fix: replace os.tmpdir() with resolvePreferredOpenClawTmpDir() across codebase by corbin-breton · Pull Request #63902 · openclaw/openclaw

corbin-breton · 2026-04-09T19:29:22Z

Summary

Replace all 14 os.tmpdir() calls flagged by the no-random-messaging guard with resolvePreferredOpenClawTmpDir() from the plugin SDK.

Problem

The check-additional CI job fails on lint:tmp:no-random-messaging for all PRs (including main itself) because 14 files use os.tmpdir() directly instead of the OpenClaw temp dir helper.

Fix

Mechanical replacement: os.tmpdir() → resolvePreferredOpenClawTmpDir() using the appropriate import path:

src/ files: relative import from ../../infra/tmp-openclaw-dir.js
extensions/ files: import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/sandbox"

Unused os imports removed where tmpdir was the only usage.

Files Changed (13 files, 14 call sites)

File	Change
`src/infra/outbound/delivery-queue.test-helpers.ts`	Replace tmpdir
`extensions/browser/src/browser/chrome-mcp.ts`	Replace tmpdir, remove unused os import
`extensions/diffs/src/test-helpers.ts`	Replace tmpdir
`extensions/google/video-generation-provider.ts`	Replace tmpdir, remove unused os import
`extensions/memory-core/src/cli.runtime.ts`	Replace 2 tmpdir calls
`extensions/memory-core/src/test-helpers.ts`	Replace tmpdir
`extensions/memory-wiki/src/test-helpers.ts`	Replace tmpdir
`extensions/openshell/src/backend.ts`	Remove redundant os.tmpdir() fallback
`extensions/qa-lab/src/gateway-child.ts`	Replace tmpdir
`extensions/qa-lab/src/model-catalog.runtime.ts`	Replace tmpdir, remove unused os import
`extensions/qqbot/src/utils/platform.ts`	Replace 2 tmpdir calls
`extensions/signal/src/install-signal-cli.ts`	Replace tmpdir, remove unused os import
`src/auto-reply/reply/followup-runner.test.ts`	Fix CliBackendConfig type mismatch

Test plan

pnpm run lint:tmp:no-random-messaging passes (0 violations)
pnpm tsgo passes (0 type errors)
pnpm check passes
All CI checks green

🤖 Generated with Claude Code

greptile-apps · 2026-04-09T19:33:51Z

Greptile Summary

Mechanical replacement of 14 os.tmpdir() call sites across 13 files with resolvePreferredOpenClawTmpDir() to fix the lint:tmp:no-random-messaging CI guard. Extensions import from openclaw/plugin-sdk/sandbox (or a local re-export barrel for the browser extension); core src/ files use a relative import from ../../infra/tmp-openclaw-dir.js. Unused os imports are removed where tmpdir was the only usage; retained where os.homedir() or os.release() are still needed.

Confidence Score: 5/5

Safe to merge — mechanical substitution with no behavior change; all guarded call sites replaced correctly.

All 14 flagged call sites are replaced correctly. Retained os imports are still needed for other APIs (homedir, release). The only finding is a stale JSDoc bullet in platform.ts, which is P2 and does not affect runtime behavior.

extensions/qqbot/src/utils/platform.ts — JSDoc comment on getHomeDir() still references os.tmpdir() after the replacement.

Vulnerabilities

No security concerns identified. The change replaces one temp-dir resolver with another; no auth, input validation, or secret-handling surfaces are affected.

Comments Outside Diff (1)

extensions/qqbot/src/utils/platform.ts, line 38-41 (link)

Stale JSDoc comment after tmpdir replacement

The third fallback bullet still documents os.tmpdir(), but line 57 now calls resolvePreferredOpenClawTmpDir().

Prompt To Fix With AI

This is a comment left during a code review.
Path: extensions/qqbot/src/utils/platform.ts
Line: 38-41

Comment:
**Stale JSDoc comment after tmpdir replacement**

The third fallback bullet still documents `os.tmpdir()`, but line 57 now calls `resolvePreferredOpenClawTmpDir()`.



How can I resolve this? If you propose a fix, please make it concise.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: extensions/qqbot/src/utils/platform.ts
Line: 38-41

Comment:
**Stale JSDoc comment after tmpdir replacement**

The third fallback bullet still documents `os.tmpdir()`, but line 57 now calls `resolvePreferredOpenClawTmpDir()`.

```suggestion
 * Priority:
 * 1. `os.homedir()`
 * 2. `$HOME` or `%USERPROFILE%`
 * 3. `resolvePreferredOpenClawTmpDir()` as a last resort
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix: replace os.tmpdir() with resolvePre..." | Re-trigger Greptile}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 572d0d4fc4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-09T21:06:14Z

 import path from "node:path";
 import { GoogleGenAI } from "@google/genai";
 import { isProviderApiKeyConfigured } from "openclaw/plugin-sdk/provider-auth";
 import { resolveApiKeyForProvider } from "openclaw/plugin-sdk/provider-auth-runtime";
+import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/sandbox";


Use lightweight temp-path SDK import

Importing resolvePreferredOpenClawTmpDir from openclaw/plugin-sdk/sandbox pulls in the full sandbox barrel, which re-exports src/agents/sandbox.ts and triggers backend registration side effects (registerSandboxBackend(...) in src/agents/sandbox/backend.ts) at module load. In provider/plugin modules that only need a temp-directory helper, this adds unnecessary startup work and global sandbox initialization on every load path (even when sandboxing is never used). Switching this helper import to openclaw/plugin-sdk/temp-path avoids that regression while preserving behavior.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3029475658

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-09T21:22:58Z

@@ -15,6 +14,7 @@ import {
  type OpenClawConfig,
 } from "openclaw/plugin-sdk/config-runtime";
 import { definePluginEntry, type OpenClawPluginApi } from "openclaw/plugin-sdk/plugin-entry";
+import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/sandbox";


Import temp-dir helper from temp-path instead of sandbox

resolvePreferredOpenClawTmpDir is imported from openclaw/plugin-sdk/sandbox, which eagerly re-exports src/agents/sandbox.ts; that path loads src/agents/sandbox/backend.ts and runs registerSandboxBackend(...) at module initialization. In this plugin, that means normal startup now pulls sandbox backend registration side effects even when no sandbox feature is used, adding avoidable global initialization and startup cost. Use openclaw/plugin-sdk/temp-path (or a local temp-path wrapper) for this helper-only use case.

Useful? React with 👍 / 👎.

corbin-breton · 2026-04-10T01:00:02Z

CI on main is currently broken by two test regressions in checks-node-test (temp-path-guard weak randomness + delivery-context Telegram thread resolution). Fix PR: #63995. This PR needs a rebase onto main after that fix lands — the check-additional failures here are also from stale base code and will resolve with rebase.

… codebase Replace all 14 os.tmpdir() calls flagged by the no-random-messaging guard with resolvePreferredOpenClawTmpDir() from the plugin SDK. This ensures temp directories are created under OpenClaw's preferred location (/tmp/openclaw) rather than the host system default, which prevents cross-session data leakage and improves sandboxing. Files changed: - src/infra/outbound/delivery-queue.test-helpers.ts - extensions/browser/src/browser/chrome-mcp.ts - extensions/diffs/src/test-helpers.ts - extensions/google/video-generation-provider.ts - extensions/memory-core/src/cli.runtime.ts (2 sites) - extensions/memory-core/src/test-helpers.ts - extensions/memory-wiki/src/test-helpers.ts - extensions/openshell/src/backend.ts - extensions/qa-lab/src/gateway-child.ts - extensions/qa-lab/src/model-catalog.runtime.ts - extensions/qqbot/src/utils/platform.ts (2 sites) - extensions/signal/src/install-signal-cli.ts Also fixes CliBackendConfig type mismatch in followup-runner test. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 02e8cfafcf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-10T01:04:32Z

+import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/sandbox";
 import { CONFIG_DIR, extractArchive, resolveBrewExecutable } from "openclaw/plugin-sdk/setup-tools";
 import { resolvePreferredOpenClawTmpDir } from "openclaw/plugin-sdk/temp-path";


Remove duplicate temp-dir import binding

This change introduces a second resolvePreferredOpenClawTmpDir import while the existing temp-path import is still present, which creates a duplicate top-level binding and makes the module fail to parse (Identifier 'resolvePreferredOpenClawTmpDir' has already been declared). Any command path that loads this Signal installer file will fail at startup/build time until one import is removed or aliased.

Useful? React with 👍 / 👎.

corbin-breton · 2026-04-10T01:12:30Z

Closing — all changes in this PR have already been merged to main via other PRs. The rebase confirmed no remaining diff.

openclaw-barnacle Bot added channel: signal Channel integration: signal extensions: memory-core Extension: memory-core channel: qqbot extensions: qa-lab extensions: memory-wiki size: S labels Apr 9, 2026

mjamiv mentioned this pull request Apr 9, 2026

TTS tool audio silently dropped: temp dir path not in media allowlist (regression) #63896

Closed

corbin-breton force-pushed the fix/no-random-messaging-cleanup branch from ba67f6c to 572d0d4 Compare April 9, 2026 21:00

chatgpt-codex-connector Bot reviewed Apr 9, 2026

View reviewed changes

corbin-breton force-pushed the fix/no-random-messaging-cleanup branch from 572d0d4 to 3029475 Compare April 9, 2026 21:19

chatgpt-codex-connector Bot reviewed Apr 9, 2026

View reviewed changes

This was referenced Apr 9, 2026

fix(agents): distinguish terminal aborts from retryable failures (#60388) #62682

Open

feat(gateway): wire coding tools into /tools/invoke HTTP surface #63919

Open

corbin-breton force-pushed the fix/no-random-messaging-cleanup branch from 3029475 to 02e8cfa Compare April 10, 2026 01:02

openclaw-barnacle Bot added size: XS and removed extensions: memory-core Extension: memory-core channel: qqbot extensions: qa-lab extensions: memory-wiki size: S labels Apr 10, 2026

chatgpt-codex-connector Bot reviewed Apr 10, 2026

View reviewed changes

corbin-breton closed this Apr 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: replace os.tmpdir() with resolvePreferredOpenClawTmpDir() across codebase#63902

fix: replace os.tmpdir() with resolvePreferredOpenClawTmpDir() across codebase#63902
corbin-breton wants to merge 1 commit intoopenclaw:mainfrom
corbin-breton:fix/no-random-messaging-cleanup

corbin-breton commented Apr 9, 2026

Uh oh!

greptile-apps Bot commented Apr 9, 2026 •

edited

Loading

Vulnerabilities

Comments Outside Diff (1)

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 9, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 9, 2026

Uh oh!

corbin-breton commented Apr 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 10, 2026

Uh oh!

corbin-breton commented Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

corbin-breton commented Apr 9, 2026

Summary

Problem

Fix

Files Changed (13 files, 14 call sites)

Test plan

Uh oh!

greptile-apps Bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Vulnerabilities

Comments Outside Diff (1)

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

corbin-breton commented Apr 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

corbin-breton commented Apr 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

greptile-apps Bot commented Apr 9, 2026 •

edited

Loading