fix(sandbox): escape C1 controls in visible session label + cover both paths

lsr911 · lsr911 · commit 578c2ea763bf · 2026-07-11T16:01:38.000+08:00
The prior change extended hasUnsafeControlChars (which gates the explain
command to an agent-only fallback) through the C1 range. But the parallel
visible Session-label path went through escapeControlCharsVisible, which only
escaped C0/DEL, so a C1 byte (e.g. U+009B CSI) in a redacted session key still
reached the single-line Session output raw.

Extend the shared escapeControlCharsVisible contract through C1 (0x80-0x9f)
so the visible label escapes those bytes too, and add an end-to-end regression
in sandbox-explain.test.ts asserting a C1-bearing session key both escapes in
the Session line and triggers the agent-only explain fallback.

Signed-off-by: lsr911 &lt;liao.shirong@xydigit.com&gt;
diff --git a/src/agents/sandbox-explain.test.ts b/src/agents/sandbox-explain.test.ts
@@ -167,4 +167,39 @@ describe("sandbox explain helpers", () => {
     expect(msg).toContain('Tool "browser" blocked by sandbox tool policy');
     expect(toolPolicyAuditInfo).not.toHaveBeenCalled();
   });
+
+  it("escapes C1 controls in the Session line and falls back to agent-only explain", () => {
+    // U+009B is the C1 CSI introducer, an alternative ANSI escape prefix (ESC [).
+    const CSI = String.fromCharCode(0x9b);
+    const cfg: OpenClawConfig = {
+      agents: {
+        defaults: {
+          sandbox: { mode: "non-main", scope: "agent" },
+        },
+      },
+      tools: {
+        sandbox: {
+          tools: {
+            deny: ["browser"],
+          },
+        },
+      },
+    };
+
+    // Session key carries a C1 byte within its trailing (visible) 6 chars.
+    const sessionKey = `agent:main:mobilechat:group:g1${CSI}`;
+    const msg = formatSandboxToolPolicyBlockedMessage({
+      cfg,
+      sessionKey,
+      toolName: "browser",
+    });
+
+    // Visible Session label escapes the C1 byte instead of emitting it raw.
+    expect(msg).toContain("\\x9b");
+    expect(msg).not.toContain(CSI);
+    // Unsafe (C1-bearing) keys use the agent-scoped explain command and never
+    // embed the raw key in a --session argument.
+    expect(msg).toContain("openclaw sandbox explain --agent");
+    expect(msg).not.toContain("--session");
+  });
 });
diff --git a/src/agents/tool-policy-audit.ts b/src/agents/tool-policy-audit.ts
@@ -131,7 +131,10 @@ export function escapeControlCharsVisible(value: string): string {
       return "\\t";
     }
     const codePoint = char.codePointAt(0) ?? 0;
-    if (codePoint < 0x20 || codePoint === 0x7f) {
+    if (codePoint < 0x20 || codePoint === 0x7f || (codePoint >= 0x80 && codePoint <= 0x9f)) {
+      // Escape C0 (0x00-0x1f), DEL (0x7f), and C1 (0x80-0x9f) controls. The C1
+      // range includes the CSI introducer U+009B (an alt ANSI escape prefix),
+      // which must not reach single-line audit/session-label output raw.
       return `\\x${codePoint.toString(16).padStart(2, "0")}`;
     }
     return char;

Original file line number	Diff line number	Diff line change
`@@ -131,7 +131,10 @@ export function escapeControlCharsVisible(value: string): string {`
`131`	`131`	`return "\\t";`
`132`	`132`	`}`
`133`	`133`	`const codePoint = char.codePointAt(0) ?? 0;`
`134`		`- if (codePoint < 0x20 \|\| codePoint === 0x7f) {`
	`134`	`+ if (codePoint < 0x20 \|\| codePoint === 0x7f \|\| (codePoint >= 0x80 && codePoint <= 0x9f)) {`
	`135`	`+ // Escape C0 (0x00-0x1f), DEL (0x7f), and C1 (0x80-0x9f) controls. The C1`
	`136`	`+ // range includes the CSI introducer U+009B (an alt ANSI escape prefix),`
	`137`	`+ // which must not reach single-line audit/session-label output raw.`
`135`	`138`	return `\\x${codePoint.toString(16).padStart(2, "0")}`;
`136`	`139`	`}`
`137`	`140`	`return char;`