fix(sandbox): POSIX sh syntax error in resolveCanonicalContainerPath by DennisGoldfinger · Pull Request #25737 · openclaw/openclaw

DennisGoldfinger · 2026-02-24T19:30:17Z

Summary

resolveCanonicalContainerPath builds a shell script as an array joined with .join("; "), producing while ...; do; parent=... — the do; is a POSIX sh syntax error (empty command after compound keyword)
Every image tool invocation in sandbox mode fails with: moltbot-sandbox-fs: -c: line 1: syntax error near unexpected token ';'
Changing the join separator to "\n" fixes it — do\n cmd is valid in all POSIX-compliant shells
Also updates the existing test assertion to accept either ; or \n after set -eu, and adds a targeted regression test for the do; bug

Reproduction

Enable sandbox mode with Docker
Send an image via WhatsApp (or any channel)
The agent attempts to use the image tool, which calls readFile → assertPathSafety → resolveCanonicalContainerPath

The container's sh rejects the script:

moltbot-sandbox-fs: -c: line 1: syntax error near unexpected token `;'
moltbot-sandbox-fs: -c: line 1: `set -eu; target="$1"; ...; do;   parent=...'

Affects any shell where do; is invalid — confirmed on bash 5.2 invoked as sh (POSIX mode) on Debian Trixie.

Test plan

Verified the joined script runs correctly in an actual sandbox container (Debian Trixie, /bin/sh -> bash)
Tested edge cases: existing paths, non-existent deep paths, symlinks, allow_final flag, paths with spaces, set -eu error handling
Updated existing "POSIX-safe shell prologue" test
Added regression test asserting the canonical path script does not contain do;

🤖 Generated with Claude Code

Greptile Summary

Fixed critical POSIX sh syntax error in resolveCanonicalContainerPath that was breaking all image tool invocations in sandbox mode. The script builder was using .join("; ") which produced invalid do; syntax (empty command after compound keyword). Changed to .join("\n") for proper POSIX compliance.

Updated test assertion to accept both ; and \n after set -eu prologue
Added targeted regression test to prevent do; syntax errors
Verified fix works in actual POSIX sh environments

Confidence Score: 5/5

This PR is safe to merge with minimal risk
The fix is a one-line change that correctly addresses a well-documented POSIX sh syntax error. The change from semicolon to newline joining is the standard solution for this issue. Test coverage is thorough with both an updated existing test and a new regression test. The fix has been verified to work in actual POSIX sh environments.
No files require special attention

_{Last reviewed commit: a8bdd7b}

_{(2/5) Greptile learns from your feedback when you react with thumbs up/down!}

… in resolveCanonicalContainerPath The shell script array in `resolveCanonicalContainerPath` was joined with `"; "`, producing `while ...; do; parent=...`. The `do;` token is a POSIX sh syntax error (empty command after compound keyword), which causes every `image` tool invocation in sandbox mode to fail with: moltbot-sandbox-fs: -c: line 1: syntax error near unexpected token `;' Changing the join separator to `"\n"` avoids the issue — `do\n cmd` is valid in all POSIX-compliant shells. Fixes sandbox image/file tool failures introduced when `resolveCanonicalContainerPath` was added for symlink escape detection. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

@pewallin

Lands reviewed fixes based on #25839 (@pewallin), #25841 (@joshjhall), and #25737/@25713 (@DennisGoldfinger/@peteragility), with additional hardening + regression tests for queue cleanup and shell script safety. Fixes #25836 Fixes #25840 Fixes #25824 Fixes #25868 Co-authored-by: Peter Wallin <pwallin@gmail.com> Co-authored-by: Joshua Hall <josh@yaplabs.com> Co-authored-by: Dennis Goldfinger <dennisgoldfinger@gmail.com> Co-authored-by: peteragility <peteragility@users.noreply.github.com>

steipete · 2026-02-24T23:28:42Z

Superseded by main commit e7a5f9f4d.

What landed from this PR:

core POSIX-shell fix in src/agents/sandbox/fs-bridge.ts (resolveCanonicalContainerPath script join changed from "; " to newline), removing do; parse failures under sh/dash

Test coverage in landed commit:

kept shell-compat coverage in src/agents/sandbox/fs-bridge.test.ts
added explicit regression check that canonical-path script contains no do; token
broadened prologue assertion to accept both set -eu; and set -eu\n forms

Linked issue status:

#25824 and #25868 are now closed by the landed commit

Thanks for the precise root-cause writeup and fix.

@shakkernerd

* ui: block svg data image opens and harden tests * changelog: credit both chat-image fix contributors * test(ui): reject base64 SVG data URLs * changelog: include openclaw#25847 in chat image safety entry (openclaw#25847) (thanks @shakkernerd) * refactor(ios): drop legacy talk payload and keychain fallbacks * chore: sync plugin versions to 2026.2.24 * chore: refresh lockfile after plugin devDependency cleanup * fix(config): soften antigravity removal fallout (openclaw#25538) Land openclaw#25538 by @chilu18 to keep legacy google-antigravity-auth config entries non-fatal after removal (see openclaw#25862). Co-authored-by: chilu18 <chilu.machona@icloud.com> * fix(security): lock sandbox tmp media paths to openclaw roots * docs(security): document openclaw temp-folder boundary * fix(security): restrict default safe-bin trusted dirs * fix: enforce local media root checks for attachment hydration * fix(synology-chat): fail closed empty allowlist * docs(changelog): add synology-chat allowlist fail-closed note * fix: harden routing/session isolation for followups and heartbeat * feat(sandbox): block container namespace joins by default * refactor(sandbox): centralize network mode policy helpers * fix(channels,sandbox): land hard breakage cluster from reviewed PR bases Lands reviewed fixes based on openclaw#25839 (@pewallin), openclaw#25841 (@joshjhall), and openclaw#25737/@25713 (@DennisGoldfinger/@peteragility), with additional hardening + regression tests for queue cleanup and shell script safety. Fixes openclaw#25836 Fixes openclaw#25840 Fixes openclaw#25824 Fixes openclaw#25868 Co-authored-by: Peter Wallin <pwallin@gmail.com> Co-authored-by: Joshua Hall <josh@yaplabs.com> Co-authored-by: Dennis Goldfinger <dennisgoldfinger@gmail.com> Co-authored-by: peteragility <peteragility@users.noreply.github.com> * refactor(synology-chat): centralize DM auth and fail fast startup * test: add routing/session isolation edge-case regressions * refactor: centralize followup origin routing helpers * refactor(outbound): centralize attachment media policy * refactor: harden safe-bin trusted dir diagnostics * fix(zalo): enforce group sender policy in groups * docs: update changelog for safe-bin hardening * test(line): align tmp-root expectation after sandbox hardening * fix(web-search): reduce provider auto-detect log noise * test(matrix,discord,sandbox): expand breakage regression coverage * refactor(matrix,tests): extract helpers and inject send-queue timing * refactor(zalo): split monitor access and webhook logic * Gateway/Security: protect /api/channels plugin root * fix(telegram): block unauthorized DM media downloads * Security: sanitize inherited host exec env * Changelog: add entry for exec env sanitization * fix(security): classify hook sessions case-insensitively * refactor(outbound): unify attachment hydration flow * refactor(telegram): simplify DM media auth precheck flow * fix(automation): harden announce delivery + cron coding profile (openclaw#25813 openclaw#25821 openclaw#25822) Co-authored-by: Shawn <shenghuikevin@shenghuideMac-mini.local> Co-authored-by: 不做了睡大觉 <user@example.com> Co-authored-by: Marcus Widing <widing.marcus@gmail.com> * security(voice-call): detect Telnyx webhook replay * Auto-reply: add exact stop trigger for do not do that * Auto-reply tests: assert exact do not do that behavior * Gateway tests: cover exact do not do that stop matching * Telegram tests: route exact do not do that to control lane * Changelog: note exact do not do that stop trigger * refactor(tmp): harden temp boundary guardrails * fix(whatsapp): stop retry loop on non-retryable 440 close * test(types): fix ts narrowing regressions in followup and matrix queue tests * fix(onboard): avoid false 'telegram plugin not available' block * fix: normalize "bedrock" provider ID to "amazon-bedrock" Add "bedrock" and "aws-bedrock" as aliases for the canonical "amazon-bedrock" provider ID in normalizeProviderId(). Without this mapping, configuring a model as "bedrock/..." causes the auth resolution fallback to miss the Bedrock-specific AWS SDK path, since the fallback check requires normalized === "amazon-bedrock". This primarily affects the main agent when the explicit auth override is not preserved through config merging. Fixes openclaw#15716 * docs(changelog): backfill landed fix PR entries * fix(security): harden system.run companion command binding * fix(discord): land proxy/media/reaction/model-picker regressions Reimplements core Discord fixes from openclaw#25277 openclaw#25523 openclaw#25575 openclaw#25588 openclaw#25731 with expanded tests. - thread proxy-aware fetch into inbound attachment/sticker downloads - fetch /gateway/bot via proxy dispatcher before ws connect - wire statusReactions emojis/timing overrides into controller - compact model-picker custom_id keys with backward-compatible parsing Co-authored-by: openperf <openperf@users.noreply.github.com> Co-authored-by: chilu18 <chilu18@users.noreply.github.com> Co-authored-by: Yipsh <Yipsh@users.noreply.github.com> Co-authored-by: lbo728 <lbo728@users.noreply.github.com> Co-authored-by: s1korrrr <s1korrrr@users.noreply.github.com> * docs(changelog): add reporter credit for exec companion hardening * fix(macos): guard voice audio paths with no input device (openclaw#25817) Co-authored-by: Stefan Förster <103369858+sfo2001@users.noreply.github.com> * fix(macos): prefer openclaw binary while keeping pnpm fallback (openclaw#25512) Co-authored-by: Peter Machona <7957943+chilu18@users.noreply.github.com> * Auth: bypass cooldown tracking for OpenRouter * Auth: use cooldown helper in explicit profile order * Tests: cover OpenRouter cooldown display bypass * Tests: skip OpenRouter failure cooldown persistence * Tests: keep OpenRouter runnable with legacy cooldown markers * Tests: preserve OpenRouter explicit auth order under cooldown fields * Changelog: note OpenRouter cooldown bypass * Changelog: remove unrelated session entries from PR * Update CHANGELOG.md * fix(macos): default voice wake forwarding to webchat (openclaw#25440) Co-authored-by: Peter Machona <7957943+chilu18@users.noreply.github.com> * fix(macos): keep Return for IME marked text commit (openclaw#25178) Co-authored-by: jft0m <9837901+bottotl@users.noreply.github.com> * fix(security): block env depth-overflow approval bypass * fix(macos): resolve webchat panel corner clipping (openclaw#22458) Co-authored-by: apethree <3081182+apethree@users.noreply.github.com> Co-authored-by: agisilaos <3073709+agisilaos@users.noreply.github.com> * Agents: trust explicit allowlist refs beyond catalog * Tests: cover allowlist refs missing from catalog * Gateway tests: accept allowlisted refs absent from catalog * Gateway tests: include synthetic allowlist models in models.list * Changelog: note allowlist stale-catalog model selection fix * fix(discord): harden voice DAVE receive reliability (openclaw#25861) Reimplements and consolidates related work: - openclaw#24339 stale disconnect/destroyed session guards - openclaw#25312 voice listener cleanup on stop - openclaw#23036 restore @snazzah/davey runtime dependency Adds Discord voice DAVE config passthrough, repeated decrypt failure rejoin recovery, regression tests, docs, and changelog updates. Co-authored-by: Frank Yang <frank.ekn@gmail.com> Co-authored-by: Do Cao Hieu <admin@docaohieu.com> * fix(macos): clean warnings and harden gateway/talk config parsing * docs(discord): document DAVE defaults and decrypt recovery * test: bridge discord voice private casts via unknown * docs(changelog): remove next-release shipping sentence * refactor(exec): split system.run phases and align ts/swift validator contracts * fix(windows): skip unreliable dev comparison in fs-safe openVerifiedLocalFile On Windows, device IDs (dev) returned by handle.stat() and fs.lstat() may differ even for the same file, causing false-positive 'path-mismatch' errors when reading local media files. This fix introduces a statsMatch() helper that: - Always compares inode (ino) values - Skips device ID (dev) comparison on Windows where it's unreliable - Maintains full comparison on Unix platforms Fixes openclaw#25699 * fix: align windows safe-open file identity checks * refactor: dedupe exec wrapper denial plan and test setup * fix: harden iMessage echo dedupe and reasoning suppression (openclaw#25897) * test(media): add win32 dev=0 local media regression * refactor: extract iMessage echo cache and unify suppression guards * test: normalize tmp media path assertion for windows * fix(render): seed Control UI origin config on first boot The gateway requires controlUi.allowedOrigins when binding to LAN. On Render, the persistent disk starts empty with no openclaw.json. Seed a minimal config with dangerouslyAllowHostHeaderOriginFallback on first boot (safe behind Render's HTTPS reverse proxy). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore(deps): update dependencies except carbon * fix(agents): normalize SiliconFlow Pro thinking=off payload (openclaw#25435) Land PR openclaw#25435 from @Zjianru. Changelog: add 2026.2.24 fix entry with contributor credit. Co-authored-by: codez <codezhujr@gmail.com> * fix(telegram): refresh global undici dispatcher for autoSelectFamily (openclaw#25682) Land PR openclaw#25682 from @lairtonlelis after maintainer rework: track dispatcher updates when network decision changes to avoid stale global fetch behavior. Co-authored-by: Ailton <lairton@telnyx.com> * fix(synology-chat): land @bmendonca3 fail-closed allowlist follow-up (openclaw#25827) Carry fail-closed empty-allowlist guard clarity and changelog attribution for PR openclaw#25827. Co-authored-by: Brian Mendonca <brianmendonca@Brians-MacBook-Air.local> * fix(agents): reduce billing false positives on long text (openclaw#25680) Land PR openclaw#25680 from @lairtonlelis. Retain explicit status/code/http 402 detection for oversized structured payloads. Co-authored-by: Ailton <lairton@telnyx.com> * fix(render): add docker entrypoint script for config seeding The inline shell command in render.yaml's dockerCommand wasn't reliably creating the seed config. Replace with a proper entrypoint script that creates a minimal openclaw.json with dangerouslyAllowHostHeaderOriginFallback on first boot, then starts the gateway bound to LAN on the PORT env var. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ui): inherit default model fallbacks in agents overview (openclaw#25729) Land PR openclaw#25729 from @Suko. Use shared fallback-resolution helper and add regression coverage for default, override, and explicit-empty cases. Co-authored-by: suko <miha.sukic@gmail.com> * fix(heartbeat): default target none and internalize relay prompts * test(windows): normalize risky-path assertions --------- Co-authored-by: Shakker <shakkerdroid@gmail.com> Co-authored-by: Peter Steinberger <steipete@gmail.com> Co-authored-by: chilu18 <chilu.machona@icloud.com> Co-authored-by: Peter Wallin <pwallin@gmail.com> Co-authored-by: Joshua Hall <josh@yaplabs.com> Co-authored-by: Dennis Goldfinger <dennisgoldfinger@gmail.com> Co-authored-by: peteragility <peteragility@users.noreply.github.com> Co-authored-by: Brian Mendonca <brianmendonca@Brians-MacBook-Air.local> Co-authored-by: Shawn <shenghuikevin@shenghuideMac-mini.local> Co-authored-by: 不做了睡大觉 <user@example.com> Co-authored-by: Marcus Widing <widing.marcus@gmail.com> Co-authored-by: Vincent Koc <vincentkoc@ieee.org> Co-authored-by: Mark Musson <mark@musson.co.za> Co-authored-by: suko <miha.sukic@gmail.com> Co-authored-by: Fred White <fwhite13@users.noreply.github.com> Co-authored-by: openperf <openperf@users.noreply.github.com> Co-authored-by: chilu18 <chilu18@users.noreply.github.com> Co-authored-by: Yipsh <Yipsh@users.noreply.github.com> Co-authored-by: lbo728 <lbo728@users.noreply.github.com> Co-authored-by: s1korrrr <s1korrrr@users.noreply.github.com> Co-authored-by: Stefan Förster <103369858+sfo2001@users.noreply.github.com> Co-authored-by: Peter Machona <7957943+chilu18@users.noreply.github.com> Co-authored-by: jft0m <9837901+bottotl@users.noreply.github.com> Co-authored-by: apethree <3081182+apethree@users.noreply.github.com> Co-authored-by: agisilaos <3073709+agisilaos@users.noreply.github.com> Co-authored-by: Frank Yang <frank.ekn@gmail.com> Co-authored-by: Do Cao Hieu <admin@docaohieu.com> Co-authored-by: Gavin X. Wang <gavinvybers@Gavins-MacBook-Pro.local> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: codez <codezhujr@gmail.com> Co-authored-by: Ailton <lairton@telnyx.com>

@pewallin

Lands reviewed fixes based on #25839 (@pewallin), #25841 (@joshjhall), and #25737/@25713 (@DennisGoldfinger/@peteragility), with additional hardening + regression tests for queue cleanup and shell script safety. Fixes #25836 Fixes #25840 Fixes #25824 Fixes #25868 Co-authored-by: Peter Wallin <pwallin@gmail.com> Co-authored-by: Joshua Hall <josh@yaplabs.com> Co-authored-by: Dennis Goldfinger <dennisgoldfinger@gmail.com> Co-authored-by: peteragility <peteragility@users.noreply.github.com>

@pewallin

Lands reviewed fixes based on openclaw#25839 (@pewallin), openclaw#25841 (@joshjhall), and openclaw#25737/@25713 (@DennisGoldfinger/@peteragility), with additional hardening + regression tests for queue cleanup and shell script safety. Fixes openclaw#25836 Fixes openclaw#25840 Fixes openclaw#25824 Fixes openclaw#25868 Co-authored-by: Peter Wallin <pwallin@gmail.com> Co-authored-by: Joshua Hall <josh@yaplabs.com> Co-authored-by: Dennis Goldfinger <dennisgoldfinger@gmail.com> Co-authored-by: peteragility <peteragility@users.noreply.github.com>

@pewallin

Lands reviewed fixes based on openclaw#25839 (@pewallin), openclaw#25841 (@joshjhall), and openclaw#25737/@25713 (@DennisGoldfinger/@peteragility), with additional hardening + regression tests for queue cleanup and shell script safety. Fixes openclaw#25836 Fixes openclaw#25840 Fixes openclaw#25824 Fixes openclaw#25868 Co-authored-by: Peter Wallin <pwallin@gmail.com> Co-authored-by: Joshua Hall <josh@yaplabs.com> Co-authored-by: Dennis Goldfinger <dennisgoldfinger@gmail.com> Co-authored-by: peteragility <peteragility@users.noreply.github.com>

@pewallin

Lands reviewed fixes based on openclaw#25839 (@pewallin), openclaw#25841 (@joshjhall), and openclaw#25737/@25713 (@DennisGoldfinger/@peteragility), with additional hardening + regression tests for queue cleanup and shell script safety. Fixes openclaw#25836 Fixes openclaw#25840 Fixes openclaw#25824 Fixes openclaw#25868 Co-authored-by: Peter Wallin <pwallin@gmail.com> Co-authored-by: Joshua Hall <josh@yaplabs.com> Co-authored-by: Dennis Goldfinger <dennisgoldfinger@gmail.com> Co-authored-by: peteragility <peteragility@users.noreply.github.com>

@pewallin

Lands reviewed fixes based on openclaw#25839 (@pewallin), openclaw#25841 (@joshjhall), and openclaw#25737/@25713 (@DennisGoldfinger/@peteragility), with additional hardening + regression tests for queue cleanup and shell script safety. Fixes openclaw#25836 Fixes openclaw#25840 Fixes openclaw#25824 Fixes openclaw#25868 Co-authored-by: Peter Wallin <pwallin@gmail.com> Co-authored-by: Joshua Hall <josh@yaplabs.com> Co-authored-by: Dennis Goldfinger <dennisgoldfinger@gmail.com> Co-authored-by: peteragility <peteragility@users.noreply.github.com>

@pewallin

Lands reviewed fixes based on openclaw#25839 (@pewallin), openclaw#25841 (@joshjhall), and openclaw#25737/@25713 (@DennisGoldfinger/@peteragility), with additional hardening + regression tests for queue cleanup and shell script safety. Fixes openclaw#25836 Fixes openclaw#25840 Fixes openclaw#25824 Fixes openclaw#25868 Co-authored-by: Peter Wallin <pwallin@gmail.com> Co-authored-by: Joshua Hall <josh@yaplabs.com> Co-authored-by: Dennis Goldfinger <dennisgoldfinger@gmail.com> Co-authored-by: peteragility <peteragility@users.noreply.github.com>

@pewallin

Lands reviewed fixes based on openclaw#25839 (@pewallin), openclaw#25841 (@joshjhall), and openclaw#25737/@25713 (@DennisGoldfinger/@peteragility), with additional hardening + regression tests for queue cleanup and shell script safety. Fixes openclaw#25836 Fixes openclaw#25840 Fixes openclaw#25824 Fixes openclaw#25868 Co-authored-by: Peter Wallin <pwallin@gmail.com> Co-authored-by: Joshua Hall <josh@yaplabs.com> Co-authored-by: Dennis Goldfinger <dennisgoldfinger@gmail.com> Co-authored-by: peteragility <peteragility@users.noreply.github.com>

@pewallin

Lands reviewed fixes based on openclaw#25839 (@pewallin), openclaw#25841 (@joshjhall), and openclaw#25737/@25713 (@DennisGoldfinger/@peteragility), with additional hardening + regression tests for queue cleanup and shell script safety. Fixes openclaw#25836 Fixes openclaw#25840 Fixes openclaw#25824 Fixes openclaw#25868 Co-authored-by: Peter Wallin <pwallin@gmail.com> Co-authored-by: Joshua Hall <josh@yaplabs.com> Co-authored-by: Dennis Goldfinger <dennisgoldfinger@gmail.com> Co-authored-by: peteragility <peteragility@users.noreply.github.com>

openclaw-barnacle bot added agents Agent runtime and tooling size: XS labels Feb 24, 2026

DennisGoldfinger closed this Feb 24, 2026

DennisGoldfinger reopened this Feb 24, 2026

steipete closed this Feb 24, 2026

steipete mentioned this pull request Feb 24, 2026

fix: use newline join for sandbox resolveCanonicalContainerPath to fix dash compatibility #25713

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(sandbox): POSIX sh syntax error in resolveCanonicalContainerPath#25737

fix(sandbox): POSIX sh syntax error in resolveCanonicalContainerPath#25737
DennisGoldfinger wants to merge 1 commit intoopenclaw:mainfrom
DennisGoldfinger:fix/sandbox-fs-bridge-shell-join

DennisGoldfinger commented Feb 24, 2026 •

edited by greptile-apps bot

Loading

Uh oh!

steipete commented Feb 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

DennisGoldfinger commented Feb 24, 2026 • edited by greptile-apps bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Reproduction

Test plan

Greptile Summary

Confidence Score: 5/5

Uh oh!

steipete commented Feb 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

DennisGoldfinger commented Feb 24, 2026 •

edited by greptile-apps bot

Loading