addressing codex review

pgondhi987 · pgondhi987 · commit 4b1b2286aa26 · 2026-05-12T14:16:39.000Z
diff --git a/src/node-host/invoke-system-run-allowlist.ts b/src/node-host/invoke-system-run-allowlist.ts
@@ -155,7 +155,8 @@ export function resolveSystemRunExecArgv(params: {
     params.shellCommand &&
     params.policy.analysisOk &&
     params.policy.allowlistSatisfied &&
-    params.segmentSatisfiedBy.some((entry) => entry === "safeBins" || entry === "inlineChain")
+    params.segmentSatisfiedBy.some((entry) => entry === "safeBins" || entry === "inlineChain") &&
+    isPosixShellInlineCommandTransport(params.argv)
   ) {
     const rebuilt = buildSafeBinsShellCommand({
       command: params.shellCommand,
@@ -181,6 +182,14 @@ export function resolveSystemRunExecArgv(params: {
   return execArgv;
 }
 
+function isPosixShellInlineCommandTransport(argv: string[]): boolean {
+  const transportArgv = resolveShellWrapperTransportArgv(argv);
+  return Boolean(
+    transportArgv &&
+    POSIX_SHELL_WRAPPER_NAMES.has(normalizeExecutableToken(transportArgv[0] ?? "")),
+  );
+}
+
 function findSubsequence(haystack: readonly string[], needle: readonly string[]): number {
   if (needle.length === 0 || needle.length > haystack.length) {
     return -1;
diff --git a/src/node-host/invoke-system-run.test.ts b/src/node-host/invoke-system-run.test.ts
@@ -834,6 +834,31 @@ describe("handleSystemRunInvoke mac app exec host routing", () => {
     },
   );
 
+  it.runIf(process.platform !== "win32")(
+    "does not apply POSIX safe-bin shell rewrites to PowerShell wrappers",
+    async () => {
+      const oldPath = process.env.PATH;
+      process.env.PATH = "/usr/bin:/bin";
+      try {
+        const { runCommand, sendInvokeResult } = await runSystemInvoke({
+          preferMacAppExecHost: false,
+          security: "allowlist",
+          ask: "off",
+          command: ["pwsh", "-Command", "head -c 16"],
+        });
+
+        expect(requireFirstRunCommandArgs(runCommand)).toEqual(["pwsh", "-Command", "head -c 16"]);
+        expectInvokeOk(sendInvokeResult);
+      } finally {
+        if (oldPath === undefined) {
+          delete process.env.PATH;
+        } else {
+          process.env.PATH = oldPath;
+        }
+      }
+    },
+  );
+
   it("denies abbreviated PowerShell encoded payloads even when the wrapper is allowlisted", async () => {
     const binDir = createFixtureDir("openclaw-pwsh-allowlist-");
     const executablePath = createTempExecutable({ dir: binDir, name: "pwsh" });
