Skip to content

chore(test): migrate to stable Vitest 5 - #138264

Merged
vincentkoc merged 10 commits into
mainfrom
build/vitest5-stable
Sep 5, 2026
Merged

vincentkoc merged 10 commits into
mainfrom
build/vitest5-stable

Conversation

@vincentkoc

@vincentkoc vincentkoc commented Sep 4, 2026 •

Copy link
Copy Markdown
Member

Related: #137201

What Problem This Solves

OpenClaw was pinned to Vitest 4.1.11. Stable Vitest 5 breaks worker shutdown,
task updates, fake-timer refresh ordering, persistent cache invalidation, native
report merging, and several project/config contracts used by this repository.

Why This Change Was Made

This migrates the workspace to Vitest 5.0.0 and keeps one native Vitest harness.
Dependency patches are limited to behavior with captured stock-Vitest-5
failures. OpenClaw-owned tooling now uses Vitest 5 project and cache contracts
directly.

Vitest 5 bundles its runner and does not publish @vitest/runner@5.0.0, so the
old standalone dependency and patch are removed. tinybench@6.1.4 is unchanged.

User Impact

Contributors and CI can use stable Vitest 5 while retaining deterministic
reports, complete worker cleanup, valid cache reuse, and current test routing.

OpenClaw's packaged runtime still supports Node 25.9+. Source test/build support
follows Vitest's published Node 22.12+, 24+, and 26+ engine range.

Evidence

Exact candidate:

  • Head: 73dcc68983f24941c564505dee75b65b55639892
  • Frozen merge base: 0e6b033d4bdb0ce6750f24fb9044bb524ddd344e
  • Ten signed commits.
  • Peter Steinberger is credited on the commits that reuse his fake-timer,
    ordered-suite, browser, and TUI repairs from
    chore(test): migrate validation workflows to Vitest 5 #137202.
  • Independent repair-head review: APPROVE · READY, no findings; 95/95
    focused tests passed. The final one-line expectation repair passed its
    focused test 1/1.
  • Current main is 4e217930a68a12586f0dd215a68f714958a02970;
    an exact-head merge-tree probe is clean.

Published dependency proof:

  • vitest@5.0.0, published September 3, 2026.
  • Registry integrity:
    sha512-gpsMNoRhMjMktVxPtstOH4/PJuPyovVaMDr4oDilXaGH1EcqM2OE96SoHT2VIQ6fTGtTjqmHDrEu2X9RQiXf8Q==
  • Patch SHA-256:
    76a69c6de8bc85bb68eebebddf7e1e798a4ebf46d36ad60e6447ebc62c49f702
  • Seven patched targets. Pristine preimages, installed postimages, and patch
    application against the published package all passed.
  • Direct source/type inspection confirmed Vitest 5's ordered-suite form is
    describe(name, { concurrent: false }, callback) and that browser context is
    provided through the virtualized vitest/browser entry.
  • Direct pnpm 12.3.4 source inspection confirmed its Linux environment lock
    records top-level pnpm only; the committed lock now matches that contract.
  • File-backed project descriptors preserve stock config-directory roots when
    omitted and apply explicit descriptor roots to both Vitest and Vite config.
  • Replayed file-backed projects now preserve their immutable native
    namePrefix after config hooks. Two named containers can share one leaf
    config without collapsing to duplicate project names.

Stock Vitest 5 failures captured before patching:

  • Persistent cache: 4/4 failed.
  • Native report owner: 1 failed.
  • CLI validation: 1 failed.
  • Bundled runner task updates: 2 failed, 1 passed.
  • Fake-timer heap refresh: 2/2 failed.
  • Fork shutdown: 8 failed, 9 passed.
  • Project descriptor and worker-exit type contracts failed.

Exact-head validation:

  • The original nested-project reproduction failed after successful child
    shards: two qualified alpha projects collapsed during replay, duplicate
    identity aborted merge, and no aggregate was published.
  • The repaired exact scenario passes with the original and replayed project
    identities equal, index.complete=true, aggregate output present, and exit
    code zero. Name/root drift remains fail-closed.
  • Native report-owner and UI project suites: 95/95 passed.
  • Preceding-head CI exposed one stale non-isolated-runner expectation: captured
    projects now intentionally include namePrefix: "". The expected project
    contract was updated by one test line; the focused test passes 1/1.
  • Patch guard, Oxfmt, Oxlint, exact upstream patch application, installed
    runtime/type hashes, and lockfile byte identity passed.
  • Node 24.15.0 / pnpm 12.3.4 frozen install: passed; lock stayed byte-stable.
  • Focused final-head patch/project suites: 3 files, 49/49 passed.
  • Explicit project-root matrix: 10/10 passed across 40 createVitest contexts.
  • Exact-head package build and tarball integrity passed in clean Linux
    Node 24.19.0 with pnpm 12.3.4.
  • Exact-head package SHA-256:
    fa3465f66d7f1af52b0a56cf9740a5ac09d40366e845d7dd0ab21ff1a20135ac
  • Node 25.9.0 package install, openclaw --version, and openclaw help: passed
    at 73dcc68. A transitive hosted-git-info engine warning was advisory only.
  • Earlier candidate-wide checks passed: fake-registry regression; 991/991
    changed tooling tests; Gateway ordered suite; Chromium menu suite;
    pnpm tsgo:test:root; pnpm tsgo:scripts; and Node 24.15.0 pnpm check.
  • Exact-head hosted CI:
    https://github.com/openclaw/openclaw/actions/runs/33984746192
    • 125 successful jobs, 11 intentional skips, zero failures.
  • Repair-head hosted CI:
    https://github.com/openclaw/openclaw/actions/runs/33984373313
    • One stale expected-project shape failed; the final one-line test-only
      commit repairs that exact assertion.
  • Preceding-head hosted CI:
    https://github.com/openclaw/openclaw/actions/runs/33980753997
    • 125 successful jobs, zero failures at 01ea440c.
  • Judged production runtime delta: +0/-0.

Full-suite disposition:

  • The five-hour Node 26 full run at prior head 32a07193 exposed four
    branch-owned compatibility defects; all four are repaired here.
  • The same run also exposed ambient/baseline failures. Exact frozen Vitest 4
    control 723731b5f7ad58e3bc0fd818b74d049563e3a2d0 reproduced those baseline
    failures.
  • Subsequent review found and repaired Linux pnpm-lock canonicalization and
    explicit file-backed project roots.
  • ClawSweeper then found a named-container replay defect: successful child
    shards could lose their parent-name context and fail aggregate publication.
    The repair carries native prefix identity through every Vitest project
    attachment path and keeps identity drift fail-closed.

Performance:

  • All 17 paired-benchmark workload/config blobs are byte-identical to the
    frozen base and current main.
  • Prior seven-round equal-work run:
    https://github.com/openclaw/openclaw/actions/runs/33958680311
    • Verdict: pass; no material performance change.
    • Overall ratio: 0.979512; core 1.009059; gateway 0.952045; UI jsdom
      0.801893; worker lifecycle 0.992484.
    • Correctness inventories and execution digests matched.
    • Only 10/28 pairs improved, so no broad improvement claim is made.
  • Historical final-runtime paired run:
    https://github.com/openclaw/openclaw/actions/runs/33977496985
    • Workflow/head pinned to e6ad4f42; baseline pinned to 0e6b033d.
    • Verdict: pass; no material performance change.
    • Overall ratio: 0.972047; core 1.008901; gateway 0.931313; UI jsdom
      0.794350; worker lifecycle 0.990713.
    • Correctness inventories and execution digests matched.
    • 14/28 pairs improved, so no broad improvement claim is made.
  • Preceding-head paired run:
    https://github.com/openclaw/openclaw/actions/runs/33980754473
    • Workflow/head pinned to 01ea440c; baseline pinned to 0e6b033d.
    • Verdict: pass; no material performance change.
    • Overall ratio: 0.975833; core 0.995018; gateway 0.943878; UI jsdom
      0.805138; worker lifecycle 0.989261.
    • Cold overall ratio: 0.979260.
    • Correctness inventories and execution digests matched; the isolation
      verifier passed.
    • 12/28 pairs improved, so no broad improvement claim is made.
  • Repair-head paired run (historical):
    https://github.com/openclaw/openclaw/actions/runs/33984383323
  • Exact-head paired run:
    https://github.com/openclaw/openclaw/actions/runs/33984747140
    • Workflow/head pinned to 73dcc689; baseline pinned to 0e6b033d.
    • Verdict: pass; no material performance change; isolation verifier passed.
    • Measured overall ratio: 0.979512; core 0.992968; gateway 0.936441;
      UI jsdom 0.790620; worker lifecycle 0.999673.
    • Cold overall ratio: 0.981702.
    • Correctness inventories and execution digests matched.
    • 13/28 pairs improved, so no broad improvement claim is made.

No persistent data model, migration, runtime config, or upgrade contract changes.
The files previously classified as data-model surfaces are test-toolchain
package/workspace configuration only.

@vincentkoc vincentkoc self-assigned this Sep 4, 2026
@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation app: web-ui App: web-ui scripts Repository scripts extensions: qa-lab size: XL maintainer Maintainer-authored PR labels Sep 4, 2026
@clawsweeper clawsweeper Bot added P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Sep 4, 2026
@clawsweeper

clawsweeper Bot commented Sep 4, 2026 •

Copy link
Copy Markdown
Contributor

Codex review: blocked before merge. Reviewed September 5, 2026, 3:00 PM ET / 19:00 UTC.

ClawSweeper review

What this changes

Upgrades the development test harness to Vitest 5 and adapts worker cleanup, caching, report aggregation, test selection, browser configuration, and contributor guidance.

Merge readiness

⛔ Blocked before merge - 4 items remain

The migration remains necessary on the inspected main revision. Source changes address the prior findings, and no new blocking defect was established; final performance acceptance and independent upstream contract verification remain unresolved.

Priority: P2
Reviewed head: 73dcc68983f24941c564505dee75b65b55639892

Review scores

Measure Result What it means
Overall readiness 🐚 platinum hermit (4/6) Substantial native regression evidence supports a coherent migration with no established new blocking defect.
Proof confidence 🦞 diamond lobster (5/6) Not applicable: This MEMBER-authored PR is exempt from the external-contributor proof gate. Its captured evidence exercises native Vitest report replay, worker cleanup, installation, and browser configuration; final performance acceptance remains a separate requirement.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Not applicable Not applicable: This MEMBER-authored PR is exempt from the external-contributor proof gate. Its captured evidence exercises native Vitest report replay, worker cleanup, installation, and browser configuration; final performance acceptance remains a separate requirement.
Evidence reviewed 12 items Pinned introduction boundary: Reviewed the merge-base-to-head changes at 73dcc68. Host evidence identifies the supplied test merge as stale; base-only agent, provider, and authorization changes were not attributed to this PR.
Migration still needed on inspected main: Fetched main still pins vitest, coverage-v8, and the standalone runner to 4.1.11. The release package blob could not be read locally, so no shipped-version implementation claim is made.
Prior nested-project finding addressed: Capture records namePrefix, replay supplies config/root/namePrefix, and the dependency patch carries prefix identity through native project attachment. Regression coverage exercises shared leaves under distinct containers and rejects changed names or roots while preserving old output.
Findings None None.
Security None None.

How this fits together

OpenClaw’s test tooling turns contributor and CI commands into Vitest projects and workers. It collects their results into reports used to validate changes and QA scenarios.

flowchart TD
 A[Contributor or CI command] --> B[Test routing]
 B --> C[Vitest projects and cache]
 C --> D[Native test workers]
 D --> E[Results and worker cleanup]
 E --> F[Report identity validation]
 F --> G[Aggregate report or explicit failure]
Loading

Before merge

  • Resolve merge risk (P1) - Existing Node 25 source-test environments become unsupported, and previously generated native blobs require regeneration; both changes are documented separately from packaged-runtime support.
  • Resolve merge risk (P1) - The captured evidence does not yet establish the final candidate’s agreed paired-performance acceptance result.
  • Resolve merge risk (P1) - Independent inspection of the published Vitest project-loader and cache implementation remains incomplete because dependency sources were unavailable in this review environment.
  • Complete next step (P2) - Verify the final candidate’s paired-performance acceptance and complete direct published Vitest loader/cache inspection before merge.
Agent review details

Security

None.

PR surface

Source +7, Tests +477, Docs +87, Config +8, Other +272. Total +851 across 69 files.

View PR surface stats
Area Files Added Removed Net
Source 2 13 6 +7
Tests 39 793 316 +477
Docs 4 93 6 +87
Config 3 16 8 +8
Generated 0 0 0 0
Other 21 784 512 +272
Total 69 1699 848 +851

Review metrics

Metric Value Why it matters
Interpreted code delta QA runtime +8/-4; tooling/test support +360/-169; tests +464/-162 The small QA-runtime growth implements structured title matching; dependency patch records, lockfiles, documentation, and manifests are counted separately.
Dependency admission exceptions 9 exact-version cooldown exemptions added The exemptions are limited to the Vitest 5.0.0 family and document their expiration.

Stored data model

Persistent data-model change detected: migration/backfill/repair: pnpm-workspace.yaml, serialized state: ui/package.json. Migration or upgrade compatibility proof is recorded; maintainers should verify it before merge.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #137201
Summary: This PR is one candidate for the shared Vitest migration request; the companion PR integrates overlapping work but remains open in the supplied context.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge-risk options

Maintainer options:

  1. Complete toolchain acceptance (recommended)
    Verify the final paired-performance result and published loader/cache contracts before accepting the documented Node-host and report-blob transition.

Technical review

Best possible solution:

Retain one native Vitest execution and reporting flow, with the documented development upgrade boundary and verified final correctness/performance acceptance.

Do we have a high-confidence way to reproduce the issue?

Not applicable to the migration as a whole; the supplied evidence describes stock-Vitest failures and repaired native regressions, but this read-only review executed no tests.

Is this the best way to solve the issue?

Unclear as a final acceptance verdict: the owner-boundary approach is coherent and addresses prior findings, but direct published-dependency inspection and final performance acceptance remain unverified.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against ac53dc9687ca.

Labels

Label justifications:

  • P2: This is a useful development-toolchain migration with no established urgent deployed-runtime regression.
  • merge-risk: 🚨 automation: The migration changes native worker termination, caching, project loading, and aggregate publication used throughout CI.
  • merge-risk: 🚨 compatibility: Vitest 5 changes supported development Node versions and native report-artifact compatibility.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This MEMBER-authored PR is exempt from the external-contributor proof gate. Its captured evidence exercises native Vitest report replay, worker cleanup, installation, and browser configuration; final performance acceptance remains a separate requirement.

Evidence

What I checked:

  • Pinned introduction boundary: Reviewed the merge-base-to-head changes at 73dcc68. Host evidence identifies the supplied test merge as stale; base-only agent, provider, and authorization changes were not attributed to this PR. (73dcc68983f2)
  • Migration still needed on inspected main: Fetched main still pins vitest, coverage-v8, and the standalone runner to 4.1.11. The release package blob could not be read locally, so no shipped-version implementation claim is made. (package.json, ac53dc9687ca)
  • Prior nested-project finding addressed: Capture records namePrefix, replay supplies config/root/namePrefix, and the dependency patch carries prefix identity through native project attachment. Regression coverage exercises shared leaves under distinct containers and rejects changed names or roots while preserving old output. (scripts/lib/vitest-report-owner.mts:242, 73dcc68983f2)
  • Native replay regression coverage: The report-owner suite checks original and replayed project/module identities, exact case inventory, one config evaluation per replayed project, and failure without publication on identity drift. Its fixture invokes the actual test wrappers and installed Vitest. (test/scripts/vitest-report-owner.test.ts:174, 73dcc68983f2)
  • Cache owner and dependency signal: The patch directly changes Vitest’s filesystem cache, project loader, worker shutdown, timer heap, and task-update producer. Native cache tests cover lock transitions, reporter and awaited hook imports, selected/root invalidation, and recreation after an idle clear. This establishes a Vitest dependency-contract requirement; it does not establish a Codex runtime dependency. (patches/vitest@5.0.0.patch:20, 73dcc68983f2)
  • Consumer and sibling boundaries: Project and plugin-batch execution share the report owner. QA’s native report reader and the TUI evidence producer both construct selection names from ancestorTitles and title. Browser configuration retains both Vite and test roots, and the four UI E2E resource projects disable implicit inheritance. (extensions/qa-lab/src/test-file-scenario-vitest-report.ts:112, 73dcc68983f2)

Likely related people:

  • steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
  • vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Record the final candidate’s paired-performance acceptance result.
  • Complete independent inspection of the published Vitest project-loader and cache-owner contracts.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (12 earlier review cycles; latest 8 shown)
  • reviewed 2026-09-04T18:56:57.147Z sha c8d2b7c :: blocked before merge. :: [P2] Keep the Chromium project root at the Vite config level | [P2] Document OpenClaw’s preserved mock history accurately
  • reviewed 2026-09-05T06:46:20.563Z sha eec831d :: blocked before merge. :: none
  • reviewed 2026-09-05T09:49:37.348Z sha 32a0719 :: blocked before merge. :: none
  • reviewed 2026-09-05T10:47:58.118Z sha 32a0719 :: blocked before merge. :: none
  • reviewed 2026-09-05T16:52:42.303Z sha e6ad4f4 :: blocked before merge. :: none
  • reviewed 2026-09-05T17:50:43.678Z sha 01ea440 :: blocked before merge. :: [P2] [P2] Preserve parent-name context when replaying nested file projects
  • reviewed 2026-09-05T18:03:20.711Z sha 01ea440 :: blocked before merge. :: [P2] [P2] Preserve container-name context when replaying file projects
  • reviewed 2026-09-05T18:47:44.702Z sha 73dcc68 :: blocked before merge. :: none

@sylvesterkaczmarek sylvesterkaczmarek left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a much cleaner Vitest 5 migration shape than carrying v4/v5 compatibility code: direct API migration plus a small, explicit patch for OpenClaw-specific guarantees. The fork/vmFork join semantics and trailing task-update delivery are the parts I would treat as non-negotiable, not optional test fixes. Keep the PR draft until same-host V4/V5 benchmark results and exact-head hosted gates are recorded, as the body already requires.

@vincentkoc

Copy link
Copy Markdown
Member Author

Maintainer patch approval and published-package proof

At exact PR head 337c76933256c100b55e9769e3b6e86810aec646, I approve carrying the temporary exact-version vitest@5.0.0 patch with hash ff0fda5e01c8f6ae2b8d70b4839ac0678a14a3521442113a53a118bf871b97e7.

Published-package proof completed on September 4, 2026:

  • npm latest: vitest@5.0.0, published September 3, 2026 at 12:24:30 UTC
  • tarball SHA-1: a85f075e65bc7c87cce4df2f9114214fbd92f245
  • tarball SHA-256: 602c520b9225cbb26d7d9d749169ff0866da24dde092a87cadd4b7c8056f7268
  • npm SRI: sha512-gpsMNoRhMjMktVxPtstOH4/PJuPyovVaMDr4oDilXaGH1EcqM2OE96SoHT2VIQ6fTGtTjqmHDrEu2X9RQiXf8Q==, exactly matching pnpm-lock.yaml
  • git apply --check --verbose and git apply --verbose both passed against the untouched published tarball
  • all declared Git preimage and postimage blob IDs matched
  • patch result: 6 files, 12 hunks, +55/-20, zero rejects or .orig files, unchanged 103-path package manifest

The three retained contracts are:

  1. public parseCLI CAC validation without executing the matched command
  2. one final trailing task-update delivery at the throttle boundary
  3. joined fork/vmFork shutdown with abnormal-exit propagation

Focused runtime replay passed: CLI valid/unknown/missing-value cases, task updates 3/3, and fork/vmFork shutdown 17/17.

The automated data-model classification is a false positive. pnpm-workspace.yaml, package metadata, and Vitest reports here are dependency/test-tooling inputs and ephemeral test artifacts; this PR changes no OpenClaw SQLite schema, migration, persistent runtime store, or serialized user-state contract.

The pressure-dependent provider-usage failure was traced to an existing unit-fast classifier gap for stateful .test-mocks helpers. The owner-level test-routing repair is included at this head, moves exactly one test to the isolated lane, and changes production runtime LOC by +0/-0. The paired benchmark has restarted from clean samples with that test retained in the equal-work inventory.

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. labels Sep 4, 2026
@openclaw-barnacle openclaw-barnacle Bot added the gateway Gateway runtime label Sep 4, 2026
@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Sep 4, 2026
@clawsweeper clawsweeper Bot added status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Sep 5, 2026
@clawsweeper clawsweeper Bot added merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. labels Sep 5, 2026
@github-actions

github-actions Bot commented Sep 5, 2026 •

Copy link
Copy Markdown
Contributor

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

  • package.json
  • patches/@vitest__runner@4.1.11.patch
  • patches/README.md
  • patches/vitest@4.1.11.patch
  • patches/vitest@5.0.0.patch
  • pnpm-lock.yaml
  • pnpm-workspace.yaml
  • ui/package.json

Maintainer follow-up:

  • Review whether the dependency changes are intentional.
  • Inspect resolved package deltas when lockfiles or workspace dependency policy changes are present.
  • Treat pnpm-lock.yaml and package-lock.json diffs as dependency security-review surfaces.
  • Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

@github-actions github-actions Bot added the dependencies-changed PR changes dependency-related files label Sep 5, 2026
@github-actions

github-actions Bot commented Sep 5, 2026 •

Copy link
Copy Markdown
Contributor

Dependency graph changes noted

This PR includes dependency graph changes. The dependency guard is informational because the PR author is a repository admin, a member of @openclaw/openclaw-secops, or an OpenClaw organization member with Maintain or Admin repository access.

  • Current SHA: 73dcc68983f24941c564505dee75b65b55639892
  • Trusted actor: @vincentkoc
  • Trusted role: pull request author; openclaw-secops

Security review is still recommended before merge when the dependency graph change is intentional.

@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Sep 5, 2026
@vincentkoc

Copy link
Copy Markdown
Member Author

@clawsweeper re-review

Please review exact head 01ea440c5d6613825ddc20417296f22494847bf6.

The prior review's evidence gates are complete:

  • Exact-head paired benchmark: https://github.com/openclaw/openclaw/actions/runs/33980754473
    • baseline 0e6b033d4bdb0ce6750f24fb9044bb524ddd344e
    • verdict pass; performance no-material-change
    • overall ratio 0.975833; core 0.995018; gateway 0.943878; UI jsdom 0.805138; worker lifecycle 0.989261
    • correctness inventories and execution digests matched; isolation verification passed
    • 12/28 pairs improved, so no broad improvement claim
  • Exact-head hosted CI: https://github.com/openclaw/openclaw/actions/runs/33980753997
    • 125 successful jobs; zero failures
  • Direct published Vitest 5.0.0 runtime/type inspection is complete, including ordered suites and file-backed project descriptors. Captured stock failures and exact-head regressions cover the patched contracts.
  • Clean Linux Node 24.19.0 / pnpm 12.3.4 package proof passed; exact tarball SHA-256 is 7fa4befc3341c1393f6b67b7e97ff75b7b0da526640569be06aa4534a59582d5. Node 25.9 packaged-runtime install/version/help also passed.
  • Source-test host docs exclude Node 25 while packaged runtime support remains; Vitest 4 native report blobs are intentionally regenerated under Vitest 5 rather than reused.
  • Independent exact-head review: no findings, APPROVE · READY.

Both prior Rank-up moves are complete.

@clawsweeper

clawsweeper Bot commented Sep 5, 2026 •

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Sep 5, 2026
@vincentkoc

Copy link
Copy Markdown
Member Author

@clawsweeper re-review

Final exact-head evidence is complete for 73dcc68983f24941c564505dee75b65b55639892.

  • The nested replay P2 is repaired with Vitest's native immutable namePrefix, applied after config hooks and carried through regular, shared, sibling, browser, and benchmark attachment paths. The red reproduction lost container identity and suppressed aggregate publication; the green run preserves exact original/replayed identities, writes index.complete=true, and exits zero. Native focused coverage is 95/95 plus the final contract check 1/1.
  • Exact-head CI passed: https://github.com/openclaw/openclaw/actions/runs/33984746192 (125 successful jobs, 11 intentional skips, 0 failures).
  • Exact-head paired performance passed: https://github.com/openclaw/openclaw/actions/runs/33984747140. Correctness inventories/digests matched, no regressions were reported, and isolation verification passed. Measured ratios: overall 0.979512, core 0.992968, gateway 0.936441, UI jsdom 0.790620, worker lifecycle 0.999673; cold overall 0.981702. Only 13/28 pairs improved, so the PR makes no broad improvement claim.
  • Direct published-dependency inspection is complete against the extracted vitest@5.0.0 npm artifact, including the project loader/cache owner in dist/chunks/index.B89dZ0-N.js, worker shutdown in init-forks.CiCtIMPj.js, runner delivery in run.CQOUYP-x.js, and declarations. The exact patch applies cleanly; patch hash is 76a69c6de8bc85bb68eebddf7e1e798a4ebf46d36ad60e6447ebc62c49f702, installed runtime hash is 54a978632cf3584e4507bed3f09ba22d6f344ec45bac5ea37fda0b9718b59e58, and installed type hash is 9409856e49fb8b6b9a84725340c7f68af76dc5c35e237ba7da71e5534d22e54c.
  • The exact packaged OpenClaw tarball passed clean Linux Node 24.19.0 build/package/integrity and Node 25.9.0 install/version/help smoke; tarball SHA-256 is fa3465f66d7f1af52b0a56cf9740a5ac09d40366e845d7dd0ab21ff1a20135ac. Node 25 is unsupported only for source-test environments by Vitest's published engine; packaged runtime support is retained because Vitest is development-only. Native report blobs intentionally regenerate across the Vitest-major transition.
  • The stored-data warning is a classifier false positive: pnpm-workspace.yaml and ui/package.json are test-toolchain package/workspace configuration. There is no persistent data model, migration, runtime config, or upgrade-contract change.
  • Current main is 4e217930a68a12586f0dd215a68f714958a02970; exact-head merge-tree is clean, and all 17 benchmark workload/config blobs remain byte-identical.

The prior Rank-up moves are addressed: final paired acceptance is recorded, and direct published Vitest loader/cache inspection is complete.

@clawsweeper

clawsweeper Bot commented Sep 5, 2026 •

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

@vincentkoc
vincentkoc merged commit 8e5a3f3 into main Sep 5, 2026
224 checks passed
@vincentkoc
vincentkoc deleted the build/vitest5-stable branch September 5, 2026 19:18
@vincentkoc

Copy link
Copy Markdown
Member Author

Merged via squash.

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Sep 6, 2026
* build(test): migrate to stable Vitest 5

Co-authored-by: Peter Steinberger <steipete@gmail.com>

* docs(test): document Vitest 5 contracts

* test(test): prove Vitest cache invalidation

* test(test): stabilize report config load proof

* test(test): restore Vitest 5 compatibility

Co-authored-by: Peter Steinberger <steipete@gmail.com>

* test(test): isolate pnpm cache fixture registry

* fix(test): keep pnpm 12 env lock portable

* fix(test): preserve explicit Vitest project roots

* fix(test): preserve nested Vitest project identity

* test(test): expect captured Vitest name prefix

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

app: web-ui App: web-ui dependencies-changed PR changes dependency-related files docs Improvements or additions to documentation extensions: qa-lab gateway Gateway runtime maintainer Maintainer-authored PR merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. scripts Repository scripts size: XL status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants