fix(desktop): load system CAs from OS trust stores; remove obsolete installer app - #3203
Merged
Merged
Conversation
resolveSystemCaEnv had one source, tls.getCACertificates("system"), which
returns 0 certificates on macOS and misses intermediates outside the ROOT
store on Windows. Behind a corporate CA the Chromium surfaces worked while
OpenCode (Bun) failed every TLS connection to the org endpoint with
'unable to verify the first certificate'.
- port the additive loader to apps/desktop/electron/system-ca.mjs:
Windows LocalMachine/CurrentUser Root+CA stores via PowerShell, macOS
admin keychains via security find-certificate, merged and deduped into
system-ca-bundle.pem for NODE_EXTRA_CA_CERTS
- extend the Electron main process default CA set with the same additions
(best-effort tls.setDefaultCACertificates) so the embedded OpenWork
server's own probes trust the corporate CA; env mutation after boot
never reached it
- operator-set NODE_EXTRA_CA_CERTS keeps its skip-and-win semantics
The generic installer (apps/installer) is replaced by the release pipeline shipping desktop assets directly. Remove the app, its build and release workflows, eval flows, version bumping, outbound-access scan entry, and the OpenWork-Installer-* asset plumbing in den-api install links, den-web install screens, and the landing release-asset filter. Configured install-link artifacts now resolve by the standard versioned desktop asset filename. packages/install-config and packages/paths stay (install links are a Den feature).
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
Deploying openwork with
|
| Latest commit: |
84da5c9
|
| Status: | ⚡️ Build in progress... |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 1 — Fix: desktop loads system CAs from the OS trust stores
Root cause of the self-hosted TLS incident:
resolveSystemCaEnvhad exactly one source —tls.getCACertificates("system")— which returns 0 certificates on macOS (measured on the control machine and reproduced here) and misses intermediates outside the ROOT store on Windows. Behind a corporate CA, Chromium surfaces (sign-in, Den API, models) worked while OpenCode (Bun) failed every TLS connection to the org MCP endpoint withunable to verify the first certificate. The richer additive loader existed in the installer since its TLS fix but was never ported to the desktop app.Changes (
apps/desktop/electron/system-ca.mjs+runtime.mjs):LocalMachine/CurrentUserRoot+CAstores (PowerShell, hidden window, 10s timeout, 8MB cap) + macOS admin keychains (security find-certificate -a -pon System.keychain + SystemRootCertificates.keychain — admin keychains only, login keychain deliberately excluded). Written tosystem-ca-bundle.pem, passed to all children (OpenCode/Bun readsNODE_EXTRA_CA_CERTSat spawn).tls.setDefaultCACertificates(defaults ∪ additions)so the embedded OpenWork server's own probes (cloud-mcp-health, the newcloud-endpoint-transportdiagnostics from feat(diagnostics): capture MCP registration errors and cloud endpoint transport evidence #3201) trust the corporate CA —Object.assign(process.env, …)after boot never reached the main process (this was the root of the earlier "corporate Windows probe_unreachable" field incident).NODE_EXTRA_CA_CERTSkeeps its skip-and-win semantics; source counts are logged each launch.Proof (real run on macOS — the failing platform class)
{ "platform": "darwin", "tlsSystemCount": 1, "oldBehavior": { "sources": "runtime=1 platform-disabled=0" }, "newBehavior": { "sources": "runtime=1 macos-keychains=158", "bundleFile": "written", "bundleCertCount": 159, "envSet": true, "mainProcessDefaults": { "before": 147, "after": 195, "extended": true } }, "operatorOverrideSkips": true }On the customer's Electron (Node 22.16) the runtime source is 0, so the old path produced nothing — every macOS user failed; the new path ships the keychain-managed corporate CA to OpenCode and the embedded server.
Part 2 — Remove the obsolete standalone installer
apps/installer(Bun webview installer) is replaced by the release pipeline shipping desktop assets directly. Removed end to end:webview-bunlock entries.build-client-installer,release-generic-installer,eval-generic-installer-release,ci-installer-windows-trust; thepublish-installersjob + release gate inrelease-macos-aarch64.yml.installer-tls-trust,generic-installer-release-contract,org-install-link); trimmed installer frames fromorg-install-activation,first-connection,standard-dmg-bootstrap-zip,organization-display-branding,desktop-upgrade-preserves-server-url,org-aware-dashboard-downloads,den-download-link-match-allowed-versions.OpenWork-Installer-*plumbing: den-api install links now resolve configured artifacts by the standard versioned desktop asset filename (redirect path was already desktop-asset based); den-web install/activation screens simplified (installer-preview.tsxdeleted); landing release-asset filter cleaned.bump-version.mjs,check-outbound-access.mjs, helm README, release skill docs updated. Keptpackages/install-config+packages/paths(install links are a Den feature; paths used by server/desktop).apps/installer|openwork-installer|OpenWork-Installer: zero matches outside changelog history.Tests run (all verified by the reviewer-side commands below)
pnpm --dir apps/desktop test— 131 pass / 0 fail (incl. new incident-case test: runtime=0 + keychain certs → bundle +setDefaultCACertificatessuperset; dedupe; parser fixtures; optional-API guards)pnpm --dir apps/desktop run typecheck:electron✅bun test test/installer-artifacts.test.ts test/install-link-access.test.ts— 39 pass / 0 failpnpm --filter openwork-server typecheck✅ ·pnpm --filter @openwork/app typecheck✅node scripts/check-outbound-access.mjs✅ ·node --checkon every edited script/flow ✅ ·pnpm installlockfile update clean ✅Validation honesty: macOS CA loading proven live on a real machine (mechanism: keychain → bundle → env + extended defaults); no live Windows cert-store run (this environment is macOS — the
daytona-windows-certsandbox is the follow-up for a GPO-injected CA end-to-end); no fraimz/video. Blue Yonder's macOS users (Venkat, Kerthi, Vamsi) are the real-world validation once this ships in 0.18.7.