webbee 0.7.5__tar.gz → 0.7.7__tar.gz

{webbee-0.7.5 → webbee-0.7.7}/.github/workflows/publish.yml

@@ -17,6 +17,8 @@ jobs:
       contents: write   # create the GitHub Release for the tag
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # the stable branch moves only forward (an ancestor check)
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
@@ -28,6 +30,17 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           password: ${{ secrets.PYPI_API_TOKEN }}
+      # The `stable` branch is what every install from git names (webbee autoupdate, `pipx reinstall`, `uv tool
+      # upgrade`): moved here to the release just published -- only forward, a re-run of an older tag leaves it.
+      - name: Move the stable branch to this release
+        run: |
+          if git ls-remote --exit-code origin refs/heads/stable >/dev/null; then
+            git fetch -q origin stable
+            if git merge-base --is-ancestor HEAD FETCH_HEAD; then
+              echo "stable is already at or past this release"; exit 0
+            fi
+          fi
+          git push origin "HEAD:refs/heads/stable"
       # Mirror the PyPI release as a GitHub Release (so the repo's Releases
       # sidebar tracks the latest version) with notes from CHANGELOG.md.
       - name: Create GitHub Release

{webbee-0.7.5 → webbee-0.7.7}/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.7.7
+
+* `pipx reinstall webbee` brings the newest release for real (live check of 0.7.6: it still gave 0.7.5).
+  * imperal-mcp is installed beside webbee without its code extra. The extra requires webbee, and on a reinstall
+    pipx (uv backend) took that webbee from PyPI over the git one while PyPI's index still showed the release before.
+    webbee's own dependencies already bring what the extra holds.
+  * An install recorded with that extra is moved once onto the corrected record.
+
+## 0.7.6
+
+* **Always the newest release, from git** (06.11: `pipx reinstall webbee` put back 0.6.7 while 0.7.5 was out).
+  * pipx and uv install again what they recorded. The upgrade at the start had recorded a release's own wheel
+    address, so a reinstall went back to that release.
+  * webbee, imperal-mcp and imperal-sdk now come from their repositories' `stable` branch, which each release's CI
+    moves to its tag. The newest release is read from git itself (the tag `stable` stands on), never from an index
+    that trails it.
+  * What pipx / uv record is the branch: `pipx reinstall`, `pipx upgrade --include-injected` and `uv tool upgrade`
+    bring the newest release. An install still recorded by a version is moved onto the branch once, even on the
+    newest release.
+  * `install.sh` installs from the branch too. No git, GitHub out of reach, or the light install of Python 3.7-3.9:
+    PyPI, as before.
+
 ## 0.7.5
 
 * Needs imperal-mcp 0.9.5:

{webbee-0.7.5 → webbee-0.7.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: webbee
-Version: 0.7.5
+Version: 0.7.7
 Summary: Webbee 🐝 — the Imperal Cloud coding agent in your terminal
 Project-URL: Homepage, https://imperal.io
 Project-URL: Documentation, https://docs.imperal.io
@@ -90,6 +90,11 @@ pipx install webbee
 # or:  pip install webbee        (inside a virtual environment)
 ```
 
+Always the newest release: at its start webbee moves itself, imperal-mcp and imperal-sdk onto their git repositories'
+`stable` branch (each release moves it to its tag) and records that branch, never a version. From then on
+`pipx reinstall webbee`, `pipx upgrade --include-injected webbee` and `uv tool upgrade webbee` all bring the newest
+release. Without git on the machine it stays on PyPI.
+
 No Python tools at hand? One line installs [uv](https://docs.astral.sh/uv/) (it brings its own Python) and webbee:
 
 ```sh

{webbee-0.7.5 → webbee-0.7.7}/README.md

@@ -35,6 +35,11 @@ pipx install webbee
 # or:  pip install webbee        (inside a virtual environment)
 ```
 
+Always the newest release: at its start webbee moves itself, imperal-mcp and imperal-sdk onto their git repositories'
+`stable` branch (each release moves it to its tag) and records that branch, never a version. From then on
+`pipx reinstall webbee`, `pipx upgrade --include-injected webbee` and `uv tool upgrade webbee` all bring the newest
+release. Without git on the machine it stays on PyPI.
+
 No Python tools at hand? One line installs [uv](https://docs.astral.sh/uv/) (it brings its own Python) and webbee:
 
 ```sh

webbee-0.7.7/install.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+# Webbee installer — bootstraps uv (which brings its own Python) then installs webbee.
+# Always the newest release, straight from git: webbee, imperal-mcp and imperal-sdk from their repositories'
+# `stable` branch, which every release moves to its tag. uv records the branch, never a version, so running this
+# again, or `uv tool upgrade webbee`, brings the newest release. No git on the machine: the newest from PyPI.
+set -e
+
+if ! command -v uv >/dev/null 2>&1; then
+  echo "Installing uv (Python toolchain manager)…"
+  curl -LsSf https://astral.sh/uv/install.sh | sh
+  # uv installs to ~/.local/bin or ~/.cargo/bin; make it visible for this run.
+  export PATH="$HOME/.local/bin:$HOME/.cargo/bin:$PATH"
+fi
+
+GH="https://github.com/imperalcloud"
+if command -v git >/dev/null 2>&1; then
+  echo "Installing webbee (newest release, from git)…"
+  uv tool install --force --refresh \
+    --with "imperal-mcp @ git+$GH/imperal-mcp.git@stable" \
+    --with "imperal-sdk[universal-index] @ git+$GH/imperal-sdk.git@stable" \
+    "webbee @ git+$GH/webbee-code.git@stable"
+else
+  echo "Installing webbee (newest release, from PyPI: no git here)…"
+  uv tool install --force --refresh "webbee"
+fi
+
+echo ""
+echo "✅ webbee installed. Start it with:  webbee"
+echo "   (if 'webbee' is not found, add uv's tool bin to your PATH: uv tool update-shell)"

{webbee-0.7.5 → webbee-0.7.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webbee"
-version = "0.7.5"
+version = "0.7.7"
 description = "Webbee 🐝 — the Imperal Cloud coding agent in your terminal"
 readme = "README.md"
 license = "GPL-3.0-or-later"

webbee-0.7.7/src/webbee/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.7.7"

{webbee-0.7.5 → webbee-0.7.7}/src/webbee/autoupdate.py

@@ -7,7 +7,16 @@ installed it (a uv tool, a pipx venv, plain pip, or the light install that runs
 the new release; then it brings the shell's imperal-mcp to its newest release WITH its code extra -- installed when
 missing, upgraded by the tool that installed it (live 2026-10-25: an install had lost its code extra and the code tools
 failed without a word). PyPI out of reach: nothing changes and webbee starts at once; nothing installed and PyPI out of
-reach: imperal-mcp from its source, git. Every step is bounded and never fails the start."""
+reach: imperal-mcp from its source, git. Every step is bounded and never fails the start.
+
+The source is git (owner 2026-11-06: "Скрипт ВСЕГДА только на САМЫЙ свежий пакет смотреть должен ... не на pypi, а на
+сам git repo"): webbee, imperal-mcp and imperal-sdk come from their repositories' ``stable`` branch, which each
+release's CI moves to its tag. pipx and uv record what they installed and ``pipx reinstall`` / ``pipx upgrade`` /
+``uv tool upgrade`` install that record again -- an install recorded as a release's own wheel address stayed on that
+release forever (live 2026-11-06: ``pipx reinstall webbee`` put back 0.6.7 while 0.7.5 was out). The record is now the
+branch, never a version: any of them brings the newest release, and an install still recorded by a version is moved
+onto the branch once. No git (or GitHub out of reach), or the light install of an old Python (3.7 builds no package
+from source): PyPI, as before."""
 import os
 import shutil
 import subprocess
@@ -16,8 +25,28 @@ import time
 
 DIST = "webbee"
 MCP = "imperal-mcp"
+SDK = "imperal-sdk"
 MCP_SPEC = "imperal-mcp[code]"
-MCP_GIT_SPEC = "imperal-mcp[code] @ git+https://github.com/imperalcloud/imperal-mcp.git"
+SDK_SPEC = "imperal-sdk[universal-index]"
+STABLE = "stable"                          # the branch CI moves to each release tag (never a version: see above)
+REPOS = {DIST: "https://github.com/imperalcloud/webbee-code.git",
+         MCP: "https://github.com/imperalcloud/imperal-mcp.git",
+         SDK: "https://github.com/imperalcloud/imperal-sdk.git"}
+NAMES = {DIST: DIST, MCP: MCP_SPEC, SDK: SDK_SPEC}   # each with the extras its install needs
+
+
+def git_spec(dist: str, ref: str = STABLE, extras: bool = True) -> str:
+    """``dist`` (with its extras) from its repository at ``ref`` -- the ``stable`` branch unless a tag is named."""
+    return f"{NAMES[dist] if extras else dist} @ git+{REPOS[dist]}@{ref}"
+
+
+MCP_GIT_SPEC = git_spec(MCP)
+# imperal-mcp beside webbee goes WITHOUT its code extra: the extra requires webbee, and pipx (uv backend) installed
+# that webbee from PyPI over the git one on a reinstall (live 2026-11-06: stable 0.7.6, `pipx reinstall` gave PyPI's
+# 0.7.5). webbee's own dependencies already hold what the extra brings (tree-sitter, the sdk's index).
+MCP_BESIDE_WEBBEE = git_spec(MCP, extras=False)
+WEBBEE_ENV_SPECS = (git_spec(DIST), MCP_BESIDE_WEBBEE, git_spec(SDK))     # webbee's own environment
+MCP_ENV_SPECS = (MCP_GIT_SPEC, git_spec(SDK), git_spec(DIST))             # the shell's imperal-mcp
 PYPI = "https://pypi.org/pypi/{}/json"
 OFF_ENV = "WEBBEE_NO_AUTOUPDATE"           # 1: never upgrade at the start (CI, a pinned setup)
 DONE_ENV = "WEBBEE_UPGRADED"               # set on the restart after a self-upgrade: never twice in a row
@@ -74,6 +103,75 @@ def wheel_url(dist: str, version: str):
         return None
 
 
+def stable_version(dist: str, git, run=subprocess.run):
+    """The release ``dist``'s ``stable`` branch stands on -- the version tag on its commit, read from the repository
+    itself (no index that trails a release) -- or None: no git, GitHub out of reach, no branch or no tag on it."""
+    if not git:
+        return None
+    try:
+        got = run([git, "ls-remote", REPOS[dist], f"refs/heads/{STABLE}", "refs/tags/v*"], capture_output=True,
+                  text=True, timeout=30, env={**os.environ, "GIT_TERMINAL_PROMPT": "0"})
+        if got.returncode != 0:
+            return None
+        head, direct, peeled = "", {}, {}
+        for line in str(got.stdout or "").splitlines():
+            sha, _, ref = line.strip().partition("\t")
+            if ref == f"refs/heads/{STABLE}":
+                head = sha
+            elif ref.startswith("refs/tags/v"):
+                name = ref[len("refs/tags/v"):]
+                if name.endswith("^{}"):
+                    peeled[name[:-3]] = sha     # the commit an annotated tag names
+                else:
+                    direct[name] = sha
+        on_head = [v for v, sha in direct.items() if peeled.get(v, sha) == head and _ver(v)]
+        return max(on_head, key=_ver) if head and on_head else None
+    except Exception:
+        return None
+
+
+def on_stable(tool: str, prefix: str, specs) -> bool:
+    """What pipx / uv will install again for the environment at ``prefix`` (``pipx reinstall``, ``pipx upgrade``,
+    ``uv tool upgrade``) is ``specs``, each by its repository's stable branch. pipx: each spec exactly as given (an
+    imperal-mcp recorded beside webbee WITH its code extra pulled webbee from PyPI on a reinstall); uv resolves the
+    record as one set, so its repository and branch suffice. Plain pip keeps no such record."""
+    try:
+        if tool == "pipx":
+            import json
+            with open(os.path.join(prefix, "pipx_metadata.json"), encoding="utf-8") as f:
+                meta = json.load(f)
+            recorded = [str((meta.get("main_package") or {}).get("package_or_url") or "")]
+            recorded += [str((p or {}).get("package_or_url") or "") for p in (meta.get("injected_packages") or {}).values()]
+            return all(s in recorded for s in specs)
+        if tool == "uv":
+            with open(os.path.join(prefix, "uv-receipt.toml"), encoding="utf-8") as f:
+                receipt = f.read()
+            urls = [s.split(" @ git+", 1)[-1].rsplit("@", 1)[0] for s in specs]
+            return all(f'git = "{u}?rev={STABLE}"' in receipt for u in urls)
+    except Exception:
+        return False
+    return True
+
+
+def _git_install(tool: str, main: str, withs, uv, pipx, python, venv: str, record: bool):
+    """``main`` and ``withs`` (the packages beside it) from git, by ``tool``, recorded as given. pipx: an environment
+    already recorded on the branch is upgraded by its own record (``upgrade --include-injected``, in place); otherwise
+    (``record``: a new one, or one recorded by a version) installed again and its packages injected -- the only way
+    pipx writes a new record. uv records ``--with`` beside the tool on every install."""
+    if tool == "uv" and uv:
+        cmd = [uv, "tool", "install", "--force", "--refresh"]
+        for w in withs:
+            cmd += ["--with", w]
+        return cmd + [main]
+    if tool == "pipx" and pipx:
+        if not record:
+            return [pipx, "upgrade", "--include-injected", venv]
+        return [[pipx, "install", "--force", main], [pipx, "inject", "--force", venv, *withs]]
+    if tool == "pip" and python:
+        return [python, "-m", "pip", "install", "--upgrade", "--no-cache-dir", main, *withs]
+    return None
+
+
 def _spec(name: str, dist: str, version: str, wheel) -> str:
     """``name`` (with its extras) at ``version``: by its wheel's address when known, else by the index."""
     url = wheel(dist, version) if wheel else None
@@ -106,10 +204,15 @@ def find_uv(which=safe_which):
 
 
 def self_command(version: str, prefix: str = sys.prefix, executable: str = sys.executable, env=os.environ,
-                 uv=None, pipx=None, wheel=None):
-    """The command that installs webbee ``version`` where this webbee is installed -- or None."""
-    spec = _spec(DIST, DIST, version, wheel)
+                 uv=None, pipx=None, wheel=None, source: str = "pypi", record: bool = True, ref: str = STABLE):
+    """The command that installs webbee ``version`` where this webbee is installed -- or None. ``source`` "git": from
+    the repositories at ``ref`` (the stable branch; a tag only to put a release back), imperal-mcp and imperal-sdk
+    beside it; ``record``: pipx writes its record anew (see ``_git_install``)."""
     light = env.get(LIGHT_ENV)
+    if source == "git" and not light:
+        return _git_install(tool_of(prefix), git_spec(DIST, ref), [MCP_BESIDE_WEBBEE, git_spec(SDK)], uv, pipx,
+                            executable, DIST, record)
+    spec = _spec(DIST, DIST, version, wheel)
     if light:                               # an old Python runs this release through its light install
         return [light, "-m", "pip", "install", "--upgrade", "--no-cache-dir", spec]
     return _install(tool_of(prefix), spec, uv, pipx, executable, venv=DIST)
@@ -132,13 +235,15 @@ def _install(tool: str, spec: str, uv, pipx, python, venv: str = ""):
 
 
 def mcp_installed(which=safe_which, run=subprocess.run) -> dict:
-    """The shell's imperal-mcp (the command on PATH): ``{"tool", "python", "version", "code"}`` -- {} when none."""
+    """The shell's imperal-mcp (the command on PATH): ``{"tool", "python", "prefix", "version", "code"}`` -- {} when
+    none."""
     exe = which(MCP)
     if not exe:
         return {}
     real = os.path.realpath(exe)
     py = os.path.join(os.path.dirname(real), "python.exe" if _WINDOWS else "python")
-    out = {"tool": tool_of(real), "python": py, "version": "", "code": False}
+    out = {"tool": tool_of(real), "python": py, "prefix": os.path.dirname(os.path.dirname(real)), "version": "",
+           "code": False}
     # asked twice when it says "no code extra": a reinstall is never made on one odd answer (live 2026-10-25: right after
     # another install the first answer said no webbee, the next ones yes)
     for _ in range(2):
@@ -155,18 +260,27 @@ def mcp_installed(which=safe_which, run=subprocess.run) -> dict:
     return out
 
 
-def mcp_command(inst: dict, newest, uv, pipx, wheel=None):
+def mcp_command(inst: dict, newest, uv, pipx, wheel=None, source: str = "pypi"):
     """The one command that makes the shell's imperal-mcp the newest with its code extra -- by the tool that installed
-    it (uv, else pipx, for a new install) -- or None when it already is, or nothing can do it."""
-    if inst and inst.get("version") and inst.get("version") == newest and inst.get("code"):
+    it (uv, else pipx, for a new install) -- or None when it already is, or nothing can do it. ``source`` "git": from
+    the stable branches, imperal-sdk and webbee beside it, and an install recorded by a version is moved onto the
+    branch even when its version is the newest (what ``pipx reinstall`` / ``uv tool upgrade`` would put back)."""
+    git = source == "git"
+    recorded = bool(inst) and on_stable(inst.get("tool") or "", inst.get("prefix") or "", MCP_ENV_SPECS)
+    if inst and inst.get("version") and inst.get("version") == newest and inst.get("code") and (recorded or not git):
         return None
     if inst and not inst.get("version"):
         return None                         # it did not answer: a working install is never replaced blind
     if inst and not newest and inst.get("code"):
         return None                         # PyPI unread: what works stays
-    spec = _spec(MCP_SPEC, MCP, newest, wheel) if newest else (MCP_SPEC if inst else MCP_GIT_SPEC)
+    if git and inst and _ver(inst.get("version")) > _ver(newest):
+        return None                         # newer than the last release (a build of its own): never taken back
     tool = inst.get("tool") if inst else ("uv" if uv else "pipx" if pipx else "")
-    return _install(tool, spec, uv, pipx, inst.get("python") if inst else None, venv=MCP if inst else "")
+    if git:
+        return _git_install(tool or "", MCP_GIT_SPEC, [git_spec(SDK), git_spec(DIST)], uv, pipx,
+                            inst.get("python") if inst else None, MCP, record=not recorded)
+    spec = _spec(MCP_SPEC, MCP, newest, wheel) if newest else (MCP_SPEC if inst else MCP_GIT_SPEC)
+    return _install(tool or "", spec, uv, pipx, inst.get("python") if inst else None, venv=MCP if inst else "")
 
 
 def restart_command(argv, env=os.environ, executable: str = sys.executable):
@@ -285,23 +399,46 @@ def imports_ok(python: str, run=subprocess.run, light: bool = False) -> bool:
         return False
 
 
+def _steps(cmd) -> list:
+    """One command, or the commands of one install in their order (pipx: install, then inject)."""
+    return [list(c) for c in cmd] if cmd and isinstance(cmd[0], (list, tuple)) else [list(cmd or [])]
+
+
+def _show(cmd) -> str:
+    """What a person runs by hand to do ``cmd``."""
+    return " && ".join(" ".join(f"'{a}'" if " " in a or "[" in a else a for a in c) for c in _steps(cmd))
+
+
 def _run(cmd, run=subprocess.run) -> bool:
+    """Every step of ``cmd`` in its order; the first that fails stops the rest."""
     try:
-        return run(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True,
-                   timeout=STEP_TIMEOUT_S).returncode == 0
+        for step in _steps(cmd):
+            if run(step, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True,
+                   timeout=STEP_TIMEOUT_S).returncode != 0:
+                return False
+        return True
     except Exception:
         return False
 
 
-def _roll_back(current: str, newest: str, python: str, light: str, env, uv, pipx, wheel, run, say) -> bool:
+def _newest(dist: str, git, fetch, stable) -> tuple:
+    """``(version, source)``: the release on ``dist``'s stable branch ("git") when git reads it, else PyPI's."""
+    v = stable(dist, git) if git else None
+    return (v, "git") if v else (fetch(dist), "pypi")
+
+
+def _roll_back(current: str, newest: str, python: str, light: str, env, uv, pipx, wheel, run, say,
+               source: str = "pypi", prefix: str = sys.prefix) -> bool:
     """``newest`` installed but does not import: ``current`` installed again by the same tool and checked the same
-    way -- never a release on disk that does not start. Says what happened either way."""
-    back = self_command(current, env=env, uv=uv, pipx=pipx, wheel=wheel)
+    way -- never a release on disk that does not start. Says what happened either way. From git: ``current``'s own
+    tag (recorded so until the next release moves it onto the branch again)."""
+    back = self_command(current, prefix=prefix, env=env, uv=uv, pipx=pipx, wheel=wheel, source=source,
+                        ref=f"v{current}")
     if back and _run(back, run) and imports_ok(python, run, light=bool(light)):
         say(f"🐝 webbee {newest} was installed but does not start (its modules do not import) -- "
             f"put {current} back; starting {current}")
         return True
-    fix = " ".join(back) if back else f"pip install webbee=={current}"
+    fix = _show(back) if back else f"pip install webbee=={current}"
     say(f"🐝 webbee {newest} was installed but does not start, and {current} could not be put back -- "
         f"this session runs on, but the next start may fail: run {fix}")
     return False
@@ -309,7 +446,7 @@ def _roll_back(current: str, newest: str, python: str, light: str, env, uv, pipx
 
 def upgrade_before_start(argv, current: str, say=print, fetch=latest, which=safe_which, run=subprocess.run,
                          execv=os.execv, env=os.environ, wheel=wheel_url, lock_path=_lock_path,
-                         sleep=time.sleep) -> list:
+                         sleep=time.sleep, stable=stable_version, prefix: str = sys.prefix) -> list:
     """Bring webbee and the shell's imperal-mcp to their newest releases, then let the start go on; a self-upgrade
     starts webbee again on the new release (never returns then). Returns what it did, for the log. Never raises."""
     did: list = []
@@ -330,7 +467,7 @@ def upgrade_before_start(argv, current: str, say=print, fetch=latest, which=safe
                 return did
             if state == "free":
                 lock = ""
-                newest = fetch(DIST)
+                newest = _newest(DIST, None if env.get(LIGHT_ENV) else which("git"), fetch, stable)[0]
                 if newest and _ver(newest) > _ver(current) and not env.get(DONE_ENV):
                     env[DONE_ENV] = "1"
                     again = restart_command(list(argv), env=env)
@@ -339,12 +476,19 @@ def upgrade_before_start(argv, current: str, say=print, fetch=latest, which=safe
                     execv(again[0], again)
                 return did
         uv, pipx = find_uv(which), which("pipx")
-        newest = fetch(DIST)
-        if newest and _ver(newest) > _ver(current) and not env.get(DONE_ENV):
-            cmd = self_command(newest, env=env, uv=uv, pipx=pipx, wheel=wheel)
+        light = env.get(LIGHT_ENV) or ""
+        git = None if light else which("git")     # 3.7's pip builds no package from source: the light install stays on PyPI
+        newest, source = _newest(DIST, git, fetch, stable)
+        tool = tool_of(prefix)
+        recorded = source != "git" or on_stable(tool, prefix, WEBBEE_ENV_SPECS)
+        # the same release recorded by a version: moved onto the branch (what pipx/uv would put back on a reinstall)
+        if newest and (_ver(newest) > _ver(current) or (not recorded and _ver(newest) == _ver(current))) \
+                and not env.get(DONE_ENV):
+            cmd = self_command(newest, prefix=prefix, env=env, uv=uv, pipx=pipx, wheel=wheel, source=source,
+                               record=not recorded)
             if cmd:
-                say(f"🐝 updating webbee {current} -> {newest} ...")
-                light = env.get(LIGHT_ENV) or ""
+                say(f"🐝 updating webbee {current} -> {newest} ..." if _ver(newest) > _ver(current) else
+                    f"🐝 moving webbee {current} onto its release branch, so a reinstall brings the newest ...")
                 python = light or sys.executable
                 installed = _run(cmd, run)
                 ok = installed and (imports_ok(python, run, light=bool(light)) or
@@ -353,7 +497,7 @@ def upgrade_before_start(argv, current: str, say=print, fetch=latest, which=safe
                     # on disk a release that does not import (or an install that broke off halfway): the next start
                     # would run it and stay stuck. The one running now (and any other open session) holds the old
                     # modules: put the old release back
-                    _roll_back(current, newest, python, light, env, uv, pipx, wheel, run, say)
+                    _roll_back(current, newest, python, light, env, uv, pipx, wheel, run, say, source, prefix)
                 elif ok:
                     did.append(f"webbee {newest}")
                     env[DONE_ENV] = "1"           # the restart inherits it: never a second self-upgrade
@@ -365,18 +509,18 @@ def upgrade_before_start(argv, current: str, say=print, fetch=latest, which=safe
                     execv(again[0], again)
                     return did
                 else:
-                    say(f"🐝 webbee could not update itself -- run: {' '.join(cmd)}")
-        mcp_newest = fetch(MCP)
+                    say(f"🐝 webbee could not update itself -- run: {_show(cmd)}")
+        mcp_newest, mcp_source = _newest(MCP, git, fetch, stable)
         inst = mcp_installed(which, run)
-        cmd = mcp_command(inst, mcp_newest, uv, pipx, wheel)
+        cmd = mcp_command(inst, mcp_newest, uv, pipx, wheel, source=mcp_source)
         if cmd:
             what = (f"imperal-mcp {inst.get('version') or '?'} -> {mcp_newest or 'source'}" if inst
-                    else f"imperal-mcp {mcp_newest or 'from source'}")
+                    else f"imperal-mcp {mcp_newest or 'from source'}") + (" (git, stable)" if mcp_source == "git" else "")
             say(f"🐝 updating {what} ...")
             if _run(cmd, run):
                 did.append(what)
             else:
-                say(f"🐝 imperal-mcp could not be updated -- run: {' '.join(cmd)}")
+                say(f"🐝 imperal-mcp could not be updated -- run: {_show(cmd)}")
     except SystemExit:
         raise
     except Exception:

{webbee-0.7.5 → webbee-0.7.7}/tests/test_autoupdate.py

@@ -299,3 +299,173 @@ def test_an_upgrader_that_dies_during_the_wait_is_taken_over(tmp_path):
                             which=_which({"pipx": "/bin/pipx"}), run=run, env={}, execv=lambda p, a: None,
                             lock_path=lambda: str(lock), sleep=sleep)
     assert len(slept) == 1 and any("webbee==0.6.5" in c for c in run.calls)
+
+
+# ── owner 2026-11-06: always the newest, from git. Live: `pipx reinstall webbee` put back 0.6.7 while 0.7.5 was out --
+#    pipx had recorded 0.6.7's wheel address and reinstalls its record; the record is now the stable branch ──
+WB, MCP_G, SDK_G = au.git_spec(au.DIST), au.git_spec(au.MCP), au.git_spec(au.SDK)
+MCP_W = au.MCP_BESIDE_WEBBEE              # beside webbee: no code extra (it would pull webbee from PyPI)
+H_OLD, H_NEW, H_TAG = "a" * 40, "b" * 40, "c" * 40
+
+
+def _ls_remote(stable_sha):
+    lines = [f"{H_OLD}\trefs/tags/v0.7.4",                       # a lightweight tag
+             f"{H_TAG}\trefs/tags/v0.7.5", f"{H_NEW}\trefs/tags/v0.7.5^{{}}",   # an annotated one: its commit
+             f"{stable_sha}\trefs/heads/stable"]
+    return lambda cmd, **kw: subprocess.CompletedProcess(cmd, 0, stdout="\n".join(lines) + "\n", stderr="")
+
+
+def test_the_newest_release_is_the_tag_the_stable_branch_stands_on():
+    assert au.stable_version("webbee", "/bin/git", run=_ls_remote(H_NEW)) == "0.7.5"
+    assert au.stable_version("webbee", "/bin/git", run=_ls_remote(H_OLD)) == "0.7.4"
+    assert au.stable_version("webbee", "/bin/git", run=_ls_remote("d" * 40)) is None   # between tags: not a release
+    assert au.stable_version("webbee", None) is None                                    # no git
+    failed = lambda cmd, **kw: subprocess.CompletedProcess(cmd, 128, stdout="", stderr="")   # noqa: E731
+    assert au.stable_version("webbee", "/bin/git", run=failed) is None                  # GitHub out of reach
+    seen = []
+    au.stable_version("imperal-sdk", "/bin/git", run=lambda cmd, **kw: seen.append((cmd, kw)) or 1 / 0)
+    assert seen[0][0][:3] == ["/bin/git", "ls-remote", au.REPOS["imperal-sdk"]]
+    assert seen[0][1]["env"]["GIT_TERMINAL_PROMPT"] == "0"                              # never waits on a prompt
+
+
+def test_the_spec_is_the_branch_never_a_version():
+    assert WB == "webbee @ git+https://github.com/imperalcloud/webbee-code.git@stable"
+    assert MCP_G == "imperal-mcp[code] @ git+https://github.com/imperalcloud/imperal-mcp.git@stable"
+    assert SDK_G == "imperal-sdk[universal-index] @ git+https://github.com/imperalcloud/imperal-sdk.git@stable"
+    assert au.MCP_GIT_SPEC == MCP_G
+    assert MCP_W == "imperal-mcp @ git+https://github.com/imperalcloud/imperal-mcp.git@stable"
+
+
+def _pipx_venv(tmp_path, main, injected=()):
+    import json
+    venv = tmp_path / "pipx" / "venvs" / "webbee"
+    venv.mkdir(parents=True)
+    (venv / "pipx_metadata.json").write_text(json.dumps({
+        "main_package": {"package_or_url": main},
+        "injected_packages": {s.split()[0]: {"package_or_url": s} for s in injected}}))
+    return str(venv)
+
+
+def test_what_pipx_and_uv_recorded_is_read(tmp_path):
+    pinned = _pipx_venv(tmp_path / "a", "webbee @ https://files.pythonhosted.org/x/webbee-0.6.7-py3-none-any.whl")
+    assert not au.on_stable("pipx", pinned, (WB,))
+    good = _pipx_venv(tmp_path / "b", WB, (MCP_W, SDK_G))
+    assert au.on_stable("pipx", good, au.WEBBEE_ENV_SPECS)
+    coded = _pipx_venv(tmp_path / "d", WB, (MCP_G, SDK_G))                   # mcp WITH its code extra beside webbee
+    assert not au.on_stable("pipx", coded, au.WEBBEE_ENV_SPECS)
+    half = _pipx_venv(tmp_path / "c", WB)                                     # its packages still from PyPI
+    assert not au.on_stable("pipx", half, au.WEBBEE_ENV_SPECS)
+    uv = tmp_path / "uv" / "tools" / "imperal-mcp"
+    uv.mkdir(parents=True)
+    (uv / "uv-receipt.toml").write_text('[tool]\nrequirements = [{ name = "imperal-mcp", extras = ["code"], '
+                                        'specifier = "==0.9.5" }]\n')
+    assert not au.on_stable("uv", str(uv), (MCP_G,))
+    (uv / "uv-receipt.toml").write_text(
+        '[tool]\nrequirements = [\n'
+        '    { name = "imperal-mcp", extras = ["code"], git = "https://github.com/imperalcloud/imperal-mcp.git?rev=stable" },\n'
+        '    { name = "imperal-sdk", extras = ["universal-index"], git = "https://github.com/imperalcloud/imperal-sdk.git?rev=stable" },\n'
+        '    { name = "webbee", git = "https://github.com/imperalcloud/webbee-code.git?rev=stable" },\n]\n')
+    assert au.on_stable("uv", str(uv), au.MCP_ENV_SPECS)
+    assert not au.on_stable("pipx", str(tmp_path / "missing"), (WB,))   # unreadable: moved, never assumed
+    assert au.on_stable("pip", "/venv", (WB,))                          # plain pip keeps no record
+
+
+def test_from_git_each_tool_installs_and_records_the_branch():
+    uv = au.self_command("0.7.5", prefix="/u/.local/share/uv/tools/webbee", env={}, uv="/bin/uv", source="git")
+    assert uv == ["/bin/uv", "tool", "install", "--force", "--refresh", "--with", MCP_W, "--with", SDK_G, WB]
+    px = au.self_command("0.7.5", prefix="/h/.local/pipx/venvs/webbee", env={}, pipx="/bin/pipx", source="git")
+    assert px == [["/bin/pipx", "install", "--force", WB], ["/bin/pipx", "inject", "--force", "webbee", MCP_W, SDK_G]]
+    kept = au.self_command("0.7.5", prefix="/h/.local/pipx/venvs/webbee", env={}, pipx="/bin/pipx", source="git",
+                           record=False)                                    # already on the branch: its own record
+    assert kept == ["/bin/pipx", "upgrade", "--include-injected", "webbee"]
+    pip = au.self_command("0.7.5", prefix="/v", executable="/v/bin/python", env={}, source="git")
+    assert pip == ["/v/bin/python", "-m", "pip", "install", "--upgrade", "--no-cache-dir", WB, MCP_W, SDK_G]
+    light = au.self_command("0.7.5", env={au.LIGHT_ENV: "/usr/bin/python3.7"}, source="git", wheel=None)
+    assert light[-1] == "webbee==0.7.5"                                     # 3.7 builds nothing from source: PyPI
+
+
+def test_the_same_release_recorded_by_a_version_is_moved_onto_the_branch(tmp_path):
+    venv = _pipx_venv(tmp_path, "webbee @ https://files.pythonhosted.org/x/webbee-0.7.5-py3-none-any.whl")
+    run, execd, env, said = _Run(), [], {}, []
+    stable = {"webbee": "0.7.5", "imperal-mcp": "0.9.5"}.get
+    au.upgrade_before_start(["--once"], "0.7.5", say=said.append, fetch=lambda d: 1 / 0, wheel=None,
+                            which=_which({"pipx": "/bin/pipx", "git": "/bin/git"}), run=run, env=env,
+                            execv=lambda p, a: execd.append(a), lock_path=lambda: str(tmp_path / "upgrade.lock"),
+                            stable=lambda d, git: stable(d), prefix=venv)
+    assert ["/bin/pipx", "install", "--force", WB] in run.calls
+    assert ["/bin/pipx", "inject", "--force", "webbee", MCP_W, SDK_G] in run.calls
+    assert execd and any("onto its release branch" in s for s in said)
+
+
+def test_on_the_branch_and_newest_nothing_is_installed(tmp_path, monkeypatch):
+    venv = _pipx_venv(tmp_path, WB, (MCP_W, SDK_G))
+    exe = tmp_path / "pipx" / "venvs" / "imperal-mcp" / "bin" / "imperal-mcp"
+    exe.parent.mkdir(parents=True)
+    exe.write_text("")
+    _pipx_venv(tmp_path / "m", MCP_G, (SDK_G, WB))
+    import shutil
+    shutil.copy(tmp_path / "m" / "pipx" / "venvs" / "webbee" / "pipx_metadata.json", exe.parent.parent)
+    monkeypatch.setattr(au, "find_uv", lambda which=None: None)
+    run = _Run(stdout="0.9.5 True")
+    au.upgrade_before_start([], "0.7.5", say=lambda m: None, fetch=lambda d: 1 / 0, wheel=None,
+                            which=_which({"pipx": "/bin/pipx", "git": "/bin/git", "imperal-mcp": str(exe)}), run=run,
+                            env={}, execv=lambda *a: 1 / 0, lock_path=lambda: str(tmp_path / "upgrade.lock"),
+                            stable=lambda d, git: {"webbee": "0.7.5", "imperal-mcp": "0.9.5"}[d], prefix=venv)
+    assert not any("install" in c or "upgrade" in c or "inject" in c for c in run.calls)
+
+
+def test_a_newer_release_on_the_branch_is_taken_by_the_install_s_own_record(tmp_path):
+    venv = _pipx_venv(tmp_path, WB, (MCP_W, SDK_G))
+    run, execd = _Run(), []
+    au.upgrade_before_start([], "0.7.4", say=lambda m: None, fetch=lambda d: 1 / 0, wheel=None,
+                            which=_which({"pipx": "/bin/pipx", "git": "/bin/git"}), run=run, env={},
+                            execv=lambda p, a: execd.append(a), lock_path=lambda: str(tmp_path / "upgrade.lock"),
+                            stable=lambda d, git: "0.7.5", prefix=venv)
+    assert run.calls[0] == ["/bin/pipx", "upgrade", "--include-injected", "webbee"] and execd
+
+
+def test_no_git_or_github_out_of_reach_falls_back_to_pypi(tmp_path):
+    run = _Run()
+    au.upgrade_before_start([], "0.7.4", say=lambda m: None, fetch={"webbee": "0.7.5"}.get, wheel=None,
+                            which=_which({"pipx": "/bin/pipx", "git": "/bin/git"}), run=run, env={},
+                            execv=lambda p, a: None, lock_path=lambda: str(tmp_path / "upgrade.lock"),
+                            stable=lambda d, git: None, prefix="/h/.local/pipx/venvs/webbee")
+    assert run.calls[0][-1] == "webbee==0.7.5"
+
+
+def test_the_shell_s_imperal_mcp_recorded_by_a_version_is_moved_onto_the_branch(tmp_path):
+    uv = tmp_path / "uv" / "tools" / "imperal-mcp"
+    uv.mkdir(parents=True)
+    (uv / "uv-receipt.toml").write_text('[tool]\nrequirements = [{ name = "imperal-mcp", extras = ["code"], '
+                                        'specifier = "==0.9.5" }]\n')
+    inst = {"tool": "uv", "python": str(uv / "bin" / "python"), "prefix": str(uv), "version": "0.9.5", "code": True}
+    assert au.mcp_command(inst, "0.9.5", "/bin/uv", None) is None               # PyPI: nothing to do
+    assert au.mcp_command(inst, "0.9.5", "/bin/uv", None, source="git") == [
+        "/bin/uv", "tool", "install", "--force", "--refresh", "--with", SDK_G, "--with", WB, MCP_G]
+    assert au.mcp_command(dict(inst, version="0.9.6"), "0.9.5", "/bin/uv", None, source="git") is None  # own build
+    assert au.mcp_command({}, "0.9.5", None, "/bin/pipx", source="git") == [
+        ["/bin/pipx", "install", "--force", MCP_G], ["/bin/pipx", "inject", "--force", "imperal-mcp", SDK_G, WB]]
+
+
+def test_the_steps_of_one_install_stop_at_the_first_that_fails():
+    calls = []
+
+    def run(cmd, **kw):
+        calls.append(cmd)
+        return subprocess.CompletedProcess(cmd, 1, stdout="", stderr="")
+    assert au._run([["/bin/pipx", "install", "x"], ["/bin/pipx", "inject", "y"]], run) is False
+    assert len(calls) == 1
+    shown = au._show([["/bin/pipx", "install", "--force", WB], ["/bin/pipx", "inject", "--force", "webbee", MCP_G]])
+    assert shown == f"/bin/pipx install --force '{WB}' && /bin/pipx inject --force webbee '{MCP_G}'"
+
+
+def test_a_git_release_that_does_not_import_is_put_back_by_its_own_tag(tmp_path, monkeypatch):
+    _checks(monkeypatch, [False, False, True])
+    venv = _pipx_venv(tmp_path, WB, (MCP_W, SDK_G))
+    run, said = _Run(), []
+    au.upgrade_before_start([], "0.7.4", say=said.append, fetch=lambda d: 1 / 0, wheel=None,
+                            which=_which({"pipx": "/bin/pipx", "git": "/bin/git"}), run=run, env={},
+                            execv=lambda *a: 1 / 0, lock_path=lambda: str(tmp_path / "upgrade.lock"),
+                            stable=lambda d, git: "0.7.5", prefix=venv)
+    assert ["/bin/pipx", "install", "--force", au.git_spec("webbee", "v0.7.4")] in run.calls
+    assert any("put 0.7.4 back" in s for s in said)