Merge pull request #122 from chigwell/121-fix-bug-generate-a-session-string-refusing-to-start

fix: enhance installation guard to support editable source checkouts

Author: chigwell

telegram_mcp/install_guard.py

@@ -31,6 +31,7 @@ class DistributionIdentity:
     urls: tuple[str, ...] = ()
     summary: str = ""
     direct_url: str = ""
+    source_root: Path | None = None
 
     @classmethod
     def from_distribution(cls, dist: metadata.Distribution) -> "DistributionIdentity":
@@ -67,7 +68,8 @@ def from_distribution(cls, dist: metadata.Distribution) -> "DistributionIdentity
             maintainers=maintainers,
             urls=urls,
             summary=package_metadata.get("Summary", ""),
-            direct_url=direct_url,
+            direct_url=direct_url or "",
+            source_root=_distribution_source_root(dist),
         )
 
 
@@ -84,6 +86,52 @@ def _project_root_declares_distribution_name(path: Path) -> bool:
     return f'name = "{DISTRIBUTION_NAME}"' in pyproject_text
 
 
+def _resolve_path(path: Path) -> Path:
+    try:
+        return path.resolve()
+    except OSError:
+        return path
+
+
+def _candidate_is_project_root(path: Path) -> bool:
+    return _project_root_declares_distribution_name(_resolve_path(path))
+
+
+def _distribution_source_root(dist: metadata.Distribution) -> Path | None:
+    """Return an editable/source-checkout root for installer metadata.
+
+    ``uv sync`` installs the project editably. In that mode ``importlib.metadata``
+    can resolve the active distribution to ``telegram_mcp.egg-info`` in the
+    checkout, while the PEP 610 ``direct_url.json`` file lives in the
+    environment's ``.dist-info`` directory. Treating the adjacent project root as
+    source provenance keeps the PyPI-collision guard strict for normal installs
+    without blocking cloned checkouts.
+    """
+
+    dist_path = getattr(dist, "_path", None)
+    if dist_path is not None:
+        metadata_path = Path(dist_path)
+        if metadata_path.name.endswith(".egg-info"):
+            candidate = metadata_path.parent
+            if _candidate_is_project_root(candidate):
+                return _resolve_path(candidate)
+
+    files = getattr(dist, "files", None)
+    locate_file = getattr(dist, "locate_file", None)
+    if not files or not callable(locate_file):
+        return None
+
+    for package_file in files:
+        if Path(str(package_file)) != Path("pyproject.toml"):
+            continue
+
+        candidate = Path(locate_file(package_file)).parent
+        if _candidate_is_project_root(candidate):
+            return _resolve_path(candidate)
+
+    return None
+
+
 def _direct_url_json(direct_url: str) -> dict:
     if not direct_url:
         return {}
@@ -116,7 +164,10 @@ def _direct_url_is_explicit_source_install(direct_url: str) -> bool:
 
 
 def _looks_like_explicit_source_install(identity: DistributionIdentity) -> bool:
-    return _direct_url_is_explicit_source_install(identity.direct_url)
+    return (
+        _direct_url_is_explicit_source_install(identity.direct_url)
+        or identity.source_root is not None
+    )
 
 
 def _format_unsafe_installation_message(identity: DistributionIdentity) -> str:

tests/test_install_guard.py

@@ -101,6 +101,39 @@ def raise_missing(_distribution_name):
     install_guard.assert_safe_distribution()
 
 
+def test_install_guard_allows_uv_editable_source_checkout_without_direct_url(
+    monkeypatch, tmp_path
+):
+    (tmp_path / "pyproject.toml").write_text(
+        '[project]\nname = "telegram-mcp"\n',
+        encoding="utf-8",
+    )
+    (tmp_path / "telegram_mcp.egg-info").mkdir()
+
+    class FakeDistribution:
+        version = "source-version"
+
+        def __init__(self):
+            self._path = tmp_path / "telegram_mcp.egg-info"
+            self.files = []
+            self.metadata = Message()
+            self.metadata["Name"] = "telegram-mcp"
+            self.metadata["Version"] = "source-version"
+            self.metadata["Author"] = "chigwell, l1v0n1"
+            self.metadata["Project-URL"] = "Homepage, https://github.com/chigwell/telegram-mcp"
+
+        def read_text(self, _filename):
+            return None
+
+    monkeypatch.setattr(
+        install_guard.metadata,
+        "distribution",
+        lambda _distribution_name: FakeDistribution(),
+    )
+
+    install_guard.assert_safe_distribution()
+
+
 def test_install_guard_raises_for_untrusted_installed_distribution(monkeypatch):
     class FakeDistribution:
         version = "0.6.3"