0365478f5d
## Problem GitHub Actions caches created by pull-request runs are scoped to that PR, so a fresh PR cannot reuse them. The default setup-uv key also hashes FCC's own version in `pyproject.toml` and `uv.lock`, making every required release bump look like a dependency change. Live validation additionally showed that exact Python 3.14.0 is not preinstalled on the current hosted runner, so each parallel job downloaded it independently. ## Changes - Key the uv artifact cache from the locked third-party dependency export, keeping ordinary FCC version bumps cache-stable while retaining artifact hashes and toolchain isolation. - Make pull-request jobs read-only consumers of two independent caches: exact uv-managed Python and third-party dependency artifacts. Cache misses remain normal installs. - Add a trusted `main`-only maintenance workflow as the sole cache writer. It publishes missing Python and dependency keys without rerunning Ruff, type checks, pytest, or Playwright. - Extend the existing uv policy contract and contributor guidance to enforce the single trusted writer, shared toolchain policy, uv version, and malware checks. <!-- greptile_comment --> <details open><summary><h3>Greptile Summary</h3></summary> This change centralizes reusable Python and dependency-cache publication on pushes to the main branch, while pull-request checks restore caches without publishing them. The exercised exact-hit, compatible-restore, and cache-miss paths completed successfully. </details> <h3>Confidence Score: 5/5</h3> Safe to merge based on the exercised cache restore and publication paths. No blocking failure remains. <details><summary><h3><a href="https://www.greptile.com/trex"><img alt="T-Rex" src="https://greptile-static-assets.s3.amazonaws.com/trex/trex_green.svg" height="20" align="absmiddle"></a> T-Rex Logs</h3></summary> **What T-Rex did** - Ran an isolated validator against the cache workflows to model exact hits, compatible restores, and misses. - Managed uv cache-policy contract test results and confirmed all four contracts passed. - Identified that the unsafe baseline would fail on exact hits, and confirmed the guard prevents that path. - Validated the deterministic workflow-path validator and confirmed all four cache-policy contracts pass. - Reviewed the guarded cache policy path validation log and confirmed all path variants pass. <a href="https://app.greptile.com/trex/runs/19348463/artifacts"><picture><source media="(prefers-color-scheme: dark)" srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifactsDark.svg?v=4"><source media="(prefers-color-scheme: light)" srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifacts.svg?v=4"><img alt="View all artifacts" src="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifacts.svg?v=4"></picture></a> <sub><a href="https://www.greptile.com/trex"><img alt="T-Rex" src="https://greptile-static-assets.s3.amazonaws.com/trex/trex_green.svg" height="14" align="absmiddle"></a> Ran code and verified through T-Rex</sub> </details> <sub>Reviews (2): Last reviewed commit: ["Make main the sole CI cache publisher"](https://github.com/alishahryar1/free-claude-code/commit/29813e2d3836e24efd3c2e4a83493afab569f454) | [Re-trigger Greptile](https://app.greptile.com/api/retrigger?id=54251842)</sub> <!-- /greptile_comment -->
9.2 KiB
9.2 KiB
AGENTIC DIRECTIVE
Keep AGENTS.md and CLAUDE.md identical.
CODING ENVIRONMENT
- Install astral uv using "curl -LsSf https://astral.sh/uv/install.sh | sh" if not already installed and if already installed then update it to the latest version
- Install Python 3.14.0 stable using
uv python install 3.14.0if not already installed (requires uv >=0.9; see[tool.uv] required-versioninpyproject.toml) - Always use
uv runto run files instead of the globalpythoncommand. - Current uv ruff formatter is set to py314 which has supports multiple exception types without paranthesis (except TypeError, ValueError:)
- Read
.env.examplefor environment variables. - All CI checks must pass; failing checks block merge.
- Add tests for new changes (including edge cases).
- Before pushing, prefer
./scripts/ci.sh(macOS/Linux) or.\scripts\ci.ps1(Windows) to run the local CI sequence; requiresuvon PATH. The local scripts run Ruff in repair mode (ruff format, thenruff check --fix) before type checking and tests. - Use
--only/--skip(PowerShell:-Only/-Skip) to run a subset when iterating; use--dry-runto print commands without running them. - GitHub CI remains check-only for Ruff (
ruff format --check,ruff check) so branch protection verifies committed code. - Fall back to individual repair commands when debugging local failures:
uv run ruff format,uv run ruff check --fix,uv run ty check,uv run pytest -v --tb=short. Use GitHub-style checks only when verifying enforcement locally:uv run ruff format --check,uv run ruff check. - Do not add
# type: ignoreor# ty: ignore; fix the underlying type issue. - Do not add
from __future__ import annotations; Python 3.14 native lazy annotations are the project standard. - All 6 check IDs are represented in
scripts/ci.sh/scripts/ci.ps1and enforced bytests.ymlbefore each merge (parallel jobs: suppression grep, ruff-format, ruff-check, ty, pytest, playwright). - Deterministic rendered Admin UI interactions live under
e2e/and run separately from ordinary pytest. Install Chromium once withuv run playwright install chromium; API and unit contracts remain undertests/. - GitHub CI runs for every pull request, including stacked PRs targeting non-
mainbranches. Head updates trigger fresh checks; strict required checks keep PRs targetingmaincurrent withmain, so the tested PR tree is the tree squash-merged without a duplicate post-merge run. - A separate trusted
Dependency Cacheworkflow runs after pushes tomainonly and is the sole writer for reusable Python and uv dependency caches. Pull-request jobs only restore caches; the maintenance workflow never reruns validation and is not a required status check. - Repository protection should use rulesets: a non-bypassable main integrity ruleset requires pull requests and strict required checks, keeps branches current, and blocks direct/force pushes to
main; a separate review ruleset may allowAlishahryar1/admins to bypass review only. - Required status checks: set required status checks to all of those statuses (e.g. Ban suppressions and legacy annotations, ruff-format, ruff-check, ty, pytest, playwright—use the exact labels GitHub shows, which may be prefixed with CI /). Remove ci from required checks if it was previously added for the old gate job.
IDENTITY & CONTEXT
- You are an expert Software Architect and Systems Engineer.
- Goal: Zero-defect, root-cause-oriented engineering for bugs; test-driven engineering for new features. Think carefully; no need to rush.
- Code: Write the simplest code possible. Keep the codebase minimal and modular.
ARCHITECTURE PRINCIPLES
- Shared utilities: Put shared Anthropic protocol logic in neutral
src/free_claude_code/core/anthropic/modules. Do not have one provider import from another provider's utils. - Failure ownership: Keep canonical failure semantics and redaction SDK-free in
core/; providers alone classify SDK/HTTP failures and own retries; protocol/API adapters alone choose wire error types and commit-boundary serialization. - DRY: Extract shared base classes to eliminate duplication. Prefer composition over copy-paste.
- Encapsulation: Use accessor methods for internal state (e.g.
set_current_task()), not direct_attributeassignment from outside. - Provider-specific config: Keep provider-specific fields (e.g.
nim_settings) in provider constructors, not in the baseProviderConfig. - Model-independent reasoning: Resolve client reasoning intent once at the application boundary; provider adapters translate documented provider capabilities. Never branch on upstream model names or versions to choose reasoning behavior.
- Dead code: Remove unused code, legacy systems, and hardcoded values. Use settings/config instead of literals (e.g.
settings.provider_typenot"nvidia_nim"). - Performance: Use list accumulation for strings (not
+=in loops), cache env vars at init, prefer iterative over recursive when stack depth matters. - Platform-agnostic naming: Use generic names (e.g.
PLATFORM_EDIT) not platform-specific ones (e.g.TELEGRAM_EDIT) in shared code. - Precise types: Avoid
typing.Any. Use owner-defined domain types for known values,JsonValue/JsonObjectfor JSON, andobjectonly at genuinely opaque boundaries where the value is narrowed before use. Enforce this through design review and type checking, not a mechanical text ban in CI. - No type ignores: Do not add
# type: ignoreor# ty: ignore. Fix the underlying type issue. - Python 3.14 annotations: Do not use
from __future__ import annotations; rely on native lazy annotations and fix circular import boundaries instead of hiding them with annotation stringization. - Imports: Prefer top-level imports. Avoid
TYPE_CHECKINGand local imports for first-party or required dependencies; if a top-level import creates a cycle, move shared types/protocols to a neutral owner. - Complete migrations: When moving modules, update imports to the new owner and remove old compatibility shims in the same change unless preserving a published interface is explicitly required.
- Maximum Test Coverage: There should be maximum test coverage for everything, preferably live smoke test coverage to catch bugs early
COGNITIVE WORKFLOW
- ANALYZE: Read relevant files. Do not guess.
- PLAN: Map out the logic. Identify root cause or required changes. Order changes by dependency.
- EXECUTE: Fix the cause, not the symptom. Execute incrementally with clear commits.
- VERIFY: Run
./scripts/ci.shor.\scripts\ci.ps1, plus relevant smoke tests when needed. Confirm the fix via logs or output. - SPECIFICITY: Do exactly as much as asked; nothing more, nothing less.
- PROPAGATION: Changes impact multiple files; propagate updates correctly.
- VERSION: If the commit touches production files on
main, bump semver in the same commit (see Versioning).
VERSIONING (MAIN)
Every commit on main that changes a production file must include a semver bump in pyproject.toml in the same commit. Do not merge or push prod changes without updating the version.
Production files
These paths count as production (runtime, packaging, or install surface):
src/free_claude_code/api/,src/free_claude_code/cli/,src/free_claude_code/config/,src/free_claude_code/core/,src/free_claude_code/messaging/,src/free_claude_code/providers/src/free_claude_code/application/.env.examplepyproject.toml(dependencies, scripts, packaging)scripts/install.sh,scripts/install.ps1,scripts/uninstall.sh,scripts/uninstall.ps1,scripts/ci.sh,scripts/ci.ps1
These do not require a version bump on their own:
tests/,smoke/- Docs and assets:
README.md,assets/,AGENTS.md,CLAUDE.md - CI and repo config:
.github/,.gitignore
If a single commit mixes production and non-production edits, still bump the version.
Semver rules
Use [project].version as MAJOR.MINOR.PATCH:
- PATCH (
x.y.Z+1): bug fixes, refactors with no user-visible behavior change, dependency updates, packaging/install fixes. - MINOR (
x.Y+1.0): backward-compatible features—new providers, admin fields, CLI commands, config options, or behavior additions. - MAJOR (
X+1.0.0): breaking changes—removed or renamed env vars, incompatible API/CLI/default changes, or migrations users must act on.
When unsure between PATCH and MINOR, prefer PATCH for fixes and MINOR for new capability.
Required steps
- Classify the change and choose the bump level.
- Update
versioninpyproject.toml. - Run
uv locksouv.lockreflects the new package version. - Include the version and lockfile updates in the same commit as the production change.
Example commit on main after a packaging fix: bump 1.2.38 → 1.2.39, run uv lock, commit together with the fix.
SUMMARY STANDARDS
- Summaries must be technical and granular.
- Include: [Files Changed], [Logic Altered], [Verification Method], [Residual Risks] (if no residual risks then say none).
TOOLS
- Prefer built-in tools (grep, read_file, etc.) over manual workflows. Check tool availability before use.