Posts on Personal Blogs for Fernweh

Why a reaction test can add extra milliseconds: press, release, and rendering

Wed, 09 Sep 2026 00:02:00 +0800

The reaction test on this site once reported over 300 milliseconds for a person who typically measured about 220–250 milliseconds elsewhere. The old implementation included the time between pressing and releasing the mouse button.

A click usually arrives after the press

A typical mouse click includes a press, a release, and then a click event. If the intended measurement is how quickly someone presses after seeing green, handling click can select a later endpoint.

In a controlled browser-input comparison, the mouse was pressed 230 milliseconds after green, held for 80 milliseconds, and released. The old implementation recorded 310 milliseconds on release. The corrected implementation records 230 milliseconds on press and ignores the later release for scoring.

Those numbers are specified test timings, not average human reaction times or a fixed correction to subtract from every score.

Define the input endpoint

The game now records these events:

Input	Measurement endpoint
Mouse	Primary-button `pointerdown`
Touch	The primary pointer contacting the panel
Keyboard	The initial Space or Enter `keydown`, excluding auto-repeat
Virtual activation from assistive technology	A supported `click` path without duplicate scoring

A compatibility click following an already-recorded mouse or touch press must not start another round. Additional pointers, non-primary buttons, and modifier combinations should not count as ordinary reactions.

Measure when the event happened

An event may occur before the main thread can process it. If a press occurs at 230 milliseconds but its handler runs at 310, reading performance.now() inside that handler includes 80 milliseconds of queue delay.

The input path therefore prefers the event’s timeStamp, normalized to the same clock as the start time. The core call is:

1
2
3
4
5
6


const pressedAt = inputTime(
 event.timeStamp,
 performance.now(),
 performance.timeOrigin
);
state = respond(state, pressedAt);

Normalization handles invalid values and older timestamps based on Unix time rather than the page’s time origin. Subtracting unrelated clocks is not meaningful.

It also affects false starts: a press that occurred before green remains early even if it is processed after the signal appears.

Align the visual update and start time

A timeout expiring means its callback can run; it does not prove that the display is already green. Starting a timer before updating the display can include extra presentation delay.

After the random wait, the game updates the panel and records its start in the same animation-frame callback. Omitting pause and state checks, the sequence is:

1
2
3
4


requestAnimationFrame(() => {
 render('ready');
 state = arm(state, performance.now());
});

requestAnimationFrame runs before painting, narrowing the gap between the script update and the next paint. It is not a timestamp of the physical pixels lighting up. Display refresh, input hardware, browser behavior, and operating-system scheduling still affect the result.

Pauses and restarts belong to the timing model

Pausing or leaving the game cancels both the pending timeout and any scheduled signal frame. Resuming starts a new wait while keeping completed samples. Otherwise an old callback could turn a new round green unexpectedly.

Early presses do not count toward the five valid samples. After a result, another press begins the next wait. Restarting clears the current round and pending work.

Use the same device, input method, and similar foreground conditions when comparing sites. These changes remove identifiable event-endpoint and queue-delay errors; a browser game still does not replace dedicated measurement hardware.

OpenClaw is installed but unusable: trace the runtime and Gateway

Wed, 09 Sep 2026 00:01:00 +0800

An installation finishing does not establish that a task can run. The runtime, Gateway, authentication, and browser connection are separate stages. Locate the failing stage before choosing the next action.

Check command resolution and runtime first

In Windows PowerShell:

1
2
3


Get-Command node, npm, openclaw -All
node --version
openclaw --version

If a command is missing, check its installation method, executable directory, and the current terminal’s PATH. Once the CLI can be found, confirm that the Node.js version running it meets that OpenClaw release’s requirements.

This machine runs Node.js v22.13.1. Running the launcher from the OpenClaw 2026.9.2 release package in an isolated directory rejected even --version, with exit code 1:

1

openclaw: Node.js >=22.22.3 <23, >=24.15.0 <25, or >=25.9.0 is required (current: v22.13.1).

This reproduction ran only the package launcher and runtime guard; it did not install OpenClaw globally or start a Gateway. Being on Node 22 is insufficient if the patch version is below the supported floor. Execution has not reached model authentication or browser pairing, so changing those settings cannot fix this error.

Both the 2026.9.2 package metadata and launcher specify this range. Choose a supported Node runtime for the OpenClaw release you use, then recheck both version commands. See installation and configuration for the installation options.

Once the CLI runs, inspect the Gateway

These are next-step checks for a working CLI, not successful output from the isolated experiment above:

1
2
3


openclaw status
openclaw gateway status
openclaw logs --follow

logs --follow streams logs until Ctrl+C. The official troubleshooting guide identifies Runtime: running, Connectivity probe: ok, and Capability: ... as useful Gateway signals. Fields can vary by release; read the complete error.

Symptom	First check
Service is not running	Installation method, startup logs, and service account
`ECONNREFUSED` / connection refused	Destination address, port, and whether the intended service is listening
Process runs but its probe fails	Address, port, authentication, and the actual probe error
Terminal CLI and background service differ	OpenClaw/Node executable paths, versions, and configuration sources

openclaw doctor provides diagnostics. Read repair, migration, or restart prompts before accepting them. doctor --fix and gateway restart change state and belong after the problem has been narrowed down.

Verify model requests and browser connections separately

A reachable Gateway does not prove that model requests work. Using your own model configuration, try a simple request without sensitive content. Interpret authentication, provider quota, model-name, and network errors using the corresponding log messages. Read provider-specific details for 401, 403, and 429 responses.

For the browser, select the intended profile and connection mode:

1

openclaw browser --browser-profile openclaw status

This checks the managed browser. To reuse a signed-in session, follow the browser modes guide for user or chrome and complete the appropriate authorization. Opening a page, installing an extension, and attaching to the correct tab are distinct checks.

Capture useful reproduction details

Record system and software versions, commands, non-sensitive destination details, error times, and relevant log excerpts. Remove tokens, keys, cookies, and personal session content.

Check ordinary JSON examples with the JSON tool and compare sanitized examples with Text Diff. Full OpenClaw configuration can be JSON5; use OpenClaw’s diagnostics rather than rewriting it with an ordinary JSON formatter.

References

Installed a Python package but cannot import it? Check the interpreter

Wed, 09 Sep 2026 00:00:00 +0800

When pip install succeeds but a program raises ModuleNotFoundError, first check whether installation and execution use the same Python interpreter.

This example uses Windows, Python 3.13.2, and two isolated virtual environments. The useful evidence is the interpreter path; the same approach applies to other Python 3 versions.

Identify the commands you are running

Run these commands in the same PowerShell window that launches the program:

1
2
3
4


Get-Command python, py, pip -All
python --version
python -c "import sys; print(sys.executable); print(sys.prefix); print(sys.base_prefix)"
python -m pip --version

Get-Command shows command resolution, sys.executable identifies the running interpreter, and python -m pip loads pip through that interpreter. Matching version numbers are insufficient: several directories can contain the same Python version.

On this machine, python resolves to D:\JDKs\Python3.13\python.exe. The legacy py launcher lists regular 3.13, free-threaded 3.13t, and 2.7; its default entry is 3.13t. Thus py and python can choose different runtimes.

The legacy launcher supports py --list-paths; the newer Python Install Manager uses py list. Check the help output to identify your launcher, then select an explicit version such as py -3.13. See the Python installation guide for installation options.

Reproducing an environment mismatch

I created env-a and env-b in an isolated directory and built a local demonstration package named blog-env-demo. It exposes a string to identify a successful import. It is not a dependency you need to download from PyPI.

Both environments run Python 3.13 and report pip 24.3.1, but pip lives in different directories. The experiment directory is abbreviated below:

1
2
3
4
5


env-a:
pip 24.3.1 from <experiment>\env-a\Lib\site-packages\pip (python 3.13)

env-b:
pip 24.3.1 from <experiment>\env-b\Lib\site-packages\pip (python 3.13)

After installing the local wheel only in A, the import succeeds in A and fails in B:

1
2
3
4
5


.\env-a\Scripts\python.exe -c "import blog_env_demo; print(blog_env_demo.MARKER)"
# installed in this interpreter

.\env-b\Scripts\python.exe -c "import blog_env_demo"
# ModuleNotFoundError: No module named 'blog_env_demo'

Installing that same wheel through B’s interpreter with -m pip makes the import succeed in B too. No Python reinstallation or global PATH change was needed. The failure was an environment mismatch.

Apply the fix to your project

If a project already has a .venv, inspect it directly:

1
2


.\.venv\Scripts\python.exe -c "import sys; print(sys.executable)"
.\.venv\Scripts\python.exe -m pip --version

For a new project without an environment, create one with an installed target version:

1

py -3.13 -m venv .venv

For a project that supplies requirements.txt, use the same interpreter for installation and execution:

1
2


.\.venv\Scripts\python.exe -m pip install -r requirements.txt
.\.venv\Scripts\python.exe app.py

Substitute the project’s actual Python version, dependency file, and entry point. Configure the IDE, debugger, or scheduled task to use that interpreter too. Calling the executable directly does not require activation or a PowerShell execution-policy change.

If the paths already match

Symptom	Next check
Distribution and import names differ	Consult the package documentation: `Pillow`, for example, is imported as `PIL`
The traceback points to a local file	Look for files such as `json.py` or `requests.py` that shadow another module
pip lists the package but the IDE fails	Inspect the interpreter in the actual run configuration
Regular and free-threaded builds are mixed	Check runtime and binary-extension compatibility; do not copy another environment’s `site-packages`

sys.prefix != sys.base_prefix normally indicates a virtual environment. Diagnose the interpreter that actually runs the program and retain the complete error message.

References

Protect Your Linux Server with Fail2ban

Wed, 01 Apr 2026 15:00:00 +0800

Fail2ban reads failure events from logs and applies ban actions. It complements protection for services such as SSH, but needs the correct log source, filter, and firewall action. Installing the service alone does not protect every entry point.

Scope and installation

These examples cover SSH with distribution packages on systemd-based Debian/Ubuntu. Check the distribution, actual SSH port, and installed Fail2ban version first. Fedora, RHEL, and other distributions have different repositories and logging defaults.

1
2
3


sudo apt update
sudo apt install fail2ban
fail2ban-client --version

Prefer maintained distribution packages. If source installation is required, consult upstream guidance to select a release and confirm dependencies, service integration, and future updates.

Identify the SSH log source

Ubuntu/Debian commonly use the ssh service unit; other environments may use sshd. Inspect the actual unit and logs:

1
2


sudo systemctl status ssh --no-pager
sudo journalctl -u ssh -n 30 --no-pager

For file-based logging, confirm that a file such as /var/log/auth.log exists and receives SSH authentication events. A path in a tutorial is not evidence that the machine writes to it.

Configure a small SSH jail override

Keep the distribution’s jail.conf and place only the overrides in /etc/fail2ban/jail.d/sshd.local. Copying the entire default file makes later upstream changes harder to inherit.

Before enabling protection, retain a second management session or console and add a verified fixed administration address to ignoreip. The example below contains loopback addresses only, not your remote management address.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


[DEFAULT]
ignoreip = 127.0.0.1/8 ::1

[sshd]
enabled = true
port = ssh
backend = systemd
maxretry = 5
findtime = 10m
bantime = 1h

Set port to the actual value if SSH uses a custom port.
The systemd backend reads the journal; do not combine it with a copied file-based logpath.
For file logs, choose a suitable backend and a verified path, for example backend = polling with logpath = /var/log/auth.log.
maxretry and findtime define the trigger; bantime sets the ban duration. Adjust them for the service and recovery options.

Validate before enabling

1

sudo fail2ban-client -t

After configuration validation succeeds, enable or reload the service:

1
2
3
4
5


sudo systemctl enable --now fail2ban
sudo fail2ban-client reload
sudo fail2ban-client ping
sudo fail2ban-client status
sudo fail2ban-client status sshd

Confirm that sshd is enabled, the log source is correct, and the ban action works. Test from a controlled source while retaining a recovery path rather than repeatedly failing authentication on your only management connection.

Bans, unbans, and persistence

192.0.2.10 is a documentation example address. Replace it with a verified target before running these commands:

1
2
3


sudo fail2ban-client set sshd banip 192.0.2.10
sudo fail2ban-client set sshd unbanip 192.0.2.10
sudo fail2ban-client unban 192.0.2.10

Upstream defaults enable SQLite persistence, with dbfile set to /var/lib/fail2ban/fail2ban.sqlite3. It is therefore inaccurate to say that all bans disappear on restart. Restoration also depends on the database, remaining ban duration, purge policy, and distribution configuration. Check effective configuration and actual status after a restart.

Before protecting other services

Do not enable a nginx-404 jail without its matching filter. Confirm the filter file, actual log format, and false-positive scope, then verify controlled samples with fail2ban-regex. A JavaScript regex tool does not replace Fail2ban’s filter tests.

If no ban occurs, inspect the sequence: log production, backend ingestion, filter matching, and firewall action. Run fail2ban-client -t after configuration changes instead of guessing through repeated restarts.

Official references

OpenClaw Browser Modes: Managed, MCP, and Chrome Extension

Tue, 24 Mar 2026 23:00:00 +0800

OpenClaw provides three browser modes: the isolated openclaw browser, the Chrome DevTools MCP user profile, and the Chrome extension chrome profile. They differ mainly in whether they reuse personal login state and how the connection is authorized.

Choose a connection mode

Profile	Browser connection	Suitable use
`openclaw`	Separate profile managed by OpenClaw	Practice and testing that do not need personal login state
`user`	Chrome DevTools MCP attaches to a running browser	Existing login state is needed and someone can approve the connection
`chrome`	OpenClaw Chrome extension	Existing login state is needed and extension installation and pairing are complete

The isolated browser is the default. Both modes that reuse a signed-in browser expose more content to automation; choose them according to the task and browser permissions.

Use the managed browser

With a working Gateway:

1
2
3
4


openclaw browser --browser-profile openclaw status
openclaw browser --browser-profile openclaw start
openclaw browser --browser-profile openclaw open https://example.com
openclaw browser --browser-profile openclaw snapshot

These commands check status, start the browser, open a test page, and inspect a snapshot separately. Successful command exit alone does not replace checking the actual page and snapshot.

Attach to Chrome with `user`

The user profile requires Chromium 144+ with remote debugging enabled.

Keep the target Chrome running and open chrome://inspect/#remote-debugging.
Enable remote debugging there.
Run the connection commands and approve Chrome’s connection prompt in person:

1
2
3
4


openclaw browser --browser-profile user start
openclaw browser --browser-profile user status
openclaw browser --browser-profile user tabs
openclaw browser --browser-profile user snapshot --format ai

user is built in; the simplest case does not require writing a complete profile configuration. Successful status should include driver: existing-session, transport: chrome-mcp, and running: true. Tab listings and snapshots should also match the real browser.

Brave, Edge, or a different profile directory may need an explicit userDataDir. A browser already started with a debugging port may need cdpUrl. Follow the matching conditions in the existing-session documentation.

The Chrome extension remains supported

The current official setup entry point is:

1

openclaw browser extension install

Complete installation, consent, and pairing using the extension documentation. Native bootstrap on macOS/Linux differs from manual pairing on Windows; follow the steps for your operating system.

After pairing, inspect the chrome profile:

1
2


openclaw browser --browser-profile chrome status
openclaw browser --browser-profile chrome tabs

Troubleshooting order

No browser subcommand: check the OpenClaw version and whether the browser plugin is enabled.
user cannot attach: check browser version, remote debugging, consent, and the target profile directory.
Status succeeds but the expected page is absent: confirm the selected profile, then inspect tabs.
The extension cannot connect: follow installation and pairing for the current operating system. MCP remote debugging does not replace extension pairing.

Official references

OpenClaw Installation: Environment Checks and Verification

Mon, 23 Mar 2026 22:00:00 +0800

OpenClaw runs a Gateway on your own device and connects it to messaging channels and model services. This guide follows the official CLI workflow: check the environment, choose an installation method, run onboarding, and verify the result.

Check the environment first

The official requirements list Node.js 22.22.3+, 24.15+, or 25.9+, with Node 26 recommended. Windows options include the native Windows Hub, PowerShell CLI, and WSL2; this article focuses on the CLI.

Record your actual versions before choosing a command:

1
2


node --version
npm --version

Model authentication depends on the provider. Complete it locally through the onboarding flow and keep credentials out of screenshots, shared links, and issue reports. Installation, onboarding, and daemon setup change the local environment.

Option 1: a package manager

For npm 12 or npm 11.16+, the current official command explicitly permits OpenClaw’s own lifecycle scripts:

1

npm install -g openclaw@latest --allow-scripts=openclaw

npm 11.15 and earlier do not support that option:

1

npm install -g openclaw@latest

For pnpm, the current global installation command is:

1

pnpm add -g --allow-build=openclaw openclaw@latest

pnpm approve-builds -g is not the supported global installation flow. Because latest changes, use a reviewed explicit release number when reproducibility matters, and record Node.js, package-manager, and operating-system versions.

Option 2: the official installer

The installer may install or select Node.js, install OpenClaw, and start onboarding. Download and inspect it before execution; verify any publisher-provided checksums or signatures as well.

macOS / Linux / WSL2

1
2
3
4
5


installer_path="$(mktemp)"
curl -fL https://openclaw.ai/install.sh -o "$installer_path"
less "$installer_path"
# Run only after reviewing the script
bash "$installer_path"

Windows PowerShell

1
2
3
4
5


$installerPath = Join-Path $env:TEMP 'openclaw-install.ps1'
Invoke-WebRequest -Uri 'https://openclaw.ai/install.ps1' -OutFile $installerPath
Get-Content -LiteralPath $installerPath
# Run only after reviewing the script
& $installerPath

This guide uses the official OpenClaw distribution. Third-party forks and mirrors can differ in package names, configuration, and versions; follow their own installation documentation. For source builds, follow the matching pnpm requirements on the official installation page.

Onboarding and verification

If the installer has not already completed onboarding:

1

openclaw onboard --install-daemon

This configures model access, the Gateway, and background startup. Check the CLI and service separately:

1
2
3
4


openclaw --version
openclaw doctor
openclaw gateway status
openclaw dashboard

doctor is a diagnostic entry point; some releases may offer configuration migrations or repairs. Read the output before accepting changes. A version number does not prove that the Gateway is running, and opening the Dashboard does not prove a successful model request.

Common failures and next steps

openclaw is not found: reopen the terminal, inspect npm prefix -g and command resolution, and confirm that you are using the Node environment that installed it.
Lifecycle scripts are blocked: check the package-manager version and the matching approval option above instead of approving unrelated packages.
The Gateway is unavailable: inspect service and connection details in openclaw gateway status before following the official troubleshooting guidance.

The next article explains the three browser connection modes. Use the JSON tool for ordinary JSON examples; full JSON5 configurations still require OpenClaw’s own diagnostics.

Official references

How to Completely Uninstall OpenClaw

Wed, 18 Mar 2026 17:22:00 +0800

Removing OpenClaw involves separate scopes: the Gateway service, state, workspace, desktop app, and CLI package. Decide what to preserve before removal and confirm any backups first.

Start with the built-in uninstaller

If the CLI is still available, inspect all removal scopes first:

1

openclaw uninstall --dry-run --all

Review the exact directories and services, then use the interactive flow:

1

openclaw uninstall

The current official prompt initially selects only the Gateway service. State, workspace, and app are separate choices; --all selects all four scopes. Removing state does not imply removing configured workspaces. Service-removal failure may preserve data scopes and produce a partial-cleanup error.

If the CLI is gone but its service remains, follow the operating-system-specific official manual removal instructions. Do not terminate every Node.js process.

The optional scripts below perform narrower package/process/Docker inventory and cleanup. They do not replace the built-in state, workspace, and service removal workflow.

Automated Uninstallation (Inspect Before Applying)

The cleanup scripts default to a read-only dry run. They list detected OpenClaw global packages, Node.js processes whose command line explicitly identifies OpenClaw, and resources in the current Docker context whose name or image explicitly matches OpenClaw. They do not stop every Node.js process or scan and remove user directories, configuration files, registry values, or arbitrary Docker resources.

Do not execute remote scripts through curl | bash or irm | iex. Download the file, verify its SHA-256 digest, inspect it, and run the dry-run first. After reviewing the plan, use -Apply/--apply; interactive mode also requires typing REMOVE OPENCLAW.

Windows (PowerShell)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


$scriptUrl = 'https://blog.codeglimpse.top/post/openclaw-uninstall/CleanupOpenClawForWindows.ps1'
$scriptPath = Join-Path $env:TEMP 'CleanupOpenClawForWindows.ps1'
Invoke-WebRequest -Uri $scriptUrl -OutFile $scriptPath

$expectedSha256 = 'eab731bd073f42fb75569be6c1dd3af37aca3214957057241ed13072fcc40daa'
if ((Get-FileHash -Algorithm SHA256 -LiteralPath $scriptPath).Hash.ToLowerInvariant() -ne $expectedSha256) {
 throw 'SHA-256 verification failed. Do not run this file.'
}

Get-Content -LiteralPath $scriptPath
& $scriptPath # dry-run; inventory only
& $scriptPath -Apply # asks for explicit confirmation before changing anything

Administrator privileges are normally unnecessary. Use an elevated terminal only if your installation location or Docker environment specifically requires it. -Apply -Yes is reserved for controlled automation after the plan has been reviewed.

Linux (Bash)

1
2
3
4
5
6
7


script_path="$(mktemp)"
curl -fL 'https://blog.codeglimpse.top/post/openclaw-uninstall/CleanupOpenClawForLinux.sh' -o "$script_path"
printf '%s %s\n' '0cfab4f8823a1644ef2e5b47275b144417c271372b7b11b795cf8c60a6689cb8' "$script_path" | sha256sum -c -

less "$script_path"
bash "$script_path" # dry-run; inventory only
bash "$script_path" --apply # requires typing REMOVE OPENCLAW

macOS (Bash)

1
2
3
4
5
6
7


script_path="$(mktemp)"
curl -fL 'https://blog.codeglimpse.top/post/openclaw-uninstall/CleanupOpenClawForMacOS.sh' -o "$script_path"
printf '%s %s\n' 'a7e6048a20a933e4297edfe64847afc8f5a206add153502ff6ac260be9d7a801' "$script_path" | shasum -a 256 -c -

less "$script_path"
bash "$script_path" # dry-run; inventory only
bash "$script_path" --apply # requires typing REMOVE OPENCLAW

Remove the CLI package and verify

After the requested service and data scopes are handled, uninstall the CLI with the package manager that installed it. Choose one:

1
2
3
4
5


# npm installation
npm uninstall -g openclaw

# pnpm installation
pnpm remove -g openclaw

Treat third-party forks such as openclaw-cn separately. Use the actual package prefix and reviewed inventory rather than deleting a guessed system-wide directory. Recheck the former service and command resolution; the absence of a CLI command alone does not prove removal of a background service.

Common problems

For permission errors, identify the installation location or Docker permission requirement first. Do not elevate every cleanup action by default.
If a command cannot be found, check the PATH and package-manager environment used for that installation. The inventory is limited to what the script can actually detect.
A dry run reports a plan. Successful cleanup requires checking the apply result and any remaining service or resource.

Official reference

OpenClaw uninstall scopes, preview, and manual service removal

How to Download and Install Python

Sun, 28 Sep 2025 16:20:00 +0800

Choose a Python version for your project, identify the interpreter actually being run, then create a virtual environment. The following steps cover Python 3.14; screenshots of the standalone installer show the 3.12/3.13 interface.

Windows: start with Python Install Manager

Official guidance now recommends obtaining Python Install Manager from python.org or Microsoft Store. Distinguish it from the older standalone .exe installer and legacy py launcher; consult the Windows documentation if their commands conflict.

After installing the manager, check its commands and install the required version. These examples select 3.14; check your project’s dependency compatibility first:

1
2
3
4
5


py help
py install 3.14
py list
py -3.14 --version
py -3.14 -c "import sys; print(sys.executable)"

The manager downloads the runtime. Check the official Windows support requirements for Python 3.14 rather than assuming that historical platform support still applies.

Existing standalone 3.12/3.13 installers

You may still encounter the older interface. Start with a per-user installation for ordinary development; install for all users with elevated privileges only when that scope is needed. The py launcher selects versions, but does not make python resolve identically in every terminal.

Keep pip available. Debug symbols, debug binaries, and the full standard-library test suite are optional components. Choose PATH changes and file associations according to the interpreters already installed rather than selecting every option.

For a silent installation, use the exact filename of an installer you have already downloaded and checked. These older-installer options demonstrate a per-user installation:

1
2


# Replace the filename with your verified installer
./python-3.13.7-amd64.exe /quiet InstallAllUsers=0 PrependPath=1 Include_test=0

The filename demonstrates syntax; it does not recommend 3.13.7 as the latest patch release. The 3.14 documentation marks the full installer as deprecated, so evaluate the install manager first for new environments.

macOS

Official installer

Download a package compatible with your macOS version and processor from Python for macOS, then read its platform and license information.

After installation, follow the current installer’s instructions for Install Certificates.command in the matching version directory. It downloads certificate components for that Python installation. Do not copy an outdated version directory from a screenshot.

1
2


python3 --version
python3 -c "import sys; print(sys.executable)"

Do not modify or remove Apple’s /usr/bin/python3. An official Python installation can coexist with the interpreter used by Apple’s developer tools.

If you already use Homebrew

Check the current Homebrew requirements, including supported macOS, hardware, and Xcode Command Line Tools. They should not be summarized as a requirement to install system Python first.

In a terminal where Homebrew is configured:

1
2
3
4


brew --version
brew install python
python3 --version
command -v python3

If Homebrew is absent, follow its official installation guidance, downloading and reviewing the installer before execution. Diagnose terminal configuration before forcing link replacements.

Linux: use distribution packages

Debian / Ubuntu

1
2
3


sudo apt update
sudo apt install python3 python3-pip python3-venv
python3 --version

Installing Python does not require upgrading the entire machine, recursively changing ownership of ~/.local, or deleting APT lock files. If a lock is held, identify the active package-management task, wait for it to finish, or follow the distribution’s recovery guidance.

Fedora

1
2


sudo dnf install python3 python3-pip
python3 --version

RHEL and other distributions have their own package versions and repository policies. Follow their documentation, preserve the system Python, and do not default to sudo pip for project dependencies.

Create a virtual environment per project

Run these commands from the project directory. The Windows example explicitly selects an installed 3.14 runtime:

1
2
3


py -3.14 -m venv .venv
.\.venv\Scripts\python.exe --version
.\.venv\Scripts\python.exe -m pip --version

macOS / Linux:

1
2
3


python3 -m venv .venv
.venv/bin/python --version
.venv/bin/python -m pip --version

Calling the environment’s interpreter directly avoids changing PowerShell execution policy just to use the example. Use that same interpreter with -m pip when installing dependencies.

Verification and common problems

Record the OS, --version, sys.executable, and pip --version; confirm that they identify the intended environment.
If python opens the Store or selects the wrong version, check application execution aliases, py list, and PATH.
For externally-managed-environment, create a project virtual environment instead of bypassing distribution protections.
If venv or ensurepip is missing, install the distribution’s matching virtual-environment component and recreate the environment.

Posts on Personal Blogs for Fernweh

Why a reaction test can add extra milliseconds: press, release, and rendering

A click usually arrives after the press

Define the input endpoint

Measure when the event happened

Align the visual update and start time

Pauses and restarts belong to the timing model

Further reading

OpenClaw is installed but unusable: trace the runtime and Gateway

Check command resolution and runtime first

Once the CLI runs, inspect the Gateway

Verify model requests and browser connections separately

Capture useful reproduction details

References

Installed a Python package but cannot import it? Check the interpreter

Identify the commands you are running

Reproducing an environment mismatch

Apply the fix to your project

If the paths already match

References

Protect Your Linux Server with Fail2ban

Scope and installation

Identify the SSH log source

Configure a small SSH jail override

Validate before enabling

Bans, unbans, and persistence

Before protecting other services

Official references

OpenClaw Browser Modes: Managed, MCP, and Chrome Extension

Choose a connection mode

Use the managed browser

Attach to Chrome with user

The Chrome extension remains supported

Troubleshooting order

Official references

OpenClaw Installation: Environment Checks and Verification

Check the environment first

Option 1: a package manager

Option 2: the official installer

macOS / Linux / WSL2

Windows PowerShell

Onboarding and verification

Common failures and next steps

Official references

How to Completely Uninstall OpenClaw

Start with the built-in uninstaller

Automated Uninstallation (Inspect Before Applying)

Windows (PowerShell)

Linux (Bash)

macOS (Bash)

Remove the CLI package and verify

Common problems

Official reference

How to Download and Install Python

Windows: start with Python Install Manager

Existing standalone 3.12/3.13 installers

macOS

Official installer

If you already use Homebrew

Linux: use distribution packages

Debian / Ubuntu

Fedora

Create a virtual environment per project

Verification and common problems

Official references

Attach to Chrome with `user`