strictcli 0.33.0__tar.gz → 0.34.0__tar.gz

{strictcli-0.33.0 → strictcli-0.34.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: strictcli
-Version: 0.33.0
+Version: 0.34.0
 Summary: A strict CLI framework for Python
 Project-URL: Homepage, https://github.com/smm-h/strictcli
 Project-URL: Repository, https://github.com/smm-h/strictcli

{strictcli-0.33.0 → strictcli-0.34.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "strictcli"
-version = "0.33.0"
+version = "0.34.0"
 description = "A strict CLI framework for Python"
 readme = "README.md"
 license = "MIT"

{strictcli-0.33.0 → strictcli-0.34.0}/strictcli/__init__.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-__version__ = "0.33.0"
+__version__ = "0.34.0"
 
 __all__ = [
     "App", "Flag", "Arg", "FlagSet", "MutexGroup", "CoRequired", "Requires",
@@ -2651,10 +2651,27 @@ class ConnectionEnvReader(Protocol):
     instead of connecting. The check command wraps the tool-supplied check
     context in a value that satisfies this protocol, backed by the app's declared
     connection envs and the invocation's hermetic state. Checks that need a
-    connection URL call ``ctx.connection_env_value("DATABASE_URL")``."""
+    connection URL call ``ctx.connection_env_value("DATABASE_URL")``.
+
+    ``is_hermetic()`` reports whether the invocation ran under --hermetic. It
+    exists so a check can DISTINGUISH the two cases that
+    ``connection_env_value``'s ``present=False`` otherwise conflates:
+    "--hermetic suppressed the connection env" vs "the env var is simply unset".
+    A check that layers config fallbacks below the env must honor hermetic even
+    when the env is unset -- otherwise it falls through to a config URL and
+    connects, violating the hermetic guarantee::
+
+        dsn, present = ctx.connection_env_value("DATABASE_URL")
+        if not present:
+            if ctx.is_hermetic():
+                return reporter.skipped("hermetic: connection suppressed")
+            # env unset but not hermetic -- config fallback is allowed here
+    """
 
     def connection_env_value(self, env_var: str) -> "tuple[str | None, bool]": ...
 
+    def is_hermetic(self) -> bool: ...
+
 
 class _CheckContextWithConn:
     """Wraps a tool-supplied check context, delegating attribute access while
@@ -2679,6 +2696,11 @@ class _CheckContextWithConn:
             return None, False
         raise KeyError(f'"{env_var}" is not a declared connection env var')
 
+    def is_hermetic(self) -> bool:
+        """Report whether the invocation ran under --hermetic. Mirrors the
+        hermetic flag captured when the wrapper was built."""
+        return self._hermetic
+
 
 @dataclass
 class _CheckDef:

{strictcli-0.33.0 → strictcli-0.34.0}/tests/test_connection_env.py

@@ -178,9 +178,15 @@ def _make_conn_check_app(tmp_path):
 
     @app.error_check("db-reachable")
     def db_reachable(ctx, reporter):
+        reporter.note(f"hermetic={ctx.is_hermetic()}")
         dsn, present = ctx.connection_env_value("DATABASE_URL")
         if not present:
-            return reporter.skipped("DATABASE_URL absent (hermetic or unset)")
+            # Distinguish hermetic suppression from a plainly-unset env: a
+            # consumer layering config fallbacks below the env must honor
+            # hermetic (skip) rather than fall through and connect.
+            if ctx.is_hermetic():
+                return reporter.skipped("DATABASE_URL suppressed by --hermetic")
+            return reporter.skipped("DATABASE_URL unset")
         reporter.note(f"dsn={dsn}")
         return reporter.passed("connection env visible")
 
@@ -194,14 +200,42 @@ def test_connection_env_check_side_access(tmp_path, monkeypatch):
     r = app.test(["check", "--tag", "db", "--verbose"])
     assert "dsn=postgres://check/db" in r.stdout
     assert "PASS" in r.stdout
+    # A non-hermetic invocation reports is_hermetic()==False to the check.
+    assert "hermetic=False" in r.stdout
 
 
 def test_connection_env_check_side_hermetic_skips(tmp_path, monkeypatch):
     monkeypatch.setenv("DATABASE_URL", "postgres://check/db")
     app = _make_conn_check_app(tmp_path)
-    r = app.test(["--hermetic", "check", "--tag", "db"])
+    r = app.test(["--hermetic", "check", "--tag", "db", "--verbose"])
     assert "SKIP" in r.stdout
     assert "dsn=" not in r.stdout
+    # The check SEES hermetic (is_hermetic()==True) and skips for that reason.
+    assert "hermetic=True" in r.stdout
+    assert "suppressed by --hermetic" in r.stdout
+
+
+def test_connection_env_check_side_hermetic_conflation(tmp_path, monkeypatch):
+    """Documents the exact gap is_hermetic() closes: under --hermetic with the
+    env var UNSET, connection_env_value returns present=False (indistinguishable
+    from a plain unset), yet is_hermetic() returns True -- so a check layering
+    config fallbacks can honor hermetic instead of connecting via a config URL."""
+    monkeypatch.delenv("DATABASE_URL", raising=False)  # env UNSET
+    app = _make_conn_check_app(tmp_path)
+    r = app.test(["--hermetic", "check", "--tag", "db", "--verbose"])
+    assert "hermetic=True" in r.stdout
+    assert "suppressed by --hermetic" in r.stdout
+    assert "DATABASE_URL unset" not in r.stdout
+
+
+def test_connection_env_check_side_unset_not_hermetic(tmp_path, monkeypatch):
+    """Counterpart: env unset and NOT hermetic -> is_hermetic()==False, so a
+    consumer is free to consult a config fallback (here reported as plain unset)."""
+    monkeypatch.delenv("DATABASE_URL", raising=False)  # env UNSET, no --hermetic
+    app = _make_conn_check_app(tmp_path)
+    r = app.test(["check", "--tag", "db", "--verbose"])
+    assert "hermetic=False" in r.stdout
+    assert "DATABASE_URL unset" in r.stdout
 
 
 # --- Registration-time enforcement ---

{strictcli-0.33.0 → strictcli-0.34.0}/uv.lock

@@ -232,7 +232,7 @@ wheels = [
 
 [[package]]
 name = "strictcli"
-version = "0.33.0"
+version = "0.34.0"
 source = { editable = "." }
 dependencies = [
     { name = "tomlkit" },