Greptile Summary

This PR fixes a sandbox access regression for LINE media downloads by migrating from /tmp-based writes (buildRandomTempFilePath + fs.writeFile) to saveMediaBuffer, which stores files under ~/.openclaw/media/inbound/ — the sandbox-accessible location. The fix also captures the Content-Type response header from LINE's API for more accurate MIME detection, and threads message.fileName through as originalFilename so that extension-based MIME fallback works for uncommon document types (PDF, DOCX, etc.).

Key findings:

• The core logic is sound: the streaming size check in downloadLineMedia fires before saveMediaBuffer's own size check, so oversized media is still correctly rejected before any disk write.
• originalFilename (from user-controlled message.fileName) is safely sanitized by sanitizeFilename in store.ts before path construction, preventing path traversal.
• Minor style issue: The outer variable in download.ts is named httpResponse, matching an inner property of the SDK return value, creating a confusing double-dereference (httpResponse.httpResponse.headers). A simple variable rename clarifies the intent.

Confidence Score: 4/5

• This PR is safe to merge. The security-sensitive originalFilename input is properly sanitized before path construction, and the core media download logic correctly enforces size limits before persisting to disk.
• The fix is correct and the implementation is secure. The streaming size check prevents oversized media from reaching the filesystem, and sanitizeFilename in store.ts prevents path-traversal attacks on the user-controlled originalFilename. All existing tests pass and have been appropriately updated. The one deduction is for a minor style inconsistency in variable naming that affects readability but not functionality.
• src/line/download.ts — minor style issue with variable naming (double-dereference httpResponse.httpResponse) addressed in review comment.

_{Last reviewed commit: b89fd9a}

saveMediaBuffer is an existing utility — this PR only migrates LINE's download path to use it instead of writing to /tmp directly. The symlink/race hardening suggestion applies to saveMediaBuffer itself, not to the changes in this PR.

The attack prerequisite (write access to ~/.openclaw/media/, created with mode: 0o700) implies the attacker already has the user's privileges, making the symlink vector redundant. Out of scope for this PR.

✍️ Author: Claude Code with @carrotRakko (AI-written, human-approved)

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

Thanks for the context here. I did a careful shell check against current main, and this is already implemented.

Current main now implements this PR's central LINE sandbox-access fix in the active bundled plugin layout: LINE inbound media is persisted through saveMediaBuffer(..., "inbound", ...) instead of temp storage, tests assert the shared media-store path and oversized-media guard, and docs/changelog record the behavior. The branch's optional Content-Type/original-filename MIME refinements are not fully present, but the observable sandbox-access bug named by the title and PR body is fixed well enough on main; any remaining MIME fidelity work should be a narrower follow-up.

Best possible solution:

Close this PR as implemented on main by 4e921808d18adaab19445f82d0a886028ce4942c. Keep the shipped extensions/line implementation that persists inbound LINE media through the plugin SDK media store, and open a smaller follow-up only if LINE Content-Type header or original filename MIME refinement is still desired.

What I checked:

• Current implementation saves LINE media in the shared inbound media store: downloadLineMedia imports saveMediaBuffer from the plugin SDK and calls saveMediaBuffer(buffer, contentType, "inbound", maxBytes), then returns saved.path and saved.contentType instead of a temp file path. (extensions/line/src/download.ts:37, db40ec404a91)
• Fix commit on main: Commit 4e921808d18adaab19445f82d0a886028ce4942c is titled fix(line): persist inbound media in shared store and changes the LINE downloader, its tests, docs, and changelog. (extensions/line/src/download.ts:37, 4e921808d18a)
• Regression tests assert media-store persistence: The LINE download test mocks saveMediaBuffer, asserts the buffer, image/jpeg content type, "inbound" subdir, default max byte limit, and returned ~/.openclaw/media/inbound/... path. It also asserts oversized media is rejected before invoking saveMediaBuffer. (extensions/line/src/download.test.ts:59, db40ec404a91)
• Sandbox staging requires media-store-rooted local files: Current sandbox staging only accepts local media under getMediaDir(), which is why moving LINE media to ~/.openclaw/media/inbound/ solves the reported sandbox access failure. (src/auto-reply/reply/stage-sandbox-media.ts:218, db40ec404a91)
• Docs and changelog record the shipped behavior: The LINE docs state inbound media is saved under ~/.openclaw/media/inbound/; the changelog records the LINE fix under Unreleased and credits the related report. No tag currently contains the fix commit, so no fixed release is identified. Public docs: docs/channels/line.md. (docs/channels/line.md:145, db40ec404a91)
• Current plugin layout supersedes the PR's old paths: The checkout has extensions/line/src/* as the active LINE plugin path and no src/line directory, so the PR's legacy src/line/* diff is obsolete even though its central behavior has landed. (extensions/line/src/download.ts:1, db40ec404a91)

So I’m closing this as already implemented rather than keeping a duplicate issue open.

Codex review notes: model gpt-5.5, reasoning high; reviewed against db40ec404a91; fix evidence: commit 4e921808d18a.