Skip to content

chore(cli): add Cloud Agent environment config #1468

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Jaden Lemmon (jadenlemmon) wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

chore(cli): add Cloud Agent environment config #1468

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .cursor/environment.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
{
"name": "@qawolf/cli",
"install": "command -v bun >/dev/null 2>&1 || curl -fsSL https://bun.sh/install | bash -s \"bun-v1.3.13\"; export BUN_INSTALL=\"$HOME/.bun\"; export PATH=\"$BUN_INSTALL/bin:$PATH\"; bun install --frozen-lockfile"

@coderabbitai coderabbitai Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- .cursor/environment.json ---'
cat -n .cursor/environment.json
printf '%s\n' '--- package.json Bun declarations ---'
rg -n -C 2 '"bun"|packageManager' package.json bun.lockb bun.lock 2>/dev/null || true
printf '%s\n' '--- installer references ---'
rg -n 'bun\.sh/install|bun-v1\.3\.13|BUN_INSTALL|bun install' . --glob '!node_modules' --glob '!dist' --glob '!build' | head -100

Repository: qawolf/cli

Length of output: 2507

🌐 Web query:

Bun install script versioned URL checksum verification bun.sh/install bun-v1.3.13

💡 Result:

The official Bun install script provided at https://bun.sh/install does not natively implement or prompt for checksum verification of the installation script itself when piped to shell [1][2]. The standard, recommended installation method—curl -fsSL https://bun.sh/install | bash—executes the script directly from the remote URL without an integrated checksum check [3][4][5]. If you require security hardening, such as preventing man-in-the-middle attacks or ensuring the integrity of the downloaded script, you must perform the verification manually or via third-party tools. Manual Verification and Hardening Strategies: 1. Use Third-Party Verification Tools: Projects such as checksum.sh provide a wrapper to download, inspect, and verify scripts against a known checksum before piping them to a shell [6][7]. Note that you must independently obtain and trust the checksum for the specific script version you intend to execute [6][7]. 2. Download and Verify the Binary Directly: For production environments or CI/CD pipelines, it is standard security practice to bypass the install script entirely [8]. You can download the specific Bun release binary (e.g., bun-v1.3.13) directly from the official GitHub releases page [4]. The GitHub release for v1.3.13 includes a SHASUMS256.txt file, which allows you to cryptographically verify the downloaded zip archive before extracting it [4]. Example of verifying a direct download: BUN_VERSION="1.3.13" # Download the specific binary curl -LO "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip" # Verify using the checksum file provided in the release # (Ensure you verify the SHASUMS256.txt file itself from a trusted source) sha256sum -c SHASUMS256.txt --ignore-missing The official documentation does not provide a specific checksum for the install.sh script itself for each release, as the install script is generally maintained to fetch the latest or requested version dynamically [1][3]. Consequently, hardening efforts typically focus on version pinning and verifying the final binary assets provided in official GitHub releases rather than the install script itself [8].

Citations:

🏁 Script executed:

#!/bin/bash
set -eu
python3 - <<'PY'
import json, urllib.request

urls = {
    "installer": "https://bun.sh/install",
    "release_checksums": "https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/SHASUMS256.txt",
}
for name, url in urls.items():
    print(f"--- {name}: {url} ---")
    with urllib.request.urlopen(url, timeout=20) as response:
        data = response.read()
        print("status:", response.status)
        print("content_type:", response.headers.get("content-type"))
        print("bytes:", len(data))
        if name == "installer":
            text = data.decode("utf-8", "replace")
            print("contains requested release:", "bun-v1.3.13" in text)
            print("version-related lines:")
            for line in text.splitlines():
                if "BUN_VERSION" in line or "version" in line.lower() or "bun-" in line:
                    print(line[:240])
        else:
            print(data.decode("utf-8", "replace")[:1000])
PY

Repository: qawolf/cli

Length of output: 2476

Pin or verify the Bun installer script.

At .cursor/environment.json:3, curl ... | bash executes the mutable https://bun.sh/install response. bun-v1.3.13 selects the Bun release but does not pin the installer contents. Use a version-pinned, checksum-verified installer, or verify the Bun release binary checksum before extraction.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.cursor/environment.json at line 3, Update the install command in the
environment configuration so the Bun installation no longer pipes the mutable
bun.sh/install response directly into bash. Use a version-pinned,
checksum-verified installer or download and verify the Bun v1.3.13 release
binary before extraction, while preserving the existing BUN_INSTALL, PATH, and
frozen dependency installation behavior.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
printf '%s\n' '--- .cursor/environment.json ---'
cat -n .cursor/environment.json
printf '%s\n' '--- package manifests and Bun references ---'
rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' '"packageManager"|"bun"|bun-v|bun install|environment' package.json bun.lockb bun.lock .cursor 2>/dev/null || true
printf '%s\n' '--- relevant tracked files ---'
git ls-files .cursor package.json bun.lock bun.lockb

Repository: qawolf/cli

Length of output: 867

🏁 Script executed:

#!/bin/bash
python3 - <<'PY'
import json, re
from pathlib import Path

env = json.loads(Path(".cursor/environment.json").read_text())
pkg = json.loads(Path("package.json").read_text())
command = env["install"]
required = pkg["packageManager"].split("@", 1)[1]

print("required_version:", required)
print("has_presence_check:", "command -v bun" in command)
print("has_version_check:", "bun --version" in command)
print("installer_argument:", re.search(r'bash -s \\"([^"]+)\\"', command).group(1))
PY

printf '%s\n' '--- shell branch with an existing mismatched Bun ---'
bash -c '
  bun() {
    if [ "$1" = "--version" ]; then
      printf "%s\n" "1.2.0"
    else
      printf "bun invocation: %s\n" "$*"
    fi
  }
  command -v bun >/dev/null 2>&1 || printf "%s\n" "installer would run"
  printf "%s\n" "existing bun version: $(bun --version)"
  bun install --frozen-lockfile
'

printf '%s\n' '--- Bun installer documentation references ---'
curl -L --max-time 15 -s https://bun.sh/docs/installation | rg -n -i -C 2 'version|bun-v|install' | head -80 || true

Repository: qawolf/cli

Length of output: 50367

🏁 Script executed:

#!/bin/bash
python3 - <<'PY'
import json
from pathlib import Path

env = json.loads(Path(".cursor/environment.json").read_text())
pkg = json.loads(Path("package.json").read_text())
command = env["install"]
required = pkg["packageManager"].split("@", 1)[1]

print("required_version:", required)
print("has_presence_check:", "command -v bun" in command)
print("has_version_check:", "bun --version" in command)
print("contains_requested_installer_version:", f'bun-v{required}' in command)
PY

printf '%s\n' '--- plain-text Bun installation documentation ---'
for url in \
  https://bun.com/docs/installation.md \
  https://bun.sh/docs/installation.md
do
  printf 'URL: %s\n' "$url"
  curl -L --max-time 15 -sS "$url" |
    rg -n -i -C 3 --max-count 8 'bun-v|bash -s|version' || true
done

Repository: qawolf/cli

Length of output: 4647

Enforce Bun 1.3.13 before installing dependencies. At .cursor/environment.json:3, check bun --version and run the installer when the version is not 1.3.13; command -v bun alone accepts incompatible versions.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.cursor/environment.json at line 3, Update the install command in the
environment configuration to validate bun --version equals 1.3.13, and run the
Bun installer when Bun is missing or has any other version. Preserve the
existing BUN_INSTALL and PATH setup, then run bun install --frozen-lockfile
using the validated version.

}
Loading