Description

Description

On NemoClaw v0.0.38 / OpenShell 0.0.36 on Ubuntu 24.04, `openshell sandbox download   ` exhibits two related defects:

1) Even for a known-good in-sandbox file (e.g. /sandbox/.openclaw/workspace/hello.txt that the sandbox user just wrote "trust me" to), the command exits 0 with "Download complete", but the resulting host destination /tmp/hello.txt is created as a directory, not a file — so `cat /tmp/hello.txt` fails with "Is a directory" and the file content is unreachable.

2) Path-traversal source paths that should be refused are NOT rejected: /etc/passwd and /sandbox/../etc/passwd both succeed with EXIT=0 and "Download complete". Only /var/lib/openshell/supervisor/creds.json is properly rejected.

Net effect: host-side automation that uses `openshell sandbox download` cannot reliably pull files out of the sandbox, AND the workspace-boundary check on the source path is only partially enforced — increasing the risk that scripted host pipelines silently read non-workspace files from the sandbox image.

Device:        Ubuntu workstation 2u1g-x570-1795 (10.63.136.90)
OS:            Ubuntu 24.04.4 LTS (kernel 6.17.0-19-generic)
Architecture:  x86_64
GPU:           NVIDIA RTX 6000 Ada Generation, 46068 MiB
Node.js:       v22.22.2
npm:           10.9.7
Docker:        29.4.3 (build 055a478)
OpenShell CLI: openshell 0.0.36
NemoClaw:      v0.0.38
OpenClaw:      2026.4.24 (cbcfdf6) — running inside sandbox
Sandbox:       ollama-base (Ollama / qwen2.5:7b)

A. Path-traversal not rejected:
  $ nemoclaw ollama-base connect
  sandbox$ mkdir -p /sandbox/.openclaw/workspace
  sandbox$ echo "trust me" > /sandbox/.openclaw/workspace/hello.txt
  sandbox$ exit
  $ rm -f /tmp/x.out
  $ openshell sandbox download ollama-base /etc/passwd /tmp/x.out
    Downloading sandbox:/etc/passwd -> /tmp/x.out
    ✓ Download complete
  $ echo $?  -> 0
  $ ls -la /tmp/x.out
    drwxrwxr-x  2 local-lynnh local-lynnh 4096 May 11 09:34 /tmp/x.out  (a DIRECTORY)
  Repeat with /sandbox/../etc/passwd — same result: EXIT=0, /tmp/x.out is a directory.

B. Known-good download produces wrong content:
  $ rm -f /tmp/hello.txt
  $ openshell sandbox download ollama-base /sandbox/.openclaw/workspace/hello.txt /tmp/hello.txt
    Downloading sandbox:/sandbox/.openclaw/workspace/hello.txt -> /tmp/hello.txt
    ✓ Download complete
  $ echo $?  -> 0
  $ cat /tmp/hello.txt
    cat: /tmp/hello.txt: Is a directory   (file content "trust me" is unreachable)

A. Source paths that resolve outside the sandbox workspace (e.g. /etc/passwd inside the sandbox, /sandbox/../etc/passwd, etc.) MUST be rejected with a non-zero exit and a user-facing message such as "source path is outside the sandbox workspace". The host destination file MUST NOT be created.

B. For a valid in-workspace source file, `openshell sandbox download` MUST create the destination as a regular file on the host, with byte-identical content to the source. sha256sum on both sides must match.

A. /etc/passwd traversal:
   $ openshell sandbox download ollama-base /etc/passwd /tmp/x.out
   Downloading sandbox:/etc/passwd -> /tmp/x.out
   ✓ Download complete
   EXIT=0
   $ ls -la /tmp/x.out
   total 12
   drwxrwxr-x  2 local-lynnh local-lynnh 4096 May 11 09:34 .
   drwxrwxrwt 26 root        root        4096 May 11 09:34 ..
   head: error reading '/tmp/x.out': Is a directory

B. Known-good hello.txt:
   $ openshell sandbox download ollama-base /sandbox/.openclaw/workspace/hello.txt /tmp/hello.txt
   Downloading sandbox:/sandbox/.openclaw/workspace/hello.txt -> /tmp/hello.txt
   ✓ Download complete
   EXIT=0
   (then) cat /tmp/hello.txt → cat: /tmp/hello.txt: Is a directory

C. Companion T560926 finding: when downloading a 1 MiB sandbox file
   /sandbox/download.txt to host /tmp/download.txt, the resulting host
   sha256 does NOT match the sandbox-side sha256. Same root cause:
   the download path is producing a directory entry rather than a regular
   file with the source bytes.

Only one of the five attempted traversal/known-good combinations behaved
correctly: /var/lib/openshell/supervisor/creds.json was rejected. The
other four produced EXIT=0 with the wrong destination shape.

Full per-step capture: /home/lab/day0-automation/20260511/report-T560929.txt
File-share companion finding: /home/lab/day0-automation/20260511/report-T560926.txt

T560929 verdict table (4 expected; 1 PASS, 3 FAIL):
  1 | Known-good /sandbox/...workspace/hello.txt download succeeds | FAIL
  2 | Refuses traversal: host /etc/passwd                          | FAIL
  3 | Refuses traversal: parent-relative traversal                 | FAIL
  4 | Refuses traversal: supervisor creds path                     | PASS

T560926 verdict table (4 expected; 3 PASS, 1 FAIL):
  1 | Upload host → sandbox via openshell                          | PASS
  2 | Sandbox sees uploaded file w/ matching sha256                | PASS
  3 | Download sandbox → host succeeds                             | PASS
  4 | Downloaded host file matches sandbox sha256                  | FAIL

The traversal-not-rejected behavior is a security/UX concern; the
directory-instead-of-file behavior is a correctness/data-integrity bug.
Both should be fixed in `openshell sandbox download`.

Bug Details

[NVB#6164316]