fix(cloud-agent): move the sandbox runtime to Bun 1.4.4 by iscekic · Pull Request #8825 · Kilo-Org/cloud

iscekic · 2026-10-23T12:58:30Z

Problem

Bun 1.3.14 is affected by GHSA-26q8-h657-pf84. Its bundled trust store includes emSign ECC Root CA - G3, so a certificate chain issued by any of the eight eMudhra/emSign intermediates revoked for key compromise in October 2026 verifies. Anyone on the network path can then impersonate any TLS server to that runtime.

Sandboxes that run without egress interception validate chains themselves, so this covers the control-plane wrapper and every bun install or bunx an agent runs inside the container.

Node needs no change: 24.22.1 already ships the blocked-public-key check from nodejs/node#66871. The Debian system store still trusts the Sectigo cross-signed copies, which is unchanged here.

Change

Pin Bun 1.4.4 in the runtime distribution, the five cloud-agent images, CI, the runtime publisher, the cloud-agent setup script, and the kiloclaw build stages.
Pin the Gastown container base image to oven/bun:1.4.4-slim. That container runs Bun at runtime, so the floating 1-slim tag left its trust store undetermined.
1.4.4 removes the affected root and rejects chains containing one of the compromised public keys, including chains supplied through NODE_EXTRA_CA_CERTS or SSL_CERT_FILE.
Align @types/bun with the runtime, which the image-version contract test asserts, and exempt that types-only version pair from minimumReleaseAge.

Verification

The pinned-version tests pass: sandbox-image-versions, runtime-manifest, vercel-snapshot, runtime-release.
The mobile release-age policy test passes with the new exemption group.
The wrapper builds and its full suite passes under Bun 1.4.4.
The Gastown container suite passes.
Root stores compared on the real binaries: 1.3.14 exposes four emSign roots, 1.4.4 exposes only emSign Root CA - G1, matching the advisory.

Deploy order

Merge, let the runtime publisher upload the 1.4.4 artifacts, then rebuild the images. Do not roll the images ahead of the publish.

Bun 1.3.14 bundles emSign ECC Root CA - G3, so a chain issued by any of the eight eMudhra intermediates revoked in October 2026 verifies (GHSA-26q8-h657-pf84, affected < 1.4.4). Sandboxes outside egress interception validate TLS themselves, so the wrapper and every bun install or bunx inside the container trust those keys. Bun 1.4.4 drops that root and rejects chains containing one of the compromised public keys, including chains that arrive through NODE_EXTRA_CA_CERTS or SSL_CERT_FILE, which the intercept path sets. Node needs no change: 24.22.1 already ships the blocked-public-key check from nodejs/node#66871. The Debian system store is unchanged. Bump the pin in the runtime distribution, the five cloud-agent images, CI, the runtime publisher, the cloud-agent setup script and the kiloclaw build stages. Align @types/bun with the runtime, which the image-version contract test asserts, and exempt that types-only version pair from minimumReleaseAge so the pair can move together.

socket-security · 2026-10-23T12:59:21Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@types/bun@1.3.14 ⏵ 1.4.4				^-2

View full report

socket-security · 2026-10-23T12:59:23Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

The mobile dependency-contract guard asserts the exact exclusion list in pnpm-workspace.yaml, so the Bun types pair added with the runtime bump belongs in both expected arrays.

kilo-code-bot · 2026-10-23T13:08:02Z

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental change makes markRouteReady in the terminal integration suite announce session.ready a second time after a 5 s wait, so one dropped readiness frame no longer fails a correct run; the retry is bounded (15 s total, under the suite's 30 s test budget) and the duplicate frame is idempotent in the Sandbox DO, so I found no defect on the changed lines.

Assumptions: [INFERENCE] I did not execute the integration suite, so I could not observe the retry firing against a real dropped frame. session.ready re-reconciliation is idempotent on the serial DO queue (sandbox-do.ts:4966), and a genuinely stuck route still fails within the 30 s testTimeout.

Files Reviewed (1 file)

services/cloud-agent-next/test/integration/control-plane-terminal-v2.test.ts

Previous Review Summaries (2 snapshots, latest commit efd7e5f)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit `efd7e5f`)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The incremental change pins the Gastown container base image to oven/bun:1.4.4-slim in both the production and dev Dockerfiles (plus the matching comment), closing the only remaining floating Bun tag in the repository; I found no defect on the changed lines.

Assumptions: [INFERENCE] I could not execute the container build or verify that the upstream oven/bun:1.4.4-slim multi-arch manifest resolves for both amd64 and arm64. These were the only oven/bun references left in the tree, so the runtime pin is now complete. services/gastown/container/package.json already carries @types/bun@1.4.4, matching the new runtime base.

Files Reviewed (2 files)

services/gastown/container/Dockerfile
services/gastown/container/Dockerfile.dev

Previous review (commit `0b34917`)

Status: No Issues Found | Recommendation: Merge

Executive Summary

The Bun 1.4.4 pin is applied consistently across the runtime distribution contract, all six sandbox Dockerfiles, CI, the runtime publisher, the setup script, and the kiloclaw build stages, with the contract tests, lockfile peer snapshots, and @types/bun/bun-types release-age exemptions updated to match; I found no defect on changed lines.

Assumptions: [INFERENCE] I could not execute the test suites or verify the upstream 1.4.4 release assets. Two rollout notes are process concerns rather than code defects: the runtime artifacts for bun-1.4.4 must be published before the images are rebuilt (as the PR body states), and services/gastown/container/Dockerfile{,.dev} still use the floating oven/bun:1-slim tag, so that image's Bun patch level is not pinned by this PR; the gastown @types/bun bump itself is types-only and harmless either way. The Socket bun-types LGPL-2.0 alert is unchanged from the previously pinned 1.3.14 pair.

Files Reviewed (21 files)

.github/workflows/ci.yml
.github/workflows/cloud-agent-runtime-publish.yml
.kilo/cloud-agent-setup.sh
pnpm-workspace.yaml
pnpm-lock.yaml
services/cloud-agent-next/Dockerfile
services/cloud-agent-next/Dockerfile.dev
services/cloud-agent-next/Dockerfile.containers
services/cloud-agent-next/Dockerfile.containers.runtime-free
services/cloud-agent-next/Dockerfile.dind
services/cloud-agent-next/src/shared/runtime-distribution.ts
services/cloud-agent-next/src/sandbox-image-versions.test.ts
services/cloud-agent-next/scripts/runtime-manifest.test.ts
services/cloud-agent-next/scripts/vercel-snapshot.test.ts
services/cloud-agent-next/src/sandbox-control/runtime-release.test.ts
services/cloud-agent-next/wrapper/package.json
services/cloud-agent-next/wrapper/src/control/workload-isolation.real.test.ts
services/gastown/container/package.json
services/kiloclaw/Dockerfile
services/kiloclaw/Dockerfile.local
apps/mobile/src/lib/minimum-release-age-policy.test.ts

_{Reviewed by deepseek-flash-latest · Input: 36.2K · Output: 3.3K · Cached: 315.3K}

_{Review guidance: REVIEW.md from base branch main}

…m tag The Gastown container runs bun at runtime, so a floating tag leaves its trust store undetermined. 1.4.4 is the first release that rejects the compromised eMudhra chains.

…al suite markRouteReady sent one session.ready frame and waited the full integration budget. A frame that arrives before the sandbox DO records the socket as current is dropped without a reply, which failed the terminal suite intermittently. Announce again after half the budget; a stuck route still fails.

test(mobile): expect the Bun types release-age exemption

0b34917

The mobile dependency-contract guard asserts the exact exclusion list in pnpm-workspace.yaml, so the Bun types pair added with the runtime bump belongs in both expected arrays.

iscekic added 2 commits October 23, 2026 15:10

fix(gastown): pin the runtime Bun image instead of the floating 1-sli…

efd7e5f

…m tag The Gastown container runs bun at runtime, so a floating tag leaves its trust store undetermined. 1.4.4 is the first release that rejects the compromised eMudhra chains.

chrarnoldus approved these changes Oct 23, 2026

View reviewed changes

chrarnoldus added this pull request to the merge queue Oct 23, 2026

Merged via the queue into main with commit eef3e87 Oct 23, 2026
110 checks passed

chrarnoldus deleted the fix/bun-144-truststore branch October 23, 2026 13:59

Navigation Menu

Repository navigation

fix(cloud-agent): move the sandbox runtime to Bun 1.4.4 - #8825

fix(cloud-agent): move the sandbox runtime to Bun 1.4.4#8825
chrarnoldus merged 4 commits into
mainfrom
fix/bun-144-truststore

iscekic commented Oct 23, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

kilo-code-bot Bot commented Oct 23, 2026 •

edited

Loading

Previous review (commit `efd7e5f`)

Executive Summary

Previous review (commit `0b34917`)

Executive Summary

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

iscekic commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Change

Verification

Deploy order

Uh oh!

socket-security Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kilo-code-bot Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Executive Summary

Previous review (commit efd7e5f)

Executive Summary

Previous review (commit 0b34917)

Executive Summary

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

iscekic commented Oct 23, 2026 •

edited

Loading

socket-security Bot commented Oct 23, 2026 •

edited

Loading

socket-security Bot commented Oct 23, 2026 •

edited

Loading

kilo-code-bot Bot commented Oct 23, 2026 •

edited

Loading

Previous review (commit `efd7e5f`)

Previous review (commit `0b34917`)