fix(telegram): resolve openshell path for child processes - #266
Closed
mihai-chiorean wants to merge 1 commit into
Closed
fix(telegram): resolve openshell path for child processes#266mihai-chiorean wants to merge 1 commit into
mihai-chiorean wants to merge 1 commit into
Conversation
Contributor
📝 WalkthroughWalkthroughPrepends Changes
Sequence Diagram(s)sequenceDiagram
participant StartScript as Start Script
participant Bridge as Telegram Bridge
participant OpenShell as OpenShell Binary
participant SSH as ssh (client)
StartScript->>StartScript: if ~/.local/bin exists && not in PATH -> prepend to PATH
StartScript->>StartScript: resolve openshell via `command -v` -> set OPENSHELL_BIN
StartScript->>Bridge: spawn with OPENSHELL_BIN exported
Bridge->>OpenShell: execFileSync(OPENSHELL_BIN, ["sandbox","ssh-config", SANDBOX])
OpenShell-->>Bridge: stdout -> SSH config
Bridge->>SSH: spawn ssh using provided config
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@scripts/telegram-bridge.js`:
- Line 89: Replace the execSync call that builds a shell-interpolated command
using OPENSHELL and SANDBOX with execFileSync to avoid shell interpolation: call
execFileSync(OPENSHELL, ["sandbox", "ssh-config", SANDBOX], { encoding: "utf-8"
}) (ensure execFileSync is imported from child_process) so arguments are passed
as an array and no shell parsing occurs; update the sshConfig assignment
accordingly and preserve the encoding option.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 560bf688-22fb-49f0-aa3f-b6cadf92898a
📒 Files selected for processing (2)
scripts/start-services.shscripts/telegram-bridge.js
wscurran
added
the
integration: telegram
mihai-chiorean
force-pushed
the
fix/telegram-path
branch
from
March 19, 2026 23:41
9effed1 to
31fc6ea
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@scripts/start-services.sh`:
- Around line 148-152: The script currently sets OPENSHELL_BIN but continues to
start the Telegram bridge even when openshell is missing; update the block that
defines OPENSHELL_BIN to check for TELEGRAM_BOT_TOKEN and, if TELEGRAM_BOT_TOKEN
is non-empty while OPENSHELL_BIN is empty, immediately fail (echo a clear error
and exit 1) or alternatively log a warning and skip starting the bridge; refer
to the OPENSHELL_BIN variable and the TELEGRAM_BOT_TOKEN env var in your change
so the script refuses to proceed with launching the Telegram bridge when
openshell cannot be resolved.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4da854c2-b53a-4d28-aa2d-54dace311075
📒 Files selected for processing (2)
scripts/start-services.shscripts/telegram-bridge.js
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/telegram-bridge.js
Comment on lines
+148
to
+152
| # Resolve openshell absolute path so child processes find it regardless of PATH | ||
| OPENSHELL_BIN="$(command -v openshell 2>/dev/null || true)" | ||
| if [ -n "$OPENSHELL_BIN" ]; then | ||
| export OPENSHELL_BIN | ||
| fi |
Contributor
There was a problem hiding this comment.
Fail fast when openshell is missing before launching Telegram bridge.
Right now the bridge still starts even when OPENSHELL_BIN cannot be resolved, which can lead to a “started but broken” service state. Consider failing early (or skipping bridge start with a warning) when TELEGRAM_BOT_TOKEN is set and openshell is absent.
Suggested fix
- OPENSHELL_BIN="$(command -v openshell 2>/dev/null || true)"
- if [ -n "$OPENSHELL_BIN" ]; then
- export OPENSHELL_BIN
- fi
+ OPENSHELL_BIN="$(command -v openshell 2>/dev/null || true)"
+ [ -n "$OPENSHELL_BIN" ] || fail "openshell not found. Install OpenShell or add it to PATH."
+ export OPENSHELL_BIN🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@scripts/start-services.sh` around lines 148 - 152, The script currently sets
OPENSHELL_BIN but continues to start the Telegram bridge even when openshell is
missing; update the block that defines OPENSHELL_BIN to check for
TELEGRAM_BOT_TOKEN and, if TELEGRAM_BOT_TOKEN is non-empty while OPENSHELL_BIN
is empty, immediately fail (echo a clear error and exit 1) or alternatively log
a warning and skip starting the bridge; refer to the OPENSHELL_BIN variable and
the TELEGRAM_BOT_TOKEN env var in your change so the script refuses to proceed
with launching the Telegram bridge when openshell cannot be resolved.
Author
mafueee
pushed a commit
to mafueee/NemoClaw
that referenced
this pull request
Mar 28, 2026
* docs(examples): add sandbox policy quickstart walkthrough Add an interactive getting-started example that demonstrates OpenShell's network policy system end-to-end: default-deny, L7 read-only access, and audit logging — all with a single YAML policy file. - examples/sandbox-policy-quickstart/policy.yaml: policy with default static fields (filesystem, landlock, process) so it works out of the box with `openshell policy set` - examples/sandbox-policy-quickstart/demo.sh: automated demo script using printf (portable) and openshell ssh-proxy for sandbox exec - examples/sandbox-policy-quickstart/README.md: step-by-step manual walkthrough - README.md: add "See network policy in action" section linking to the quickstart Signed-off-by: Alexander Watson <zredlined@gmail.com> Made-with: Cursor Signed-off-by: Alexander Watson <zredlined@gmail.com> Made-with: Cursor * docs: soften default-deny wording to minimal outbound access Sandbox defaults vary by type and community configs, so "all outbound traffic is blocked" is too absolute. Made-with: Cursor * docs: use curl -sS so L4 deny errors are visible curl -s suppresses stderr, hiding the 403 from the CONNECT proxy. Adding -S ensures the error message is always shown. Made-with: Cursor --------- Signed-off-by: Alexander Watson <zredlined@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
openshell: not foundbecause~/.local/binisn't in PATH for child processes spawned vianohupstart-services.shnow adds~/.local/binto PATH if missing, resolvesopenshellto its absolute path viacommand -v, and exports it asOPENSHELL_BINOPENSHELL_BINenv var (falls back to bareopenshell)Fixes #199
Summary by CodeRabbit