✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

✅ PR preview is ready!

@cursor review

Summary

This PR adds support for auto-rerun when config.toml is created at runtime. When Streamlit starts without a config.toml file, creating one will now trigger an automatic app rerun to apply the configuration. The implementation modifies _install_config_watchers() in bootstrap.py to use watch_dir() for watching parent directories when config files don't exist, complementing the existing watch_file() behavior for existing files.

Changed files:

• lib/streamlit/web/bootstrap.py - Added directory watching logic
• lib/tests/streamlit/web/bootstrap_test.py - Added two new test cases

Code Quality

The implementation is clean, minimal, and follows existing patterns in the codebase:

Strengths:

• Uses the existing watch_dir() infrastructure with appropriate parameters (glob_pattern="config.toml", allow_nonexistent=True)
• The code is well-commented, explaining the purpose of each branch (lines 329, 331)
• Import is properly added at the top of the file

Minor Issue:

In test_install_config_watcher_mixed_existing_and_nonexistent (lines 452-454), there is dead code - the exists_side_effect function is defined but never used. The test actually uses custom_exists instead:

def exists_side_effect(path):
    # Simulate: first config file exists, second doesn't
    return "home" in path or path.endswith("0")

This unused function should be removed to keep the test clean.

Test Coverage

The test coverage is adequate with two new test cases:

1. test_install_config_watcher_for_nonexistent_files (lines 413-442):

   • Verifies watch_dir is called for each config file location when files don't exist
   • Verifies watch_file is NOT called (good negative assertion)
   • Verifies correct parameters (glob_pattern, allow_nonexistent)
   • Verifies callback triggers config reload

2. test_install_config_watcher_mixed_existing_and_nonexistent (lines 444-469):

   • Tests the mixed scenario where some files exist and some don't
   • Verifies correct dispatch between watch_file and watch_dir

The tests follow best practices:

• Include docstrings explaining the test purpose
• Use appropriate mocking
• Include negative assertions (e.g., assert patched_watch_file.call_count == 0)

Backwards Compatibility

This change is fully backwards compatible:

• Existing behavior for watching existing config files remains unchanged (watch_file is still used when files exist)
• The new directory watching only activates when config files don't exist at startup
• No API changes or breaking modifications

Security & Risk

Low risk:

• Uses existing, well-tested watch_dir() infrastructure
• No new attack vectors introduced
• The file watcher only triggers config reload, which is already a supported operation
• Directory watching with allow_nonexistent=True is designed for this exact use case

Edge case consideration:
After verifying the watcher implementation in event_based_path_watcher.py, I confirmed that subsequent modifications to config.toml after creation will also trigger the callback, ensuring the feature works correctly for the full lifecycle.

Recommendations

1. Remove dead code in test (Minor): Remove the unused exists_side_effect function in test_install_config_watcher_mixed_existing_and_nonexistent (line 452-454). This is optional but improves code cleanliness.

Verdict

APPROVED: This is a well-implemented feature that addresses issue #11296 with minimal, clean code changes. The implementation correctly uses existing infrastructure, includes adequate test coverage, and poses no backwards compatibility or security concerns. The only minor issue is a small amount of dead code in the test file that can be addressed as a follow-up if desired.

This is an automated AI review. Please verify the feedback and use your judgment.

📉 Python coverage change detected

The Python unit test coverage has decreased by 0.0007%

• Current PR: 93.0539% (22833 statements, 1586 missed)
• Latest develop: 93.0546% (22821 statements, 1585 missed)

✅ Coverage change is within normal range.

📊 View detailed coverage comparison

Summary

This PR adds directory-based config watchers so config.toml creation is detected, and updates the event-based watcher to hash the watched directory for correct glob filtering. It also adds unit tests covering the new watcher behavior.

Code Quality

Changes are localized and follow existing patterns; the watched_path tracking makes the directory-vs-file behavior explicit. One consistency concern: for directory watches, the early mtime short-circuit still uses the event file path while the MD5 hash uses the watched directory, which could skip a real directory-level change on coarse timestamp filesystems (lib/streamlit/watcher/event_based_path_watcher.py lines 431-452).

Test Coverage

Unit tests cover the new directory glob filtering and file-creation detection behavior in the event-based watcher, plus the new config watcher logic (lib/tests/streamlit/watcher/event_based_path_watcher_test.py lines 520-653, lib/tests/streamlit/web/bootstrap_test.py lines 413-465). No frontend or e2e changes are required here.

Backwards Compatibility

No public API changes; behavior is internal to watcher plumbing. The callback path for directory watches now reflects the watched directory rather than the specific file event, but current internal uses don’t depend on the exact path.

Security & Risk

Low risk. The change is scoped to config file watching and watcher MD5 calculation logic, with tests in place.

Recommendations

1. Consider using watched_path for the mtime check when the matched watch is a directory to keep the short-circuit consistent with the MD5 target and reduce the chance of missing changes on coarse mtime filesystems (lib/streamlit/watcher/event_based_path_watcher.py lines 431-452).

Verdict

APPROVED: Solid, scoped change with good unit coverage and minimal risk.

This is an automated AI review using gpt-5.2-codex-high. Please verify the feedback and use your judgment.

📈 Frontend coverage change detected

The frontend unit test (vitest) coverage has increased by 0.0500%

• Current PR: 86.4500% (13339 lines, 1807 missed)
• Latest develop: 86.4000% (13339 lines, 1814 missed)

🎉 Great job on improving test coverage!

📊 View detailed coverage comparison

Summary

This PR adds allow_nonexistent support for config watchers so creating config.toml triggers reloads, and adjusts event-based watcher MD5 handling to respect glob patterns. It also adds unit tests for watcher behavior and bootstrap config watcher wiring.

Code Quality

• Potential regression: EventBasedPathWatcher.handle_path_change_event now passes watched_path to callbacks for directory events, which strips the actual changed file path (e.g., lib/streamlit/watcher/event_based_path_watcher.py lines 388-460). This breaks path-specific filtering logic such as ComponentFileWatcher._is_in_ignored_directory, which expects a file path to detect ignored directories like node_modules (e.g., lib/streamlit/components/v2/component_file_watcher.py lines 352-402). Consider keeping the callback argument as the actual changed file path while using watched_path only for MD5 calculations.
• Potential regression: The new MD5 computation uses the watched directory path when a directory is watched (same block above), but directory MD5s in calc_md5_with_blocking_retries are based on filenames only (not file contents) (e.g., lib/streamlit/watcher/util.py lines 49-61, 106-111). This means edits to existing files inside watched directories will not trigger callbacks, which can break hot-reload for component asset directories or server.folderWatchList.

Test Coverage

Unit tests were added for event-based and polling watchers and the bootstrap config watcher wiring. However, there is no test asserting that file content changes inside watched directories still trigger callbacks when glob_pattern is used; given the MD5 change, this is a high-risk gap. No e2e or frontend tests are necessary for this backend-only change.

Backwards Compatibility

The callback argument change for directory watches and the loss of file-content change detection in watched directories can alter behavior in existing integrations (component watchers, folder watch list). This is a backwards compatibility risk and should be addressed before merge.

Security & Risk

No direct security issues identified. The main risk is regressions in file watching that can prevent reruns or reloads when files are edited, or trigger reloads for ignored directories.

Recommendations

1. Preserve callback semantics for directory watches by sending the actual changed file path while using watched_path only for MD5 and logging (or provide both paths).
2. Ensure directory watchers still detect file content modifications with glob_pattern (e.g., compute MD5 for matching files or include file mtimes/contents in directory identifiers), and add a targeted unit test for this case.

Verdict

CHANGES REQUESTED: The current watcher behavior can miss file content changes in watched directories and changes callback semantics, both of which risk regressions.

This is an automated AI review using gpt-5.2-codex-high. Please verify the feedback and use your judgment.

Summary

This PR updates config file watching to detect newly created config.toml files by watching the file path directly (with allow_nonexistent=True), clarifies watcher behavior in docstrings, and adds targeted unit tests for event-based/polling watchers and bootstrap configuration watchers. No frontend or protobuf changes.

Code Quality

The changes are small, well-scoped, and follow existing watcher patterns. Docstrings now clarify file vs directory watcher behavior and callback semantics. No structural concerns in the Python code.

Test Coverage

Python unit tests were added to cover the new allow_nonexistent behavior for both event-based and polling watchers, plus plumbing through watch_file and bootstrap config watchers. These tests include positive and negative checks and provide good coverage for the change. No e2e tests were added, which is appropriate given the backend-only scope.

Backwards Compatibility

Backwards compatible. watch_file adds a keyword-only optional parameter and preserves prior behavior by default. Existing call sites should remain unaffected.

Security & Risk

Low risk. The watcher changes are localized and do not affect security-sensitive paths. There is a minor operational edge case: if the parent .streamlit directory does not exist, watchdog scheduling can fail, so config creation might still not be detected in that scenario.

Recommendations

1. Consider handling the case where the parent .streamlit directory is missing by either ensuring the directory exists or watching the parent directory for creation events. This would make “load config on creation” fully reliable on first-run setups. (lib/streamlit/web/bootstrap.py:323-330)
2. New unit tests are missing type annotations, which the Python test guide recommends for new tests. Consider adding types to the new test methods. (lib/tests/streamlit/watcher/event_based_path_watcher_test.py:520-648, lib/tests/streamlit/watcher/polling_path_watcher_test.py:247-306)

Verdict

APPROVED: Solid, low-risk improvement with good unit test coverage; only minor follow-up recommendations.

This is an automated AI review using gpt-5.2-codex-high. Please verify the feedback and use your judgment.

I decided to do a bit more tweaking and enforce usage of the poll based watcher for config files. This should be better for specific paths and is equivalent to what we already do for secrets.toml