fix(exec): allow symlinked OPENCLAW_STATE_DIR via terminal stat

t2wei · t2wei · commit 229add945150 · 2026-06-23T16:16:44.000+08:00
`ensureDir` validated the approvals directory with `fs.lstatSync`, then
rejected any path where `isSymbolicLink()` was true. This breaks on
common deployment topologies where the state directory itself is a
top-level symlink (e.g. `/opt/openclaw` -&gt; `/mnt/efs/openclaw` for
EFS-backed hosts on AWS).

The companion `assertNoExecApprovalsSymlinkParents` check walks the
segments BETWEEN the trusted root and the terminal target — when
`OPENCLAW_STATE_DIR` equals `OPENCLAW_HOME` (the trusted root), no
segments are walked and the terminal symlink slips past that walk
without inspection. The follow-up lstat check is therefore the only
gate, and it rejects the entire deployment.

Switch to `fs.statSync` so a terminal symlink that resolves to a real
directory is accepted while:

- intermediate path symlinks are still rejected by the parents check
- non-directory terminals (regular files, FIFOs, etc.) are still
  rejected via `dirStat.isDirectory()`

Symptom before fix:

```text
[tools] exec failed: Refusing to use unsafe exec approvals directory:
  /opt/openclaw raw_params={"workdir":"...","timeout":20}
```

Every exec tool call from any agent failed with the same error
regardless of `workdir`, because `OPENCLAW_STATE_DIR` resolution
happens server-side before the workdir is consulted.

Adds a regression test that mirrors the deployment shape: `HOME` and
`STATE_DIR` both pointing at a symlink whose target is a real directory.
diff --git a/src/infra/exec-approvals-store.test.ts b/src/infra/exec-approvals-store.test.ts
@@ -338,6 +338,30 @@ describe("exec approvals store helpers", () => {
     },
   );
 
+  it.runIf(process.platform !== "win32")(
+    "accepts a symlinked state directory whose target is a real directory",
+    () => {
+      // Deployments commonly mount the state dir via a top-level symlink
+      // (e.g. `/opt/openclaw` -> `/mnt/efs/openclaw` for EFS-backed hosts).
+      // When HOME and STATE_DIR coincide at the symlink, the
+      // `assertNoExecApprovalsSymlinkParents` walk sees zero segments
+      // (target == root) and does not check the terminal symlink.
+      // `ensureDir` must therefore resolve the symlink (statSync) instead of
+      // rejecting any terminal symlink outright.
+      const tmpRoot = makeTempDir();
+      tempDirs.push(tmpRoot);
+      const realRoot = path.join(tmpRoot, "real");
+      fs.mkdirSync(realRoot, { recursive: true });
+      const linkedRoot = path.join(tmpRoot, "linked");
+      fs.symlinkSync(realRoot, linkedRoot);
+      setTestEnvValue("OPENCLAW_HOME", linkedRoot);
+      setTestEnvValue("OPENCLAW_STATE_DIR", linkedRoot);
+
+      expect(() => ensureExecApprovals()).not.toThrow();
+      expect(fs.existsSync(path.join(realRoot, "exec-approvals.json"))).toBe(true);
+    },
+  );
+
   it.runIf(process.platform !== "win32")(
     "rejects symlinked approvals files before resolving the default no-prompt policy",
     () => {
diff --git a/src/infra/exec-approvals.ts b/src/infra/exec-approvals.ts
@@ -418,8 +418,16 @@ function ensureDir(filePath: string) {
   const dir = path.dirname(filePath);
   assertNoExecApprovalsSymlinkParents(dir, resolveRequiredHomeDir());
   fs.mkdirSync(dir, { recursive: true });
-  const dirStat = fs.lstatSync(dir);
-  if (!dirStat.isDirectory() || dirStat.isSymbolicLink()) {
+  // Resolve symlinks at the terminal directory: deployments often mount the
+  // state directory via a top-level symlink (e.g. `/opt/openclaw` →
+  // `/mnt/efs/openclaw` for EFS-backed hosts). `assertNoExecApprovalsSymlinkParents`
+  // walks segments BETWEEN the trusted root and the terminal target — when
+  // the terminal equals the trusted root, no segments are walked and a
+  // symlink at the terminal is missed. Use `statSync` (follows symlinks) so
+  // a terminal symlink that resolves to a real directory is accepted while
+  // intermediate symlinks remain rejected by the parents check above.
+  const dirStat = fs.statSync(dir);
+  if (!dirStat.isDirectory()) {
     throw new Error(`Refusing to use unsafe exec approvals directory: ${dir}`);
   }
   try {
