fix(pre-commit): quote Python dependency range by deepujain · Pull Request #91276 · openclaw/openclaw

deepujain · 2026-06-08T00:13:40Z

What Problem This Solves

The local skills-python-tests hook listed the pytest lower and upper bounds as separate YAML flow-sequence values. prek treated the second value as another dependency, while pre-commit rejected the bare <9 requirement, so neither frontend could create the hook environment reliably.

Why This Change Was Made

Quote the complete PEP 508 range as one dependency string: pytest>=8,<9. This keeps the intended pytest compatibility window without adding another hook path or changing the test command.

User Impact

Contributors can run the skills Python hook with either supported pre-commit frontend without dependency parsing failures.

Evidence

uvx --from prek==0.3.9 prek run skills-python-tests --all-files
uvx --from pre-commit==4.2.0 pre-commit run skills-python-tests --all-files
git diff --check origin/main...HEAD

Both live hook runs passed after creating an isolated environment from the quoted range.

deepujain · 2026-06-08T00:13:46Z

Focused pairing-guidance patch is up.

What changed:

the TUI pairing-required disconnect hint now names openclaw devices approve <requestId> explicitly
added a matching assertion in src/tui/tui.test.ts

Validation:

git diff --check
attempted node_modules/.bin/vitest run src/tui/tui.test.ts, but this checkout currently trips a pre-existing getOAuthProviders is not a function startup failure before the TUI tests execute

clawsweeper · 2026-06-08T00:15:54Z

Codex review: needs maintainer review before merge. Reviewed July 5, 2026, 9:44 AM ET / 13:44 UTC.

Summary
The branch changes the skills-python-tests hook dependency from two YAML flow-sequence entries to one quoted pytest>=8,<9 requirement string.

PR surface: Other 0. Total 0 across 1 file.

Reproducibility: yes. Current main parses the hook dependency as pytest>=8 plus standalone <9, and Python packaging rejects standalone <9 as an invalid requirement.

Review metrics: 1 noteworthy metric.

Hook dependency spec: 1 changed. The only semantic change is the dependency string pre-commit forwards to pip for the local skills Python hook.

Root-cause cluster
Relationship: canonical
Canonical: #91276
Summary: This PR is the current viable open landing path for the pre-commit pytest requirement quoting fix; older related PRs are closed unmerged or only partially overlap.

Members:

duplicate: fix(pre-commit): use single pytest dependency specifier #39137 - Closed unmerged PR with the same one-line pre-commit dependency fix.
partial_overlap: fix(voice-call): add staleCallReaperSeconds and webhookSecurity to co… #39109 - Closed unmerged PR that included this pre-commit fix alongside a separate voice-call schema change.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Next step before merge

[P2] No repair job is needed because the open PR already contains the narrow fix with sufficient terminal proof; normal maintainer merge gates are the remaining path.

Security
Cleared: The diff only changes an existing pytest version range into one valid requirement string and does not add a dependency source, permission, secret path, or runtime execution surface.

Review details

Best possible solution:

Land the one-line quoted dependency fix after normal exact-head merge gates, keeping the local hook dependency as a single PEP 508 requirement string.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main parses the hook dependency as pytest>=8 plus standalone <9, and Python packaging rejects standalone <9 as an invalid requirement.

Is this the best way to solve the issue?

Yes. Quoting the full version range as one YAML scalar is the narrow maintainable fix; no broader hook, CI, or dependency refactor is needed.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 245092dc3ae1.

Label changes

Label justifications:

P3: This is a low-blast-radius contributor tooling fix for a local pre-commit hook dependency string, not runtime product behavior.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body and maintainer comment provide terminal proof that both supported hook frontends create the isolated environment and run the skills Python suite after the fix.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body and maintainer comment provide terminal proof that both supported hook frontends create the isolated environment and run the skills Python suite after the fix.

Evidence reviewed

PR surface:

Other 0. Total 0 across 1 file.

View PR surface stats

Area	Files	Added	Removed
Source	0	0	0
Tests	0	0	0
Docs	0	0	0
Config	0	0	0
Generated	0	0	0
Other	1	1	1
Total	1	1	1

What I checked:

Current main source: Current main still has additional_dependencies: [pytest>=8, <9] for the local skills-python-tests hook. (.pre-commit-config.yaml:67, 245092dc3ae1)
Current-main reproduction: Ruby YAML parses the current hook dependencies as ["pytest>=8", "<9"], proving the list is split before pre-commit receives it. (.pre-commit-config.yaml:67, 245092dc3ae1)
Dependency contract: pre-commit v4.2.0 validates additional_dependencies as an array of strings and the Python language installer expands each string into python -mpip install, so list element boundaries are dependency boundaries. (pre_commit/clientlib.py / pre_commit/languages/python.py:215)
Requirement parser proof: Python packaging accepts pytest>=8,<9 and rejects standalone <9 with InvalidRequirement, matching the reported hook setup failure.
PR diff: The PR changes only the dependency scalar to ["pytest>=8,<9"], which is the smallest fix for the split list behavior. (.pre-commit-config.yaml:67, e4a2caf058ab)
Real behavior proof: The PR body and maintainer verification comment report successful live runs with prek==0.3.9 and pre-commit==4.2.0 on the exact-head one-line fix. (e4a2caf058ab)

Likely related people:

vincentkoc: Authored the commit that added the skills Python lint/test pre-commit hook and later recreated the root pre-commit config contents that still contain the split dependency form. (role: introduced behavior and recent area contributor; confidence: high; commits: 76dabd5214b4, e085fa1a3ffd; files: .pre-commit-config.yaml, .github/workflows/ci.yml)
vignesh07: Authored the formatting commit that changed the intended pytest range from pytest>=8,<9 to the current YAML flow sequence spelling with a space after the comma. (role: adjacent contributor; confidence: medium; commits: 5a0eb695fa0f; files: .pre-commit-config.yaml)
steipete: Provided exact-head maintainer verification for this narrow fix and has nearby history on root pre-commit runner stabilization. (role: recent reviewer and adjacent root-config contributor; confidence: medium; commits: 50f233d16d52; files: .pre-commit-config.yaml)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (5 earlier review cycles)

reviewed 2026-07-02T11:35:46.899Z sha e2950a0 :: needs real behavior proof before merge. :: none
reviewed 2026-07-05T09:57:45.772Z sha 21613fa :: needs maintainer review before merge. :: none
reviewed 2026-07-05T10:04:11.369Z sha 21613fa :: needs maintainer review before merge. :: none
reviewed 2026-07-05T11:20:49.944Z sha cdb0596 :: needs maintainer review before merge. :: none
reviewed 2026-07-05T13:38:59.849Z sha e4a2caf :: needs maintainer review before merge. :: none

deepujain · 2026-06-08T02:51:29Z

@clawsweeper re-review

The current head is still the same narrow pairing-guidance patch: it only names openclaw devices approve <requestId> in the disconnect hint and adds the adjacent src/tui/tui.test.ts assertion. The earlier review timed out before evaluating the actual diff, so please retry the durable review on the current head and replace the timeout-only verdict with a real result.

clawsweeper · 2026-06-08T02:51:32Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27113263216
Updated: 2026-06-08T03:00:23.618Z

deepujain · 2026-07-02T09:10:28Z

Rebased onto current main and resolved the TUI recovery-hint conflict by preserving the newer upstream device-approval guidance (approve --latest, explicit <requestId>, auth flag reminder, and scope-upgrade coverage). Verified with node scripts/run-vitest.mjs src/tui/tui.test.ts and git diff --check.

steipete · 2026-07-05T09:53:35Z

Maintainer verification complete on exact head e4a2caf058ababb42a96cbe8b897066aee94dbec.

Changes made:

rebased the contributor fix onto current origin/main
removed the empty CI-refresh commit
kept the patch to one quoted PEP 508 dependency range
retitled and rewrote the PR description to match the actual change

Live proof:

uvx --from prek==0.3.9 prek run skills-python-tests --all-files — passed
uvx --from pre-commit==4.2.0 pre-commit run skills-python-tests --all-files — passed
git diff --check origin/main...HEAD — passed
exact-head GitHub CI — all meaningful checks green

Both frontends created isolated hook environments from pytest>=8,<9 and ran the skills Python suite successfully.

[pytest>=8, <9] is parsed as two items; pip fails on '<9'. Use ["pytest>=8,<9"] so pip gets one valid PEP 440 spec. Pre-commit-only fix from closed openclaw#39109.

steipete · 2026-07-05T13:51:29Z

Merged via squash.

Prepared head SHA: e4a2caf058ababb42a96cbe8b897066aee94dbec
Landed commit: 8a698108e096b5decb2c6ea356697a786ad9d6fa

[pytest>=8, <9] is parsed as two items; pip fails on '<9'. Use ["pytest>=8,<9"] so pip gets one valid PEP 440 spec. Pre-commit-only fix from closed openclaw#39109.

openclaw-barnacle Bot added size: XS triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 8, 2026

clawsweeper Bot added the rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. label Jun 8, 2026

deepujain force-pushed the fix/67618-pairing-approve-hint branch from 6bf8df9 to e2950a0 Compare July 2, 2026 09:09

openclaw-barnacle Bot added the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 2, 2026

clawsweeper Bot added the merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. label Jul 2, 2026

steipete force-pushed the fix/67618-pairing-approve-hint branch from e2950a0 to 21613fa Compare July 5, 2026 09:52

steipete changed the title ~~fix(tui): include pairing approval command in recovery hint (Fixes #67618)~~ fix(pre-commit): quote Python dependency range Jul 5, 2026

openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 5, 2026

openclaw-barnacle Bot added docs Improvements or additions to documentation app: android App: android app: web-ui App: web-ui gateway Gateway runtime scripts Repository scripts labels Jul 5, 2026

openclaw-barnacle Bot added size: XS and removed agents Agent runtime and tooling size: XL labels Jul 5, 2026

steipete force-pushed the fix/67618-pairing-approve-hint branch 3 times, most recently from f32f97e to 3e37518 Compare July 5, 2026 13:20

openclaw-barnacle Bot added channel: voice-call Channel integration: voice-call app: web-ui App: web-ui scripts Repository scripts size: XL and removed size: XS labels Jul 5, 2026

steipete force-pushed the fix/67618-pairing-approve-hint branch from a522d33 to 4333422 Compare July 5, 2026 13:30

openclaw-barnacle Bot added size: XS and removed channel: voice-call Channel integration: voice-call app: web-ui App: web-ui scripts Repository scripts size: XL labels Jul 5, 2026

fix(pre-commit): use single pytest dependency specifier

e4a2caf

[pytest>=8, <9] is parsed as two items; pip fails on '<9'. Use ["pytest>=8,<9"] so pip gets one valid PEP 440 spec. Pre-commit-only fix from closed openclaw#39109.

steipete force-pushed the fix/67618-pairing-approve-hint branch from 4333422 to e4a2caf Compare July 5, 2026 13:36

steipete merged commit 8a69810 into openclaw:main Jul 5, 2026
146 of 151 checks passed

github-actions Bot mentioned this pull request Jul 5, 2026

📡 Upstream Digest — 2026-07-05 15:06 UTC curtismercier/openclaw-mods#1215

Open

clawsweeper Bot mentioned this pull request Jul 5, 2026

docs: document context engine running summaries #100400

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(pre-commit): quote Python dependency range#91276

fix(pre-commit): quote Python dependency range#91276
steipete merged 1 commit into
openclaw:mainfrom
deepujain:fix/67618-pairing-approve-hint

deepujain commented Jun 8, 2026 •

edited by steipete

Loading

Uh oh!

deepujain commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

deepujain commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

deepujain commented Jul 2, 2026

Uh oh!

steipete commented Jul 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

steipete commented Jul 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

deepujain commented Jun 8, 2026 • edited by steipete Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

deepujain commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deepujain commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deepujain commented Jul 2, 2026

Uh oh!

steipete commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

steipete commented Jul 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

deepujain commented Jun 8, 2026 •

edited by steipete

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

steipete commented Jul 5, 2026 •

edited

Loading