fix(mxc): treat cmd /R as a command-mode switch

[SebTardif]

What Problem

cmd /R is the same as /C, but SelectsCmdCommandMode only recognized /C and /K. cmd.exe /r prog hello&calc was serialized as raw argv, so cmd parsed the extra command.

Why

The approval card showed separate argv elements. The joined command then ran. This stays inside the sandbox when MXC is available. It is an approval mismatch, not a host escape.

User Impact

/R, /r, and an attached /Rcommand now fail closed unless the argv is the canonical cmd.exe /d /s /c carrier.

Evidence

Head a4a9c9398fa10c8b403b6e6b67f12da124aac589.

MxcAvailability.Probe with OPENCLAW_WXC_EXEC set to this head's tools\mxc\x64\wxc-exec.exe reported AppContainer available and system.run allowed.

MxcConfigBuilder.Build for cmd.exe /R echo hi threw NotSupportedException before DirectAppContainerExecutor.ExecuteAsync: Direct cmd.exe command wrappers must use canonical argv: cmd.exe /d /s /c <command>. No sandbox process was started.

The same executor then ran cmd.exe /d /s /c whoami.exe. With Windows UI left off, the contained process exited -1073741502 (0xC0000142) in about 137ms, tag mxc, empty stdout. With SystemRunAllowWindowsUi true, the same argv exited 0 in 145ms, tag mxc, and printed one account name. That name is redacted here.

Required proof pools

• windows-wsl-mxc: /R is rejected before wxc-exec. A canonical /d /s /c command completed inside MXC when Windows UI was allowed.

Validation

• Head a4a9c9398fa10c8b403b6e6b67f12da124aac589.
• dotnet build src/OpenClaw.Tray.WinUI/OpenClaw.Tray.WinUI.csproj -p:Platform=x64 -p:RuntimeIdentifier=win-x64 succeeded and copied wxc-exec.exe.
• Focused Build_DirectArgv_CmdSlashRCommandMode_FailsClosed: 5 passed, 0 failed.
• ./build.ps1 exited 0.
• Shared tests: 4098 passed, 32 skipped, 0 failed, 4130 total.
• Local Tray closeout on a CRLF working tree of a4a9c9398fa10c8b403b6e6b67f12da124aac589: 3064 passed, 0 failed, 0 skipped, 3064 total. Tracked C# and XAML files were CRLF on disk for that run. The git commit was not changed.
• An earlier LF checkout of this same commit was 3059 passed, 5 failed, 0 skipped, 3064 total. Those five compare multiline source to a hardcoded CRLF snippet. That mismatch is #1518. They are not the /R change.
• .\scripts\validate-mxc-e2e.ps1 on this head, without -AllowSkip: exit 1. The port-lease unit tests passed. MirroredWslSafeGatewayPort_IsListeningAndRecorded, RealGateway_SystemRun_ExecutesThroughWindowsNodeMxcSandbox, and RealGateway_SystemRun_BlocksWritesToTrayDataDirectoryInMxcSandbox failed. Setup stopped at GATEWAY_RESTART_PREPARATION_REFUSED while restarting the fresh E2E gateway after the wizard, so those three proofs did not run the MXC path.

Real behavior proof

• Behavior or issue addressed: /R must fail closed, and canonical cmd.exe /d /s /c must be able to run in the AppContainer.
• Real environment tested: Windows, head a4a9c9398fa10c8b403b6e6b67f12da124aac589, wxc-exec.exe from that tray build.
• Exact steps or command run after this patch: MxcConfigBuilder.Build for /R, then DirectAppContainerExecutor.ExecuteAsync for cmd.exe /d /s /c whoami.exe.
• Evidence after fix: /R threw before execution. The canonical command with Windows UI allowed exited 0, tag mxc, stdout was one redacted account name. On 2026-09-25 the same tray build, head a4a9c939, was paired as a Windows node to a local OpenClaw 2026.9.6 gateway at ws://127.0.0.1:18789. openclaw gateway call node.invoke for system.run returned ok. The node log shows decision=Allow, containment=mxc, exitCode=0, timedOut=false, stdout length 23 for a powershell marker. Duration was about 625ms. The local exec policy was full with ask off, written on the node, because a remote full grant is refused.
• Observed result after fix: /R did not start a sandbox process. The canonical carrier did run inside MXC. A later Gateway node.invoke of system.run also ran inside MXC and exited 0.
• Not verified / blocked: The non-skipped MXC end-to-end script did not reach system.run. The fresh E2E gateway restart was refused. The UI-denied canonical launch exited 0xC0000142 and is not a successful run. An owner has not accepted the /R compatibility restriction.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 27, 2026, 1:21 PM ET / 17:21 UTC (Revision 10).

ClawSweeper review

What this changes

The branch makes the Windows MXC sandbox reject cmd.exe /R command wrappers outside the supported canonical form and adds five regression cases.

Regression provenance

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

✅ Ready for maintainer review

Current main does not reject cmd.exe /R at the MXC command builder. This PR remains a focused fix, and the maintainer has accepted its compatibility restriction and reported current-head Windows validation. No actionable patch defect was found.

Priority: P2
Reviewed head: 84a331581ac65207d4e788f32ac462a3d64b5645

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	Focused code and regression coverage are backed by exact-head native MXC validation and an accepted compatibility decision.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): At the exact PR head, a collaborator reports five production-builder /R rejections on Windows 11/WSL2 and 17/17 non-skipped Gateway-to-node MXC E2E tests, including canonical execution and denied writes. The earlier PR-body direct executor trace shows canonical execution on the pre-merge head; the current-head comment supplies the required updated validation. No stored-data contract changes.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): At the exact PR head, a collaborator reports five production-builder /R rejections on Windows 11/WSL2 and 17/17 non-skipped Gateway-to-node MXC E2E tests, including canonical execution and denied writes. The earlier PR-body direct executor trace shows canonical execution on the pre-merge head; the current-head comment supplies the required updated validation. No stored-data contract changes.
Evidence reviewed	8 items	Introduced behavior: The pinned PR delta adds /r to command-mode detection. Noncanonical command-mode argv is rejected before the executor constructs a process launch. Current main still needs the fix: The pinned main version detects /c and /k but omits /r; the latest listed release also predates this PR. The PR is not redundant on main. Regression coverage: Five new cases cover uppercase, lowercase, attached, and combined /r forms and assert rejection.
Findings	None	None.
Security	None	None.

How this fits together

A Gateway system.run request reaches the Windows node's approval and sandbox path. The MXC builder turns approved arguments into a process command line; the executor then launches that command inside a Windows AppContainer.

flowchart LR
  A[Gateway system.run request] --> B[Windows node approval]
  B --> C[MXC command builder]
  C --> D{Canonical cmd wrapper?}
  D -->|Yes| E[AppContainer execution]
  D -->|No command mode| E
  D -->|Unsupported command mode| F[Sandbox denial]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	2 files; production +3/-4, tests +18	The change is confined to MXC command detection and its focused regression coverage.

Technical review

Best possible solution:

Keep one canonical cmd carrier contract across approvals and MXC, with /R denied before process launch and /d /s /c preserved as the supported form.

Do we have a high-confidence way to reproduce the issue?

Yes. Main's command-mode detector omits /r, and a collaborator independently reported reproducing its command-mode behavior; this read-only review did not execute Windows code.

Is this the best way to solve the issue?

Yes. Extending the existing detector and using the existing canonical carrier rejection path is a narrow fix consistent with the accepted compatibility decision.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 5a59535216ee.

Labels

Label changes:

• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦞 diamond lobster, so this older rating label is no longer current.

Label justifications:

• P2: This is a bounded command approval and sandbox consistency fix with limited affected argv forms.
• merge-risk: 🚨 compatibility: Existing sandboxed /R calls will fail closed; a collaborator explicitly accepted that restriction and named the canonical replacement.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): At the exact PR head, a collaborator reports five production-builder /R rejections on Windows 11/WSL2 and 17/17 non-skipped Gateway-to-node MXC E2E tests, including canonical execution and denied writes. The earlier PR-body direct executor trace shows canonical execution on the pre-merge head; the current-head comment supplies the required updated validation. No stored-data contract changes.
• proof: sufficient: Contributor real behavior proof is sufficient. At the exact PR head, a collaborator reports five production-builder /R rejections on Windows 11/WSL2 and 17/17 non-skipped Gateway-to-node MXC E2E tests, including canonical execution and denied writes. The earlier PR-body direct executor trace shows canonical execution on the pre-merge head; the current-head comment supplies the required updated validation. No stored-data contract changes.

Evidence

What I checked:

• Introduced behavior: The pinned PR delta adds /r to command-mode detection. Noncanonical command-mode argv is rejected before the executor constructs a process launch. (src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs:555, 84a331581ac6)
• Current main still needs the fix: The pinned main version detects /c and /k but omits /r; the latest listed release also predates this PR. The PR is not redundant on main. (src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs:553, 5a59535216ee)
• Regression coverage: Five new cases cover uppercase, lowercase, attached, and combined /r forms and assert rejection. (tests/OpenClaw.Shared.Tests/Mxc/MxcConfigBuilderTests.cs:793, 84a331581ac6)
• No host fallback for this rejection: The command runner handles an unsupported sandbox request as a sandbox denial; its host-fallback catch handles the distinct sandbox-unavailable exception. (src/OpenClaw.Shared/Mxc/MxcCommandRunner.cs:214, 84a331581ac6)
• Accepted compatibility tradeoff and current-head proof: In PR comment fix(mxc): treat cmd /R as a command-mode switch #1477 (comment), a collaborator accepts fail-closed /R rejection and reports exact-head Windows 11/WSL2 validation: five focused rejections, 17/17 non-skipped MXC E2E tests, 4,112 Shared tests passed, and 3,115 Tray tests passed. This supersedes the older-head blocker described in the PR body. (84a331581ac6)
• Repository MXC proof requirement: The documented validation path requires the real Gateway to Windows node MXC run without allowing a skipped MXC proof. (docs/WINDOWS_NODE_TESTING.md:229, 84a331581ac6)

Likely related people:

• Scott Hanselman: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Caleb Eden: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Barbara Kudiess: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (9 earlier review cycles; latest 8 shown)

• reviewed 2026-09-23T19:57:09.670Z sha a4a9c93 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-25T10:55:30.807Z sha a4a9c93 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-25T11:17:28.532Z sha a4a9c93 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-25T17:03:45.680Z sha a4a9c93 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-25T18:24:16.856Z sha a4a9c93 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-25T18:46:46.429Z sha a4a9c93 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-27T16:55:52.427Z sha a4a9c93 :: blocked before merge. :: none
• reviewed 2026-09-27T17:05:17.021Z sha 84a3315 :: needs maintainer review before merge. :: none

[karkarl]

Global triage: NEEDS_HUMAN_TEST. Take confidence 55%; recommendation confidence 92%; effort small; risk medium.

Reviewed exact head 502e854705f7. I independently reproduced that cmd.exe /R executes as an undocumented /C synonym. The fix fails closed before launch and cannot fall back to the host. Repository policy still requires scripts\validate-mxc-e2e.ps1 without -AllowSkip, with native evidence that /R is denied and canonical /d /s /c still executes. Also report Tray tests. Minor cleanup: StartsWith("/r") is subsumed by Contains("/r"), and Validation contains a literal `n.

[shanselman]

Maintainer decision: accept the fail-closed compatibility restriction. cmd.exe /R must be rejected by the MXC carrier path; callers should use the documented canonical cmd.exe /d /s /c form instead.

I now have a strict BaseContainer host. I am updating this original branch onto current main without rewriting history, then running ./scripts/validate-mxc-e2e.ps1 without -AllowSkip, the required Shared/Tray suites, and focused native evidence for /R denial plus canonical execution. I will post the exact updated SHA and results here.

[shanselman]

Validated updated exact branch head 84a331581ac65207d4e788f32ac462a3d64b5645 on a Windows 11 + WSL2 host where MXC 0.8 reports tier=base-container, needsDaclAugmentation=false, and no warnings.

Maintainer compatibility decision: accept fail-closed /R rejection. The supported replacement is canonical cmd.exe /d /s /c.

Validation

• Focused production-builder regression: Build_DirectArgv_CmdSlashRCommandMode_FailsClosed: PASS, 5/5 forms rejected (/R, /r, attached /Recho, /rcommand, and combined /d/s/r...).
• ./scripts/validate-mxc-e2e.ps1 without -AllowSkip: PASS, 17/17 tests.
• Required Gateway proofs passed, including canonical system.run execution through the Windows node MXC sandbox and blocked tray-data writes.
• dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore: PASS, 4,112 passed, 32 skipped, 0 failed.
• dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore: PASS, 3,115 passed, 0 failed.

The validation process used task-local TEMP/TMP on D:\; no global ACL or WSL settings were changed, and fixture uninstall completed.

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/36335711964
• Updated: 2026-09-27T17:07:03.729Z

[shanselman]

The failed Core/CLI job is unrelated to this PR's two-file MXC change. It timed out once in MigrationRecordTests.CleanupScript_CompletedReceiptPreservesFilesWithoutCallingWsl(... clockRollback: True) after 30 seconds. I reran that exact theory locally on current head 84a33158: 5/5 passed in 5 seconds. I have requested a failed-job rerun; no migration-test changes are being added to this branch.

[shanselman]

Maintainer merge override was attempted after three failed runs showed only unrelated Connection-suite flakes, but the repository ruleset correctly refused while CI Gate is red. I have started another failed-job rerun. No unrelated migration/readiness test changes will be added to this focused MXC branch.