fix(cli): harden json run and zip fallback

lib/cli/tests/deploy/test_archive.py

@@ -1,4 +1,5 @@
 from pathlib import Path
+import subprocess
 import zipfile
 
 import pytest
@@ -56,6 +57,42 @@ def test_create_project_zip_uses_repository_file_list(tmp_path: Path):
     assert names == {"pyproject.toml", "uv.lock"}
 
 
+def test_create_project_zip_without_repository_uses_git_ignore_rules(
+    tmp_path: Path,
+):
+    (tmp_path / "pyproject.toml").write_text("[project]\nname = 'demo'\n")
+    (tmp_path / ".gitignore").write_text("node_modules/\nsecret.txt\n")
+    (tmp_path / "src").mkdir()
+    (tmp_path / "src" / "main.py").write_text("print('hello')\n")
+    (tmp_path / "node_modules").mkdir()
+    (tmp_path / "node_modules" / "package.json").write_text("{}\n")
+    (tmp_path / "secret.txt").write_text("secret\n")
+
+    try:
+        subprocess.run(
+            ["git", "init"],
+            cwd=tmp_path,
+            capture_output=True,
+            check=True,
+            text=True,
+        )
+    except (FileNotFoundError, subprocess.CalledProcessError) as exc:
+        pytest.skip(f"git is not available in this environment: {exc}")
+
+    archive_path = create_project_zip("demo", project_dir=tmp_path)
+    try:
+        with zipfile.ZipFile(archive_path) as archive:
+            names = set(archive.namelist())
+    finally:
+        archive_path.unlink(missing_ok=True)
+
+    assert names == {
+        ".gitignore",
+        "pyproject.toml",
+        "src/main.py",
+    }
+
+
 def test_create_project_zip_does_not_fallback_when_repository_listing_fails(
     tmp_path: Path,
 ):

lib/cli/tests/deploy/test_deploy_main.py

@@ -414,6 +414,25 @@ class TestDeployCommand(unittest.TestCase):
         )
         self.mock_client.create_crew.assert_not_called()
 
+    @patch("crewai_cli.deploy.main.git.Repository")
+    def test_prepare_git_repository_returns_repo_when_init_commit_fails(
+        self, mock_repository
+    ):
+        recovered_repository = MagicMock()
+        mock_repository.side_effect = [
+            ValueError("not a Git repository"),
+            recovered_repository,
+        ]
+        mock_repository.initialize.side_effect = RuntimeError("commit failed")
+
+        with patch("sys.stdout", new=StringIO()) as fake_out:
+            repository = self.deploy_command._prepare_git_repository()
+
+        self.assertIs(repository, recovered_repository)
+        self.assertIn("Git auto-setup did not complete", fake_out.getvalue())
+        mock_repository.initialize.assert_called_once_with()
+        self.assertEqual(mock_repository.call_count, 2)
+
     @patch("crewai_cli.deploy.main.create_project_zip")
     @patch("crewai_cli.deploy.main.fetch_and_json_env_file")
     @patch("crewai_cli.deploy.main.git.Repository")

lib/cli/tests/test_run_crew.py

@@ -182,7 +182,7 @@ def test_json_project_env_run_failure_exits_nonzero(monkeypatch, tmp_path: Path)
 def test_json_run_installs_dependencies_when_pyproject_has_no_lockfile(
     monkeypatch, tmp_path: Path
 ):
-    """JSON crew runs should lock/sync project dependencies only once."""
+    """JSON crew runs should lock/sync project dependencies only when needed."""
     monkeypatch.chdir(tmp_path)
     (tmp_path / "pyproject.toml").write_text("[project]\nname = 'demo'\n")
     calls = []
@@ -196,11 +196,11 @@ def test_json_run_installs_dependencies_when_pyproject_has_no_lockfile(
 
     run_crew_module._install_json_crew_dependencies_if_needed()
 
-    assert calls == [([], True, False)]
+    assert calls == [([], True, None)]
 
 
 @pytest.mark.parametrize("lockfile", ["uv.lock", "poetry.lock"])
-def test_json_run_skips_dependency_install_when_lockfile_exists(
+def test_json_run_syncs_frozen_when_lockfile_exists_without_venv(
     monkeypatch, tmp_path: Path, lockfile: str
 ):
     monkeypatch.chdir(tmp_path)
@@ -217,6 +217,28 @@ def test_json_run_skips_dependency_install_when_lockfile_exists(
 
     run_crew_module._install_json_crew_dependencies_if_needed()
 
+    assert calls == [(["--frozen"], True, None)]
+
+
+@pytest.mark.parametrize("lockfile", ["uv.lock", "poetry.lock"])
+def test_json_run_skips_dependency_install_when_lockfile_and_venv_exist(
+    monkeypatch, tmp_path: Path, lockfile: str
+):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / "pyproject.toml").write_text("[project]\nname = 'demo'\n")
+    (tmp_path / lockfile).write_text("# lock\n")
+    (tmp_path / ".venv").mkdir()
+    calls = []
+
+    def fake_install_crew(
+        proxy_options, *, raise_on_error=False, install_project=None
+    ):
+        calls.append((proxy_options, raise_on_error, install_project))
+
+    monkeypatch.setattr("crewai_cli.install_crew.install_crew", fake_install_crew)
+
+    run_crew_module._install_json_crew_dependencies_if_needed()
+
     assert calls == []