vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-21 14:11:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(exec): fail closed when sandbox is unavailable and harden deny followups (#56800)

Browse Source 
* fix(exec): fail closed when sandbox is unavailable and harden deny followups

* docs(changelog): note exec fail-closed fix
This commit is contained in:
scoootscooob
2026-03-28 22:20:49 -07:00
committed by GitHub
parent d5e59621a7
commit 5d81b64343
14 changed files with 116 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/agents/bash-tools.exec.path.test.ts
View File

@@ -251,25 +251,14 @@ describe("exec host env validation", () => {
}
});
it("defaults to sandbox when sandbox runtime is unavailable", async () => {
it("fails closed when the implicit sandbox host has no sandbox runtime", async () => {
const tool = createExecTool({ security: "full", ask: "off" });
const result = await tool.execute("call1", {
command: "echo ok",
});
const text = normalizeText(result.content.find((c) => c.type === "text")?.text);
expect(text).toContain("ok");
const err = await tool
.execute("call2", {
await expect(
tool.execute("call1", {
command: "echo ok",
host: "gateway",
})
.then(() => null)
.catch((error: unknown) => (error instanceof Error ? error : new Error(String(error))));
expect(err).toBeTruthy();
expect(err?.message).toMatch(/exec host not allowed/);
expect(err?.message).toMatch(/tools\.exec\.host=sandbox/);
}),
).rejects.toThrow(/sandbox runtime is unavailable/);
});
it("fails closed when sandbox host is explicitly configured without sandbox runtime", async () => {