[manish-wekan]

Why

nitrostack-py upgrade fails on every project init creates:

Error: Refusing to write an invalid pyproject.toml: Invalid value (at line 20, column 12)

The dependency pattern also matched nitrostack = { path = "vendor/nitrostack" } in [tool.uv.sources].

Fixing the pattern isn't enough. A vendored project runs vendor/nitrostack, whatever spec it declares. With "nitrostack>=0.4.2" against a vendored 0.4.1, uv lock succeeds and the project keeps running 0.4.1. So "upgrade" would quietly do nothing.

What

• Spec rewrite. In pyproject.toml, upgrade only rewrites the spec inside [project].dependencies. The pattern also skips paths that end in /nitrostack.
• Vendored projects (those with vendor/nitrostack): upgrade replaces the vendored copy with the target release.
  • When the running CLI is that release, it copies the CLI's SDK, the same way init does.
  • Otherwise it downloads the PyPI wheel and checks it against PyPI's sha256.
  • The wheel's Requires-Dist (without extras) becomes the vendored pyproject.toml's dependencies.
  • It skips the same directories (templates, caches) as init's copy, and refuses archive paths outside the vendor directory.
  • The new tree is built next to the old one and swapped in, so a failed download or a bad wheel leaves the project unchanged.
  • The dependency stays the plain nitrostack that vendor.py requires.
  • --dry-run, --allow-downgrade and "already installed" behave as before.
• init next steps.
  • Removed "NitroStudio cannot folder-connect a Python project": Studio now opens Python projects.
  • The pizzaz open-shops hint now prints only for the pizzaz template.
• README: the upgrade section describes both cases.

Test

• New tests/test_cli_upgrade_vendored.py (8 tests), with no network access:
  • the uv source entry and vendor paths are left alone;
  • the vendored copy is replaced from a wheel (version, dependencies, templates skipped, project files untouched);
  • the copy path is used when the CLI is the target;
  • dry run, already-installed and downgrade guard;
  • a failed download or a bad zip leaves the old SDK and no temporary directories;
  • archive paths outside the vendor directory are refused;
  • a sha256 mismatch is rejected.
• Mutation checks: removing the lookbehind, the dependency scoping, the vendored branch or the sha256 check each makes the tests fail.
• Full suite: 828 passed. Ruff is clean on the changed files. main.py had 90 existing findings and now has 89; none are new.
• End to end against real PyPI, on a fresh init --template python-starter project:
  1. upgrade --version 0.4.0 --allow-downgrade downloaded and verified the wheel. After install, the venv runs 0.4.0 and calculate works.
  2. upgrade (latest, 0.4.1) copied the running SDK. After install, the venv runs 0.4.1 and calculate works.
  3. pyproject.toml and requirements.txt stayed valid and unchanged throughout.

🤖 Generated with Claude Code