Skip to content

fix(media): normalize Windows inbound paths case-insensitively#96024

Closed
VectorPeak wants to merge 2 commits into
openclaw:mainfrom
VectorPeak:codex/windows-inbound-path-case
Closed

fix(media): normalize Windows inbound paths case-insensitively#96024
VectorPeak wants to merge 2 commits into
openclaw:mainfrom
VectorPeak:codex/windows-inbound-path-case

Conversation

@VectorPeak

@VectorPeak VectorPeak commented Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

Windows drive paths are case-insensitive, but OpenClaw's inbound media path policy currently compares normalized path segments case-sensitively.

For example, a configured inbound media root may be:

C:\Users\Alice\.openclaw\media

while an inbound local media path may be reported as:

c:\users\alice\.openclaw\media\incoming\photo.jpg

Both paths refer to the same location on Windows, but the current segment comparison rejects the candidate path because C: does not equal c: and Users does not equal users.

This can block valid local media paths before they enter media staging, local media access, media understanding, or agent media tooling.

Change

Normalize Windows drive absolute paths to lowercase inside normalizePosixAbsolutePath().

POSIX-style absolute paths are unchanged, so Linux/macOS case-sensitive behavior is preserved.

Evidence

Reproduced against an installed OpenClaw package on Windows:

OpenClaw 2026.6.8 (844f405)

Command:

node --input-type=module -e "import { isInboundPathAllowed } from 'file:///E:/Dev/nvm4w/nodejs/node_modules/openclaw/dist/media-core/inbound-path-policy.js'; const root='E:\\Github\\openclaw\\media'; const same='E:\\Github\\openclaw\\media\\incoming\\photo.png'; const diff='e:\\github\\openclaw\\media\\incoming\\photo.png'; console.log(JSON.stringify({version:'OpenClaw 2026.6.8 (844f405)', root, sameCaseAllowed:isInboundPathAllowed({filePath:same,roots:[root]}), differentCaseAllowed:isInboundPathAllowed({filePath:diff,roots:[root]})}, null, 2));"

Output before this fix:

{
  "version": "OpenClaw 2026.6.8 (844f405)",
  "root": "E:\\Github\\openclaw\\media",
  "sameCaseAllowed": true,
  "differentCaseAllowed": false
}

Validation

  • git diff --check upstream/main...HEAD passed.
  • Attempted: corepack pnpm exec vitest run packages/media-core/src/inbound-path-policy.test.ts --runInBand
    • This timed out locally while initializing the test runner/dependencies, so I could not complete the Vitest run in this checkout.

AI Assistance Disclosure

This PR was prepared with AI assistance.

@VectorPeak
VectorPeak force-pushed the codex/windows-inbound-path-case branch from 4114d43 to 33fa5bc Compare June 23, 2026 07:53
@VectorPeak
VectorPeak marked this pull request as ready for review June 23, 2026 08:06
@VectorPeak
VectorPeak force-pushed the codex/windows-inbound-path-case branch from 1c2e0d8 to 379328b Compare June 23, 2026 08:15
@VectorPeak VectorPeak changed the title [codex] fix(media): normalize Windows inbound paths case-insensitively fix(media): normalize Windows inbound paths case-insensitively Jun 23, 2026
@VectorPeak
VectorPeak force-pushed the codex/windows-inbound-path-case branch from 379328b to 2716328 Compare June 23, 2026 09:21
@BradGroux BradGroux mentioned this pull request Jun 23, 2026
Draft
@clawsweeper

clawsweeper Bot commented Jun 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed June 25, 2026, 7:49 AM ET / 11:49 UTC.

Summary
The PR lowercases normalized Windows drive absolute media paths before inbound path allowlist segment comparison.

PR surface: Source +2. Total +2 across 1 file.

Reproducibility: yes. at source level: current main preserves Windows path casing and then compares root and candidate segments with strict equality. I did not run a Windows package repro in this read-only review.

Review metrics: none identified.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P1] Add redacted after-fix Windows terminal output from this branch showing differentCaseAllowed: true.
  • [P1] Add a focused regression test in packages/media-core/src/inbound-path-policy.test.ts for mixed-case Windows drive roots and candidate paths.

Proof guidance:

  • [P1] Needs real behavior proof before merge: The PR body includes before-fix Windows output but no redacted after-fix terminal output, log, screenshot, or linked artifact from this branch showing the accepted mixed-case path. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

  • [P1] The external PR still has only before-fix Windows terminal output; it needs redacted after-fix output from this branch showing the mixed-case drive path is accepted before merge.
  • [P1] No focused regression test covers the Windows mixed-case root/candidate behavior, so future changes could reintroduce the case-sensitive segment mismatch.

Maintainer options:

  1. Decide the mitigation before merge
    Land the shared media-core normalization after after-fix Windows proof and focused mixed-case Windows drive regression coverage are present.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • [P1] Human review should wait for contributor-supplied after-fix Windows proof; ClawSweeper cannot safely provide the contributor's real setup evidence.

Security
Cleared: The diff only changes string normalization in media-core and does not touch dependencies, workflows, secrets, package metadata, or code execution surfaces.

Review details

Best possible solution:

Land the shared media-core normalization after after-fix Windows proof and focused mixed-case Windows drive regression coverage are present.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: current main preserves Windows path casing and then compares root and candidate segments with strict equality. I did not run a Windows package repro in this read-only review.

Is this the best way to solve the issue?

Yes, this is likely the best fix shape because normalizing in the shared media-core policy covers media-understanding, local media access, sandbox staging, and plugin SDK callers together; caller-level case folding would duplicate the invariant.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 4ecb45bf7729.

Label changes

Label justifications:

  • P2: This is a normal-priority Windows media access bug fix with limited blast radius and no evidence of data loss, security bypass, or core runtime outage.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body includes before-fix Windows output but no redacted after-fix terminal output, log, screenshot, or linked artifact from this branch showing the accepted mixed-case path. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed

PR surface:

Source +2. Total +2 across 1 file.

View PR surface stats
Area Files Added Removed Net
Source 1 3 1 +2
Tests 0 0 0 0
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 1 3 1 +2

What I checked:

Likely related people:

  • jalehman: Live commit metadata and blame attribute the visible current inbound path policy file to boundary commit 0cdb050; older authorship is obscured by the shallow checkout. (role: recent boundary contributor; confidence: low; commits: 0cdb050bac19; files: packages/media-core/src/inbound-path-policy.ts)
  • vincentkoc: Live commit metadata shows the v2026.6.10 release commit containing the shipped policy file under vincentkoc; older detailed provenance is not visible locally. (role: release/adjacent package contributor; confidence: low; commits: aa69b12d0086; files: packages/media-core/src/inbound-path-policy.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. labels Jun 23, 2026
@VectorPeak VectorPeak closed this by deleting the head repository Jun 28, 2026
@VectorPeak VectorPeak mentioned this pull request Jun 29, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

P2 Normal backlog priority with limited blast radius. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. size: XS status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@VectorPeak