fix: tighten openshell exec preflight

steipete · steipete · commit 822ee6294796 · 2026-05-25T18:36:55.000+01:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -15,6 +15,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- OpenShell/SSH: reject malformed generated exec commands before sandbox/session setup so unresolved workflow placeholders fail fast instead of reaching the remote shell. Fixes #72373. Thanks @brokemac79.
 - Installer: make Alpine apk installs cover Git, verify the Node runtime floor, try `nodejs-current`, and report Alpine version guidance when repositories only provide older Node packages.
 - Agents/media: send direct fallback for generated media still missing after an active requester wake fails. (#85489) Thanks @fuller-stack-dev.
 - Agents: derive overflow compaction budgets from provider-reported and synthetic over-budget token counts so confirmed context overflows compact before retrying. (#70473) Thanks @fuller-stack-dev.
diff --git a/docs/plugins/sdk-subpaths.md b/docs/plugins/sdk-subpaths.md
@@ -264,6 +264,7 @@ focused channel/runtime subpaths, `config-contracts`, `string-coerce-runtime`,
     | `plugin-sdk/tool-plugin` | Define a simple typed agent-tool plugin and expose static metadata for manifest generation |
     | `plugin-sdk/tool-payload` | Extract normalized payloads from tool result objects |
     | `plugin-sdk/tool-send` | Extract canonical send target fields from tool args |
+    | `plugin-sdk/sandbox` | Sandbox backend types and SSH/OpenShell command helpers, including fail-fast exec command preflight |
     | `plugin-sdk/temp-path` | Shared temp-download path helpers and private secure temp workspaces |
     | `plugin-sdk/logging-core` | Subsystem logger and redaction helpers |
     | `plugin-sdk/markdown-table-runtime` | Markdown table mode and conversion helpers |
diff --git a/src/agents/sandbox/ssh.test.ts b/src/agents/sandbox/ssh.test.ts
@@ -124,6 +124,8 @@ describe("sandbox ssh helpers", () => {
   it.each([
     ["workflow install <name>", /unresolved placeholder token <name>/],
     ["workflow run <workflow-id> --ref main", /unresolved placeholder token <workflow-id>/],
+    ["echo $(workflow run <workflow-id> --ref main)", /unresolved placeholder token <workflow-id>/],
+    ["WORKFLOW_ID=<workflow-id> workflow run", /unresolved placeholder token <workflow-id>/],
     ['echo "unterminated', /unclosed double quote/],
     ["printf '%s", /unclosed single quote/],
     ["echo foo\\", /trailing backslash escape/],
@@ -148,6 +150,7 @@ describe("sandbox ssh helpers", () => {
           "cat < input.txt > output.txt",
           "cat <in>out",
           "cat <input> output",
+          "cat = <input-file> output.txt",
           'cat <input-file> "output file"',
           "cat <<'EOF' > literal.txt",
           "<workflow-id>",
diff --git a/src/agents/sandbox/ssh.ts b/src/agents/sandbox/ssh.ts
@@ -301,6 +301,9 @@ function readPlaceholderToken(command: string, index: number): string | null {
   if (!match) {
     return null;
   }
+  if (command[index - 1] === "=") {
+    return match[0];
+  }
   if (isLikelyGeneratedWorkflowPlaceholder(command, index)) {
     return match[0];
   }
@@ -330,6 +333,8 @@ function isLikelyGeneratedWorkflowPlaceholder(command: string, index: number): b
       prefix.lastIndexOf(";"),
       prefix.lastIndexOf("&"),
       prefix.lastIndexOf("|"),
+      prefix.lastIndexOf("("),
+      prefix.lastIndexOf("`"),
     ) + 1;
   const currentCommand = prefix.slice(segmentStart).trim();
   return /^workflow(?:\s+[A-Za-z0-9._/-]+)*$/.test(currentCommand);
