strictcli 0.30.0__tar.gz → 0.31.0__tar.gz

strictcli-0.30.0/.github/workflows/ci-pypi.yml → strictcli-0.31.0/.github/workflows/ci.yml

@@ -26,4 +26,8 @@ jobs:
       - run: uv python install ${{ matrix.python-version }}
       - run: uv sync --locked
       - run: uv run python -c "import strictcli"
-      - run: uv run pytest
+      - name: Install gitleaks
+        run: |
+          GITLEAKS_VERSION=8.24.3
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin gitleaks
+      - run: uv run pytest --rootdir .

{strictcli-0.30.0 → strictcli-0.31.0}/.github/workflows/publish.yml

@@ -3,8 +3,18 @@ on:
   release:
     types: [published]
   workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to publish (e.g. v1.2.3). Overrides the ref for
+          retry dispatch.
+        required: false
+        type: string
+
+# One publish run per tag: a workflow_dispatch retry at the same tag
+# queues behind the in-flight run instead of racing it. A publish is never
+# cancelled mid-flight.
 concurrency:
-  group: ${{ github.workflow_ref }}-${{ github.ref }}
+  group: publish-${{ inputs.tag || github.ref_name }}
   cancel-in-progress: false
 permissions:
   contents: read
@@ -20,16 +30,57 @@ jobs:
       GATE_TIMEOUT_MINUTES: '20'
       GATE_GRACE_MINUTES: '5'
       GATE_POLL_SECONDS: '15'
+      GATE_MARKER_ATTEMPTS: '5'
+      GATE_MARKER_RETRY_SECONDS: '5'
       CI_CHECK_REGEX: ^(test)( \(.*\))?$
     steps:
       - name: Wait for CI to succeed on the release commit
         run: |
           set -euo pipefail
 
-          # Ref-based commit resolution: GITHUB_SHA is the tag's commit for both
-          # release-triggered runs and workflow_dispatch retries at the tag ref.
-          # Never read the release event payload -- dispatch retries have none.
-          sha="$GITHUB_SHA"
+          # Commit resolution -- explicit marker-first order (never reads the release
+          # event payload; dispatch retries have none, so this path is uniform for
+          # release events and dispatch retries alike):
+          #   (1) Marker: rlsbl writes the exact commit CI ran on into the GitHub
+          #       Release body as a machine-parseable line of the form
+          #           <!-- rlsbl-ci-sha: <40-hex> -->
+          #       Prefer it when present -- it pins the precise commit and is immune to
+          #       ref races. A just-created release can lag on a GitHub API read replica
+          #       (the marker is written at release creation but may not be visible on
+          #       the first read), so RETRY the read GATE_MARKER_ATTEMPTS times,
+          #       GATE_MARKER_RETRY_SECONDS apart, before concluding it is absent. The
+          #       tag is inputs.tag (TAG_INPUT) when dispatched with an explicit
+          #       override, else GITHUB_REF_NAME (matches the router resolver).
+          #   (2) Fallback: older releases predate the marker, so fall back to
+          #       $GITHUB_SHA, the tag's commit for both release and dispatch-at-tag.
+          extract_ci_sha() {
+            # Emit the first rlsbl-ci-sha marker SHA found on stdin, if any.
+            sed -n 's/.*<!-- rlsbl-ci-sha: \([0-9a-f]\{40\}\) -->.*/\1/p' | head -n1
+          }
+          tag="${TAG_INPUT:-$GITHUB_REF_NAME}"
+          marker_attempts="${GATE_MARKER_ATTEMPTS:-5}"
+          marker_retry_seconds="${GATE_MARKER_RETRY_SECONDS:-5}"
+          sha=""
+          attempt=1
+          while [ "$attempt" -le "$marker_attempts" ]; do
+            if body="$(gh release view "$tag" --json body --jq .body 2>/dev/null)"; then
+              sha="$(printf '%s\n' "$body" | extract_ci_sha)"
+            fi
+            if [ -n "$sha" ]; then
+              break
+            fi
+            if [ "$attempt" -lt "$marker_attempts" ]; then
+              echo "Publish gate: rlsbl-ci-sha marker not yet visible in the '$tag' release body (attempt $attempt/$marker_attempts); retrying in ${marker_retry_seconds}s..."
+              sleep "$marker_retry_seconds"
+            fi
+            attempt=$(( attempt + 1 ))
+          done
+          if [ -n "$sha" ]; then
+            echo "Publish gate: resolved release commit from rlsbl-ci-sha marker in the '$tag' release body."
+          else
+            sha="$GITHUB_SHA"
+            echo "Publish gate: no rlsbl-ci-sha marker after $marker_attempts attempt(s) on the '$tag' release body; falling back to \$GITHUB_SHA."
+          fi
           echo "Publish gate: waiting for CI on $GITHUB_REF_NAME (commit $sha)"
           echo "Check-run name filter: $CI_CHECK_REGEX"
           # Timeout, grace window, and poll interval come from the job env above;
@@ -49,11 +100,19 @@ jobs:
             # Match this project's CI check runs by name; exclude check runs that
             # belong to THIS workflow run (the gate itself and the queued publish
             # jobs would otherwise deadlock the poll loop).
+            # A retried CI run creates a BRAND-NEW check-run with the same name as the
+            # old one, so a stale failure would block the gate forever. Project id and
+            # started_at, then reduce to the latest check-run per name (max started_at,
+            # numeric id as tiebreak for retries within the same second) BEFORE the
+            # pending / not-success logic runs. This way the newest run decides: still
+            # running -> wait; genuinely red -> hard fail.
             runs="$(jq -s --arg re "$CI_CHECK_REGEX" --arg run_id "$GITHUB_RUN_ID" '
               [ .[].check_runs[]
                 | select(.name | test($re))
                 | select((.details_url // "") | contains("/actions/runs/" + $run_id + "/") | not)
-                | {name, status, conclusion} ]' <<< "$resp")"
+                | {name, status, conclusion, id, started_at} ]
+              | group_by(.name)
+              | map(sort_by(.started_at, .id) | last)' <<< "$resp")"
             total="$(jq 'length' <<< "$runs")"
 
             if [ "$total" -eq 0 ]; then
@@ -112,41 +171,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.tag || github.event.release.tag_name }}
       - uses: astral-sh/setup-uv@v7
+      - name: Install gitleaks
+        run: |
+          GITLEAKS_VERSION=8.24.3
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin gitleaks
       - run: uv build --out-dir dist
+      - name: Scan artifacts for secrets
+        run: |
+          gitleaks dir dist/
       - uses: pypa/gh-action-pypi-publish@release/v1
         with:
           skip-existing: true
-  npm:
-    needs: gate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-      - name: Check if already published
-        id: check-npm
-        run: |
-          PKG_NAME=$(node -p "require('./package.json').name")
-          PKG_VERSION=$(node -p "require('./package.json').version")
-          if npm view "${PKG_NAME}@${PKG_VERSION}" version 2>/dev/null; then
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            echo "Already published: ${PKG_NAME}@${PKG_VERSION}"
-          fi
-      - name: Determine dist-tag
-        id: dist-tag
-        run: |
-          PKG_VERSION=$(node -p "require('./package.json').version")
-          if echo "$PKG_VERSION" | grep -q '-'; then
-            PREID=$(echo "$PKG_VERSION" | sed 's/[^-]*-//' | sed 's/\.[^.]*$//')
-            echo "tag=--tag $PREID" >> "$GITHUB_OUTPUT"
-          else
-            echo "tag=" >> "$GITHUB_OUTPUT"
-          fi
-      - run: npm publish --provenance --access public ${{ 
-          steps.dist-tag.outputs.tag }}
-        if: steps.check-npm.outputs.skip != 'true'
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

strictcli-0.31.0/.gitignore

@@ -0,0 +1,20 @@
+node_modules/
+__pycache__/
+*.pyc
+*.log
+.DS_Store
+coverage/
+dist/
+*.egg-info/
+.rlsbl-notes-*.tmp
+.rlsbl/lock
+.credentials.json
+.*-cache.json
+.env
+.env.local
+*.local-only
+
+.rlsbl-monorepo/lock
+
+build/
+target/

strictcli-0.31.0/.rlsbl/bases/.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+# Per-SHA group: re-runs of the same commit dedupe, but a new commit never
+# cancels an earlier commit's in-flight run (release CI conclusions stay intact).
+concurrency:
+  group: ${{ github.workflow_ref }}-${{ github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # requires-python: >= 3.11
+        python-version: ["3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v7
+      - run: uv python install ${{ matrix.python-version }}
+      - run: uv sync --locked
+      - run: uv run python -c "import strictcli"
+      - name: Install gitleaks
+        run: |
+          GITLEAKS_VERSION=8.24.3
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin gitleaks
+      - run: uv run pytest --rootdir .

strictcli-0.31.0/.rlsbl/bases/.github/workflows/publish.yml

@@ -0,0 +1,187 @@
+name: Publish
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to publish (e.g. v1.2.3). Overrides the ref for
+          retry dispatch.
+        required: false
+        type: string
+
+# One publish run per tag: a workflow_dispatch retry at the same tag
+# queues behind the in-flight run instead of racing it. A publish is never
+# cancelled mid-flight.
+concurrency:
+  group: publish-${{ inputs.tag || github.ref_name }}
+  cancel-in-progress: false
+permissions:
+  contents: read
+  id-token: write
+jobs:
+  gate:
+    name: Gate on CI
+    runs-on: ubuntu-latest
+    permissions:
+      checks: read
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GATE_TIMEOUT_MINUTES: '20'
+      GATE_GRACE_MINUTES: '5'
+      GATE_POLL_SECONDS: '15'
+      GATE_MARKER_ATTEMPTS: '5'
+      GATE_MARKER_RETRY_SECONDS: '5'
+      CI_CHECK_REGEX: ^(test)( \(.*\))?$
+    steps:
+      - name: Wait for CI to succeed on the release commit
+        run: |
+          set -euo pipefail
+
+          # Commit resolution -- explicit marker-first order (never reads the release
+          # event payload; dispatch retries have none, so this path is uniform for
+          # release events and dispatch retries alike):
+          #   (1) Marker: rlsbl writes the exact commit CI ran on into the GitHub
+          #       Release body as a machine-parseable line of the form
+          #           <!-- rlsbl-ci-sha: <40-hex> -->
+          #       Prefer it when present -- it pins the precise commit and is immune to
+          #       ref races. A just-created release can lag on a GitHub API read replica
+          #       (the marker is written at release creation but may not be visible on
+          #       the first read), so RETRY the read GATE_MARKER_ATTEMPTS times,
+          #       GATE_MARKER_RETRY_SECONDS apart, before concluding it is absent. The
+          #       tag is inputs.tag (TAG_INPUT) when dispatched with an explicit
+          #       override, else GITHUB_REF_NAME (matches the router resolver).
+          #   (2) Fallback: older releases predate the marker, so fall back to
+          #       $GITHUB_SHA, the tag's commit for both release and dispatch-at-tag.
+          extract_ci_sha() {
+            # Emit the first rlsbl-ci-sha marker SHA found on stdin, if any.
+            sed -n 's/.*<!-- rlsbl-ci-sha: \([0-9a-f]\{40\}\) -->.*/\1/p' | head -n1
+          }
+          tag="${TAG_INPUT:-$GITHUB_REF_NAME}"
+          marker_attempts="${GATE_MARKER_ATTEMPTS:-5}"
+          marker_retry_seconds="${GATE_MARKER_RETRY_SECONDS:-5}"
+          sha=""
+          attempt=1
+          while [ "$attempt" -le "$marker_attempts" ]; do
+            if body="$(gh release view "$tag" --json body --jq .body 2>/dev/null)"; then
+              sha="$(printf '%s\n' "$body" | extract_ci_sha)"
+            fi
+            if [ -n "$sha" ]; then
+              break
+            fi
+            if [ "$attempt" -lt "$marker_attempts" ]; then
+              echo "Publish gate: rlsbl-ci-sha marker not yet visible in the '$tag' release body (attempt $attempt/$marker_attempts); retrying in ${marker_retry_seconds}s..."
+              sleep "$marker_retry_seconds"
+            fi
+            attempt=$(( attempt + 1 ))
+          done
+          if [ -n "$sha" ]; then
+            echo "Publish gate: resolved release commit from rlsbl-ci-sha marker in the '$tag' release body."
+          else
+            sha="$GITHUB_SHA"
+            echo "Publish gate: no rlsbl-ci-sha marker after $marker_attempts attempt(s) on the '$tag' release body; falling back to \$GITHUB_SHA."
+          fi
+          echo "Publish gate: waiting for CI on $GITHUB_REF_NAME (commit $sha)"
+          echo "Check-run name filter: $CI_CHECK_REGEX"
+          # Timeout, grace window, and poll interval come from the job env above;
+          # edit them there if this repository's CI needs different limits.
+
+          now() { date +%s; }
+          start="$(now)"
+          deadline=$(( start + GATE_TIMEOUT_MINUTES * 60 ))
+          grace_deadline=$(( start + GATE_GRACE_MINUTES * 60 ))
+
+          while :; do
+            if ! resp="$(gh api --paginate "repos/$GITHUB_REPOSITORY/commits/$sha/check-runs?per_page=100")"; then
+              echo "Checks API request failed; retrying in ${GATE_POLL_SECONDS}s..."
+              sleep "$GATE_POLL_SECONDS"
+              continue
+            fi
+            # Match this project's CI check runs by name; exclude check runs that
+            # belong to THIS workflow run (the gate itself and the queued publish
+            # jobs would otherwise deadlock the poll loop).
+            # A retried CI run creates a BRAND-NEW check-run with the same name as the
+            # old one, so a stale failure would block the gate forever. Project id and
+            # started_at, then reduce to the latest check-run per name (max started_at,
+            # numeric id as tiebreak for retries within the same second) BEFORE the
+            # pending / not-success logic runs. This way the newest run decides: still
+            # running -> wait; genuinely red -> hard fail.
+            runs="$(jq -s --arg re "$CI_CHECK_REGEX" --arg run_id "$GITHUB_RUN_ID" '
+              [ .[].check_runs[]
+                | select(.name | test($re))
+                | select((.details_url // "") | contains("/actions/runs/" + $run_id + "/") | not)
+                | {name, status, conclusion, id, started_at} ]
+              | group_by(.name)
+              | map(sort_by(.started_at, .id) | last)' <<< "$resp")"
+            total="$(jq 'length' <<< "$runs")"
+
+            if [ "$total" -eq 0 ]; then
+              if [ "$(now)" -ge "$grace_deadline" ]; then
+                echo "::error::Publish gate: no CI check runs matching $CI_CHECK_REGEX appeared on $sha within $GATE_GRACE_MINUTES minutes."
+                echo "A scaffolded repository always has a CI workflow, so the release commit must produce CI check runs."
+                echo "If CI jobs were renamed, update CI_CHECK_REGEX in this workflow's gate job to match the new names."
+                exit 1
+              fi
+              echo "No matching CI check runs yet; retrying in ${GATE_POLL_SECONDS}s..."
+              sleep "$GATE_POLL_SECONDS"
+              continue
+            fi
+
+            pending="$(jq '[ .[] | select(.status != "completed") ] | length' <<< "$runs")"
+            if [ "$pending" -gt 0 ]; then
+              if [ "$(now)" -ge "$deadline" ]; then
+                echo "::error::Publish gate: timed out after $GATE_TIMEOUT_MINUTES minutes waiting for CI to complete on $sha."
+                jq -r '.[] | "  \(.name): status=\(.status) conclusion=\(.conclusion // "none")"' <<< "$runs"
+                exit 1
+              fi
+              echo "$pending of $total matching CI check runs still running; retrying in ${GATE_POLL_SECONDS}s..."
+              sleep "$GATE_POLL_SECONDS"
+              continue
+            fi
+
+            not_success="$(jq '[ .[] | select(.conclusion != "success") ]' <<< "$runs")"
+            if [ "$(jq 'length' <<< "$not_success")" -gt 0 ]; then
+              echo "::error::Publish gate: CI did not pass on $sha -- refusing to publish."
+              jq -r '.[] | "  \(.name): \(.conclusion)"' <<< "$not_success"
+              while IFS= read -r conclusion; do
+                case "$conclusion" in
+                  failure|timed_out)
+                    echo "CI concluded '$conclusion' on the release commit. Fix the failure, re-run the CI workflow to green on this exact commit (gh run rerun <run-id>), then re-dispatch this publish workflow at the tag ref: gh workflow run <publish workflow> --ref $GITHUB_REF_NAME"
+                    ;;
+                  cancelled)
+                    echo "A CI check run was CANCELLED. A cancelled run proves nothing about the commit, so the gate treats it as a hard failure instead of waiting for a conclusion that will never come. Re-run the cancelled CI workflow (gh run rerun <run-id>), then re-dispatch this publish workflow at the tag ref."
+                    ;;
+                  skipped)
+                    echo "A CI check run matching the filter was SKIPPED. The gate cannot treat a skipped check as passing: this project's own CI must actually run on the release commit. Check paths filters and job conditions, re-run CI on this commit, then re-dispatch this publish workflow at the tag ref."
+                    ;;
+                  *)
+                    echo "CI check concluded '$conclusion' (not success). The gate only proceeds when every matching check concluded success."
+                    ;;
+                esac
+              done <<< "$(jq -r '.[].conclusion' <<< "$not_success" | sort -u)"
+              exit 1
+            fi
+
+            echo "Publish gate: all $total matching CI check runs succeeded."
+            jq -r '.[] | "  \(.name): \(.conclusion)"' <<< "$runs"
+            exit 0
+          done
+  pypi:
+    needs: gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.tag || github.event.release.tag_name }}
+      - uses: astral-sh/setup-uv@v7
+      - name: Install gitleaks
+        run: |
+          GITLEAKS_VERSION=8.24.3
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar xz -C /usr/local/bin gitleaks
+      - run: uv build --out-dir dist
+      - name: Scan artifacts for secrets
+        run: |
+          gitleaks dir dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true

{strictcli-0.30.0 → strictcli-0.31.0/.rlsbl/bases}/.gitignore

@@ -4,14 +4,15 @@ __pycache__/
 *.log
 .DS_Store
 coverage/
+build/
 dist/
+target/
 *.egg-info/
 .rlsbl-notes-*.tmp
 .rlsbl/lock
+.rlsbl-monorepo/lock
 .credentials.json
 .*-cache.json
 .env
 .env.local
 *.local-only
-
-.rlsbl-monorepo/lock

strictcli-0.31.0/.rlsbl/bases/.rlsbl/lint/python.toml

@@ -0,0 +1,25 @@
+[forbidden-imports]
+modules = [
+    "argparse",
+    "click",
+    "typer",
+    "flask",
+    "fastapi",
+    "django",
+    "uvicorn",
+    "granian",
+    "starlette",
+    "tornado",
+    "bottle",
+]
+
+[stdout]
+enabled = true
+ignore = []
+
+[entry-point]
+enabled = true
+ignore = []
+
+[files]
+exclude = []

{strictcli-0.30.0 → strictcli-0.31.0}/.rlsbl/config.json

@@ -1,7 +1,6 @@
 {
   "targets": [
-    "pypi",
-    "npm"
+    "pypi"
   ],
   "publish_mode": "ci",
   "push_timeout": 300,
@@ -10,12 +9,6 @@
       "type": "pypi",
       "target": "pypi",
       "local": false
-    },
-    "npm": {
-      "type": "npm",
-      "target": "npm",
-      "local": false,
-      "provenance": true
     }
   },
   "coverage_unit": "commit"

strictcli-0.31.0/.rlsbl/lint/python.toml

@@ -0,0 +1,25 @@
+[forbidden-imports]
+modules = [
+    "argparse",
+    "click",
+    "typer",
+    "flask",
+    "fastapi",
+    "django",
+    "uvicorn",
+    "granian",
+    "starlette",
+    "tornado",
+    "bottle",
+]
+
+[stdout]
+enabled = true
+ignore = []
+
+[entry-point]
+enabled = true
+ignore = []
+
+[files]
+exclude = []

strictcli-0.31.0/.rlsbl/managed-files.json

@@ -0,0 +1,9 @@
+{
+  "version": 1,
+  "files": {
+    ".github/workflows/ci.yml": "bfcdec1fcd8ff944f7ba7eb114ab091d0c5158f499ed4632945c2c4ca2d868df",
+    ".github/workflows/publish.yml": "9bc0b409f8c5c2a3c5795a3e7c66095b9479c1a03fb41250ff0461e1221b54f2",
+    ".gitignore": "a102f466628d2d28aea6b2157c1b406b1911d788b596b5b84f4952f121539d42",
+    ".rlsbl/lint/python.toml": "9cfbcef2e010d5fad243437bf2fd8df54a1fae70ee0762f9d11da70fe207501c"
+  }
+}

strictcli-0.31.0/.rlsbl/version

@@ -0,0 +1 @@
+0.108.0

{strictcli-0.30.0 → strictcli-0.31.0}/CLAUDE.md

@@ -16,5 +16,5 @@ This project uses [rlsbl](https://github.com/smm-h/rlsbl) for release orchestrat
 - No tokens or secrets in command-line arguments (use env vars or config files)
 - All file writes to shared state should be atomic (write to tmp, then rename)
 - External calls (APIs, CLI tools) must have timeouts and graceful fallbacks
-- Use `npm link` (npm) or `uv pip install -e .` (Python) for local development
+- Use `uv pip install -e .` for local development
 - CI runs smoke tests on every push; manual testing for UI/UX changes

{strictcli-0.30.0 → strictcli-0.31.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: strictcli
-Version: 0.30.0
+Version: 0.31.0
 Summary: A strict CLI framework for Python
 Project-URL: Homepage, https://github.com/smm-h/strictcli
 Project-URL: Repository, https://github.com/smm-h/strictcli

{strictcli-0.30.0 → strictcli-0.31.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "strictcli"
-version = "0.30.0"
+version = "0.31.0"
 description = "A strict CLI framework for Python"
 readme = "README.md"
 license = "MIT"

{strictcli-0.30.0 → strictcli-0.31.0}/strictcli/__init__.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-__version__ = "0.30.0"
+__version__ = "0.31.0"
 
 __all__ = [
     "App", "Flag", "Arg", "FlagSet", "MutexGroup", "CoRequired", "Requires",
@@ -2843,6 +2843,7 @@ class App:
         if self._coverage_shard_path is None:
             return
         path = self._coverage_shard_path.format(n=self._coverage_shard_counter)
+        os.makedirs(os.path.dirname(path), exist_ok=True)
         with open(path, "a", encoding="utf-8") as f:
             f.write(json.dumps({"command": cmd_path}) + "\n")
 
@@ -7716,26 +7717,27 @@ def _mcp_handle_tools_list(
 
 def _mcp_handle_tools_call(
     app: App,
-    commands: dict[str, tuple[Command, str]],
     req_id: object,
     params: dict,
 ) -> dict:
     """Handle the MCP 'tools/call' request."""
-    tool_name = params.get("name")
-    if not isinstance(tool_name, str):
+    if "name" not in params:
         return _mcp_jsonrpc_error(
-            req_id, -32602, "missing or invalid 'name' in params",
+            req_id, -32602, "missing required parameter: name",
         )
-
-    if tool_name not in commands:
+    tool_name = params["name"]
+    if not isinstance(tool_name, str):
         return _mcp_jsonrpc_error(
-            req_id, -32602, f"unknown tool: {tool_name}",
+            req_id, -32602, "parameter 'name' must be a string",
         )
 
+    # Unknown tools are NOT a -32602 protocol error: like Go, the name is
+    # passed to app.call(), whose invocation error surfaces as tool-result
+    # error content (isError) below.
     arguments = params.get("arguments", {})
     if not isinstance(arguments, dict):
         return _mcp_jsonrpc_error(
-            req_id, -32602, "'arguments' must be an object",
+            req_id, -32602, "parameter 'arguments' must be an object",
         )
 
     try:
@@ -7793,7 +7795,7 @@ def _run_mcp_server(
             app, commands, req_id,
         ),
         "tools/call": lambda req_id, params: _mcp_handle_tools_call(
-            app, commands, req_id, params,
+            app, req_id, params,
         ),
     }
 

{strictcli-0.30.0 → strictcli-0.31.0}/tests/test_mcp.py

@@ -299,6 +299,11 @@ class TestMcpToolsCall:
         assert parsed == {"migrated": True, "dry_run": True}
 
     def test_call_unknown_tool(self):
+        """Unknown tools surface as tool-result errors (isError), not -32602.
+
+        Matches Go: the name is passed to Call, whose invocation error
+        becomes error content in the result.
+        """
         app = _build_app()
 
         @app.command("cmd", help="a command")
@@ -309,8 +314,12 @@ class TestMcpToolsCall:
             "jsonrpc": "2.0", "id": 15, "method": "tools/call",
             "params": {"name": "nonexistent", "arguments": {}},
         })
-        assert resp["error"]["code"] == -32602
-        assert "unknown tool" in resp["error"]["message"]
+        assert "error" not in resp
+        assert resp["result"]["isError"] is True
+        content = resp["result"]["content"]
+        assert len(content) == 1
+        assert content[0]["type"] == "text"
+        assert content[0]["text"] == "unknown command 'nonexistent'"
 
     def test_call_missing_required_flag(self):
         app = _build_app()
@@ -342,6 +351,35 @@ class TestMcpToolsCall:
             "params": {"arguments": {}},
         })
         assert resp["error"]["code"] == -32602
+        assert resp["error"]["message"] == "missing required parameter: name"
+
+    def test_call_non_string_name(self):
+        app = _build_app()
+
+        @app.command("cmd", help="a command")
+        def cmd(ctx):
+            pass
+
+        resp = _send_one(app, {
+            "jsonrpc": "2.0", "id": 19, "method": "tools/call",
+            "params": {"name": 42, "arguments": {}},
+        })
+        assert resp["error"]["code"] == -32602
+        assert resp["error"]["message"] == "parameter 'name' must be a string"
+
+    def test_call_non_object_arguments(self):
+        app = _build_app()
+
+        @app.command("cmd", help="a command")
+        def cmd(ctx):
+            pass
+
+        resp = _send_one(app, {
+            "jsonrpc": "2.0", "id": 20, "method": "tools/call",
+            "params": {"name": "cmd", "arguments": ["not", "an", "object"]},
+        })
+        assert resp["error"]["code"] == -32602
+        assert resp["error"]["message"] == "parameter 'arguments' must be an object"
 
     def test_call_no_arguments_key(self):
         """When 'arguments' is omitted, defaults to empty dict."""

{strictcli-0.30.0 → strictcli-0.31.0}/uv.lock

@@ -232,7 +232,7 @@ wheels = [
 
 [[package]]
 name = "strictcli"
-version = "0.30.0"
+version = "0.31.0"
 source = { editable = "." }
 dependencies = [
     { name = "tomlkit" },

strictcli-0.30.0/.github/workflows/ci.yml

@@ -1,22 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        # requires-python: >= 3.11
-        python-version: ["3.12", "3.13", "3.14"]
-    steps:
-      - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
-      - run: uv python install ${{ matrix.python-version }}
-      - run: uv sync
-      - run: uv run python -c "import strictcli"

strictcli-0.30.0/.npmignore

@@ -1,34 +0,0 @@
-# Development and CI
-tests/
-test/
-__tests__/
-.github/
-scripts/
-docs/
-todo/
-e2e/
-
-# rlsbl metadata
-.rlsbl/
-.rlsbl-monorepo/
-
-# Python artifacts (for multi-target projects)
-__pycache__/
-*.pyc
-*.py
-*.toml
-.venv/
-
-# Build/cache
-coverage/
-.nyc_output/
-
-# Editor/OS
-.DS_Store
-*.log
-.env
-.env.local
-
-# Selfdoc
-.selfdoc/
-selfdoc.json

strictcli-0.30.0/.rlsbl/managed-files.json

@@ -1,11 +0,0 @@
-{
-  "version": 1,
-  "files": {
-    ".github/workflows/ci-pypi.yml": "6bde3f6dd33979636f6a8f51721f85519c4d2b6106cb9c9fa78e540df26471c4",
-    ".npmignore": "7c0eea9785c0318aeb39bf8b670ce8384f4a5b812fde69ce23d7d018057325a3",
-    ".github/workflows/publish.yml": "20db711b8a7745c3ab41814b827e946d60e937e82ee3984e86f39567717199b1",
-    ".gitignore": "c0582f9b1c640f9f9a8acbbe02cd19fff50e66cc595f25e129b7cc9b6cd357db",
-    ".rlsbl/lint/python.toml": "9cfbcef2e010d5fad243437bf2fd8df54a1fae70ee0762f9d11da70fe207501c",
-    ".rlsbl/lint/npm.toml": "baa36014e65923d8cc5c8b83c77fa651da79351627570476402da66840027645"
-  }
-}

strictcli-0.30.0/index.js

@@ -1,5 +0,0 @@
-throw new Error(
-  "strictcli is a Python library. Install it with: uv add strictcli (or pip install strictcli). " +
-  "This npm package is a wrapper that installs the Python package. " +
-  "Import it in Python: import strictcli"
-);

strictcli-0.30.0/package-lock.json

@@ -1,14 +0,0 @@
-{
-  "name": "strictcli",
-  "version": "0.30.0",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "strictcli",
-      "version": "0.30.0",
-      "hasInstallScript": true,
-      "license": "MIT"
-    }
-  }
-}

strictcli-0.30.0/package.json

@@ -1,25 +0,0 @@
-{
-  "name": "strictcli",
-  "version": "0.30.0",
-  "description": "A strict, zero-dependency CLI framework for Python (npm wrapper)",
-  "main": "index.js",
-  "scripts": {
-    "postinstall": "node postinstall.js"
-  },
-  "keywords": [
-    "strictcli",
-    "cli",
-    "argparse",
-    "command-line",
-    "framework",
-    "python",
-    "rlsbl"
-  ],
-  "author": "S. M. Hosseini <m.hosseini@veliu.com>",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/smm-h/strictcli.git"
-  },
-  "homepage": "https://github.com/smm-h/strictcli"
-}

strictcli-0.30.0/postinstall.js

@@ -1,17 +0,0 @@
-const { execSync } = require("child_process");
-
-const version = require("./package.json").version;
-const pkg = `strictcli==${version}`;
-
-try {
-  execSync(`uv pip install ${pkg}`, { stdio: "inherit" });
-} catch {
-  try {
-    execSync(`pip install ${pkg}`, { stdio: "inherit" });
-  } catch {
-    console.error(
-      `Failed to install Python package ${pkg}. ` +
-      "Ensure uv or pip is available, then run: uv add strictcli"
-    );
-  }
-}