Skip to content

Fix #166: Quote sandbox names in shell commands #335

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hkc5 wants to merge 3 commits into from
Closed

Fix #166: Quote sandbox names in shell commands #335

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fd3b4a3
fix: quote sandbox names in shell commands using shellEscape()
hkc5 Mar 18, 2026
09afb41
refactor: consolidate shell quoting to use existing shellQuote() helper
hkc5 Mar 21, 2026
691ceb9
fix: apply shellQuote consistently to all sandboxName usages
hkc5 Mar 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions bin/lib/onboard.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,7 +221,7 @@ function sleep(seconds) {

function waitForSandboxReady(sandboxName, attempts = 10, delaySeconds = 2) {
for (let i = 0; i < attempts; i += 1) {
const exists = runCapture(`openshell sandbox get "${sandboxName}" 2>/dev/null`, { ignoreError: true });
const exists = runCapture(`openshell sandbox get ${shellQuote(sandboxName)} 2>/dev/null`, { ignoreError: true });
if (exists) return true;
sleep(delaySeconds);
}
Expand Down Expand Up @@ -438,7 +438,7 @@ async function createSandbox(gpu) {
}
}
// Destroy old sandbox
run(`openshell sandbox delete "${sandboxName}" 2>/dev/null || true`, { ignoreError: true });
run(`openshell sandbox delete ${shellQuote(sandboxName)} 2>/dev/null || true`, { ignoreError: true });
registry.removeSandbox(sandboxName);
}

Expand All @@ -457,7 +457,7 @@ async function createSandbox(gpu) {
const basePolicyPath = path.join(ROOT, "nemoclaw-blueprint", "policies", "openclaw-sandbox.yaml");
const createArgs = [
`--from "${buildCtx}/Dockerfile"`,
`--name "${sandboxName}"`,
`--name ${shellQuote(sandboxName)}`,
`--policy "${basePolicyPath}"`,
];
// --gpu is intentionally omitted. See comment in startGateway().
Expand Down Expand Up @@ -507,7 +507,7 @@ async function createSandbox(gpu) {
if (!ready) {
// Clean up the orphaned sandbox so the next onboard retry with the same
// name doesn't fail on "sandbox already exists".
const delResult = run(`openshell sandbox delete "${sandboxName}" 2>/dev/null || true`, { ignoreError: true });
const delResult = run(`openshell sandbox delete ${shellQuote(sandboxName)} 2>/dev/null || true`, { ignoreError: true });
console.error("");
console.error(` Sandbox '${sandboxName}' was created but did not become ready within 60s.`);
if (delResult.status === 0) {
Expand All @@ -525,7 +525,7 @@ async function createSandbox(gpu) {
// which would silently prevent the new sandbox's dashboard from being reachable.
run(`openshell forward stop 18789 2>/dev/null || true`, { ignoreError: true });
// Forward dashboard port to the new sandbox
run(`openshell forward start --background 18789 "${sandboxName}"`, { ignoreError: true });
run(`openshell forward start --background 18789 ${shellQuote(sandboxName)}`, { ignoreError: true });

// Register only after confirmed ready — prevents phantom entries
registry.registerSandbox({
Expand Down Expand Up @@ -800,7 +800,7 @@ async function setupOpenclaw(sandboxName, model, provider) {
onboardedAt: new Date().toISOString(),
};
const script = buildSandboxConfigSyncScript(sandboxConfig);
run(`cat <<'EOF_NEMOCLAW_SYNC' | openshell sandbox connect "${sandboxName}"
run(`cat <<'EOF_NEMOCLAW_SYNC' | openshell sandbox connect ${shellQuote(sandboxName)}
${script}
EOF_NEMOCLAW_SYNC`, { stdio: ["ignore", "ignore", "inherit"] });
}
Expand Down