chore(cli): add Cloud Agent environment config - #1468
chore(cli): add Cloud Agent environment config#1468Jaden Lemmon (jadenlemmon) wants to merge 1 commit into
Conversation
WalkthroughAdded Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.cursor/environment.json:
- Line 3: Update the install command in the environment configuration so the Bun
installation no longer pipes the mutable bun.sh/install response directly into
bash. Use a version-pinned, checksum-verified installer or download and verify
the Bun v1.3.13 release binary before extraction, while preserving the existing
BUN_INSTALL, PATH, and frozen dependency installation behavior.
- Line 3: Update the install command in the environment configuration to
validate bun --version equals 1.3.13, and run the Bun installer when Bun is
missing or has any other version. Preserve the existing BUN_INSTALL and PATH
setup, then run bun install --frozen-lockfile using the validated version.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: be753cdb-b540-4e9f-b44d-8ed72bb81b04
📒 Files selected for processing (1)
.cursor/environment.json
| @@ -0,0 +1,4 @@ | |||
| { | |||
| "name": "@qawolf/cli", | |||
| "install": "command -v bun >/dev/null 2>&1 || curl -fsSL https://bun.sh/install | bash -s \"bun-v1.3.13\"; export BUN_INSTALL=\"$HOME/.bun\"; export PATH=\"$BUN_INSTALL/bin:$PATH\"; bun install --frozen-lockfile" | |||
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- .cursor/environment.json ---'
cat -n .cursor/environment.json
printf '%s\n' '--- package.json Bun declarations ---'
rg -n -C 2 '"bun"|packageManager' package.json bun.lockb bun.lock 2>/dev/null || true
printf '%s\n' '--- installer references ---'
rg -n 'bun\.sh/install|bun-v1\.3\.13|BUN_INSTALL|bun install' . --glob '!node_modules' --glob '!dist' --glob '!build' | head -100Repository: qawolf/cli
Length of output: 2507
🌐 Web query:
Bun install script versioned URL checksum verification bun.sh/install bun-v1.3.13
💡 Result:
The official Bun install script provided at https://bun.sh/install does not natively implement or prompt for checksum verification of the installation script itself when piped to shell [1][2]. The standard, recommended installation method—curl -fsSL https://bun.sh/install | bash—executes the script directly from the remote URL without an integrated checksum check [3][4][5]. If you require security hardening, such as preventing man-in-the-middle attacks or ensuring the integrity of the downloaded script, you must perform the verification manually or via third-party tools. Manual Verification and Hardening Strategies: 1. Use Third-Party Verification Tools: Projects such as checksum.sh provide a wrapper to download, inspect, and verify scripts against a known checksum before piping them to a shell [6][7]. Note that you must independently obtain and trust the checksum for the specific script version you intend to execute [6][7]. 2. Download and Verify the Binary Directly: For production environments or CI/CD pipelines, it is standard security practice to bypass the install script entirely [8]. You can download the specific Bun release binary (e.g., bun-v1.3.13) directly from the official GitHub releases page [4]. The GitHub release for v1.3.13 includes a SHASUMS256.txt file, which allows you to cryptographically verify the downloaded zip archive before extracting it [4]. Example of verifying a direct download: BUN_VERSION="1.3.13" # Download the specific binary curl -LO "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip" # Verify using the checksum file provided in the release # (Ensure you verify the SHASUMS256.txt file itself from a trusted source) sha256sum -c SHASUMS256.txt --ignore-missing The official documentation does not provide a specific checksum for the install.sh script itself for each release, as the install script is generally maintained to fetch the latest or requested version dynamically [1][3]. Consequently, hardening efforts typically focus on version pinning and verifying the final binary assets provided in official GitHub releases rather than the install script itself [8].
Citations:
- 1: https://bun.sh/install
- 2: https://github.com/oven-sh/bun/blob/main/src/cli/install.sh
- 3: https://bun.com/docs/installation
- 4: https://github.com/oven-sh/bun/releases/tag/bun-v1.3.13
- 5: https://bun.com/blog/release-notes/bun-v1.3.13
- 6: https://checksum.sh/
- 7: https://github.com/gavinuhma/checksum.sh
- 8: Harden Bun install: pin version + SHA256 checksum openclaw/openclaw#59028
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import json, urllib.request
urls = {
"installer": "https://bun.sh/install",
"release_checksums": "https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/SHASUMS256.txt",
}
for name, url in urls.items():
print(f"--- {name}: {url} ---")
with urllib.request.urlopen(url, timeout=20) as response:
data = response.read()
print("status:", response.status)
print("content_type:", response.headers.get("content-type"))
print("bytes:", len(data))
if name == "installer":
text = data.decode("utf-8", "replace")
print("contains requested release:", "bun-v1.3.13" in text)
print("version-related lines:")
for line in text.splitlines():
if "BUN_VERSION" in line or "version" in line.lower() or "bun-" in line:
print(line[:240])
else:
print(data.decode("utf-8", "replace")[:1000])
PYRepository: qawolf/cli
Length of output: 2476
Pin or verify the Bun installer script.
At .cursor/environment.json:3, curl ... | bash executes the mutable https://bun.sh/install response. bun-v1.3.13 selects the Bun release but does not pin the installer contents. Use a version-pinned, checksum-verified installer, or verify the Bun release binary checksum before extraction.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.cursor/environment.json at line 3, Update the install command in the
environment configuration so the Bun installation no longer pipes the mutable
bun.sh/install response directly into bash. Use a version-pinned,
checksum-verified installer or download and verify the Bun v1.3.13 release
binary before extraction, while preserving the existing BUN_INSTALL, PATH, and
frozen dependency installation behavior.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
printf '%s\n' '--- .cursor/environment.json ---'
cat -n .cursor/environment.json
printf '%s\n' '--- package manifests and Bun references ---'
rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' '"packageManager"|"bun"|bun-v|bun install|environment' package.json bun.lockb bun.lock .cursor 2>/dev/null || true
printf '%s\n' '--- relevant tracked files ---'
git ls-files .cursor package.json bun.lock bun.lockbRepository: qawolf/cli
Length of output: 867
🏁 Script executed:
#!/bin/bash
python3 - <<'PY'
import json, re
from pathlib import Path
env = json.loads(Path(".cursor/environment.json").read_text())
pkg = json.loads(Path("package.json").read_text())
command = env["install"]
required = pkg["packageManager"].split("@", 1)[1]
print("required_version:", required)
print("has_presence_check:", "command -v bun" in command)
print("has_version_check:", "bun --version" in command)
print("installer_argument:", re.search(r'bash -s \\"([^"]+)\\"', command).group(1))
PY
printf '%s\n' '--- shell branch with an existing mismatched Bun ---'
bash -c '
bun() {
if [ "$1" = "--version" ]; then
printf "%s\n" "1.2.0"
else
printf "bun invocation: %s\n" "$*"
fi
}
command -v bun >/dev/null 2>&1 || printf "%s\n" "installer would run"
printf "%s\n" "existing bun version: $(bun --version)"
bun install --frozen-lockfile
'
printf '%s\n' '--- Bun installer documentation references ---'
curl -L --max-time 15 -s https://bun.sh/docs/installation | rg -n -i -C 2 'version|bun-v|install' | head -80 || trueRepository: qawolf/cli
Length of output: 50367
🏁 Script executed:
#!/bin/bash
python3 - <<'PY'
import json
from pathlib import Path
env = json.loads(Path(".cursor/environment.json").read_text())
pkg = json.loads(Path("package.json").read_text())
command = env["install"]
required = pkg["packageManager"].split("@", 1)[1]
print("required_version:", required)
print("has_presence_check:", "command -v bun" in command)
print("has_version_check:", "bun --version" in command)
print("contains_requested_installer_version:", f'bun-v{required}' in command)
PY
printf '%s\n' '--- plain-text Bun installation documentation ---'
for url in \
https://bun.com/docs/installation.md \
https://bun.sh/docs/installation.md
do
printf 'URL: %s\n' "$url"
curl -L --max-time 15 -sS "$url" |
rg -n -i -C 3 --max-count 8 'bun-v|bash -s|version' || true
doneRepository: qawolf/cli
Length of output: 4647
Enforce Bun 1.3.13 before installing dependencies. At .cursor/environment.json:3, check bun --version and run the installer when the version is not 1.3.13; command -v bun alone accepts incompatible versions.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.cursor/environment.json at line 3, Update the install command in the
environment configuration to validate bun --version equals 1.3.13, and run the
Bun installer when Bun is missing or has any other version. Preserve the
existing BUN_INSTALL and PATH setup, then run bun install --frozen-lockfile
using the validated version.
2 participants
Overview of Changes
Adds a
.cursor/environment.jsonso QA Wolf Cloud Agents get a working, reproducible dev environment out of the box. The repo needs Bun (pinned viapackageManager), which is not present in the default image, so theinstallphase installs the pinned Bun (bun-v1.3.13) when it is missing and then runsbun install --frozen-lockfile. The command is idempotent and needs nostart/terminalsbecause the CLI has no long-running services.Testing
Validated end to end on a fresh VM: Bun install, dependency install (twice, for idempotence), the full quality suite, a build, and a real product action (running the web example flow, which launches Chromium and passes).
bun run typecheck bun run lint bun run format:check bun run knip bun run test bun run build bun run dev -- doctor bun run dev -- flows run examples/example.flow.ts --junit /tmp/junit.xmlChecklist