fix(runner): quote docker mount fields that contain commas

[SebTardif]

Docker parses each --mount argument as a CSV record. ClawScan previously concatenated paths into that record without escaping them, so a skill or explicit mount such as My Skill, "v2" failed before its sandbox could start.

Encode each complete mount record with Go's CSV writer while preserving mount selection and permissions. Add serialization coverage and a real ClawScan CLI integration test that checks target/rules read access, rejected writes to read-only mounts, and successful writes to an explicitly writable cache. Run the Docker test in CI and document the supported paths.

Thanks @SebTardif for the fix and initial regression test.

Validation:

• Reproduced with the checksum-verified v0.2.0 binary and synthetic input: Docker exits 125 with bare " in non-quoted-field.
• go test -count=1 ./..., go vet ./..., CLI build/help/static scan, make docs-site, npm wrapper/helper tests, and npm pack smoke all pass on a disposable Linux host.
• go build ./cmd/clawscan && docker pull alpine:3.23 && node --test scripts/docker-mounts.test.mjs passes against real Docker. Both ordinary paths and comma/quote paths retain the intended permissions:

✔ Docker preserves paths and mount permissions: plain
✔ Docker preserves paths and mount permissions: My Skill, "v2"

• Independent Codex autoreview: no actionable P0–P2 findings.
• Exact-head CI passed for 5fb0301c5d2d6742eb6327a548786a19869fe742, including the new Docker check. CodeQL and submission validation also passed.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 7, 2026, 6:12 AM ET / 10:12 UTC (Revision 7).

ClawSweeper review

What this changes

The PR encodes Docker bind mounts as CSV records and adds CLI integration coverage for paths containing commas and quotation marks while preserving mount permissions.

Merge readiness

✅ Ready for maintainer review

The fix remains necessary on main, and no blocking defect was found. The updated head resolves the previous proof gap through a successful Docker-backed CLI integration step.

Priority: P2
Reviewed head: 5fb0301c5d2d6742eb6327a548786a19869fe742

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused repair with real Docker integration coverage and no actionable correctness or security findings.
Proof confidence	🐚 platinum hermit (4/6) ✨ media proof bonus	Sufficient (linked_artifact): The exact-head GitHub job successfully ran the built ClawScan CLI through its production sandbox runner and real Docker using plain and comma/quote paths, with assertions for readable inputs, rejected target/rules writes, and writable cache output. This resolves the earlier unit-test-only gap; raw logs were inaccessible to the reviewer, but matching successful step metadata and the executed harness were inspected. No stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (linked_artifact): The exact-head GitHub job successfully ran the built ClawScan CLI through its production sandbox runner and real Docker using plain and comma/quote paths, with assertions for readable inputs, rejected target/rules writes, and writable cache output. This resolves the earlier unit-test-only gap; raw logs were inaccessible to the reviewer, but matching successful step metadata and the executed harness were inspected. No stored-data contract changes.
Evidence reviewed	7 items	Current main still needs the fix: Main constructs mount arguments by concatenating unescaped source and target paths, so embedded commas or quotation marks are not encoded as CSV fields. Focused serialization repair: The changed helper uses encoding/csv for the entire mount record. Existing source selection and read-only decisions remain intact. Production-path integration coverage: The integration script invokes the built ClawScan CLI with --sandbox docker and Alpine, exercises plain and comma/quote paths, requires completed scanner JSON, verifies rejected target/rules writes, and reads a cache file written by the container. It uses the real Docker process rather than a mocked runner.
Findings	None	None.
Security	None	None.

How this fits together

ClawScan runs command-backed scanners and judges inside Docker by default. Its sandbox runner converts target paths and configured mounts into Docker arguments that control container access to host files.

flowchart TD
  A[Scan target] --> C[Sandbox runner]
  B[Configured mounts] --> C
  C --> D[Select mount permissions]
  D --> E[Encode CSV mount records]
  E --> F[Docker scanner process]
  F --> G[Raw scanner evidence]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test LOC	Production +16/-5; tests +119/-0	The production growth is a focused CSV encoder supported by serialization and real Docker integration coverage.

Technical review

Best possible solution:

Use standard CSV encoding at the Docker mount boundary and retain integration coverage that checks actual container access and permissions.

Do we have a high-confidence way to reproduce the issue?

Yes, source provides a high-confidence path: current main inserts comma-containing host paths directly into Docker's CSV mount argument. No failing current-main execution was performed during this read-only review.

Is this the best way to solve the issue?

Yes, standard CSV encoding repairs the serialization boundary while preserving existing permission selection, and the new integration coverage exercises Docker acceptance and filesystem effects.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 6cde6b180106.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. The exact-head GitHub job successfully ran the built ClawScan CLI through its production sandbox runner and real Docker using plain and comma/quote paths, with assertions for readable inputs, rejected target/rules writes, and writable cache output. This resolves the earlier unit-test-only gap; raw logs were inaccessible to the reviewer, but matching successful step metadata and the executed harness were inspected. No stored-data contract changes.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The exact-head GitHub job successfully ran the built ClawScan CLI through its production sandbox runner and real Docker using plain and comma/quote paths, with assertions for readable inputs, rejected target/rules writes, and writable cache output. This resolves the earlier unit-test-only gap; raw logs were inaccessible to the reviewer, but matching successful step metadata and the executed harness were inspected. No stored-data contract changes.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P2: This repairs sandbox execution for special-character paths without changing public configuration or mount permissions.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The exact-head GitHub job successfully ran the built ClawScan CLI through its production sandbox runner and real Docker using plain and comma/quote paths, with assertions for readable inputs, rejected target/rules writes, and writable cache output. This resolves the earlier unit-test-only gap; raw logs were inaccessible to the reviewer, but matching successful step metadata and the executed harness were inspected. No stored-data contract changes.
• proof: sufficient: Contributor real behavior proof is sufficient. The exact-head GitHub job successfully ran the built ClawScan CLI through its production sandbox runner and real Docker using plain and comma/quote paths, with assertions for readable inputs, rejected target/rules writes, and writable cache output. This resolves the earlier unit-test-only gap; raw logs were inaccessible to the reviewer, but matching successful step metadata and the executed harness were inspected. No stored-data contract changes.

Evidence

What I checked:

• Current main still needs the fix: Main constructs mount arguments by concatenating unescaped source and target paths, so embedded commas or quotation marks are not encoded as CSV fields. (internal/runner/sandbox.go:255, 6cde6b180106)
• Focused serialization repair: The changed helper uses encoding/csv for the entire mount record. Existing source selection and read-only decisions remain intact. (internal/runner/sandbox.go:261, 5fb0301c5d2d)
• Production-path integration coverage: The integration script invokes the built ClawScan CLI with --sandbox docker and Alpine, exercises plain and comma/quote paths, requires completed scanner JSON, verifies rejected target/rules writes, and reads a cache file written by the container. It uses the real Docker process rather than a mocked runner. (scripts/docker-mounts.test.mjs:10, 5fb0301c5d2d)
• Recorded after-fix Docker execution: GitHub job https://github.com/openclaw/clawscan/actions/runs/37605321795/job/112739259492 identifies the exact reviewed head and reports successful Build CLI and Test Docker mount paths and permissions steps, completed at 2026-10-07T10:08:21Z. The workflow executes the inspected integration script without a skip or failure fallback. Raw log retrieval was blocked by the reviewer's network allowlist; job and step metadata were available. (.github/workflows/ci.yml:69, 5fb0301c5d2d)
• Large tooling deletion is already merged: The review-helper migration comes from merged chore(autoreview): use the shared canonical skill #63 at current main. Comparison with that main revision leaves seven files containing the mount repair, tests, workflow step, and supporting documentation; the large deletion does not represent removal of current-main tooling. (.agents/skills/autoreview/SKILL.md:7, 6cde6b180106)
• Re-review continuity: The previous completed review had no findings and requested a Docker-backed run demonstrating special-character paths and intended permissions. The new production-path integration script and successful matching job address that request; the original macOS unit-test transcript alone would not. (5fb0301c5d2d)

Likely related people:

• jesse-merhi: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Patrick-Erichsen: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (6 earlier review cycles)

• reviewed 2026-10-04T02:47:01.147Z sha b5ff8ff :: needs real behavior proof before merge. :: none
• reviewed 2026-10-04T21:23:39.552Z sha b5ff8ff :: needs real behavior proof before merge. :: none
• reviewed 2026-10-05T04:10:26.440Z sha b5ff8ff :: needs real behavior proof before merge. :: none
• reviewed 2026-10-05T16:51:44.905Z sha b5ff8ff :: needs real behavior proof before merge. :: none
• reviewed 2026-10-06T11:01:54.285Z sha b5ff8ff :: needs real behavior proof before merge. :: none
• reviewed 2026-10-06T21:59:56.410Z sha b5ff8ff :: needs real behavior proof before merge. :: none

[steipete]

Merged as ff17e1d. Thanks @SebTardif.

The v0.2.0 binary reproduces Docker's CSV parse failure on the synthetic comma/quote path. The fixed CLI passed real Docker integration tests for ordinary and comma/quote paths, including denied target/rules writes and successful explicit cache writes. The test now runs in CI.

Validation passed on a disposable Linux host: go test -count=1 ./..., go vet ./..., CLI build/help/static scan, make docs-site, node --test scripts/docker-mounts.test.mjs, npm wrapper/helper tests, and node scripts/build-npm-package.mjs --version v0.0.0 --pack --smoke. Independent Codex autoreview found no actionable P0–P2 findings. Exact-head CI passed, as did CodeQL and submission validation.