trackerkeeper 0.1.0__tar.gz → 0.1.2__tar.gz

{trackerkeeper-0.1.0 → trackerkeeper-0.1.2}/.github/release-checklist-template.md

@@ -7,7 +7,7 @@ it propagates. See `docs/RELEASING.md`.
 - [ ] **GitHub release** drafted by `release.yml` — `.deb`, AppImage + `.zsync`, sdist/wheel, `SHA256SUMS`, Sigstore attestations
 - [ ] Cross-distro **smoke tests** green (deb + AppImage self-containment)
 - [ ] **Review the draft** and click **Publish** ← the one human gate
-- [ ] **PyPI** — `pypi-publish.yml` uploaded `${V}`: https://pypi.org/project/trackerkeeper-base/${V}/
+- [ ] **PyPI** — `pypi-publish.yml` uploaded `${V}`: https://pypi.org/project/trackerkeeper/${V}/
 - [ ] Provenance verifies: `gh attestation verify <asset> --repo wolfgangwarehaus/trackerkeeper`
 
 ## Dormant / deferred — light up when configured (docs/TODO.md)

{trackerkeeper-0.1.0 → trackerkeeper-0.1.2}/.github/workflows/pypi-publish.yml

@@ -10,7 +10,7 @@ name: Publish to PyPI
 # One-time PyPI setup — create a pending publisher (the project doesn't exist on
 # PyPI yet, so use the "pending publisher" form):
 #   https://pypi.org/manage/account/publishing/  → Add a new pending publisher:
-#     PyPI Project Name: trackerkeeper-base
+#     PyPI Project Name: trackerkeeper       # == [project] name in pyproject.toml
 #     Owner:             wolfgangwarehaus
 #     Repository name:   trackerkeeper
 #     Workflow name:     pypi-publish.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     environment:
       name: pypi
-      url: https://pypi.org/project/trackerkeeper-base/
+      url: https://pypi.org/project/trackerkeeper/
     permissions:
       contents: read # gh release download
       id-token: write # mint the short-lived OIDC token Trusted Publishing needs

{trackerkeeper-0.1.0/trackerkeeper.egg-info → trackerkeeper-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trackerkeeper
-Version: 0.1.0
+Version: 0.1.2
 Summary: One dashboard for software & firmware updates across everything you own
 Author-email: august <augustvontrips@gmail.com>
 License: GPL-2.0-or-later

trackerkeeper-0.1.2/docs/CHANGELOG.md

@@ -0,0 +1,202 @@
+# Changelog
+
+All notable changes to trackerkeeper are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning is
+[SemVer](https://semver.org/) and **the git tag is the version** (setuptools-scm).
+
+Cutting a release moves the `[Unreleased]` section below into a dated
+`[X.Y.Z]` heading, then `git tag vX.Y.Z`. `release.yml` lifts that section verbatim
+into the GitHub release notes (falling back to auto-generated notes if the tag has
+no matching section). See `docs/RELEASING.md`.
+
+## [Unreleased]
+
+## [0.1.2] — 2026-07-26
+
+The looks pass. tracker keeper stops wearing dough's placeholder, learns to tell
+you *what* changed rather than only *that* something did, and becomes usable at
+the 300px width it always advertised.
+
+### Added
+- **A real logo, and a brand accent to match.** The first two releases shipped
+  wearing dough's placeholder blob. The mark is a refresh wheel closing on a
+  check — the ring is the update cycle, the check is "you're current" — with the
+  gap and arrowhead in the bottom-right, the one quadrant the check's diagonal
+  never crosses. One accent throughout, because a two-tone draft put a
+  near-white check on the ring that vanished on light backgrounds. The default
+  accent moves from dough's violet to the brand green `#2fbe8a` (already the
+  "Green" preset), so a fresh profile's chrome matches its own icon.
+- **Per-item detail.** Click any card to see what actually changed — the release
+  notes the checkers were already fetching and throwing away. GitHub's release
+  body, Steam's announcement, the App Store's "What's New", Flathub's release
+  description and any RSS entry's body all land here, normalised to plain text.
+  A source that structurally can't carry notes (a package index, an ISO mirror)
+  says so rather than showing an empty box.
+
+  Notes render as **plain text, never rich text**: the body is written by a
+  third party, and handing arbitrary remote HTML to a Qt rich-text widget would
+  pull in remote images and let a stranger control the markup. The changelog
+  link still goes to the fully formatted original.
+
+### Changed
+- **The fleet list has a foreground.** A card had two states — pending or not —
+  so a month-old update looked exactly like one from an hour ago, and every row
+  wore the same green. Now there are three: **fresh** (an update inside a week)
+  leads with a full-white name and the accent on the dot, the new build and the
+  changelog link; **pending but older** keeps its dot and its *mark updated*
+  button — it's still yours to install — but eases back to neutral; **current**
+  sits quietest of all.
+- **One accent, not two near-identical greens.** The "new" colour (`#56c48d`)
+  sat a few points off the accent (`#2fbe8a`) while meaning something different,
+  which read as a printing error rather than a distinction. The accent is now
+  the single colour meaning *live news*, and card tints derive from whatever
+  accent is active rather than a frozen hex — so picking another accent
+  recolours the list properly.
+- **Category sections read as sections.** A dim caps label over a flat run of
+  cards left the groups blending into one list. The header is brighter and
+  carries a hairline rule, the cards step in beneath it, and sections are
+  separated by a gap.
+- **The app name reads in full at every width.** The title steps down the type
+  ladder as the bar tightens (subhead → body → caption) instead of eliding, and
+  the update badge shortens with it — `· 3 updates available`, then `· 3 new`,
+  then just `· 3`. At 300px the app's own name is worth more of that row than
+  two extra words.
+
+### Fixed
+- **The app is legible at its minimum width.** At 300px the fleet list was
+  unusable: names chopped to `Stea` / `Game` / `Slay`, versions to `202607`, the
+  age column showing `hours ago` with the number cut off the front, and the title
+  reading `tracker keepeı`. Four causes: `QLabel` clips instead of eliding (there
+  is now a shared `ui_helpers.ElidedLabel`); the name shared one rich-text label
+  with the platform tag, so the name was what disappeared; the full-text
+  *changelog →* and *mark updated* buttons cost ~175px of a 430px row and are now
+  a `→` and a `✓` below the widest tier; and the age column gets compact forms
+  (`13h`, `4d`, `2w`, `3mo`) that fit whole, with the full phrase on hover.
+- **An empty update badge no longer reserves space.** Its width floor was
+  computed once per layout tier from whatever text happened to be there, so a
+  badge that later emptied out kept holding ~59px — and the title paid for it,
+  eliding beside an invisible label occupying a sixth of the bar.
+- The Steam checker asked for `maxlength=1`, truncating every announcement body
+  to a single character — invisible while only the title was read, and exactly
+  what the detail view needed.
+- **The visual baseline was guarding a screen users never see.** The rig grabbed
+  dough's placeholder canvas rather than the app's own first screen, so the
+  golden would have passed through any dashboard regression. Fixed upstream in
+  dough, so every app built from it gets a baseline that tracks its real UI.
+
+## [0.1.1] — 2026-07-25
+
+The watchtower actually watches now. v0.1.0 only checked at launch, so a
+tray-resident app showed you whatever the world looked like when you booted it;
+this release adds the heartbeat, tells you what's new *since you last looked*,
+and grows the checker count from six to eight.
+
+### Added
+- **A Flatpak checker** (`flatpak`) — Flathub app id (`org.videolan.VLC`) via
+  Flathub's appstream API. With `arch` beside it that's most of a Linux desktop
+  covered. Prefers the newest **stable** release: the feed carries development
+  builds too, and quietly promoting you onto a beta would misrepresent "latest".
+- **An optional GitHub token** — set `TRACKERKEEPER_GITHUB_TOKEN` (or
+  `GITHUB_TOKEN` / `GH_TOKEN`) to raise GitHub's unauthenticated 60 requests/hour
+  to 5000. Read from the environment, never stored by the app, and sent **only**
+  to `api.github.com` — a token in your environment is never handed to a distro
+  mirror or a changelog feed.
+- **A generic RSS / Atom checker** (`rss`) — the widest-coverage source yet, and
+  the answer for the long tail: most projects publish releases as a feed even
+  when they expose no API at all. `ref` is the feed URL, optionally followed by
+  a space and a filter phrase (`https://…/index.xml plasma`) so one busy feed
+  can serve several tracked items. Handles both feed dialects, and falls back to
+  the entry link when a feed ships empty titles — as KDE's own does.
+- **The heartbeat.** tracker keeper now re-checks on a timer (every 2 hours by
+  default, 15 minutes minimum, `0` for manual-only) instead of once at launch —
+  and the timer runs whether or not the window is open, because a watchtower
+  resting in the tray is still watching. Opening the window from the tray also
+  re-checks when the data has gone stale, so what you see is current.
+
+### Changed
+- **Checks run concurrently** (up to 8 at a time) rather than one after another.
+  A refresh used to take as long as the *sum* of its sources, and one
+  unreachable mirror stalled every item queued behind it.
+- **Conditional requests.** Every fetch now sends `If-None-Match` /
+  `If-Modified-Since` and serves the cached body on a `304`. On GitHub a 304
+  costs **no rate-limit quota**, which is what makes a two-hourly heartbeat
+  affordable in the first place.
+- **A failed check says which failure it was.** "Couldn't reach the source" and
+  "nothing matched this source — check the handle" need different reactions;
+  reporting both as "couldn't check" sent you debugging your network when the
+  actual problem was a typo'd app id.
+- **New since you last looked.** An update that arrives while you're away is
+  now marked `NEW` until you actually open the window, and the state is stored
+  — so a restart doesn't re-shout what you already saw, and it doesn't quietly
+  drop it either. The tray tooltip reports it too ("3 updates available, 1 new").
+- **Settings gained a Tracking section**: how often to check (15 minutes to 12
+  hours, or only when you ask), show the tray icon, close-to-tray, and start in
+  the tray. The interval re-arms live — no relaunch to change how often a
+  watchtower watches.
+
+### Fixed
+- A changelog URL is now escaped before it reaches the card's rich-text label —
+  those URLs are user-entered, and an unescaped quote could close the `href` and
+  let the rest of the string render as markup.
+- **The release tooling broke its own first release.** The Inno Setup template
+  carried a sample `/DAppVersion=0.1.0`, and the gate asserting no committed file
+  bakes the current version saw that as live the moment v0.1.0 was tagged. That
+  gate also matched substrings, so `1.0.0` would have matched inside the MSIX
+  placeholder `1.0.0.0` and failed the same way at v1.0.0. Both fixed upstream in
+  dough, so no future release — here or in any other app built from it — trips
+  over them.
+
+### Internal
+- **The test suite was writing to your real settings.** It had no isolation at
+  all, so `pytest` edited `~/.config/<org>/trackerkeeper.conf` — a run could
+  silently discard collapsed groups you'd set. Closing it properly took three
+  Qt calls plus the shipped `Settings` constructor (which used the bare
+  `QSettings(org, app)` form, hardwiring NativeFormat); production behaviour is
+  unchanged.
+- **The intermittent CI abort had a root cause**, and it wasn't the test being
+  blamed: `processEvents()` never delivers `DeferredDelete`, so the whole suite's
+  widgets were destroyed at once by the first test to spin a real nested event
+  loop. Fixing it also roughly halved the suite's runtime.
+
+## [0.1.0] — 2026-07-25
+
+The first release. tracker keeper is a **watchtower, not an updater**: it tells
+you what's new across everything you own and links the changelog — it never
+downloads, installs, or applies anything.
+
+### Added
+- **The dashboard** — your fleet in one scrollable column, newest-update-first.
+  Each card shows what you have vs what the source found, how long ago it
+  dropped, its release channel, and a changelog link. Sort by recency or
+  channel (click the active chip to flip direction), group into your own
+  categories, and collapse the sections you're not watching today.
+- **Six source checkers**, each a small function behind two injected network
+  seams so no test ever touches the network:
+
+  | kind | source | handle (`ref`) |
+  | --- | --- | --- |
+  | `github` | GitHub releases API | `owner/repo` |
+  | `arch` | archlinux.org package search | the pkgname |
+  | `appstore` | Apple iTunes Lookup | track id **or** bundle id |
+  | `appledev` | Apple developer-releases feed | an OS filter — "iOS 27" |
+  | `steam` | Steam news API | the numeric appid |
+  | `cachyos` | the mirror's dated ISO index | the edition |
+
+  Plus `manual` — the universal fallback for a world no checker reaches yet.
+- **A tray presence.** The app rests in the system tray with the update count
+  in its tooltip, a menu (Show / Check / Settings / Quit), click-to-toggle, and
+  close-to-tray. It self-disables where the desktop has no tray, so the window
+  can never be trapped invisible.
+- **Utility sizing** — a 480×620 default that stays readable down to a 300px
+  strip, dropping columns and labels as it narrows rather than squeezing them.
+- **Desktop notifications** when a check finds something genuinely new.
+- The baking phase: a single metadata source (`[tool.trackerkeeper.metadata]`), the
+  `trackerkeeper bake` renderer, and the first channels — PyPI, a loose `.deb`, and an
+  AppImage — generated from one source and verified against drift.
+
+### The rule it lives by
+A card only ever shows a version a **real source returned**. A check that can't
+reach a source keeps the last-known value and says "couldn't check" — tracker
+keeper never invents a latest.
+
+<!-- release-notes-end -->

{trackerkeeper-0.1.0 → trackerkeeper-0.1.2}/docs/RELEASING.md

@@ -32,10 +32,26 @@ uploads workflow artifacts but creates no release.
 
 ## One-time setup
 
-- **PyPI Trusted Publishing** — add a pending publisher at
-  <https://pypi.org/manage/account/publishing/> matching `pypi-publish.yml`
-  (project `trackerkeeper-base`, owner `wolfgangwarehaus`, repo `trackerkeeper`, workflow
-  `pypi-publish.yml`, environment `pypi`). See the header of that workflow.
+- **PyPI Trusted Publishing** *(not yet configured — this is what failed on the
+  v0.1.0 publish)* — add a pending publisher at
+  <https://pypi.org/manage/account/publishing/>. The project name must match
+  `[project] name` in `pyproject.toml`, which for this loaf is **`trackerkeeper`**
+  — NOT the dough base's own PyPI project. Register exactly these, which are the
+  claims GitHub actually presented on the v0.1.0 run:
+
+  | field | value |
+  | --- | --- |
+  | PyPI project name | `trackerkeeper` |
+  | Owner | `wolfgangwarehaus` |
+  | Repository name | `trackerkeeper` |
+  | Workflow name | `pypi-publish.yml` |
+  | Environment name | `pypi` |
+
+  Until it exists, publishing a release fails that one leg with
+  `invalid-publisher: valid token, but no corresponding publisher` — the GitHub
+  release itself still publishes with every artifact, so only PyPI is missing.
+  After registering, re-run the failed job (`gh run rerun <id>`) or dispatch
+  `pypi-publish.yml` with the tag; nothing needs re-tagging.
 - **AUR** *(dormant)* — `aur.yml` publishes the PKGBUILD on `release: released`,
   but skips until you add an `AUR_SSH_PRIVATE_KEY` secret (a dedicated AUR deploy
   keypair; the public half on your AUR account) **and** the AUR reopens

trackerkeeper-0.1.2/docs/TODO.md

@@ -0,0 +1,155 @@
+# TODO — the handoff
+
+**Read this first.** Current state in two lines, then exactly what to do next,
+then the standing backlog.
+
+## Where things stand (2026-07-25)
+
+**v0.1.0 is tagged and built.** The release workflow produced a complete draft —
+`.deb`, AppImage (+`.zsync`), Windows setup `.exe` + portable `.zip`, sdist,
+wheel, `SHA256SUMS`, Sigstore attestations. It is **unpublished**: reviewing and
+clicking Publish on GitHub is the one deliberate human gate, and publishing
+fires `pypi-publish.yml` (PyPI via OIDC).
+
+Since the tag, `main` has moved on with the heartbeat, "new since you last
+looked", the Tracking settings section, and a generic RSS/Atom checker — all
+under `[Unreleased]` in the changelog, i.e. the substance of an 0.2.0.
+
+The app is a tray-resident watchtower over a 9-item fleet, every item
+auto-checked, that now **keeps checking on a timer whether or not the window is
+open**. CI is green on all five legs.
+
+## Pick up here (in order)
+
+1. **Publish the v0.1.0 draft** — review it at
+   `gh release view v0.1.0 --web`, then Publish. Delivery item `267380`.
+   (The tag was force-moved once, onto `edcf503`, so the released commit is
+   green; the draft is idempotently rebuilt on any re-push of the tag.)
+2. **Ship Linux-first** (delivery `0a95b7`): AUR + deb/AppImage via
+   `trackerkeeper-deliver`. Note `aur.yml` stays dormant until an
+   `AUR_SSH_PRIVATE_KEY` secret exists **and** AUR reopens new-package
+   registration.
+3. **Then 0.2.0** when the `[Unreleased]` block feels complete — the two
+   cheapest wins on the board are conditional requests (`cb0d95`) and
+   distinguishing "no match" from "unreachable" (`4e3124`).
+
+## Resolved: the CI abort that cost a re-run on most pushes
+
+**Root cause found, and it was not in the single-instance code.** conftest's
+`_isolate_qt_windows` closed and `deleteLater()`'d every top-level widget after
+each test, then called `processEvents()` — but **`processEvents()` does not
+deliver `DeferredDelete`**. Qt only reaps those when an event loop unwinds to
+the nesting level that posted them, and that fixture never runs one:
+
+```python
+w = QWidget(); w.deleteLater()
+app.processEvents()                                   # -> still alive
+QCoreApplication.sendPostedEvents(None, QEvent.Type.DeferredDelete)  # -> destroyed
+```
+
+So every `deleteLater()`'d widget in the suite stayed alive until the first test
+that spun a **real nested `QEventLoop`** — `_spin()` in
+`test_single_instance_forwarding` — which then destroyed hundreds at once, in
+arbitrary order, each carrying native blur / event-filter state. That explains
+every symptom: always the same point, always right after
+`test_settings_migration` (its alphabetical predecessor), roaming across all
+three OSes, passing locally on a single file, and cleared by `rerun --failed`
+(which runs that file alone).
+
+Fixed in `tests/conftest.py` with an explicit `sendPostedEvents(DeferredDelete)`.
+Side effect: the suite got **~2× faster** (8–10 s → ~4 s) while running more
+tests, because every `processEvents()` had been walking an ever-growing object
+graph. If an abort ever returns, look for a *new* fixture that defers deletion
+without reaping it.
+
+## What exists now (so you don't re-derive it)
+
+**Seven checkers**, all in `sources.py`, each a `(item, http, http_text)`
+function behind two injected network seams (so no test touches the network):
+
+| kind | source | notes |
+| --- | --- | --- |
+| `github` | GitHub releases API | latest **stable** (pre-releases skipped by design) |
+| `arch` | archlinux.org JSON search | prefers stable repo over testing |
+| `appstore` | Apple iTunes Lookup | app id **or** bundle id; the whole iOS/Mac store |
+| `appledev` | Apple developer-releases RSS | `ref` is an OS filter — "iOS 27", "macOS 27" |
+| `steam` | Steam news API | filters to `patchnotes`; version parsed from the title |
+| `cachyos` | mirror ISO index | rolling distro — newest `YYMMDD` snapshot folder |
+| `rss` | **any** RSS/Atom feed | `ref` = feed URL + optional title filter |
+| `manual` | — | the universal fallback; never fabricates a version |
+
+`rss` is the widest-coverage one and the answer for the long tail. `ref` is the
+feed URL, optionally followed by a space and a filter phrase
+(`https://kde.org/announcements/index.xml plasma`) — URLs can't contain spaces,
+so the split is unambiguous. It reads both dialects, and when a feed ships empty
+`<title/>` elements it takes the version from the entry **link** instead — KDE's
+own announcement feed does exactly that, and a title-only reader sees nothing.
+
+**The heartbeat** (`dashboard.py`): a `QTimer` re-checks every 2 h by default
+(15 min floor, `0` = manual only), running whether or not the window is visible;
+showing the window re-checks when stale. The timer stays `None` under offscreen,
+which doubles as the "network is allowed" sentinel — headless runs never reach
+the network. Checks run **concurrently** (pool of 8), so one dead mirror can't
+stall the rest.
+
+**"New since you last looked"**: `Item.seen_version` + `is_new()`. `has_update()`
+stays true until you install, so it can't tell *pending* from *news*; `is_new()`
+is an update you haven't laid eyes on, and it's persisted. Banked on
+`hideEvent` — banking on show would clear the badges in the instant they
+appeared. Notifications deliberately still fire only when `latest` **changes**;
+firing on "unseen" would re-notify every cycle until you looked.
+
+**The cardinal rule** (holds everywhere): a card only ever shows a version a
+real source returned. Unreachable → "couldn't check", never an invented latest.
+
+**UI:** one top bar (hamburger + settings left, title + badge, actions right,
+window controls) — the dashboard folds its header onto it via
+`TopBar.add_action()` / `insert_title_widget()` / `add_menu_action()`. Below it:
+sort chips (Updated / Channel, click the active one to flip direction), a Group
+toggle, then collapsible category sections. Density comes from the design-token
+type ladder (CAPTION/TINY/MICRO), never literal px, so the font-scale setting
+still works. `width_tier()` drops columns as the window narrows.
+
+**Tray** (`tray.py`): tooltip carries the update count *and* the unseen count
+("3 updates available, 1 new"), menu (Show / Check / Settings / Quit),
+click-to-toggle, close-to-tray, start-in-tray. Self-disables when the desktop
+has no tray so the window can never be trapped invisible —
+`tray.will_have_tray()` is the single predicate for that, and start-in-tray is
+gated on it (skipping the show without a tray would launch a process with no
+icon *and* no window).
+
+**Settings** now has a TRACKING section: check interval, show tray icon,
+close-to-tray, start-in-tray. The interval re-arms the live dashboard through
+`AppBus.tracking_prefs_changed` — no relaunch.
+
+## Standing backlog
+
+- **More checkers**: Flatpak (baking `f7a5a3`, Arch half already shipped) —
+  Flathub's `/api/v2/appstream/<id>` is the obvious way in.
+- **Conditional requests** (`cb0d95`) — ETag/`If-None-Match` + optional GitHub
+  token. Matters more now that checks run every 2 h by default.
+- **"No match" vs "unreachable"** (`4e3124`) — a typo'd ref currently reads as a
+  network blip.
+- **Per-item detail view** (`ba86e2`) — GitHub hands you `body` and Steam
+  `contents` for free; both are currently discarded in favour of a link.
+- **Brand**: replace the placeholder logo SVG + pick an accent (ingredient
+  `ac9750`) — currently riding the system accent.
+- **rig baseline goldens** now that the UI has settled (`eb70cb`).
+- **CachyOS `kde` edition** doesn't parse (different mirror layout); `desktop`,
+  `handheld`, `cli` work.
+
+## Gotchas worth keeping
+
+- **Two catalogs.** `default_fleet()` in `catalog.py` is the seed for a *fresh*
+  install; the live fleet is `~/.local/share/wolfgangwarehaus/trackerkeeper/catalog.json`
+  and **the file wins**. Editing only the seed changes nothing for an existing
+  user — that cost a debugging round early on.
+- **Stop the app before hand-editing that JSON**, or the running instance
+  overwrites your edit on its next save.
+- **`rig probe` needs no other instance running** — single-instance refuses the
+  probe's second launch and the X11 leg reports "(no window)" as a false FAIL.
+- **Re-render must un-parent before `deleteLater`**, or old rows ghost over the
+  new layout.
+- `top_bar.py` is now `manual` in `dough-sync.toml` (it was unclassified, i.e.
+  AUTO — a sync would have silently overwritten the hamburger work); `tray.py`
+  is `authored`.

{trackerkeeper-0.1.0 → trackerkeeper-0.1.2}/dough-sync.toml

@@ -4,7 +4,7 @@
 # The dough commit this loaf was last reconciled against. `--record` stamps it.
 # Seeded to dough HEAD at init; set it to the commit you actually forked from if
 # you want the first sync to surface everything dough changed since.
-synced_from = "36b09a3"
+synced_from = "f51c08b"
 
 # Files (relative to the trackerkeeper/ package dir) the fork OWNS — net-new app code or
 # modules it fully rewrote. Sync never reads or writes these.
@@ -13,6 +13,7 @@ authored = [
     "sources.py",      # the update-checker provider engine — net-new
     "dashboard.py",    # the fleet dashboard UI — net-new
     "item_dialog.py",  # the add/edit-item form — net-new
+    "detail_dialog.py",# the per-item release-notes view — net-new
     "tray.py",         # the system-tray presence (watchtower resting state) — net-new
 ]
 
@@ -22,4 +23,11 @@ manual = [
     "app.py",       # main() wires the dashboard as run_app content (not the placeholder)
     "identity.py",  # display_name "tracker keeper" — the whole-word transform would regress it
     "top_bar.py",   # hamburger + left settings + the add_action/title-slot API the dashboard folds into
+    # These three were UNCLASSIFIED while carrying local changes, which meant the
+    # next `--apply` would have silently reverted them — the drift report read
+    # +0/-79, +0/-5, +1/-11, i.e. pure loss. Classify a file the moment you
+    # customize it; the sync door assumes anything unlisted is dough's to own.
+    "settings_dialog.py",  # the TRACKING section (check interval + the tray toggles)
+    "bus.py",              # AppBus.tracking_prefs_changed — Settings re-arms the live heartbeat
+    "rig.py",              # baseline grabs the app's real content, not dough's placeholder
 ]

{trackerkeeper-0.1.0 → trackerkeeper-0.1.2}/pyproject.toml

@@ -11,10 +11,12 @@ requires = ["setuptools>=68", "wheel", "setuptools-scm>=8"]
 build-backend = "setuptools.build_meta"
 
 [project]
-# The PyPI DISTRIBUTION name — "trackerkeeper" is squatted on PyPI (a 2015 third-party
-# package), so pip's name is trackerkeeper-base while the import package stays `trackerkeeper`
-# (distribution name ≠ import name, like beautifulsoup4/bs4). `trackerkeeper new` pins
-# a fork's name back to its slug.
+# The PyPI DISTRIBUTION name. Inherited lore warning: the BASE (dough) publishes
+# under a -base suffix because its own bare name is squatted, and baking rewrote
+# that comment with this slug — but `trackerkeeper` is free on PyPI, and `new`
+# pins a fork's name back to its slug, which is what happened here. This value is
+# authoritative: it names the wheel/sdist, deliver.py reads it, and it is what the
+# PyPI Trusted Publisher must be registered against (docs/RELEASING.md).
 name = "trackerkeeper"
 # version is DYNAMIC — the tag is the version (docs/BAKING.md §2 principle 4).
 # setuptools-scm derives it from the latest `git tag vX.Y.Z`; there is nothing

trackerkeeper-0.1.2/tests/conftest.py

@@ -0,0 +1,121 @@
+"""Shared fixtures for the trackerkeeper test suite.
+
+trackerkeeper is PySide6 code, so almost every test needs a live ``QApplication``. We
+deliberately don't depend on ``pytest-qt`` (it's not in the dev extras) — a
+hand-rolled, session-scoped ``qapp`` fixture mirrors the offscreen application
+``ci.yml``'s boot-smoke builds, so the suite runs headless and deterministically.
+"""
+
+from __future__ import annotations
+
+import os
+
+# Force the offscreen platform BEFORE any PySide6 import so the suite never needs
+# a display server (parity with the boot-smoke CI step). setdefault so a caller
+# can still override (e.g. QT_QPA_PLATFORM=xcb to eyeball a widget).
+os.environ.setdefault("QT_QPA_PLATFORM", "offscreen")
+
+import pytest
+from PySide6.QtCore import (
+    QCoreApplication,
+    QEvent,
+    QSettings,
+    QStandardPaths,
+    QThread,
+)
+from PySide6.QtWidgets import QApplication
+
+# Keep the suite OUT of the maker's real settings — it had been writing straight
+# into them. Tests mutate settings through the shipped `get_settings()` handle
+# (save_collapsed, the tray toggles, the refresh interval), and that handle keys
+# off QSettings(identity.org(), identity.app()) — the SHIPPED path — so a plain
+# `pytest` was editing ~/.config/wolfgangwarehaus/trackerkeeper.conf. It really
+# did: `collapsed_groups` and `start_minimized` turned up there, written by the
+# suite, which means a run could quietly discard the groups you had folded.
+#
+# Two calls are needed, not one. Test mode redirects PATHS, but QSettings'
+# NativeFormat is a different store per platform and only Linux's is a path it
+# can reach — macOS uses a CFPreferences .plist and Windows the registry, and
+# neither is redirected. IniFormat routes all three through QStandardPaths so
+# the redirect is universal. Both must precede any QSettings construction: the
+# (org, app) ctor resolves its backend at construction time.
+# tests/test_settings_isolation.py is the guard that keeps this honest.
+QStandardPaths.setTestModeEnabled(True)
+QSettings.setDefaultFormat(QSettings.Format.IniFormat)
+
+# …and pin WHERE the INI lives, because test mode doesn't reach it off Linux.
+# QSettings resolves its own base dir and only consults QStandardPaths on Linux
+# (via XDG_CONFIG_HOME, which test mode sets); macOS uses a hardcoded ~/.config
+# and Windows the raw %APPDATA%, so IniFormat alone still lands on the real
+# store in an INI coat. setPath() is Qt's explicit override and the only thing
+# that binds all three. Anchored to the test-mode config location so everything
+# stays under one qttest tree.
+QSettings.setPath(
+    QSettings.Format.IniFormat,
+    QSettings.Scope.UserScope,
+    QStandardPaths.writableLocation(
+        QStandardPaths.StandardLocation.GenericConfigLocation),
+)
+
+
+@pytest.fixture(scope="session")
+def qapp():
+    """The process-wide QApplication, identity-stamped exactly like ``main()``:
+    application + organization name ``"trackerkeeper"`` so the ``QSettings("trackerkeeper",
+    "trackerkeeper")`` handle resolves identically under test."""
+    app = QApplication.instance() or QApplication([])
+    app.setApplicationName("trackerkeeper")
+    app.setOrganizationName("trackerkeeper")
+    yield app
+
+
+@pytest.fixture(autouse=True)
+def _isolate_identity():
+    """Snapshot and restore the process-global identity (trackerkeeper.identity is module
+    state mutated by configure()). Defense-in-depth for the whole identity /
+    metadata suite: a test that reidentifies the app and fails — or a future one
+    that forgets to restore — would otherwise leak into every later assertion.
+    Restores the raw ``_owner`` sentinel too, which configure() cannot reset to
+    None. Snapshot via the private globals so the reset is exact."""
+    from trackerkeeper import identity
+
+    saved = (identity._org, identity._app, identity._display_name, identity._owner)
+    yield
+    identity._org, identity._app, identity._display_name, identity._owner = saved
+
+
+@pytest.fixture(autouse=True)
+def _isolate_qt_windows(qapp):
+    """Tear down any top-level windows a test creates, right after it runs, so Qt
+    state never accumulates across tests. Without this, lingering windows — each
+    carrying native blur / event-filter state — pile up and get destroyed in an
+    arbitrary order at process exit, which makes PySide6 segfault; the leak is
+    order-dependent, so it only bites under shuffled runs (pytest-randomly).
+    Deleting per test, while the QApplication is healthy, keeps each test's Qt
+    world isolated and the process exit clean."""
+    yield
+    # A widget can own a RUNNING QThread — Dashboard parents its _RefreshWorker
+    # to itself — and destroying one mid-flight aborts the process ("QThread:
+    # Destroyed while thread is still running"). Let them finish before the
+    # delete below can take their parent out from under them. Caught in dough,
+    # where the breadboard's channel probe hit exactly this once the reap landed.
+    for w in qapp.topLevelWidgets():
+        for t in w.findChildren(QThread):
+            if t.isRunning():
+                t.quit()          # ends an event loop; a blocking run() ignores it
+                t.wait(10_000)    # …so this is what actually makes it safe
+    for w in qapp.topLevelWidgets():
+        w.close()
+        w.deleteLater()
+    qapp.processEvents()
+    # …and actually REAP them. processEvents() does not deliver DeferredDelete:
+    # Qt only reaps those when an event loop unwinds to the nesting level that
+    # posted them, and this fixture never runs one. Without this line every
+    # deleteLater'd widget in the suite stays alive until the first test that
+    # spins a real nested QEventLoop — test_single_instance_forwarding's _spin()
+    # — which then destroys hundreds of them at once, in arbitrary order, each
+    # carrying native blur / event-filter state. That is exactly the pile-up
+    # this fixture exists to prevent, and it aborted the run (SIGABRT on
+    # ubuntu/macos, a hard exit on windows) on most pushes. Reaping per test
+    # keeps destruction ordered and the process exit clean.
+    QCoreApplication.sendPostedEvents(None, QEvent.Type.DeferredDelete)