fix(cartridges): drop unchecked @ptrCast from all cartridge shims (CWE-704) by hyperpolymath · Pull Request #89 · hyperpolymath/boj-server-cartridges

hyperpolymath · 2026-07-17T09:38:16Z

Closes the Hypatia code_safety/zig_ptr_cast alert (#550) raised on #85, which reported 8 unchecked pointer conversions (CWE-704) in bug-filing-mcp/ffi/cartridge_shim.zig.

#85 merged before the alert was addressed, so the flagged code is now on main and the alert is still open. This fixes it there.

Why 115 files

cartridge_shim.zig is vendored byte-identical into 116 cartridges, so the same latent flaw sat in every copy — the alert only named bug-filing-mcp because that was the file #85 touched. Each other copy would raise the identical alert as soon as a PR touched it. Fixing them together also stops the vendored copies drifting apart.

The fix

The 8 casts were redundant, not unsafe — no behaviour change:

std.mem.sliceTo(ptr, 0) accepts a [*c]const u8 directly and scans to the NUL, so neither the @ptrCast nor the [*:0] re-typing was ever needed.
Typing the test locals as [*c]const u8 removes the cast at the call sites.

The non-null precondition documented on toolIs is unchanged and still enforced by invokeArgsNull.

local-coord-mcp already carried exactly this fix (post-#146). This adopts that as the canonical form rather than inventing a second one, which collapses the shim from three divergent variants to two. npc-mcp keeps its trimmed layout and takes the same transform.

Verification

Run against the CI toolchain (zig 0.15.2), not my local default:

All 116/116 shims pass zig test.
115/116 cartridges zig build clean. database-mcp fails only on a missing local libsqlite3 — it fails identically on pristine main, so it is environmental and unrelated to this change.
No @ptrCast remains in any shim.

🤖 Generated with Claude Code

Hypatia code_safety/zig_ptr_cast flagged 8 unchecked pointer conversions (CWE-704) in bug-filing-mcp's cartridge_shim.zig (alert 550, raised on #85). The shim is vendored byte-identical into 116 cartridges, so the same latent flaw sat in every copy and would have surfaced as a fresh alert each time one was touched. The casts were redundant rather than unsafe: std.mem.sliceTo(ptr, 0) takes the [*c]const u8 directly and scans to the NUL, and typing the test locals as [*c]const u8 removes the need to cast at the call sites. Behaviour is unchanged — the non-null precondition documented on toolIs still holds and is still enforced by invokeArgsNull. local-coord-mcp already carried exactly this fix (post-#146); this adopts that as the canonical form rather than inventing a second one, which also collapses the shim from three divergent variants to two. npc-mcp keeps its trimmed layout and takes the same transform. Verified under the CI toolchain (zig 0.15.2): all 116 shims pass zig test, and 115/116 cartridges build clean. database-mcp fails only for a missing local libsqlite3 — it fails identically on pristine main, so it is environmental and unrelated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

github-actions · 2026-07-17T09:39:11Z

🔍 Hypatia Security Scan

Findings: 282 issues detected

Severity	Count
🔴 Critical	44
🟠 High	133
🟡 Medium	105

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/auth-method-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/category-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/missing-fields-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/cartridge-minter/mint.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/code-quality/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/infrastructure/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

github-actions · 2026-07-17T10:48:43Z

🔍 Hypatia Security Scan

Findings: 281 issues detected

Severity	Count
🔴 Critical	44
🟠 High	133
🟡 Medium	104

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/auth-method-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/category-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/missing-fields-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/cartridge-minter/mint.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/code-quality/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/infrastructure/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

…tch call (CWE-704) Follow-up to #89 (which fixed the FFI shim's internal ptrCasts) and #90 (which shipped the adapter with the old pattern, mirrored from k9iser-mcp before that cartridge's own equivalent was cleaned up). The three @ptrCast calls at the dispatch call site were unnecessary: Zig's [*c] pointer parameters accept array/slice/scalar pointers via implicit C-pointer coercion, verified by a standalone build-obj test before touching the real file. Re-verified with the real toolchain after the edit: zig build test green; rebuilt the binary and re-ran the live smoke test (REST dispatch + 404 on unknown route) to confirm no behavioral change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq

…tch call (CWE-704) (#91)  ## Summary Follow-up to #89 (fixed the FFI shim's internal `@ptrCast`s across all 116 cartridges) and #90 (shipped bug-filing-mcp's new adapter with the old pre-#89 dispatch pattern, mirrored from k9iser-mcp before its own equivalent was cleaned up). Drops the three now-unnecessary `@ptrCast` calls at the adapter's dispatch call site — the same CWE-704 finding class, one file further down the stack. Confirmed with a standalone `zig build-obj` test before touching the real file: Zig's `[*c]` pointer parameters accept array/slice/scalar pointers via implicit C-pointer coercion, so the explicit casts were doing nothing. ## Schema-validation note - [ ] This PR adds or modifies one or more `cartridge.json` manifests. - [x] This PR does not touch any `cartridge.json`. ## Testing - `zig build test` (0.15.2): green. - Rebuilt the binary and re-ran the live smoke test (REST dispatch to `/invoke?tool=submit_feedback`, 404 on unknown route) — confirmed no behavioral change. ## Refs Follow-up to #89/#90. Part of #274. Same fix will be applied to the bundled snapshot in `boj-server`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq --- _Generated by [Claude Code](https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq)_ Co-authored-by: Claude <noreply@anthropic.com>

Merge branch 'main' into fix/zig-ptr-cast-shim

0cb8cb9

hyperpolymath merged commit 47f1ac3 into main Jul 17, 2026
28 of 29 checks passed

hyperpolymath deleted the fix/zig-ptr-cast-shim branch July 17, 2026 10:51

hyperpolymath mentioned this pull request Jul 17, 2026

fix(bug-filing-mcp): drop unnecessary @ptrCast from the adapter dispatch call (CWE-704) #91

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(cartridges): drop unchecked @ptrCast from all cartridge shims (CWE-704)#89

fix(cartridges): drop unchecked @ptrCast from all cartridge shims (CWE-704)#89
hyperpolymath merged 2 commits into
mainfrom
fix/zig-ptr-cast-shim

hyperpolymath commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Jul 17, 2026

Why 115 files

The fix

Verification

Uh oh!

github-actions Bot commented Jul 17, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Jul 17, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant