Skip to content

fix(release): ship the automation runtime (sdk/automate/analyze) in release archives - #98

Merged
ralyodio merged 1 commit into
mainfrom
fix/release-automation-runtime
Sep 13, 2026
Merged

ralyodio merged 1 commit into
mainfrom
fix/release-automation-runtime

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Release tarballs v3.9.13 and v3.10.0 contain no sdk/ at all: build-release.sh stages the automation runtime only when pnpm ... build succeeds, and the release job never installed pnpm or the workspace, so the stage was silently skipped. That is why tron mcp, tron analyze, tron run and now tron automate answer "This TronBrowser build lacks ... Run: tron upgrade" on a fresh install.

  • Install the workspace (corepack pnpm 9.12.0, --filter @tronbrowser/sdk...) before packaging on linux/macos.
  • Fail the job when the archive has no sdk/automate-bin.js.
  • Print the staging build log tail on failure instead of one line.
  • Relay health reply reports the caller's scheme behind Railway's TLS edge.

Verified locally: build-release.sh v3.10.1-test linux with pnpm present stages 67 sdk/ entries including sdk/automate-bin.js. Tag v3.10.1 after merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_018WGZpo8on6XLGYnccXV3dP

…mation runtime ships

Every release tarball since the automation runtime landed has shipped without
sdk/, automate/ and analyze/: build-release.sh stages them only when it can
run `pnpm ... build`, and the release job never installed pnpm or the
workspace, so the stage skipped with a one-line note nobody read. v3.9.13 and
v3.10.0 both have zero sdk/ entries, which is why `tron mcp`, `tron analyze`,
`tron run` and now `tron automate` all answered "This TronBrowser build lacks
... Run: tron upgrade" on a fresh install.

- release.yml: corepack + `pnpm install --frozen-lockfile --filter
  @tronbrowser/sdk...` before packaging on linux/macos, and a step that fails
  the job when the archive has no sdk/automate-bin.js.
- build-release.sh: keep the staging build log and print its tail on failure.
- services/api mcp/tron: the GET health reply reports the caller's scheme
  (x-forwarded-proto) instead of http:// behind Railway's TLS edge.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018WGZpo8on6XLGYnccXV3dP
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

51 finding(s)

MEDIUM: 32 | LOW: 19

Severity Rule Location
MEDIUM js-open-redirect apps/desktop/extensions/ai-sidebar/install-helper.js:156
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:34
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/media.js:57
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:237
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:266
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/newtab.js:336
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/options.js:305
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:77
MEDIUM js-unescaped-html-sink apps/desktop/extensions/ai-sidebar/sidepanel.js:165
MEDIUM sh-remote-script-execution apps/desktop/launcher/tronbrowser:122
MEDIUM sh-remote-script-execution apps/desktop/launcher/tronbrowser:432
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:77
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:227
MEDIUM js-unescaped-html-sink apps/extensions/public/store.js:569
MEDIUM js-unescaped-html-sink apps/web/public/app.js:29
MEDIUM js-unescaped-html-sink apps/web/public/dns.js:54
MEDIUM sh-remote-script-execution apps/web/public/install.sh:161
MEDIUM sh-remote-script-execution apps/web/public/install.sh:166
MEDIUM sh-remote-script-execution apps/web/public/install.sh:279
MEDIUM sh-remote-script-execution apps/web/public/install.sh:297
MEDIUM sh-remote-script-execution apps/web/public/install.sh:704
MEDIUM sh-remote-script-execution apps/web/public/install.sh:985
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:96
MEDIUM js-unescaped-html-sink apps/web/public/settings.js:168
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:80
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:92
MEDIUM js-dynamic-code-execution packages/sdk/src/mcp/tools.ts:103
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:65
MEDIUM js-dynamic-code-execution packages/sdk/src/page.ts:70
MEDIUM sql-template-interpolation services/api/src/store/db.ts:116
MEDIUM js-dynamic-code-execution services/api/src/store/scanner.ts:44
MEDIUM sh-predictable-temp-path start.sh:25
LOW js-dynamic-code-execution packages/agent-runtime/src/analyze/form-script.test.ts:6
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:26
LOW js-unescaped-html-sink packages/agent-runtime/src/analyze/form-script.test.ts:49
LOW js-dynamic-code-execution packages/browser-core/src/automation/extract-script.test.ts:6
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:35
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:47
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:70
LOW js-unescaped-html-sink packages/browser-core/src/automation/extract-script.test.ts:89
LOW js-dynamic-code-execution packages/browser-core/src/automation/snapshot-script.test.ts:11
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:24
LOW js-unescaped-html-sink packages/browser-core/src/automation/snapshot-script.test.ts:63
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:47
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:170
LOW js-unescaped-html-sink packages/provenance/src/scan.test.ts:216
LOW js-dynamic-code-execution packages/sdk/src/mcp/automate.test.ts:258
LOW secret-generic-api-key packages/storage/src/config.ts:51
LOW secret-generic-credential packages/storage/src/config.ts:51
LOW js-dynamic-code-execution services/api/src/store/scanner.test.ts:32

…and 1 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit ee98326 into main Sep 13, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant