Skip to content

fix(bug-filing-mcp): drop unnecessary @ptrCast from the adapter dispatch call (CWE-704)#91

Merged
hyperpolymath merged 1 commit into
mainfrom
claude/adapter-ptrcast-cleanup
Jul 17, 2026
Merged

fix(bug-filing-mcp): drop unnecessary @ptrCast from the adapter dispatch call (CWE-704)#91
hyperpolymath merged 1 commit into
mainfrom
claude/adapter-ptrcast-cleanup

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

Follow-up to #89 (fixed the FFI shim's internal @ptrCasts across all 116 cartridges) and #90 (shipped bug-filing-mcp's new adapter with the old pre-#89 dispatch pattern, mirrored from k9iser-mcp before its own equivalent was cleaned up). Drops the three now-unnecessary @ptrCast calls at the adapter's dispatch call site — the same CWE-704 finding class, one file further down the stack.

Confirmed with a standalone zig build-obj test before touching the real file: Zig's [*c] pointer parameters accept array/slice/scalar pointers via implicit C-pointer coercion, so the explicit casts were doing nothing.

Schema-validation note

  • This PR adds or modifies one or more cartridge.json manifests.
  • This PR does not touch any cartridge.json.

Testing

  • zig build test (0.15.2): green.
  • Rebuilt the binary and re-ran the live smoke test (REST dispatch to /invoke?tool=submit_feedback, 404 on unknown route) — confirmed no behavioral change.

Refs

Follow-up to #89/#90. Part of #274. Same fix will be applied to the bundled snapshot in boj-server.

🤖 Generated with Claude Code

https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq


Generated by Claude Code

…tch call (CWE-704)

Follow-up to #89 (which fixed the FFI shim's internal ptrCasts) and #90
(which shipped the adapter with the old pattern, mirrored from
k9iser-mcp before that cartridge's own equivalent was cleaned up). The
three @ptrCast calls at the dispatch call site were unnecessary: Zig's
[*c] pointer parameters accept array/slice/scalar pointers via implicit
C-pointer coercion, verified by a standalone build-obj test before
touching the real file.

Re-verified with the real toolchain after the edit: zig build test green;
rebuilt the binary and re-ran the live smoke test (REST dispatch + 404 on
unknown route) to confirm no behavioral change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq
@github-actions

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 282 issues detected

Severity Count
🔴 Critical 44
🟠 High 135
🟡 Medium 103

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/auth-method-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/category-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/missing-fields-batch-fix/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/cartridge-minter/mint.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/tools/validate-cartridges/main_test.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/code-quality/sanctify-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/infrastructure/hesiod-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/bofig-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/boj-server-cartridges/boj-server-cartridges/cartridges/domains/research/academic-workflow-mcp/adapter/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

@hyperpolymath
hyperpolymath marked this pull request as ready for review July 17, 2026 16:22
@hyperpolymath
hyperpolymath merged commit cb4c0cc into main Jul 17, 2026
28 of 29 checks passed
@hyperpolymath
hyperpolymath deleted the claude/adapter-ptrcast-cleanup branch July 17, 2026 16:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants