Fix MXC probe failure classification

Treat indeterminate probe failures as retryable unless structured probe JSON explicitly reports an unsupported host. Skip availability probing entirely when the sandbox toggle is off.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: shanselman

src/OpenClaw.Shared/Mxc/MxcAvailability.cs

@@ -224,26 +224,43 @@ internal static MxcProbeResult ParseProbeOutput(WxcProbeStatus status, int exitC
                 $"Could not determine MXC sandbox support (wxc-exec --probe {what}{(detail is null ? "" : $": {Summarize(detail)}")}).");
         }
 
-        // The process ran to completion. A non-zero exit is the binary reporting that
-        // this host cannot sandbox — a definitive, non-retryable verdict. (Genuine
-        // infrastructure failures — timeout / failed launch — are captured above via
-        // status, so they never reach this branch and get cached as "unsupported".)
-        if (exitCode != 0)
-        {
-            var detail = FirstNonEmpty(stderr, stdout);
-            return Unsupported(
-                $"This Windows host does not support the MXC sandbox (wxc-exec --probe exited {exitCode}{(detail is null ? "" : $": {Summarize(detail)}")}).");
-        }
-
-        // Exit 0 but no/garbled output is a binary anomaly, not a clear answer —
+        // No/garbled output is a binary anomaly, not a clear answer —
         // treat as a (retryable) probe error rather than silently "unsupported".
         if (string.IsNullOrWhiteSpace(stdout))
-            return Error("Could not determine MXC sandbox support (wxc-exec --probe returned no output).");
+        {
+            var detail = FirstNonEmpty(stderr);
+            return Error(
+                $"Could not determine MXC sandbox support (wxc-exec --probe {(exitCode == 0 ? "returned no output" : $"exited {exitCode}")}{(detail is null ? "" : $": {Summarize(detail)}")}).");
+        }
 
         try
         {
             using var doc = JsonDocument.Parse(stdout);
             var root = doc.RootElement;
+            var warnings = ReadWarnings(root);
+
+            if (TryGetString(root, "error") is { } error)
+            {
+                return Unsupported(
+                    $"This Windows host does not support the MXC sandbox (wxc-exec --probe reported: {Summarize(error)}).",
+                    warnings);
+            }
+
+            if (root.TryGetProperty("supported", out var supportedEl)
+                && supportedEl.ValueKind == JsonValueKind.False)
+            {
+                return Unsupported(
+                    "This Windows host does not support the MXC sandbox (wxc-exec --probe reported no usable isolation tier).",
+                    warnings);
+            }
+
+            if (exitCode != 0)
+            {
+                var detail = FirstNonEmpty(stderr, stdout);
+                return Error(
+                    $"Could not determine MXC sandbox support (wxc-exec --probe exited {exitCode}{(detail is null ? "" : $": {Summarize(detail)}")}).");
+            }
+
             if (root.ValueKind != JsonValueKind.Object
                 || !root.TryGetProperty("tier", out var tierEl)
                 || tierEl.ValueKind != JsonValueKind.String
@@ -255,29 +272,53 @@ internal static MxcProbeResult ParseProbeOutput(WxcProbeStatus status, int exitC
             var needsDacl = root.TryGetProperty("needsDaclAugmentation", out var d)
                 && d.ValueKind == JsonValueKind.True;
 
-            var warnings = new List<string>();
-            if (root.TryGetProperty("warnings", out var w) && w.ValueKind == JsonValueKind.Array)
-            {
-                foreach (var item in w.EnumerateArray())
-                {
-                    if (item.ValueKind != JsonValueKind.String) continue;
-                    var s = item.GetString();
-                    if (!string.IsNullOrWhiteSpace(s)) warnings.Add(s);
-                }
-            }
-
             return new MxcProbeResult(MxcProbeOutcome.Supported, tierEl.GetString(), needsDacl, warnings, null);
         }
         catch (JsonException ex)
         {
-            return Error($"Could not determine MXC sandbox support (wxc-exec --probe returned unparseable output: {ex.Message}).");
+            var detail = FirstNonEmpty(stderr, stdout);
+            return Error(
+                $"Could not determine MXC sandbox support (wxc-exec --probe {(exitCode == 0 ? "returned unparseable output" : $"exited {exitCode}")}: {Summarize(detail ?? ex.Message)}).");
         }
 
-        static MxcProbeResult Unsupported(string reason) =>
-            new(MxcProbeOutcome.UnsupportedHost, null, false, Array.Empty<string>(), reason);
+        static MxcProbeResult Unsupported(string reason, IReadOnlyList<string>? warnings = null) =>
+            new(MxcProbeOutcome.UnsupportedHost, null, false, warnings ?? Array.Empty<string>(), reason);
 
         static MxcProbeResult Error(string reason) =>
             new(MxcProbeOutcome.ProbeError, null, false, Array.Empty<string>(), reason);
+
+        static string? TryGetString(JsonElement root, string propertyName)
+        {
+            if (root.ValueKind != JsonValueKind.Object
+                || !root.TryGetProperty(propertyName, out var property)
+                || property.ValueKind != JsonValueKind.String)
+            {
+                return null;
+            }
+
+            var value = property.GetString();
+            return string.IsNullOrWhiteSpace(value) ? null : value;
+        }
+
+        static List<string> ReadWarnings(JsonElement root)
+        {
+            var warnings = new List<string>();
+            if (root.ValueKind != JsonValueKind.Object
+                || !root.TryGetProperty("warnings", out var w)
+                || w.ValueKind != JsonValueKind.Array)
+            {
+                return warnings;
+            }
+
+            foreach (var item in w.EnumerateArray())
+            {
+                if (item.ValueKind != JsonValueKind.String) continue;
+                var s = item.GetString();
+                if (!string.IsNullOrWhiteSpace(s)) warnings.Add(s);
+            }
+
+            return warnings;
+        }
     }
 
     private static string? FirstNonEmpty(params string?[] values)

src/OpenClaw.Shared/Mxc/MxcCommandRunner.cs

@@ -51,6 +51,12 @@ public async Task<CommandResult> RunAsync(CommandRequest request, CancellationTo
     {
         var settings = _settingsProvider();
 
+        if (!settings.SystemRunSandboxEnabled)
+        {
+            _logger.Info("[mxc] sandbox=disabled; routing system.run through host runner");
+            return await _hostFallback.RunAsync(request, ct);
+        }
+
         // When MXC sandboxing isn't available on this host (e.g. Windows 10, an
         // older build whose wxc-exec --probe reports no usable isolation tier, or
         // missing wxc-exec.exe), fall back to the host runner so the agent can
@@ -66,12 +72,6 @@ public async Task<CommandResult> RunAsync(CommandRequest request, CancellationTo
             return await _hostFallback.RunAsync(request, ct);
         }
 
-        if (!settings.SystemRunSandboxEnabled)
-        {
-            _logger.Info("[mxc] sandbox=disabled; routing system.run through host runner");
-            return await _hostFallback.RunAsync(request, ct);
-        }
-
         var settingsDirectoryPath = _settingsDirectoryPathProvider();
         var policy = MxcPolicyBuilder.ForSystemRun(settings, settingsDirectoryPath);
         var argsJson = SerializeArgs(request);

tests/OpenClaw.Shared.Tests/Mxc/MxcAvailabilityTests.cs

@@ -98,20 +98,36 @@ public void ParseProbeOutput_CapturesWarningsAndDaclFlag()
     }
 
     [Fact]
-    public void ParseProbeOutput_CompletedNonZeroExit_ReportsUnsupportedHost()
+    public void ParseProbeOutput_CompletedNonZeroExit_ReportsProbeError()
     {
         var result = MxcAvailability.ParseProbeOutput(
             WxcProbeStatus.Completed,
             exitCode: 1,
             stdout: "",
-            stderr: "unsupported os");
+            stderr: "unknown option --probe");
+
+        Assert.Equal(MxcProbeOutcome.ProbeError, result.Outcome);
+        Assert.False(result.Supported);
+        Assert.Null(result.Tier);
+        Assert.NotNull(result.FailureReason);
+        Assert.Contains("Could not determine", result.FailureReason!);
+    }
+
+    [Fact]
+    public void ParseProbeOutput_CompletedJsonError_ReportsUnsupportedHost()
+    {
+        var result = MxcAvailability.ParseProbeOutput(
+            WxcProbeStatus.Completed,
+            exitCode: 1,
+            stdout: "{\"error\":\"unsupported Windows build\",\"warnings\":[\"need newer host\"]}",
+            stderr: "");
 
-        // The binary ran to completion and returned a definitive negative — not a probe error.
         Assert.Equal(MxcProbeOutcome.UnsupportedHost, result.Outcome);
         Assert.False(result.Supported);
         Assert.Null(result.Tier);
+        Assert.Equal(["need newer host"], result.Warnings);
         Assert.NotNull(result.FailureReason);
-        Assert.Contains("does not support", result.FailureReason!);
+        Assert.Contains("unsupported Windows build", result.FailureReason!);
     }
 
     [Fact]
@@ -254,13 +270,11 @@ public void Probe_WhenProbeReportsNoTier_ReportsUnavailableWithReason()
                 NullLogger.Instance,
                 _ => new WxcProbeInvocation(WxcProbeStatus.Completed, 1, string.Empty, "unsupported os build"));
 
-            // wxc-exec is present, but the host probe said no → not a setup issue,
-            // and a definitive verdict (exit 1) is NOT a transient probe error.
             Assert.True(availability.IsWxcExecResolvable);
             Assert.False(availability.IsAppContainerAvailable);
             Assert.False(availability.HasAnyBackend);
             Assert.NotEmpty(availability.UnsupportedReasons);
-            Assert.False(availability.ProbeErrored);
+            Assert.True(availability.ProbeErrored);
         }
         finally
         {

tests/OpenClaw.Shared.Tests/Mxc/MxcCommandRunnerTests.cs

@@ -61,12 +61,25 @@ public async Task RunAsync_SandboxDisabled_AlwaysRoutesToHost()
         {
             Result = new CommandResult { ExitCode = 0, Stdout = "host" },
         };
-        var runner = NewRunner(executor, fallback, NewSettings(sandboxEnabled: false));
+        var availabilityChecks = 0;
+        var runner = new MxcCommandRunner(
+            executor,
+            fallback,
+            () => NewSettings(sandboxEnabled: false),
+            () => "C:\\test\\settings",
+            () =>
+            {
+                availabilityChecks++;
+                return true;
+            },
+            invalidateAvailability: null,
+            NullLogger.Instance);
 
         var result = await runner.RunAsync(new CommandRequest { Command = "echo hi" });
 
         Assert.Equal("host", result.Stdout);
         Assert.NotNull(fallback.LastRequest);
+        Assert.Equal(0, availabilityChecks);
         // Executor must not have been touched.
         Assert.Null(executor.LastRequest);
     }
@@ -101,9 +114,8 @@ public async Task RunAsync_MxcUnavailable_FallsBackToHost_WithSandboxToggleOff()
     [Fact]
     public async Task RunAsync_MxcUnavailable_FallsBackToHost_WithSandboxToggleOn()
     {
-        // Same as the toggle-off variant — the !_isSandboxAvailable() short-circuit
-        // fires before either the toggle check or the executor path, and both
-        // routes lead to the host fallback.
+        // With sandboxing enabled, unavailable MXC is detected before the
+        // executor path and routes to the host fallback.
         var executor = new FakeSandboxExecutor { ThrowsUnavailable = true, UnavailableReason = "MXC missing" };
         var fallback = new FakeCommandRunner
         {