GGitHubfix(security): standardize standalone runtimes on Node 24.22.1 (#6365)

f0556919创建于 11 天前历史提交

文件	最后提交记录	最后更新时间
bin	fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard.	11 天前
evals	fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard.	11 天前
test	fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard.	11 天前
README.md	fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard.	11 天前
migrate.md	test(evals): a real agent follows migrate.md; fix login and Cowork guidance it exposed (#5642) Adds a live spec where Claude Code (headless, real model) follows migrate.md on a computer that has Claude Cowork's files, with the CLI from this checkout and an account on the world's Den. It scores the commands the agent ran (scan, plan, then apply for the chosen plugin only), what the organization ends up with, the final report, and that the sign-in token never appears in the transcript. Live lane: needs OPENWORK_EVAL_AGENT_ANTHROPIC_API_KEY and the claude CLI. What the first runs exposed: - `openwork-bootstrap login` ignored the account already signed in and started a device sign-in against the hosted API. Without --base-url it now checks the saved account first, like migrate does. - Cowork runs shell commands in an isolated VM that sees only connected folders, so an agent inside Cowork cannot scan Cowork's own files. migrate.md now says so and gives the two ways forward. Signed-off-by: Benjamin Shafii <ben@prologe.io>	28 天前
package.json	fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard.	11 天前
start.md	fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard.	11 天前

OpenWork Bootstrap CLI

Script-installable openwork-bootstrap command for agent-first onboarding.

Requires stable Node.js 24.x, version 24.22.1 or newer within that major. Older releases and other majors (including 25+) are rejected before any command runs. This replaces the previous Node.js 20+ requirement. The installer reuses a supported system Node or downloads a private official Node.js 24.22.1 build, verified against its published SHA-256 checksum, without changing system Node.

This package is intentionally small and does not assume npm is the install channel. A bootstrap script can place bin/openwork.mjs on disk, then run:

openwork-bootstrap install --bin-dir ~/.local/bin --install-dir ~/.openwork/bootstrap
openwork-bootstrap doctor --json
openwork-bootstrap install app --manifest https://example.com/openwork-install-manifest.json
openwork-bootstrap doctor --app --json
openwork-bootstrap login --base-url https://den.example.com
openwork-bootstrap cloud onboard --base-url https://den.example.com --org-name "Ada Workspace" --teammate-emails teammate@example.com --skill-name 'First skill' --json

Current scope:

install installs the lightweight CLI into a user-writable bin directory.
install app downloads a manifest-selected desktop app artifact, verifies its SHA-256 digest, and installs it into a user-writable app directory. Supported artifact types: macOS .dmg, .zip, .tar.gz/.tgz, Linux .AppImage, and Windows .exe/.msi copy-installs.
doctor verifies the CLI install and, optionally, a Den API health endpoint.
login signs in with the OAuth 2.0 device authorization grant (RFC 8628): it prints a link and a one-time code, the person approves in the browser, and the session is saved to ~/.openwork/credentials.json (mode 0600, override with OPENWORK_CREDENTIALS_PATH). OPENWORK_API_TOKEN takes precedence. logout revokes the session and deletes the file.
cloud onboard creates an org, invites a teammate, and creates a starter skill as the signed-in person. The --owner-email/--owner-password* flags still work but are deprecated: passwords end up in shell history. On the deprecated password path, hosted Cloud still needs the two-step email code (--request-code, then --verification-code <code> or --verification-code-stdin).

This is a bootstrap layer for install and Cloud onboarding; runtime hosting uses the desktop app, OpenWork Cloud, or openwork-server.