Repository navigation
fix(security): build native MCPorter releases with Bun 1.4.4 - #464
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f8562089b3
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
clawsweeper
Bot
added
clawsweeper:intake:bug
|
Codex review: needs maintainer review before merge. What this changesThis PR requires stable Bun 1.4.4 or newer for native compilation and release provenance, and uses the admitted executable for generated artifacts. Example: Run generate-cli --compile with BUN_BIN selecting Bun 1.4.3.
Review scores
ProductKind: Bug fix · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep open: this PR closes a real native compiler admission gap that remains on main, and the earlier release-path finding is addressed without a new actionable defect. Priority: P1 Before mergeNone. FindingsNone. Agent review detailsHow this fits togetherThe shared generator runtime owner selects Bun for public CLI generation, while native build and release scripts consume its version policy before compilation or provenance acceptance. flowchart TD
A[Public generator] --> B[Bun runtime admission]
C[Native build script] --> B
D[Release packager] --> B
E[Release verifier] --> B
B --> F[Supported compiler]
F --> G[Native MCP artifacts]
Technical reviewBest possible solution: Land the shared compiler admission fix while retaining the existing signing, source-integrity, and release verification gates. Do we have a high-confidence way to reproduce the issue? Current main checks Bun availability without a supported-version floor, and its release verifier accepts any nonempty builder version; the supplied old/new compiler and provenance observations match those source paths. Is this the best way to solve the issue? The patch fixes the shared admission owner and its release consumers, preserving compiler overrides, Windows console suppression, and real build configuration without adding another policy path. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 5f9eee19b421. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment HistoryReview history (3 earlier review cycles)Reviewed October 23, 2026, 10:26 PM ET / October 24, 2026, 02:26 UTC (Revision 4). |
|
@clawsweeper re-review Final head |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
clawsweeper:intake:bug
clawsweeper
Bot
removed
clawsweeper:intake:bug
|
@clawsweeper re-review The exact source head remains 4307fdc. The description now links retained native macOS ARM and Windows x64 package/install, generated-client and private-CA controls from run 40053731368; canonical Darwin ARM also has 28 incident-key rejection observations with built-in and old explicit trust. Artifact identities and scope limits are included. Original Windows timing attribution, Windows compiled incident-key proof, Darwin Intel and signed publication gaps remain explicit. Review only; no repair, merge, publication or deployment is requested. |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
clawsweeper:intake:bug
Split the Windows handoff policy cases without increasing their timeout, resolve native build paths with fileURLToPath, and retain runtime-checked Windows and macOS rehearsal artifacts. Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com>
steipete
left a comment
steipete
left a comment
There was a problem hiding this comment.
Reviewed the repaired head and independent P0–P2 review. Exact-head CI and the release rehearsal are green; retained Windows x64 and macOS arm64/x86_64 artifacts have been downloaded and qualified. The macOS qualification copies preserve the documented 13.0 minimum, embed Bun 1.4.4, and pass strict Developer ID and online notarization checks. Contributor credit is retained in the squash message and changelog.
The initial Bun 1.4.4 CI pins left native release packaging and public
generate-cli --compileable to use affected Bun 1.4.3. This update makes the existing runtime owner enforce stable Bun >=1.4.4 at all compiler/provenance boundaries, then uses the exact admitted executable. Version discovery suppresses project/global preloads; real build settings and all signing/source/provenance gates remain intact. Existing BUN_BIN absolute/relative and PATH selection work; affected compilers fail with an actionable upgrade message.Validation on the exact final source in isolated Linux ARM UTM:
pnpm check; full tests (250 files/2277 tests passed;5 files/27 tests skipped); canonical package-install/OAuth-vault migration/downgrade proof; actual public generator old-runtime rejection and fixed compiler native-tool calls; old/new provenance red/green; canonical build rejection/usable output. Final rebuilt main CLI and generated-client artifacts each passed32 TLS cases, including14incident hosts with built-in and qualified old extra-CA modes, proper private CA/MCP positive, issuer/hostname negatives and legitimate HTTPS controls. Native compiler1.4.4 input is exact-hashed. Fresh canonical P0–P2 review is scoped-clean.Limits: the original broad security proof is Linux ARM; the additional native macOS ARM and Windows x64 scenarios below extend the demonstrated scope. Signed publication and deployed-fleet delivery remain unproven. Full Mac release-contract gates remain normal CI requirements. An existing standalone-native generator/default matching-package NPM Arborist failure was reproduced at the same pre-compiler phase on old and new native inputs with matched Node/npm/compiler/fixture; source/installed-Node generator succeeds. Its underlying baseline cause remains open. Final-head CI must be read at the actual published head; pending checks are not passing results.
Existing historical Bun 1.4.3 release provenance is intentionally rejected by the hardened compiler/provenance boundary; rebuild with a supported stable Bun rather than bypassing the admission check.
Native Windows x64 component check passes with the byte-identical final runtime owner: the null-device query works, selects the same absolute Bun executable, and suppresses project preload with a sensitive control. Its global-preload control was insensitive, so Windows global-preload suppression remains unqualified. Earlier controlled full-context Windows base/candidate suites both passed, but the original shared-handoff timeout remains unattributed. The additional installed-package/generated-client and canonical Darwin ARM artifact results below extend this component proof; signed publication remains separate.
Exact source and artifact evidence
{ "candidate": "4307fdcc994c16f9a021e97cd5d6ea004275e051", "tree": "3f5e588c4cd23639feb77b1b2fee976acfcfd897", "base": "5f9eee19b4216359e5937032705f7ce274b2ef4d", "nativeLinuxArmMainSha256": "6018d2f3c80ae3469c6f697d854c62be3c2f9309c346464b0b481c7a08c04bd5", "mainTLS": { "cases": 32, "incidentHosts": 14, "typedRevoked": 28, "modes": [ "builtin", "qualified old extra CA" ], "controls": [ "public HTTPS reaches expected MCP HTTP415", "private MCP positive with proper CA", "untrusted issuer rejection", "hostname rejection" ] }, "generatedClientTLS": { "cases": 32, "typedRevoked": 28, "exactPerURLNativeArtifacts": 17 }, "sourceOwnerSha256": "98a9b7f0340875f10dfde34559a4a9e4248b8287dec18c77be8163dc49edd82f", "linuxEvidenceArchiveSha256": "ba395e6e28ff6706346c734b8186d1c267a09e58d897f653a7ef5b908908a793", "windowsComponent": { "validationHead": "6633cfcc14953004370624c54b5282ad77983470", "run": "https://github.com/openclaw/mcporter/actions/runs/40032349493", "conclusion": "SUCCESS", "artifact": 12534694578, "artifactZipSha256": "fec72f1a6a336a3fa8788696683fde1e6b29a20839599b099d4c6ec71b071f7e", "bunPE": "cb1d8e6564e655e49d30cead359750a1cbbd12f42651caa4b62244d7bd93c244", "nodePE": "d702daa815eabbff763c7d3808e235cf031cf2ca70211b56847bc72f51e240e5", "qualified": [ "actual owner selects same absolute executable", "Windows null-device metadata query works", "project-preload control sensitive and repaired query suppresses preload" ], "unqualified": [ "global preload control insensitive on Windows", "Windows compiled incident-key TLS rejection (private-CA calls qualified below)", "broad original Windows timing failure" ] } }Observed final rebuilt CLI output (transport addresses omitted)
These are field-preserving projections of retained raw product output, not simulated expected values. The private positive uses an owned synthetic MCP tool.
[ { "case": "builtin-00.stdout", "rawSHA256": "30face2a793df615b86820acd82d19a6468676697eeaed7def5f3d7e199e6fd7", "observedOutputProjection": { "mode": "server", "status": "error", "durationMs": 166, "issue": { "kind": "other", "rawMessage": "Version negotiation probe failed: certificate revoked" }, "error": "Version negotiation probe failed: certificate revoked" } }, { "case": "extra-old-00.stdout", "rawSHA256": "1be772e46d8d15bd6e024cdc67d87e6409fe7f94d4bafbc6191848b6eba4cdf2", "observedOutputProjection": { "mode": "server", "status": "error", "durationMs": 142, "issue": { "kind": "other", "rawMessage": "Version negotiation probe failed: certificate revoked" }, "error": "Version negotiation probe failed: certificate revoked" } }, { "case": "private-trusted.stdout", "rawSHA256": "576370b8845788e5ec12c468047a93e96274ffe6dd981ce5e65374c6cac2ba05", "observedOutputProjection": { "mode": "server", "status": "ok", "durationMs": 29, "tools": [ { "name": "owned_private_proof", "description": "Synthetic local tool; no model or external action", "inputSchema": { "type": "object", "properties": {} }, "options": [] } ] } }, { "case": "private-untrusted.stdout", "rawSHA256": "15887bfc0d29aa3f936a7e8d0cb57696952de2522f22ebee2928aeb4ff68f557", "observedOutputProjection": { "mode": "server", "status": "error", "durationMs": 13, "issue": { "kind": "other", "rawMessage": "Version negotiation probe failed: unable to verify the first certificate" }, "error": "Version negotiation probe failed: unable to verify the first certificate" } }, { "case": "public.stdout", "rawSHA256": "2cf9189db176bc49d2f65e2b1dcc17ae5a86ae660f5190296230495cc3b30753", "observedOutputProjection": { "mode": "server", "status": "http", "durationMs": 1284, "issue": { "kind": "http", "rawMessage": "SSE error: Non-200 status code (415)", "statusCode": 415 }, "error": "http 415" } } ]Additional finite native validation on exact source
4307fdcc994c16f9a021e97cd5d6ea004275e051: run 40053731368, macOS ARM and Windows x64 artifact jobs passed. Each independently built/packed the source, installed the actual npm tarball into a clean consumer, exercised version/help, rejected an untrusted local TLS issuer before HTTP requests (typed verifier observation), and succeeded with an explicit private CA. Both generated Node bundles and native Bun executables completed real MCPtools/callagainst the owned TLS peer. Canonical Darwin ARM main CLI was rebuilt and rejected all 14 incident destinations with built-in trust and the old explicit CA bundle (28 typedcertificate revokedoutcomes), alongside a successful private-CA MCP control. No source, security assertion, timeout, or product CI gate was weakened; initial qualification failures were setup/observation-harness defects, not product verdicts.9b80f9707a2aa972b78482d8d74665732938105afb673445ce187813e44ca780; canonical main0d6edbe68e8b7de53936f20ea5138c652ca53c4007610580d1c6bbf79a44be4b; generated Bun27890e6ccef1530e39f298a1fe977a3fb823920edb5f09a58d9940692588fa1b0cc63b5f933929b73e133326083bcc05febd4fe85a87471a16985d7d712a2d21; generated Bun98a799d9fcc8b67f3d30fb223a250b9d43daa21f290caf8260d7f4fafe1a4ec7Remaining limits: Windows generated-native incident-key rejection, Darwin Intel artifact behavior, and signed/notarized publication are not established by these runs. The original Windows timing failure remains unattributed; earlier matched full-suite comparisons passing does not prove it unrelated. These bounded gaps remain explicit for the maintainer's merge decision. Windows retained log files use CP1252/CRLF; their recorded captured-text hashes reproduce after that reversible encoding/newline transformation; archive and executable hashes identify raw bytes.