stkit 17.2.3__tar.gz → 17.2.5__tar.gz

{stkit-17.2.3 → stkit-17.2.5}/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## v17.2.5 (2026-10-31)
+
+No migration required.
+
+- `stk smoke` crashed on any page with three or more like SVG shapes side by side, such as a chart's paths or an icon's circles: the repeated-row rule read `innerText`, which SVG elements lack. The rule now looks at HTML elements only. A page smoke cannot read now fails that page with the reason, instead of stopping the whole run (Build Loop).
+
+## v17.2.4 (2026-10-31)
+
+No migration required.
+
+- Notifications are opt-in, like uploads and MCP: add `stk.notification` to the app's extensions for the `/api/notifications` routes and the layout's bell. From 17.2.0 to 17.2.3 stk registered those routes in every app, and because the first matching route answers, an app's own `/api/notifications` was silently never reached. `notify()` still stores rows without it (Background Work).
+- `stk verify` fails when two endpoints register the same path and method, naming both, so a shadowed route can no longer ship silently.
+- Apps made by `stk init`, and the example app, list `stk.notification`.
+
+### Upgrade considerations
+
+- An app that uses stk's bell adds `import stk.notification` and puts `stk.notification` in its `extensions` list, or the bell disappears and `/api/notifications` returns 404.
+
 ## v17.2.3 (2026-10-31)
 
 Run `uv run stk db upgrade`.

{stkit-17.2.3 → stkit-17.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stkit
-Version: 17.2.3
+Version: 17.2.5
 Summary: An async Quart framework optimized for AI-assisted development workflows
 Project-URL: Documentation, https://docs.stkit.dev
 Project-URL: Source, https://github.com/level09/stk

{stkit-17.2.3 → stkit-17.2.5}/examples/minimal/minimal/app.py

@@ -1,9 +1,10 @@
+import stk.notification
 from stk import Stk
 
 from minimal import note
 from minimal.settings import Config
 
 # Each extension is a package with init_app(app); order is precedence.
-extensions = [note]
+extensions = [stk.notification, note]
 
 app = Stk(__name__, config=Config, extensions=extensions)

{stkit-17.2.3 → stkit-17.2.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stkit"
-version = "17.2.3"
+version = "17.2.5"
 description = "An async Quart framework optimized for AI-assisted development workflows"
 authors = [
     {name = "Level09", email = "hello@level09.com"}

{stkit-17.2.3 → stkit-17.2.5}/stk/__init__.py

@@ -3,7 +3,7 @@ stk Framework
 A modern Python web framework optimized for AI-assisted development.
 """
 
-__version__ = "17.2.3"
+__version__ = "17.2.5"
 
 
 def __getattr__(name):

{stkit-17.2.3 → stkit-17.2.5}/stk/app.py

@@ -27,7 +27,6 @@ from werkzeug.security import safe_join
 import stk.extensions as ext
 from stk.agent_login import agent_login_enabled, bp_agent_login
 from stk.extensions import session
-from stk.notification.views import bp_notification
 from stk.portal.views import portal
 from stk.public.views import public
 from stk.settings import Config
@@ -206,7 +205,6 @@ def register_blueprints(app):
     app.register_blueprint(bp_user)
     app.register_blueprint(public)
     app.register_blueprint(portal)
-    app.register_blueprint(bp_notification)
     app.register_blueprint(ws_bp)
     if agent_login_enabled(app):
         app.register_blueprint(bp_agent_login)

{stkit-17.2.3 → stkit-17.2.5}/stk/checks.py

@@ -295,6 +295,28 @@ def check_admin_reset_route(app):
     )
 
 
+@check("No route is registered twice")
+def check_unique_routes(app):
+    # Werkzeug answers with the first matching rule, so an app route that repeats
+    # a core one (or another extension's) is never reached, with no error at all.
+    owners = {}
+    for rule in app.url_map.iter_rules():
+        # stk's own blueprints share /static on purpose: one folder, one answer.
+        if rule.endpoint == "static" or rule.endpoint.endswith(".static"):
+            continue
+        for method in rule.methods - {"HEAD", "OPTIONS"}:
+            owners.setdefault((method, rule.rule), []).append(rule.endpoint)
+    clashes = [
+        f"{method} {path}: {' and '.join(endpoints)}"
+        for (method, path), endpoints in sorted(owners.items())
+        if len(endpoints) > 1
+    ]
+    assert not clashes, (
+        "only the first endpoint ever answers; rename one route or drop the"
+        " extension that adds it:\n    " + "\n    ".join(clashes)
+    )
+
+
 @check("GET / answers 200, after any redirects")
 async def check_http_index(app):
     # An app may send / to its sign-in or home page; what it lands on must work.

{stkit-17.2.3 → stkit-17.2.5}/stk/cli/copy_rules.py

@@ -15,8 +15,10 @@ VISIBLE_TEXT_JS = """() => {
 }"""
 
 # Visible texts of sibling elements that share a tag and classes: rows of a list.
+# Only HTML elements: SVG shapes (a chart's paths, an icon's circles) repeat by
+# design and have no innerText.
 ROWS_JS = """() => {
-  const shown = el => el.getClientRects().length > 0;
+  const shown = el => el instanceof HTMLElement && el.getClientRects().length > 0;
   const sig = k => k.tagName + '.' + [...k.classList]
     .filter(c => !/active|selected|hover|focus|open|current/.test(c)).sort().join('.');
   const out = [];

{stkit-17.2.3 → stkit-17.2.5}/stk/cli/smoke.py

@@ -303,9 +303,18 @@ async def _visit_smoke_page(context, base_url, name, path, screenshot_path=None)
     page.on("pageerror", _record_page_error)
     page.on("requestfailed", _record_failed_request)
     response = await page.goto(f"{base_url}{path}", wait_until="networkidle")
-    low_contrast = await page.evaluate(CONTRAST_JS)
-    text = await page.evaluate(VISIBLE_TEXT_JS)
-    rows = await page.evaluate(ROWS_JS)
+    from playwright.async_api import Error as PlaywrightError
+
+    try:
+        low_contrast = await page.evaluate(CONTRAST_JS)
+        text = await page.evaluate(VISIBLE_TEXT_JS)
+        rows = await page.evaluate(ROWS_JS)
+    except PlaywrightError as exc:
+        # One page smoke cannot read fails that page, not the whole run.
+        console_entries.append(
+            {"type": "pageerror", "text": f"smoke could not read the page: {exc}"}
+        )
+        low_contrast, text, rows = [], "", []
     if screenshot_path is not None:
         screenshot_path.parent.mkdir(parents=True, exist_ok=True)
         await page.screenshot(path=str(screenshot_path), full_page=True)

{stkit-17.2.3 → stkit-17.2.5}/stk/notification/__init__.py

@@ -1,4 +1,8 @@
-"""Stored, per-user notifications. The row is the truth; the socket push is a nudge."""
+"""Stored, per-user notifications. The row is the truth; the socket push is a nudge.
+
+Opt in with `extensions=[stk.notification, ...]` for the `/api/notifications`
+routes and the layout's bell; `notify()` stores rows either way.
+"""
 
 import stk.extensions as ext
 from stk.notification.models import Notification
@@ -27,3 +31,11 @@ async def notify(user_id, title, link=None, kind=None, body=None):
         await db.commit()
     await broadcast({"type": "notification", **row.to_dict()}, user_id)
     return row
+
+
+def init_app(app):
+    from stk.notification.views import bp_notification
+
+    app.extensions["stk.notification"] = True
+    app.jinja_env.globals["stk_notifications"] = True
+    app.register_blueprint(bp_notification)

{stkit-17.2.3 → stkit-17.2.5}/stk/scaffold/app/__app__/app.py

@@ -1,8 +1,9 @@
+import stk.notification
 from stk import Stk
 
 from __app__.settings import Config
 
 # Each extension is a package with init_app(app); order is precedence.
-extensions = []
+extensions = [stk.notification]
 
 app = Stk(__name__, config=Config, extensions=extensions)

{stkit-17.2.3 → stkit-17.2.5}/stk/templates/layout.html

@@ -48,8 +48,10 @@
             <!-- Theme Switcher -->
             <theme-switcher></theme-switcher>
 
-            <!-- Notifications -->
+            {% if stk_notifications %}
+            <!-- Notifications: only with stk.notification in the app's extensions -->
             <notification-dropdown ref="notifications"></notification-dropdown>
+            {% endif %}
 
             <!-- Connection Status -->
             <v-tooltip :text="wsConnected ? 'Real-time connected' : 'Reconnecting...'" location="bottom">

{stkit-17.2.3 → stkit-17.2.5}/tests/test_copy_rules.py

@@ -1,6 +1,7 @@
 import unittest
 
 from stk.cli.copy_rules import (
+    ROWS_JS,
     broken_value,
     copy_findings,
     hex_id,
@@ -110,3 +111,28 @@ class SmokeCopyReportTests(unittest.TestCase):
 
 if __name__ == "__main__":
     unittest.main()
+
+
+class RowsInBrowserTest(unittest.IsolatedAsyncioTestCase):
+    """ROWS_JS runs in a real page: SVG shapes have no innerText."""
+
+    async def test_repeated_svg_shapes_are_skipped_and_html_rows_kept(self):
+        try:
+            from playwright.async_api import async_playwright
+
+            playwright = await async_playwright().start()
+            browser = await playwright.chromium.launch()
+        except Exception as exc:  # no Playwright or no browser installed
+            self.skipTest(f"chromium unavailable: {exc}")
+        try:
+            page = await browser.new_page()
+            await page.set_content(
+                "<svg width='90' height='30'><circle cx='10' cy='10' r='5'/>"
+                "<circle cx='30' cy='10' r='5'/><circle cx='50' cy='10' r='5'/></svg>"
+                "<ul><li>Alpha</li><li>Beta</li><li>Gamma</li></ul>"
+            )
+            rows = await page.evaluate(ROWS_JS)
+        finally:
+            await browser.close()
+            await playwright.stop()
+        self.assertEqual(rows, [["Alpha", "Beta", "Gamma"]])

{stkit-17.2.3 → stkit-17.2.5}/tests/test_notifications.py

@@ -5,6 +5,7 @@ import unittest
 from quart_security import hash_password
 
 import stk.extensions as ext
+import stk.notification
 from stk.app import Stk
 from stk.extensions import Base
 from stk.notification import notify
@@ -14,7 +15,7 @@ from stk.user.models import User
 
 class NotificationTests(unittest.IsolatedAsyncioTestCase):
     async def asyncSetUp(self):
-        self.app = Stk(__name__, config=TestingConfig)
+        self.app = Stk(__name__, config=TestingConfig, extensions=[stk.notification])
         async with ext.engine.begin() as conn:
             await conn.run_sync(Base.metadata.create_all)
         async with ext.async_session_factory() as db:

stkit-17.2.5/tests/test_route_collisions.py

@@ -0,0 +1,41 @@
+"""An app route that repeats a core one is never reached; verify must say so."""
+
+import contextlib
+import io
+import unittest
+
+from quart import Blueprint
+
+import stk.notification
+from stk import checks
+from stk.app import Stk
+from stk.checks import check_unique_routes
+from stk.settings import TestingConfig
+
+
+class RouteCollisionTest(unittest.IsolatedAsyncioTestCase):
+    async def test_core_routes_are_unique(self):
+        app = Stk(__name__, config=TestingConfig, extensions=[stk.notification])
+        with contextlib.redirect_stdout(io.StringIO()):
+            self.assertTrue(await check_unique_routes(app))
+
+    async def test_an_app_route_shadowed_by_a_core_route_fails(self):
+        app = Stk(__name__, config=TestingConfig, extensions=[stk.notification])
+        inbox = Blueprint("inbox", __name__)
+
+        @inbox.get("/api/notifications")
+        async def own_notifications():
+            return {"items": []}
+
+        app.register_blueprint(inbox)
+        with contextlib.redirect_stdout(io.StringIO()):
+            self.assertFalse(await check_unique_routes(app))
+        detail = checks.RESULTS[-1]["detail"]
+        self.assertIn("GET /api/notifications", detail)
+        self.assertIn("inbox.own_notifications", detail)
+
+    async def test_without_stk_notification_the_app_owns_the_path(self):
+        app = Stk(__name__, config=TestingConfig)
+        rules = {r.rule for r in app.url_map.iter_rules()}
+        self.assertNotIn("/api/notifications", rules)
+        self.assertNotIn("stk_notifications", app.jinja_env.globals)

{stkit-17.2.3 → stkit-17.2.5}/tests/test_scaffolder.py

@@ -321,7 +321,7 @@ class InitAndNewTests(unittest.TestCase):
             ast.parse((self.app / "acme" / "widget" / name).read_text())
         app_module = (self.app / "acme" / "app.py").read_text()
         self.assertIn("from acme import gadget, widget", app_module)
-        self.assertIn("extensions = [widget, gadget]", app_module)
+        self.assertIn("extensions = [stk.notification, widget, gadget]", app_module)
 
     def test_new_starts_the_app_lineage_after_stk(self):
         (revision,) = (self.app / "acme" / "migrations").glob("*.py")