Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix OpenShell should fail fast on malformed generated commands and hard-abort repeated tool loops [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#72373•Fetched 2026-04-27 05:30:43
View on GitHub
Comments
1
Participants
2
Timeline
1
Reactions
0
Author
KaspnovKaspnov
Participants
clawsweeper[bot]clawsweeper[bot]KaspnovKaspnov
Timeline (top)
commented ×1

OpenShell currently accepts clearly malformed/generated shell commands and hands them to /bin/sh; repeated identical failed tool calls are only warned on rather than hard-aborted. In a chat-surface session this can create a long-running “typing/processing” wedge when a model repeatedly emits malformed commands derived from executable-looking placeholder text.

Error Message

and changed repeated identical tool-call detection from warn-only to hard-abort. After restart, openclaw health --json returned live/ready and chat replies recovered. 2. Treat repeated identical tool calls as a hard turn-abort after threshold, with a clear user-visible/tool-visible error.

Root Cause

This is not model-specific. GPT-5.5 made the issue visible, but the runtime should guard against any model emitting placeholder/syntax-garbage commands. Without fail-fast behaviour, a chat surface can appear wedged and keep showing a long-running processing state.

Fix Action

Fix / Workaround

Local mitigation tested

A local runtime patch added preflight rejection for:

RAW_BUFFERClick to expand / collapse

Summary

OpenShell currently accepts clearly malformed/generated shell commands and hands them to /bin/sh; repeated identical failed tool calls are only warned on rather than hard-aborted. In a chat-surface session this can create a long-running “typing/processing” wedge when a model repeatedly emits malformed commands derived from executable-looking placeholder text.

Observed behaviour

During a chat session using openai-codex/gpt-5.5 as the default model, the assistant repeatedly attempted malformed shell/tool commands. The runtime passed these through far enough that the turn did not fail fast. The loop detector warned after repeated identical tool calls, but did not abort the turn.

Examples of command patterns that should be rejected before shell execution:

  • literal placeholder tokens in executable positions or args, e.g. <name>, <workflow-id>
  • unclosed quotes
  • trailing escapes
  • unterminated backticks / command substitutions

One contributing source was bundled skill/help text containing executable-looking placeholder examples such as workflow install <name> and workflow run <workflow-id> "<task>". The model copied the placeholders literally.

Expected behaviour

OpenShell should fail closed before invoking /bin/sh when the command contains obviously non-runnable generated placeholders or malformed shell syntax.

Repeated identical tool calls in a single turn should hard-abort the turn after the configured threshold rather than only warning, especially when the repeated call is failing or malformed.

Why this matters

This is not model-specific. GPT-5.5 made the issue visible, but the runtime should guard against any model emitting placeholder/syntax-garbage commands. Without fail-fast behaviour, a chat surface can appear wedged and keep showing a long-running processing state.

Local mitigation tested

A local runtime patch added preflight rejection for:

  • literal <placeholder> tokens
  • unclosed quotes
  • trailing backslash escapes
  • unterminated backticks

and changed repeated identical tool-call detection from warn-only to hard-abort. After restart, openclaw health --json returned live/ready and chat replies recovered.

Suggested fix

  1. Add OpenShell preflight validation before shell invocation for generated-command hazards.
  2. Treat repeated identical tool calls as a hard turn-abort after threshold, with a clear user-visible/tool-visible error.
  3. Consider linting bundled skills/help examples so placeholder commands are not presented in a copy-executable form unless clearly quoted as non-runnable syntax.

Environment

  • OpenClaw installed via package manager
  • Host OS: macOS arm64
  • Default model at time: openai-codex/gpt-5.5

extent analysis

TL;DR

Implement preflight validation in OpenShell to reject malformed commands before invoking /bin/sh and treat repeated identical tool calls as a hard turn-abort.

Guidance

  • Add checks for literal placeholder tokens, unclosed quotes, trailing escapes, and unterminated backticks in the command string before passing it to /bin/sh.
  • Modify the repeated identical tool-call detection to hard-abort the turn after the configured threshold, providing a clear error message.
  • Review and lint bundled skills/help examples to prevent executable-looking placeholder commands from being copied literally by the model.

Example

import re

def validate_command(command):
    # Check for literal placeholder tokens
    if re.search(r'<\w+>', command):
        return False
    # Check for unclosed quotes
    if command.count('"') % 2 != 0 or command.count("'") % 2 != 0:
        return False
    # Check for trailing escapes
    if command.endswith('\\'):
        return False
    # Check for unterminated backticks
    if command.count('`') % 2 != 0:
        return False
    return True

Notes

The provided local mitigation patch suggests that adding preflight validation and modifying the repeated identical tool-call detection can resolve the issue. However, the exact implementation details may vary depending on the OpenShell codebase.

Recommendation

Apply the suggested fix by implementing preflight validation and modifying the repeated identical tool-call detection, as it directly addresses the identified issues and provides a clear solution to prevent malformed commands from being executed.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#cache error#pipeline error#runtime error#dependency conflict#environment setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix OpenShell should fail fast on malformed generated commands and hard-abort repeated tool loops [1 comments, 2 participants]