thoughtleaders-cli 0.9.8__tar.gz → 0.9.10__tar.gz

{thoughtleaders_cli-0.9.8 → thoughtleaders_cli-0.9.10}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "tl-cli",
-  "version": "0.9.8",
+  "version": "0.9.10",
   "description": "ThoughtLeaders CLI — query sponsorship deals, channels, brands, uploads, and intelligence from the terminal",
   "author": {
     "name": "ThoughtLeaders",

thoughtleaders_cli-0.9.10/.github/workflows/ci.yml

@@ -0,0 +1,66 @@
+name: CI
+
+# Fast, hermetic checks on every push to main and every PR. These run the
+# mocked unit suite under tests/ — no live API, no credits, fully
+# deterministic. The live CLI tests live in cli-integration.yml.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  unit-tests:
+    name: Unit tests (mocked) · py${{ matrix.python-version }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # Matches `requires-python = ">=3.12"`.
+        python-version: ["3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Sync locked dependencies
+        run: uv sync --frozen --python ${{ matrix.python-version }}
+      - name: Run unit tests
+        # tests/ mock the HTTP client (CliRunner + fake get_client), so there
+        # is no network, no API key, and no credit spend.
+        run: uv run --python ${{ matrix.python-version }} --with pytest pytest tests/ -v
+
+  windows-launcher:
+    name: Windows launcher (tl setup windows)
+    # `tl setup windows` writes a tl.cmd that runs the CLI through the signed
+    # python.exe, so the unsigned pipx stub can't be blocked by Smart App
+    # Control. This job proves the wrapper is written and actually launches the
+    # CLI. NOTE: GitHub runners don't have SAC in enforcement, so this verifies
+    # the mechanism, not the block itself — real SAC validation needs a SAC/WDAC
+    # machine. Hermetic: a uv project install is a dev install, so the CLI's
+    # auto-updater no-ops (no network).
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Sync locked dependencies
+        run: uv sync --frozen
+      - name: Install the launcher wrapper
+        run: uv run tl setup windows
+      - name: Wrapper exists and launches the CLI through python
+        shell: pwsh
+        run: |
+          $cmd = "$env:LOCALAPPDATA\Programs\tl-cli\tl.cmd"
+          if (-not (Test-Path $cmd)) { throw "wrapper not written at $cmd" }
+          Get-Content $cmd
+          & $cmd --version
+          if ($LASTEXITCODE -ne 0) { throw "wrapper failed to launch the CLI (exit $LASTEXITCODE)" }

{thoughtleaders_cli-0.9.8 → thoughtleaders_cli-0.9.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: thoughtleaders-cli
-Version: 0.9.8
+Version: 0.9.10
 Summary: ThoughtLeaders CLI — query sponsorship data, channels, brands, and intelligence
 Project-URL: Homepage, https://thoughtleaders.io
 Project-URL: Repository, https://github.com/ThoughtLeaders-io/thoughtleaders-cli
@@ -92,6 +92,25 @@ uv tool install thoughtleaders-cli
 pip install thoughtleaders-cli
 ```
 
+#### Windows with Smart App Control / WDAC
+
+The pipx/uv install above creates an **unsigned** launcher stub that Windows
+Smart App Control (and enforced WDAC policies) block — `tl` fails to start with
+a Code Integrity error. Fix it with:
+
+```powershell
+tl setup windows
+```
+
+That drops a small `tl.cmd` on your `PATH` (ahead of the blocked stub) which
+launches the CLI through the already-signed `python.exe`, so it runs cleanly
+under SAC. If `tl` is *already* blocked and won't start, bootstrap it through
+the signed interpreter directly, then reopen your terminal:
+
+```powershell
+& "$env:USERPROFILE\pipx\venvs\thoughtleaders-cli\Scripts\python.exe" -m tl_cli setup windows
+```
+
 Then set up:
 ```bash
 tl auth login          # authenticate with ThoughtLeaders (OAuth2 browser flow, device code, or API key)

{thoughtleaders_cli-0.9.8 → thoughtleaders_cli-0.9.10}/README.md

@@ -64,6 +64,25 @@ uv tool install thoughtleaders-cli
 pip install thoughtleaders-cli
 ```
 
+#### Windows with Smart App Control / WDAC
+
+The pipx/uv install above creates an **unsigned** launcher stub that Windows
+Smart App Control (and enforced WDAC policies) block — `tl` fails to start with
+a Code Integrity error. Fix it with:
+
+```powershell
+tl setup windows
+```
+
+That drops a small `tl.cmd` on your `PATH` (ahead of the blocked stub) which
+launches the CLI through the already-signed `python.exe`, so it runs cleanly
+under SAC. If `tl` is *already* blocked and won't start, bootstrap it through
+the signed interpreter directly, then reopen your terminal:
+
+```powershell
+& "$env:USERPROFILE\pipx\venvs\thoughtleaders-cli\Scripts\python.exe" -m tl_cli setup windows
+```
+
 Then set up:
 ```bash
 tl auth login          # authenticate with ThoughtLeaders (OAuth2 browser flow, device code, or API key)

{thoughtleaders_cli-0.9.8 → thoughtleaders_cli-0.9.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "thoughtleaders-cli"
-version = "0.9.8"
+version = "0.9.10"
 description = "ThoughtLeaders CLI — query sponsorship data, channels, brands, and intelligence"
 readme = "README.md"
 license = "MIT"

{thoughtleaders_cli-0.9.8 → thoughtleaders_cli-0.9.10}/src/tl_cli/__init__.py

@@ -1,3 +1,3 @@
 """ThoughtLeaders CLI — query sponsorship data, channels, brands, and intelligence."""
 
-__version__ = "0.9.8"
+__version__ = "0.9.10"

thoughtleaders_cli-0.9.10/src/tl_cli/__main__.py

@@ -0,0 +1,13 @@
+"""Module entry point for the CLI.
+
+Enables `python -m tl_cli` and serves as the single entry script for the
+PyInstaller-frozen standalone build (see packaging/tl.spec). Invoking the CLI
+through the signed `python.exe` / signed frozen exe is what keeps it runnable
+under Windows Smart App Control, which blocks the unsigned launcher stub that
+pipx/uv generate per install.
+"""
+
+from tl_cli.main import cli
+
+if __name__ == "__main__":
+    cli()

{thoughtleaders_cli-0.9.8 → thoughtleaders_cli-0.9.10}/src/tl_cli/commands/setup.py

@@ -160,14 +160,69 @@ def _run_claude(args: list[str], claude_bin: str) -> tuple[bool, str]:
         return False, str(e)
 
 
+def _installed_plugin_version() -> str | None:
+    """Version of the plugin Claude Code actually has on disk, or None.
+
+    Reads Claude Code's own install record rather than trusting the stamp
+    written at setup time: `plugin install` is a no-op once the plugin is
+    present, so a stamp saying "whatever the CLI version was when setup last
+    ran" can name a version that was never installed. Returns None when the
+    record is missing or unreadable — callers treat that as "unknown", never
+    as "outdated", so a change to Claude Code's bookkeeping cannot turn into
+    a false warning for every user at once.
+    """
+    try:
+        record = json.loads((CLAUDE_PLUGINS_DIR / "installed_plugins.json").read_text(encoding="utf-8"))
+        entries = record["plugins"][PLUGIN_KEY]
+    except (OSError, ValueError, KeyError, TypeError):
+        return None
+    if not isinstance(entries, list):
+        return None
+    # One entry per install scope; setup installs at user scope, so prefer it.
+    scoped = sorted((e for e in entries if isinstance(e, dict)), key=lambda e: e.get("scope") != "user")
+    for entry in scoped:
+        version = entry.get("version")
+        if isinstance(version, str) and version and version != "unknown":
+            return version
+    return None
+
+
 def _get_installed_plugin_version() -> str | None:
-    """Try to read the installed plugin version from the cache."""
+    """Installed plugin version: Claude Code's record, else the setup stamp.
+
+    The stamp is the fallback for installs that never reached the plugin
+    registry (the standalone-skills path), where the copied skills really are
+    the ones this CLI shipped with.
+    """
+    version = _installed_plugin_version()
+    if version:
+        return version
     version_file = CLAUDE_PLUGINS_DIR / "tl-cli" / ".version"
     if version_file.exists():
         return version_file.read_text().strip()
     return None
 
 
+def _write_version_stamp(version: str) -> None:
+    """Record which plugin version is installed, for `check_plugin_version()`."""
+    version_dir = CLAUDE_PLUGINS_DIR / "tl-cli"
+    version_dir.mkdir(parents=True, exist_ok=True)
+    (version_dir / ".version").write_text(version)
+
+
+def _update_plugin(claude_bin: str) -> tuple[bool, bool, str]:
+    """Pull the installed plugin up to the marketplace's current version.
+
+    `plugin install` exits successfully without doing anything when the
+    plugin is already installed, so this is what actually advances an
+    existing install. Returns (ok, changed, output); `changed` is False when
+    the plugin was already at the latest version.
+    """
+    ok, output = _run_claude(["plugin", "update", PLUGIN_KEY], claude_bin)
+    changed = ok and "already at the latest" not in output.lower()
+    return ok, changed, output
+
+
 def check_plugin_version() -> list[str]:
     """Check if installed plugin versions match CLI version.
 
@@ -176,11 +231,9 @@ def check_plugin_version() -> list[str]:
     warnings = []
 
     # Claude Code
-    claude_version_file = CLAUDE_PLUGINS_DIR / "tl-cli" / ".version"
-    if claude_version_file.exists():
-        installed = claude_version_file.read_text().strip()
-        if installed != __version__:
-            warnings.append(f"Claude Code plugin is outdated (v{installed} vs CLI v{__version__}). Run 'tl setup claude' to update.")
+    installed = _get_installed_plugin_version()
+    if installed and installed != __version__:
+        warnings.append(f"Claude Code plugin is outdated (v{installed} vs CLI v{__version__}). Run 'tl setup claude' to update.")
 
     # OpenCode
     opencode_version_file = OPENCODE_SKILLS_DIR / ".tl-version"
@@ -368,9 +421,9 @@ def setup_claude(
 ) -> None:
     """Install the TL CLI plugin for Claude Code.
 
-    Registers the ThoughtLeaders marketplace, installs the tl-cli plugin,
-    and adds a /tl shim command so the plugin's tl skill can be invoked
-    without the plugin namespace. Standalone skill copies in ~/.claude/skills
+    Registers the ThoughtLeaders marketplace, installs and updates the
+    tl-cli plugin, and adds a /tl shim command so the plugin's tl skill can
+    be invoked without the plugin namespace. Standalone skill copies in ~/.claude/skills
     are only installed as a fallback when the plugin can't be installed;
     unmodified copies left by earlier versions are removed.
 
@@ -445,7 +498,23 @@ def setup_claude(
             _print_manual_instructions()
             raise SystemExit(1)
 
-    # Step 3: /tl shim command + cleanup of standalone copies from older versions
+    # Step 3: Update the plugin. An install that found the plugin already
+    # present did nothing, so without this an existing install stays pinned
+    # at whatever version it was first installed at.
+    console.print("[bold]Updating plugin...[/bold]")
+    ok, changed, output = _update_plugin(claude_bin)
+    installed_version = _installed_plugin_version()
+    version_label = f"v{installed_version}" if installed_version else "version unknown"
+    if not ok:
+        console.print(f"  [yellow]![/yellow] Plugin update failed: {output}")
+        console.print(f"    Continuing with the installed plugin ({version_label}).")
+    elif changed:
+        console.print(f"  [green]✓[/green] Plugin updated to {version_label}")
+        console.print("    [yellow]Restart Claude Code to apply the new version.[/yellow]")
+    else:
+        console.print(f"  [green]✓[/green] Plugin already up to date ({version_label})")
+
+    # Step 4: /tl shim command + cleanup of standalone copies from older versions
     console.print("[bold]Installing /tl shortcut...[/bold]")
     shim = _install_command_shim()
     console.print(f"  [green]✓[/green] /tl command installed: {shim}")
@@ -456,10 +525,7 @@ def setup_claude(
         console.print(f"  [yellow]![/yellow] Kept {kept} modified standalone skill(s) in {CLAUDE_SKILLS_DIR}")
         console.print("    These differ from the plugin's versions and shadow nothing — remove manually if unwanted.")
 
-    # Write version stamp
-    version_dir = CLAUDE_PLUGINS_DIR / "tl-cli"
-    version_dir.mkdir(parents=True, exist_ok=True)
-    (version_dir / ".version").write_text(__version__)
+    _write_version_stamp(installed_version or __version__)
 
     console.print()
     console.print("[green]Setup complete![/green]")
@@ -523,6 +589,14 @@ def _setup_noninteractive(fmt: str = "json") -> None:
 
         ok, output = _run_claude(["plugin", "install", PLUGIN_KEY], claude_bin)
         result["plugin_installed"] = ok or "already" in output.lower()
+
+        # `install` is a no-op on an already-installed plugin — this is what
+        # advances it to the marketplace's current version.
+        if result["plugin_installed"]:
+            ok, changed, output = _update_plugin(claude_bin)
+            result["plugin_updated"] = changed
+            if not ok:
+                result["plugin_update_error"] = output
     else:
         result["marketplace_registered"] = False
         result["plugin_installed"] = False
@@ -541,10 +615,11 @@ def _setup_noninteractive(fmt: str = "json") -> None:
         result["command_shim_installed"] = False
         result["standalone_skills_installed"] = _install_standalone_skills(plugin_root)
 
-    # Write version stamp
-    version_dir = CLAUDE_PLUGINS_DIR / "tl-cli"
-    version_dir.mkdir(parents=True, exist_ok=True)
-    (version_dir / ".version").write_text(__version__)
+    # Stamp what is actually installed. The standalone fallback copied this
+    # CLI's own bundled skills, so there __version__ is the honest answer.
+    installed_version = _installed_plugin_version() if result["plugin_installed"] else None
+    result["plugin_version"] = installed_version
+    _write_version_stamp(installed_version or __version__)
 
     result["status"] = "ok"
     _emit_setup_result(result, fmt)
@@ -756,3 +831,74 @@ def setup_codex(
         json_output=json_output,
         toon_output=toon_output,
     )
+
+
+def _prepend_user_path(new_dir: str) -> bool:
+    """Prepend ``new_dir`` to the persistent per-user PATH.
+
+    Writes HKCU\\Environment and broadcasts the change so new processes pick it
+    up without a sign-out. Returns True if PATH was changed, False if new_dir
+    was already present. Windows-only.
+    """
+    import ctypes
+    import winreg
+
+    with winreg.OpenKey(winreg.HKEY_CURRENT_USER, "Environment", 0, winreg.KEY_READ | winreg.KEY_WRITE) as key:
+        try:
+            current, _ = winreg.QueryValueEx(key, "Path")
+        except FileNotFoundError:
+            current = ""
+        parts = [p for p in current.split(os.pathsep) if p]
+        target = os.path.normcase(os.path.normpath(new_dir))
+        if any(os.path.normcase(os.path.normpath(p)) == target for p in parts):
+            return False
+        updated = os.pathsep.join([new_dir, *parts]) if parts else new_dir
+        winreg.SetValueEx(key, "Path", 0, winreg.REG_EXPAND_SZ, updated)
+
+    # Tell running shells the environment changed (best-effort).
+    ctypes.windll.user32.SendMessageTimeoutW(0xFFFF, 0x1A, 0, "Environment", 0x2, 5000, None)
+    return True
+
+
+@app.command("windows")
+def setup_windows(
+    force: bool = typer.Option(False, "--force", help="Overwrite an existing tl.cmd wrapper"),
+) -> None:
+    """Make `tl` runnable under Windows Smart App Control (Windows only).
+
+    pipx/uv expose `tl` through an *unsigned* launcher stub that Smart App
+    Control (and enforced WDAC policies) block. This writes a small `tl.cmd`
+    that runs the CLI through the already-signed `python.exe` instead, and
+    puts it ahead of the blocked stub on your PATH.
+
+    Run once. On a machine where `tl` is already blocked, bootstrap it with
+    the venv's signed python directly:
+
+        <pipx-venv>\\Scripts\\python.exe -m tl_cli setup windows
+
+    Examples:
+        tl setup windows
+    """
+    if sys.platform != "win32":
+        console.print("[yellow]`tl setup windows` only applies on Windows — nothing to do here.[/yellow]")
+        return
+
+    python_exe = Path(sys.executable)
+    wrapper_dir = Path(os.environ.get("LOCALAPPDATA", Path.home())) / "Programs" / "tl-cli"
+    wrapper = wrapper_dir / "tl.cmd"
+
+    if wrapper.exists() and not force:
+        console.print(f"[yellow]Wrapper already exists:[/yellow] {wrapper}\nRe-run with --force to regenerate it.")
+        return
+
+    wrapper_dir.mkdir(parents=True, exist_ok=True)
+    # Absolute path to the signed interpreter bypasses PATH so the launch can't
+    # resolve back to the blocked stub. %* forwards all arguments unchanged.
+    wrapper.write_text(f'@echo off\r\n"{python_exe}" -m tl_cli %*\r\n', encoding="ascii", newline="")
+
+    console.print(f"[green]✓[/green] Wrote signed-launcher wrapper: {wrapper}")
+    if _prepend_user_path(str(wrapper_dir)):
+        console.print(f"[green]✓[/green] Added to your user PATH (ahead of the blocked stub): {wrapper_dir}")
+    else:
+        console.print(f"[dim]Already on your user PATH: {wrapper_dir}[/dim]")
+    console.print("[dim]Open a new terminal, then run:[/dim] tl whoami")

{thoughtleaders_cli-0.9.8 → thoughtleaders_cli-0.9.10}/src/tl_cli/self_update.py

@@ -426,7 +426,11 @@ def _resync_integrations() -> None:
             subprocess.run(
                 [tl_bin, "setup", tool, "--json"],
                 capture_output=True,
-                timeout=120,
+                # The Claude Code path shells out to `claude` several times
+                # (marketplace add + update, plugin install + update), each
+                # with its own timeout — a 120s budget for the whole resync
+                # can expire mid-sequence on a slow network.
+                timeout=300,
                 check=False,
             )
         except (OSError, subprocess.TimeoutExpired):

{thoughtleaders_cli-0.9.8 → thoughtleaders_cli-0.9.10}/tests/test_setup.py

@@ -1,5 +1,6 @@
 """Tests for `tl setup` helpers."""
 
+import json
 import sys
 from pathlib import Path
 
@@ -8,8 +9,10 @@ from tl_cli.commands.setup import (
     _bundled_skill_blurbs,
     _find_claude_binary,
     _install_command_shim,
+    _installed_plugin_version,
     _remove_matching_standalone_skills,
     _trees_identical,
+    _update_plugin,
 )
 
 
@@ -191,3 +194,135 @@ class TestFindClaudeBinary:
         if sys.platform == "win32":
             monkeypatch.setenv("APPDATA", str(tmp_path / "AppData" / "Roaming"))
         assert _find_claude_binary() is None
+
+
+class TestInstalledPluginVersion:
+    def _record(self, tmp_path, monkeypatch, payload):
+        plugins = tmp_path / "plugins"
+        plugins.mkdir(parents=True, exist_ok=True)
+        monkeypatch.setattr(setup, "CLAUDE_PLUGINS_DIR", plugins)
+        (plugins / "installed_plugins.json").write_text(json.dumps(payload), encoding="utf-8")
+        return plugins
+
+    def test_reads_version_from_install_record(self, tmp_path, monkeypatch):
+        self._record(tmp_path, monkeypatch, {"version": 2, "plugins": {setup.PLUGIN_KEY: [{"scope": "user", "version": "0.7.2"}]}})
+        assert _installed_plugin_version() == "0.7.2"
+
+    def test_prefers_user_scope(self, tmp_path, monkeypatch):
+        self._record(
+            tmp_path,
+            monkeypatch,
+            {"plugins": {setup.PLUGIN_KEY: [{"scope": "project", "version": "0.1.0"}, {"scope": "user", "version": "0.9.9"}]}},
+        )
+        assert _installed_plugin_version() == "0.9.9"
+
+    def test_ignores_unknown_version(self, tmp_path, monkeypatch):
+        self._record(tmp_path, monkeypatch, {"plugins": {setup.PLUGIN_KEY: [{"scope": "user", "version": "unknown"}]}})
+        assert _installed_plugin_version() is None
+
+    def test_missing_file(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(setup, "CLAUDE_PLUGINS_DIR", tmp_path / "plugins")
+        assert _installed_plugin_version() is None
+
+    def test_unreadable_record_is_unknown_not_outdated(self, tmp_path, monkeypatch):
+        plugins = tmp_path / "plugins"
+        plugins.mkdir(parents=True)
+        monkeypatch.setattr(setup, "CLAUDE_PLUGINS_DIR", plugins)
+        (plugins / "installed_plugins.json").write_text("{not json", encoding="utf-8")
+        assert _installed_plugin_version() is None
+        assert not [w for w in setup.check_plugin_version() if "Claude Code plugin" in w]
+
+    def test_unexpected_shape_is_unknown(self, tmp_path, monkeypatch):
+        self._record(tmp_path, monkeypatch, {"plugins": {setup.PLUGIN_KEY: {"scope": "user", "version": "0.7.2"}}})
+        assert _installed_plugin_version() is None
+
+
+class TestCheckPluginVersion:
+    def test_warns_on_record_behind_cli(self, tmp_path, monkeypatch):
+        plugins = tmp_path / "plugins"
+        plugins.mkdir(parents=True)
+        monkeypatch.setattr(setup, "CLAUDE_PLUGINS_DIR", plugins)
+        monkeypatch.setattr(setup, "OPENCODE_SKILLS_DIR", tmp_path / "opencode")
+        monkeypatch.setattr(setup, "AGENTS_SKILLS_DIR", tmp_path / "agents")
+        (plugins / "installed_plugins.json").write_text(
+            json.dumps({"plugins": {setup.PLUGIN_KEY: [{"scope": "user", "version": "0.7.2"}]}}), encoding="utf-8"
+        )
+        # A stamp claiming the current version must not mask the real one.
+        (plugins / "tl-cli").mkdir()
+        (plugins / "tl-cli" / ".version").write_text(setup.__version__)
+
+        warnings = setup.check_plugin_version()
+        assert any("0.7.2" in w for w in warnings)
+
+    def test_falls_back_to_stamp_without_record(self, tmp_path, monkeypatch):
+        plugins = tmp_path / "plugins"
+        (plugins / "tl-cli").mkdir(parents=True)
+        monkeypatch.setattr(setup, "CLAUDE_PLUGINS_DIR", plugins)
+        monkeypatch.setattr(setup, "OPENCODE_SKILLS_DIR", tmp_path / "opencode")
+        monkeypatch.setattr(setup, "AGENTS_SKILLS_DIR", tmp_path / "agents")
+        (plugins / "tl-cli" / ".version").write_text("0.1.0")
+
+        assert any("0.1.0" in w for w in setup.check_plugin_version())
+
+    def test_silent_when_nothing_installed(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(setup, "CLAUDE_PLUGINS_DIR", tmp_path / "plugins")
+        monkeypatch.setattr(setup, "OPENCODE_SKILLS_DIR", tmp_path / "opencode")
+        monkeypatch.setattr(setup, "AGENTS_SKILLS_DIR", tmp_path / "agents")
+        assert setup.check_plugin_version() == []
+
+
+class TestUpdatePlugin:
+    def test_already_latest_is_not_a_change(self, monkeypatch):
+        monkeypatch.setattr(setup, "_run_claude", lambda args, b: (True, 'tl-cli is already at the latest version (0.9.9).'))
+        assert _update_plugin("claude") == (True, False, 'tl-cli is already at the latest version (0.9.9).')
+
+    def test_version_advance_is_a_change(self, monkeypatch):
+        monkeypatch.setattr(setup, "_run_claude", lambda args, b: (True, 'Plugin "tl-cli" updated from 0.7.2 to 0.9.9.'))
+        ok, changed, _ = _update_plugin("claude")
+        assert (ok, changed) == (True, True)
+
+    def test_failure_is_not_a_change(self, monkeypatch):
+        monkeypatch.setattr(setup, "_run_claude", lambda args, b: (False, "boom"))
+        assert _update_plugin("claude") == (False, False, "boom")
+
+
+class TestSetupCallSequence:
+    def _stub_env(self, tmp_path, monkeypatch, record=None):
+        plugin_root = tmp_path / "plugin"
+        (plugin_root / "skills").mkdir(parents=True)
+        plugins = tmp_path / "plugins"
+        plugins.mkdir()
+        if record is not None:
+            (plugins / "installed_plugins.json").write_text(json.dumps(record), encoding="utf-8")
+        monkeypatch.setattr(setup, "_find_plugin_root", lambda: plugin_root)
+        monkeypatch.setattr(setup, "_find_claude_binary", lambda: "/usr/bin/claude")
+        monkeypatch.setattr(setup, "CLAUDE_PLUGINS_DIR", plugins)
+        monkeypatch.setattr(setup, "CLAUDE_SKILLS_DIR", tmp_path / "skills")
+        monkeypatch.setattr(setup, "CLAUDE_COMMANDS_DIR", tmp_path / "commands")
+        calls = []
+        monkeypatch.setattr(setup, "_run_claude", lambda args, b: (calls.append(args), (True, "ok"))[1])
+        return calls, plugins
+
+    def test_interactive_updates_after_install(self, tmp_path, monkeypatch):
+        calls, _ = self._stub_env(tmp_path, monkeypatch)
+        setup.setup_claude(json_output=False, toon_output=False)
+        assert calls.index(["plugin", "update", setup.PLUGIN_KEY]) > calls.index(["plugin", "install", setup.PLUGIN_KEY])
+
+    def test_noninteractive_updates_after_install(self, tmp_path, monkeypatch, capsys):
+        calls, _ = self._stub_env(tmp_path, monkeypatch)
+        setup._setup_noninteractive()
+        assert calls.index(["plugin", "update", setup.PLUGIN_KEY]) > calls.index(["plugin", "install", setup.PLUGIN_KEY])
+        assert json.loads(capsys.readouterr().out)["plugin_updated"] is True
+
+    def test_stamp_records_installed_version_not_cli_version(self, tmp_path, monkeypatch, capsys):
+        record = {"plugins": {setup.PLUGIN_KEY: [{"scope": "user", "version": "0.7.2"}]}}
+        _, plugins = self._stub_env(tmp_path, monkeypatch, record=record)
+        setup._setup_noninteractive()
+        assert (plugins / "tl-cli" / ".version").read_text() == "0.7.2"
+        assert json.loads(capsys.readouterr().out)["plugin_version"] == "0.7.2"
+
+    def test_standalone_fallback_stamps_cli_version(self, tmp_path, monkeypatch, capsys):
+        _, plugins = self._stub_env(tmp_path, monkeypatch)
+        monkeypatch.setattr(setup, "_find_claude_binary", lambda: None)
+        setup._setup_noninteractive()
+        assert (plugins / "tl-cli" / ".version").read_text() == setup.__version__

thoughtleaders_cli-0.9.8/.github/workflows/ci.yml

@@ -1,38 +0,0 @@
-name: CI
-
-# Fast, hermetic checks on every push to main and every PR. These run the
-# mocked unit suite under tests/ — no live API, no credits, fully
-# deterministic. The live CLI tests live in cli-integration.yml.
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  unit-tests:
-    name: Unit tests (mocked) · py${{ matrix.python-version }}
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        # Matches `requires-python = ">=3.12"`.
-        python-version: ["3.12", "3.13", "3.14"]
-    steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v7
-        with:
-          enable-cache: true
-      - name: Sync locked dependencies
-        run: uv sync --frozen --python ${{ matrix.python-version }}
-      - name: Run unit tests
-        # tests/ mock the HTTP client (CliRunner + fake get_client), so there
-        # is no network, no API key, and no credit spend.
-        run: uv run --python ${{ matrix.python-version }} --with pytest pytest tests/ -v