Add dependency sources to poetry show

[wolfgang-aura]

poetry show lists dependency names, versions, and descriptions, but it does not identify where each package came from. This makes it difficult to distinguish PyPI packages, configured package sources, and direct-origin dependencies in the same environment.

The command discarded the resolved package source while formatting its flat table and JSON output. This change adds --source, derives a readable source from the resolved package, and includes it in flat text, single-package, and JSON output. PyPI packages are labelled PyPI, configured repositories use their source name, and direct dependencies show their actual URL. Because tree output has a different recursive format, combining --source with --tree now fails explicitly instead of silently ignoring the option.

Tests cover PyPI and configured sources, direct URLs, JSON and text output, truncation behaviour, and the tree-mode error. Documentation for poetry show now describes the option.

Verification on Windows 11 with Python 3.14.3: the focused source tests passed (8 passed). The wider test_show.py run reached 87 passes but had two environment-related failures caused by the installed poetry-core API not accepting this checkout's splitext(..., is_filename=...) call; CI still needs to run the supported matrix, mypy, and pre-commit checks.

An alternative was to add source data to tree output. That would require changing the recursive tree presentation and increase the scope of this focused feature, so this patch rejects the combination clearly instead.

Resolves #10967.

This change was implemented and reviewed with codex/gpt-5.6-luna through the Mailman harness. The submitting human must review the diff and take responsibility for the contribution before filing.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Approved.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

Sourcery assessment

Approved.