fix: split pip into local pip and remote pypi sources

Previously, the pip source fell back to 'pip index versions' when a
package wasn't installed locally, but still showed '(installed)' since
pip is marked as a local source. This was misleading.

Now:
- pip: only checks locally installed packages via 'pip show'
- pypi: new remote source using PyPI JSON API

Closes latest-kfr

Author: cv

.beads/last-touched

@@ -1 +1 @@
-latest-2t7.10
+latest-kfr

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "latest"
-version = "0.2.1"
+version = "0.2.2"
 edition = "2024"
 description = "Find the latest version of any command, package, or library"
 license = "MIT"

Cargo.toml

@@ -31,7 +31,7 @@ mod tests {
     #[test]
     fn test_default_has_all_sources() {
         let config = Config::default();
-        assert_eq!(config.precedence.len(), 17);
+        assert_eq!(config.precedence.len(), 18);
     }
 
     #[test]

src/config.rs

@@ -166,6 +166,12 @@ static PUB: JsonApiSource = JsonApiSource {
     url_template: "https://pub.dev/api/packages/{}",
     version_path: "latest.version",
 };
+static PYPI: JsonApiSource = JsonApiSource {
+    name: "pypi",
+    ecosystem: Ecosystem::Python,
+    url_template: "https://pypi.org/pypi/{}/json",
+    version_path: "info.version",
+};
 
 /// Source definitions: (name, `type_variant`, constructor, `is_local`, ecosystem)
 /// This is the SINGLE source of truth.
@@ -210,6 +216,7 @@ define_sources! {
     "npm",      Npm      => &NPM,           false, Ecosystem::Npm;
     "uv",       Uv       => UvSource,       true,  Ecosystem::Python;
     "pip",      Pip      => PipSource,      true,  Ecosystem::Python;
+    "pypi",     Pypi     => &PYPI,          false, Ecosystem::Python;
     "conda",    Conda    => CondaSource,    false, Ecosystem::Python;
     "go",       Go       => &GO,            false, Ecosystem::Go;
     "cargo",    Cargo    => &CARGO,         false, Ecosystem::Cargo;

src/sources/mod.rs

@@ -1,4 +1,4 @@
-use super::{Ecosystem, Source, extract_version, extract_version_field};
+use super::{Ecosystem, Source, extract_version_field};
 use std::process::Command;
 
 pub struct PipSource;
@@ -19,20 +19,12 @@ impl Source for PipSource {
             Command::new("which").arg(cmd).output().map(|o| o.status.success()).unwrap_or(false)
         })?;
 
-        // Try local install first, then PyPI
+        // Only check locally installed packages
         Command::new(pip)
             .args(["show", package])
             .output()
             .ok()
             .filter(|o| o.status.success())
             .and_then(|o| extract_version_field(&String::from_utf8_lossy(&o.stdout)))
-            .or_else(|| {
-                Command::new(pip)
-                    .args(["index", "versions", package])
-                    .output()
-                    .ok()
-                    .filter(|o| o.status.success())
-                    .and_then(|o| extract_version(&String::from_utf8_lossy(&o.stdout)))
-            })
     }
 }