stml-cli 0.1.6__tar.gz → 0.1.9__tar.gz

{stml_cli-0.1.6 → stml_cli-0.1.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stml-cli
-Version: 0.1.6
+Version: 0.1.9
 Summary: The stml partner CLI — pull, edit, push, and publish stml apps and libraries.
 Author: stml
 Project-URL: Homepage, https://stml.io
@@ -35,6 +35,12 @@ Spec: [`docs/user-stories/feature/024-app-authoring-platform.md`](../docs/user-s
 Runs on **macOS, Linux, and Windows** — it's pure-Python and touches nothing
 platform-specific beyond the filesystem and HTTPS.
 
+**Staying current**: after a command finishes, the CLI prints a one-line
+notice when a newer release exists on PyPI (checked at most once a day,
+cached, quiet when stderr isn't a terminal, never blocks or fails a command).
+Update with `pipx upgrade stml-cli`. Set `STML4_NO_UPDATE_CHECK=1` to turn
+the check off entirely.
+
 ## Quickstart
 
 ```sh

{stml_cli-0.1.6 → stml_cli-0.1.9}/README.md

@@ -25,6 +25,12 @@ Spec: [`docs/user-stories/feature/024-app-authoring-platform.md`](../docs/user-s
 Runs on **macOS, Linux, and Windows** — it's pure-Python and touches nothing
 platform-specific beyond the filesystem and HTTPS.
 
+**Staying current**: after a command finishes, the CLI prints a one-line
+notice when a newer release exists on PyPI (checked at most once a day,
+cached, quiet when stderr isn't a terminal, never blocks or fails a command).
+Update with `pipx upgrade stml-cli`. Set `STML4_NO_UPDATE_CHECK=1` to turn
+the check off entirely.
+
 ## Quickstart
 
 ```sh

{stml_cli-0.1.6 → stml_cli-0.1.9}/pyproject.toml

@@ -25,3 +25,8 @@ version = { attr = "stml_cli.__version__" }
 [tool.setuptools.packages.find]
 where = ["."]
 include = ["stml_cli*"]
+
+[dependency-groups]
+dev = [
+    "pytest>=8",
+]

{stml_cli-0.1.6 → stml_cli-0.1.9}/stml_cli/__init__.py

@@ -9,7 +9,7 @@ from __future__ import annotations
 
 import os
 
-__version__ = "0.1.6"
+__version__ = "0.1.9"
 
 # TLS trust: framework/python.org builds have no OpenSSL CA path, so a real
 # https backend fails with "unable to get local issuer certificate". certifi's

{stml_cli-0.1.6 → stml_cli-0.1.9}/stml_cli/__main__.py

@@ -1,6 +1,6 @@
 """`stml` CLI entry point — argparse dispatch (024 §CLI surface).
 
-    stml login | logout | whoami
+    stml login | logout | whoami | token
     stml list [--workspace <ws>]
     stml pull <app-url> [<dir>]
     stml push [<app-url>] <dir>
@@ -19,7 +19,7 @@ from __future__ import annotations
 import argparse
 import sys
 
-from . import __version__, commands, http
+from . import __version__, commands, http, update_check
 from .config import DEFAULT_BACKEND
 
 
@@ -32,6 +32,10 @@ def build_parser() -> argparse.ArgumentParser:
     sub.add_parser("login", help="Authenticate in the browser and cache a session").set_defaults(func=commands.cmd_login)
     sub.add_parser("logout", help="Delete the cached session").set_defaults(func=commands.cmd_logout)
     sub.add_parser("whoami", help="Show the resolved user + backend").set_defaults(func=commands.cmd_whoami)
+    sub.add_parser(
+        "token",
+        help="Print a fresh access token for the backend (for scripts: STML4_TOKEN=$(stml token))",
+    ).set_defaults(func=commands.cmd_token)
 
     ls = sub.add_parser(
         "list",
@@ -146,6 +150,10 @@ def main(argv: list[str] | None = None) -> int:
             print(e.code, file=sys.stderr)
             return 1
         return e.code or 0
+    finally:
+        # Post-command so the (at most daily) PyPI round-trip lands at exit,
+        # never ahead of a command's own output. Silent in scripts/CI.
+        update_check.maybe_notify()
     return 0
 
 

{stml_cli-0.1.6 → stml_cli-0.1.9}/stml_cli/commands.py

@@ -47,7 +47,17 @@ def cmd_login(args) -> None:
 
 
 def cmd_logout(args) -> None:
-    _log("✓ Logged out" if config.clear_session() else "Not logged in.")
+    if config.clear_session(args.backend):
+        _log(f"✓ Logged out of {args.backend}")
+    else:
+        _log(f"Not logged in to {args.backend}.")
+
+
+def cmd_token(args) -> None:
+    # stdout carries ONLY the token, so `STML4_TOKEN=$(stml token)` (and the
+    # monorepo publish wrappers) can substitute it cleanly; any chatter a
+    # refresh produces goes to stderr.
+    print(http.resolve_token(args.backend))
 
 
 def cmd_whoami(args) -> None:
@@ -152,6 +162,16 @@ def cmd_pull(args) -> None:
     _write_link(dest, args.backend, workspace, app)
     tail = f" (+ {asset_count} asset(s))" if asset_count else ""
     _log(f"✓ Pulled {len(written)} file(s) from {result.get('app', app)} → {dest}{tail}")
+    if result.get("generated_manifest"):
+        # The app's overlay had no manifest — the backend reconstructed one from
+        # the platform's live state (flow rows, dependency pins, provenance).
+        _log("  ℹ pyproject.toml was generated from the app's platform state — "
+             "review it (name/version/issuer-org) before `stml publish`.")
+    if result.get("base_files"):
+        # Attached app: files the app never forked come from its base library
+        # version, so the folder is the complete effective tree.
+        _log(f"  ℹ {result['base_files']} file(s) came from the app's base "
+             "library (never forked in the app).")
 
 
 def cmd_push(args) -> None:
@@ -305,6 +325,7 @@ def cmd_init(args) -> None:
         raise SystemExit(f"{target} exists and is not empty")
     target.mkdir(parents=True, exist_ok=True)
     name = args.name or target.name
+    pkg_name = name.replace("-", "_")
     (target / "pyproject.toml").write_text(
         f'''[project]
 name = "{name}"
@@ -316,15 +337,79 @@ dependencies = []
 [tool.stml]
 requires-runtime = ">=0.1"
 issuer-org = ""  # set to your org slug
-exports-flows = []
+exports-flows = [
+    {{ name = "hello", entrypoint = "{pkg_name}.hello:app" }},
+]
 depends-on = []
+
+[dependency-groups]
+dev = [
+    "pytest",
+]
+
+[tool.pytest.ini_options]
+pythonpath = ["src"]
 ''',
         encoding="utf-8",
     )
-    pkg = target / name.replace("-", "_")
-    pkg.mkdir()
+    # src layout — the shape `stml pull` writes and deployment-version 2
+    # expects (flows ship under src/); keeps init/pull/push round-trips stable.
+    pkg = target / "src" / pkg_name
+    pkg.mkdir(parents=True)
     (pkg / "__init__.py").write_text('"""Library entry point."""\n', encoding="utf-8")
+    (pkg / "hello.py").write_text(
+        f'''"""A minimal runnable flow — replace its steps with your own and keep
+`exports-flows` in pyproject.toml pointing at each flow's `module:app`."""
+
+from stml.runtime import App
+
+app = App("hello")
+
+
+@app.step(name="Greet", description="Says hello.")
+def greet() -> dict:
+    return {{"message": "Hello from {name}!"}}
+''',
+        encoding="utf-8",
+    )
     (target / "README.md").write_text(f"# {name}\n", encoding="utf-8")
+    (target / "AGENTS.md").write_text(
+        f'''# `{name}` — usage for the assistant
+
+<What this library does, who installs it, and how its flows are meant to be
+run — write it for the AI assistant working on or with this library.>
+
+## Layout
+
+- `src/{pkg_name}/` — the package. Flows live here and are listed in
+  `pyproject.toml` under `[tool.stml] exports-flows` as `module:app`.
+- `tests/` — local-only: `stml push` and `stml publish` both skip it.
+  Run with `uv run pytest`.
+''',
+        encoding="utf-8",
+    )
+    (target / ".gitignore").write_text(
+        ".venv/\n__pycache__/\n*.pyc\n.stml/\n.pytest_cache/\n.ruff_cache/\n",
+        encoding="utf-8",
+    )
+    # tests/ is LOCAL-ONLY by convention: push and publish both skip it
+    # (paths._EXCLUDE_DIRS / packaging.EXCLUDE_DIRS), so scaffold it with a
+    # stub that says so — runnable code belongs in the package, never here.
+    tests_dir = target / "tests"
+    tests_dir.mkdir()
+    (tests_dir / "__init__.py").write_text("", encoding="utf-8")
+    (tests_dir / "test_smoke.py").write_text(
+        f'''"""tests/ is local-only: `stml push` and `stml publish` both skip this
+folder — put runnable code in the package, never in here."""
+
+import {pkg_name}
+
+
+def test_import():
+    assert {pkg_name}.__doc__
+''',
+        encoding="utf-8",
+    )
     _log(f"✓ Scaffolded {target}")
 
 

stml_cli-0.1.9/stml_cli/config.py

@@ -0,0 +1,110 @@
+"""Per-OS config dir + the cached login sessions (024 §OS & runtime support §4).
+
+One session file PER BACKEND (``session-<host[-port]>.json``), so signing in to
+a second backend (a dev stack next to prod, say) never clobbers the first —
+a partner with a single backend still sees exactly one file. The refresh token
+lives here between commands; access tokens are minted per call and never
+persisted. Files are written user-only where the OS supports it (``chmod`` is
+a no-op on Windows, which relies on the per-user profile dir).
+
+Installs older than 0.1.9 kept a single ``session.json``; it is adopted into
+the per-backend file on first read against the backend it was minted for.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import sys
+import urllib.parse
+from pathlib import Path
+
+DEFAULT_BACKEND = os.environ.get("STML4_BACKEND", "https://api.stml.io")
+
+_LEGACY_SESSION_FILE = "session.json"
+
+
+def config_dir() -> Path:
+    """OS-appropriate config directory for stml (created on demand)."""
+    if sys.platform == "darwin":
+        base = Path.home() / "Library" / "Application Support"
+    elif os.name == "nt":
+        base = Path(os.environ.get("APPDATA") or (Path.home() / "AppData" / "Roaming"))
+    else:  # Linux / other POSIX
+        base = Path(os.environ.get("XDG_CONFIG_HOME") or (Path.home() / ".config"))
+    return base / "stml"
+
+
+def _session_filename(backend: str) -> str:
+    """``session-<host[-port]>.json`` for the backend URL — the per-backend key."""
+    u = urllib.parse.urlsplit(backend)
+    host = (u.hostname or "").lower()
+    if not host:  # not URL-shaped; sanitize the whole string rather than guess
+        return f"session-{re.sub(r'[^A-Za-z0-9._-]+', '-', backend.strip().lower())}.json"
+    return f"session-{host}-{u.port}.json" if u.port else f"session-{host}.json"
+
+
+def _session_path(backend: str) -> Path:
+    return config_dir() / _session_filename(backend)
+
+
+def _read_json(p: Path) -> dict | None:
+    try:
+        return json.loads(p.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, OSError):
+        return None
+
+
+def read_session(backend: str) -> dict | None:
+    """Return the cached session for this backend, or None if not logged in.
+
+    Falls back to the pre-0.1.9 single ``session.json`` when it was minted for
+    this same backend, migrating it to the per-backend file as a side effect.
+    A legacy file for a DIFFERENT backend is left alone — it gets adopted when
+    a command targets that backend.
+    """
+    p = _session_path(backend)
+    if p.exists():
+        return _read_json(p)
+
+    legacy = config_dir() / _LEGACY_SESSION_FILE
+    if legacy.exists():
+        sess = _read_json(legacy)
+        if sess and (sess.get("backend") or "").rstrip("/") == backend.rstrip("/"):
+            write_session(sess)
+            legacy.unlink(missing_ok=True)
+            return sess
+    return None
+
+
+def write_session(session: dict) -> None:
+    """Persist the session dict (keyed by its ``backend``) with user-only perms."""
+    backend = session.get("backend") or ""
+    if not backend:
+        raise ValueError("session is missing 'backend' — cannot pick a session file")
+    d = config_dir()
+    d.mkdir(parents=True, exist_ok=True)
+    p = _session_path(backend)
+    p.write_text(json.dumps(session, indent=2), encoding="utf-8")
+    try:  # best-effort; POSIX only
+        os.chmod(p, 0o600)
+    except OSError:  # pragma: no cover
+        pass
+
+
+def clear_session(backend: str) -> bool:
+    """Delete the cached session for this backend (the legacy single file too,
+    when it belongs to it). Returns True if anything was removed."""
+    removed = False
+    p = _session_path(backend)
+    if p.exists():
+        p.unlink()
+        removed = True
+    legacy = config_dir() / _LEGACY_SESSION_FILE
+    if legacy.exists():
+        sess = _read_json(legacy)
+        if sess and (sess.get("backend") or "").rstrip("/") == backend.rstrip("/"):
+            legacy.unlink()
+            removed = True
+    return removed

{stml_cli-0.1.6 → stml_cli-0.1.9}/stml_cli/http.py

@@ -140,19 +140,11 @@ def resolve_token(backend: str) -> str:
     if override:
         return override.strip()
 
-    sess = config.read_session()
+    # Sessions are cached per backend (config._session_filename), so the token
+    # we read here was minted by exactly the backend this command targets.
+    sess = config.read_session(backend)
     if not sess or not sess.get("refresh_token"):
-        raise SystemExit("Not logged in. Run: stml login  (or set STML4_TOKEN)")
-
-    # The cached session is minted by ONE backend; sending its token elsewhere
-    # yields confusing server errors (and whoami would claim a login that isn't
-    # valid there). Call the mismatch out instead.
-    sess_backend = (sess.get("backend") or "").rstrip("/")
-    if sess_backend and sess_backend != backend.rstrip("/"):
-        raise SystemExit(
-            f"Logged in to {sess_backend}, but this command targets {backend}.\n"
-            f"Run: stml --backend {backend} login   (a session is valid for one backend)"
-        )
+        raise SystemExit(f"Not logged in to {backend}. Run: stml login  (or set STML4_TOKEN)")
 
     now = int(time.time())
     if not sess.get("expires_at") or int(sess["expires_at"]) - now < 60:

{stml_cli-0.1.6 → stml_cli-0.1.9}/stml_cli/packaging.py

@@ -30,6 +30,13 @@ EXCLUDE_FILES = {"uv.lock", "poetry.lock", "Pipfile.lock", ".DS_Store"}
 EXCLUDE_SUFFIXES = {".pyc", ".pyo"}
 
 
+def _is_env_file(name: str) -> bool:
+    """SECURITY: `.env` / `.env.<anything>` hold local credentials and must
+    never be packaged (`.env.example` is the secret-free template and may
+    ship). Matches paths._is_env_file (the push path)."""
+    return (name == ".env" or name.startswith(".env.")) and name != ".env.example"
+
+
 def build_tarball(lib_dir: Path) -> bytes:
     buf = io.BytesIO()
     with tarfile.open(fileobj=buf, mode="w:gz") as tar:
@@ -41,6 +48,8 @@ def build_tarball(lib_dir: Path) -> bytes:
                 continue
             if path.name in EXCLUDE_FILES or path.suffix in EXCLUDE_SUFFIXES:
                 continue
+            if _is_env_file(path.name):
+                continue
             if not path.is_file():
                 continue
             arcname = f"{lib_dir.name}/{path.relative_to(lib_dir).as_posix()}"

{stml_cli-0.1.6 → stml_cli-0.1.9}/stml_cli/paths.py

@@ -47,15 +47,23 @@ def _is_packaging_path(rel: str) -> bool:
         return True
     return False
 
-# Local-only artifacts that must never be pushed into the overlay.
+# Local-only artifacts that must never be pushed into the overlay. `tests`
+# matches packaging.EXCLUDE_DIRS: unit tests are test-only, never shipped.
 _EXCLUDE_DIRS = {
-    ".git", "__pycache__", ".venv", "venv", ".stml",
+    ".git", "__pycache__", ".venv", "venv", ".stml", "tests",
     "node_modules", ".mypy_cache", ".ruff_cache", ".pytest_cache",
 }
 _EXCLUDE_NAMES = {".DS_Store"}
 _EXCLUDE_SUFFIXES = {".pyc", ".pyo"}
 
 
+def _is_env_file(name: str) -> bool:
+    """SECURITY: `.env` / `.env.<anything>` hold local credentials and must
+    never be pushed (`.env.example` is the secret-free template and may ship).
+    Matches packaging._is_env_file (the publish path)."""
+    return (name == ".env" or name.startswith(".env.")) and name != ".env.example"
+
+
 def to_posix_key(rel: Path) -> str:
     """A native relative path → the POSIX overlay key (forward slashes)."""
     return PurePosixPath(*rel.parts).as_posix()
@@ -86,6 +94,8 @@ def read_tree(root: Path) -> list[dict]:
             continue
         if p.name in _EXCLUDE_NAMES or p.suffix in _EXCLUDE_SUFFIXES:
             continue
+        if _is_env_file(p.name):
+            continue
         if not p.is_file():
             continue
         # Top-level assets/ is binary, bucket-backed media (written by pull's

stml_cli-0.1.9/stml_cli/update_check.py

@@ -0,0 +1,115 @@
+"""New-release notice (024 §Distributing the partner CLI).
+
+After a command finishes, print a one-line stderr notice when a newer
+``stml-cli`` release exists on PyPI — the way ``gh`` does it. Designed to
+never get in the way:
+
+- PyPI is asked at most once per day; the answer is cached in the config dir
+  (``update-check.json``) and reused between runs.
+- The fetch has a short timeout and every failure is swallowed (a run must
+  never fail or hang because PyPI is unreachable).
+- Quiet when stderr is not a TTY (scripts, CI, cron) and when
+  ``STML4_NO_UPDATE_CHECK`` is set.
+- Only plain ``X.Y.Z`` versions are compared; anything else (pre-releases,
+  odd tags) never triggers a notice.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import sys
+import time
+import urllib.request
+
+from . import __version__, config
+
+PYPI_JSON_URL = "https://pypi.org/pypi/stml-cli/json"
+CHECK_INTERVAL_S = 24 * 3600
+FETCH_TIMEOUT_S = 1.5
+
+_STATE_FILE = "update-check.json"
+_VERSION_RE = re.compile(r"^(\d+)\.(\d+)\.(\d+)$")
+
+
+def _parse(version: str) -> tuple[int, int, int] | None:
+    m = _VERSION_RE.match((version or "").strip())
+    return (int(m[1]), int(m[2]), int(m[3])) if m else None
+
+
+def is_newer(latest: str, current: str) -> bool:
+    """True only when both parse as plain X.Y.Z and latest > current."""
+    lat, cur = _parse(latest), _parse(current)
+    return bool(lat and cur and lat > cur)
+
+
+def _state_path():
+    return config.config_dir() / _STATE_FILE
+
+
+def _read_state() -> dict:
+    try:
+        state = json.loads(_state_path().read_text(encoding="utf-8"))
+        return state if isinstance(state, dict) else {}
+    except (OSError, json.JSONDecodeError, ValueError):
+        return {}
+
+
+def _write_state(state: dict) -> None:
+    try:
+        d = config.config_dir()
+        d.mkdir(parents=True, exist_ok=True)
+        _state_path().write_text(json.dumps(state), encoding="utf-8")
+    except OSError:  # read-only home, etc. — the notice is best-effort anyway
+        pass
+
+
+def fetch_latest() -> str | None:
+    """The newest version on PyPI, or None on any failure."""
+    try:
+        req = urllib.request.Request(
+            PYPI_JSON_URL, headers={"User-Agent": f"stml-cli/{__version__}"}
+        )
+        with urllib.request.urlopen(req, timeout=FETCH_TIMEOUT_S) as resp:
+            info = json.loads(resp.read().decode("utf-8")).get("info") or {}
+            return info.get("version") or None
+    except Exception:
+        return None
+
+
+def _interactive() -> bool:
+    """Notice-worthy terminal? Scripts and CI (non-TTY stderr) stay quiet."""
+    try:
+        return sys.stderr.isatty()
+    except Exception:
+        return False
+
+
+def maybe_notify(now: float | None = None) -> None:
+    """Refresh the cached latest version (at most daily) and print the notice.
+
+    Called once per invocation, after the command ran — so the one-time fetch
+    latency lands at exit, never before a command's output.
+    """
+    if os.environ.get("STML4_NO_UPDATE_CHECK"):
+        return
+    if not _interactive():
+        return
+
+    now = time.time() if now is None else now
+    state = _read_state()
+    if now - float(state.get("checked_at") or 0) >= CHECK_INTERVAL_S:
+        latest = fetch_latest()
+        # Stamp checked_at even on failure so an offline machine retries
+        # daily, not on every command.
+        state = {"checked_at": now, "latest": latest or state.get("latest")}
+        _write_state(state)
+
+    latest = state.get("latest")
+    if latest and is_newer(latest, __version__):
+        print(
+            f"\nA newer stml is available: {__version__} → {latest} — "
+            f"update with: pipx upgrade stml-cli",
+            file=sys.stderr,
+        )

{stml_cli-0.1.6 → stml_cli-0.1.9}/stml_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: stml-cli
-Version: 0.1.6
+Version: 0.1.9
 Summary: The stml partner CLI — pull, edit, push, and publish stml apps and libraries.
 Author: stml
 Project-URL: Homepage, https://stml.io
@@ -35,6 +35,12 @@ Spec: [`docs/user-stories/feature/024-app-authoring-platform.md`](../docs/user-s
 Runs on **macOS, Linux, and Windows** — it's pure-Python and touches nothing
 platform-specific beyond the filesystem and HTTPS.
 
+**Staying current**: after a command finishes, the CLI prints a one-line
+notice when a newer release exists on PyPI (checked at most once a day,
+cached, quiet when stderr isn't a terminal, never blocks or fails a command).
+Update with `pipx upgrade stml-cli`. Set `STML4_NO_UPDATE_CHECK=1` to turn
+the check off entirely.
+
 ## Quickstart
 
 ```sh

{stml_cli-0.1.6 → stml_cli-0.1.9}/stml_cli.egg-info/SOURCES.txt

@@ -9,6 +9,7 @@ stml_cli/oauth.py
 stml_cli/packaging.py
 stml_cli/paths.py
 stml_cli/refs.py
+stml_cli/update_check.py
 stml_cli.egg-info/PKG-INFO
 stml_cli.egg-info/SOURCES.txt
 stml_cli.egg-info/dependency_links.txt
@@ -16,6 +17,9 @@ stml_cli.egg-info/entry_points.txt
 stml_cli.egg-info/requires.txt
 stml_cli.egg-info/top_level.txt
 tests/test_disambiguation.py
+tests/test_init.py
 tests/test_paths.py
 tests/test_refs.py
+tests/test_sessions.py
+tests/test_update_check.py
 tests/test_whoami_expiry.py

stml_cli-0.1.9/tests/test_init.py

@@ -0,0 +1,42 @@
+from pathlib import Path
+from types import SimpleNamespace
+
+from stml_cli import commands, paths
+
+
+def test_init_scaffolds_src_layout_lib(tmp_path: Path):
+    target = tmp_path / "my-lib"
+    commands.cmd_init(SimpleNamespace(dir=str(target), name=None))
+
+    # src layout with a runnable example flow, exported in pyproject.
+    assert (target / "src" / "my_lib" / "__init__.py").is_file()
+    assert (target / "src" / "my_lib" / "hello.py").is_file()
+    pyproject = (target / "pyproject.toml").read_text()
+    assert 'entrypoint = "my_lib.hello:app"' in pyproject
+    # pytest works out of the box: dev dep + src on the test pythonpath.
+    assert "pytest" in pyproject and 'pythonpath = ["src"]' in pyproject
+    assert (target / "AGENTS.md").is_file()
+    assert (target / ".gitignore").is_file()
+
+    # tests/ is scaffolded but local-only: the stub imports the package name
+    # and push (read_tree) must not pick the folder up.
+    stub = (target / "tests" / "test_smoke.py").read_text()
+    assert "import my_lib" in stub
+    keys = {f["path"] for f in paths.read_tree(target)}
+    assert "my_lib/hello.py" in keys  # src/ stripped to flat overlay keys
+    assert not any(k.startswith("tests/") for k in keys)
+
+
+def test_init_scaffolded_smoke_test_passes(tmp_path: Path):
+    """The generated tests/test_smoke.py must actually pass in the scaffold."""
+    import subprocess
+    import sys
+
+    target = tmp_path / "demo-lib"
+    commands.cmd_init(SimpleNamespace(dir=str(target), name=None))
+    res = subprocess.run(
+        [sys.executable, "-m", "pytest", "tests/", "-q", "-p", "no:cacheprovider",
+         "--rootdir", str(target), "-o", 'pythonpath=src'],
+        cwd=target, capture_output=True, text=True,
+    )
+    assert res.returncode == 0, res.stdout + res.stderr

{stml_cli-0.1.6 → stml_cli-0.1.9}/tests/test_paths.py

@@ -114,6 +114,18 @@ def test_local_junk_is_excluded(tmp_path: Path):
     assert keys == {"flows/x.py"}  # .git, __pycache__, .stml, *.pyc all dropped
 
 
+def test_tests_dir_is_never_pushed(tmp_path: Path):
+    """tests/ is test-only and never shipped — push skips it like publish does
+    (packaging.EXCLUDE_DIRS), both top-level and under src/."""
+    paths.write_tree(tmp_path, [{"path": "flows/x.py", "content": "x=1\n"}])
+    (tmp_path / "tests").mkdir()
+    (tmp_path / "tests" / "test_x.py").write_text("def test_x(): pass\n")
+    (tmp_path / "src" / "tests").mkdir()
+    (tmp_path / "src" / "tests" / "test_y.py").write_text("def test_y(): pass\n")
+    keys = {f["path"] for f in paths.read_tree(tmp_path)}
+    assert keys == {"flows/x.py"}
+
+
 def test_assets_dir_is_never_pushed(tmp_path: Path):
     """Top-level assets/ is bucket-backed binary media (written by pull) — push
     must skip it (a .xlsx would crash read_text) but publish ships it from disk."""

stml_cli-0.1.9/tests/test_sessions.py

@@ -0,0 +1,76 @@
+"""Per-backend session store: file keying, isolation, legacy adoption."""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+
+from stml_cli import config
+
+
+@pytest.fixture
+def cfg_dir(tmp_path, monkeypatch):
+    monkeypatch.setattr(config, "config_dir", lambda: tmp_path)
+    return tmp_path
+
+
+def _session(backend: str, tag: str) -> dict:
+    return {
+        "backend": backend,
+        "access_token": f"at-{tag}",
+        "refresh_token": f"rt-{tag}",
+        "expires_at": 2_000_000_000,
+    }
+
+
+def test_session_filename_per_backend():
+    assert config._session_filename("https://api.stml.io") == "session-api.stml.io.json"
+    assert config._session_filename("http://localhost:8010") == "session-localhost-8010.json"
+    # trailing slash and case don't change the key
+    assert config._session_filename("https://API.stml.io/") == "session-api.stml.io.json"
+
+
+def test_sessions_are_isolated_per_backend(cfg_dir):
+    config.write_session(_session("http://localhost:8010", "dev"))
+    config.write_session(_session("https://api.stml.io", "prod"))
+
+    assert config.read_session("http://localhost:8010")["access_token"] == "at-dev"
+    assert config.read_session("https://api.stml.io")["access_token"] == "at-prod"
+    # logging out of one backend leaves the other untouched
+    assert config.clear_session("http://localhost:8010") is True
+    assert config.read_session("http://localhost:8010") is None
+    assert config.read_session("https://api.stml.io")["access_token"] == "at-prod"
+
+
+def test_write_session_requires_backend(cfg_dir):
+    with pytest.raises(ValueError):
+        config.write_session({"access_token": "x", "refresh_token": "y"})
+
+
+def test_legacy_session_adopted_for_matching_backend(cfg_dir):
+    legacy = cfg_dir / "session.json"
+    legacy.write_text(json.dumps(_session("http://localhost:8010", "old")))
+
+    sess = config.read_session("http://localhost:8010")
+    assert sess and sess["access_token"] == "at-old"
+    # migrated: per-backend file exists, legacy single file is gone
+    assert (cfg_dir / "session-localhost-8010.json").exists()
+    assert not legacy.exists()
+
+
+def test_legacy_session_left_alone_for_other_backend(cfg_dir):
+    legacy = cfg_dir / "session.json"
+    legacy.write_text(json.dumps(_session("https://api.stml.io", "prod")))
+
+    assert config.read_session("http://localhost:8010") is None
+    assert legacy.exists()  # still owned by prod; adopted when prod is targeted
+
+
+def test_clear_session_removes_matching_legacy_file(cfg_dir):
+    legacy = cfg_dir / "session.json"
+    legacy.write_text(json.dumps(_session("https://api.stml.io", "prod")))
+
+    assert config.clear_session("https://api.stml.io") is True
+    assert not legacy.exists()
+    assert config.clear_session("https://api.stml.io") is False

stml_cli-0.1.9/tests/test_update_check.py

@@ -0,0 +1,95 @@
+"""Update notice: version comparison, daily cache, and notify gating."""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+
+from stml_cli import config, update_check
+
+
+@pytest.fixture
+def cfg_dir(tmp_path, monkeypatch):
+    monkeypatch.setattr(config, "config_dir", lambda: tmp_path)
+    return tmp_path
+
+
+@pytest.fixture
+def tty_stderr(monkeypatch):
+    """maybe_notify is TTY-gated; pretend we're interactive. (Patching the
+    gate, not sys.stderr — capsys swaps the stream object mid-test.)"""
+    monkeypatch.setattr(update_check, "_interactive", lambda: True)
+
+
+def test_is_newer_plain_triples():
+    assert update_check.is_newer("0.2.0", "0.1.9")
+    assert update_check.is_newer("1.0.0", "0.9.9")
+    assert not update_check.is_newer("0.1.9", "0.1.9")
+    assert not update_check.is_newer("0.1.8", "0.1.9")
+
+
+def test_is_newer_rejects_non_plain_versions():
+    # Pre-releases / odd tags never trigger a notice.
+    assert not update_check.is_newer("0.2.0rc1", "0.1.9")
+    assert not update_check.is_newer("banana", "0.1.9")
+    assert not update_check.is_newer("0.2", "0.1.9")
+    assert not update_check.is_newer("0.2.0", "0.1.9.dev0")
+
+
+def test_notifies_from_fresh_cache_without_fetch(cfg_dir, tty_stderr, monkeypatch, capsys):
+    (cfg_dir / "update-check.json").write_text(
+        json.dumps({"checked_at": 1_000_000, "latest": "99.0.0"})
+    )
+    monkeypatch.setattr(
+        update_check, "fetch_latest", lambda: pytest.fail("fresh cache must not fetch")
+    )
+    update_check.maybe_notify(now=1_000_000 + 60)
+    assert "99.0.0" in capsys.readouterr().err
+
+
+def test_stale_cache_fetches_and_persists(cfg_dir, tty_stderr, monkeypatch, capsys):
+    monkeypatch.setattr(update_check, "fetch_latest", lambda: "99.0.0")
+    update_check.maybe_notify(now=5_000_000)
+    assert "99.0.0" in capsys.readouterr().err
+    state = json.loads((cfg_dir / "update-check.json").read_text())
+    assert state == {"checked_at": 5_000_000, "latest": "99.0.0"}
+
+
+def test_failed_fetch_stamps_checked_at_and_keeps_old_latest(
+    cfg_dir, tty_stderr, monkeypatch, capsys
+):
+    (cfg_dir / "update-check.json").write_text(
+        json.dumps({"checked_at": 0, "latest": "99.0.0"})
+    )
+    monkeypatch.setattr(update_check, "fetch_latest", lambda: None)
+    update_check.maybe_notify(now=5_000_000)
+    assert "99.0.0" in capsys.readouterr().err  # old answer still notifies
+    state = json.loads((cfg_dir / "update-check.json").read_text())
+    assert state["checked_at"] == 5_000_000  # offline machines retry daily, not per-command
+    assert state["latest"] == "99.0.0"
+
+
+def test_no_notice_when_up_to_date(cfg_dir, tty_stderr, monkeypatch, capsys):
+    monkeypatch.setattr(update_check, "fetch_latest", lambda: update_check.__version__)
+    update_check.maybe_notify(now=5_000_000)
+    assert capsys.readouterr().err == ""
+
+
+def test_silent_when_disabled_by_env(cfg_dir, tty_stderr, monkeypatch, capsys):
+    monkeypatch.setenv("STML4_NO_UPDATE_CHECK", "1")
+    monkeypatch.setattr(
+        update_check, "fetch_latest", lambda: pytest.fail("disabled must not fetch")
+    )
+    update_check.maybe_notify(now=5_000_000)
+    assert capsys.readouterr().err == ""
+    assert not (cfg_dir / "update-check.json").exists()
+
+
+def test_silent_when_stderr_is_not_a_tty(cfg_dir, monkeypatch, capsys):
+    monkeypatch.setattr(update_check, "_interactive", lambda: False)
+    monkeypatch.setattr(
+        update_check, "fetch_latest", lambda: pytest.fail("non-tty must not fetch")
+    )
+    update_check.maybe_notify(now=5_000_000)
+    assert capsys.readouterr().err == ""

stml_cli-0.1.6/stml_cli/config.py

@@ -1,64 +0,0 @@
-"""Per-OS config dir + the cached login session (024 §OS & runtime support §4).
-
-The refresh token lives here between commands; access tokens are minted per
-call and never persisted. The file is written user-only where the OS supports
-it (``chmod`` is a no-op on Windows, which relies on the per-user profile dir).
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import sys
-from pathlib import Path
-
-DEFAULT_BACKEND = os.environ.get("STML4_BACKEND", "https://api.stml.io")
-
-_SESSION_FILE = "session.json"
-
-
-def config_dir() -> Path:
-    """OS-appropriate config directory for stml (created on demand)."""
-    if sys.platform == "darwin":
-        base = Path.home() / "Library" / "Application Support"
-    elif os.name == "nt":
-        base = Path(os.environ.get("APPDATA") or (Path.home() / "AppData" / "Roaming"))
-    else:  # Linux / other POSIX
-        base = Path(os.environ.get("XDG_CONFIG_HOME") or (Path.home() / ".config"))
-    return base / "stml"
-
-
-def _session_path() -> Path:
-    return config_dir() / _SESSION_FILE
-
-
-def read_session() -> dict | None:
-    """Return the cached session dict, or None if not logged in."""
-    p = _session_path()
-    if not p.exists():
-        return None
-    try:
-        return json.loads(p.read_text(encoding="utf-8"))
-    except (json.JSONDecodeError, OSError):
-        return None
-
-
-def write_session(session: dict) -> None:
-    """Persist the session dict with user-only perms where supported."""
-    d = config_dir()
-    d.mkdir(parents=True, exist_ok=True)
-    p = _session_path()
-    p.write_text(json.dumps(session, indent=2), encoding="utf-8")
-    try:  # best-effort; POSIX only
-        os.chmod(p, 0o600)
-    except OSError:  # pragma: no cover
-        pass
-
-
-def clear_session() -> bool:
-    """Delete the cached session. Returns True if one was present."""
-    p = _session_path()
-    if p.exists():
-        p.unlink()
-        return True
-    return False