stkit 17.3.0__tar.gz → 17.3.1__tar.gz

{stkit-17.3.0 → stkit-17.3.1}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## v17.3.1 (2026-10-31)
+
+No migration required.
+
+- Versioned static responses were marked public and immutable for a year even when they were a 404 or carried a session cookie change, such as clearing a stale login. A shared cache could then replay them to other visitors. Only a 200 with no cookie change is cached publicly now; a response that changes the session is `private, no-store`.
+- `stk smoke`'s raw-score rule could take tens of seconds on a page with a long run of blanks after the word "score", from two adjacent optional-blank patterns backtracking. It is linear now (Build Loop).
+
 ## v17.3.0 (2026-10-31)
 
 Run `uv run stk db upgrade`: `stk_0007` marks every existing account confirmed. Requires quart-security 2.1.0.

{stkit-17.3.0 → stkit-17.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: stkit
-Version: 17.3.0
+Version: 17.3.1
 Summary: An async Quart framework optimized for AI-assisted development workflows
 Project-URL: Documentation, https://docs.stkit.dev
 Project-URL: Source, https://github.com/level09/stk

{stkit-17.3.0 → stkit-17.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stkit"
-version = "17.3.0"
+version = "17.3.1"
 description = "An async Quart framework optimized for AI-assisted development workflows"
 authors = [
     {name = "Level09", email = "hello@level09.com"}

{stkit-17.3.0 → stkit-17.3.1}/stk/__init__.py

@@ -3,7 +3,7 @@ stk Framework
 A modern Python web framework optimized for AI-assisted development.
 """
 
-__version__ = "17.3.0"
+__version__ = "17.3.1"
 
 
 def __getattr__(name):

{stkit-17.3.0 → stkit-17.3.1}/stk/app.py

@@ -18,6 +18,7 @@ from quart import (
     send_from_directory,
     url_for,
 )
+from quart import session as quart_session
 from quart_security import Security, SQLAlchemyUserDatastore
 from quart_security.views import _ensure_csrf_token
 from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
@@ -253,11 +254,15 @@ def register_static_versioning(app):
     @app.after_request
     async def _cache_static(response):
         if request.path.startswith(f"{app.static_url_path}/"):
-            response.headers["Cache-Control"] = (
-                "public, max-age=31536000, immutable"
-                if request.args.get("v")
-                else "no-cache"
-            )
+            if quart_session.modified:
+                # This response sets or clears a session cookie; a shared cache
+                # must never replay it to someone else.
+                policy = "private, no-store"
+            elif request.args.get("v") and response.status_code == 200:
+                policy = "public, max-age=31536000, immutable"
+            else:
+                policy = "no-cache"
+            response.headers["Cache-Control"] = policy
         return response
 
     def import_map():

{stkit-17.3.0 → stkit-17.3.1}/stk/cli/copy_rules.py

@@ -41,7 +41,8 @@ HEX = re.compile(r"[0-9a-f]{6,}", re.I)
 HASH_LABEL = re.compile(r"(?:sha-?256|sha|md5|hash|digest|fingerprint)\W{0,3}$", re.I)
 SNAKE = re.compile(r"(?<![\w./@-])[a-z][a-z0-9]*(?:_[a-z0-9]+)+(?![\w@-]|\.\w)")
 SCORE = re.compile(
-    r"\b(?:score|similarity|confidence|distance|cosine)\b\s*[:=]?\s*-?\d*\.\d+", re.I
+    r"\b(?:score|similarity|confidence|distance|cosine)\b\s*(?:[:=]\s*)?-?\d*\.\d+",
+    re.I,
 )
 ONE = re.compile(r"(?<![\d.,:/-])\b1[ \t]+([A-Za-z]+s)\b")
 # Words ending in s after a 1 that are not plurals: "1 is", "1 status".

{stkit-17.3.0 → stkit-17.3.1}/tests/test_copy_rules.py

@@ -1,3 +1,4 @@
+import time
 import unittest
 
 from stk.cli.copy_rules import (
@@ -49,6 +50,11 @@ class CopyRuleTests(unittest.TestCase):
             ["jane_doe@example.com", "/static/app_icon.png", "STK_ENV", "Pending"],
         )
 
+    def test_raw_score_is_linear_on_long_blank_runs(self):
+        start = time.perf_counter()
+        self.assertEqual(raw_score("score" + " " * 50_000 + "!"), [])
+        self.assertLess(time.perf_counter() - start, 1)
+
     def test_raw_score(self):
         self.assertRule(
             raw_score,

{stkit-17.3.0 → stkit-17.3.1}/tests/test_static_versioning.py

@@ -22,6 +22,21 @@ class StaticVersioningTests(unittest.IsolatedAsyncioTestCase):
         bare = await client.get("/static/js/config.js")
         self.assertEqual(bare.headers["Cache-Control"], "no-cache")
 
+    async def test_errors_and_session_cookies_are_never_cached_publicly(self):
+        app = Stk(__name__, config=TestingConfig)
+        client = app.test_client()
+        missing = await client.get("/static/missing.css?v=1")
+        self.assertEqual(missing.status_code, 404)
+        self.assertNotIn("public", missing.headers["Cache-Control"])
+        # A stale login is cleared on any request, static ones included; that
+        # response carries a cookie change and must stay private.
+        async with client.session_transaction() as cookie:
+            cookie["_user_id"] = "gone"
+        async with app.test_request_context("/"):
+            url = url_for("static", filename="js/config.js")
+        cleared = await client.get(url)
+        self.assertEqual(cleared.headers["Cache-Control"], "private, no-store")
+
 
 if __name__ == "__main__":
     unittest.main()