wheels-packages Phase 3 — CLI commands (install/list/update/remove) #2270

Activity

1. bpamiri

   added

   enhancement

   on Apr 23, 2026
2. bpamiri

   added a commit that references this issue on Apr 24, 2026

   feat(cli): wheels packages CLI — registry-backed install (#2270 Phase…

   ...

   110f95d
3. bpamiri commented on Apr 24, 2026

   

   bpamiri

   on Apr 24, 2026

   CollaboratorAuthor

   More actions

   Closing — scope is complete and merged.

   Scope verification

   Scope item	Delivered in
   wheels packages list	#2276 · PackagesMainCli.list()
   wheels packages search <query>	#2276 · PackagesMainCli.search()
   wheels packages show <name>	#2276 · PackagesMainCli.show()
   wheels packages install <name>	#2276 · PackagesMainCli.install()
   wheels packages install <name>@<version>	#2276 · $parseTarget() + VersionResolver.pick(pin)
   wheels packages update <name> (explicit --yes)	#2276 · throws Wheels.Packages.ConfirmationRequired without --yes
   wheels packages update --all (explicit --yes)	#2276 · $updateAll()
   wheels packages remove <name>	#2276 · Installer.uninstall() (refuses dirs without package.json)
   wheels packages registry refresh	#2276 · PackagesRegistryCli.refresh()
   wheels packages registry info	#2276 · PackagesRegistryCli.info()
   Reuse SemVer matcher from PackageLoader (#2231)	#2276 · VersionResolver delegates to wheels.SemVer
   Explicit-only update policy — no auto-pull on reload	#2276 · update verbs require --yes; PackageLoader never calls the installer

   Acceptance criterion

   A user on Wheels 4.1 can run wheels packages install wheels-sentry and have it appear under vendor/ after reload, with the tarball sha256 verified against the registry's manifest.

   Met by #2276 (sha256 hard-abort on mismatch — no --skip-checksum flag) and stabilised by #2287 ($extract gates on tar exit code, not stderr, so GNU tar's informational warnings on macOS-authored tarballs no longer fail extraction).

   Follow-ups (separate issues, not blocking closure)

   • Phase 3.5 aggregated registry index.json — registry-side, avoids N+1 HTTP on list.
   • Phase 4 web UI — wheels-dev/wheels#2271 (shipped via feat(web): packages.wheels.dev static site (#2271) #2278).
   • Retire per-file checksums in PackageLoader.cfc now that distribution-layer sha256 is authoritative.
   • Defensive edge case for empty-name targets — fix(cli): reject empty-name target in wheels packages install #2290 (this was caught while doing the closure review).
4. bpamiri

   closed this as completedon Apr 24, 2026