[joshavant]

Summary

CI and release jobs can select Node runtimes that still accept the compromised eMudhra keys, including from a cached moving major. Select the released fixed patch in each existing supported Node major and keep coupled matrix predicates aligned. Package runtime compatibility and public APIs are unchanged.

Compatibility And Security

Hosted CI remains required. Linux arm64 incident qualification does not establish native macOS/Windows runtime coverage. Installed consumer runtimes and provider-owned action/runner runtimes are separate obligations.

Validation

pnpm check passes, including lint, types, build, package contents, and 140 Node/browser/Worker tests. Workflow YAML and actionlint pass; git diff --check and independent P3 review pass. The fixed Node binaries independently reject all12 incident chains in8 trust modes. Required Unreleased changelog entry included.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR pins CI and release tooling to Node.js 22.23.4, 24.22.1, and 26.12.1 and updates the coverage condition.

Example: The Linux Node 24 check starts with an older Node 24 cached on its runner.

• Before: The moving major selector can use the older cached runtime.
• After: The workflow requests Node 24.22.1 and still runs coverage.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	A focused, source-supported repair with passing hosted validation and no findings; direct evidence of the reported compromised-chain rejection is limited.
Proof confidence	🦐 gold shrimp (3/6)	The supplied maintainer-authored classification exempts this PR from the ordinary contributor proof gate; exact-head hosted CI exercises runtime setup across the retained platforms, while the reported incident-chain qualification has no linked trace.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Build and release tooling can use Node runtimes that still trust disclosed compromised CA keys.
Reason: The repair is narrow, backed by upstream security releases, and preserves supported package runtimes; the supplied maintainer-authored classification establishes direction.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it makes a focused security improvement absent from main, preserves the existing platform matrix, and introduces no actionable defect found in review.

Priority: P2
Reviewed head: 4cc18e48106acd6fd473814ac92beee430d583d1

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: The body reports incident-chain rejection but supplies no inspectable execution trace; hosted checks establish workflow compatibility rather than that TLS scenario.

Agent review details

How this fits together

GitHub Actions selects Node runtimes to install dependencies, validate the package, run browser checks, and perform protected-tag publishing.

flowchart TD
  A[Pull request or release event] --> B[Workflow runtime selection]
  B --> C[Node security patch]
  C --> D[Dependency installation]
  D --> E[Package and browser checks]
  E --> F[Protected tag publishing]

Loading

Technical review

Best possible solution:

Land the focused runtime pins while preserving package compatibility and existing release safeguards.

Do we have a high-confidence way to reproduce the issue?

Main uses moving Node major selectors, and upstream confirms the selected patches contain the relevant TLS fix; no incident-chain execution was independently reproduced.

Is this the best way to solve the issue?

Exact patch selection is the smallest complete repository-owned repair and keeps the existing matrix and coverage behavior intact.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against c5e11c32f69b.

Provenance checked

• CI and release Node selection changes intended behavior with a stated reason (45a3c6a: The automation baseline established Node 22/24 checks and Node 24 release tooling; ci: cover Node 26 and refresh transitive tooling #68 subsequently added Node 26 coverage.)
• Coverage job condition keeps the original intent (2e73ab0: test: add Vitest 5 coverage reporting #74 deliberately runs coverage in the Node 24 Linux job; the updated predicate preserves that decision.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Focused patch and unchanged compatibility boundary: The pinned introduction diff changes only workflow Node selectors, the coupled coverage predicate, and an Unreleased note; main retains moving major selectors. Package engines, public APIs, action references, publishing permissions, and release guards are unchanged. (.github/workflows/ci.yml:39, 4cc18e48106a)
• Hosted validation and feature ownership: Exact-head CI passed all seven Node/platform checks, browser smoke, workflow lint, and the retained Node 24 Linux coverage step: https://github.com/openclaw/libterminal/actions/runs/39684446103. History identifies Vincent Koc with the automation baseline and release hardening, and Peter Steinberger with Node 26 coverage and subsequent tooling changes. Full discussion contains only bot status comments; searches found no competing incident fix. One historical git show encountered an unavailable promised object; supplied provenance and GitHub PR bodies cover the changed behavior. (.github/workflows/ci.yml:72, 4cc18e48106a)
• Authoritative security-fix contract: The workflow executes Node, making its TLS contract relevant. Official release notes for v22.23.4, v24.22.1, and v26.12.1 each include blocked-public-key rejection. The upstream implementation explains the compromised eMudhra intermediates and certificate-revoked result: tls: reject chains containing blocked public keys nodejs/node#66871. (d9a3f3d150f7)

Likely related people:

• Peter Steinberger: Raw commit 2c82dce adds .github/workflows/ci.yml:43 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 2c82dce8f442; files: .github/workflows/ci.yml)
• Vincent Koc: Raw commit 45a3c6a adds .github/workflows/release.yml:42 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 45a3c6a67bfd; files: .github/workflows/release.yml)

Labels

Label changes:

• add P2: This hardens build and release tooling against a disclosed CA-key compromise without evidence of an active repository compromise or broken user workflow.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: This hardens build and release tooling against a disclosed CA-key compromise without evidence of an active repository compromise or broken user workflow.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 6:22 PM ET / 22:22 UTC.