[mldangelo-oai]

Summary

A Windows checkout with core.autocrlf=true could pack the extensionless POSIX MCP launcher with a carriage return in its shebang. A Linux kernel then returned ENOENT when executing the installed file, preventing MCP and its documented helpers from starting.

Changes

• Mark the extensionless launcher as LF text in Git. Touch the tracked launcher so an existing Windows checkout receives the corrected bytes on its next fast-forward pull.
• Check the launcher's actual tarball bytes for carriage returns and cover both shebang and body regressions.

Testing

• An existing Windows checkout with 102 CRLF line endings received an LF-only launcher after a real git pull --ff-only. A fresh checkout produced the same bytes.
• Used the Linux kernel in WSL2 to execute both mode-0755 tar entries directly. The original returned ENOENT. The fixed launcher passed the configured server path and --stdio to a harmless test executable and exited successfully. Verified byte-for-byte identity of the Windows batch launcher in both packages.
• Passed 31 tarball checks, 11 Windows MCP launcher checks, eight portable source checks and validation of all 952 entries in the corrected npm archive. SDK build, types, formatting and Python lint checks also passed.

Risk and rollout

The EOL rule names the single POSIX launcher. The package check rejects an archive containing a carriage return in that executable before release.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T20:19:17.787400Z	54a9a30	PR opened
🔒 Security Review	✅ Completed 2026-11-09T20:19:54.596597Z	54a9a30	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for fixing this. No blocking findings in this merge-safety review. The scoped LF attribute, launcher rewrite, and packaged-byte checks address both existing checkouts and published archives.

Verified all 31 tarball tests, nine portable source tests, TypeScript, Ruff, and formatting. An autocrlf checkout smoke changed the launcher from 102 CRLF endings to LF-only and passed direct Linux execution with the expected arguments. Native Windows execution and the full SDK suite were not independently run.