@openclaw/openshell-sandbox 2026.6.11-beta.2 → 2026.7.1-beta.1

package/dist/index.js

@@ -1,5 +1,5 @@
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
-import { buildValidatedExecRemoteCommand, createRemoteShellSandboxFsBridge, createSshSandboxSessionFromConfigText, createWritableRenameTargetResolver, disposeSshSandboxSession, registerSandboxBackend, resolvePreferredOpenClawTmpDir, runPluginCommandWithTimeout, runSshSandboxCommand, sanitizeEnvVars, shellEscape, withTempWorkspace } from "openclaw/plugin-sdk/sandbox";
+import { buildRemoteWorkdirValidationCommand, buildValidatedExecRemoteCommand, createRemoteShellSandboxFsBridge, createSshSandboxSessionFromConfigText, createWritableRenameTargetResolver, disposeSshSandboxSession, registerSandboxBackend, resolvePreferredOpenClawTmpDir, runPluginCommandWithTimeout, runSshSandboxCommand, sanitizeEnvVars, shellEscape, withTempWorkspace } from "openclaw/plugin-sdk/sandbox";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coerce-runtime";
@@ -8,7 +8,7 @@ import { formatPluginConfigIssue, mapPluginConfigIssues } from "openclaw/plugin-
 import { MAX_TIMER_TIMEOUT_SECONDS } from "openclaw/plugin-sdk/number-runtime";
 import { z } from "zod";
 import { root } from "openclaw/plugin-sdk/file-access-runtime";
-import { isPathInside, movePathWithCopyFallback } from "openclaw/plugin-sdk/security-runtime";
+import { FsSafeError, isPathInside, movePathWithCopyFallback } from "openclaw/plugin-sdk/security-runtime";
 //#region extensions/openshell/src/cli.ts
 function resolveOpenShellCommand(command) {
 	return command;
@@ -153,97 +153,6 @@ function resolveOpenShellPluginConfig(value) {
 	};
 }
 //#endregion
-//#region extensions/openshell/src/mirror.ts
-const DEFAULT_OPEN_SHELL_MIRROR_EXCLUDE_DIRS = [
-	"hooks",
-	"git-hooks",
-	".git"
-];
-const COPY_TREE_FS_CONCURRENCY = 16;
-function createExcludeMatcher(excludeDirs) {
-	const excluded = new Set((excludeDirs ?? []).map((d) => normalizeLowercaseStringOrEmpty(d)));
-	return (name) => excluded.has(normalizeLowercaseStringOrEmpty(name));
-}
-function createConcurrencyLimiter(limit) {
-	let active = 0;
-	const queue = [];
-	const release = () => {
-		active -= 1;
-		queue.shift()?.();
-	};
-	return async (task) => {
-		if (active >= limit) await new Promise((resolve) => {
-			queue.push(resolve);
-		});
-		active += 1;
-		try {
-			return await task();
-		} finally {
-			release();
-		}
-	};
-}
-const runLimitedFs = createConcurrencyLimiter(COPY_TREE_FS_CONCURRENCY);
-async function lstatIfExists(targetPath) {
-	return await runLimitedFs(async () => await fs.lstat(targetPath)).catch(() => null);
-}
-async function copyTreeWithoutSymlinks(params) {
-	const stats = await runLimitedFs(async () => await fs.lstat(params.sourcePath));
-	if (stats.isSymbolicLink()) return;
-	const targetStats = await lstatIfExists(params.targetPath);
-	if (params.preserveTargetSymlinks && targetStats?.isSymbolicLink()) return;
-	if (stats.isDirectory()) {
-		await runLimitedFs(async () => await fs.mkdir(params.targetPath, { recursive: true }));
-		const entries = await runLimitedFs(async () => await fs.readdir(params.sourcePath));
-		await Promise.all(entries.map(async (entry) => {
-			await copyTreeWithoutSymlinks({
-				sourcePath: path.join(params.sourcePath, entry),
-				targetPath: path.join(params.targetPath, entry),
-				preserveTargetSymlinks: params.preserveTargetSymlinks
-			});
-		}));
-		return;
-	}
-	if (stats.isFile()) {
-		await runLimitedFs(async () => await fs.mkdir(path.dirname(params.targetPath), { recursive: true }));
-		await runLimitedFs(async () => await fs.copyFile(params.sourcePath, params.targetPath));
-	}
-}
-async function replaceDirectoryContents(params) {
-	const isExcluded = createExcludeMatcher(params.excludeDirs);
-	await fs.mkdir(params.targetDir, { recursive: true });
-	const existing = await fs.readdir(params.targetDir);
-	await Promise.all(existing.filter((entry) => !isExcluded(entry)).map(async (entry) => {
-		const targetPath = path.join(params.targetDir, entry);
-		if ((await lstatIfExists(targetPath))?.isSymbolicLink()) return;
-		await runLimitedFs(async () => await fs.rm(targetPath, {
-			recursive: true,
-			force: true
-		}));
-	}));
-	const sourceEntries = await fs.readdir(params.sourceDir);
-	for (const entry of sourceEntries) {
-		if (isExcluded(entry)) continue;
-		await copyTreeWithoutSymlinks({
-			sourcePath: path.join(params.sourceDir, entry),
-			targetPath: path.join(params.targetDir, entry),
-			preserveTargetSymlinks: true
-		});
-	}
-}
-async function stageDirectoryContents(params) {
-	const isExcluded = createExcludeMatcher(params.excludeDirs);
-	await fs.mkdir(params.targetDir, { recursive: true });
-	const sourceEntries = await fs.readdir(params.sourceDir);
-	for (const entry of sourceEntries) {
-		if (isExcluded(entry)) continue;
-		await copyTreeWithoutSymlinks({
-			sourcePath: path.join(params.sourceDir, entry),
-			targetPath: path.join(params.targetDir, entry)
-		});
-	}
-}
-//#endregion
 //#region extensions/openshell/src/fs-bridge.ts
 const MATERIALIZED_SKILLS_CONTAINER_PARTS = [
 	".openclaw",
@@ -313,7 +222,10 @@ var OpenShellFsBridge = class {
 			allowFinalSymlinkForUnlink: false
 		});
 		await this.backend.mkdirpRemotePath(target.containerPath, params.signal);
-		await fs.mkdir(hostPath, { recursive: true });
+		await mkdirLocalRootPath({
+			hostPath,
+			target
+		});
 	}
 	async remove(params) {
 		const target = this.resolveTarget(params);
@@ -330,9 +242,11 @@ var OpenShellFsBridge = class {
 			signal: params.signal,
 			ignoreMissing: params.force !== false
 		});
-		await fs.rm(hostPath, {
-			recursive: params.recursive ?? false,
-			force: params.force !== false
+		await removeLocalRootPath({
+			force: params.force,
+			hostPath,
+			recursive: params.recursive,
+			target
 		});
 	}
 	async rename(params) {
@@ -351,11 +265,19 @@ var OpenShellFsBridge = class {
 			allowMissingLeaf: true,
 			allowFinalSymlinkForUnlink: false
 		});
+		await assertRenameSourceSupported(fromHostPath);
+		if (from.mountHostRoot !== to.mountHostRoot) throw new Error("OpenShell cross-root mirror renames require pinned fs-safe support");
+		await assertSameDeviceRenameSupported({
+			fromHostPath,
+			root: from.mountHostRoot,
+			toHostPath
+		});
 		await this.backend.renameRemotePath(from.containerPath, to.containerPath, params.signal);
-		await fs.mkdir(path.dirname(toHostPath), { recursive: true });
-		await movePathWithCopyFallback({
-			from: fromHostPath,
-			to: toHostPath
+		await moveLocalRootPath({
+			from,
+			fromHostPath,
+			to,
+			toHostPath
 		});
 	}
 	async stat(params) {
@@ -469,6 +391,92 @@ var OpenShellFsBridge = class {
 		throw new Error(`Path escapes sandbox root (${workspaceRoot}): ${params.filePath}`);
 	}
 };
+async function mkdirLocalRootPath(params) {
+	const relativePath = relativeToRoot(params.target, params.hostPath);
+	if (!relativePath) return;
+	await (await root(params.target.mountHostRoot)).mkdir(relativePath);
+}
+async function removeLocalRootPath(params) {
+	const root$1 = await root(params.target.mountHostRoot);
+	const relativePath = relativeToRoot(params.target, params.hostPath);
+	try {
+		if (params.force === false) await fs.lstat(params.hostPath);
+		if (params.recursive) {
+			if ((await fs.lstat(params.hostPath).catch((err) => {
+				if (isNotFoundError(err)) return null;
+				throw err;
+			}))?.isSymbolicLink()) {
+				await root$1.remove(relativePath);
+				return;
+			}
+			await removeRootTree(root$1, relativePath);
+			return;
+		}
+		await root$1.remove(relativePath);
+	} catch (err) {
+		if (params.force !== false && isNotFoundError(err)) return;
+		throw err;
+	}
+}
+async function removeRootTree(root, relativePath, knownStats) {
+	const stats = knownStats ?? await root.stat(relativePath);
+	if (stats.isDirectory && !stats.isSymbolicLink) {
+		const entries = await root.list(relativePath, { withFileTypes: true });
+		for (const entry of entries) await removeRootTree(root, path.join(relativePath, entry.name), entry);
+		if (!relativePath) return;
+	}
+	await root.remove(relativePath);
+}
+async function moveLocalRootPath(params) {
+	const root$2 = await root(params.from.mountHostRoot);
+	const fromRelativePath = relativeToRoot(params.from, params.fromHostPath);
+	const toRelativePath = relativeToRoot(params.to, params.toHostPath);
+	await mkdirParentPath(root$2, toRelativePath);
+	await root$2.move(fromRelativePath, toRelativePath, { overwrite: true });
+}
+async function mkdirParentPath(root, relativePath) {
+	const parentPath = path.dirname(relativePath);
+	if (parentPath === "." || parentPath === "") return;
+	await root.mkdir(parentPath);
+}
+function relativeToRoot(target, hostPath) {
+	const relativePath = path.relative(target.mountHostRoot, hostPath);
+	return relativePath === "." ? "" : relativePath;
+}
+async function assertRenameSourceSupported(fromHostPath) {
+	const stats = await fs.lstat(fromHostPath);
+	if (stats.isSymbolicLink()) throw new Error("Sandbox symlink rename sources are not supported by the local mirror bridge");
+	if (stats.isFile() && stats.nlink > 1) throw new Error("Sandbox hardlinked rename sources are not supported by the local mirror bridge");
+}
+async function assertSameDeviceRenameSupported(params) {
+	const sourceStats = await fs.lstat(params.fromHostPath);
+	const destinationParentStats = await nearestExistingDirectoryStats({
+		root: params.root,
+		targetPath: path.dirname(params.toHostPath)
+	});
+	if (sourceStats.dev !== destinationParentStats.dev) throw new Error("OpenShell cross-device mirror renames require pinned fs-safe support");
+}
+async function nearestExistingDirectoryStats(params) {
+	const rootPath = path.resolve(params.root);
+	let cursor = path.resolve(params.targetPath);
+	while (isPathInside(rootPath, cursor)) {
+		const stats = await fs.lstat(cursor).catch((err) => {
+			if (isNotFoundError(err)) return null;
+			throw err;
+		});
+		if (stats) {
+			if (!stats.isDirectory()) throw new Error(`Sandbox rename destination parent is not a directory: ${cursor}`);
+			return stats;
+		}
+		const next = path.dirname(cursor);
+		if (next === cursor) break;
+		cursor = next;
+	}
+	return await fs.lstat(rootPath);
+}
+function isNotFoundError(err) {
+	return err instanceof FsSafeError && err.code === "not-found" || typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
 function resolveProtectedSkillTarget(params) {
 	const relativeRoot = path.posix.join(...MATERIALIZED_SKILLS_CONTAINER_PARTS);
 	const normalizedInput = path.posix.normalize(params.input.replace(/\\/g, "/"));
@@ -503,7 +511,9 @@ function resolveProtectedSkillShadowTarget(params) {
 }
 async function assertLocalPathSafety(params) {
 	if (!params.target.hostPath) throw new Error(`Missing local host path for ${params.target.containerPath}`);
-	if (!isPathInside(await fs.realpath(params.root).catch(() => path.resolve(params.root)), await resolveCanonicalCandidate(params.target.hostPath))) throw new Error(`Sandbox path escapes allowed mounts; cannot access: ${params.target.containerPath}`);
+	const canonicalRoot = await fs.realpath(params.root).catch(() => path.resolve(params.root));
+	const targetStats = await fs.lstat(params.target.hostPath).catch(() => null);
+	if (!isPathInside(canonicalRoot, params.allowFinalSymlinkForUnlink && targetStats?.isSymbolicLink() ? path.resolve(canonicalRoot, path.relative(params.root, params.target.hostPath)) : await resolveCanonicalCandidate(params.target.hostPath))) throw new Error(`Sandbox path escapes allowed mounts; cannot access: ${params.target.containerPath}`);
 	const relative = path.relative(params.root, params.target.hostPath);
 	const segments = relative.split(path.sep).filter(Boolean).slice(0, Math.max(0, relative.split(path.sep).filter(Boolean).length));
 	let cursor = params.root;
@@ -533,8 +543,109 @@ async function resolveCanonicalCandidate(targetPath) {
 	}
 }
 //#endregion
+//#region extensions/openshell/src/mirror.ts
+const DEFAULT_OPEN_SHELL_MIRROR_EXCLUDE_DIRS = [
+	"hooks",
+	"git-hooks",
+	".git"
+];
+const COPY_TREE_FS_CONCURRENCY = 16;
+function createExcludeMatcher(excludeDirs) {
+	const excluded = new Set((excludeDirs ?? []).map((d) => normalizeLowercaseStringOrEmpty(d)));
+	return (name) => excluded.has(normalizeLowercaseStringOrEmpty(name));
+}
+function createConcurrencyLimiter(limit) {
+	let active = 0;
+	const queue = [];
+	const release = () => {
+		active -= 1;
+		queue.shift()?.();
+	};
+	return async (task) => {
+		if (active >= limit) await new Promise((resolve) => {
+			queue.push(resolve);
+		});
+		active += 1;
+		try {
+			return await task();
+		} finally {
+			release();
+		}
+	};
+}
+const runLimitedFs = createConcurrencyLimiter(COPY_TREE_FS_CONCURRENCY);
+async function lstatIfExists(targetPath) {
+	return await runLimitedFs(async () => await fs.lstat(targetPath)).catch(() => null);
+}
+async function copyTreeWithoutSymlinks(params) {
+	const stats = await runLimitedFs(async () => await fs.lstat(params.sourcePath));
+	if (stats.isSymbolicLink()) return;
+	const targetStats = await lstatIfExists(params.targetPath);
+	if (params.preserveTargetSymlinks && targetStats?.isSymbolicLink()) return;
+	if (stats.isDirectory()) {
+		await runLimitedFs(async () => await fs.mkdir(params.targetPath, { recursive: true }));
+		const entries = await runLimitedFs(async () => await fs.readdir(params.sourcePath));
+		await Promise.all(entries.map(async (entry) => {
+			await copyTreeWithoutSymlinks({
+				sourcePath: path.join(params.sourcePath, entry),
+				targetPath: path.join(params.targetPath, entry),
+				preserveTargetSymlinks: params.preserveTargetSymlinks
+			});
+		}));
+		return;
+	}
+	if (stats.isFile()) {
+		await runLimitedFs(async () => await fs.mkdir(path.dirname(params.targetPath), { recursive: true }));
+		await runLimitedFs(async () => await fs.copyFile(params.sourcePath, params.targetPath));
+	}
+}
+async function replaceDirectoryContents(params) {
+	const isExcluded = createExcludeMatcher(params.excludeDirs);
+	await fs.mkdir(params.targetDir, { recursive: true });
+	const existing = await fs.readdir(params.targetDir);
+	await Promise.all(existing.filter((entry) => !isExcluded(entry)).map(async (entry) => {
+		const targetPath = path.join(params.targetDir, entry);
+		if ((await lstatIfExists(targetPath))?.isSymbolicLink()) return;
+		await runLimitedFs(async () => await fs.rm(targetPath, {
+			recursive: true,
+			force: true
+		}));
+	}));
+	const sourceEntries = await fs.readdir(params.sourceDir);
+	for (const entry of sourceEntries) {
+		if (isExcluded(entry)) continue;
+		await copyTreeWithoutSymlinks({
+			sourcePath: path.join(params.sourceDir, entry),
+			targetPath: path.join(params.targetDir, entry),
+			preserveTargetSymlinks: true
+		});
+	}
+}
+async function stageDirectoryContents(params) {
+	const isExcluded = createExcludeMatcher(params.excludeDirs);
+	await fs.mkdir(params.targetDir, { recursive: true });
+	const sourceEntries = await fs.readdir(params.sourceDir);
+	for (const entry of sourceEntries) {
+		if (isExcluded(entry)) continue;
+		await copyTreeWithoutSymlinks({
+			sourcePath: path.join(params.sourceDir, entry),
+			targetPath: path.join(params.targetDir, entry)
+		});
+	}
+}
+//#endregion
 //#region extensions/openshell/src/backend.ts
 const MATERIALIZED_SKILLS_REMOTE_PARTS = [".openclaw", "sandbox-skills"];
+function buildOpenShellDirectoryUploadArgs(params) {
+	return [
+		"sandbox",
+		"upload",
+		"--no-git-ignore",
+		params.sandboxName,
+		params.localPath,
+		normalizeRemotePath(params.remotePath)
+	];
+}
 const PINNED_REMOTE_PATH_MUTATION_SCRIPT = [
 	"set -eu",
 	"die() { echo \"$1\" >&2; exit 1; }",
@@ -744,6 +855,10 @@ async function createOpenShellSandboxBackend(params) {
 		mode: params.pluginConfig.mode,
 		configLabel: params.pluginConfig.from,
 		configLabelKind: "Source",
+		workdirValidation: "backend",
+		validateWorkdir: async (workdir) => await impl.validateWorkdir(workdir),
+		discardPreparedWorkdir: (workdir) => impl.discardPreparedWorkdir(workdir),
+		workdirRoots: [params.pluginConfig.remoteWorkspaceDir, params.pluginConfig.remoteAgentWorkspaceDir],
 		buildExecSpec: async ({ command, workdir, env, usePty }) => {
 			const pending = await impl.prepareExec({
 				command,
@@ -782,6 +897,7 @@ var OpenShellSandboxBackendImpl = class {
 	constructor(params) {
 		this.params = params;
 		this.ensurePromise = null;
+		this.preparedRemoteWorkspaceForNextExec = null;
 		this.remoteSeedPending = false;
 	}
 	asHandle() {
@@ -794,6 +910,10 @@ var OpenShellSandboxBackendImpl = class {
 			mode: this.params.execContext.config.mode,
 			configLabel: this.params.execContext.config.from,
 			configLabelKind: "Source",
+			workdirValidation: "backend",
+			validateWorkdir: async (workdir) => await this.validateWorkdir(workdir),
+			discardPreparedWorkdir: (workdir) => this.discardPreparedWorkdir(workdir),
+			workdirRoots: [this.params.remoteWorkspaceDir, this.params.remoteAgentWorkspaceDir],
 			remoteWorkspaceDir: this.params.remoteWorkspaceDir,
 			remoteAgentWorkspaceDir: this.params.remoteAgentWorkspaceDir,
 			buildExecSpec: async ({ command, workdir, env, usePty }) => {
@@ -829,14 +949,14 @@ var OpenShellSandboxBackendImpl = class {
 		};
 	}
 	async prepareExec(params) {
+		const remoteWorkdir = params.workdir ?? this.params.remoteWorkspaceDir;
+		const preparedWorkspace = this.consumePreparedRemoteWorkspaceForNextExec(remoteWorkdir);
 		const remoteCommand = buildValidatedExecRemoteCommand({
 			command: params.command,
-			workdir: params.workdir ?? this.params.remoteWorkspaceDir,
+			workdir: remoteWorkdir,
 			env: params.env
 		});
-		await this.ensureSandboxExists();
-		if (this.params.execContext.config.mode === "mirror") await this.syncWorkspaceToRemote();
-		else if (!await this.maybeSeedRemoteWorkspace()) await this.syncSkillsWorkspaceToRemote();
+		await (preparedWorkspace ?? this.prepareRemoteWorkspaceForExec());
 		const sshSession = await createOpenShellSshSession({ context: this.params.execContext });
 		return {
 			argv: [
@@ -860,6 +980,67 @@ var OpenShellSandboxBackendImpl = class {
 			token: { sshSession }
 		};
 	}
+	async validateWorkdir(workdir) {
+		const preparedWorkspace = this.prepareRemoteWorkspaceForExec();
+		const reusablePreparation = {
+			workdir,
+			promise: preparedWorkspace
+		};
+		this.preparedRemoteWorkspaceForNextExec = reusablePreparation;
+		try {
+			await preparedWorkspace;
+			const sshSession = await createOpenShellSshSession({ context: this.params.execContext });
+			try {
+				const result = await runSshSandboxCommand({
+					session: sshSession,
+					remoteCommand: buildRemoteWorkdirValidationCommand({
+						workdir,
+						root: this.resolveWorkdirValidationRoot(workdir)
+					}),
+					allowFailure: true
+				});
+				const resolvedWorkdir = result.code === 0 ? result.stdout.toString("utf8").trim() : "";
+				if (this.preparedRemoteWorkspaceForNextExec === reusablePreparation) this.preparedRemoteWorkspaceForNextExec = resolvedWorkdir ? {
+					workdir: resolvedWorkdir,
+					promise: preparedWorkspace
+				} : null;
+				return resolvedWorkdir || null;
+			} finally {
+				await disposeSshSandboxSession(sshSession);
+			}
+		} catch (error) {
+			if (this.preparedRemoteWorkspaceForNextExec === reusablePreparation) this.preparedRemoteWorkspaceForNextExec = null;
+			throw error;
+		}
+	}
+	resolveWorkdirValidationRoot(workdir) {
+		try {
+			const normalized = normalizeRemotePath(workdir);
+			return [normalizeRemotePath(this.params.remoteAgentWorkspaceDir), normalizeRemotePath(this.params.remoteWorkspaceDir)].toSorted((a, b) => b.length - a.length).find((root) => isRemotePathInside(root, normalized)) ?? this.params.remoteWorkspaceDir;
+		} catch {
+			return this.params.remoteWorkspaceDir;
+		}
+	}
+	consumePreparedRemoteWorkspaceForNextExec(workdir) {
+		const preparedWorkspace = this.preparedRemoteWorkspaceForNextExec;
+		if (!preparedWorkspace || preparedWorkspace.workdir !== workdir) {
+			this.preparedRemoteWorkspaceForNextExec = null;
+			return null;
+		}
+		this.preparedRemoteWorkspaceForNextExec = null;
+		return preparedWorkspace.promise;
+	}
+	discardPreparedWorkdir(workdir) {
+		if (this.preparedRemoteWorkspaceForNextExec?.workdir === workdir) this.preparedRemoteWorkspaceForNextExec = null;
+	}
+	async prepareRemoteWorkspaceForExec() {
+		await this.ensureSandboxExists();
+		if (this.params.execContext.config.mode === "mirror") {
+			await this.syncWorkspaceToRemote();
+			return;
+		}
+		if (!await this.maybeSeedRemoteWorkspace()) await this.syncSkillsWorkspaceToRemote();
+	}
 	async finalizeExec(token) {
 		try {
 			if (this.params.execContext.config.mode === "mirror") await this.syncWorkspaceFromRemote();
@@ -1109,23 +1290,25 @@ var OpenShellSandboxBackendImpl = class {
 			rootDir: resolveOpenShellTmpRoot(),
 			prefix: "openclaw-openshell-upload-"
 		}, async ({ dir: tmpDir }) => {
+			const remoteRootName = path.posix.basename(normalizeRemotePath(remotePath));
+			const stagedRoot = path.join(tmpDir, remoteRootName);
 			await stageDirectoryContents({
 				sourceDir: localPath,
-				targetDir: tmpDir
+				targetDir: stagedRoot
 			});
-			const result = await runOpenShellCli({
-				context: this.params.execContext,
-				args: [
-					"sandbox",
-					"upload",
-					"--no-git-ignore",
-					this.params.execContext.sandboxName,
-					tmpDir,
-					remotePath
-				],
-				cwd: this.params.createParams.workspaceDir
-			});
-			if (result.code !== 0) throw new Error(result.stderr.trim() || "openshell sandbox upload failed");
+			const stagedEntries = (await fs.readdir(stagedRoot)).toSorted();
+			for (const entry of stagedEntries) {
+				const result = await runOpenShellCli({
+					context: this.params.execContext,
+					args: buildOpenShellDirectoryUploadArgs({
+						sandboxName: this.params.execContext.sandboxName,
+						localPath: path.join(stagedRoot, entry),
+						remotePath
+					}),
+					cwd: this.params.createParams.workspaceDir
+				});
+				if (result.code !== 0) throw new Error(result.stderr.trim() || "openshell sandbox upload failed");
+			}
 		});
 	}
 	async maybeSeedRemoteWorkspace() {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/openshell-sandbox",
-  "version": "2026.6.11-beta.2",
+  "version": "2026.7.1-beta.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/openshell-sandbox",
-      "version": "2026.6.11-beta.2",
+      "version": "2026.7.1-beta.1",
       "dependencies": {
         "zod": "4.4.3"
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/openshell-sandbox",
-  "version": "2026.6.11-beta.2",
+  "version": "2026.7.1-beta.1",
   "description": "OpenClaw sandbox backend for the NVIDIA OpenShell CLI with mirrored local workspaces and SSH command execution.",
   "repository": {
     "type": "git",
@@ -20,10 +20,10 @@
       "minHostVersion": ">=2026.5.12-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.6.11-beta.2"
+      "pluginApi": ">=2026.7.1-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.6.11-beta.2",
+      "openclawVersion": "2026.7.1-beta.1",
       "bundledDist": false
     },
     "release": {
@@ -41,7 +41,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.6.11-beta.2"
+    "openclaw": ">=2026.7.1-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {