fix(matrix): use fixed crypto bootstrap command by Patrick-Erichsen · Pull Request #97181 · openclaw/openclaw

Patrick-Erichsen · 2026-06-27T05:13:53Z

What Problem This Solves

The Matrix plugin's packaged crypto bootstrap surfaced as suspicious in ClawHub because the source exposed an injectable Node executable / command-runner path around the native Matrix crypto dependency repair command.

Why This Change Was Made

The runtime only needs to run the package-local download-lib.js with the current Node executable. This removes the test-only command and executable injection seam from production code while keeping the same fixed argv, cwd, timeout, bounded output, retry, and incomplete-binding cleanup behavior.

Per maintainer direction, this PR no longer bumps the Matrix plugin package version or shrinkwrap root metadata. It now carries the source hardening only, with zero dependency-file changes relative to origin/main.

User Impact

Matrix users keep the same automatic native crypto runtime repair behavior. Future Matrix package artifacts built from this source will no longer expose the injectable bootstrap command path that triggered the scanner concern; publishing a new immutable ClawHub package artifact can happen in the normal follow-up release flow.

Evidence

node scripts/run-vitest.mjs extensions/matrix/src/matrix/deps.test.ts
node scripts/generate-npm-shrinkwrap.mjs --package-dir extensions/matrix --check
git diff --check origin/main...HEAD
pnpm check:docs
pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes-97181-after-revert.md --json /tmp/dependency-changes-97181-after-revert.json
pnpm install && pnpm exec oxfmt --check extensions/matrix/src/matrix/deps.ts extensions/matrix/src/matrix/deps.test.ts

Dependency report after reverting release metadata:

Changed dependency files: 0
Added resolved packages: 0
Removed resolved packages: 0
Changed resolved package versions: 0

github-actions · 2026-06-27T05:14:25Z

Dependency graph guard cleared

This PR no longer has blocked dependency graph changes. A future dependency graph change requires a fresh /allow-dependencies-change comment after the guard blocks that new head SHA.

Current SHA: 1257b36556673ff2acd389885425e4d3076d6503

clawsweeper · 2026-06-27T05:15:24Z

Codex review: needs maintainer review before merge. Reviewed June 29, 2026, 11:53 PM ET / 03:53 UTC.

Summary
The PR removes the Matrix crypto runtime runCommand and nodeExecutable injection seam and updates Matrix deps tests to exercise the fixed process.execPath bootstrap path.

PR surface: Source -10, Tests -3. Total -13 across 2 files.

Reproducibility: yes. from source inspection: current main exposes runCommand and nodeExecutable parameters and uses them to build the Matrix native crypto bootstrap command. I did not run a live packaged Matrix bootstrap.

Review metrics: 2 noteworthy metrics.

Bootstrap injection seams: 2 removed. The PR removes the production runCommand and nodeExecutable override path from the Matrix native crypto bootstrap command.
Dependency metadata: 0 dependency files changed; 0 resolved packages changed. The current head no longer asks maintainers to approve a package version or shrinkwrap change as part of this source hardening.

Stored data model
Persistent data-model change detected: serialized state: extensions/matrix/src/matrix/deps.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Get Matrix or secops owner review on the current head before merge.

Risk before merge

[P1] The changed path still executes upstream @matrix-org/matrix-sdk-crypto-nodejs/download-lib.js, which downloads a platform native binding from GitHub releases; green CI does not replace Matrix/security owner signoff for that boundary.
[P1] The current head intentionally leaves package version and shrinkwrap metadata unchanged, so an immutable ClawHub package republish/rescan remains a follow-up release operation rather than something this PR itself completes.

Maintainer options:

Get current-head security signoff (recommended)
Have a Matrix or secops owner confirm that head 1257b36556673ff2acd389885425e4d3076d6503 is the intended source-only hardening before merge.
Ask for packaged bootstrap proof
If maintainers want stronger artifact confidence, ask for a redacted packaged Matrix crypto bootstrap log or ClawHub scan proof before merge.

Next step before merge

[P2] Human review is the remaining action because the PR has a protected maintainer label and touches a native crypto download/command execution path; there is no narrow automated repair to queue.

Security
Cleared: No concrete new security or supply-chain regression was found; the diff removes an injectable command seam and no longer changes dependency metadata.

Review details

Best possible solution:

Land the source-only hardening after current-head Matrix or secops review, keeping package metadata unchanged until the normal Matrix publish flow.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: current main exposes runCommand and nodeExecutable parameters and uses them to build the Matrix native crypto bootstrap command. I did not run a live packaged Matrix bootstrap.

Is this the best way to solve the issue?

Yes: after the metadata revert, using the existing fixed command runner with process.execPath is the narrow owner-boundary hardening. The remaining blocker is current-head Matrix/security review, not a code repair.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 72f837a4a478.

Label changes

Label justifications:

P2: This is focused Matrix plugin hardening with limited blast radius, but it still affects a native crypto bootstrap path.
merge-risk: 🚨 security-boundary: The PR changes the command path used to execute the Matrix native crypto download script, so security-boundary review remains meaningful even with green CI.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR has current-head terminal validation in the body plus copied dependency-report output showing zero dependency-file or resolved-package changes after the metadata revert.
proof: sufficient: Contributor real behavior proof is sufficient. The PR has current-head terminal validation in the body plus copied dependency-report output showing zero dependency-file or resolved-package changes after the metadata revert.

Evidence reviewed

PR surface:

Source -10, Tests -3. Total -13 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	3	13	-10
Tests	1	47	50	-3
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	50	63	-13

What I checked:

Repository policy applied: Root AGENTS.md and the scoped extensions guide were read; their dependency-backed behavior, plugin-boundary, and security-sensitive review guidance applies to this Matrix plugin change. (AGENTS.md:1, 72f837a4a478)
Current main exposes the injectable bootstrap seam: Current main's Matrix runtime deps type accepts runCommand and nodeExecutable, and the bootstrap path uses them to build the native crypto download command. (extensions/matrix/src/matrix/deps.ts:17, 72f837a4a478)
PR head fixes the command path: At PR head, the dependency shape only accepts requireFn, resolveFn, and log, and the bootstrap command calls runFixedCommandWithTimeout with [process.execPath, scriptPath]. (extensions/matrix/src/matrix/deps.ts:17, 1257b3655667)
Runtime caller checked: Matrix crypto loading calls ensureMatrixCryptoRuntime() before loading the native crypto bindings, so the changed helper is on the Matrix E2EE/native crypto runtime path. (extensions/matrix/src/matrix/sdk/crypto-facade.ts:81, 72f837a4a478)
Focused tests exercise real script execution: The PR-head tests replace mocked command injection with temporary download-lib.js scripts that verify cwd, COREPACK_ENABLE_DOWNLOAD_PROMPT=0, retry, and incomplete-binding cleanup behavior. (extensions/matrix/src/matrix/deps.test.ts:70, 1257b3655667)
Upstream dependency contract inspected: The upstream package declares postinstall: node download-lib.js; download-lib.js downloads a platform native binding from GitHub releases into the package directory. (package/download-lib.js:25)

Likely related people:

bmendonca3: The Matrix native crypto bootstrap and its original tests, including the command injection seams now being hardened, were introduced in the merged bootstrap work. (role: introduced bootstrap behavior; confidence: high; commits: 66c1da45d4c9; files: extensions/matrix/src/matrix/deps.ts, extensions/matrix/src/matrix/deps.test.ts)
gumadeiras: CONTRIBUTING lists Matrix under this person’s areas, and nearby merged history includes Matrix packaged runtime wrapper fixes. (role: Matrix area owner and recent Matrix runtime contributor; confidence: high; commits: a17c6046a96f, 12ad809e7906, 94693f7ff036; files: extensions/matrix/src/plugin-entry.runtime.js, extensions/matrix/src/matrix/sdk/crypto-facade.ts, extensions/matrix)
mbelinky: A security commit touched this same Matrix deps path to disable the broader plugin runtime command execution primitive and introduce fixed command execution. (role: security-adjacent contributor; confidence: medium; commits: 45db2aa0cd1b; files: extensions/matrix/src/matrix/deps.ts)
steipete: The original bootstrap PR was merged by this person, and shortlog/history show repeated contributions on the central Matrix crypto/runtime files. (role: bootstrap PR merger and frequent Matrix path contributor; confidence: medium; commits: 66c1da45d4c9, 605cb60586eb; files: extensions/matrix/src/matrix/deps.ts, extensions/matrix/src/matrix/deps.test.ts, extensions/matrix/src/matrix/sdk/crypto-facade.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Patrick-Erichsen · 2026-06-30T03:19:25Z

/allow-dependencies-change reviewed dependency report: 0 added, 0 removed, 0 changed resolved packages; Matrix version and shrinkwrap metadata bump is intentional for @openclaw/[email protected] ClawHub republish.

Patrick-Erichsen · 2026-06-30T03:26:08Z

@openclaw/openclaw-secops approval needed for the current head SHA 0b0a12b82075c1fa742d359f1a1bfd1bd01c5493 so this Matrix republish path can land.

Fresh proof from this head:

pnpm check:docs passes after refreshing docs/docs_map.md.
pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes-97181.md --json /tmp/dependency-changes-97181.json reports 0 added, 0 removed, 0 changed resolved packages and 2 dependency file changes.
The two dependency-file changes are the intentional @openclaw/[email protected] package version metadata and shrinkwrap root metadata for the ClawHub republish/rescan.

Dependency Guard is expected to stay red until a listed repo admin or secops reviewer posts the override command for this exact SHA. After that, I can rerun Dependency Guard and continue with merge plus Matrix-only publish/rescan.

Patrick-Erichsen requested a review from a team as a code owner June 27, 2026 05:13

openclaw-barnacle Bot added channel: matrix Channel integration: matrix size: S maintainer Maintainer-authored PR labels Jun 27, 2026

github-actions Bot added the dependencies-changed PR changes dependency-related files label Jun 27, 2026

Patrick-Erichsen self-assigned this Jun 30, 2026

Patrick-Erichsen added 2 commits June 29, 2026 20:41

fix(matrix): use fixed crypto bootstrap command

ced2027

chore(matrix): drop release metadata bump

1257b36

github-actions Bot mentioned this pull request Jun 30, 2026

🦞 OpenClaw 生态日报 2026-06-30 96loveslife/big_model_radar#80

Open

clawsweeper Bot mentioned this pull request Jul 7, 2026

fix(matrix): handle stdout/stderr stream errors in dependency commands #101597

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(matrix): use fixed crypto bootstrap command#97181

fix(matrix): use fixed crypto bootstrap command#97181
Patrick-Erichsen merged 2 commits into
mainfrom
pe/claw-434-matrix-fixed-node-bootstrap

Patrick-Erichsen commented Jun 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

Patrick-Erichsen commented Jun 30, 2026

Uh oh!

Patrick-Erichsen commented Jun 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

Patrick-Erichsen commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

github-actions Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency graph guard cleared

Uh oh!

clawsweeper Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Patrick-Erichsen commented Jun 30, 2026

Uh oh!

Patrick-Erichsen commented Jun 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Patrick-Erichsen commented Jun 27, 2026 •

edited

Loading

github-actions Bot commented Jun 27, 2026 •

edited

Loading

clawsweeper Bot commented Jun 27, 2026 •

edited

Loading