[steipete]

Repeating top-level --cwd currently loads configuration from the first directory while Commander executes in the last. An approve-all first project can therefore authorize writes inside a final deny-all project. Repeated --mcp-config has the same first-value mismatch, and configuration errors occur outside the normal output formatter.

Use one shared last-value scan for bootstrap paths, preserving required option values, command boundaries, empty cwd, and literal whitespace. Resolve the final MCP path against the final cwd. Move configuration loading into the existing error boundary with an explicit-output fallback before configuration becomes available; loaded format defaults still govern later errors. This removes the redundant first-match helpers without adding flags or changing exit/error codes.

Regression command: pnpm run build:test followed by node --test --test-name-pattern='^bootstrap' dist-test/test/cli.test.js. Before the fix, 24 cases failed and the version/default-format control passed. A synthetic --cwd FIRST --cwd=SECOND --format json fixture exec 'write SECOND/sentinel.txt denied' returned exit 0 despite SECOND's deny-all policy. After the fix it exits 5 and the file is absent. The focused bootstrap/version/config/output selection now passes all 31 tests.

Separate source-blind validation passed 51 cases over five contracts using the built CLI and a self-authored ACP peer. Actual session/new.cwd and peer cwd matched the final project; a positive approve-all control wrote its synthetic file, while deny-all returned Permission denied for fs/write_text_file and created none. Final relative MCP configuration reached session/new as:

{"name":"second-tools","command":"synthetic-mcp","args":["second"],"env":[]}

Malformed global/project JSON, invalid timeout, and missing MCP files each exited 1. JSON/strict modes emitted exactly one JSON-RPC error with id:null, error.data.acpxCode:"RUNTIME", and origin:"cli", with empty stderr. Quiet emitted one stderr diagnostic; text emitted no stack trace. Boundary, literal-option-value, empty/whitespace-cwd, malformed-earlier-project, version-bypass, and no-agent-launch default-format probes also passed. All synthetic peers exited and fixtures were removed.

pnpm run check and pnpm run check:docs passed on AWS Crabbox cbx_232ff861a01d, run run_3245442fa92e121de3a376fb44a17ab5: 1,316 tests passed, 2 skipped, and the declared flows/runtime coverage gates passed. Isolated autoreview through P2 is scoped-clean. Config/output docs and Unreleased changelog updated.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 20, 2026, 3:58 AM ET / 07:58 UTC.

ClawSweeper review

What this changes

Aligns startup configuration with the final working-directory and MCP-config flags, formats configuration errors consistently, and adds regression tests and documentation.

Merge readiness

✅ Ready for maintainer review

This fix remains necessary: current main and v0.17.1 retain the bootstrap mismatch. The patch is focused, and the supplied production-path observations cover permission enforcement and startup error output; no blocking defect was found.

Priority: P2
Reviewed head: 512496f8882dd49f604a52e840c1f1f54e5389d6

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused repair with concrete runtime observations, targeted regression coverage, and no actionable correctness finding.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The captured built-CLI run exercises bootstrap configuration through the real ACP client and filesystem owner: the final project governs cwd, MCP configuration, and allowed versus rejected writes. Reported output observations also cover startup errors in JSON, strict, quiet, and text modes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): The captured built-CLI run exercises bootstrap configuration through the real ACP client and filesystem owner: the final project governs cwd, MCP configuration, and allowed versus rejected writes. Reported output observations also cover startup errors in JSON, strict, quiet, and text modes.
Evidence reviewed	7 items	Current main still contains the defect: The pinned main implementation returns the first cwd and MCP-config occurrence. Command execution independently resolves Commander options, allowing configuration and execution directories to disagree. Latest release also retains first-value selection: Inspection of v0.17.1 shows the same first-match bootstrap helpers; this is not cleanup of an already-shipped fix. Introduced implementation and error boundary: The shared scanner retains the final occurrence, skips required option values, and stops at command boundaries. Configuration loading now enters the existing error formatter with explicit flags available before config defaults load.
Findings	None	None.
Security	None	None.

How this fits together

The CLI loads project configuration before dispatching commands to ACP agents. That configuration supplies permissions, MCP servers, and output defaults, so its working directory must match command execution.

flowchart TD
  A[Top-level CLI flags] --> B[Select final path values]
  B --> C[Load project and MCP configuration]
  C --> D[Run ACP command]
  D --> E[Enforce permissions before file writes]
  C --> F[Configuration error]
  F --> G[Requested output format]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +47/-85 (net -38); tests +174/-0	The fix consolidates bootstrap parsing while adding coverage for configuration selection and error output.

Technical review

Best possible solution:

Use the same effective paths for configuration and execution while retaining existing permission enforcement, output formats, and stored configuration.

Do we have a high-confidence way to reproduce the issue?

Yes: source establishes first-value bootstrap selection versus last-value execution, and the contributor supplies before/after denied-write observations. This read-only review did not execute tests.

Is this the best way to solve the issue?

Yes: consolidating path selection and extending the existing error boundary repairs the implicated paths without new flags, persisted formats, or competing configuration mechanisms.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 95c9d79513a6.

Labels

Label changes:

• add P2: This fixes a bounded CLI configuration mismatch affecting repeated path flags and startup error handling.
• add proof: sufficient: Contributor real behavior proof is sufficient. The captured built-CLI run exercises bootstrap configuration through the real ACP client and filesystem owner: the final project governs cwd, MCP configuration, and allowed versus rejected writes. Reported output observations also cover startup errors in JSON, strict, quiet, and text modes.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The captured built-CLI run exercises bootstrap configuration through the real ACP client and filesystem owner: the final project governs cwd, MCP configuration, and allowed versus rejected writes. Reported output observations also cover startup errors in JSON, strict, quiet, and text modes.

Label justifications:

• P2: This fixes a bounded CLI configuration mismatch affecting repeated path flags and startup error handling.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The captured built-CLI run exercises bootstrap configuration through the real ACP client and filesystem owner: the final project governs cwd, MCP configuration, and allowed versus rejected writes. Reported output observations also cover startup errors in JSON, strict, quiet, and text modes.
• proof: sufficient: Contributor real behavior proof is sufficient. The captured built-CLI run exercises bootstrap configuration through the real ACP client and filesystem owner: the final project governs cwd, MCP configuration, and allowed versus rejected writes. Reported output observations also cover startup errors in JSON, strict, quiet, and text modes.

Evidence

What I checked:

• Current main still contains the defect: The pinned main implementation returns the first cwd and MCP-config occurrence. Command execution independently resolves Commander options, allowing configuration and execution directories to disagree. (src/cli-core.ts:180, 95c9d79513a6)
• Latest release also retains first-value selection: Inspection of v0.17.1 shows the same first-match bootstrap helpers; this is not cleanup of an already-shipped fix. (src/cli-core.ts:180, 50a47ad10a75)
• Introduced implementation and error boundary: The shared scanner retains the final occurrence, skips required option values, and stops at command boundaries. Configuration loading now enters the existing error formatter with explicit flags available before config defaults load. (src/cli-core.ts:180, 512496f8882d)
• Final filesystem authorization boundary: Command handlers pass the selected configuration's permission mode into the real ACP client. FileSystemHandlers checks write approval before opening the writable file; persistent clients also refresh their runtime permission policy. (src/filesystem.ts:140, 512496f8882d)
• Captured after-fix runtime evidence: The complete supplied PR body, context sourceRevision 9c241234b3991267b62133379546e6540b7f1c28d4bd36e82cb94b64b44add52, reports 51 built-CLI probes using an independent ACP peer: final session and process cwd agreed, approve-all wrote a file, deny-all returned Permission denied for fs/write_text_file with no file created, and final MCP servers reached session/new. It also records malformed-config stdout/stderr results across output modes. Full checks were reported on AWS Crabbox cbx_232ff861a01d, run run_3245442fa92e121de3a376fb44a17ab5. These are contributor observations, not reviewer-executed tests. (512496f8882d)
• Regression coverage and scope: Added tests cover mixed repeated flag spellings, rejected filesystem writes, empty and whitespace paths, option-looking values, four configuration failures across four output modes, version bypass, and loaded output defaults. The diff contains one production file, one test file, two documentation files, and the changelog. (test/cli.test.ts:140, 512496f8882d)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Landed as 5dc546b. Startup configuration now follows the same final cwd/MCP values as command execution, and configuration errors honor explicit JSON/quiet formatting.

The regression suite reproduced the wrong-project permission decision before the fix. Afterward, 31 focused tests, 51 source-blind CLI/ACP cases, and full checks with 1,316 passed/2 skipped were green; declared coverage, docs, and independent review through P2 passed. All 12 CI jobs passed for 512496f: https://github.com/openclaw/acpx/actions/runs/35498194369. Main is synchronized and clean.