Skip to content

fix(skills): point gog brew install at homebrew-core gogcli (#95017)#95019

Merged
vincentkoc merged 1 commit into
openclaw:mainfrom
ZengWen-DT:radar/issue-95017
Jun 22, 2026
Merged

fix(skills): point gog brew install at homebrew-core gogcli (#95017)#95019
vincentkoc merged 1 commit into
openclaw:mainfrom
ZengWen-DT:radar/issue-95017

Conversation

@ZengWen-DT

@ZengWen-DT ZengWen-DT commented Jun 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Onboarding's skill-dependency installer fails to install the gog skill because its bundled metadata points at a Homebrew formula that no longer exists in that tap:

"formula": "steipete/tap/gogcli"

gogcli has since graduated to homebrew-core, and the formula was removed from steipete/tap. The installer builds brew install steipete/tap/gogcli, which now fails with:

Warning: Skipping steipete/tap because it is not trusted. Run `brew trust steipete/tap` to trust it.
Warning: No available formula or cask with the name "steipete/tap/gogcli".

This PR points the gog skill at the canonical core formula gogcli, so the install command becomes brew install gogcli. Using the core formula (vs. openclaw/tap/gogcli) also avoids the third-party-tap trust prompt the reporter hit.

Fixes #95017.

Scope note

Only gog's formula graduated to core. The other steipete/tap/* skills (songsee, camsnap, peekaboo, imsg, etc.) still resolve in that tap, so they are intentionally left unchanged — verified steipete/tap still serves those formulae and no longer serves gogcli.

Verification

Real behavior proof

  • Behavior addressed: gog skill dependency install during onboarding fails because metadata references the removed steipete/tap/gogcli formula; switching to the homebrew-core gogcli formula makes the resolved brew install gogcli command succeed against Homebrew core.

  • Real environment tested: Linux (WSL2) checkout, live network. The dependency contract was checked directly against the live Homebrew formulae API and the steipete/homebrew-tap git repo, and the skill install-spec resolution was exercised through the real skill frontmatter parser and the real install-argv builder.

  • Exact steps or command run after this patch:

    curl -fsSL https://formulae.brew.sh/api/formula/gogcli.json | head -c 200
curl -fsSL -o /dev/null -w "%{http_code}\n" https://raw.githubusercontent.com/steipete/homebrew-tap/main/Formula/gogcli.rb
curl -fsSL -o /dev/null -w "%{http_code}\n" https://raw.githubusercontent.com/steipete/homebrew-tap/main/Formula/songsee.rb
node scripts/run-vitest.mjs <disposable spec exercising parseFrontmatter + resolveOpenClawMetadata against the patched skills/gog/SKILL.md>

  • Evidence after fix: Live output captured after this patch.

    Homebrew core now owns gogcli (matches the reporter's working manual install):

    $ curl -fsSL https://formulae.brew.sh/api/formula/gogcli.json | head -c 200
{"name":"gogcli","full_name":"gogcli","tap":"homebrew/core","oldnames":[],"aliases":[],
"versioned_formulae":[],"desc":"Google Suite CLI","license":"MIT",
"homepage":"https://gogcli.sh","versions":{"stable":"0.29.0","head":"HEAD","bottle":true}

    The old tapped formula is gone, while sibling tap formulae still resolve (so only gog needs changing):

    $ curl ... steipete/homebrew-tap/main/Formula/gogcli.rb   -> 404
$ curl ... steipete/homebrew-tap/main/Formula/songsee.rb  -> 200

    Running the real frontmatter parser + install-argv builder against the patched skills/gog/SKILL.md:

    $ node scripts/run-vitest.mjs <spec>
Test Files  1 passed (1)
     Tests  1 passed (1)
# resolved brew install spec: formula === "gogcli"
# buildInstallArgv output:    ["brew", "install", "gogcli"]

  • Observed result after fix: The resolved install command for gog is now brew install gogcli, which resolves against homebrew-core (HTTP 200 / formula present) instead of the removed, untrusted steipete/tap/gogcli (HTTP 404), eliminating the onboarding install failure.

  • What was not tested: A full end-to-end openclaw onboard run on a fresh VPS that performs the actual brew install (no clean VPS + Homebrew sandbox available here). The failure and fix are fully determined by the resolved brew install <formula> argument and the live Homebrew formula availability shown above.

Notes

  • Data/metadata-only change (one line). No new permanent test added — there is no per-skill-formula test harness, and asserting a single data literal is low value; the disposable parser spec above was used only to capture the proof and then removed.
  • AI-assisted.

@openclaw-barnacle openclaw-barnacle Bot added size: XS triage: mock-only-proof Candidate: PR proof only shows tests, mocks, snapshots, lint, typecheck, or CI. labels Jun 19, 2026
@clawsweeper

clawsweeper Bot commented Jun 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 20, 2026, 6:07 PM ET / 22:07 UTC.

Summary
This PR changes the bundled gog skill Homebrew install metadata from steipete/tap/gogcli to the Homebrew core formula gogcli.

PR surface: Docs 0. Total 0 across 1 file.

Reproducibility: yes. Source inspection shows current main passes the gog metadata formula through to brew install steipete/tap/gogcli, and live Homebrew checks show gogcli is available from Homebrew core while the old tap path returns 404.

Review metrics: 1 noteworthy metric.

  • Skill install metadata: 1 changed, 0 added, 0 removed. This changes the exact Homebrew formula target that onboarding passes to brew install for the bundled gog skill.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #95017
Summary: This PR is the direct candidate fix for the stale gog Homebrew formula issue.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • none.

Risk before merge

  • [P1] A full fresh-VPS openclaw onboard run was not provided; confidence comes from source tracing, PR proof for metadata-to-argv resolution, and live Homebrew formula availability.

Maintainer options:

  1. Decide the mitigation before merge
    Merge this focused metadata update after normal maintainer checks, then let the linked issue close once main points gog at the Homebrew core formula.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • No repair lane is needed because this PR already contains the narrow implementation candidate; the remaining action is normal maintainer review and merge/check handling.

Security
Cleared: No concrete security or supply-chain regression was found; the diff changes the same tool's install target from a removed custom tap path to the current Homebrew core formula.

Review details

Best possible solution:

Merge this focused metadata update after normal maintainer checks, then let the linked issue close once main points gog at the Homebrew core formula.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows current main passes the gog metadata formula through to brew install steipete/tap/gogcli, and live Homebrew checks show gogcli is available from Homebrew core while the old tap path returns 404.

Is this the best way to solve the issue?

Yes. Updating the existing gog skill metadata is the narrowest maintainable fix because the parser and installer already support safe Homebrew core formula names without adding fallback logic.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f18ff7551edc.

Label changes

Label justifications:

  • P2: This is a normal-priority first-run onboarding bug fix with a narrow bundled skill dependency blast radius.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes copied live Homebrew API/tap output and post-patch parser-to-install-argv proof showing the resolved command becomes brew install gogcli.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes copied live Homebrew API/tap output and post-patch parser-to-install-argv proof showing the resolved command becomes brew install gogcli.
Evidence reviewed

PR surface:

Docs 0. Total 0 across 1 file.

View PR surface stats
Area Files Added Removed Net
Source 0 0 0 0
Tests 0 0 0 0
Docs 1 1 1 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 1 1 1 0

What I checked:

  • Current main still has stale metadata: Current main declares the gog brew formula as steipete/tap/gogcli, so the requested fix is not already implemented on main. (skills/gog/SKILL.md:16, f18ff7551edc)
  • PR diff is focused: The live PR diff changes only the gog formula value from steipete/tap/gogcli to gogcli. (skills/gog/SKILL.md:16, 976ce22b54de)
  • Parser accepts the new formula shape: Skill frontmatter parsing normalizes safe brew formula values and stores them on spec.formula; gogcli is within the accepted core-formula pattern. (src/skills/loading/frontmatter.ts:129, f18ff7551edc)
  • Installer command path uses the metadata literal: The skill installer builds brew recipes as brew install <formula>, so this metadata literal controls the failing command. (src/skills/lifecycle/install.ts:179, f18ff7551edc)
  • Onboarding reaches the skill installer: The onboarding skills step invokes installSkill with the selected skill's primary install recipe, matching the linked first-run dependency-install path. (src/commands/onboard-skills.ts:215, f18ff7551edc)
  • Dependency contract check: Homebrew's formula API currently reports gogcli under homebrew/core at stable 0.29.0, while the old steipete/homebrew-tap raw formula URL returns HTTP 404; a sibling tap formula still returned HTTP 200.

Likely related people:

  • steipete: Git history shows Peter Steinberger introduced the gog skill and later added the brew install hint that included steipete/tap/gogcli, with several follow-up gog skill updates. (role: introduced install metadata and frequent gog skill contributor; confidence: high; commits: d1850aaada68, 002d92787447, f84def1b6087; files: skills/gog/SKILL.md)
  • Shakker: Current-main blame for the gog metadata and the skill install/onboarding path points to a recent grafted skills work commit, making this a useful routing signal for the current checkout state. (role: recent area contributor; confidence: medium; commits: 09fcafffbc63; files: skills/gog/SKILL.md, src/skills/lifecycle/install.ts, src/skills/loading/frontmatter.ts)
  • vincentkoc: The latest release tag carries the same stale gog metadata in a release commit authored by Vincent Koc, so this is relevant for shipped-behavior routing even though the original metadata predates that release. (role: release/current-main carrier; confidence: medium; commits: 844f405ac1be; files: skills/gog/SKILL.md)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. labels Jun 19, 2026
@openclaw-barnacle openclaw-barnacle Bot removed the triage: mock-only-proof Candidate: PR proof only shows tests, mocks, snapshots, lint, typecheck, or CI. label Jun 19, 2026
@clawsweeper clawsweeper Bot mentioned this pull request Jun 19, 2026
Closed
@openclaw-barnacle openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed proof: sufficient ClawSweeper judged the real behavior proof convincing. labels Jun 19, 2026
@clawsweeper clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 19, 2026
This was referenced Jun 19, 2026
Closed
Closed
Closed
Closed
Closed
@vincentkoc
vincentkoc merged commit 99551c4 into openclaw:main Jun 22, 2026
34 checks passed
@vincentkoc

vincentkoc commented Jun 22, 2026

Copy link
Copy Markdown
Member

Merged via squash.

Thanks @ZengWen-DT!

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 22, 2026
@ZengWen-DT @vincentkoc
fix(skills): point gog brew install at homebrew-core gogcli (openclaw…
06b2985 
…#95017) (openclaw#95019)

Merged via squash.

Prepared head SHA: a4f489c
Co-authored-by: ZengWen-DT <[email protected]>
Co-authored-by: vincentkoc <[email protected]>
Reviewed-by: @vincentkoc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. proof: supplied External PR includes structured after-fix real behavior proof. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: XS status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: gog skill dependency install fails with stale Homebrew formula

2 participants

@ZengWen-DT @vincentkoc