fix(skills): add-rtk mount rejected on v2 — relative containerPath + PATH#2969
Open
OowhitecatoO wants to merge 1 commit into
Open
fix(skills): add-rtk mount rejected on v2 — relative containerPath + PATH#2969OowhitecatoO wants to merge 1 commit into
OowhitecatoO wants to merge 1 commit into
Conversation
…PATH The add-rtk skill mounted rtk at an absolute containerPath (/usr/local/bin/rtk), which mount-security rejects on v2 (containerPath must be relative and is force-prefixed under /workspace/extra/). rtk never reached the container and the PreToolUse hook failed silently. - Mount at relative bin/rtk (lands at /workspace/extra/bin/rtk, read-only) - Add the rtk path to the mount allowlist (new step) - Put /workspace/extra/bin on PATH via settings.json env and invoke the hook by absolute path, so the bare `rtk` the hook emits resolves - Dedup matches both old and new containerPath, so re-running heals installs from the broken skill; add a migration callout - Troubleshooting now points at the real signal (Additional mount REJECTED) Refs nanocoai#1792, nanocoai#2571 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
github-actions
Bot
added
follows-guidelines
This was referenced Jul 8, 2026
OowhitecatoO
added a commit
to OowhitecatoO/nanoclaw
that referenced
this pull request
Jul 8, 2026
舊 add-rtk 把 rtk 掛在絕對 containerPath /usr/local/bin/rtk,v2 的 mount-security 只允許相對路徑(強制前綴 /workspace/extra/),整個 mount 被靜默拒絕(error.log 的 Additional mount REJECTED),rtk 從沒進過容器、 PreToolUse hook 靜默失敗。本 commit 把 skill 改成 v2 相容做法,零 core 改動。 - 相對 mount bin/rtk → 落點 /workspace/extra/bin/rtk(唯讀) - 新增 allowlist step(~/.config/nanoclaw/mount-allowlist.json)+ 重啟提醒 - 新增 PATH step:settings.json env 注入 /workspace/extra/bin,hook 改絕對 路徑(只讓 rtk 改寫出的裸名指令靠注入 PATH 解析);dedup 同時吃舊絕對與 新相對條目,重跑可自癒 - 遷移段落 +「更新 rtk 後需重啟容器(mount 綁 inode)」提醒 - Troubleshooting 指向真正訊號 Additional mount REJECTED 與兩道關卡 本地六個 group 已直接修好並實機驗證(mount 唯讀、容器內可執行、注入 PATH 後裸名解析、error.log 無新 REJECTED、jq 冪等)。此修正同步提交上游 PR nanocoai#2969 —— 將來 rebase / update-nanoclaw 時,若該 PR 已被 merge,可直接丟棄此 commit。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017ZdXHiD5PoWdDKT1YMCnUF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type of Change
This is a fix to an existing operational skill (
/add-rtk), entirely within itsSKILL.md/REMOVE.md— no source changes.Description
The
/add-rtkskill mounts rtk at an absolutecontainerPath(/usr/local/bin/rtk). On NanoClaw v2,mount-security(src/modules/mount-security/index.ts) rejects any absolute container path — additional mounts must be relative and are force-prefixed under/workspace/extra/. So the mount is silently rejected (Additional mount REJECTEDinlogs/nanoclaw.error.log), rtk never reaches the container, and thePreToolUsehook that rewrites Bash commands to the bare namertk …fails quietly. The skill has never worked on v2.What changed (
SKILL.md+REMOVE.mdonly):bin/rtk→ lands at/workspace/extra/bin/rtk(read-only).~/.config/nanoclaw/mount-allowlist.json), with a host-service restart note (the allowlist is cached in-process)./workspace/extra/binonPATHvia the group'ssettings.jsonenv(Claude Code appliesenvto Bash subprocesses and treats values literally, so the full containerPATHis set), and invoke the hook by absolute path so the hook itself never depends onPATH. Only the barertk …the hook emits relies on the injectedPATH.bin/rtkand the legacy/usr/local/bin/rtk, so re-running heals installs from the broken skill. Added a "Migrating from an earlier version" callout.Additional mount REJECTED) and the two independent gates (mount-security path rule + allowlist).Refs #1792 (documents the undocumented relative-path /
/workspace/extra/prefix behavior), #2571 (introduced the broken skill).For Skills
Testing note (honest): validated on a live v2 install across six agent groups rather than a fresh clone — the relative mount lands read-only at
/workspace/extra/bin/rtkandrtk --versionruns inside the container; with the injectedenv.PATHthe barertkresolves whilegit/nodestill resolve;logs/nanoclaw.error.logshows no newAdditional mount REJECTEDafter the fix; and thejqfilters in Step 5 / REMOVE were verified idempotent (re-run leaves a single hook, sets/removesPATHcleanly, and preserves otherenvkeys and thePreCompacthook).🤖 Generated with Claude Code