@openclaw/openshell-sandbox 2026.10.5 → 2026.10.6

package/dist/index.js

@@ -8,6 +8,7 @@ import { movePathWithCopyFallback } from "@openclaw/fs-safe/atomic";
 import { GUEST_FILESYSTEM_PYTHON } from "@openclaw/fs-safe/guest";
 import { createDeferred, formatPluginConfigIssue, mapPluginConfigIssues } from "openclaw/plugin-sdk/extension-shared";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
+import { lstatIfExists } from "openclaw/plugin-sdk/path-existence-runtime";
 import { FsSafeError, canonicalPathFromExistingAncestor, extractErrorCode } from "openclaw/plugin-sdk/security-runtime";
 import { asOptionalRecord, normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { safeParseJson } from "openclaw/plugin-sdk/text-utility-runtime";
@@ -269,7 +270,7 @@ var OpenShellFsBridge = class {
 	async stat(params) {
 		const target = this.resolveTarget(params);
 		const hostPath = target.hostPath;
-		const stats = await fsPromises.lstat(hostPath).catch(() => null);
+		const stats = await lstatIfExists(hostPath, "ENOENT");
 		if (!stats) return null;
 		await assertLocalPathSafety({
 			target,
@@ -463,14 +464,14 @@ function createExcludeMatcher(excludeDirs) {
 	return (name) => excluded.has(normalizeLowercaseStringOrEmpty(name));
 }
 const runLimitedFs = pLimit(COPY_TREE_FS_CONCURRENCY);
-async function lstatIfExists(targetPath) {
+async function lstatIfExists$1(targetPath) {
 	return await runLimitedFs(fsPromises.lstat, targetPath).catch((error) => {
 		if (extractErrorCode(error) === "ENOENT") return null;
 		throw error;
 	});
 }
 async function reconcileMirrorPath(params) {
-	const targetStats = await lstatIfExists(params.targetPath);
+	const targetStats = await lstatIfExists$1(params.targetPath);
 	if (targetStats && !targetStats.isDirectory() && !targetStats.isFile()) return true;
 	const sourceStats = params.sourcePath ? await runLimitedFs(fsPromises.lstat, params.sourcePath) : null;
 	const sourceDir = sourceStats?.isDirectory() ? params.sourcePath : void 0;
@@ -807,11 +808,15 @@ var OpenShellSandboxBackendImpl = class {
 		await this.ensureSandboxExists();
 		const sshSession = await createOpenShellSshSession({ context: this.params.execContext });
 		try {
+			let root = this.params.remoteWorkspaceDir;
+			try {
+				root = this.resolveRemoteTarget(workdir).root;
+			} catch {}
 			const result = await runSshSandboxCommand({
 				session: sshSession,
 				remoteCommand: buildRemoteWorkdirValidationCommand({
 					workdir,
-					root: this.resolveWorkdirValidationRoot(workdir)
+					root
 				}),
 				allowFailure: true
 			});
@@ -820,13 +825,6 @@ var OpenShellSandboxBackendImpl = class {
 			await disposeSshSandboxSession(sshSession);
 		}
 	}
-	resolveWorkdirValidationRoot(workdir) {
-		try {
-			return this.resolveRemoteTarget(workdir).root;
-		} catch {
-			return this.params.remoteWorkspaceDir;
-		}
-	}
 	async validateMirrorWorkdir(workdir) {
 		const normalized = normalizeRemotePath(workdir);
 		const roots = this.workspaceUploadRoots();
@@ -851,7 +849,7 @@ var OpenShellSandboxBackendImpl = class {
 			let local = root.local;
 			for (const part of root.local === skillsWorkspaceDir ? ["", ...parts] : parts) {
 				local = path.join(local, part);
-				if (!(await fsPromises.lstat(local).catch(() => null))?.isDirectory()) return null;
+				if (!(await lstatIfExists(local, "ENOENT"))?.isDirectory()) return null;
 			}
 			return normalized;
 		}
@@ -941,7 +939,7 @@ var OpenShellSandboxBackendImpl = class {
 		await this.ensureSandboxExists();
 		await this.maybeSeedRemoteWorkspace();
 		const target = this.resolveRemoteTarget(remotePath);
-		const stats = await fsPromises.lstat(localPath).catch(() => null);
+		const stats = await lstatIfExists(localPath, "ENOENT");
 		if (!stats || stats.isSymbolicLink()) {
 			await this.removeRemotePath(remotePath, {
 				recursive: true,
@@ -1160,11 +1158,11 @@ var OpenShellSandboxBackendImpl = class {
 	async syncSkillsWorkspaceToRemote() {
 		if (this.params.createParams.cfg.workspaceAccess !== "rw" || !this.params.createParams.skillsWorkspaceDir) return;
 		const remoteSkillsWorkspaceDir = resolveRemoteMaterializedSkillsWorkspaceDir(this.params.remoteWorkspaceDir);
+		const stats = await lstatIfExists(this.params.createParams.skillsWorkspaceDir, "ENOENT");
 		await this.runRemoteShellScriptInternal({
 			script: `${ENSURE_OPEN_SHELL_REMOTE_REAL_DIRECTORY_SCRIPT}\nfind "$1" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +`,
 			args: [remoteSkillsWorkspaceDir, this.params.remoteWorkspaceDir]
 		});
-		const stats = await fsPromises.lstat(this.params.createParams.skillsWorkspaceDir).catch(() => null);
 		if (!stats?.isDirectory() || stats.isSymbolicLink()) return;
 		await this.uploadPathToRemote(this.params.createParams.skillsWorkspaceDir, remoteSkillsWorkspaceDir);
 	}
@@ -1332,7 +1330,7 @@ async function removeDownloadedWorkspacePath(tmpDir, parts) {
 	let cursor = tmpDir;
 	for (const [index, part] of parts.entries()) {
 		const next = path.join(cursor, part);
-		const stats = await fsPromises.lstat(next).catch(() => null);
+		const stats = await lstatIfExists(next, "ENOENT");
 		if (!stats) return;
 		if (index === parts.length - 1 || stats.isSymbolicLink() || !stats.isDirectory()) {
 			await fsPromises.rm(next, {
@@ -1346,9 +1344,9 @@ async function removeDownloadedWorkspacePath(tmpDir, parts) {
 }
 async function moveLocalShadowAside(params) {
 	const shadowPath = path.join(params.workspaceDir, ...params.relativeParts);
-	const parentStats = await fsPromises.lstat(path.dirname(shadowPath)).catch(() => null);
+	const parentStats = await lstatIfExists(path.dirname(shadowPath), "ENOENT");
 	if (!parentStats?.isDirectory() || parentStats.isSymbolicLink()) return;
-	const shadowStats = await fsPromises.lstat(shadowPath).catch(() => null);
+	const shadowStats = await lstatIfExists(shadowPath, "ENOENT");
 	if (!shadowStats || shadowStats.isSymbolicLink()) return;
 	const preserveRoot = await fsPromises.mkdtemp(path.join(path.dirname(params.tmpDir), "openclaw-openshell-preserve-"));
 	let preserved;
@@ -1374,7 +1372,7 @@ async function restoreLocalShadow(preserved) {
 	const { shadowPath, receipt } = preserved;
 	const assertBackup = () => assertPreservedShadowIdentity(receipt);
 	const parentPath = path.dirname(shadowPath);
-	const parentStats = await fsPromises.lstat(parentPath).catch(() => null);
+	const parentStats = await lstatIfExists(parentPath, "ENOENT");
 	if (parentStats?.isSymbolicLink()) throw new Error(`Refusing to restore workspace shadow through symlink parent: ${parentPath}`);
 	if (parentStats && !parentStats.isDirectory()) {
 		assertBackup();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/openshell-sandbox",
-  "version": "2026.10.5",
+  "version": "2026.10.6",
   "description": "OpenClaw sandbox backend for the NVIDIA OpenShell CLI with mirrored local workspaces and SSH command execution.",
   "repository": {
     "type": "git",
@@ -23,10 +23,10 @@
       "minHostVersion": ">=2026.5.12-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.10.5"
+      "pluginApi": ">=2026.10.6"
     },
     "build": {
-      "openclawVersion": "2026.10.5",
+      "openclawVersion": "2026.10.6",
       "bundledDist": false
     },
     "release": {
@@ -45,7 +45,7 @@
     "assets/activity.svg"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.10.5"
+    "openclaw": ">=2026.10.6"
   },
   "peerDependenciesMeta": {
     "openclaw": {