{"record":{"id":"1180dd52ad3de6f7","repo":"zeroclaw-labs/zeroclaw","slug":"wasm-runtime-does-not-support-shell-commands-use","errorCode":null,"errorMessage":"WASM runtime does not support shell commands. Use `execute_module()` to run WASM tools, or switch to runtime.kind = \"native\" for shell access.","messagePattern":"WASM runtime does not support shell commands\\. Use `execute_module\\(\\)` to run WASM tools, or switch to runtime\\.kind = \"native\" for shell access\\.","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-runtime/src/platform/wasm.rs","lineNumber":295,"sourceCode":"    fn supports_long_running(&self) -> bool {\n        // WASM modules are short-lived invocations, not daemons\n        false\n    }\n\n    fn memory_budget(&self) -> u64 {\n        self.config.memory_limit_mb.saturating_mul(1024 * 1024)\n    }\n\n    fn shell_dialect(&self) -> ShellDialect {\n        ShellDialect::None\n    }\n\n    fn build_shell_command(\n        &self,\n        _command: &str,\n        _workspace_dir: &Path,\n    ) -> anyhow::Result<tokio::process::Command> {\n        bail!(\n            \"WASM runtime does not support shell commands. \\\n             Use `execute_module()` to run WASM tools, or switch to runtime.kind = \\\"native\\\" for shell access.\"\n        )\n    }\n}\n\n// ── Tests ───────────────────────────────────────────────────────\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n\n    fn default_config() -> WasmRuntimeConfig {\n        WasmRuntimeConfig::default()\n    }\n\n    // ── Basic trait compliance ──────────────────────────────────\n","sourceCodeStart":277,"sourceCodeEnd":313,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-runtime/src/platform/wasm.rs#L277-L313","documentation":"WasmPlatform implements the platform trait's build_shell_command by immediately bailing. The WASM sandbox is deliberately shell-less — tools must be compiled .wasm modules executed via execute_module, so no tokio process Command can be constructed. The message points callers to the two supported alternatives: execute_module for wasm tools, or runtime.kind = \"native\" when shell access is genuinely required.","triggerScenarios":"Any code path that builds a shell command (tool executors that `sh -c` skill instructions, legacy bash-tool call sites) while the configured platform is the WASM one; skills or plugins assuming a native host; runtime kind switched to wasm without auditing shell-dependent features.","commonSituations":"Hardening a deployment into the wasm sandbox without refactoring bash-based tools; shared skill packs written against the native runtime; new contributors testing skills on a wasm-configured instance.","solutions":["Port the tool to a wasm module and invoke it with execute_module()","If shell access is a hard requirement, switch config to runtime.kind = \"native\" for that deployment","Guard shell-dependent code paths: branch on the platform/runtime kind before ever calling build_shell_command","Audit skills/plugins for shell usage before enabling the wasm runtime"],"exampleFix":"// before\nlet cmd = platform.build_shell_command(\"ls -la\", &ws)?;\n\n// after\nmatch platform_kind {\n    RuntimeKind::Native => platform.build_shell_command(\"ls -la\", &ws)?,\n    RuntimeKind::Wasm => { platform.execute_module(\"lister\", &ws, &caps)?; /* ... */ }\n}","handlingStrategy":"validation","validationCode":"match platform.runtime_kind() {\n    RuntimeKind::Native => { let cmd = platform.build_shell_command(cmd_str, &ws)?; }\n    RuntimeKind::Wasm => { /* route to execute_module with a compiled tool instead */ }\n}","typeGuard":null,"tryCatchPattern":"Err(e) if e.to_string().contains(\"does not support shell commands\") => {\n    // architectural limit of the sandbox: port the tool to wasm or switch runtime.kind; never bypass\n}","preventionTips":["Branch on runtime kind before constructing shell commands, not after","Audit skills/plugins for shell usage before enabling the wasm runtime","Compile shell-replacing wasm tools ahead of switching a deployment to wasm"],"tags":["rust","zeroclaw","wasm","sandbox","shell","unsupported-operation"],"backgroundTag":"unsupported-operation","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}