[{"data":1,"prerenderedAt":2229},["ShallowReactive",2],{"page-\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Favoiding-shell-injection-in-python-clis\u002F":3,"content-directory":1682},{"id":4,"title":5,"body":6,"date":1668,"description":1669,"difficulty":1670,"draft":1671,"extension":1672,"meta":1673,"navigation":128,"path":1674,"seo":1675,"stem":1676,"tags":1677,"updated":1668,"__hash__":1681},"content\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Favoiding-shell-injection-in-python-clis\u002Findex.md","Avoiding Shell Injection in Python CLIs",{"type":7,"value":8,"toc":1641},"minimark",[9,36,41,58,62,73,77,80,301,324,329,332,376,379,383,387,405,498,504,622,629,669,672,685,765,786,792,798,883,901,904,907,981,985,993,1108,1111,1115,1118,1158,1162,1165,1493,1515,1519,1528,1532,1539,1546,1554,1564,1568,1574,1584,1602,1606,1637],[10,11,12,13,17,18,21,22,25,26,29,30,35],"p",{},"Internal tools are where shell injection hides. Nobody expects an attacker to run ",[14,15,16],"code",{},"mytool archive",", so a command like ",[14,19,20],{},"subprocess.run(f\"tar czf {out} {src}\", shell=True)"," ships without a second thought. Then someone points the tool at a directory created by a CI job, a file uploaded by a customer, a branch name from a pull request, or a value from a shared config file — and a string you treated as data is parsed as code. This guide explains exactly how that happens, then shows the layered fixes: argument lists so no shell is involved, ",[14,23,24],{},"--"," so the called program cannot mistake data for options, ",[14,27,28],{},"shlex.quote"," for the rare case a shell is genuinely needed, and validation at the edge. It belongs to the ",[31,32,34],"a",{"href":33},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002F","subprocess topic",".",[37,38,40],"h2",{"id":39},"prerequisites","Prerequisites",[42,43,44,48,55],"ul",{},[45,46,47],"li",{},"Python 3.10+ on Linux or macOS for the demonstrations (Windows notes are included).",[45,49,50,51,35],{},"A CLI that runs external programs, ideally through a helper like the one in ",[31,52,54],{"href":53},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Fcalling-external-commands-safely-with-subprocess\u002F","calling external commands safely with subprocess",[45,56,57],{},"An understanding that \"the user\" of a CLI includes every source of its input: arguments, files, environment, config and other programs' output.",[37,59,61],{"id":60},"how-data-becomes-a-command","How data becomes a command",[10,63,64,65,68,69,72],{},"With ",[14,66,67],{},"shell=True",", Python runs ",[14,70,71],{},"\u002Fbin\u002Fsh -c \u003Cstring>",". Everything in that string is shell syntax. If any part of it came from outside your code, the author of that part is writing shell script alongside you.",[74,75],"inline-diagram",{"name":76},"sp-injection-flow",[10,78,79],{},"A concrete demonstration, safe to run in an empty directory:",[81,82,87],"pre",{"className":83,"code":84,"language":85,"meta":86,"style":86},"language-python shiki shiki-themes github-light github-dark","# injection_demo.py — run in an empty scratch directory\nimport subprocess\nfrom pathlib import Path\n\nPath(\"notes.txt\").write_text(\"hello\\n\")\nname = \"notes.txt; echo INJECTED > pwned.txt\"\n\n# Vulnerable: the semicolon ends the wc command and starts another.\nsubprocess.run(f\"wc -l {name}\", shell=True)\nprint(\"pwned.txt exists:\", Path(\"pwned.txt\").exists())   # True\n\nPath(\"pwned.txt\").unlink()\n\n# Safe: one argument, no shell. wc just fails to find a strangely named file.\nsubprocess.run([\"wc\", \"-l\", name])\nprint(\"pwned.txt exists:\", Path(\"pwned.txt\").exists())   # False\n","python","",[14,88,89,98,109,123,130,156,168,173,179,216,240,245,255,260,266,283],{"__ignoreMap":86},[90,91,94],"span",{"class":92,"line":93},"line",1,[90,95,97],{"class":96},"sJ8bj","# injection_demo.py — run in an empty scratch directory\n",[90,99,101,105],{"class":92,"line":100},2,[90,102,104],{"class":103},"szBVR","import",[90,106,108],{"class":107},"sVt8B"," subprocess\n",[90,110,112,115,118,120],{"class":92,"line":111},3,[90,113,114],{"class":103},"from",[90,116,117],{"class":107}," pathlib ",[90,119,104],{"class":103},[90,121,122],{"class":107}," Path\n",[90,124,126],{"class":92,"line":125},4,[90,127,129],{"emptyLinePlaceholder":128},true,"\n",[90,131,133,136,140,143,146,150,153],{"class":92,"line":132},5,[90,134,135],{"class":107},"Path(",[90,137,139],{"class":138},"sZZnC","\"notes.txt\"",[90,141,142],{"class":107},").write_text(",[90,144,145],{"class":138},"\"hello",[90,147,149],{"class":148},"sj4cs","\\n",[90,151,152],{"class":138},"\"",[90,154,155],{"class":107},")\n",[90,157,159,162,165],{"class":92,"line":158},6,[90,160,161],{"class":107},"name ",[90,163,164],{"class":103},"=",[90,166,167],{"class":138}," \"notes.txt; echo INJECTED > pwned.txt\"\n",[90,169,171],{"class":92,"line":170},7,[90,172,129],{"emptyLinePlaceholder":128},[90,174,176],{"class":92,"line":175},8,[90,177,178],{"class":96},"# Vulnerable: the semicolon ends the wc command and starts another.\n",[90,180,182,185,188,191,194,197,200,202,205,209,211,214],{"class":92,"line":181},9,[90,183,184],{"class":107},"subprocess.run(",[90,186,187],{"class":103},"f",[90,189,190],{"class":138},"\"wc -l ",[90,192,193],{"class":148},"{",[90,195,196],{"class":107},"name",[90,198,199],{"class":148},"}",[90,201,152],{"class":138},[90,203,204],{"class":107},", ",[90,206,208],{"class":207},"s4XuR","shell",[90,210,164],{"class":103},[90,212,213],{"class":148},"True",[90,215,155],{"class":107},[90,217,219,222,225,228,231,234,237],{"class":92,"line":218},10,[90,220,221],{"class":148},"print",[90,223,224],{"class":107},"(",[90,226,227],{"class":138},"\"pwned.txt exists:\"",[90,229,230],{"class":107},", Path(",[90,232,233],{"class":138},"\"pwned.txt\"",[90,235,236],{"class":107},").exists())   ",[90,238,239],{"class":96},"# True\n",[90,241,243],{"class":92,"line":242},11,[90,244,129],{"emptyLinePlaceholder":128},[90,246,248,250,252],{"class":92,"line":247},12,[90,249,135],{"class":107},[90,251,233],{"class":138},[90,253,254],{"class":107},").unlink()\n",[90,256,258],{"class":92,"line":257},13,[90,259,129],{"emptyLinePlaceholder":128},[90,261,263],{"class":92,"line":262},14,[90,264,265],{"class":96},"# Safe: one argument, no shell. wc just fails to find a strangely named file.\n",[90,267,269,272,275,277,280],{"class":92,"line":268},15,[90,270,271],{"class":107},"subprocess.run([",[90,273,274],{"class":138},"\"wc\"",[90,276,204],{"class":107},[90,278,279],{"class":138},"\"-l\"",[90,281,282],{"class":107},", name])\n",[90,284,286,288,290,292,294,296,298],{"class":92,"line":285},16,[90,287,221],{"class":148},[90,289,224],{"class":107},[90,291,227],{"class":138},[90,293,230],{"class":107},[90,295,233],{"class":138},[90,297,236],{"class":107},[90,299,300],{"class":96},"# False\n",[10,302,303,304,307,308,311,312,315,316,319,320,323],{},"The payload does not need a semicolon. ",[14,305,306],{},"$(...)"," and backticks run commands inside an argument, ",[14,309,310],{},"|"," pipes into another program, ",[14,313,314],{},">"," overwrites files, ",[14,317,318],{},"&"," backgrounds a process, a newline starts a new command, and ",[14,321,322],{},"*"," expands to filenames. Filenames can legally contain every one of those characters on Linux.",[325,326,328],"h3",{"id":327},"where-untrusted-input-hides-in-internal-tools","Where untrusted input hides in internal tools",[10,330,331],{},"\"But only our own engineers run this\" is the usual defence, and it misses where the data comes from rather than who types the command. A few places that routinely feed hostile or merely unexpected strings into internal CLIs:",[42,333,334,348,354,360,370],{},[45,335,336,340,341,204,344,347],{},[337,338,339],"strong",{},"Branch and tag names."," Anyone who can open a pull request chooses them, and CI jobs pass them to release scripts. Git allows ",[14,342,343],{},"$",[14,345,346],{},";",", backticks and parentheses in ref names.",[45,349,350,353],{},[337,351,352],{},"Filenames from elsewhere."," Uploaded files, extracted archives, synced buckets and generated artefacts all carry names you did not pick.",[45,355,356,359],{},[337,357,358],{},"Output of another program."," A tool that reads a list of hostnames or container IDs from an API and passes them on is only as safe as that API's data.",[45,361,362,365,366,369],{},[337,363,364],{},"Config in a repository."," A ",[14,367,368],{},".mytool.toml"," is edited by every contributor with commit rights.",[45,371,372,375],{},[337,373,374],{},"Environment variables in CI."," Pipeline variables are often settable by people who cannot change the pipeline itself.",[10,377,378],{},"In each case the person running the tool is trustworthy and the input is not. Security for a CLI is about the second, not the first.",[37,380,382],{"id":381},"the-recipe-four-layers","The recipe: four layers",[325,384,386],{"id":385},"_1-argument-lists-always","1. Argument lists, always",[10,388,389,390,392,393,396,397,400,401,404],{},"Pass a list and leave ",[14,391,208],{}," at its default of ",[14,394,395],{},"False",". Python then calls ",[14,398,399],{},"execve()"," directly and each list element becomes exactly one element of the child's ",[14,402,403],{},"argv",". There is no parser to confuse, so there is nothing to escape.",[81,406,408],{"className":83,"code":407,"language":85,"meta":86,"style":86},"import subprocess\nfrom pathlib import Path\n\n\ndef archive(src: Path, out: Path) -> None:\n    subprocess.run([\"tar\", \"-czf\", str(out), \"-C\", str(src.parent), \"--\", src.name], check=True)\n",[14,409,410,416,426,430,434,452],{"__ignoreMap":86},[90,411,412,414],{"class":92,"line":93},[90,413,104],{"class":103},[90,415,108],{"class":107},[90,417,418,420,422,424],{"class":92,"line":100},[90,419,114],{"class":103},[90,421,117],{"class":107},[90,423,104],{"class":103},[90,425,122],{"class":107},[90,427,428],{"class":92,"line":111},[90,429,129],{"emptyLinePlaceholder":128},[90,431,432],{"class":92,"line":125},[90,433,129],{"emptyLinePlaceholder":128},[90,435,436,439,443,446,449],{"class":92,"line":132},[90,437,438],{"class":103},"def",[90,440,442],{"class":441},"sScJk"," archive",[90,444,445],{"class":107},"(src: Path, out: Path) -> ",[90,447,448],{"class":148},"None",[90,450,451],{"class":107},":\n",[90,453,454,457,460,462,465,467,470,473,476,478,480,483,486,489,492,494,496],{"class":92,"line":158},[90,455,456],{"class":107},"    subprocess.run([",[90,458,459],{"class":138},"\"tar\"",[90,461,204],{"class":107},[90,463,464],{"class":138},"\"-czf\"",[90,466,204],{"class":107},[90,468,469],{"class":148},"str",[90,471,472],{"class":107},"(out), ",[90,474,475],{"class":138},"\"-C\"",[90,477,204],{"class":107},[90,479,469],{"class":148},[90,481,482],{"class":107},"(src.parent), ",[90,484,485],{"class":138},"\"--\"",[90,487,488],{"class":107},", src.name], ",[90,490,491],{"class":207},"check",[90,493,164],{"class":103},[90,495,213],{"class":148},[90,497,155],{"class":107},[10,499,500,501,503],{},"Most code that uses ",[14,502,67],{}," does so for a feature that has a direct Python equivalent:",[505,506,507,520],"table",{},[508,509,510],"thead",{},[511,512,513,517],"tr",{},[514,515,516],"th",{},"Shell feature",[514,518,519],{},"Instead, in Python",[521,522,523,545,557,569,581,597,609],"tbody",{},[511,524,525,531],{},[526,527,528],"td",{},[14,529,530],{},"cmd1 | cmd2",[526,532,533,534,537,538,541,542],{},"two ",[14,535,536],{},"Popen"," objects, ",[14,539,540],{},"stdout=PIPE"," into ",[14,543,544],{},"stdin=",[511,546,547,552],{},[526,548,549],{},[14,550,551],{},"> out.txt",[526,553,554],{},[14,555,556],{},"stdout=open(\"out.txt\", \"w\")",[511,558,559,564],{},[526,560,561],{},[14,562,563],{},"*.log",[526,565,566],{},[14,567,568],{},"sorted(Path(\".\").glob(\"*.log\"))",[511,570,571,576],{},[526,572,573],{},[14,574,575],{},"~\u002Fx",[526,577,578],{},[14,579,580],{},"Path.home() \u002F \"x\"",[511,582,583,588],{},[526,584,585],{},[14,586,587],{},"$VAR",[526,589,590,593,594],{},[14,591,592],{},"os.environ[\"VAR\"]"," or ",[14,595,596],{},"env=",[511,598,599,604],{},[526,600,601],{},[14,602,603],{},"cd dir && cmd",[526,605,606],{},[14,607,608],{},"cwd=\"dir\"",[511,610,611,616],{},[526,612,613],{},[14,614,615],{},"cmd1 && cmd2",[526,617,533,618,621],{},[14,619,620],{},"run(..., check=True)"," calls",[325,623,625,626,628],{"id":624},"_2-before-untrusted-positional-data","2. ",[14,627,24],{}," before untrusted positional data",[10,630,631,632,634,635,638,639,642,643,646,647,204,650,646,653,204,656,646,659,662,663,646,666,35],{},"An argument list stops the ",[337,633,208],{}," from interpreting your data. It does not stop the ",[337,636,637],{},"program"," from interpreting it. If a value starts with ",[14,640,641],{},"-",", most programs treat it as an option. That is \"argument injection\", and it is real: ",[14,644,645],{},"git"," accepts ",[14,648,649],{},"--upload-pack=\u003Ccommand>",[14,651,652],{},"tar",[14,654,655],{},"--checkpoint-action=exec=\u003Ccommand>",[14,657,658],{},"find",[14,660,661],{},"-exec",", and ",[14,664,665],{},"rsync",[14,667,668],{},"-e",[74,670],{"name":671},"sp-option-injection",[10,673,674,675,677,678,680,681,684],{},"By POSIX convention, ",[14,676,24],{}," means \"end of options; everything after this is a positional argument\". Put it before any data you did not write. For programs that do not support ",[14,679,24],{},", make relative paths unambiguous by prefixing ",[14,682,683],{},".\u002F",", which also works for filenames beginning with a dash:",[81,686,688],{"className":83,"code":687,"language":85,"meta":86,"style":86},"def safe_path_arg(p: Path) -> str:\n    s = str(p)\n    return s if p.is_absolute() or not s.startswith(\"-\") else f\".\u002F{s}\"\n",[14,689,690,704,717],{"__ignoreMap":86},[90,691,692,694,697,700,702],{"class":92,"line":93},[90,693,438],{"class":103},[90,695,696],{"class":441}," safe_path_arg",[90,698,699],{"class":107},"(p: Path) -> ",[90,701,469],{"class":148},[90,703,451],{"class":107},[90,705,706,709,711,714],{"class":92,"line":100},[90,707,708],{"class":107},"    s ",[90,710,164],{"class":103},[90,712,713],{"class":148}," str",[90,715,716],{"class":107},"(p)\n",[90,718,719,722,725,728,731,734,737,740,743,746,749,752,755,757,760,762],{"class":92,"line":111},[90,720,721],{"class":103},"    return",[90,723,724],{"class":107}," s ",[90,726,727],{"class":103},"if",[90,729,730],{"class":107}," p.is_absolute() ",[90,732,733],{"class":103},"or",[90,735,736],{"class":103}," not",[90,738,739],{"class":107}," s.startswith(",[90,741,742],{"class":138},"\"-\"",[90,744,745],{"class":107},") ",[90,747,748],{"class":103},"else",[90,750,751],{"class":103}," f",[90,753,754],{"class":138},"\".\u002F",[90,756,193],{"class":148},[90,758,759],{"class":107},"s",[90,761,199],{"class":148},[90,763,764],{"class":138},"\"\n",[10,766,767,768,771,772,774,775,777,778,781,782,785],{},"Git is a special case worth knowing: a revision argument (",[14,769,770],{},"git log \u003Crev>",") cannot be protected with ",[14,773,24],{},", because ",[14,776,24],{}," there separates revisions from paths. Validate revisions instead — ",[14,779,780],{},"git check-ref-format --branch"," for branch names, or ",[14,783,784],{},"git rev-parse --verify --end-of-options \u003Crev>"," on git 2.24+.",[325,787,789,790],{"id":788},"_3-when-you-truly-need-a-shell-shlexquote","3. When you truly need a shell: ",[14,791,28],{},[10,793,794,795,797],{},"Occasionally a shell is the point: you are generating a command for the user to copy, running a user-configured hook, or executing over SSH where the remote side always uses a shell. Then quote every interpolated value with ",[14,796,28],{},", which wraps it in single quotes and escapes embedded single quotes so a POSIX shell sees exactly one word:",[81,799,801],{"className":83,"code":800,"language":85,"meta":86,"style":86},"import shlex\n\nhost = \"build-01\"\npath = \"\u002Fsrv\u002Fdata\u002Fit's here; rm -rf \u002F\"\nremote = f\"du -sh -- {shlex.quote(path)}\"\nsubprocess.run([\"ssh\", host, remote], check=True)\nprint(remote)   # du -sh -- '\u002Fsrv\u002Fdata\u002Fit'\"'\"'s here; rm -rf \u002F'\n",[14,802,803,810,814,824,834,855,873],{"__ignoreMap":86},[90,804,805,807],{"class":92,"line":93},[90,806,104],{"class":103},[90,808,809],{"class":107}," shlex\n",[90,811,812],{"class":92,"line":100},[90,813,129],{"emptyLinePlaceholder":128},[90,815,816,819,821],{"class":92,"line":111},[90,817,818],{"class":107},"host ",[90,820,164],{"class":103},[90,822,823],{"class":138}," \"build-01\"\n",[90,825,826,829,831],{"class":92,"line":125},[90,827,828],{"class":107},"path ",[90,830,164],{"class":103},[90,832,833],{"class":138}," \"\u002Fsrv\u002Fdata\u002Fit's here; rm -rf \u002F\"\n",[90,835,836,839,841,843,846,848,851,853],{"class":92,"line":132},[90,837,838],{"class":107},"remote ",[90,840,164],{"class":103},[90,842,751],{"class":103},[90,844,845],{"class":138},"\"du -sh -- ",[90,847,193],{"class":148},[90,849,850],{"class":107},"shlex.quote(path)",[90,852,199],{"class":148},[90,854,764],{"class":138},[90,856,857,859,862,865,867,869,871],{"class":92,"line":158},[90,858,271],{"class":107},[90,860,861],{"class":138},"\"ssh\"",[90,863,864],{"class":107},", host, remote], ",[90,866,491],{"class":207},[90,868,164],{"class":103},[90,870,213],{"class":148},[90,872,155],{"class":107},[90,874,875,877,880],{"class":92,"line":170},[90,876,221],{"class":148},[90,878,879],{"class":107},"(remote)   ",[90,881,882],{"class":96},"# du -sh -- '\u002Fsrv\u002Fdata\u002Fit'\"'\"'s here; rm -rf \u002F'\n",[10,884,885,886,888,889,892,893,896,897,900],{},"Two caveats. ",[14,887,28],{}," targets POSIX shells; ",[14,890,891],{},"cmd.exe"," and PowerShell have entirely different rules and the standard library has no quoter for them — on Windows, avoid the shell. And quoting only helps if you quote ",[337,894,895],{},"every"," value; one forgotten interpolation undoes it. ",[14,898,899],{},"shlex.join(argv)"," quotes a whole list at once, which is the right way to print a command for the user.",[74,902],{"name":903},"sp-quoting-matrix",[10,905,906],{},"A cleaner alternative for fixed scripts is to pass values through the environment. The script text is a constant you wrote; the data never touches the command string:",[81,908,910],{"className":83,"code":909,"language":85,"meta":86,"style":86},"subprocess.run(\n    [\"sh\", \"-c\", 'cp -- \"$SRC\" \"$DEST\" && echo copied'],\n    env={**os.environ, \"SRC\": user_src, \"DEST\": user_dest},\n    check=True,\n)\n",[14,911,912,917,938,965,977],{"__ignoreMap":86},[90,913,914],{"class":92,"line":93},[90,915,916],{"class":107},"subprocess.run(\n",[90,918,919,922,925,927,930,932,935],{"class":92,"line":100},[90,920,921],{"class":107},"    [",[90,923,924],{"class":138},"\"sh\"",[90,926,204],{"class":107},[90,928,929],{"class":138},"\"-c\"",[90,931,204],{"class":107},[90,933,934],{"class":138},"'cp -- \"$SRC\" \"$DEST\" && echo copied'",[90,936,937],{"class":107},"],\n",[90,939,940,943,945,947,950,953,956,959,962],{"class":92,"line":111},[90,941,942],{"class":207},"    env",[90,944,164],{"class":103},[90,946,193],{"class":107},[90,948,949],{"class":103},"**",[90,951,952],{"class":107},"os.environ, ",[90,954,955],{"class":138},"\"SRC\"",[90,957,958],{"class":107},": user_src, ",[90,960,961],{"class":138},"\"DEST\"",[90,963,964],{"class":107},": user_dest},\n",[90,966,967,970,972,974],{"class":92,"line":125},[90,968,969],{"class":207},"    check",[90,971,164],{"class":103},[90,973,213],{"class":148},[90,975,976],{"class":107},",\n",[90,978,979],{"class":92,"line":132},[90,980,155],{"class":107},[325,982,984],{"id":983},"_4-validate-at-the-edge","4. Validate at the edge",[10,986,987,988,992],{},"Finally, reject values that can never be legitimate before they reach a subprocess at all. If a parameter is a branch name, an environment name or a container tag, it has a known shape — enforce it where you parse arguments, as covered in ",[31,989,991],{"href":990},"\u002Fadvanced-input-parsing-user-experience\u002Fadvanced-argument-validation-strategies\u002F","advanced argument validation strategies",":",[81,994,996],{"className":83,"code":995,"language":85,"meta":86,"style":86},"import re\n\nimport typer\n\nENV_NAME = re.compile(r\"^[a-z][a-z0-9-]{0,30}$\")\n\n\ndef env_name(value: str) -> str:\n    if not ENV_NAME.fullmatch(value):\n        raise typer.BadParameter(\"use lowercase letters, digits and dashes\")\n    return value\n",[14,997,998,1005,1009,1016,1020,1048,1052,1056,1075,1088,1101],{"__ignoreMap":86},[90,999,1000,1002],{"class":92,"line":93},[90,1001,104],{"class":103},[90,1003,1004],{"class":107}," re\n",[90,1006,1007],{"class":92,"line":100},[90,1008,129],{"emptyLinePlaceholder":128},[90,1010,1011,1013],{"class":92,"line":111},[90,1012,104],{"class":103},[90,1014,1015],{"class":107}," typer\n",[90,1017,1018],{"class":92,"line":125},[90,1019,129],{"emptyLinePlaceholder":128},[90,1021,1022,1025,1028,1031,1034,1036,1039,1042,1044,1046],{"class":92,"line":132},[90,1023,1024],{"class":148},"ENV_NAME",[90,1026,1027],{"class":103}," =",[90,1029,1030],{"class":107}," re.compile(",[90,1032,1033],{"class":103},"r",[90,1035,152],{"class":138},[90,1037,1038],{"class":148},"^[a-z][a-z0-9-]",[90,1040,1041],{"class":103},"{0,30}",[90,1043,343],{"class":148},[90,1045,152],{"class":138},[90,1047,155],{"class":107},[90,1049,1050],{"class":92,"line":158},[90,1051,129],{"emptyLinePlaceholder":128},[90,1053,1054],{"class":92,"line":170},[90,1055,129],{"emptyLinePlaceholder":128},[90,1057,1058,1060,1063,1066,1068,1071,1073],{"class":92,"line":175},[90,1059,438],{"class":103},[90,1061,1062],{"class":441}," env_name",[90,1064,1065],{"class":107},"(value: ",[90,1067,469],{"class":148},[90,1069,1070],{"class":107},") -> ",[90,1072,469],{"class":148},[90,1074,451],{"class":107},[90,1076,1077,1080,1082,1085],{"class":92,"line":181},[90,1078,1079],{"class":103},"    if",[90,1081,736],{"class":103},[90,1083,1084],{"class":148}," ENV_NAME",[90,1086,1087],{"class":107},".fullmatch(value):\n",[90,1089,1090,1093,1096,1099],{"class":92,"line":218},[90,1091,1092],{"class":103},"        raise",[90,1094,1095],{"class":107}," typer.BadParameter(",[90,1097,1098],{"class":138},"\"use lowercase letters, digits and dashes\"",[90,1100,155],{"class":107},[90,1102,1103,1105],{"class":92,"line":242},[90,1104,721],{"class":103},[90,1106,1107],{"class":107}," value\n",[10,1109,1110],{},"Validation is defence in depth, not the primary control. Allow-lists are strong; deny-lists of \"dangerous characters\" always miss something.",[37,1112,1114],{"id":1113},"ux-considerations","UX considerations",[10,1116,1117],{},"Security fixes should not make the tool worse to use, and done well they make it better:",[42,1119,1120,1126,1142,1148],{},[45,1121,1122,1125],{},[337,1123,1124],{},"Filenames with spaces just work."," Argument lists fix the most common user-facing bug of shell strings — paths with spaces or quotes — at the same time as the security hole.",[45,1127,1128,1131,1132,593,1135,1138,1139,1141],{},[337,1129,1130],{},"Show commands in copy-pasteable form."," When you log what you are about to run (for ",[14,1133,1134],{},"--verbose",[14,1136,1137],{},"--dry-run","), print ",[14,1140,899],{}," so the user can paste it into a shell and get the same behaviour.",[45,1143,1144,1147],{},[337,1145,1146],{},"Explain rejected input."," \"invalid environment name 'prod;ls': use lowercase letters, digits and dashes\" teaches the rule; \"invalid input\" does not.",[45,1149,1150,1153,1154,1157],{},[337,1151,1152],{},"Keep hooks explicit."," If your tool runs user-configured shell commands (a ",[14,1155,1156],{},"post_build"," hook), document that the value is executed by a shell and is trusted configuration — and never interpolate other data into it.",[37,1159,1161],{"id":1160},"testing-the-behaviour","Testing the behaviour",[10,1163,1164],{},"Injection tests are cheap and worth having as a permanent regression suite. Feed hostile values through the real code path and assert that nothing outside the intended operation happened:",[81,1166,1168],{"className":83,"code":1167,"language":85,"meta":86,"style":86},"# tests\u002Ftest_injection.py\nimport subprocess\nimport sys\nfrom pathlib import Path\n\nimport pytest\n\nHOSTILE = [\n    \"a; touch PWNED\",\n    \"$(touch PWNED)\",\n    \"`touch PWNED`\",\n    \"a | touch PWNED\",\n    \"a\\ntouch PWNED\",\n    \"--output=PWNED\",\n]\n\n\ndef count_lines(path: str, cwd: Path) -> subprocess.CompletedProcess[str]:\n    code = \"import sys; print(len(open(sys.argv[1]).readlines()))\"\n    return subprocess.run([sys.executable, \"-c\", code, path], cwd=cwd,\n                          capture_output=True, text=True)\n\n\n@pytest.mark.parametrize(\"value\", HOSTILE)\ndef test_hostile_names_are_just_names(tmp_path, value):\n    count_lines(value, tmp_path)\n    assert not (tmp_path \u002F \"PWNED\").exists()\n\n\ndef test_real_file_with_awkward_name(tmp_path):\n    p = tmp_path \u002F \"it's a file; really.txt\"\n    p.write_text(\"1\\n2\\n\")\n    assert count_lines(p.name, tmp_path).stdout.strip() == \"2\"\n",[14,1169,1170,1175,1181,1188,1198,1202,1209,1213,1223,1230,1237,1244,1251,1263,1270,1275,1279,1284,1305,1316,1337,1358,1363,1368,1385,1396,1402,1422,1427,1432,1443,1459,1479],{"__ignoreMap":86},[90,1171,1172],{"class":92,"line":93},[90,1173,1174],{"class":96},"# tests\u002Ftest_injection.py\n",[90,1176,1177,1179],{"class":92,"line":100},[90,1178,104],{"class":103},[90,1180,108],{"class":107},[90,1182,1183,1185],{"class":92,"line":111},[90,1184,104],{"class":103},[90,1186,1187],{"class":107}," sys\n",[90,1189,1190,1192,1194,1196],{"class":92,"line":125},[90,1191,114],{"class":103},[90,1193,117],{"class":107},[90,1195,104],{"class":103},[90,1197,122],{"class":107},[90,1199,1200],{"class":92,"line":132},[90,1201,129],{"emptyLinePlaceholder":128},[90,1203,1204,1206],{"class":92,"line":158},[90,1205,104],{"class":103},[90,1207,1208],{"class":107}," pytest\n",[90,1210,1211],{"class":92,"line":170},[90,1212,129],{"emptyLinePlaceholder":128},[90,1214,1215,1218,1220],{"class":92,"line":175},[90,1216,1217],{"class":148},"HOSTILE",[90,1219,1027],{"class":103},[90,1221,1222],{"class":107}," [\n",[90,1224,1225,1228],{"class":92,"line":181},[90,1226,1227],{"class":138},"    \"a; touch PWNED\"",[90,1229,976],{"class":107},[90,1231,1232,1235],{"class":92,"line":218},[90,1233,1234],{"class":138},"    \"$(touch PWNED)\"",[90,1236,976],{"class":107},[90,1238,1239,1242],{"class":92,"line":242},[90,1240,1241],{"class":138},"    \"`touch PWNED`\"",[90,1243,976],{"class":107},[90,1245,1246,1249],{"class":92,"line":247},[90,1247,1248],{"class":138},"    \"a | touch PWNED\"",[90,1250,976],{"class":107},[90,1252,1253,1256,1258,1261],{"class":92,"line":257},[90,1254,1255],{"class":138},"    \"a",[90,1257,149],{"class":148},[90,1259,1260],{"class":138},"touch PWNED\"",[90,1262,976],{"class":107},[90,1264,1265,1268],{"class":92,"line":262},[90,1266,1267],{"class":138},"    \"--output=PWNED\"",[90,1269,976],{"class":107},[90,1271,1272],{"class":92,"line":268},[90,1273,1274],{"class":107},"]\n",[90,1276,1277],{"class":92,"line":285},[90,1278,129],{"emptyLinePlaceholder":128},[90,1280,1282],{"class":92,"line":1281},17,[90,1283,129],{"emptyLinePlaceholder":128},[90,1285,1287,1289,1292,1295,1297,1300,1302],{"class":92,"line":1286},18,[90,1288,438],{"class":103},[90,1290,1291],{"class":441}," count_lines",[90,1293,1294],{"class":107},"(path: ",[90,1296,469],{"class":148},[90,1298,1299],{"class":107},", cwd: Path) -> subprocess.CompletedProcess[",[90,1301,469],{"class":148},[90,1303,1304],{"class":107},"]:\n",[90,1306,1308,1311,1313],{"class":92,"line":1307},19,[90,1309,1310],{"class":107},"    code ",[90,1312,164],{"class":103},[90,1314,1315],{"class":138}," \"import sys; print(len(open(sys.argv[1]).readlines()))\"\n",[90,1317,1319,1321,1324,1326,1329,1332,1334],{"class":92,"line":1318},20,[90,1320,721],{"class":103},[90,1322,1323],{"class":107}," subprocess.run([sys.executable, ",[90,1325,929],{"class":138},[90,1327,1328],{"class":107},", code, path], ",[90,1330,1331],{"class":207},"cwd",[90,1333,164],{"class":103},[90,1335,1336],{"class":107},"cwd,\n",[90,1338,1340,1343,1345,1347,1349,1352,1354,1356],{"class":92,"line":1339},21,[90,1341,1342],{"class":207},"                          capture_output",[90,1344,164],{"class":103},[90,1346,213],{"class":148},[90,1348,204],{"class":107},[90,1350,1351],{"class":207},"text",[90,1353,164],{"class":103},[90,1355,213],{"class":148},[90,1357,155],{"class":107},[90,1359,1361],{"class":92,"line":1360},22,[90,1362,129],{"emptyLinePlaceholder":128},[90,1364,1366],{"class":92,"line":1365},23,[90,1367,129],{"emptyLinePlaceholder":128},[90,1369,1371,1374,1376,1379,1381,1383],{"class":92,"line":1370},24,[90,1372,1373],{"class":441},"@pytest.mark.parametrize",[90,1375,224],{"class":107},[90,1377,1378],{"class":138},"\"value\"",[90,1380,204],{"class":107},[90,1382,1217],{"class":148},[90,1384,155],{"class":107},[90,1386,1388,1390,1393],{"class":92,"line":1387},25,[90,1389,438],{"class":103},[90,1391,1392],{"class":441}," test_hostile_names_are_just_names",[90,1394,1395],{"class":107},"(tmp_path, value):\n",[90,1397,1399],{"class":92,"line":1398},26,[90,1400,1401],{"class":107},"    count_lines(value, tmp_path)\n",[90,1403,1405,1408,1410,1413,1416,1419],{"class":92,"line":1404},27,[90,1406,1407],{"class":103},"    assert",[90,1409,736],{"class":103},[90,1411,1412],{"class":107}," (tmp_path ",[90,1414,1415],{"class":103},"\u002F",[90,1417,1418],{"class":138}," \"PWNED\"",[90,1420,1421],{"class":107},").exists()\n",[90,1423,1425],{"class":92,"line":1424},28,[90,1426,129],{"emptyLinePlaceholder":128},[90,1428,1430],{"class":92,"line":1429},29,[90,1431,129],{"emptyLinePlaceholder":128},[90,1433,1435,1437,1440],{"class":92,"line":1434},30,[90,1436,438],{"class":103},[90,1438,1439],{"class":441}," test_real_file_with_awkward_name",[90,1441,1442],{"class":107},"(tmp_path):\n",[90,1444,1446,1449,1451,1454,1456],{"class":92,"line":1445},31,[90,1447,1448],{"class":107},"    p ",[90,1450,164],{"class":103},[90,1452,1453],{"class":107}," tmp_path ",[90,1455,1415],{"class":103},[90,1457,1458],{"class":138}," \"it's a file; really.txt\"\n",[90,1460,1462,1465,1468,1470,1473,1475,1477],{"class":92,"line":1461},32,[90,1463,1464],{"class":107},"    p.write_text(",[90,1466,1467],{"class":138},"\"1",[90,1469,149],{"class":148},[90,1471,1472],{"class":138},"2",[90,1474,149],{"class":148},[90,1476,152],{"class":138},[90,1478,155],{"class":107},[90,1480,1482,1484,1487,1490],{"class":92,"line":1481},33,[90,1483,1407],{"class":103},[90,1485,1486],{"class":107}," count_lines(p.name, tmp_path).stdout.strip() ",[90,1488,1489],{"class":103},"==",[90,1491,1492],{"class":138}," \"2\"\n",[10,1494,1495,1496,1498,1499,1502,1503,1506,1507,1510,1511,35],{},"Add a lint rule so new ",[14,1497,67],{}," calls are caught in review: Ruff's ",[14,1500,1501],{},"S602","–",[14,1504,1505],{},"S605"," rules (from flake8-bandit) flag subprocess calls with a shell and ",[14,1508,1509],{},"os.system",". Enabling them is part of ",[31,1512,1514],{"href":1513},"\u002Fproject-setup-dependency-management\u002Flinting-and-type-checking-cli-code\u002Fconfiguring-ruff-for-a-cli-project\u002F","configuring Ruff for a CLI project",[37,1516,1518],{"id":1517},"conclusion","Conclusion",[10,1520,1521,1522,1524,1525,1527],{},"Shell injection in a CLI is almost always the same mistake: building a command string from data and handing it to a shell. Remove the shell with argument lists and the whole class disappears; add ",[14,1523,24],{}," before untrusted positionals to stop option injection; reserve ",[14,1526,28],{}," or environment variables for the rare cases a shell is required; and validate structured values where they enter your program. Put a lint rule and a hostile-input test suite behind it so the fix stays fixed.",[37,1529,1531],{"id":1530},"frequently-asked-questions","Frequently asked questions",[325,1533,1535,1536,1538],{"id":1534},"is-shelltrue-safe-if-the-string-is-a-constant","Is ",[14,1537,67],{}," safe if the string is a constant?",[10,1540,1541,1542,1545],{},"Yes. ",[14,1543,1544],{},"subprocess.run(\"make clean && make\", shell=True)"," with no interpolated data is not injectable. The danger begins the moment any part of the string is computed. Many teams still ban it by lint rule and allow exceptions with an inline comment, which keeps the review question visible.",[325,1547,1549,1550,1553],{"id":1548},"does-using-pathlibpath-objects-protect-me","Does using ",[14,1551,1552],{},"pathlib.Path"," objects protect me?",[10,1555,1556,1557,1560,1561,1563],{},"Only in the sense that you are probably passing them in an argument list. A ",[14,1558,1559],{},"Path"," interpolated into an f-string is just text, and a path can contain any character except NUL and ",[14,1562,1415],{}," in a component.",[325,1565,1567],{"id":1566},"what-about-environment-variables-and-config-files-as-input","What about environment variables and config files as input?",[10,1569,1570,1571,1573],{},"Treat them exactly like arguments. A ",[14,1572,368],{}," in a repository is controlled by whoever can commit to that repository, which is why tools that run commands from project config — like pre-commit hooks — document that you are trusting the repository.",[325,1575,1535,1577,593,1580,1583],{"id":1576},"is-ospopen-or-commandsgetoutput-any-different",[14,1578,1579],{},"os.popen",[14,1581,1582],{},"commands.getoutput"," any different?",[10,1585,1586,1587,1589,1590,1593,1594,1597,1598,1601],{},"Both always use a shell. ",[14,1588,1579],{}," is a thin wrapper around ",[14,1591,1592],{},"subprocess.Popen(cmd, shell=True)","; ",[14,1595,1596],{},"commands"," no longer exists in Python 3. Replace them with ",[14,1599,1600],{},"subprocess.run"," and an argument list.",[37,1603,1605],{"id":1604},"related","Related",[42,1607,1608,1614,1619,1625,1631],{},[45,1609,1610,1611],{},"Up: ",[31,1612,1613],{"href":33},"Running subprocesses from Python CLIs",[45,1615,1616],{},[31,1617,1618],{"href":53},"Calling external commands safely with subprocess",[45,1620,1621],{},[31,1622,1624],{"href":1623},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Fwrapping-git-and-other-tools-from-a-python-cli\u002F","Wrapping git and other tools from a Python CLI",[45,1626,1627],{},[31,1628,1630],{"href":1629},"\u002Fadvanced-input-parsing-user-experience\u002Fadvanced-argument-validation-strategies\u002Fvalidating-file-and-directory-paths-in-clis\u002F","Validating file and directory paths in CLIs",[45,1632,1633],{},[31,1634,1636],{"href":1635},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis\u002F","Secrets and credentials in Python CLIs",[1638,1639,1640],"style",{},"html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .s4XuR, html code.shiki .s4XuR{--shiki-default:#E36209;--shiki-dark:#FFAB70}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}",{"title":86,"searchDepth":100,"depth":100,"links":1642},[1643,1644,1647,1655,1656,1657,1658,1667],{"id":39,"depth":100,"text":40},{"id":60,"depth":100,"text":61,"children":1645},[1646],{"id":327,"depth":111,"text":328},{"id":381,"depth":100,"text":382,"children":1648},[1649,1650,1652,1654],{"id":385,"depth":111,"text":386},{"id":624,"depth":111,"text":1651},"2. -- before untrusted positional data",{"id":788,"depth":111,"text":1653},"3. When you truly need a shell: shlex.quote",{"id":983,"depth":111,"text":984},{"id":1113,"depth":100,"text":1114},{"id":1160,"depth":100,"text":1161},{"id":1517,"depth":100,"text":1518},{"id":1530,"depth":100,"text":1531,"children":1659},[1660,1662,1664,1665],{"id":1534,"depth":111,"text":1661},"Is shell=True safe if the string is a constant?",{"id":1548,"depth":111,"text":1663},"Does using pathlib.Path objects protect me?",{"id":1566,"depth":111,"text":1567},{"id":1576,"depth":111,"text":1666},"Is os.popen or commands.getoutput any different?",{"id":1604,"depth":100,"text":1605},"2026-09-18","How filenames, branch names and config values become commands in Python CLIs, and how argument lists, shlex.quote, -- and allow-lists shut each path down.","intermediate",false,"md",{},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Favoiding-shell-injection-in-python-clis",{"title":5,"description":1669},"cli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Favoiding-shell-injection-in-python-clis\u002Findex",[1678,1679,208,1680],"security","subprocess","validation","DvdS3y9ZRW1njp13XOcDfGZIAWaPXl-OlfVghi7spf0",[1683,1686,1689,1692,1695,1698,1701,1704,1707,1710,1713,1716,1719,1722,1725,1728,1731,1734,1737,1740,1743,1746,1749,1752,1755,1758,1761,1764,1767,1770,1773,1776,1779,1782,1785,1788,1791,1794,1797,1800,1803,1806,1809,1812,1815,1818,1821,1824,1827,1830,1833,1836,1839,1842,1845,1848,1851,1854,1857,1860,1863,1866,1869,1872,1875,1878,1881,1884,1887,1890,1893,1896,1899,1902,1905,1908,1911,1914,1917,1920,1921,1924,1927,1930,1933,1936,1939,1942,1945,1948,1951,1954,1956,1959,1962,1965,1968,1971,1974,1977,1980,1983,1986,1989,1992,1995,1998,2001,2004,2007,2010,2013,2016,2019,2022,2025,2028,2031,2034,2037,2040,2043,2046,2049,2052,2055,2058,2061,2064,2067,2070,2073,2076,2079,2082,2085,2088,2091,2094,2097,2100,2103,2106,2109,2112,2115,2118,2121,2124,2127,2130,2133,2136,2139,2142,2145,2148,2151,2154,2157,2160,2163,2166,2169,2172,2175,2178,2181,2184,2187,2190,2193,2196,2199,2202,2205,2208,2211,2214,2217,2220,2223,2226],{"path":1684,"title":1685},"\u002Fabout","About Python CLI Toolcraft",{"path":1687,"title":1688},"\u002Fadvanced-input-parsing-user-experience\u002Fadvanced-argument-validation-strategies","Advanced Argument Validation Strategies",{"path":1690,"title":1691},"\u002Fadvanced-input-parsing-user-experience\u002Fadvanced-argument-validation-strategies\u002Fparsing-nested-json-arguments-in-python-clis","Parsing Nested JSON Args in Python CLIs",{"path":1693,"title":1694},"\u002Fadvanced-input-parsing-user-experience\u002Fadvanced-argument-validation-strategies\u002Fvalidating-dependent-and-conflicting-options","Validating Dependent and Conflicting CLI Options",{"path":1696,"title":1697},"\u002Fadvanced-input-parsing-user-experience\u002Fadvanced-argument-validation-strategies\u002Fvalidating-file-and-directory-paths-in-clis","Validating File and Directory Paths in CLIs",{"path":1699,"title":1700},"\u002Fadvanced-input-parsing-user-experience\u002Fadvanced-argument-validation-strategies\u002Fwriting-custom-click-parameter-types","Writing Custom Click Parameter Types",{"path":1702,"title":1703},"\u002Fadvanced-input-parsing-user-experience\u002Fbuilding-terminal-uis-with-textual\u002Fbuilding-your-first-textual-app","Building Your First Textual App for a Python CLI",{"path":1705,"title":1706},"\u002Fadvanced-input-parsing-user-experience\u002Fbuilding-terminal-uis-with-textual\u002Fchoosing-between-a-cli-a-prompt-flow-and-a-tui","Choosing Between a CLI, a Prompt Flow and a TUI",{"path":1708,"title":1709},"\u002Fadvanced-input-parsing-user-experience\u002Fbuilding-terminal-uis-with-textual","Building Terminal UIs with Textual for Python CLIs",{"path":1711,"title":1712},"\u002Fadvanced-input-parsing-user-experience\u002Fbuilding-terminal-uis-with-textual\u002Ftesting-textual-apps-with-pilot","Testing Textual Apps with Pilot",{"path":1714,"title":1715},"\u002Fadvanced-input-parsing-user-experience\u002Fcli-help-output-and-documentation\u002Fadding-examples-and-epilogs-to-help-output","Adding Examples and Epilogs to Help Output",{"path":1717,"title":1718},"\u002Fadvanced-input-parsing-user-experience\u002Fcli-help-output-and-documentation\u002Fgenerating-man-pages-and-docs-from-a-cli","Generating Man Pages and Docs from a CLI",{"path":1720,"title":1721},"\u002Fadvanced-input-parsing-user-experience\u002Fcli-help-output-and-documentation","CLI Help Output and Documentation",{"path":1723,"title":1724},"\u002Fadvanced-input-parsing-user-experience\u002Fcli-help-output-and-documentation\u002Fversioning-and-deprecating-cli-flags","Versioning and Deprecating CLI Flags",{"path":1726,"title":1727},"\u002Fadvanced-input-parsing-user-experience\u002Fcli-help-output-and-documentation\u002Fwriting-help-text-users-actually-read","Writing Help Text Users Actually Read",{"path":1729,"title":1730},"\u002Fadvanced-input-parsing-user-experience\u002Fcross-platform-terminal-compatibility\u002Fadapting-output-to-terminal-width","Adapting Python CLI Output to Terminal Width",{"path":1732,"title":1733},"\u002Fadvanced-input-parsing-user-experience\u002Fcross-platform-terminal-compatibility\u002Fdetecting-ci-environments-and-non-interactive-shells","Detecting CI Environments and Non-Interactive Shells",{"path":1735,"title":1736},"\u002Fadvanced-input-parsing-user-experience\u002Fcross-platform-terminal-compatibility\u002Ffixing-unicode-and-encoding-errors-on-windows","Fixing Unicode and Encoding Errors on Windows in Python CLIs",{"path":1738,"title":1739},"\u002Fadvanced-input-parsing-user-experience\u002Fcross-platform-terminal-compatibility","Cross-Platform Terminal Compatibility for Python CLIs",{"path":1741,"title":1742},"\u002Fadvanced-input-parsing-user-experience\u002Fcross-platform-terminal-compatibility\u002Frespecting-no-color-and-force-color","Respecting NO_COLOR and FORCE_COLOR in Python CLIs",{"path":1744,"title":1745},"\u002Fadvanced-input-parsing-user-experience\u002Ferror-handling-and-exit-codes\u002Fchoosing-exit-codes-for-cli-tools","Choosing Exit Codes for CLI Tools",{"path":1747,"title":1748},"\u002Fadvanced-input-parsing-user-experience\u002Ferror-handling-and-exit-codes\u002Fdesigning-an-exception-hierarchy-for-a-cli","Designing an Exception Hierarchy for a Python CLI",{"path":1750,"title":1751},"\u002Fadvanced-input-parsing-user-experience\u002Ferror-handling-and-exit-codes\u002Ffriendly-error-messages-and-tracebacks","Friendly Error Messages and Tracebacks",{"path":1753,"title":1754},"\u002Fadvanced-input-parsing-user-experience\u002Ferror-handling-and-exit-codes\u002Fhandling-keyboard-interrupt-cleanly","Handling Keyboard Interrupt Cleanly",{"path":1756,"title":1757},"\u002Fadvanced-input-parsing-user-experience\u002Ferror-handling-and-exit-codes","Error Handling and Exit Codes for CLIs",{"path":1759,"title":1760},"\u002Fadvanced-input-parsing-user-experience\u002Ferror-handling-and-exit-codes\u002Freporting-machine-readable-errors-in-json-mode","Reporting Machine-Readable Errors in JSON Mode",{"path":1762,"title":1763},"\u002Fadvanced-input-parsing-user-experience\u002Fhandling-configuration-files-env-vars\u002Fconfig-precedence-flags-env-files-defaults","Config Precedence: Flags, Env, Files, Defaults",{"path":1765,"title":1766},"\u002Fadvanced-input-parsing-user-experience\u002Fhandling-configuration-files-env-vars\u002Fdiscovering-project-config-files-by-walking-up-directories","Discovering Project Config Files by Walking Up Directories",{"path":1768,"title":1769},"\u002Fadvanced-input-parsing-user-experience\u002Fhandling-configuration-files-env-vars","Handling Config Files and Env Vars in CLIs",{"path":1771,"title":1772},"\u002Fadvanced-input-parsing-user-experience\u002Fhandling-configuration-files-env-vars\u002Floading-yaml-configs-safely-in-cli-apps","Loading YAML configs safely in CLI apps",{"path":1774,"title":1775},"\u002Fadvanced-input-parsing-user-experience\u002Fhandling-configuration-files-env-vars\u002Freading-toml-config-with-tomllib","Reading TOML Config with tomllib in Python CLIs",{"path":1777,"title":1778},"\u002Fadvanced-input-parsing-user-experience\u002Fhandling-configuration-files-env-vars\u002Ftyped-settings-with-pydantic-settings","Typed Settings with pydantic-settings in Python CLIs",{"path":1780,"title":1781},"\u002Fadvanced-input-parsing-user-experience","Advanced Input Parsing for Python CLIs",{"path":1783,"title":1784},"\u002Fadvanced-input-parsing-user-experience\u002Finteractive-terminal-ui-with-rich\u002Fadding-progress-bars-and-spinners-to-python-clis","Progress Bars and Spinners for Python CLIs",{"path":1786,"title":1787},"\u002Fadvanced-input-parsing-user-experience\u002Finteractive-terminal-ui-with-rich\u002Fbuilding-interactive-prompts-and-menus","Building Interactive Prompts and Menus in Python CLIs",{"path":1789,"title":1790},"\u002Fadvanced-input-parsing-user-experience\u002Finteractive-terminal-ui-with-rich","Interactive Terminal UI with Rich",{"path":1792,"title":1793},"\u002Fadvanced-input-parsing-user-experience\u002Finteractive-terminal-ui-with-rich\u002Flive-dashboards-with-rich-live","Live Dashboards with Rich Live in Python CLIs",{"path":1795,"title":1796},"\u002Fadvanced-input-parsing-user-experience\u002Finteractive-terminal-ui-with-rich\u002Frendering-tables-and-json-with-rich","Rendering Tables and JSON with Rich",{"path":1798,"title":1799},"\u002Fadvanced-input-parsing-user-experience\u002Finteractive-terminal-ui-with-rich\u002Ftheming-rich-output-consistently","Theming Rich Output Consistently in Python CLIs",{"path":1801,"title":1802},"\u002Fadvanced-input-parsing-user-experience\u002Fshell-completion-for-python-clis\u002Fdynamic-completion-values-from-apis-and-files","Dynamic Completion Values from APIs and Files",{"path":1804,"title":1805},"\u002Fadvanced-input-parsing-user-experience\u002Fshell-completion-for-python-clis\u002Fenabling-tab-completion-in-click-and-typer","Enabling Tab Completion in Click and Typer",{"path":1807,"title":1808},"\u002Fadvanced-input-parsing-user-experience\u002Fshell-completion-for-python-clis","Shell Completion for Python CLIs",{"path":1810,"title":1811},"\u002Fadvanced-input-parsing-user-experience\u002Fshell-completion-for-python-clis\u002Finstalling-shell-completion-for-bash-zsh-fish","Installing Shell Completion for bash, zsh, fish",{"path":1813,"title":1814},"\u002Fadvanced-input-parsing-user-experience\u002Fshell-completion-for-python-clis\u002Ftesting-shell-completion-in-python-clis","Testing Shell Completion in Python CLIs",{"path":1816,"title":1817},"\u002Fadvanced-input-parsing-user-experience\u002Fstructured-logging-for-cli-apps\u002Fadding-trace-ids-and-context-to-cli-logs","Adding Trace IDs and Context to Python CLI Logs",{"path":1819,"title":1820},"\u002Fadvanced-input-parsing-user-experience\u002Fstructured-logging-for-cli-apps\u002Fadding-verbose-and-quiet-logging-flags","Adding Verbose and Quiet Logging Flags",{"path":1822,"title":1823},"\u002Fadvanced-input-parsing-user-experience\u002Fstructured-logging-for-cli-apps","Structured Logging for CLI Apps",{"path":1825,"title":1826},"\u002Fadvanced-input-parsing-user-experience\u002Fstructured-logging-for-cli-apps\u002Fstructured-json-logging-in-python-clis","Structured JSON Logging in Python CLIs",{"path":1828,"title":1829},"\u002Fadvanced-input-parsing-user-experience\u002Fstructured-logging-for-cli-apps\u002Fwriting-rotating-log-files-from-a-cli","Writing Rotating Log Files from a Python CLI",{"path":1831,"title":1832},"\u002Fadvanced-input-parsing-user-experience\u002Fworking-with-stdin-stdout-and-pipes\u002Fdetecting-tty-and-adapting-output","Detecting a TTY and Adapting Output",{"path":1834,"title":1835},"\u002Fadvanced-input-parsing-user-experience\u002Fworking-with-stdin-stdout-and-pipes\u002Femitting-json-output-for-scripting","Emitting JSON Output for Scripting",{"path":1837,"title":1838},"\u002Fadvanced-input-parsing-user-experience\u002Fworking-with-stdin-stdout-and-pipes\u002Fhandling-broken-pipe-and-sigpipe","Handling Broken Pipe and SIGPIPE",{"path":1840,"title":1841},"\u002Fadvanced-input-parsing-user-experience\u002Fworking-with-stdin-stdout-and-pipes","Working with stdin, stdout and Pipes",{"path":1843,"title":1844},"\u002Fadvanced-input-parsing-user-experience\u002Fworking-with-stdin-stdout-and-pipes\u002Fprocessing-large-files-and-ndjson-streams","Processing Large Files and NDJSON Streams in Python CLIs",{"path":1846,"title":1847},"\u002Fadvanced-input-parsing-user-experience\u002Fworking-with-stdin-stdout-and-pipes\u002Freading-piped-input-in-python-clis","Reading Piped Input in Python CLIs",{"path":1849,"title":1850},"\u002Fcli-runtime-systems-integration\u002Fcalling-http-apis-from-python-clis\u002Fbuilding-an-api-client-cli-with-httpx","Building an API Client CLI with httpx",{"path":1852,"title":1853},"\u002Fcli-runtime-systems-integration\u002Fcalling-http-apis-from-python-clis\u002Fdownloading-files-with-progress-in-python","Downloading Files with Progress in Python CLIs",{"path":1855,"title":1856},"\u002Fcli-runtime-systems-integration\u002Fcalling-http-apis-from-python-clis","Calling HTTP APIs from Python CLIs",{"path":1858,"title":1859},"\u002Fcli-runtime-systems-integration\u002Fcalling-http-apis-from-python-clis\u002Foauth-device-flow-login-for-clis","OAuth Device Flow Login for Python CLIs",{"path":1861,"title":1862},"\u002Fcli-runtime-systems-integration\u002Fcalling-http-apis-from-python-clis\u002Fpaginating-api-results-in-a-cli","Paginating API Results in a Python CLI",{"path":1864,"title":1865},"\u002Fcli-runtime-systems-integration\u002Fcalling-http-apis-from-python-clis\u002Fretries-and-backoff-for-cli-http-calls","Retries and Backoff for CLI HTTP Calls",{"path":1867,"title":1868},"\u002Fcli-runtime-systems-integration\u002Fconcurrency-and-async-in-python-clis\u002Fcancelling-async-tasks-on-ctrl-c","Cancelling Async Tasks on Ctrl+C in Python CLIs",{"path":1870,"title":1871},"\u002Fcli-runtime-systems-integration\u002Fconcurrency-and-async-in-python-clis","Concurrency and Async in Python CLIs",{"path":1873,"title":1874},"\u002Fcli-runtime-systems-integration\u002Fconcurrency-and-async-in-python-clis\u002Fmultiprocessing-for-cpu-bound-cli-tasks","Multiprocessing for CPU-Bound CLI Tasks",{"path":1876,"title":1877},"\u002Fcli-runtime-systems-integration\u002Fconcurrency-and-async-in-python-clis\u002Fparallelising-cli-work-with-thread-pools","Parallelising CLI Work with Thread Pools",{"path":1879,"title":1880},"\u002Fcli-runtime-systems-integration\u002Fconcurrency-and-async-in-python-clis\u002Frate-limiting-concurrent-requests-in-clis","Rate-Limiting Concurrent Requests in Python CLIs",{"path":1882,"title":1883},"\u002Fcli-runtime-systems-integration\u002Fconcurrency-and-async-in-python-clis\u002Frunning-async-code-in-typer-and-click","Running Async Code in Typer and Click",{"path":1885,"title":1886},"\u002Fcli-runtime-systems-integration\u002Ffilesystem-paths-and-atomic-writes\u002Fcross-platform-paths-with-pathlib","Cross-Platform Paths with pathlib in CLIs",{"path":1888,"title":1889},"\u002Fcli-runtime-systems-integration\u002Ffilesystem-paths-and-atomic-writes\u002Ffile-locking-for-concurrent-cli-runs","File Locking for Concurrent CLI Runs in Python",{"path":1891,"title":1892},"\u002Fcli-runtime-systems-integration\u002Ffilesystem-paths-and-atomic-writes","Filesystem Paths and Atomic Writes for CLIs",{"path":1894,"title":1895},"\u002Fcli-runtime-systems-integration\u002Ffilesystem-paths-and-atomic-writes\u002Fsafe-temporary-files-and-directories","Safe Temporary Files and Directories in CLIs",{"path":1897,"title":1898},"\u002Fcli-runtime-systems-integration\u002Ffilesystem-paths-and-atomic-writes\u002Fstoring-app-data-with-platformdirs","Storing CLI App Data with platformdirs",{"path":1900,"title":1901},"\u002Fcli-runtime-systems-integration\u002Ffilesystem-paths-and-atomic-writes\u002Fwriting-files-atomically-in-python-clis","Writing Files Atomically in Python CLIs",{"path":1903,"title":1904},"\u002Fcli-runtime-systems-integration","CLI Runtime & Systems Integration for Python",{"path":1906,"title":1907},"\u002Fcli-runtime-systems-integration\u002Flong-running-and-watch-mode-clis\u002Fbuilding-a-watch-mode-with-watchfiles","Building a Watch Mode with watchfiles in Python",{"path":1909,"title":1910},"\u002Fcli-runtime-systems-integration\u002Flong-running-and-watch-mode-clis\u002Fhandling-sigterm-and-graceful-shutdown","Handling SIGTERM and Graceful Shutdown in CLIs",{"path":1912,"title":1913},"\u002Fcli-runtime-systems-integration\u002Flong-running-and-watch-mode-clis\u002Fhealth-checks-and-heartbeats-for-long-running-clis","Health Checks and Heartbeats for Long-Running CLIs",{"path":1915,"title":1916},"\u002Fcli-runtime-systems-integration\u002Flong-running-and-watch-mode-clis","Long-Running and Watch-Mode Python CLIs",{"path":1918,"title":1919},"\u002Fcli-runtime-systems-integration\u002Flong-running-and-watch-mode-clis\u002Frunning-a-cli-on-a-schedule-with-cron-and-systemd","Running a Python CLI on a Schedule with cron and systemd",{"path":1674,"title":5},{"path":1922,"title":1923},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Fcalling-external-commands-safely-with-subprocess","Calling External Commands Safely with subprocess",{"path":1925,"title":1926},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Fhandling-subprocess-timeouts-and-exit-codes","Handling Subprocess Timeouts and Exit Codes",{"path":1928,"title":1929},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis","Running Subprocesses from Python CLIs",{"path":1931,"title":1932},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Fstreaming-subprocess-output-in-real-time","Streaming Subprocess Output in Real Time",{"path":1934,"title":1935},"\u002Fcli-runtime-systems-integration\u002Frunning-subprocesses-from-python-clis\u002Fwrapping-git-and-other-tools-from-a-python-cli","Wrapping git and Other Tools from a Python CLI",{"path":1937,"title":1938},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis","Secrets and Credentials in Python CLIs",{"path":1940,"title":1941},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis\u002Fprompting-for-passwords-securely","Prompting for Passwords Securely in Python CLIs",{"path":1943,"title":1944},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis\u002Freading-secrets-from-env-and-files","Reading Secrets from Env Vars and Files in CLIs",{"path":1946,"title":1947},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis\u002Fredacting-secrets-from-cli-output-and-logs","Redacting Secrets from CLI Output and Logs",{"path":1949,"title":1950},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis\u002Fstoring-tokens-with-keyring","Storing CLI Tokens Securely with keyring",{"path":1952,"title":1953},"\u002Fcli-runtime-systems-integration\u002Fsecrets-and-credentials-in-python-clis\u002Fsupporting-multiple-profiles-and-accounts","Supporting Multiple Profiles and Accounts in CLIs",{"path":1415,"title":1955},"Python CLI Toolcraft",{"path":1957,"title":1958},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcli-startup-performance-and-lazy-loading\u002Fcaching-expensive-work-between-cli-runs","Caching Expensive Work Between Python CLI Runs",{"path":1960,"title":1961},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcli-startup-performance-and-lazy-loading","CLI Startup Performance and Lazy Loading",{"path":1963,"title":1964},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcli-startup-performance-and-lazy-loading\u002Flazy-loading-subcommands-for-faster-startup","Lazy Loading Subcommands for Faster Startup",{"path":1966,"title":1967},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcli-startup-performance-and-lazy-loading\u002Fprofiling-python-cli-startup-time","Profiling Python CLI Startup Time",{"path":1969,"title":1970},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcli-startup-performance-and-lazy-loading\u002Freducing-cli-dependency-weight","Reducing CLI Dependency Weight",{"path":1972,"title":1973},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcommand-line-parsing-with-argparse\u002Fargparse-subparsers-for-subcommands","argparse Subparsers for Subcommands",{"path":1975,"title":1976},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcommand-line-parsing-with-argparse\u002Fargparse-vs-click-vs-typer-comparison","argparse vs Click vs Typer Compared",{"path":1978,"title":1979},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcommand-line-parsing-with-argparse","Command-Line Parsing with argparse",{"path":1981,"title":1982},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcommand-line-parsing-with-argparse\u002Fmigrating-from-argparse-to-typer","Migrating from argparse to Typer",{"path":1984,"title":1985},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcommand-line-parsing-with-argparse\u002Fmutually-exclusive-options-in-argparse","Mutually Exclusive Options in argparse",{"path":1987,"title":1988},"\u002Fmodern-python-cli-frameworks-architecture\u002Fcommand-line-parsing-with-argparse\u002Fwriting-custom-argparse-actions","Writing Custom argparse Actions in Python",{"path":1990,"title":1991},"\u002Fmodern-python-cli-frameworks-architecture\u002Fdesigning-cli-interfaces-and-conventions\u002Fadding-dry-run-and-confirmation-to-destructive-commands","Adding Dry-Run and Confirmation to Destructive Commands",{"path":1993,"title":1994},"\u002Fmodern-python-cli-frameworks-architecture\u002Fdesigning-cli-interfaces-and-conventions\u002Ffollowing-posix-and-gnu-argument-conventions","Following POSIX and GNU Argument Conventions in Python",{"path":1996,"title":1997},"\u002Fmodern-python-cli-frameworks-architecture\u002Fdesigning-cli-interfaces-and-conventions\u002Fglobal-options-vs-per-command-options","Global Options vs Per-Command Options in Python CLIs",{"path":1999,"title":2000},"\u002Fmodern-python-cli-frameworks-architecture\u002Fdesigning-cli-interfaces-and-conventions","Designing CLI Interfaces and Conventions in Python",{"path":2002,"title":2003},"\u002Fmodern-python-cli-frameworks-architecture\u002Fdesigning-cli-interfaces-and-conventions\u002Fnaming-commands-and-flags-consistently","Naming Commands and Flags Consistently in Python CLIs",{"path":2005,"title":2006},"\u002Fmodern-python-cli-frameworks-architecture","Python CLI Frameworks and Architecture",{"path":2008,"title":2009},"\u002Fmodern-python-cli-frameworks-architecture\u002Fplugin-architectures-for-extensible-clis\u002Fdiscovering-plugins-with-entry-points","Discovering Plugins with Entry Points in Python CLIs",{"path":2011,"title":2012},"\u002Fmodern-python-cli-frameworks-architecture\u002Fplugin-architectures-for-extensible-clis\u002Fhook-based-plugins-with-pluggy","Hook-Based Plugins for Python CLIs with pluggy",{"path":2014,"title":2015},"\u002Fmodern-python-cli-frameworks-architecture\u002Fplugin-architectures-for-extensible-clis","Plugin Architectures for Extensible CLIs",{"path":2017,"title":2018},"\u002Fmodern-python-cli-frameworks-architecture\u002Fplugin-architectures-for-extensible-clis\u002Fversioning-a-plugin-api","Versioning a Plugin API for a Python CLI",{"path":2020,"title":2021},"\u002Fmodern-python-cli-frameworks-architecture\u002Fplugin-architectures-for-extensible-clis\u002Fwriting-a-plugin-for-an-existing-cli","Writing a Plugin for an Existing CLI",{"path":2023,"title":2024},"\u002Fmodern-python-cli-frameworks-architecture\u002Fstructuring-multi-command-python-clis\u002Fbest-practices-for-python-cli-entry-points","Best practices for Python CLI entry points",{"path":2026,"title":2027},"\u002Fmodern-python-cli-frameworks-architecture\u002Fstructuring-multi-command-python-clis\u002Fdependency-injection-patterns-for-cli-commands","Dependency Injection Patterns for CLI Commands",{"path":2029,"title":2030},"\u002Fmodern-python-cli-frameworks-architecture\u002Fstructuring-multi-command-python-clis\u002Fhow-to-structure-a-large-python-cli-project","Structuring a Large Python CLI Project",{"path":2032,"title":2033},"\u002Fmodern-python-cli-frameworks-architecture\u002Fstructuring-multi-command-python-clis","Structuring Multi-Command Python CLIs",{"path":2035,"title":2036},"\u002Fmodern-python-cli-frameworks-architecture\u002Fstructuring-multi-command-python-clis\u002Fsharing-common-options-across-commands","Sharing Common Options Across Python CLI Commands",{"path":2038,"title":2039},"\u002Fmodern-python-cli-frameworks-architecture\u002Fstructuring-multi-command-python-clis\u002Fsharing-state-with-click-context-objects","Sharing State with Click Context Objects",{"path":2041,"title":2042},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Fend-to-end-testing-an-installed-cli","End-to-End Testing an Installed Python CLI",{"path":2044,"title":2045},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications","Testing Python CLI Applications",{"path":2047,"title":2048},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Fmeasuring-cli-test-coverage","Measuring CLI Test Coverage",{"path":2050,"title":2051},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Fmocking-filesystem-and-network-in-cli-tests","Mocking the Filesystem and Network in CLI Tests",{"path":2053,"title":2054},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Fproperty-based-testing-cli-arguments-with-hypothesis","Property-Based Testing CLI Arguments with Hypothesis",{"path":2056,"title":2057},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Fsnapshot-testing-cli-output","Snapshot Testing CLI Output",{"path":2059,"title":2060},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Ftesting-click-commands-with-clirunner","Testing Click Commands with CliRunner",{"path":2062,"title":2063},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftesting-python-cli-applications\u002Ftesting-interactive-prompts-and-stdin","Testing Interactive Prompts and stdin",{"path":2065,"title":2066},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftyper-vs-click-when-to-use-each\u002Fbuilding-a-cli-with-subcommands-in-click","Building a CLI with subcommands in Click",{"path":2068,"title":2069},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftyper-vs-click-when-to-use-each\u002Fbuilding-dynamic-commands-in-click","Building Dynamic Commands in Click",{"path":2071,"title":2072},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftyper-vs-click-when-to-use-each\u002Fconverting-a-click-app-to-typer","Converting a Click App to Typer",{"path":2074,"title":2075},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftyper-vs-click-when-to-use-each","Typer vs Click: When to Use Each",{"path":2077,"title":2078},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftyper-vs-click-when-to-use-each\u002Ftyper-callback-functions-explained","Typer callback functions explained",{"path":2080,"title":2081},"\u002Fmodern-python-cli-frameworks-architecture\u002Ftyper-vs-click-when-to-use-each\u002Fusing-annotated-options-in-typer","Using Annotated Options in Typer",{"path":2083,"title":2084},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fautomating-releases-from-git-tags","Automating Python CLI Releases from Git Tags",{"path":2086,"title":2087},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fcaching-uv-dependencies-in-ci","Caching uv Dependencies in CI for Python CLIs",{"path":2089,"title":2090},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis","CI\u002FCD Pipelines for Python CLIs",{"path":2092,"title":2093},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fpublishing-to-pypi-with-trusted-publishing","Publishing a CLI to PyPI with Trusted Publishing",{"path":2095,"title":2096},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Fsmoke-testing-the-built-wheel-in-ci","Smoke-Testing the Built Wheel of a Python CLI in CI",{"path":2098,"title":2099},"\u002Fproject-setup-dependency-management\u002Fci-cd-pipelines-for-python-clis\u002Ftesting-a-cli-across-python-versions-with-github-actions","Testing a CLI Across Python Versions in GitHub Actions",{"path":2101,"title":2102},"\u002Fproject-setup-dependency-management\u002Fcli-project-scaffolding-with-cookiecutter\u002Fbuilding-a-cookiecutter-template-for-typer-clis","Building a Cookiecutter Template for Typer CLIs",{"path":2104,"title":2105},"\u002Fproject-setup-dependency-management\u002Fcli-project-scaffolding-with-cookiecutter\u002Fcopier-vs-cookiecutter-for-cli-templates","Copier vs Cookiecutter for CLI Templates",{"path":2107,"title":2108},"\u002Fproject-setup-dependency-management\u002Fcli-project-scaffolding-with-cookiecutter","CLI Project Scaffolding with Cookiecutter",{"path":2110,"title":2111},"\u002Fproject-setup-dependency-management\u002Fcli-project-scaffolding-with-cookiecutter\u002Fpost-generation-hooks-in-cli-templates","Post-Generation Hooks in Python CLI Templates",{"path":2113,"title":2114},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries\u002Fbuilding-cross-platform-release-binaries-in-ci","Building Cross-Platform Release Binaries in CI",{"path":2116,"title":2117},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries\u002Fbundling-a-python-cli-with-pyinstaller","Bundling a Python CLI with PyInstaller",{"path":2119,"title":2120},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries\u002Fhomebrew-and-scoop-packaging-for-python-clis","Homebrew and Scoop Packaging for Python CLIs",{"path":2122,"title":2123},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries","Distributing CLIs as Standalone Binaries",{"path":2125,"title":2126},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries\u002Fnuitka-vs-pyinstaller-for-python-clis","Nuitka vs PyInstaller for Python CLI Binaries",{"path":2128,"title":2129},"\u002Fproject-setup-dependency-management\u002Fdistributing-clis-as-standalone-binaries\u002Fshipping-a-cli-as-a-zipapp-with-shiv","Shipping a CLI as a Zipapp with shiv",{"path":2131,"title":2132},"\u002Fproject-setup-dependency-management","Project Setup & Dependency Management",{"path":2134,"title":2135},"\u002Fproject-setup-dependency-management\u002Flinting-and-type-checking-cli-code\u002Fconfiguring-ruff-for-a-cli-project","Configuring Ruff for a Python CLI Project",{"path":2137,"title":2138},"\u002Fproject-setup-dependency-management\u002Flinting-and-type-checking-cli-code\u002Fenforcing-import-boundaries-in-a-cli-codebase","Enforcing Import Boundaries in a Python CLI Codebase",{"path":2140,"title":2141},"\u002Fproject-setup-dependency-management\u002Flinting-and-type-checking-cli-code","Linting and Type-Checking Python CLI Code",{"path":2143,"title":2144},"\u002Fproject-setup-dependency-management\u002Flinting-and-type-checking-cli-code\u002Ftype-checking-click-and-typer-code-with-mypy","Type-Checking Click and Typer Code with mypy",{"path":2146,"title":2147},"\u002Fproject-setup-dependency-management\u002Fmanaging-cli-versioning-changelogs\u002Fautomating-changelogs-with-conventional-commits","Automating Changelogs with Conventional Commits",{"path":2149,"title":2150},"\u002Fproject-setup-dependency-management\u002Fmanaging-cli-versioning-changelogs\u002Fderiving-versions-from-git-tags-with-hatch-vcs","Deriving CLI Versions from Git Tags with hatch-vcs",{"path":2152,"title":2153},"\u002Fproject-setup-dependency-management\u002Fmanaging-cli-versioning-changelogs\u002Fexposing-version-info-and-build-metadata","Exposing Version Info and Build Metadata",{"path":2155,"title":2156},"\u002Fproject-setup-dependency-management\u002Fmanaging-cli-versioning-changelogs","Managing CLI Versioning & Changelogs",{"path":2158,"title":2159},"\u002Fproject-setup-dependency-management\u002Fmanaging-cli-versioning-changelogs\u002Fsemantic-versioning-policy-for-cli-tools","A Semantic Versioning Policy for CLI Tools",{"path":2161,"title":2162},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution\u002Fbuilding-wheels-and-sdists-for-python-clis","Building Wheels and sdists for Python CLIs",{"path":2164,"title":2165},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution\u002Fbundling-data-files-with-importlib-resources","Bundling Data Files with importlib.resources in CLIs",{"path":2167,"title":2168},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution","Packaging Python CLIs for Distribution",{"path":2170,"title":2171},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution\u002Finstalling-and-distributing-clis-with-pipx","Installing and Distributing CLIs with pipx",{"path":2173,"title":2174},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution\u002Fpublishing-a-python-cli-to-pypi","Publishing a Python CLI to PyPI",{"path":2176,"title":2177},"\u002Fproject-setup-dependency-management\u002Fpackaging-python-clis-for-distribution\u002Fwriting-pyproject-toml-metadata-for-a-cli","Writing pyproject.toml Metadata for a Python CLI",{"path":2179,"title":2180},"\u002Fproject-setup-dependency-management\u002Fpoetry-workflows-for-cli-development","Poetry Workflows for CLI Development",{"path":2182,"title":2183},"\u002Fproject-setup-dependency-management\u002Fpoetry-workflows-for-cli-development\u002Fmigrating-a-cli-from-poetry-to-uv","Migrating a Python CLI from Poetry to uv",{"path":2185,"title":2186},"\u002Fproject-setup-dependency-management\u002Fpoetry-workflows-for-cli-development\u002Fpoetry-dependency-groups-for-cli-tooling","Poetry Dependency Groups for CLI Tooling",{"path":2188,"title":2189},"\u002Fproject-setup-dependency-management\u002Fpoetry-workflows-for-cli-development\u002Fpoetry-entry-points-and-scripts-for-clis","Poetry Entry Points and Scripts for CLIs",{"path":2191,"title":2192},"\u002Fproject-setup-dependency-management\u002Fpre-commit-hooks-for-cli-projects","Pre-commit Hooks for CLI Projects",{"path":2194,"title":2195},"\u002Fproject-setup-dependency-management\u002Fpre-commit-hooks-for-cli-projects\u002Fsetting-up-pre-commit-for-python-cli-repos","Setting up pre-commit for Python CLI repos",{"path":2197,"title":2198},"\u002Fproject-setup-dependency-management\u002Fpre-commit-hooks-for-cli-projects\u002Fshipping-your-cli-as-a-pre-commit-hook","Shipping Your Python CLI as a pre-commit Hook",{"path":2200,"title":2201},"\u002Fproject-setup-dependency-management\u002Fpre-commit-hooks-for-cli-projects\u002Fwriting-local-pre-commit-hooks-in-python","Writing Local pre-commit Hooks in Python",{"path":2203,"title":2204},"\u002Fproject-setup-dependency-management\u002Fuv-for-python-cli-dependency-management","uv for Python CLI Dependency Management",{"path":2206,"title":2207},"\u002Fproject-setup-dependency-management\u002Fuv-for-python-cli-dependency-management\u002Frunning-one-off-cli-scripts-with-uv-run","Running One-Off CLI Scripts with uv run and PEP 723",{"path":2209,"title":2210},"\u002Fproject-setup-dependency-management\u002Fuv-for-python-cli-dependency-management\u002Fuv-init-vs-poetry-init-for-cli-tools","uv init vs poetry init for CLI tools",{"path":2212,"title":2213},"\u002Fproject-setup-dependency-management\u002Fuv-for-python-cli-dependency-management\u002Fuv-tool-install-vs-pipx-for-clis","uv tool install vs pipx for CLIs",{"path":2215,"title":2216},"\u002Fproject-setup-dependency-management\u002Fuv-for-python-cli-dependency-management\u002Fuv-workspaces-for-multi-package-clis","uv Workspaces for Multi-Package Python CLIs",{"path":2218,"title":2219},"\u002Fproject-setup-dependency-management\u002Fvirtual-environments-isolation-best-practices","Python CLI Env Isolation Best Practices",{"path":2221,"title":2222},"\u002Fproject-setup-dependency-management\u002Fvirtual-environments-isolation-best-practices\u002Fmanaging-virtual-environments-for-cross-platform-clis","Managing Python CLI Virtual Environments",{"path":2224,"title":2225},"\u002Fproject-setup-dependency-management\u002Fvirtual-environments-isolation-best-practices\u002Fpinning-the-python-version-for-a-cli","Pinning the Python Version for a CLI",{"path":2227,"title":2228},"\u002Fproject-setup-dependency-management\u002Fvirtual-environments-isolation-best-practices\u002Fsupporting-multiple-python-versions-with-nox","Supporting Multiple Python Versions with nox",1789736905050]