python: expand service and testing workflows - #165
Conversation
Why: Add the missing FastAPI and FastMCP maintenance guidance, replace the narrow pytest skill, and reconcile portable exports and bootstrap policy. Verification: uv run scripts/validate_repo_metadata.py uv run pytest uv run ruff check . uv run mypy . uv run scripts/validate_socket_metadata.py uv run scripts/validate_claude_compatibility.py uv run scripts/export_hermes_skills.py --check uv run scripts/validate_hermes_compatibility.py uv run mypy
ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (55)
💤 Files with no reviewable changes (4)
📝 WalkthroughWalkthroughThe PR expands the Python skills plugin with FastAPI, FastMCP, and Python testing workflows; replaces the legacy pytest skill; centralizes bootstrap policies; removes packaged ChangesPython skills workflow expansion
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cc81a940a7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Do not overwrite a non-empty target or existing `pyproject.toml` without the | ||
| entrypoint's explicit force flag. Initialize git only when requested by the |
There was a problem hiding this comment.
When a target already contains pyproject.toml, this shared contract implies that supplying the entrypoint's force flag permits overwriting it, but skills/bootstrap-uv-python-workspace/scripts/init_uv_python_project.sh explicitly refuses the overwrite even with --force, and the FastAPI/FastMCP entrypoints delegate to that scaffold. This makes the newly authoritative contract impossible to follow; clarify that --force permits a non-empty directory but never an existing pyproject.toml.
AGENTS.md reference: AGENTS.md:L60-L61
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🧹 Nitpick comments (1)
plugins/python-skills/skills/python-package-workflow/SKILL.md (1)
91-104: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSmoke-check commands match upstream uv guidance; tighten the lead-in prose.
The
uv run --isolated --no-project --with dist/*.whl tests/smoke_test.pypattern matches astral-sh's own documented release-workflow example. However, the sentence introducing it ("create a temporary consumer outside the package tree and install the built artifact there") describes a manual external-directory approach that the shown commands don't actually use —--isolated --no-projectalready provides isolation without needing a directory outside the package tree. Consider rewording the lead-in so it doesn't imply an extra manual step.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/python-skills/skills/python-package-workflow/SKILL.md` around lines 91 - 104, Revise the lead-in before the uv smoke-check commands to describe using an isolated, no-project environment to test the built artifact, rather than requiring a temporary consumer directory outside the package tree. Keep the existing wheel/sdist commands and smoke-test guidance unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/maintainers/python-skills-plugin-plan.md`:
- Around line 77-80: Update the documentation passage describing the older
twelve-skill architecture metadata claim. Since
docs/architecture/architecture.json now lists all fifteen Python skill
manifests, either present the twelve-skill statement strictly as historical
context or state that the regenerated metadata is synchronized, while preserving
the current fifteen-skill inventory as the audit source of truth.
In `@plugins/python-skills/shared/bootstrap-contract.md`:
- Line 58: Update the “Test setup or testing workflow” entry in the routing
table to explicitly scope it to existing-project test setup and maintenance,
while directing initial pytest/Ruff/mypy scaffolding to
bootstrap-uv-python-workspace.
In `@plugins/python-skills/skills/build-python-agent-service/SKILL.md`:
- Line 10: Restrict the allowed-tools entry in the build-python-agent-service
skill so Bash(uv:*) is replaced by only the specific uv subcommands required by
the workflow, preventing arbitrary Python execution through uv run variants. Add
regression coverage for uv run python -c, uv run -m, and uv run --with ...
python bypass forms, while retaining the check that Bash(python:*) is absent.
In `@plugins/python-skills/skills/fastapi-service-workflow/SKILL.md`:
- Line 3: Shorten the exported frontmatter descriptions to the repository’s
accepted length while preserving their core scope. Apply the same shortened
FastAPI description in
plugins/python-skills/skills/fastapi-service-workflow/SKILL.md:3 and
skills/fastapi-service-workflow/SKILL.md:3, and the same shortened FastMCP
description in plugins/python-skills/skills/fastmcp-service-workflow/SKILL.md:3
and skills/fastmcp-service-workflow/SKILL.md:3.
In
`@plugins/python-skills/skills/python-testing-workflow/references/uv-workspace-testing.md`:
- Around line 16-18: Update the package-scoped testing guidance in
uv-workspace-testing.md and the corresponding command in SKILL.md to run pytest
from the selected workspace member, using uv’s --directory <member-dir> option
or explicitly documenting the required working directory; ensure tests/unit
resolves relative to that member in both affected files.
In
`@plugins/python-skills/skills/python-testing-workflow/scripts/bootstrap_pytest_uv.sh`:
- Line 10: Update the SKILL_NAME-derived profile handling in
plugins/python-skills/skills/python-testing-workflow/scripts/bootstrap_pytest_uv.sh
(lines 10-10) and run_pytest_uv.sh (lines 9-9) to load or migrate profiles from
the previous workflow namespace when the renamed namespace is absent. Document
the required one-time migration in skills/python-testing-workflow/SKILL.md
(lines 63-64), including the old and new namespaces and the expected user
action.
In `@plugins/python-skills/skills/python-testing-workflow/SKILL.md`:
- Around line 3-10: Update the frontmatter allowed-tools declaration in the
Python testing workflow skill to authorize Bash commands beginning with
scripts/bootstrap_pytest_uv.sh and scripts/run_pytest_uv.sh, while preserving
the existing uv and Read permissions.
In `@ROADMAP.md`:
- Around line 173-176: Resolve the contradictory pytest migration status in
ROADMAP.md by updating the earlier scope item that says the existing pytest
skill surfaces remain intact, or explicitly documenting the exception for
uv-pytest-unit-testing. Ensure the roadmap consistently reflects whether that
skill was replaced while preserving the broader migration status.
In `@skills/python-testing-workflow/SKILL.md`:
- Line 10: Align the allowed-tools declaration in SKILL.md with the documented
workflow commands: either add Bash permissions for
scripts/bootstrap_pytest_uv.sh and scripts/run_pytest_uv.sh, or change those
examples to use only uv-prefixed commands. Keep the permissions and examples
consistent.
---
Nitpick comments:
In `@plugins/python-skills/skills/python-package-workflow/SKILL.md`:
- Around line 91-104: Revise the lead-in before the uv smoke-check commands to
describe using an isolated, no-project environment to test the built artifact,
rather than requiring a temporary consumer directory outside the package tree.
Keep the existing wheel/sdist commands and smoke-test guidance unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 982f914e-3181-4ccc-8934-216ca4bff702
📒 Files selected for processing (55)
README.mdROADMAP.mddocs/agents/bundled-subagent-role-candidates.mddocs/architecture/ARCHITECTURE.mddocs/architecture/architecture.jsondocs/maintainers/hermes-compatibility.mddocs/maintainers/python-skills-plugin-plan.mdplugins/python-skills/.codex-plugin/plugin.jsonplugins/python-skills/shared/bootstrap-contract.mdplugins/python-skills/skills/bootstrap-python-mcp-service/SKILL.mdplugins/python-skills/skills/bootstrap-python-mcp-service/agents/openai.yamlplugins/python-skills/skills/bootstrap-python-mcp-service/references/fastmcp-docs-lookup.mdplugins/python-skills/skills/bootstrap-python-service/SKILL.mdplugins/python-skills/skills/bootstrap-uv-python-workspace/SKILL.mdplugins/python-skills/skills/build-python-agent-service/SKILL.mdplugins/python-skills/skills/choose-python-project-shape/SKILL.mdplugins/python-skills/skills/fastapi-service-workflow/SKILL.mdplugins/python-skills/skills/fastapi-service-workflow/agents/openai.yamlplugins/python-skills/skills/fastmcp-service-workflow/SKILL.mdplugins/python-skills/skills/fastmcp-service-workflow/agents/openai.yamlplugins/python-skills/skills/integrate-fastapi-fastmcp/SKILL.mdplugins/python-skills/skills/integrate-fastapi-fastmcp/agents/openai.yamlplugins/python-skills/skills/python-ci-workflow/SKILL.mdplugins/python-skills/skills/python-package-workflow/SKILL.mdplugins/python-skills/skills/python-testing-workflow/SKILL.mdplugins/python-skills/skills/python-testing-workflow/agents/openai.yamlplugins/python-skills/skills/python-testing-workflow/assets/profiles/bootstrap_pytest_uv.config.yamlplugins/python-skills/skills/python-testing-workflow/assets/profiles/run_pytest_uv.config.yamlplugins/python-skills/skills/python-testing-workflow/references/customization.mdplugins/python-skills/skills/python-testing-workflow/references/interactive-customization.mdplugins/python-skills/skills/python-testing-workflow/references/pytest-workflow.mdplugins/python-skills/skills/python-testing-workflow/references/uv-workspace-testing.mdplugins/python-skills/skills/python-testing-workflow/scripts/bootstrap_pytest_uv.shplugins/python-skills/skills/python-testing-workflow/scripts/run_pytest_uv.shplugins/python-skills/skills/uv-pytest-unit-testing/SKILL.mdplugins/python-skills/skills/uv-pytest-unit-testing/agents/openai.yamlplugins/python-skills/tests/test_build_python_agent_service_skill.pyplugins/python-skills/tests/test_plugin_smoke.pyscripts/export_hermes_skills.pyskills.sh.jsonskills/build-python-agent-service/SKILL.mdskills/fastapi-service-workflow/SKILL.mdskills/fastapi-service-workflow/agents/openai.yamlskills/fastmcp-service-workflow/SKILL.mdskills/fastmcp-service-workflow/agents/openai.yamlskills/python-testing-workflow/SKILL.mdskills/python-testing-workflow/agents/openai.yamlskills/python-testing-workflow/assets/profiles/bootstrap_pytest_uv.config.yamlskills/python-testing-workflow/assets/profiles/run_pytest_uv.config.yamlskills/python-testing-workflow/references/customization.mdskills/python-testing-workflow/references/interactive-customization.mdskills/python-testing-workflow/references/pytest-workflow.mdskills/python-testing-workflow/references/uv-workspace-testing.mdskills/python-testing-workflow/scripts/bootstrap_pytest_uv.shskills/python-testing-workflow/scripts/run_pytest_uv.sh
💤 Files with no reviewable changes (4)
- plugins/python-skills/skills/uv-pytest-unit-testing/agents/openai.yaml
- plugins/python-skills/skills/uv-pytest-unit-testing/SKILL.md
- plugins/python-skills/skills/bootstrap-python-mcp-service/agents/openai.yaml
- plugins/python-skills/skills/integrate-fastapi-fastmcp/agents/openai.yaml
| The shipped inventory has fifteen skills. The original expansion plan below | ||
| predates the later local-first agent-service addition, so this list is the | ||
| current source of truth for the audit rather than the older twelve-skill | ||
| summary in generated architecture metadata. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Update the stale architecture-metadata claim.
Line 77-80 says the generated architecture metadata still contains an older twelve-skill summary, but docs/architecture/architecture.json now lists the fifteen Python skill manifests, including the new service and testing workflows. Reword this as historical context or state that the regenerated metadata is synchronized.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/maintainers/python-skills-plugin-plan.md` around lines 77 - 80, Update
the documentation passage describing the older twelve-skill architecture
metadata claim. Since docs/architecture/architecture.json now lists all fifteen
Python skill manifests, either present the twelve-skill statement strictly as
historical context or state that the regenerated metadata is synchronized, while
preserving the current fifteen-skill inventory as the audit source of truth.
| | New FastMCP server | `bootstrap-python-mcp-service` | | ||
| | Existing FastAPI and FastMCP integration | `integrate-fastapi-fastmcp` | | ||
| | Existing-project implementation | `build-python-project` | | ||
| | Test setup or testing workflow | `python-testing-workflow` | |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Disambiguate initial test scaffolding from test maintenance.
Line 58 routes “Test setup” to python-testing-workflow, while the inventory says bootstrap-uv-python-workspace owns initial pytest/Ruff/mypy setup. Since this contract is read by bootstrap skills, new-project requests can be routed to the maintenance workflow instead of the bootstrap path. Change this to “Existing-project test setup or testing workflow,” or explicitly distinguish the two cases.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/python-skills/shared/bootstrap-contract.md` at line 58, Update the
“Test setup or testing workflow” entry in the routing table to explicitly scope
it to existing-project test setup and maintenance, while directing initial
pytest/Ruff/mypy scaffolding to bootstrap-uv-python-workspace.
| repo: python-skills | ||
| category: python-agent-service | ||
| allowed-tools: Read Bash(rg:*) Bash(git:*) Bash(uv:*) Bash(python:*) | ||
| allowed-tools: Read Bash(rg:*) Bash(git:*) Bash(uv:*) |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repo files around target:"
fd -a 'SKILL.md|openai.yaml|README|.*permission.*|.*allowed.*|.*tool.*' . | sed 's#^\./##' | head -200
echo
echo "Target file:"
cat -n plugins/python-skills/skills/build-python-agent-service/SKILL.md | sed -n '1,120p'
echo
echo "Partner file if present:"
if [ -f plugins/python-skills/skills/build-python-agent-service/agents/openai.yaml ]; then
cat -n plugins/python-skills/skills/build-python-agent-service/agents/openai.yaml | sed -n '1,240p'
fi
echo
echo "Search permission/allowed-tools/config for Bash(:*) wildcards:"
rg -n --hidden --glob '!**/.git/**' 'allowed-tools|Bash\(|Bash\([^)]*\):|\*\)' plugins .github scripts README.md 2>/dev/null | sed -n '1,240p'
echo
echo "Search documentation/tests mentioning Bash(python:*)/uv run/allowed tools:"
rg -n --hidden --glob '!**/.git/**' 'Bash\(python:\*|Bash\(uv:\*|allowed-tools|uv run|uv run python|Bash\(.*:\*\)' . | sed -n '1,320p'Repository: gaelic-ghost/socket
Length of output: 18886
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Target files:"
sed -n '1,80p' plugins/python-skills/skills/build-python-agent-service/SKILL.md || true
if [ -f plugins/python-skills/skills/build-python-agent-service/agents/openai.yaml ]; then
sed -n '1,220p' plugins/python-skills/skills/build-python-agent-service/agents/openai.yaml
fi
echo
echo "Target directory files:"
git ls-files plugins/python-skills/skills/build-python-agent-service
echo
echo "Locate host/matcher/permission docs and tests:"
for f in README.md docs/agents/README.md docs/maintainers/xcode-27-agentic-tooling-plan.md plugins/speak-swiftly-server README.md; do
if [ -f "$f" ]; then
echo "--- $f"
rg -n --hidden --glob '!**/.git/**' 'allowed-tools|Bash\(|matcher|permission|tools' "$f" || true
fi
done
echo
echo "Find test files mentioning allowed tools or Bash wildcards"
find . -path './.git' -prune -o \( -name '*test*.py' -o -name '*test*' \) -print | sed 's#^\./##' | head -200 | while read -r f; do
if rg -q 'allowed-tools|Bash\(python:\*|Bash\(uv:\*|uv run|rg:|git:' "$f" 2>/dev/null; then
echo "--- $f"
rg -n 'allowed-tools|Bash\(python:\*|Bash\(uv:\*|uv run|rg:|git:' "$f" || true
fi
done | sed -n '1,320p'
echo
echo "Find Python scripts or configs mentioning Bash allowed-tools:"
find . -path './.git' -prune -o \( -name '*.py' -o -name '*.yaml' -o -name '*.yml' -o -name '*.json' \) -print | while read -r f; do
if [ -f "$f" ] && rg -q 'allowed-tools|Bash\([A-Za-z]' "$f" 2>/dev/null; then
echo "--- $f"
rg -n 'allowed-tools|Bash\([A-Za-z]' "$f" | sed -n '1,60p' || true
fi
done | sed -n '1,260p'Repository: gaelic-ghost/socket
Length of output: 17934
Keep Bash(uv:*) scoped to the required uv subcommands.
Removing Bash(python:*) does not block arbitrary Python execution if the host matcher allows wildcard arguments: uv run python -c ..., uv run -m ..., or uv run --with ... python ... still route through an allowed Bash(uv:*) tool. Replace the catch-all with only the uv commands this workflow needs and add regression coverage for these bypass forms; the regression only checks that Bash(python:*) is absent.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/python-skills/skills/build-python-agent-service/SKILL.md` at line 10,
Restrict the allowed-tools entry in the build-python-agent-service skill so
Bash(uv:*) is replaced by only the specific uv subcommands required by the
workflow, preventing arbitrary Python execution through uv run variants. Add
regression coverage for uv run python -c, uv run -m, and uv run --with ...
python bypass forms, while retaining the check that Bash(python:*) is absent.
| @@ -0,0 +1,89 @@ | |||
| --- | |||
| name: fastapi-service-workflow | |||
| description: Maintain existing uv-managed FastAPI services, including route and dependency composition, typed settings, lifespan, async and integration testing, OpenAPI review, deployment-readiness handoff, and service-specific diagnostics. | |||
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Shorten the exported skill descriptions to clear Hermes compatibility warnings.
The PR validation reports description-length warnings for Hermes exports. Shorten each frontmatter description to the repository’s accepted limit while preserving its key scope.
plugins/python-skills/skills/fastapi-service-workflow/SKILL.md#L3-L3: shorten the FastAPI description.skills/fastapi-service-workflow/SKILL.md#L3-L3: apply the same shortened description.plugins/python-skills/skills/fastmcp-service-workflow/SKILL.md#L3-L3: shorten the FastMCP description.skills/fastmcp-service-workflow/SKILL.md#L3-L3: apply the same shortened description.
📍 Affects 4 files
plugins/python-skills/skills/fastapi-service-workflow/SKILL.md#L3-L3(this comment)skills/fastapi-service-workflow/SKILL.md#L3-L3plugins/python-skills/skills/fastmcp-service-workflow/SKILL.md#L3-L3skills/fastmcp-service-workflow/SKILL.md#L3-L3
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/python-skills/skills/fastapi-service-workflow/SKILL.md` at line 3,
Shorten the exported frontmatter descriptions to the repository’s accepted
length while preserving their core scope. Apply the same shortened FastAPI
description in plugins/python-skills/skills/fastapi-service-workflow/SKILL.md:3
and skills/fastapi-service-workflow/SKILL.md:3, and the same shortened FastMCP
description in plugins/python-skills/skills/fastmcp-service-workflow/SKILL.md:3
and skills/fastmcp-service-workflow/SKILL.md:3.
| DRY_RUN=0 | ||
|
|
||
| SKILL_NAME="uv-pytest-unit-testing" | ||
| SKILL_NAME="python-testing-workflow" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Migrate existing customization profiles when renaming the workflow.
The SKILL_NAME rename changes the derived profile namespace, so existing profiles are silently ignored unless a fallback or explicit migration is provided.
plugins/python-skills/skills/python-testing-workflow/scripts/bootstrap_pytest_uv.sh#L10-L10: load or migrate the old bootstrap profile namespace.plugins/python-skills/skills/python-testing-workflow/scripts/run_pytest_uv.sh#L9-L9: load or migrate the old run profile namespace.skills/python-testing-workflow/SKILL.md#L63-L64: document the required one-time migration.
📍 Affects 3 files
plugins/python-skills/skills/python-testing-workflow/scripts/bootstrap_pytest_uv.sh#L10-L10(this comment)plugins/python-skills/skills/python-testing-workflow/scripts/run_pytest_uv.sh#L9-L9skills/python-testing-workflow/SKILL.md#L63-L64
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@plugins/python-skills/skills/python-testing-workflow/scripts/bootstrap_pytest_uv.sh`
at line 10, Update the SKILL_NAME-derived profile handling in
plugins/python-skills/skills/python-testing-workflow/scripts/bootstrap_pytest_uv.sh
(lines 10-10) and run_pytest_uv.sh (lines 9-9) to load or migrate profiles from
the previous workflow namespace when the renamed namespace is absent. Document
the required one-time migration in skills/python-testing-workflow/SKILL.md
(lines 63-64), including the old and new namespaces and the expected user
action.
| description: Set up, run, and improve Python tests in uv projects and workspaces. Use for pytest configuration, focused and package-targeted runs, fixtures, parametrization, async and integration tests, coverage, CI parity, or failure triage. | ||
| license: Apache-2.0 | ||
| compatibility: Designed for Codex and compatible Agent Skills clients on macOS with uv-managed Python projects, pytest, and shell access for the bundled setup and execution scripts. | ||
| metadata: | ||
| owner: gaelic-ghost | ||
| repo: python-skills | ||
| category: python-testing | ||
| allowed-tools: Bash(uv:*) Read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Does Claude Code's allowed-tools Bash() pattern match only the literal command prefix, or does it also permit shell scripts that internally call the allowed command?
💡 Result:
Claude Code's Bash permission rules operate on the literal command string provided to the tool, and they do not automatically "permit" shell scripts (like.sh files) simply because the internal commands inside those scripts might match an allowlist [1][2]. The Bash tool's permission mechanism functions as follows: 1. Matching Process: Claude Code matches the specific string generated by the AI (or command-line instruction) against the configured allow/deny patterns [2][3]. These rules support glob patterns (e.g., Bash(npm run *)) [1][4]. 2. Script Execution: If Claude Code is instructed to execute a shell script (e.g.,./myscript.sh), it evaluates that specific command (the execution of the script itself) against the permission rules [3]. If you have an allow rule for Bash(npm run *), it does not grant blanket permission for a shell script to run those same commands unless the execution of the script itself is permitted [4]. 3. Compound Commands: Claude Code is designed to parse compound commands (e.g., using &&,;, |, ||) and evaluates each subcommand segment independently against the permission rules [4][3]. Each segment must independently satisfy the allowlist; it does not "permit" the entire chain based on a single prefix match [5][3]. 4. Security Enforcement: The system employs security validators and path constraints that operate on the command string before execution [3]. Because it evaluates the command emitted for execution, attempting to "hide" unapproved actions inside a script simply shifts the requirement to permit the script's execution path, rather than bypassing the need to authorize the specific command being run [4][3]. In summary, the allowlist pattern matching is not transitive; it does not inspect the contents of scripts to permit them based on their internal logic. To allow a shell script, you must explicitly permit the command used to invoke that script [1][4].
Citations:
- 1: https://code.claude.com/docs/en/permissions
- 2: https://aitoolsguidebook.com/en/articles/claude-code-bash-sandbox-blocks-command/
- 3: https://claude-code-explain.helmcode.com/bash-security/
- 4: https://getclaudekit.com/blog/guide/mechanics/permission-model
- 5: Chained bash commands silently bypass the tool permission allowlist anthropics/claude-code#36637
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== candidate files =="
git ls-files | rg 'plugins/python-skills/skills/python-testing-workflow/(SKILL.md|agents/openai.yaml|scripts/).*' || true
echo
echo "== SKILL.md lines 1-90 =="
cat -n plugins/python-skills/skills/python-testing-workflow/SKILL.md | sed -n '1,90p'
echo
echo "== openai.yaml lines 1-160 =="
cat -n plugins/python-skills/skills/python-testing-workflow/agents/openai.yaml | sed -n '1,160p'
echo
echo "== scripts =="
find plugins/python-skills/skills/python-testing-workflow/scripts -maxdepth 1 -type f -print -exec sh -c 'echo "--- $1"; sed -n "1,80p" "$1"' sh {} \;
echo
echo "== allowed-tools patterns in python-skills skill frontmatter =="
rg -n '^allowed-tools:' plugins/python-skills/skills -A2 || trueRepository: gaelic-ghost/socket
Length of output: 14183
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
skill = Path("plugins/python-skills/skills/python-testing-workflow/SKILL.md")
text = skill.read_text()
m = re.search(r'allowed-tools:\s*(.*?)(?:\n(?:metadata:|description:|compatibility:|license:|$))', text, re.S)
allowed = (m.group(1).splitlines()[0].strip() if m else "")
print("allowed-tools:", allowed)
target_commands = [
"scripts/bootstrap_pytest_uv.sh",
"./scripts/bootstrap_pytest_uv.sh",
"bash scripts/bootstrap_pytest_uv.sh",
"run_pytest_uv.sh",
"./run_pytest_uv.sh",
"uv",
"uv test",
]
def matches(command):
# Model Claude-style Bash(prefix*) literal command-prefix matching discussed by verification source:
# exact/substring comparison is not enough for compound commands, but keep this concise because commands here are simple.
return any(command.startswith(prefix.rstrip("*")) for prefix in allowed.split())
for cmd in target_commands:
print(cmd, "=>", matches(cmd))
PYRepository: gaelic-ghost/socket
Length of output: 398
Add allowed-tools entries for the bundled script commands.
allowed-tools: Bash(uv:*) Read only authorizes Bash commands starting with uv, but the documented setup/execution entry points invoke scripts/bootstrap_pytest_uv.sh and scripts/run_pytest_uv.sh directly. Add Bash permissions for those command prefixes so agents are not blocked at the documented workflow step.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/python-skills/skills/python-testing-workflow/SKILL.md` around lines 3
- 10, Update the frontmatter allowed-tools declaration in the Python testing
workflow skill to authorize Bash commands beginning with
scripts/bootstrap_pytest_uv.sh and scripts/run_pytest_uv.sh, while preserving
the existing uv and Read permissions.
| - [x] Replace `python-skills:uv-pytest-unit-testing` with the broader `python-skills:python-testing-workflow` without a duplicate compatibility surface. | ||
| - [x] Update Python plugin metadata after the first new skill slice lands. | ||
| - [x] Run child validation with `uv run scripts/validate_repo_metadata.py`, `uv run pytest`, `uv run ruff check .`, and `uv run mypy .`. | ||
| - [ ] Run root metadata validation with `uv run scripts/validate_socket_metadata.py`. | ||
| - [x] Run root metadata validation with `uv run scripts/validate_socket_metadata.py`. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Resolve the contradictory pytest migration status.
Line 161 still says the existing pytest skill surfaces remain intact, while this checklist says uv-pytest-unit-testing was replaced. Update the earlier scope item or explicitly document the exception so the roadmap reflects the actual inventory.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ROADMAP.md` around lines 173 - 176, Resolve the contradictory pytest
migration status in ROADMAP.md by updating the earlier scope item that says the
existing pytest skill surfaces remain intact, or explicitly documenting the
exception for uv-pytest-unit-testing. Ensure the roadmap consistently reflects
whether that skill was replaced while preserving the broader migration status.
| owner: gaelic-ghost | ||
| repo: python-skills | ||
| category: python-testing | ||
| allowed-tools: Bash(uv:*) Read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== candidate files =="
git ls-files | rg '(^skills/python-testing-workflow/SKILL\.md$|^skills/python-testing-workflow/scripts/|allowed-tools|Bash\()'
echo
echo "== SKILL front matter and relevant examples =="
cat -n skills/python-testing-workflow/SKILL.md | sed -n '1,90p'
echo
echo "== scripts permissions and contents =="
for f in $(git ls-files skills/python-testing-workflow/scripts); do
echo "--- $f ---"
ls -la "$f"
sed -n '1,80p' "$f"
done
echo
echo "== allowed-tools usage across python-testing-workflow =="
rg -n "allowed-tools|allowed_tools|Bash|Read|scripts/bootstrap_pytest_uv.sh|scripts/run_pytest_uv.sh|uv run|uv" skills/python-testing-workflow/skills 2>/dev/null || true
rg -n "allowed-tools|allowed_tools|Bash|Read|scripts/bootstrap_pytest_uv.sh|scripts/run_pytest_uv.sh|uv run|uv" skills/python-testing-workflow -g '!skits/*' 2>/dev/null || trueRepository: gaelic-ghost/socket
Length of output: 16083
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repository-wide Bash permission syntax =="
rg -n "allowed-tools: Bash\(|allowed-tools|allowed_tools" -g 'SKILL.md' -g '/*.md' -g '*.yaml' .
echo
echo "== nearby SKILL permissions =="
for f in $(git ls-files '**/SKILL.md' | head -50); do
if rg -q '^allowed-tools:|allowed_tools:' "$f"; then
echo "--- $f ---"
sed -n '1,16p' "$f"
fi
done
echo
echo "== scripts entry and run_cmd usage in scripts =="
python3 - <<'PY'
from pathlib import Path
import re
for p in [Path("skills/python-testing-workflow/scripts/bootstrap_pytest_uv.sh"),
Path("skills/python-testing-workflow/scripts/run_pytest_uv.sh")]:
text = p.read_text()
print(f"--- {p} ---")
for i, line in enumerate(text.splitlines(), 1):
if re.search(r'function run_cmd|run_cmd=|run_cmd \(', line):
print(f"{i}: {line}")
# Show first and last 8 lines.
lines = text.splitlines()
print("first 12:")
for i,l in enumerate(lines[:12],1):
print(f"{i}: {l}")
print("last 12:")
for i,l in enumerate(lines[-12:], len(lines)-11):
print(f"{i}: {l}")
PYRepository: gaelic-ghost/socket
Length of output: 17887
🌐 Web query:
Codex agent skills Bash allowed tools prefix syntax Bash(file:*) Bash(uv:*) SKILL.md
💡 Result:
In the context of Codex agents, Bash is a primary tool used for task execution, often within a sandbox or pseudo-terminal (PTY) environment [1][2]. The syntax Bash(file:) and Bash(uv:) are not standard primitive keywords in the official Codex tool surface but represent pattern-based task instructions or references used within skill files (SKILL.md) to manage file scopes or package management [3][4]. Skill Syntax and SKILL.md The SKILL.md file serves as the instruction manual for an agent [4][5]. It must include YAML frontmatter defining metadata like name and description, and can optionally include an allowed-tools list [3][6]. Agents use this file to understand how to interact with the environment, apply guidelines, and execute tasks [3][4]. The "file:" or "uv:" syntax often appears in community or advanced agent configurations as a shorthand convention to inform the agent: 1. Bash(file:): Often used in prompt instructions or skill references to signal that the agent should only operate on specific files or within the defined file system boundary of the current task [7][8]. 2. Bash(uv:): Used to signify tasks that leverage uv for dependency management, script execution, or package installation, ensuring that the agent uses uv for portability and performance rather than traditional virtual environments or global pip [9][10]. Bash Tool Parameters When the agent invokes the Bash tool directly, it typically accepts the following parameters [2][11]: - command (string): The shell command to execute [2]. - pty (boolean): Set to true for interactive tasks; crucial for Codex to maintain TUI or interactive CLI state [2]. - workdir (string): Restricts the agent's operations to a specific folder [2][11]. - background (boolean): Runs the task asynchronously, returning a session ID for monitoring [2]. - timeout (number): Specifies the execution time limit [2]. Best Practices - Prefer Dedicated Tools: The Codex prompting guide emphasizes using built-in tools (e.g., read_file, apply_patch, git) over Bash shell commands when a dedicated tool exists [1]. - PTY Requirement: For Codex-based agents, always set pty:true when running interactive tools or sub-agents [2][11]. - Skill Enumeration: Systems often use a list-skills script or an agent-level configuration (like AGENTS.md) to parse YAML frontmatter from SKILL.md files, allowing the agent to discover tools without bloating the context window [3].
Citations:
- 1: https://codex.danielvaughan.com/2026/06/03/codex-cli-built-in-tool-surface-complete-reference-shell-file-search-image-multi-agent/
- 2: https://explainx.ai/skills/steipete/clawdis/coding-agent
- 3: https://github.com/oferhalevi/codex-skills-integration
- 4: https://github.com/trailofbits/codex-config/blob/main/README.md
- 5: https://mcpmarket.com/es/tools/skills/claude-code-tools-reference
- 6: https://github.com/deicer/codex-lb/blob/main/.agents/skills/codex-review-loop/SKILL.md
- 7: https://github.com/disler/single-file-agents
- 8: https://github.com/shivalahare/CodingAgent/blob/main/README.md
- 9: https://github.com/microsoft/ai-agents-for-beginners/blob/main/translations/en/.agents/skills/jupyter-notebook/SKILL.md
- 10: https://github.com/trailofbits/skills/blob/HEAD/plugins/modern-python/skills/modern-python/references/uv-commands.md
- 11: https://cdn.jsdelivr.net/npm/@pixelzx/genesis@2026.6.7/skills/coding-agent/SKILL.md
🌐 Web query:
site:github.com/oferhalevi/codex-skills-integration Bash(file:*) Bash(uv:*) SKILL.md
💡 Result:
The terms Bash(file:) and Bash(uv:) do not appear to be standard technical nomenclature or documented features within the context of the codex-skills-integration framework or standard Bash scripting [1]. In the context of the codex-skills-integration project, SKILL.md is a mandatory file used to define individual agent skills [1]. Each SKILL.md file must contain YAML frontmatter including at least a name and a description, followed by Markdown-formatted instructions and guidelines for the skill [1]. While the framework utilizes uv to manage dependencies and execute scripts such as list-skills, there is no documented reference to Bash(file:) or Bash(uv:) syntax [1]. It is possible these terms are misinterpretations or specific, non-public shorthand references for internal tool configurations or script execution contexts not reflected in the available documentation [1].
Citations:
Align Bash permissions with the documented script commands.
allowed-tools: Bash(uv:*) Read limits Bash commands to uv prefixes, but the shared workflow examples use bare script commands like scripts/bootstrap_pytest_uv.sh ... and scripts/run_pytest_uv.sh .... Add matching script permissions or update the examples to run only allowed commands.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/python-testing-workflow/SKILL.md` at line 10, Align the allowed-tools
declaration in SKILL.md with the documented workflow commands: either add Bash
permissions for scripts/bootstrap_pytest_uv.sh and scripts/run_pytest_uv.sh, or
change those examples to use only uv-prefixed commands. Keep the permissions and
examples consistent.
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 9
🧹 Nitpick comments (1)
plugins/python-skills/skills/python-package-workflow/SKILL.md (1)
91-104: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSmoke-check commands match upstream uv guidance; tighten the lead-in prose.
The
uv run --isolated --no-project --with dist/*.whl tests/smoke_test.pypattern matches astral-sh's own documented release-workflow example. However, the sentence introducing it ("create a temporary consumer outside the package tree and install the built artifact there") describes a manual external-directory approach that the shown commands don't actually use —--isolated --no-projectalready provides isolation without needing a directory outside the package tree. Consider rewording the lead-in so it doesn't imply an extra manual step.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/python-skills/skills/python-package-workflow/SKILL.md` around lines 91 - 104, Revise the lead-in before the uv smoke-check commands to describe using an isolated, no-project environment to test the built artifact, rather than requiring a temporary consumer directory outside the package tree. Keep the existing wheel/sdist commands and smoke-test guidance unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/maintainers/python-skills-plugin-plan.md`:
- Around line 77-80: Update the documentation passage describing the older
twelve-skill architecture metadata claim. Since
docs/architecture/architecture.json now lists all fifteen Python skill
manifests, either present the twelve-skill statement strictly as historical
context or state that the regenerated metadata is synchronized, while preserving
the current fifteen-skill inventory as the audit source of truth.
In `@plugins/python-skills/shared/bootstrap-contract.md`:
- Line 58: Update the “Test setup or testing workflow” entry in the routing
table to explicitly scope it to existing-project test setup and maintenance,
while directing initial pytest/Ruff/mypy scaffolding to
bootstrap-uv-python-workspace.
In `@plugins/python-skills/skills/build-python-agent-service/SKILL.md`:
- Line 10: Restrict the allowed-tools entry in the build-python-agent-service
skill so Bash(uv:*) is replaced by only the specific uv subcommands required by
the workflow, preventing arbitrary Python execution through uv run variants. Add
regression coverage for uv run python -c, uv run -m, and uv run --with ...
python bypass forms, while retaining the check that Bash(python:*) is absent.
In `@plugins/python-skills/skills/fastapi-service-workflow/SKILL.md`:
- Line 3: Shorten the exported frontmatter descriptions to the repository’s
accepted length while preserving their core scope. Apply the same shortened
FastAPI description in
plugins/python-skills/skills/fastapi-service-workflow/SKILL.md:3 and
skills/fastapi-service-workflow/SKILL.md:3, and the same shortened FastMCP
description in plugins/python-skills/skills/fastmcp-service-workflow/SKILL.md:3
and skills/fastmcp-service-workflow/SKILL.md:3.
In
`@plugins/python-skills/skills/python-testing-workflow/references/uv-workspace-testing.md`:
- Around line 16-18: Update the package-scoped testing guidance in
uv-workspace-testing.md and the corresponding command in SKILL.md to run pytest
from the selected workspace member, using uv’s --directory <member-dir> option
or explicitly documenting the required working directory; ensure tests/unit
resolves relative to that member in both affected files.
In
`@plugins/python-skills/skills/python-testing-workflow/scripts/bootstrap_pytest_uv.sh`:
- Line 10: Update the SKILL_NAME-derived profile handling in
plugins/python-skills/skills/python-testing-workflow/scripts/bootstrap_pytest_uv.sh
(lines 10-10) and run_pytest_uv.sh (lines 9-9) to load or migrate profiles from
the previous workflow namespace when the renamed namespace is absent. Document
the required one-time migration in skills/python-testing-workflow/SKILL.md
(lines 63-64), including the old and new namespaces and the expected user
action.
In `@plugins/python-skills/skills/python-testing-workflow/SKILL.md`:
- Around line 3-10: Update the frontmatter allowed-tools declaration in the
Python testing workflow skill to authorize Bash commands beginning with
scripts/bootstrap_pytest_uv.sh and scripts/run_pytest_uv.sh, while preserving
the existing uv and Read permissions.
In `@ROADMAP.md`:
- Around line 173-176: Resolve the contradictory pytest migration status in
ROADMAP.md by updating the earlier scope item that says the existing pytest
skill surfaces remain intact, or explicitly documenting the exception for
uv-pytest-unit-testing. Ensure the roadmap consistently reflects whether that
skill was replaced while preserving the broader migration status.
In `@skills/python-testing-workflow/SKILL.md`:
- Line 10: Align the allowed-tools declaration in SKILL.md with the documented
workflow commands: either add Bash permissions for
scripts/bootstrap_pytest_uv.sh and scripts/run_pytest_uv.sh, or change those
examples to use only uv-prefixed commands. Keep the permissions and examples
consistent.
---
Nitpick comments:
In `@plugins/python-skills/skills/python-package-workflow/SKILL.md`:
- Around line 91-104: Revise the lead-in before the uv smoke-check commands to
describe using an isolated, no-project environment to test the built artifact,
rather than requiring a temporary consumer directory outside the package tree.
Keep the existing wheel/sdist commands and smoke-test guidance unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 982f914e-3181-4ccc-8934-216ca4bff702
📒 Files selected for processing (55)
README.mdROADMAP.mddocs/agents/bundled-subagent-role-candidates.mddocs/architecture/ARCHITECTURE.mddocs/architecture/architecture.jsondocs/maintainers/hermes-compatibility.mddocs/maintainers/python-skills-plugin-plan.mdplugins/python-skills/.codex-plugin/plugin.jsonplugins/python-skills/shared/bootstrap-contract.mdplugins/python-skills/skills/bootstrap-python-mcp-service/SKILL.mdplugins/python-skills/skills/bootstrap-python-mcp-service/agents/openai.yamlplugins/python-skills/skills/bootstrap-python-mcp-service/references/fastmcp-docs-lookup.mdplugins/python-skills/skills/bootstrap-python-service/SKILL.mdplugins/python-skills/skills/bootstrap-uv-python-workspace/SKILL.mdplugins/python-skills/skills/build-python-agent-service/SKILL.mdplugins/python-skills/skills/choose-python-project-shape/SKILL.mdplugins/python-skills/skills/fastapi-service-workflow/SKILL.mdplugins/python-skills/skills/fastapi-service-workflow/agents/openai.yamlplugins/python-skills/skills/fastmcp-service-workflow/SKILL.mdplugins/python-skills/skills/fastmcp-service-workflow/agents/openai.yamlplugins/python-skills/skills/integrate-fastapi-fastmcp/SKILL.mdplugins/python-skills/skills/integrate-fastapi-fastmcp/agents/openai.yamlplugins/python-skills/skills/python-ci-workflow/SKILL.mdplugins/python-skills/skills/python-package-workflow/SKILL.mdplugins/python-skills/skills/python-testing-workflow/SKILL.mdplugins/python-skills/skills/python-testing-workflow/agents/openai.yamlplugins/python-skills/skills/python-testing-workflow/assets/profiles/bootstrap_pytest_uv.config.yamlplugins/python-skills/skills/python-testing-workflow/assets/profiles/run_pytest_uv.config.yamlplugins/python-skills/skills/python-testing-workflow/references/customization.mdplugins/python-skills/skills/python-testing-workflow/references/interactive-customization.mdplugins/python-skills/skills/python-testing-workflow/references/pytest-workflow.mdplugins/python-skills/skills/python-testing-workflow/references/uv-workspace-testing.mdplugins/python-skills/skills/python-testing-workflow/scripts/bootstrap_pytest_uv.shplugins/python-skills/skills/python-testing-workflow/scripts/run_pytest_uv.shplugins/python-skills/skills/uv-pytest-unit-testing/SKILL.mdplugins/python-skills/skills/uv-pytest-unit-testing/agents/openai.yamlplugins/python-skills/tests/test_build_python_agent_service_skill.pyplugins/python-skills/tests/test_plugin_smoke.pyscripts/export_hermes_skills.pyskills.sh.jsonskills/build-python-agent-service/SKILL.mdskills/fastapi-service-workflow/SKILL.mdskills/fastapi-service-workflow/agents/openai.yamlskills/fastmcp-service-workflow/SKILL.mdskills/fastmcp-service-workflow/agents/openai.yamlskills/python-testing-workflow/SKILL.mdskills/python-testing-workflow/agents/openai.yamlskills/python-testing-workflow/assets/profiles/bootstrap_pytest_uv.config.yamlskills/python-testing-workflow/assets/profiles/run_pytest_uv.config.yamlskills/python-testing-workflow/references/customization.mdskills/python-testing-workflow/references/interactive-customization.mdskills/python-testing-workflow/references/pytest-workflow.mdskills/python-testing-workflow/references/uv-workspace-testing.mdskills/python-testing-workflow/scripts/bootstrap_pytest_uv.shskills/python-testing-workflow/scripts/run_pytest_uv.sh
💤 Files with no reviewable changes (4)
- plugins/python-skills/skills/uv-pytest-unit-testing/agents/openai.yaml
- plugins/python-skills/skills/uv-pytest-unit-testing/SKILL.md
- plugins/python-skills/skills/bootstrap-python-mcp-service/agents/openai.yaml
- plugins/python-skills/skills/integrate-fastapi-fastmcp/agents/openai.yaml
🛑 Comments failed to post (1)
plugins/python-skills/skills/python-testing-workflow/references/uv-workspace-testing.md (1)
16-18: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail echo "== file existence ==" printf '%s\n' plugins/python-skills/skills/python-testing-workflow/references/uv-workspace-testing.md skills/python-testing-workflow/SKILL.md 2>/dev/null | while read -r f; do if [ -e "$f" ]; then printf 'EXISTS %s\n' "$f" wc -l "$f" else printf 'MISSING %s\n' "$f" fi done echo "== target snippets ==" sed -n '1,80p' plugins/python-skills/skills/python-testing-workflow/references/uv-workspace-testing.md echo '---' sed -n '45,70p' skills/python-testing-workflow/SKILL.md echo "== related uv-workspace/run scripts ==" fd -a 'run_pytest|pytest|pyproject|uv-workspace|uv.*test' skills/python-testing-workflow plugins/python-skills/skills/python-testing-workflow 2>/dev/null | sed 's#^\./##' | head -100 for f in $(fd 'run_pytest_|uv|pyproject' skills/python-testing-workflow plugins/python-skills/skills/python-testing-workflow 2>/dev/null); do echo "---- $f" sed -n '1,220p' "$f" doneRepository: gaelic-ghost/socket
Length of output: 28977
🌐 Web query:
astral uv cli run --package current directory workspace members arguments relative to workspace root or member💡 Result:
When using
uv runin a workspace, the handling of command arguments and file paths depends on the current working directory (CWD) and the configuration of the workspace. 1. Resolution of Command Arguments: Any command-line arguments (including relative paths) passed touv runare resolved relative to your current working directory [1]. They are not automatically adjusted to be relative to the workspace root or the selected workspace member. 2. Workspace Member Selection: By default,uv rundiscovers the workspace member associated with your CWD [2]. You can explicitly target a specific workspace member using the--package <package>flag, which allows you to execute a command within the context of that package from anywhere in the workspace [3][4]. 3. Command Execution Context: While--packageensures the command runs with the environment and dependencies of the specified member, the command itself is still executed from your CWD [2]. For example, if you runuv run --package my-member pytestfrom the workspace root,pytestwill attempt to run in the root directory rather than the directory ofmy-member, which may cause it to miss files or configuration if the tool relies on the CWD [2]. 4. Path Resolution Update: Recent versions ofuv(as of mid-2026) have introduced features to improve workspace awareness. Notably,uvmay now detect the workspace based on the target script's directory rather than the CWD if the--preview-features target-workspace-discoveryflag is enabled (or in newer default behaviors) [1][5]. In summary, standard relative paths passed as arguments touv runremain relative to your CWD [1]. If you need a command to execute relative to a specific package's directory, you may need to use the--directory <path>flag alongside--package <package>to change the working directory before the command runs [1].Citations:
- 1: https://docs.astral.sh/uv/reference/cli/index.md
- 2: astral-sh/uv#13749
- 3: https://docs.astral.sh/uv/concepts/projects/workspaces/
- 4: https://github.com/astral-sh/uv/blob/8ee34679/docs/concepts/projects/workspaces.md
- 5: astral-sh/uv#17423
Make package-scoped test paths member-relative.
uv run --package <member> pytest tests/unitstill resolvestests/unitfrom the current workspace directory;--packageonly selects the environment. Either document the required working directory or show/use--directory <member-dir>so the path selects the member.📍 Affects 2 files
plugins/python-skills/skills/python-testing-workflow/references/uv-workspace-testing.md#L16-L18(this comment)skills/python-testing-workflow/SKILL.md#L59-L59🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/python-skills/skills/python-testing-workflow/references/uv-workspace-testing.md` around lines 16 - 18, Update the package-scoped testing guidance in uv-workspace-testing.md and the corresponding command in SKILL.md to run pytest from the selected workspace member, using uv’s --directory <member-dir> option or explicitly documenting the required working directory; ensure tests/unit resolves relative to that member in both affected files.
1 participant
Summary
python-testing-workflow.Verification
uv run scripts/validate_repo_metadata.pyuv run pytestuv run ruff check .uv run mypy .uv run scripts/validate_socket_metadata.pyuv run scripts/validate_claude_compatibility.pyuv run scripts/export_hermes_skills.py --checkuv run scripts/validate_hermes_compatibility.pyuv run plugins/productivity-skills/skills/maintain-project-architecture/scripts/maintain_project_architecture.py --project-root . --run-mode check-onlySummary by CodeRabbit