Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix Workspace symlinks to ~/.openclaw subdirectories are rejected by boundary path check [2 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#64472•Fetched 2026-04-11 06:14:46
View on GitHub
Comments
1
Participants
2
Timeline
3
Reactions
0
Author
abczsl520abczsl520
Participants
abczsl520abczsl520ClawKingAIClawKingAI
Timeline (top)
cross-referenced ×2commented ×1

Workspace bootstrap files (AGENTS.md, SOUL.md, MEMORY.md, etc.) that are symlinks pointing to targets within the ~/.openclaw/ directory tree are rejected by the boundary path security check, causing them to show as [MISSING] in the system prompt.

Error Message

  • assertInsideBoundary() — throws boundary escape error
  • No error or warning is surfaced to the user — the files simply appear missing

Root Cause

The boundary path resolution in src/infra/boundary-path.ts uses fs.realpathSync() to resolve symlinks, then checks if the canonical path is inside the workspace root (~/.openclaw/workspace/). Since ~/.openclaw/kb/ is a sibling of ~/.openclaw/workspace/, not a child, the check fails.

Three enforcement points reject these paths:

  • applyResolvedSymlinkHop() — throws symlinkEscapeError
  • assertInsideBoundary() — throws boundary escape error
  • assertLexicalBoundaryOrCanonicalAlias() — throws pathEscapeError

Fix Action

Workaround

Replace symlinks with actual file copies and use a periodic sync script to keep them in sync. This works but is fragile and loses the atomicity benefits of symlinks.

PR fix notes

PR #64473: fix: allow symlinks within ~/.openclaw directory in boundary path checks

Description (problem / solution / changelog)

Fixes #64472

Problem

Workspace bootstrap files that are symlinks pointing to targets within ~/.openclaw/ (but outside ~/.openclaw/workspace/) are rejected by the boundary path security check. This causes them to show as [MISSING] in the system prompt, silently breaking all workspace-level instructions.

This commonly happens when users set up knowledge-base sync (e.g., Syncthing) with a dedicated directory like ~/.openclaw/kb/ and symlink workspace files to it.

Solution

Add a fallback check in three boundary enforcement points (applyResolvedSymlinkHop, assertInsideBoundary, assertLexicalBoundaryOrCanonicalAlias): if a symlink target is not inside the workspace root but IS inside ~/.openclaw/, allow it.

Security Considerations

  • Symlinks to arbitrary locations outside ~/.openclaw/ are still blocked
  • The ~/.openclaw/ directory is already a trusted boundary — it contains the gateway config, agent data, plugins, and workspace
  • This change only relaxes the check for sibling directories within the same trust boundary
  • All other safety checks (TOCTOU protection, hardlink rejection, file type validation, max size) remain unchanged

Changes

  • src/infra/boundary-path.ts: 3 functions modified, 23 lines added, 5 removed
    • applyResolvedSymlinkHop(): fallback ~/.openclaw/ check before throwing symlink escape error
    • assertInsideBoundary(): fallback ~/.openclaw/ check before throwing boundary error
    • assertLexicalBoundaryOrCanonicalAlias(): fallback ~/.openclaw/ check before throwing path escape error

Testing

Existing boundary path tests should continue to pass — they use temp directories outside ~/.openclaw/, so the new fallback check does not apply to them.

Manual verification: symlinked workspace bootstrap files to ~/.openclaw/kb/ directory, confirmed they are now loaded correctly in the system prompt.

Changed files

  • src/infra/boundary-path.ts (modified, +23/-5)

PR #51277: fix: allow symlinks to openclaw root sibling dirs

Description (problem / solution / changelog)

Summary

Previously, workspace bootstrap files (AGENTS.md, SOUL.md, MEMORY.md, etc.) symlinked to paths inside ~/.openclaw/ but outside ~/.openclaw/workspace/ were rejected by boundary path security checks (issue #64472).

This affects users with multi-machine sync setups (e.g. Syncthing) who symlink workspace files to ~/.openclaw/kb/AGENTS.md.

Root Cause

Three enforcement points in src/infra/boundary-path.ts checked only if the resolved path was inside the workspace root, with no fallback for sibling directories within the openclaw root.

Fix

Added fallback checks to allow paths inside the openclaw root (~/.openclaw/) even if outside the workspace root specifically. Security maintained — symlinks to arbitrary locations outside ~/.openclaw/ are still blocked.

Changed

  • applyResolvedSymlinkHop() — now allows symlinks resolving inside ~/.openclaw/ root
  • assertInsideBoundary() — now allows candidates inside ~/.openclaw/ root
  • assertLexicalBoundaryOrCanonicalAlias() — now allows canonical aliases inside ~/.openclaw/ root

Test Plan

  1. Create a symlink: ln -s ~/.openclaw/kb/AGENTS.md ~/.openclaw/workspace/AGENTS.md
  2. Start openclaw — AGENTS.md should load correctly (no [MISSING] prefix)
  3. No regression for normal (non-symlinked) workspace files

Closes #64472

Changed files

  • src/auto-reply/reply/agent-runner-execution.ts (modified, +14/-0)
  • src/auto-reply/reply/sandbox-security-error.test.ts (added, +51/-0)
  • src/config/zod-schema.hooks.ts (modified, +5/-1)
  • src/infra/boundary-path.ts (modified, +19/-5)
RAW_BUFFERClick to expand / collapse

Description

Workspace bootstrap files (AGENTS.md, SOUL.md, MEMORY.md, etc.) that are symlinks pointing to targets within the ~/.openclaw/ directory tree are rejected by the boundary path security check, causing them to show as [MISSING] in the system prompt.

Use Case

A common deployment pattern for multi-machine setups is to sync knowledge-base files (memory/, scripts/, AGENTS.md, etc.) across machines using tools like Syncthing. The natural approach is:

  1. Create a dedicated sync directory: ~/.openclaw/kb/
  2. Symlink workspace bootstrap files to the sync directory: ~/.openclaw/workspace/AGENTS.md → ~/.openclaw/kb/AGENTS.md

This keeps the sync isolated from project code while sharing workspace configuration.

Root Cause

The boundary path resolution in src/infra/boundary-path.ts uses fs.realpathSync() to resolve symlinks, then checks if the canonical path is inside the workspace root (~/.openclaw/workspace/). Since ~/.openclaw/kb/ is a sibling of ~/.openclaw/workspace/, not a child, the check fails.

Three enforcement points reject these paths:

  • applyResolvedSymlinkHop() — throws symlinkEscapeError
  • assertInsideBoundary() — throws boundary escape error
  • assertLexicalBoundaryOrCanonicalAlias() — throws pathEscapeError

Impact

  • All bootstrap files show [MISSING] in the system prompt
  • All workspace-level instructions (AGENTS.md rules, SOUL.md persona, etc.) are silently lost
  • No error or warning is surfaced to the user — the files simply appear missing
  • The issue persists across all new sessions until the symlinks are replaced with real files

Proposed Fix

Add a fallback check in the three enforcement points: if a symlink target is not inside the workspace root but IS inside ~/.openclaw/, allow it. This maintains security (symlinks to arbitrary locations outside ~/.openclaw/ are still blocked) while supporting the sync directory pattern.

Environment

  • OpenClaw version: 2026.3.13
  • OS: macOS (Darwin arm64)
  • Node: v22

Workaround

Replace symlinks with actual file copies and use a periodic sync script to keep them in sync. This works but is fragile and loses the atomicity benefits of symlinks.

extent analysis

TL;DR

Modify the boundary path security check in src/infra/boundary-path.ts to allow symlinks pointing to targets within the ~/.openclaw/ directory tree.

Guidance

  • Identify the three enforcement points (applyResolvedSymlinkHop, assertInsideBoundary, assertLexicalBoundaryOrCanonicalAlias) in src/infra/boundary-path.ts that reject symlinks and modify them to include a fallback check for targets within ~/.openclaw/.
  • Verify the fix by creating a symlink from ~/.openclaw/workspace/ to a file within ~/.openclaw/kb/ and checking if the file is no longer marked as [MISSING] in the system prompt.
  • Consider implementing a periodic sync script as a temporary workaround to keep file copies in sync, although this loses the benefits of symlinks.
  • Review the proposed fix to ensure it maintains the required security level by blocking symlinks to arbitrary locations outside ~/.openclaw/.

Example

// Example of modified assertInsideBoundary function
function assertInsideBoundary(path) {
  const canonicalPath = fs.realpathSync(path);
  if (canonicalPath.startsWith(workspaceRoot) || canonicalPath.startsWith(openclawRoot)) {
    return true;
  }
  throw new Error('Path is outside the allowed boundary');
}

Notes

The fix relies on the fs.realpathSync() function to resolve symlinks and check if the canonical path is inside the allowed boundary. The openclawRoot variable should be set to the path of the ~/.openclaw/ directory.

Recommendation

Apply the proposed fix to modify the boundary path security check, as it maintains security while supporting the sync directory pattern.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#ssr#cache issue#memory leak#API versioning#request timeout

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING