diff --git a/src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs b/src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs index a80b3f345..5e79f1c22 100644 --- a/src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs +++ b/src/OpenClaw.Shared/Mxc/MxcConfigBuilder.cs @@ -550,10 +550,9 @@ private static bool SelectsCmdCommandMode(IReadOnlyList argv) if (!argument.StartsWith("/", StringComparison.Ordinal)) continue; - if (argument.StartsWith("/c", StringComparison.OrdinalIgnoreCase) - || argument.StartsWith("/k", StringComparison.OrdinalIgnoreCase) - || argument.Contains("/c", StringComparison.OrdinalIgnoreCase) - || argument.Contains("/k", StringComparison.OrdinalIgnoreCase)) + if (argument.Contains("/c", StringComparison.OrdinalIgnoreCase) + || argument.Contains("/k", StringComparison.OrdinalIgnoreCase) + || argument.Contains("/r", StringComparison.OrdinalIgnoreCase)) { return true; } diff --git a/tests/OpenClaw.Shared.Tests/Mxc/MxcConfigBuilderTests.cs b/tests/OpenClaw.Shared.Tests/Mxc/MxcConfigBuilderTests.cs index f6bf73302..747e379e6 100644 --- a/tests/OpenClaw.Shared.Tests/Mxc/MxcConfigBuilderTests.cs +++ b/tests/OpenClaw.Shared.Tests/Mxc/MxcConfigBuilderTests.cs @@ -790,6 +790,24 @@ public void Build_DirectArgv_LateCmdCommandMode_FailsClosed() Assert.Contains("canonical argv", error.Message, StringComparison.Ordinal); } + [Theory] + [InlineData("/R", "echo hi")] + [InlineData("/r", "prog", "hello&calc")] + [InlineData("/Recho hi")] + [InlineData("/rcommand")] + [InlineData("/d/s/recho hi")] + public void Build_DirectArgv_CmdSlashRCommandMode_FailsClosed(params string[] tail) + { + string[] argv = [ExpectedSystemCmdExe(), .. tail]; + using var argsDoc = JsonDocument.Parse(JsonSerializer.Serialize(new { argv })); + var request = RequestFor(BalancedPolicy()) with { Args = argsDoc.RootElement.Clone() }; + + var error = Assert.Throws( + () => BuildConfig(request, pathEnvVar: "")); + + Assert.Contains("canonical argv", error.Message, StringComparison.Ordinal); + } + [Fact] public void Build_CmdBootstrapRefsWithDelayedExpansionSyntax_FailsClosed() {