[harjothkhara]

Summary

Fixes #4652.

The v0.78.0 glibc Linux CLI tarballs fail to start on Ubuntu 26.04 with libxml2.so.2: cannot open shared object file. Ubuntu 26.04 ships libxml2 2.15, which provides libxml2.so.16. This is a regression of #1046, which was fixed by limiting FoundationXML to macOS in JetBrainsStatusProbe.swift. #4608 then added ProviderPluginIconSVG.swift with the old #if canImport(FoundationXML) guard. Because ProviderPluginManifest calls ProviderPluginIconSVG.isValid, CodexBarCore pulled FoundationXML, and with it libxml2.so.2, back into the Linux CLI.

Changes:

• ProviderPluginIconSVG: uses the same #if os(macOS) && canImport(FoundationXML) guard as the JetBrains fix. The XMLParser allowlist validation is macOS-only. On other platforms, isValid returns false, so plugin icons fall back to the monogram. Only the macOS app draws plugin icons. No other FoundationXML or XMLParser use exists outside the already-guarded JetBrains probe.
• CI regression gate: build-linux-cli in ci.yml, and the two glibc entries in release-cli.yml, now fail if the built CodexBarCLI lists libxml2 in its readelf -d NEEDED entries. This regression has now happened twice. The gate fails closed:
  • readelf output is captured unmasked, so an inspection error fails the step.
  • An empty NEEDED list also fails.
  • The static musl release builds have no dynamic section, so they're excluded via matrix.asset-platform == 'linux'.

Real behavior proof (Linux CI on this PR)

This comes from this PR's own CI run, 39350172637. The build-linux-cli jobs build the shipped glibc CodexBarCLI (swift build -c release --product CodexBarCLI --static-swift-stdlib) and run the new gate on that exact binary.

Startup: the existing "Smoke test CodexBarCLI" step ran the fixed binary on both architectures before the gate, and it passed. That step checks --help, --version, and the Linux usage --provider codex --web error path.

Actual dependency list from readelf -d, linux-x64 job:

 0x0000000000000001 (NEEDED)             Shared library: [libsqlite3.so.0]
 0x0000000000000001 (NEEDED)             Shared library: [libcurl.so.4]
 0x0000000000000001 (NEEDED)             Shared library: [libm.so.6]
 0x0000000000000001 (NEEDED)             Shared library: [libstdc++.so.6]
 0x0000000000000001 (NEEDED)             Shared library: [libgcc_s.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x0000000000000001 (NEEDED)             Shared library: [ld-linux-x86-64.so.2]

The linux-arm64 job has the same list, ending in ld-linux-aarch64.so.1. There's no libxml2.so.2 on either architecture, so the dynamic loader on Ubuntu 26.04, which only ships libxml2.so.16, has nothing missing to fail on. By contrast, the v0.78.0 linux-x86_64 and linux-aarch64 release binaries list libxml2.so.2, per readelf -d in #4652. Both gate steps passed, along with build-linux-musl-cli.

Commands run

• swift build --target CodexBarCore and swift build --product CodexBarCLI (macOS): pass
• make check: 0 violations
• Scripts/test_ci_path_gate.sh: pass, and both workflow YAMLs parse
• Gate script with a stubbed readelf:
  • readelf fails → step fails
  • NEEDED libxml2.so.2 → step fails
  • clean NEEDED list → step passes
  • empty output → step fails
• I can't build Linux binaries on my macOS host. This PR's build-linux-cli jobs run the new readelf gate against the real glibc CLI, for x64 and arm64.

Thanks @simonsteiner for the precise diagnosis.

🤖 Generated with Claude Code

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T07:28:13.098376Z	cf8d059	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

Restrict plugin SVG parsing to macOS and reject glibc CLI builds that link libxml2.

Example: Run CodexBarCLI --version on Ubuntu 26.04 without libxml2.so.2.

• Before: The v0.78.0 glibc binary exits with a missing libxml2.so.2 loader error.
• After: The fixed Linux binary starts and has no libxml2 NEEDED entry.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, correct repair supported by shipped Linux startup and dependency evidence; the macOS test job was still running when inspected.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (live_output): The updated body provides actual fixed-binary ELF dependencies for x64 and arm64, and linked exact-head jobs confirm shipped CLI startup and the libxml2 gate on both architectures. Together these resolve the earlier request: the reported missing SONAME is absent from the fixed binaries, although no Ubuntu 26.04 rerun is claimed.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: The released glibc CLI fails before initialization when libxml2.so.2 is absent.
Reason: It restores CLI startup without adding settings, changing the plugin schema, or weakening the macOS renderer's safeguards.

Regression provenance

Possible regression — probable (reviewed change; failure trace). No predecessor PR is attributed.

Merge readiness

✅ Ready for maintainer review

This PR fixes a confirmed Linux startup regression still present on main; no actionable patch defects remain.

Priority: P1
Reviewed head: 122c6f710e5b4375f63e38acc96785ecbabadd79

Before merge

None.

Findings

None.

Agent review details

How this fits together

Plugin manifests pass optional SVG strings through CodexBarCore validation before the macOS app renders them; the Linux CLI shares that core but does not render icons.

flowchart TD
  A[Plugin manifest] --> B[CodexBarCore icon validation]
  B --> C[macOS XML allowlist]
  C --> D[Template image or monogram]
  B --> E[Linux rejects optional SVG]
  E --> F[CLI without FoundationXML]
  F --> G[ELF dependency gate]

Loading

Technical review

Best possible solution:

Land the macOS-only parser boundary with the glibc dependency gates while preserving existing icon validation and fallback.

Do we have a high-confidence way to reproduce the issue?

The affected-release loader trace and artifact dependency comparison match the current-main FoundationXML linkage path; no target code was executed during this read-only review.

Is this the best way to solve the issue?

This is a focused repair at the shared dependency owner, following the existing JetBrains platform boundary and checking the actual release binary rather than hiding the loader failure.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 92acf2eac671.

Provenance checked

• Plugin SVG validation changes intended behavior with a stated reason (ac30c44: The merged feature validates untrusted SVGs before native image decoding and retains monogram fallback.)
• Linux build and release checks keeps the original intent (35051a8: Existing release steps harden packaging and smoke-test the built CLI; the new dependency assertion supplements those checks without replacing them.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Reviewed patch and policy: Read the complete root AGENTS.md and pinned introduced diff; no nested governing AGENTS.md, maintainer notes, or pr-simplify skill were present. The checkout remained clean. (AGENTS.md:1, 122c6f710e5b)
• Current-main dependency path: Main imports FoundationXML on Linux and executes XMLParser through ProviderPluginIcon initialization; the sole SVG renderer is in the macOS app. The patch removes that Linux linkage without changing macOS validation. (Sources/CodexBarCore/Plugins/ProviderPluginIconSVG.swift:2, 92acf2eac671)
• Affected release and workaround: simonsteiner supplies the v0.78.0 loader failure and dependency comparisons for both glibc architectures in Linux CLI 0.78.0 links libxml2.so.2 again (regression of #1046), fails on Ubuntu 26.04 #4652; the static-musl artifact and v0.77.0 work on the affected setup.
• Updated Linux behavior evidence: The updated PR body supplies actual readelf output without libxml2 for both architectures. https://github.com/steipete/CodexBar/actions/runs/39350172637 records successful shipped-CLI startup smoke steps and dependency gates for the reviewed head on both Ubuntu 24.04 architectures. Raw log retrieval was blocked at the Azure storage redirect; this reviewer-side limitation does not invalidate the supplied output. (.github/workflows/ci.yml:595, 122c6f710e5b)
• Feature intent and history: Allow user plugins to declare a monochrome SVG icon #4608 introduced the SVG validator for native template images; steipete's merge comment explicitly preserves allowlisting, bounds, rasterization, and monogram fallback. The downloaded screenshots show that earlier macOS feature, not Linux startup. (Sources/CodexBarCore/Plugins/ProviderPluginIconSVG.swift:2, ac30c447f9d2)
• Workflow safety and inspection limits: The added checks inspect the existing build output, fail on readelf errors or missing NEEDED entries, and exclude static-musl releases; permissions, downloads, publication, test inventory, and cache contracts remain unchanged. Some older history blobs were unavailable with lazy fetching disabled; current source, supplied provenance, blame, and GitHub discussion established the relevant intent. (.github/workflows/release-cli.yml:321, 92acf2eac671)

Likely related people:

• Peter Steinberger: Raw commit 35051a8 adds .github/workflows/release-cli.yml:130 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 35051a8f76e8; files: .github/workflows/release-cli.yml)

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

• P1: The current release's glibc CLI cannot execute any command on the reported Ubuntu 26.04 setup.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (1 earlier review cycle)

• reviewed 2026-10-20T01:06:30.471Z sha 122c6f7 :: needs real behavior proof before merge. :: none

Reviewed October 19, 2026, 9:25 PM ET / October 20, 2026, 01:25 UTC (Revision 2).

[harjothkhara]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/39353449126
• Updated: 2026-10-20T01:26:53.894Z

[steipete]

Merged in e6bfb10, thanks @harjothkhara for jumping on this so fast! The Linux CLI no longer links libxml2. We kept your fix, made SVG parsing macOS-only, and added a linkage check (ELF NEEDED entries, any libxml2 SONAME fails) to Linux CI and both glibc release builds, so this can't slip back in unnoticed again.