## Problem
Bug-report validation rejected useful prose even when the FCC version
was unambiguous, and older installations received no update guidance.
Issue forms also duplicated their existing labels with forced title
prefixes.
## Changes
| Before | After |
| --- | --- |
| The FCC version field accepted only a bare version, copied command
output, or `None`. | The field accepts exactly one standalone
`number.number.number` value anywhere in the text, while preserving
exact `None` and rejecting ambiguous input. |
| Valid versions were not compared with the currently installable code.
| The workflow reads the live issue and project version from the default
branch, then compares numeric components safely. |
| Older reports received no update guidance. | One bot-owned comment
asks the reporter to update; edits update or remove that comment without
labels or issue closure. |
| Bug and feature forms forced `[Bug]` and `[Feature]` title prefixes. |
Existing `bug` and `enhancement` labels own classification without
changing the reporter's title. |
| Contract coverage inspected only workflow source fragments. | Contract
coverage executes the JavaScript lifecycle and protects label-only issue
classification. |
<!-- greptile_comment -->
<details open><summary><h3>Greptile Summary</h3></summary>
This PR improves issue classification and FCC version triage. The main
changes are:
- Removes forced title prefixes from bug and feature forms.
- Accepts one unambiguous numeric FCC version within descriptive text.
- Compares reported versions with the default branch project version.
- Reconciles invalid-version and update-guidance comments after edits.
- Adds executable workflow lifecycle and issue-form contract tests.
</details>
<h3>Confidence Score: 5/5</h3>
This looks safe to merge.
Corrected version fields now remove stale invalid-version comments.
Common valid TOML quote and comment formats are handled.
No blocking issues remain in the changed code.
<details><summary><h3><a href="https://www.greptile.com/trex"><img
alt="T-Rex"
src="https://greptile-static-assets.s3.amazonaws.com/trex/trex_green.svg"
height="20" align="absmiddle"></a> T-Rex Logs</h3></summary>
**What T-Rex did**
- I reviewed the pre-change contract-validation baseline for forms,
which showed 12 failures and 18 passes under origin/main.
- I executed the post-change contract-validation test run with the
environment set for the project and the pytest suite targeting the
contract tests, and it completed with exit code 0 and 30 passes.
<a
href="https://app.greptile.com/trex/runs/15163869/artifacts"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifactsDark.svg?v=4"><source
media="(prefers-color-scheme: light)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifacts.svg?v=4"><img
alt="View all artifacts"
src="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifacts.svg?v=4"></picture></a>
<sub><a href="https://www.greptile.com/trex"><img alt="T-Rex"
src="https://greptile-static-assets.s3.amazonaws.com/trex/trex_green.svg"
height="14" align="absmiddle"></a> Ran code and verified through
T-Rex</sub>
</details>
<details open><summary><h3>Important Files Changed</h3></summary>
| Filename | Overview |
|----------|----------|
| .github/workflows/validate-bug-report-version.yml | Adds live issue
reconciliation, project-version parsing, numeric comparison, and managed
invalid and outdated comments. |
| tests/contracts/test_issue_form_version_validation.py | Adds
executable coverage for version extraction, TOML parsing, numeric
comparison, and comment reconciliation. |
| .github/ISSUE_TEMPLATE/bug-report.yml | Removes the title prefix and
allows one numeric version within descriptive text. |
| .github/ISSUE_TEMPLATE/feature-request.yml | Removes the title prefix
while retaining enhancement classification. |
| tests/contracts/test_issue_forms.py | Checks that issue forms use
labels instead of title prefixes. |
</details>
<sub>Reviews (3): Last reviewed commit: ["Reconcile bug version triage
state"](https://github.com/alishahryar1/free-claude-code/commit/8efe7aaf95bd2a96719b1d0811afb83b06c5d79c)
| [Re-trigger
Greptile](https://app.greptile.com/api/retrigger?id=45775911)</sub>
<!-- /greptile_comment -->
## Problem
Dependabot updates passed CI without uv checking their locked packages
against known malware advisories. The supported uv minimum also predated
this capability.
## Changes
| Before | After |
| --- | --- |
| Project, installers, and CI allowed uv versions without malware
checking. | All supported surfaces require uv `0.11.16` or newer. |
| Parallel CI runners synchronized dependencies without an OSV malware
check. | Workflow-wide uv environment settings enable the check
independently on every runner. |
| Installers treated prerelease builds as their equivalent stable
version. | Installers accept stable uv releases only while preserving
valid build metadata. |
| uv security-policy values and edge behavior could drift between
maintained surfaces. | Contract and installer tests enforce the shared
policy. |
| FCC reported version `4.8.5`. | FCC reports patch version `4.8.6`. |
<!-- greptile_comment -->
<details open><summary><h3>Greptile Summary</h3></summary>
This PR enables uv malware checks across CI and raises the supported uv
baseline. The main changes are:
- Requires uv `0.11.16` across project, installer, and CI configuration.
- Enables the malware-check preview policy at workflow scope.
- Rejects prerelease uv versions in both installers.
- Adds policy and installer tests for the updated behavior.
- Bumps the package and lockfile version to `4.8.6`.
</details>
<h3>Confidence Score: 5/5</h3>
This looks safe to merge.
The installer fix preserves prerelease suffixes and rejects them before
numeric comparison. Both installer variants cover stable releases, build
metadata, and prerelease versions. No blocking issues remain in the
changed code.
<details><summary><h3><a href="https://www.greptile.com/trex"><img
alt="T-Rex"
src="https://greptile-static-assets.s3.amazonaws.com/trex/trex_green.svg"
height="20" align="absmiddle"></a> T-Rex Logs</h3></summary>
**What T-Rex did**
- Policy declarations were verified to include uv 0.11.16 in the
pyproject, in both installers, and in CI setup, along with
workflow-level malware variables.
- The installer dry run printed all planned stages and ended with the
message "Dry run complete. No changes were made.".
- PowerShell execution was intentionally not attempted on Linux as part
of the contract validation.
- A set of 10 log artifacts was collected to support inspection of
policy coverage, dry-run results, and environment constraints.
<a
href="https://app.greptile.com/trex/runs/14927224/artifacts"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifactsDark.svg?v=4"><source
media="(prefers-color-scheme: light)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifacts.svg?v=4"><img
alt="View all artifacts"
src="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifacts.svg?v=4"></picture></a>
<sub><a href="https://www.greptile.com/trex"><img alt="T-Rex"
src="https://greptile-static-assets.s3.amazonaws.com/trex/trex_green.svg"
height="14" align="absmiddle"></a> Ran code and verified through
T-Rex</sub>
</details>
<details open><summary><h3>Important Files Changed</h3></summary>
| Filename | Overview |
|----------|----------|
| .github/workflows/tests.yml | Enables the uv malware-check policy at
workflow scope and installs uv 0.11.16. |
| pyproject.toml | Raises the required uv version and bumps the package
patch version. |
| scripts/install.sh | Rejects prerelease uv versions while accepting
stable versions with build metadata. |
| scripts/install.ps1 | Applies the same stable-version requirement to
the PowerShell installer. |
| tests/contracts/test_uv_policy.py | Checks uv minimum consistency and
workflow-wide malware policy placement. |
| tests/scripts/test_installers.py | Adds stable, build-metadata, and
prerelease cases for both installers. |
| uv.lock | Synchronizes the locked project version with the package
version bump. |
</details>
<sub>Reviews (2): Last reviewed commit: ["Reject prerelease uv in
installers"](https://github.com/alishahryar1/free-claude-code/commit/d35d9d44d68d78ab2f00af0cb7297ffd7b7c4c3f)
| [Re-trigger
Greptile](https://app.greptile.com/api/retrigger?id=45238978)</sub>
<!-- /greptile_comment -->
## Problem
Bug-report validation rejected the literal output of `fcc-server
--version`, leaving reports labeled even when they contained an
unambiguous FCC version.
## Changes
| Before | After |
| --- | --- |
| The validator rejected `free-claude-code x.y.z` copied from the
command output. | The validator silently accepts copied command output.
|
| The form requested a bare `x.y.z` value or `None`. | The form
continues requesting a bare `x.y.z` value or `None`. |
| Prefixed version input had no accepted exact shape. | Prefixed version
input must exactly match `free-claude-code x.y.z`. |
## Problem
Bug reports can satisfy the required FCC version field with ambiguous
values such as `latest`, preventing reliable reproduction and regression
analysis.
## Changes
| Before | After |
| --- | --- |
| The form accepted any non-empty FCC version text. | The form requests
only an `x.y.z` version or `None`. |
| Invalid values required manual maintainer follow-up. | A dedicated
workflow labels invalid reports and posts one correction prompt. |
| Corrected reports retained manual triage state. | Editing the issue
reruns validation and removes the workflow-owned label when valid. |
<!-- greptile_comment -->
<details open><summary><h3>Greptile Summary</h3></summary>
This PR validates FCC versions supplied through the bug-report form. The
main changes are:
- Requests an exact `x.y.z` version or `None`.
- Validates bug reports when opened or edited.
- Adds and removes workflow-owned triage state.
- Adds contract tests for parsing and workflow behavior.
</details>
<h3>Confidence Score: 5/5</h3>
This looks safe to merge.
No blocking issues found in the changed code.
<details><summary><h3><a href="https://www.greptile.com/trex"><img
alt="T-Rex"
src="https://greptile-static-assets.s3.amazonaws.com/trex/trex_green.svg"
height="20" align="absmiddle"></a> T-Rex Logs</h3></summary>
**What T-Rex did**
- T-Rex captured the initial state showing there was no version triage
before capture.
- After capture, the latest state showed a needs-fcc-version label added
and one marked comment.
- Repeat delivery then listed only comments.
- In the 4.6.1 case, the needs-fcc-version label was removed.
- With the None input, no API calls were made.
<a
href="https://app.greptile.com/trex/runs/14521311/artifacts"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifactsDark.svg?v=4"><source
media="(prefers-color-scheme: light)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifacts.svg?v=4"><img
alt="View all artifacts"
src="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifacts.svg?v=4"></picture></a>
<sub><a href="https://www.greptile.com/trex"><img alt="T-Rex"
src="https://greptile-static-assets.s3.amazonaws.com/trex/trex_green.svg"
height="14" align="absmiddle"></a> Ran code and verified through
T-Rex</sub>
</details>
<details open><summary><h3>Important Files Changed</h3></summary>
| Filename | Overview |
|----------|----------|
| .github/ISSUE_TEMPLATE/bug-report.yml | Updates the FCC version
instructions and placeholder to require an exact version or `None`. |
| .github/workflows/validate-bug-report-version.yml | Adds exact version
validation with per-issue concurrency, idempotent comments, and label
reconciliation after edits. |
| tests/contracts/test_issue_form_version_validation.py | Adds contract
coverage for form text, accepted and rejected values, field extraction,
and triage operations. |
</details>
<sub>Reviews (1): Last reviewed commit: ["Validate FCC versions in bug
reports"](https://github.com/alishahryar1/free-claude-code/commit/388fe8515d61bdd47bc6ee9e1c9034222940c3bf)
| [Re-trigger
Greptile](https://app.greptile.com/api/retrigger?id=44414967)</sub>
<!-- /greptile_comment -->
## Problem
Python 3.14 provides native lazy annotations, but the codebase still
relied on legacy future annotation imports. Those imports also made
type-only import cycles easier to hide instead of fixing ownership
boundaries.
## Changes
| Before | After |
| --- | --- |
| Python files used `from __future__ import annotations`. | Python files
rely on Python 3.14 native lazy annotations. |
| Some runtime modules used `TYPE_CHECKING` or local imports for
required dependencies. | Runtime modules use top-level owner-module
imports with explicit boundaries. |
| Local and GitHub guardrails only rejected type ignore suppressions. |
Local and GitHub guardrails reject type ignore suppressions and legacy
future annotation imports. |
| Agent docs only documented the no-type-ignore rule. | Agent docs
document the Python 3.14 annotation and import-boundary rules. |
<!-- greptile_comment -->
<details open><summary><h3>Greptile Summary</h3></summary>
This PR moves the codebase to Python 3.14 native lazy annotations. The
main changes are:
- Removed legacy `from __future__ import annotations` imports across
Python modules.
- Promoted selected runtime dependencies from `TYPE_CHECKING` or local
imports to explicit owner-module imports.
- Added local, GitHub, and contract-test guardrails to reject legacy
future annotation imports.
- Updated agent docs with the annotation and import-boundary rules.
- Bumped the package patch version for production-file changes.
</details>
<h3>Confidence Score: 5/5</h3>
Safe to merge with low risk.
The changes are mostly mechanical annotation cleanup with matching CI
and contract-test guardrails. Reviewed import-boundary updates did not
show a confirmed runtime cycle or dependency break.
No files require special attention.
<details><summary><h3><a href="https://www.greptile.com/trex"><img
alt="T-Rex"
src="https://greptile-static-assets.s3.amazonaws.com/trex/trex_green.svg"
height="20" align="absmiddle"></a> T-Rex Logs</h3></summary>
**What T-Rex did**
- Performed an end-to-end validation of the guardrail contract suite: an
environment check confirmed uv availability, a guardrail pytest run used
CPython 3.14.0 with 5 passing contract tests, 3 focused CI-script tests
passed, and the direct CI suppressions guardrail command (including the
legacy future-annotations grep) also passed.
<a
href="https://app.greptile.com/trex/runs/13303335/artifacts"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifactsDark.svg?v=4"><source
media="(prefers-color-scheme: light)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifacts.svg?v=4"><img
alt="View all artifacts"
src="https://greptile-static-assets.s3.amazonaws.com/badges/ViewAllArtifacts.svg?v=4"></picture></a>
<sub><a href="https://www.greptile.com/trex"><img alt="T-Rex"
src="https://greptile-static-assets.s3.amazonaws.com/trex/trex_green.svg"
height="14" align="absmiddle"></a> Ran code and verified through
T-Rex</sub>
</details>
<details open><summary><h3>Important Files Changed</h3></summary>
| Filename | Overview |
|----------|----------|
| api/runtime.py | Moves messaging, CLI manager, session, limiter, and
tree dependencies from local/type-checking imports to explicit top-level
owner-module imports. |
| messaging/platforms/telegram.py | Removes future annotations and
promotes Telegram SDK type imports into the existing availability guard.
|
| messaging/platforms/telegram_inbound.py | Removes future annotations
and imports Telegram SDK types at module scope for inbound
normalization. |
| tests/contracts/test_import_boundaries.py | Adds an AST contract that
rejects legacy future annotation imports across Python files. |
| scripts/ci.sh | Extends the local suppression check to reject legacy
future annotation imports alongside type-ignore suppressions. |
| scripts/ci.ps1 | Mirrors the local PowerShell CI suppression check for
legacy future annotations. |
| .github/workflows/tests.yml | Renames and broadens the GitHub
guardrail job to reject both type suppressions and legacy future
annotations. |
| pyproject.toml | Bumps the patch version for production-file changes.
|
</details>
<details open><summary><h3>Sequence Diagram</h3></summary>
<a href="#gh-light-mode-only">
```mermaid
%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Dev as Developer/CI
participant Guard as Suppression guard
participant AST as Import-boundary contract test
participant Py as Python modules
Dev->>Guard: Run local/GitHub suppression check
Guard->>Py: "Scan *.py for type ignores and future annotations"
Guard-->>Dev: Fail if legacy annotation import remains
Dev->>AST: Run pytest contract tests
AST->>Py: Parse imports with ast
AST-->>Dev: Assert no future annotations/import-boundary violations
Py-->>Dev: Use Python 3.14 native lazy annotations
```
</a>
<a href="#gh-dark-mode-only">
```mermaid
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Dev as Developer/CI
participant Guard as Suppression guard
participant AST as Import-boundary contract test
participant Py as Python modules
Dev->>Guard: Run local/GitHub suppression check
Guard->>Py: "Scan *.py for type ignores and future annotations"
Guard-->>Dev: Fail if legacy annotation import remains
Dev->>AST: Run pytest contract tests
AST->>Py: Parse imports with ast
AST-->>Dev: Assert no future annotations/import-boundary violations
Py-->>Dev: Use Python 3.14 native lazy annotations
```
</a>
</details>
<sub>Reviews (2): Last reviewed commit: ["Remove legacy future
annotations
import"](https://github.com/alishahryar1/free-claude-code/commit/6e6cda69da243bbdb92831207aecb3731ad469f8)
| [Re-trigger
Greptile](https://app.greptile.com/api/retrigger?id=41875785)</sub>
<!-- /greptile_comment -->
Use head repo and SHA when checking out pull_request events so the
workflow can fetch the branch from the fork instead of the base repo.
Fixes CI failure when patch-1 (or other fork branches) don't exist
in the base repository.
Co-authored-by: Ali Khokhar <alishahryar2@gmail.com>
- Added a step to fail the CI if any '# type: ignore' comments are found in Python files.
- Refactored tests to use mocking for better isolation and reliability.
- Updated type hints and casting in several files to improve type safety.
- Run ty check; fail CI if type errors
- Run ruff format --check; fail CI if not formatted
- Rename workflow to CI
Co-authored-by: Ali Khokhar <alishahryar2@gmail.com>
- License: use standard MIT yellow badge, link to opensource.org
- Python: update to 3.14 to match pyproject.toml
- uv: use official dynamic endpoint badge from astral-sh/uv
- Tests: replace static pytest 95% with GitHub Actions badge
- Ty: fix link to PyPI (pypi.org/project/ty/)
- Add .github/workflows/tests.yml for CI
Co-authored-by: Ali Khokhar <alishahryar2@gmail.com>
Ali Khokhar