fix(agents): tighten workspace file opens by eleqtrizit · Pull Request #66636 · openclaw/openclaw

eleqtrizit · 2026-04-14T15:27:33Z

Summary

Routes agents.files.get, agents.files.set, and workspace file listing through the existing root-scoped fs-safe helpers
Removes the separate path-resolution layer for allowlisted workspace files so the gateway uses the same open/read/write validation path everywhere

Changes

Replaced the hand-rolled workspace file resolver in src/gateway/server-methods/agents.ts with openFileWithinRoot, readFileWithinRoot, and writeFileWithinRoot
Updated src/infra/fs-safe.ts to resolve opened file real paths from the open file descriptor before falling back to the current path
Tightened the gateway tests to reject symlink aliases for allowlisted agent files and added an fs-safe regression that locks in the fd-first realpath behavior

Validation

Ran pnpm test src/gateway/server-methods/agents-mutate.test.ts
Ran pnpm test src/infra/fs-safe.test.ts
Ran pnpm check on the rebased branch

Notes

This change intentionally rejects allowlisted agent-file symlink aliases instead of resolving through them
Supersedes fix(agents): tighten workspace file opens #66079 (branch moved to fork)

greptile-apps · 2026-04-14T15:31:56Z

Greptile Summary

This PR tightens workspace file access in the agents gateway by routing agents.files.get and agents.files.set through the shared fs-safe helpers, and adds fd-first realpath resolution to openVerifiedLocalFile so a symlink swap between open(2) and realpath(3) can no longer redirect the validated path to a different inode. The agents.files.set bare-catch regression flagged in a prior review thread was addressed in a follow-up commit (149616372) that rethrows non-SafeOpenError errors, consistent with the agents.files.get and writeWorkspaceFileOrRespond patterns.

Confidence Score: 5/5

This PR is safe to merge; the prior P1 concern has been resolved and all remaining findings are P2 or lower.
The bare-catch regression in agents.files.set that allowed non-SafeOpenError OS errors to be swallowed was fixed in the final follow-up commit. The fd-first realpath addition is well-tested (race scenario verified in fs-safe.test.ts), and the symlink/hardlink gateway tests are comprehensive. No P0 or P1 issues remain.
No files require special attention.

_{Reviews (4): Last reviewed commit: "fix(agents): rethrow unexpected errors i..." | Re-trigger Greptile}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 53eb7ecc31

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

eleqtrizit · 2026-04-14T15:52:02Z

@greptile review

eleqtrizit · 2026-04-14T15:52:02Z

@codex review

chatgpt-codex-connector · 2026-04-14T16:00:24Z

Codex Review: Didn't find any major issues. Keep them coming!

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

drobison00 · 2026-04-14T16:59:39Z

@greptile review
@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e82c07b679

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

drobison00 · 2026-04-14T17:18:51Z

@greptile review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 149616372e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

… probes

…nclaw#66636)

Match the narrow-SafeOpenError catch pattern that agents.files.get (commit 633b8f92) and writeWorkspaceFileOrRespond already use, so a real OS error (ENOSPC, EACCES, EBUSY, ...) surfaces through normal gateway error handling instead of being masked as 'unsafe workspace file'.

The mock functions are declared as vi.fn(async (..._args: unknown[]) => Stats | null) so mockImplementation callbacks must accept ...unknown[], not a narrowed (filePath: string) argument. The narrower signature works at runtime but trips tsgo's strict type check; switch to args[0] unpacking so the callbacks match the hoisted mock shape.

* fix(agents): tighten workspace file opens * fix(agents): clarify symlink rejection tests * fix(agents): surface unsafe identity reads * fix(agents): use non-blocking opens for identity reads and write-mode probes * fix(fssafe): restore symlink read identity check * fix(worklog): append comment resolution status * fix(fssafe): close afterOpen handle leaks * fix(worklog): append comment resolution follow-up * fix(worklog): drop internal user file * fix(agents): rethrow unexpected errors in agents.files.get * changelog: note agents.files fs-safe routing + fd-first realpath (openclaw#66636) * fix(agents): rethrow unexpected errors in agents.files.set too Match the narrow-SafeOpenError catch pattern that agents.files.get (commit 633b8f92) and writeWorkspaceFileOrRespond already use, so a real OS error (ENOSPC, EACCES, EBUSY, ...) surfaces through normal gateway error handling instead of being masked as 'unsafe workspace file'. * test(agents): match fsStat/fsLstat mock signatures The mock functions are declared as vi.fn(async (..._args: unknown[]) => Stats | null) so mockImplementation callbacks must accept ...unknown[], not a narrowed (filePath: string) argument. The narrower signature works at runtime but trips tsgo's strict type check; switch to args[0] unpacking so the callbacks match the hoisted mock shape. --------- Co-authored-by: Devin Robison <drobison@nvidia.com>

chatgpt-codex-connector Bot reviewed Apr 14, 2026

View reviewed changes

Comment thread USER.md Outdated

openclaw-barnacle Bot added gateway Gateway runtime size: L maintainer Maintainer-authored PR labels Apr 14, 2026

drobison00 force-pushed the 423 branch from 83398ed to e82c07b Compare April 14, 2026 16:59

greptile-apps Bot reviewed Apr 14, 2026

View reviewed changes

Comment thread src/gateway/server-methods/agents.ts Outdated

chatgpt-codex-connector Bot reviewed Apr 14, 2026

View reviewed changes

Comment thread src/gateway/server-methods/agents.ts

drobison00 force-pushed the 423 branch from e82c07b to 6d856bd Compare April 14, 2026 17:08

drobison00 force-pushed the 423 branch from f36dacd to 09c9b80 Compare April 14, 2026 17:14

drobison00 force-pushed the 423 branch from 09c9b80 to 1496163 Compare April 14, 2026 17:18

chatgpt-codex-connector Bot reviewed Apr 14, 2026

View reviewed changes

Comment thread src/gateway/server-methods/agents.ts

eleqtrizit added 9 commits April 14, 2026 13:56

fix(agents): tighten workspace file opens

e7ef93a

fix(agents): clarify symlink rejection tests

55fc54a

fix(agents): surface unsafe identity reads

f1b0461

fix(agents): use non-blocking opens for identity reads and write-mode…

cbd3871

… probes

fix(fssafe): restore symlink read identity check

bf3d6f9

fix(worklog): append comment resolution status

68df12d

fix(fssafe): close afterOpen handle leaks

c65c31f

fix(worklog): append comment resolution follow-up

b37a8ff

fix(worklog): drop internal user file

534e0e7

eleqtrizit and others added 4 commits April 14, 2026 13:56

fix(agents): rethrow unexpected errors in agents.files.get

c9f0352

changelog: note agents.files fs-safe routing + fd-first realpath (ope…

6188fc2

…nclaw#66636)

drobison00 force-pushed the 423 branch from 04f4362 to 9d17aa0 Compare April 14, 2026 19:57

drobison00 merged commit 472bcbb into openclaw:main Apr 14, 2026
38 of 42 checks passed

github-actions Bot mentioned this pull request Apr 14, 2026

📡 Upstream Digest — 2026-04-14 20:44 UTC curtismercier/openclaw-mods#574

Open

clawsweeper Bot mentioned this pull request May 1, 2026

feat: add workspace file management for agents #62417

Open

25 tasks

This was referenced May 3, 2026

feat(agents): add workspaceConfig.allowedExternalPaths for trusted symlinked workspace files #38981

Closed

[Feature]: Configurable umask / file permissions for agent-created user-facing files #51660

Open

clawsweeper Bot mentioned this pull request May 9, 2026

[Bug v2026.5.9-beta.1] Control UI shows workspace files as missing despite files existing at configured paths #79953

Closed

clawsweeper Bot mentioned this pull request May 15, 2026

Workspace file injector does not follow symlinks #38622

Open

cknzraposo mentioned this pull request May 18, 2026

memory-wiki: "Refusing to write imported source page through symlink" fires for non-symlink FsSafeError causes #83740

Closed

clawsweeper Bot mentioned this pull request May 21, 2026

Control UI: Memory panel for MEMORY.md and USER.md #46809

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(agents): tighten workspace file opens#66636

fix(agents): tighten workspace file opens#66636
drobison00 merged 13 commits into
openclaw:mainfrom
eleqtrizit:423

eleqtrizit commented Apr 14, 2026

Uh oh!

greptile-apps Bot commented Apr 14, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

eleqtrizit commented Apr 14, 2026

Uh oh!

eleqtrizit commented Apr 14, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 14, 2026

Uh oh!

drobison00 commented Apr 14, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

drobison00 commented Apr 14, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

eleqtrizit commented Apr 14, 2026

Summary

Changes

Validation

Notes

Uh oh!

greptile-apps Bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

eleqtrizit commented Apr 14, 2026

Uh oh!

eleqtrizit commented Apr 14, 2026

Uh oh!

chatgpt-codex-connector Bot commented Apr 14, 2026

Uh oh!

drobison00 commented Apr 14, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

drobison00 commented Apr 14, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

greptile-apps Bot commented Apr 14, 2026 •

edited

Loading