, Path]]:
+    """``(name, root)`` of each feature to scan: the ones named, else every
+    editable feature at the workspace root."""
+    if not identifiers:
+        return [
+            (leaf, Path(path)) for _, leaf, path in editable_feature_dirs(workspace)
+        ]
+    targets = []
+    for identifier in identifiers:
+        found = resolve_feature_ref(identifier, workspace)
+        if found is None:
+            click.secho(
+                f"  Feature '{identifier}' not found at the workspace root or "
+                "in .splent_cache.",
+                fg="red",
+            )
+            raise SystemExit(1)
+        root, _, name = found
+        targets.append((root.name if "@" in root.name else name, root))
+    return targets
+
+
+@click.command(
+    "feature:security",
+    short_help="Find the SQL and XSS sinks the toolchain refuses in features.",
+)
+@click.argument("feature_identifiers", nargs=-1)
+def feature_security(feature_identifiers):
+    """
+    Scan features for SQL injection and XSS sinks no runtime can catch.
+
+    \b
+    Python
+      sql-from-string       SQL of text(), execute(), exec_driver_sql(),
+                            literal_column(), or a string given to filter(),
+                            where(), order_by() or having(), built from a
+                            variable string (an f-string, %, + or format())
+      markup-from-string    Markup() of a string built that way from values
+                            that are not escaped
+      template-from-string  render_template_string() of a template that is
+                            not a literal
+    Templates (.html, .j2, .xml, .svg under templates/)
+      autoescape-off        {% autoescape false %}
+      inline-handler        an on...= attribute
+      inline-script         a <script> with code, no src and no nonce
+      javascript-url        href, src, action or formaction with javascript:
+
+    \b
+    A reviewed exception says so on its line.
+      # splent: allow <rule>            in Python
+      {# splent: allow <rule> #}        in a template
+
+    \b
+    FEATURE_IDENTIFIERS are short names (notes), package names
+    (splent_feature_notes), either under a namespace (splent-io/notes),
+    or snapshots (notes@v1.2.0). Without any, every editable feature at
+    the workspace root is scanned. Tests are not scanned. Exits 1 when
+    there is a finding.
+
+    \b
+    Examples:
+      splent feature:security notes
+      splent feature:security auth profile
+      splent feature:security
+    """
+    workspace = Path(context.workspace())
+    targets = _targets(workspace, feature_identifiers)
+
+    click.echo()
+    click.echo(click.style("  Security scan (SQL and XSS sinks)", bold=True))
+    click.echo()
+
+    total = 0
+    flagged = 0
+    for name, root in targets:
+        findings = security_scan.scan_feature(root)
+        if not findings:
+            continue
+        flagged += 1
+        total += len(findings)
+        click.echo(click.style(f"  {name}", bold=True))
+        security_scan.echo_findings(findings)
+        click.echo()
+
+    scanned = f"{len(targets)} feature" + ("" if len(targets) == 1 else "s")
+    if total:
+        click.secho(
+            f"  ❌ {total} finding(s) in {flagged} of {scanned}.", fg="red", bold=True
+        )
+        click.echo(f"  {security_scan.ALLOW_HINT}")
+        click.echo()
+        raise SystemExit(1)
+    click.secho(f"  ✅ No findings in {scanned}.", fg="green", bold=True)
+    click.echo()
+
+
+cli_command = feature_security

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/feature/feature_test.py

@@ -175,7 +175,7 @@ def _passthrough_args(
 
 def _is_prod(value) -> bool:
     """SPLENT_ENV read the way production_active() reads it."""
-    return (value or "").strip().lower() == "prod"
+    return context.normalize_env(value) == "prod"
 
 
 def _is_prod_active(product: str | None = None) -> bool:

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/feature/feature_unlock.py

@@ -203,6 +203,11 @@ def replace_pyproject_reference(pyproject_path: str, name: str, version: str):
 
     if not changed:
         return
+    # Back to the editable checkout, which is never installed from PyPI, so
+    # the PyPI name the pinned release had is forgotten, as detach does.
+    from splent_cli.utils.feature_utils import set_feature_distribution
+
+    set_feature_distribution(data, name, None)
 
     write_toml(pyproject_path, data)
 
@@ -230,7 +235,7 @@ def _compile_assets(workspace: str, product_path: str, name: str):
     from splent_cli.services import frontend
 
     product = os.path.basename(product_path)
-    env = os.getenv("SPLENT_ENV", "dev")
+    env = context.resolve_env()
 
     # Find webpack config
     editable_path = os.path.join(workspace, name)
@@ -457,7 +462,12 @@ def _edit_one(
     is_flag=True,
     help="Convert all versioned features to editable.",
 )
-@click.option("--force", is_flag=True, help="Bypass lifecycle state checks.")
+@click.option(
+    "--force",
+    is_flag=True,
+    hidden=True,
+    help="Accepted for scripts that pass it; there is no check to bypass.",
+)
 @keeps_ci_workflows
 def feature_edit(feature_name, edit_all, force):
     workspace = str(context.workspace())

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/feature/feature_xray.py

@@ -135,7 +135,7 @@ def feature_xray(feature_ref, filter_cat, validate, full):
 
     data = load_toml(pyproject_path, what=f"{product} pyproject.toml")
 
-    env = os.getenv("SPLENT_ENV", "dev")
+    env = context.resolve_env()
     features = read_features_from_data(data, env)
 
     # Check for stale contracts

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/product/product_build.py

@@ -48,11 +48,6 @@ CONTRACTS_FORMAT = 1
 # version, anything else is a pip specifier.
 RUNTIME_TABLE = ("tool", "splent", "runtime")
 RUNTIME_DEFAULTS = {"gunicorn": ">=23,<24"}
-RUNTIME_COMMENT = (
-    "# What the production image installs besides the features. splent\n"
-    "# product:build keeps splent_framework and splent_cli at the versions this\n"
-    "# product is built with; a bare version means exactly that version.\n"
-)
 # Where those pins lived before, in a file of their own. Removed by the build
 # that moves them into pyproject.toml.
 LEGACY_REQUIREMENTS_FILE = "requirements.prod.txt"
@@ -449,15 +444,7 @@ def write_runtime_pins(pyproject_path: str, workspace: str) -> dict | None:
     if wanted == current:
         return None
     splent["runtime"] = wanted
-    result = edit_toml(text, data)
-    header = "[" + ".".join(RUNTIME_TABLE) + "]"
-    lines = result.splitlines(keepends=True)
-    for i, line in enumerate(lines):
-        if line.strip() == header and not (i and lines[i - 1].lstrip().startswith("#")):
-            newline = "\r\n" if line.endswith("\r\n") else "\n"
-            lines[i:i] = [c + newline for c in RUNTIME_COMMENT.splitlines()]
-            break
-    atomic_write(pyproject_path, "".join(lines), newline="")
+    atomic_write(pyproject_path, edit_toml(text, data), newline="")
     return wanted
 
 

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/product/product_config.py

@@ -190,7 +190,7 @@ def product_config(show_all, filter_feature, filter_key, show_secrets):
     col_src = max(col_src, 6)
 
     # Header
-    env = os.getenv("SPLENT_ENV", "dev")
+    env = context.resolve_env()
     feature_sources = set()
     for v in trace.values():
         src = v.get("source", "")

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/product/product_env.py

@@ -509,6 +509,12 @@ def product_env(generate, merge, env_name, process_all):
                 "".join(env_line(k, v) for k, v in merged.items()),
             )
 
+        # This process may hold the file's previous values, and what follows
+        # in it (product:derive starting the stacks) must see the new ones.
+        from splent_cli.utils.dynamic_imports import reload_product_env
+
+        reload_product_env(target_env)
+
         if product_replaced:
             click.echo(
                 click.style("  product  ", dim=True)

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/product/product_restart.py

@@ -27,10 +27,11 @@ from splent_cli.utils.proc import require_docker, run
 # ── Feature change detection ─────────────────────────────────────────
 
 
-def _installed_features(container_id: str) -> dict[str, str]:
+def _installed_features(container_id: str) -> dict[str, dict]:
     """Read pip-installed splent_feature_* packages from the container.
 
-    Returns {package_name: version_or_path} dict.
+    Returns {package_name: {"version": ..., "location": ...}}, the location
+    being the directory an editable install points at ("" for any other).
     """
     result = subprocess.run(
         ["docker", "exec", container_id, "pip", "list", "--format=json"],
@@ -49,7 +50,12 @@ def _installed_features(container_id: str) -> dict[str, str]:
             if name.startswith("splent-feature-") or name.startswith("splent_feature_"):
                 # Normalize: pip uses hyphens, we use underscores
                 normalized = name.replace("-", "_")
-                installed[normalized] = pkg.get("version", "")
+                installed[normalized] = {
+                    "version": pkg.get("version", ""),
+                    "location": (pkg.get("editable_project_location") or "").rstrip(
+                        "/"
+                    ),
+                }
     except (json.JSONDecodeError, KeyError):
         pass
     return installed
@@ -77,6 +83,7 @@ def _declared_features(workspace: str, product: str, env: str) -> list[dict]:
         result.append(
             {
                 "entry": entry,
+                "namespace": ns,
                 "name": name,
                 "version": version,
                 "editable": editable,
@@ -85,25 +92,44 @@ def _declared_features(workspace: str, product: str, env: str) -> list[dict]:
     return result
 
 
+def _feature_link(product: str, feat: dict) -> str:
+    """Container path of the product's link to a feature: features/<ns>/<name>
+    for an editable one (the entrypoint installs it from there, this command
+    from the workspace's copy), and <name>@<version> for a pinned one."""
+    link = f"/workspace/{product}/features/{feat['namespace']}/{feat['name']}"
+    return f"{link}@{feat['version']}" if feat["version"] else link
+
+
 def _detect_changes(container_id, workspace, product, env):
-    """Compare declared features with installed ones. Returns lists of features to install."""
+    """The declared features the container does not have as declared:
+    missing, at another version, or installed from the other copy (the
+    workspace's for an editable feature, the product's pinned link for a
+    pinned one). Returns (name, path_or_entry, editable) for each."""
     installed = _installed_features(container_id)
     declared = _declared_features(workspace, product, env)
 
-    to_install = []  # (name, path_or_entry, editable)
+    to_install = []
 
     for feat in declared:
         name = feat["name"]
-        editable = feat["editable"]
+        found = installed.get(name)
 
-        if editable:
-            # Editable: check if it's installed as editable (pip shows local path)
+        if feat["editable"]:
             feature_path = os.path.join(workspace, name)
-            if name not in installed or not os.path.isdir(feature_path):
+            copies = (f"/workspace/{name}", _feature_link(product, feat))
+            if (
+                found is None
+                or found["location"] not in copies
+                or not os.path.isdir(feature_path)
+            ):
                 to_install.append((name, feature_path, True))
         else:
-            # Pinned: check if version matches
-            if name not in installed:
+            location = found["location"] if found else ""
+            if (
+                found is None
+                or found["version"] != feat["version"]
+                or (location and location != _feature_link(product, feat))
+            ):
                 to_install.append((name, feat["entry"], False))
 
     return to_install
@@ -395,9 +421,12 @@ def product_restart(env_dev, env_prod, full):
     """Restart Flask inside the container.
 
     \b
-    Detects feature changes before restarting:
-    - New features in pyproject.toml → pip install
-    - Features switched to editable → pip install -e
+    Detects feature changes before restarting, and installs each changed
+    feature with pip install -e from the copy pyproject.toml names:
+    - a feature added to pyproject.toml
+    - a pinned feature at another version
+    - a feature switched between editable (the workspace's copy) and
+      pinned (the product's features/ link)
     Then kills Flask/watchmedo and restarts.
 
     \b

{splent_cli-1.49.0 → splent_cli-1.50.0}/src/splent_cli/commands/product/product_routes.py

@@ -75,7 +75,7 @@ def product_routes(filter_feature, group):
         click.secho("No routes matched.", fg="yellow")
         return
 
-    env = os.getenv("SPLENT_ENV", "dev")
+    env = context.resolve_env()
 
     if group:
         # Group by feature