Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: Remote inbound media staging spawns hardcoded /usr/bin/scp (broken on Windows / non-FHS layouts) [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#78677•Fetched 2026-05-07 03:33:56
View on GitHub
Comments
1
Participants
2
Timeline
5
Reactions
2
Author
azvastazvast
Participants
azvastazvastclawsweeper[bot]clawsweeper[bot]
Timeline (top)
labeled ×2commented ×1cross-referenced ×1referenced ×1

stageSandboxMedia copies remote attachments via scpFile, which always uses spawn("/usr/bin/scp", ...). That path is POSIX-specific. On Windows, OpenSSH’s client is typically scp.exe on PATH, not /usr/bin/scp, so staging can fail with spawn/ENOENT even when scp is installed. The same hardcoding is fragile on Linux systems where scp is not installed at /usr/bin/scp.

Error Message

  1. Observe failure to stage remote files (spawn error / missing executable), while scp may work from a normal shell. Remote staging should resolve scp in a portable way (e.g. scp on PATH, platform-specific detection, or documented requirement with a clear preflight error), consistent with other tooling in the repo that uses platform-aware binary resolution. High for operators using remote inbound media on Windows or non-standard layouts: attachments may not stage; replies may run without expected media or error opaquely depending on caller. Critical only if you can show this breaks a documented, common production path (add evidence when filing).

Root Cause

stageSandboxMedia copies remote attachments via scpFile, which always uses spawn("/usr/bin/scp", ...). That path is POSIX-specific. On Windows, OpenSSH’s client is typically scp.exe on PATH, not /usr/bin/scp, so staging can fail with spawn/ENOENT even when scp is installed. The same hardcoding is fragile on Linux systems where scp is not installed at /usr/bin/scp.

Fix Action

Fixed

PR fix notes

PR #78680: fix: resolve scp via PATH instead of hardcoded /usr/bin/scp (#78677)

Description (problem / solution / changelog)

Problem

scpFile in src/auto-reply/reply/stage-sandbox-media.ts hardcodes the scp binary path as /usr/bin/scp. This breaks remote inbound media staging on:

  • Windows: OpenSSH ships scp at %SystemRoot%\System32\OpenSSH\scp.exe, not /usr/bin/scp
  • Non-FHS Linux layouts: any distro or container where scp lives at /bin/scp, /usr/local/bin/scp, etc.

Fixes #78677.

Fix

Replace "/usr/bin/scp" with "scp" in the spawn() call. Node's child_process.spawn with a bare command name uses the process PATH to resolve the binary — consistent with every other spawn call in the codebase that passes a bare command (e.g. "ffmpeg", "convert", "npm").

Audit A — existing helper check

No existing detectBinary/resolveBinary helper handles scp. detect-binary.ts only resolves optional tools to detect presence, not for spawning. Bare name is the established pattern here.

Audit B — shared caller check

scpFile is private to stage-sandbox-media.ts (not exported, not imported elsewhere). One caller site only.

Audit C — rival PR scan

No rival PR open for #78677 as of scout time.

Real behavior proof

  • Existing test suite (reply.stage-sandbox-media.scp-remote-path.test.ts) extended with a third case that captures the spawn command argument and asserts it equals "scp" (not /usr/bin/scp).
  • All 3 tests pass: shell injection rejection, path-traversal-safe cache dir, and the new bare-command assertion.
  • pnpm -s tsgo:core clean.

Co-authored-by: hclsys

Changed files

  • CHANGELOG.md (modified, +1/-0)
  • src/auto-reply/reply.stage-sandbox-media.scp-remote-path.test.ts (modified, +18/-0)
  • src/auto-reply/reply/stage-sandbox-media.ts (modified, +1/-1)
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

stageSandboxMedia copies remote attachments via scpFile, which always uses spawn("/usr/bin/scp", ...). That path is POSIX-specific. On Windows, OpenSSH’s client is typically scp.exe on PATH, not /usr/bin/scp, so staging can fail with spawn/ENOENT even when scp is installed. The same hardcoding is fragile on Linux systems where scp is not installed at /usr/bin/scp.

Steps to reproduce

  1. Run OpenClaw on Windows (or a host where scp is not at /usr/bin/scp).
  2. Exercise inbound media staging with MediaRemoteHost set so the code path calls stageRemoteFileIntoRoot → scpFile (see src/auto-reply/reply/stage-sandbox-media.ts).
  3. Observe failure to stage remote files (spawn error / missing executable), while scp may work from a normal shell.

Expected behavior

Remote staging should resolve scp in a portable way (e.g. scp on PATH, platform-specific detection, or documented requirement with a clear preflight error), consistent with other tooling in the repo that uses platform-aware binary resolution.

Actual behavior

scpFile unconditionally invokes /usr/bin/scp, so remote staging depends on a fixed FHS path and fails on typical Windows (and possibly other) layouts.

OpenClaw version

2026.5.4

Operating system

Ubuntu 24.04 / Windows 11

Install method

npm global

Model

anthropic/claude-sonnet-4.5

Provider / routing chain

anthropic

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

High for operators using remote inbound media on Windows or non-standard layouts: attachments may not stage; replies may run without expected media or error opaquely depending on caller. Critical only if you can show this breaks a documented, common production path (add evidence when filing).

Additional information

Confirm duplicate issues on GitHub for scp, stageSandboxMedia, MediaRemoteHost, or /usr/bin/scp before filing.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Remote staging should resolve scp in a portable way (e.g. scp on PATH, platform-specific detection, or documented requirement with a clear preflight error), consistent with other tooling in the repo that uses platform-aware binary resolution.

#tensor shape#autograd error#model save/load#optimization#mixed precision

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: Remote inbound media staging spawns hardcoded /usr/bin/scp (broken on Windows / non-FHS layouts) [1 pull requests, 1 comments, 2 participants]