build(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24

[dependabot]

Bumps github.com/mattn/go-isatty from 0.0.23 to 0.0.24.

Commits

• c44dc0b Use TIOCGWINSZ instead of TCGETS to detect terminals (#97)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 24, 2026, 6:32 AM ET / 10:32 UTC.

ClawSweeper review

What this changes

This PR updates crawlkit’s direct github.com/mattn/go-isatty dependency from v0.0.23 to v0.0.24, refreshing the corresponding Go module checksums.

Merge readiness

⛔ Blocked until real behavior proof is added - 3 items remain

Keep this PR open: current main still pins github.com/mattn/go-isatty v0.0.23, while this clean two-file patch moves it to v0.0.24 and all supplied checks pass. The upstream patch changes terminal detection on Unix-like systems, so merge needs a small real terminal/non-terminal behavior check rather than an already-implemented close.

Priority: P3
Reviewed head: 718779ac2579b2d354e565f11b7dd187b5c310fd

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The patch is narrow and currently has no concrete correctness finding, but it is not merge-ready under the real-behavior-proof gate.
Proof confidence	🧂 unranked krab (1/6)	Needs real behavior proof before merge: The external PR provides generated Dependabot metadata and successful CI, but no after-fix live terminal or redirected-output evidence; add a redacted terminal transcript or equivalent live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs real behavior proof before merge: The external PR provides generated Dependabot metadata and successful CI, but no after-fix live terminal or redirected-output evidence; add a redacted terminal transcript or equivalent live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	4 items	Current-main dependency state: The supplied PR comparison against current main shows go.mod at the base SHA requiring github.com/mattn/go-isatty v0.0.23; the proposed v0.0.24 update is therefore not already implemented on main. Narrow proposed patch: The PR changes only the direct module version and its two checksum entries: 3 additions and 3 deletions across go.mod and go.sum. Behavioral relevance: The Dependabot body identifies the upstream v0.0.24 change as using TIOCGWINSZ rather than TCGETS for terminal detection, which can affect interactive-versus-redirected output classification.
Findings	None	None.
Security	None	None.

How this fits together

crawlkit’s CLI output and terminal-browser surfaces need to distinguish interactive terminals from redirected output. The updated dependency provides that terminal-capability detection, which informs whether downstream command paths use interactive formatting or plain output.

flowchart LR
  A[CLI command] --> B[Output and TUI helpers]
  B --> C[Terminal capability check]
  C --> D{Interactive terminal?}
  D --> E[Interactive formatting]
  D --> F[Plain redirected output]

Loading

Before merge

• Resolve merge risk (P1) - v0.0.24 changes Unix terminal detection semantics, so an existing interactive or redirected CLI/TUI path could be classified differently even though the module diff is small.
• Resolve merge risk (P1) - The PR body contains no after-fix live behavior evidence; passing CI is useful but does not demonstrate terminal classification in a real shell.
• Complete next step (P2) - No code repair is identified; a maintainer or contributor needs to supply focused runtime proof for the terminal-detection compatibility change before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency surface	1 direct production module updated	The change is limited to go-isatty, but that module participates in terminal-capability detection.
Patch size	2 files affected; 3 additions, 3 deletions	The small metadata-only diff limits review scope and isolates the compatibility question.

Merge-risk options

Maintainer options:

1. Capture terminal-mode proof before merge (recommended)
   Run a redacted interactive-terminal and redirected-output check against this head to confirm the upstream detection change preserves crawlkit’s output mode selection.
2. Accept the upstream detection change
   Merge based on the narrow patch and green CI if maintainers intentionally accept the upstream terminal-detection behavior without additional runtime proof.

Technical review

Best possible solution:

Confirm that crawlctl retains correct interactive formatting in a terminal and plain behavior when output is redirected, then merge this narrowly scoped dependency update if both paths remain correct.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a defect report; the relevant verification is a focused live check of interactive-terminal and redirected-output behavior after the dependency update.

Is this the best way to solve the issue?

Yes, the proposed version bump is the narrowest way to take the upstream terminal-detection fix, provided it is paired with a real output-mode verification rather than relying solely on CI.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 7a8ba7f7c78b.

Labels

Label changes:

• add P3: This is a routine patch-level dependency maintenance update with no demonstrated user-facing regression.
• add merge-risk: 🚨 compatibility: The upstream release changes terminal detection behavior, which can alter existing CLI or TUI output-mode behavior on supported platforms.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The external PR provides generated Dependabot metadata and successful CI, but no after-fix live terminal or redirected-output evidence; add a redacted terminal transcript or equivalent live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P3: This is a routine patch-level dependency maintenance update with no demonstrated user-facing regression.
• merge-risk: 🚨 compatibility: The upstream release changes terminal detection behavior, which can alter existing CLI or TUI output-mode behavior on supported platforms.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The external PR provides generated Dependabot metadata and successful CI, but no after-fix live terminal or redirected-output evidence; add a redacted terminal transcript or equivalent live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Current-main dependency state: The supplied PR comparison against current main shows go.mod at the base SHA requiring github.com/mattn/go-isatty v0.0.23; the proposed v0.0.24 update is therefore not already implemented on main. (go.mod:12, 7a8ba7f7c78b)
• Narrow proposed patch: The PR changes only the direct module version and its two checksum entries: 3 additions and 3 deletions across go.mod and go.sum. (go.sum:39, 718779ac2579)
• Behavioral relevance: The Dependabot body identifies the upstream v0.0.24 change as using TIOCGWINSZ rather than TCGETS for terminal detection, which can affect interactive-versus-redirected output classification. (718779ac2579)
• Automated validation: The supplied PR checks report successful analyze, tests, Windows tests, CodeQL, and verified-secret scans on the proposed head. (718779ac2579)

Likely related people:

• unidentified current-main dependency owner: The supplied context identifies the dependency change but contains no current-main blame or feature-history identity for the terminal-detection call sites; route to the contributor responsible for crawlkit’s CLI/TUI dependency maintenance. (role: likely follow-up owner; confidence: low; files: go.mod, go.sum)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add redacted live output from an interactive terminal and a redirected/non-TTY invocation; omit private paths, endpoints, tokens, and other sensitive details.
• After adding proof to the PR body, trigger a fresh ClawSweeper review or ask a maintainer to comment @clawsweeper re-review if it does not run automatically.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: build(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.