fix(release): validate exact prepared npm package sets#102759
Conversation
openclaw-barnacle
Bot
added
scripts
bf32a16 to
127452c
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Codex review: needs maintainer review before merge. Reviewed July 9, 2026, 8:03 AM ET / 12:03 UTC. Summary PR surface: Tests +263, Config +127, Other +400. Total +790 across 19 files. Reproducibility: yes. Current main records only the root npm tarball in the preflight manifest and passes only that tarball through the checklist/Parallels path, so companion packages can resolve from a different registry set. Review metrics: 1 noteworthy metric.
Stored data model Root-cause cluster Members:
Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything. Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Risk before merge
Maintainer options:
Next step before merge
Maintainer decision needed
Security Review detailsBest possible solution: Keep the exact package-set contract and merge after release/security owners accept the strict manifest requirement and clear or address the fixture-proxy CodeQL comment. Do we have a high-confidence way to reproduce the issue? Yes. Current main records only the root npm tarball in the preflight manifest and passes only that tarball through the checklist/Parallels path, so companion packages can resolve from a different registry set. Is this the best way to solve the issue? Yes, with owner sign-off on strictness. The PR fixes both the producer and every checked consumer path, which is the right release-boundary solution; the remaining question is operational/security acceptance, not a better code location. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against c9b3358d43f7. Label changesLabel changes:
Label justifications:
Evidence reviewedPR surface: Tests +263, Config +127, Other +400. Total +790 across 19 files. View PR surface stats
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
clawsweeper
Bot
added
rating: 🐚 platinum hermit
Forward-port the beta3 package-set preflight, Telegram, and Parallels validation to main while preserving main's existing Bun install smoke. Recompute decoded proxy response lengths and require artifact tarballs to exactly match the verified manifest.
127452c to
8f8e51c
Compare
|
Land-ready proof for exact head
Known proof gap: this forward-port did not duplicate the live Telegram and Parallels release matrix; those scenarios remain owned by the release workflows. No local or hosted blocker remains for this PR. |
|
Merged via squash.
|
* fix(release): validate prepared npm package sets Forward-port the beta3 package-set preflight, Telegram, and Parallels validation to main while preserving main's existing Bun install smoke. Recompute decoded proxy response lengths and require artifact tarballs to exactly match the verified manifest. * fix(release): lock fixture registry proxy origin
* fix(release): validate prepared npm package sets Forward-port the beta3 package-set preflight, Telegram, and Parallels validation to main while preserving main's existing Bun install smoke. Recompute decoded proxy response lengths and require artifact tarballs to exactly match the verified manifest. * fix(release): lock fixture registry proxy origin (cherry picked from commit 0535679)
2 participants
Closes #102757
What Problem This Solves
Fixes an issue where release managers validating an npm candidate could pass Telegram and Parallels checks against the prepared
openclawtarball while companion packages such as@openclaw/aiwere resolved from a different registry artifact set. The candidate registry could also advertise the compressed upstreamContent-Lengthafterfetchdecoded the response body.Why This Change Was Made
The npm preflight manifest now records the exact companion tarballs, versions, and SHA-256 digests. Candidate consumers reject duplicate, missing, extra, or mismatched tarballs and install the prepared set through a local npm registry in Docker and all Parallels guest lanes. The registry keeps public npm as an upstream fallback and emits the decoded body length.
This preserves
main's existing Bun package-build fix; it forward-ports only the package-set validation and transport hardening proven duringv2026.7.1-beta.3.User Impact
Release candidates are now validated against the same root and companion package bytes intended for publication. A mixed or incomplete artifact set fails closed before publish instead of passing against already-published dependencies.
Evidence
tbx_01kx3as3asakb5sz9h9692j6qa(https://github.com/openclaw/openclaw/actions/runs/29015534662)pnpm check:changedpassed for all 19 touched release/tooling filespnpm test:serial test/scripts/npm-telegram-live.test.ts test/scripts/package-acceptance-workflow.test.ts test/scripts/parallels-npm-update-smoke.test.ts test/scripts/parallels-smoke-model.test.ts test/scripts/plugins-assertions.test.ts test/scripts/release-candidate-checklist.test.tsgit diff --check origin/main...HEADpassedde7843fc2bf1fc267b3fc30c1892f297561926f8AI-assisted maintainer change; the implementation and proof were reviewed before push.