fix(release): start installed connector in RC canary - #717
Conversation
|
@copilot review |
|
@codex review |
|
@coderabbitai review |
✅ Action performedReview finished.
|
📝 WalkthroughWalkthroughThe beta RC canary now tracks execution state, validates candidate and connector behavior, enforces exact process and rollback invariants, verifies expanded proof artifacts, and uploads sanitized failure packets. The bridge CLI also propagates its isolated state-directory environment variable. ChangesRC canary execution
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
evaOS review status: completedPR: #717 - fix(release): start installed connector in RC canary evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #717 Review URL: #717 (review) |
coderabbitai
Bot
added
area:release
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6db0da161f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![evaos-code-review-bot[bot]](https://avatars.githubusercontent.com/in/4184532?s=60&v=4){kind=small}
There was a problem hiding this comment.
Walkthrough
PR: #717 - fix(release): start installed connector in RC canary
Head: 6db0da161f2ad5d3d06e8dc9d6809597264680dd into evaos/beta-rc-20260612. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~58 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
.github/workflows/evaos-beta-rc-canary.yml |
modified | +844/-37 | Changed file | Moderate: validated P3 finding |
scripts/evaosBetaReleaseGate.js |
modified | +220/-0 | Changed file | Elevated: large change |
tests/unit/process/evaosBetaReleaseGate.test.ts |
modified | +208/-3 | Test coverage | Elevated: large change |
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts |
modified | +423/-1 | Test coverage | Elevated: large change |
Review Signal
Validated inline findings: 1 (P0: 0, P1: 0, P2: 0, P3: 1).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Runtime correctness: 1
Validation and Proof
2 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
- required: CI/release smoke proof - CI, release, launchd, or package metadata changed. Proof: green GitHub check; release-status; coverage-audit; rollback note.
Proof status: missing - 1 required validation/proof recommendation(s) missing from PR metadata.
Profile validation hints: Do not ask for broad local suites when remote CI or fast-smoke proof is the right gate.
Profile proof expectations: Look for focused app smoke, packaged resource checks, or CI artifact proof when relevant.
Related Context
Related issues/PRs: #708, #623.
Suggested labels: tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
apps/eva-desktop-mac/**- Check macOS identity, helper path, TCC identity, and packaged resource shape risk. - Path instructions:
scripts/**- Treat release, packaging, and artifact-shape changes as high risk. - Label suggestions: workbench, macos, regression-hardening
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/evaos-beta-rc-canary.yml:
- Around line 851-861: The workflow audit must prove that the canonical
Workbench process is present, rather than succeeding when no matching process is
found. In .github/workflows/evaos-beta-rc-canary.yml lines 851-861, track
whether canonicalApp is matched and exit nonzero when absent; in
scripts/evaosBetaReleaseGate.js lines 1016-1017, require that positive assertion
from the workflow audit; in
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts lines 432-449, add
cases for empty and unrelated-only snapshots that must fail.
In `@scripts/evaosBetaReleaseGate.js`:
- Around line 1107-1125: Update the failure-writer audit around
unsafeFailureWriter to parse the embedded script and enforce an exact allowlist
of approved environment keys and payload fields, rejecting additions such as
GH_TOKEN or secret fields even when they bypass the current blacklist. Preserve
the existing schema and step checks, and add a tamper test covering an
unauthorized secret field.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 957c17ee-42da-4b9c-95c5-710bb2a0f44a
📒 Files selected for processing (5)
.github/workflows/evaos-beta-rc-canary.ymlresources/evaos-beta/bridge/src/evaos_desktop_bridge/qa_canary.pyscripts/evaosBetaReleaseGate.jstests/unit/process/evaosBetaReleaseGate.test.tstests/unit/process/prepareEvaosDesktopBridgeResource.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: Coverage Test
- GitHub Check: Build Test (macos-arm64)
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{js,jsx,ts,tsx}: Name utility files using camelCase, such as formatDate.ts.
Prefix unused parameters with_.
Format code with Oxfmt using Prettier-compatible rules: inline single-element arrays that fit on one line, require trailing commas in multiline arrays and objects, and use single quotes for strings.
Files:
tests/unit/process/prepareEvaosDesktopBridgeResource.test.tsscripts/evaosBetaReleaseGate.jstests/unit/process/evaosBetaReleaseGate.test.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Use strict TypeScript; do not useanyand do not leave implicit returns.
Use the path aliases@/*,@process/*, and@renderer/*.
Prefertypeoverinterfaceaccording to the Oxlint configuration.
Write code comments in English and use JSDoc for public functions.
Files:
tests/unit/process/prepareEvaosDesktopBridgeResource.test.tstests/unit/process/evaosBetaReleaseGate.test.ts
**/*.{test,spec}.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use Vitest 4 for tests and maintain at least 80% coverage.
Files:
tests/unit/process/prepareEvaosDesktopBridgeResource.test.tstests/unit/process/evaosBetaReleaseGate.test.ts
🪛 ast-grep (0.44.1)
tests/unit/process/evaosBetaReleaseGate.test.ts
[warning] 3853-3861: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(
path.join(proofDir, 'rollback-smoke.md'),
[
'PASS: candidate app rolled back; released fallback app launched; data/cache disposition recorded; protocol handler state evaos-workbench / com.evaos.workbench inspected; broker login/session state remained usable.',
'Fallback exact bundle identity verified: true',
'Fallback exact main-process path verified: true',
'Fallback exact main-process dwell seconds: 8',
].join('\n') + '\n'
)
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 3878-3878: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(rollbackProofPath, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 3884-3884: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(rollbackProofPath, rollbackProof.replace(${requiredMarker}\n, ''))
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 3895-3895: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(rollbackProofPath, rollbackProof)
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 3898-3898: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(connectorStartProofPath, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 3900-3900: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(connectorStartProofPath, ${JSON.stringify(connectorStartProof, null, 2)}\n)
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 3912-3912: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(connectorStartProofPath, ${JSON.stringify(connectorStartProof, null, 2)}\n)
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 3923-3923: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(connectorStartProofPath, ${JSON.stringify(connectorStartProof, null, 2)}\n)
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
🪛 zizmor (1.26.1)
.github/workflows/evaos-beta-rc-canary.yml
[error] 1739-1739: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🔇 Additional comments (6)
.github/workflows/evaos-beta-rc-canary.yml (2)
138-138: LGTM!Also applies to: 269-300, 332-332, 438-533, 581-581, 600-751, 875-878, 888-889, 944-1202, 1211-1239, 1272-1601, 1612-1612, 1633-1633, 1643-1735, 1746-1762
1739-1739: 🔒 Security & PrivacyLeave
actions/upload-artifact@v4as-is. The workflow matches the repo’s existing versioned action pattern, and there’s no documented full-SHA pinning rule to enforce here.> Likely an incorrect or invalid review comment.resources/evaos-beta/bridge/src/evaos_desktop_bridge/qa_canary.py (1)
671-671: LGTM!scripts/evaosBetaReleaseGate.js (1)
208-221: LGTM!Also applies to: 277-279, 975-1015, 1018-1106, 1126-1129, 3945-3990, 4176-4177
tests/unit/process/evaosBetaReleaseGate.test.ts (1)
275-300: LGTM!Also applies to: 1103-1108, 1175-1180, 1215-1330, 3856-3925
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts (1)
269-307: LGTM!Also applies to: 321-321, 385-431, 450-767
evaOS review status: completedPR: #717 - fix(release): start installed connector in RC canary evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #717 Review URL: #717 (review) |
There was a problem hiding this comment.
Walkthrough
PR: #717 - fix(release): start installed connector in RC canary
Head: 0e6138966c14bfa4b665c743fe98eb11c5d6e296 into evaos/beta-rc-20260612. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~58 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
.github/workflows/evaos-beta-rc-canary.yml |
modified | +872/-40 | Changed file | Moderate: validated P2 finding |
scripts/evaosBetaReleaseGate.js |
modified | +253/-0 | Changed file | Elevated: large change |
tests/unit/process/evaosBetaReleaseGate.test.ts |
modified | +405/-3 | Test coverage | Elevated: large change |
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts |
modified | +452/-1 | Test coverage | Elevated: large change |
Review Signal
Validated inline findings: 3 (P0: 0, P1: 0, P2: 1, P3: 2).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- CI/build: 1
- Release regression: 1
- Runtime correctness: 1
Validation and Proof
2 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
- required: CI/release smoke proof - CI, release, launchd, or package metadata changed. Proof: green GitHub check; release-status; coverage-audit; rollback note.
Proof status: missing - 1 required validation/proof recommendation(s) missing from PR metadata.
Profile validation hints: Do not ask for broad local suites when remote CI or fast-smoke proof is the right gate.
Profile proof expectations: Look for focused app smoke, packaged resource checks, or CI artifact proof when relevant.
Related Context
Related issues/PRs: #708, #623.
Suggested labels: tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
apps/eva-desktop-mac/**- Check macOS identity, helper path, TCC identity, and packaged resource shape risk. - Path instructions:
scripts/**- Treat release, packaging, and artifact-shape changes as high risk. - Label suggestions: workbench, macos, regression-hardening
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
|
@coderabbitai review |
|
@copilot review |
|
@codex review |
✅ Action performedReview finished.
|
evaOS review status: completedPR: #717 - fix(release): start installed connector in RC canary evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #717 Review URL: #717 (review) |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
Walkthrough
PR: #717 - fix(release): start installed connector in RC canary
Head: 1fc36868ae8dc37cf9d921ff0f3a8e31c8b653b6 into evaos/beta-rc-20260612. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~58 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
.github/workflows/evaos-beta-rc-canary.yml |
modified | +896/-40 | Changed file | Moderate: validated P3 finding |
scripts/evaosBetaReleaseGate.js |
modified | +260/-0 | Changed file | Elevated: large change |
tests/unit/process/evaosBetaReleaseGate.test.ts |
modified | +492/-3 | Test coverage | Elevated: large change |
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts |
modified | +452/-1 | Test coverage | Elevated: large change |
Review Signal
Validated inline findings: 2 (P0: 0, P1: 0, P2: 0, P3: 2).
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
- Flaky test risk: 1
- Runtime correctness: 1
Validation and Proof
2 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
- required: CI/release smoke proof - CI, release, launchd, or package metadata changed. Proof: green GitHub check; release-status; coverage-audit; rollback note.
Proof status: missing - 1 required validation/proof recommendation(s) missing from PR metadata.
Profile validation hints: Do not ask for broad local suites when remote CI or fast-smoke proof is the right gate.
Profile proof expectations: Look for focused app smoke, packaged resource checks, or CI artifact proof when relevant.
Related Context
Related issues/PRs: #708, #623.
Suggested labels: tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
apps/eva-desktop-mac/**- Check macOS identity, helper path, TCC identity, and packaged resource shape risk. - Path instructions:
scripts/**- Treat release, packaging, and artifact-shape changes as high risk. - Label suggestions: workbench, macos, regression-hardening
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
evaOS review status: completedPR: #717 - fix(release): start installed connector in RC canary evaOS review completed for this PR head. Automation note: agents should wait for this comment to reach PR URL: #717 Review URL: #717 (review) |
|
@copilot review |
|
@codex review |
|
@coderabbitai review |
✅ Action performedReview finished.
|
100yenadmin
left a comment
100yenadmin
left a comment
There was a problem hiding this comment.
Thread disposition recorded against exact head e60846f.
100yenadmin
left a comment
100yenadmin
left a comment
There was a problem hiding this comment.
Thread disposition recorded against exact head e60846f.
100yenadmin
left a comment
100yenadmin
left a comment
There was a problem hiding this comment.
Thread disposition recorded against exact head e60846f.
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/evaos-beta-rc-canary.yml (1)
887-902: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftProve that
open -ncreated the canonical main process.The current contract proves only that a canonical process exists afterward, so a stale process can falsely satisfy candidate-launch proof.
.github/workflows/evaos-beta-rc-canary.yml#L887-L902: snapshot canonical main PIDs before launch and require a newly appearing exact-path PID after the dwell.scripts/evaosBetaReleaseGate.js#L1053-L1056: require the baseline and new-PID comparison in the workflow audit.tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts#L444-L459: add stale-canonical-only and stale-plus-new PID cases.tests/unit/process/evaosBetaReleaseGate.test.ts#L1394-L1398: add mutations removing baseline capture and PID-delta validation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/evaos-beta-rc-canary.yml around lines 887 - 902, Prove that the launch created a new canonical main process rather than reusing a stale one. In .github/workflows/evaos-beta-rc-canary.yml:887-902, snapshot canonical main PIDs before launch and require an exact-path PID absent from the baseline after the dwell; update scripts/evaosBetaReleaseGate.js:1053-1056 to audit both baseline capture and PID-delta validation; add stale-only and stale-plus-new PID cases in tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts:444-459 and mutations removing baseline capture or delta validation in tests/unit/process/evaosBetaReleaseGate.test.ts:1394-1398.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/evaos-beta-rc-canary.yml:
- Around line 887-902: Prove that the launch created a new canonical main
process rather than reusing a stale one. In
.github/workflows/evaos-beta-rc-canary.yml:887-902, snapshot canonical main PIDs
before launch and require an exact-path PID absent from the baseline after the
dwell; update scripts/evaosBetaReleaseGate.js:1053-1056 to audit both baseline
capture and PID-delta validation; add stale-only and stale-plus-new PID cases in
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts:444-459 and
mutations removing baseline capture or delta validation in
tests/unit/process/evaosBetaReleaseGate.test.ts:1394-1398.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9bc43d23-3b90-40bb-98d3-f5302dc6f2ff
📒 Files selected for processing (4)
.github/workflows/evaos-beta-rc-canary.ymlscripts/evaosBetaReleaseGate.jstests/unit/process/evaosBetaReleaseGate.test.tstests/unit/process/prepareEvaosDesktopBridgeResource.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: Build Test (macos-arm64)
- GitHub Check: Unit Tests (macos-14)
- GitHub Check: Coverage Test
🧰 Additional context used
📓 Path-based instructions (3)
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{js,jsx,ts,tsx}: Name utility files using camelCase, such as formatDate.ts.
Prefix unused parameters with_.
Format code with Oxfmt using Prettier-compatible rules: inline single-element arrays that fit on one line, require trailing commas in multiline arrays and objects, and use single quotes for strings.
Files:
tests/unit/process/prepareEvaosDesktopBridgeResource.test.tstests/unit/process/evaosBetaReleaseGate.test.tsscripts/evaosBetaReleaseGate.js
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Use strict TypeScript; do not useanyand do not leave implicit returns.
Use the path aliases@/*,@process/*, and@renderer/*.
Prefertypeoverinterfaceaccording to the Oxlint configuration.
Write code comments in English and use JSDoc for public functions.
Files:
tests/unit/process/prepareEvaosDesktopBridgeResource.test.tstests/unit/process/evaosBetaReleaseGate.test.ts
**/*.{test,spec}.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Use Vitest 4 for tests and maintain at least 80% coverage.
Files:
tests/unit/process/prepareEvaosDesktopBridgeResource.test.tstests/unit/process/evaosBetaReleaseGate.test.ts
🪛 ast-grep (0.44.1)
tests/unit/process/evaosBetaReleaseGate.test.ts
[warning] 1548-1548: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.join(repoRoot, '.github/workflows/evaos-beta-rc-canary.yml'), 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1555-1555: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(githubEnv, '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1556-1556: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(waitLog, '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1557-1557: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(signalLog, '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1565-1565: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(waitLog, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1566-1566: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(signalLog, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1567-1567: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(githubEnv, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1574-1574: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.join(repoRoot, '.github/workflows/evaos-beta-rc-canary.yml'), 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1581-1581: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(githubEnv, '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1582-1582: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(waitLog, '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1583-1583: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(signalLog, '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1591-1591: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(waitLog, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1592-1592: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(signalLog, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1593-1593: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(githubEnv, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1600-1600: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.join(repoRoot, '.github/workflows/evaos-beta-rc-canary.yml'), 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1607-1607: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(githubEnv, '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1608-1608: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(waitLog, '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1609-1609: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(signalLog, '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1617-1617: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(waitLog, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1618-1618: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(signalLog, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1619-1619: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(githubEnv, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1626-1626: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.join(repoRoot, '.github/workflows/evaos-beta-rc-canary.yml'), 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1633-1633: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(githubEnv, '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1634-1634: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(waitLog, '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1635-1635: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(signalLog, '')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1643-1643: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.join(dir, 'job-probe-count'), 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1644-1644: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(waitLog, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1645-1645: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(signalLog, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1646-1646: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(githubEnv, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 1653-1653: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.join(repoRoot, '.github/workflows/evaos-beta-rc-canary.yml'), 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
🔇 Additional comments (4)
.github/workflows/evaos-beta-rc-canary.yml (1)
138-138: LGTM!Also applies to: 269-300, 332-332, 438-443, 505-533, 581-581, 600-797, 923-926, 936-937, 992-1251, 1260-1261, 1281-1288, 1321-1339, 1379-1511, 1524-1632, 1641-1650, 1661-1661, 1692-1811
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts (1)
269-307: LGTM!Also applies to: 321-321, 385-443, 460-796
scripts/evaosBetaReleaseGate.js (1)
21-21: LGTM!Also applies to: 209-222, 278-280, 976-1052, 1057-1184, 4000-4045, 4231-4232
tests/unit/process/evaosBetaReleaseGate.test.ts (1)
60-160: LGTM!Also applies to: 376-401, 1204-1209, 1276-1281, 1316-1393, 1399-1517, 1548-1679, 4175-4180, 4197-4244
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e60846f3de
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Walkthrough
PR: #717 - fix(release): start installed connector in RC canary
Head: e60846f3dec4b2a6ae56b757049400a9ab3e11e2 into evaos/beta-rc-20260612. Review event: COMMENT.
Provider: GLM/Z.ai through ZCode (zcode-glm, zcode, model GLM-5.2).
Estimated review effort: 5/5 (~58 min)
Changed Files
| File | Status | Churn | Purpose | Risk |
|---|---|---|---|---|
.github/workflows/evaos-beta-rc-canary.yml |
modified | +896/-40 | Changed file | Elevated: large change |
scripts/evaosBetaReleaseGate.js |
modified | +275/-0 | Changed file | Elevated: large change |
tests/unit/process/evaosBetaReleaseGate.test.ts |
modified | +527/-3 | Test coverage | Elevated: large change |
tests/unit/process/prepareEvaosDesktopBridgeResource.test.ts |
modified | +452/-1 | Test coverage | Elevated: large change |
Review Signal
No validated inline findings.
Dropped findings before posting: 0. High-severity findings: 0.
Risk Taxonomy
No finding categories.
Validation and Proof
2 required validation/proof recommendation(s) selected from changed files.
- required: TypeScript/web build or CI proof - Runtime TypeScript/web files or package/config files changed. Proof: npm run build; typecheck; focused Vitest; green GitHub check.
- required: CI/release smoke proof - CI, release, launchd, or package metadata changed. Proof: green GitHub check; release-status; coverage-audit; rollback note.
Proof status: missing - 1 required validation/proof recommendation(s) missing from PR metadata.
Profile validation hints: Do not ask for broad local suites when remote CI or fast-smoke proof is the right gate.
Profile proof expectations: Look for focused app smoke, packaged resource checks, or CI artifact proof when relevant.
Related Context
Related issues/PRs: #708, #623.
Suggested labels: tests.
Suggested reviewers: none from current metadata.
Review Settings Preview
- Profile: assertive
- Enabled sections: Review summary (inline_review); Walkthrough (inline_review); Changed-files table (walkthrough); Effort estimate (walkthrough); Related issues/PRs (walkthrough); Suggested labels (suggestion_only); Review status comment (sticky_status)
- Path instructions:
apps/eva-desktop-mac/**- Check macOS identity, helper path, TCC identity, and packaged resource shape risk. - Path instructions:
scripts/**- Treat release, packaging, and artifact-shape changes as high risk. - Label suggestions: workbench, macos, regression-hardening
- Reviewer suggestions: none
- Suggestion behavior: suggestions only; labels and reviewers are not auto-applied.
- Roadmap-only settings: auto-apply labels; auto-request reviewers; required status checks
Pre-merge checklist
- Inline comments target current RIGHT-side diff lines.
- No secret-like content survived into posted inline comments.
- REQUEST_CHANGES is only used when eligible P0/P1 findings survive validation.
- Required behavior proof is present or not applicable.
- Labels and reviewers are suggestions only; the bot did not auto-apply them.
v2.1.36 / Mac Access inheritance checkpointThis is the stable, unmerged source checkpoint for the v2.1.36 Workbench lane.
Connector contracts Mac Access must inherit
Dependency and proof boundary
This is source/PR proof only. It does not prove a fresh signed/notarized installed candidate, installed-app RC and live canaries, private-tailnet selected-binding/direct Mac control, pristine-Mac onboarding, publication, distribution, or customer readiness. Mac Access #699/#707 must not refresh from this unmerged head. Refresh is safe only from a later canonical merge or explicitly designated superseding head, and only after the v2.1.36 distribution freeze is explicitly lifted. |
1 participant
Pull Request
Description
The immutable
evaos-beta-v2.1.36-evaos-beta.4candidate passed build, signing, notarization, manifest registration, and the installed pre-canary, but RC run29481445600failed because the workflow launched Workbench and then waited for a connector token without starting the packaged connector. Generic Workbench launch must not auto-start Mac control.This change makes the RC workflow own an isolated installed-candidate connector process explicitly. It starts the packaged bridge on loopback with an isolated state directory, proves the securely created token and health endpoint, runs the installed connector QA against the same state, sanitizes failure evidence, and terminates only exact bundle-owned processes. Rollback now runs after every post-install outcome and proves the restored fallback's exact bundle identity and exact main process for an eight-second dwell.
The
.4candidate remains immutable and unpublished. A successful merge would require a fresh candidate; this PR does not claim release or customer readiness.Related Issues
Type of Change
fix- Bug fix (non-breaking change which fixes an issue)feat- New feature (non-breaking change which adds functionality)perf- Performance improvementrefactor- Code restructuring (no behavior change)docs- Documentation updateAtomic PR Checklist (Rule 1)
<type>(<scope>): <subject>in EnglishLocal Checks (Rule 2)
oxfmt --checkpasses for all changed formatter-supported filesoxlintreports 0 errors; six pre-existingconsistent-function-scopingwarnings remainbunx tsc --noEmit- deferred to canonical CI; no production TypeScript changedgit diff --check- no whitespace errorsactionlint .github/workflows/evaos-beta-rc-canary.ymlnode scripts/evaosBetaReleaseGate.js audit-configqa_canary.pyRuntime Verification
Agent Handoff
100yenadmin/evaOS-GUIserve; same-state QA child; regular runner-owned0600token read throughO_NOFOLLOWand a fixed 130-byte buffer; strict sanitized connector-start proof; exact bundle-path process cleanup; restored fallback identity/path/eight-second dwell proof.4remains unpublished and must not be reused as release proofScreenshots
N/A; release harness and proof-gate change.
Additional Context
Publication remains fail-closed. Private-tailnet selected-binding/direct Mac-control proof and pristine-Mac onboarding are separate hardware/runtime gates and are not replaced by this loopback installed-candidate canary.
Summary by CodeRabbit