feat: auto-detect dependency changes and reinstall openant#36
Draft
joshbouncesecurity wants to merge 4 commits intoknostic:masterfrom
Draft
feat: auto-detect dependency changes and reinstall openant#36joshbouncesecurity wants to merge 4 commits intoknostic:masterfrom
joshbouncesecurity wants to merge 4 commits intoknostic:masterfrom
Conversation
Hash pyproject.toml (SHA-256) after each pip install and store in ~/.openant/venv/.deps-hash. On every CLI invocation, EnsureRuntime compares the stored hash with the current file and re-runs `pip install -e` when they differ. This prevents stale venv issues when dependencies change (e.g. swapping anthropic for claude-agent-sdk) — previously the user had to manually uninstall and reinstall. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
joshbouncesecurity
requested review from
ar7casper,
dgeyshis,
shahar-davidson,
sounil and
yotamleo
as code owners
… stale-trigger tests - Record the pyproject.toml hash even when openant is already importable so existing users aren't forced into a one-time reinstall after upgrading to the auto-detect-deps build. - Extract depsStalenessAt(corePath, hashPath) and readHashAt/writeHashAt helpers so the stale-detection logic is unit-testable without invoking pip or touching the real ~/.openant/venv directory. - Add tests covering the modified-pyproject trigger, fresh-state behavior, matching-hash short-circuit, missing pyproject, and empty stored hash.
If writeStoredHash fails after a successful install, the next run would otherwise see no stored hash and trigger a redundant reinstall. Surface the failure as a warning on stderr — consistent with the existing warning in CheckDepsStale — so users can spot a misbehaving venv directory.
If the venv directory does not yet exist (e.g. user runs against a system Python without the managed venv), writeStoredHash would fail every run and trigger a redundant reinstall on the next call. Have writeHashAt MkdirAll its parent first so the marker file always lands successfully.
Contributor
Author
Manual verificationAfter installing this branch:
|
Contributor
Author
Local test resultsBuilt the Go CLI from this branch on Windows and exercised the deps-hash flow. (Note: I needed Commands run: Outcome:
Sample output of the post-install run for transparency: The |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Go CLI now hashes
pyproject.tomlafterpip install -eand re-runs install automatically when dependencies change. Prevents stale venv issues aftergit pullintroduces new dependencies.Addresses item 14 from #16 (does not close the issue).
Test plan
pyproject.tomlskip the install.pyproject.toml(e.g., adding a dep) causes the next CLI invocation to reinstall automatically.