@openclaw/openshell-sandbox 2026.6.5-beta.2 → 2026.6.5-beta.3

package/dist/index.js

@@ -245,6 +245,11 @@ async function stageDirectoryContents(params) {
 }
 //#endregion
 //#region extensions/openshell/src/fs-bridge.ts
+const MATERIALIZED_SKILLS_CONTAINER_PARTS = [
+	".openclaw",
+	"sandbox-skills",
+	"skills"
+];
 function createOpenShellFsBridge(params) {
 	return new OpenShellFsBridge(params.sandbox, params.backend);
 }
@@ -392,7 +397,18 @@ var OpenShellFsBridge = class {
 		const hasAgentMount = this.sandbox.workspaceAccess !== "none" && workspaceRoot !== agentRoot;
 		const agentContainerRoot = (this.backend.remoteAgentWorkspaceDir || "/agent").replace(/\\/g, "/");
 		const workspaceContainerRoot = this.sandbox.containerWorkdir.replace(/\\/g, "/");
+		const skillsRoot = this.sandbox.skillsWorkspaceDir ? path.resolve(this.sandbox.skillsWorkspaceDir, "skills") : void 0;
+		const skillsContainerRoot = path.posix.join(workspaceContainerRoot, ...MATERIALIZED_SKILLS_CONTAINER_PARTS);
+		const workspaceSkillsShadowRoot = path.resolve(workspaceRoot, ...MATERIALIZED_SKILLS_CONTAINER_PARTS);
 		const input = params.filePath.trim();
+		if (skillsRoot && this.sandbox.workspaceAccess === "rw") {
+			const protectedSkillTarget = resolveProtectedSkillTarget({
+				input,
+				skillsRoot,
+				skillsContainerRoot
+			});
+			if (protectedSkillTarget) return protectedSkillTarget;
+		}
 		if (input.startsWith(`${workspaceContainerRoot}/`) || input === workspaceContainerRoot) {
 			const relative = path.posix.relative(workspaceContainerRoot, input) || "";
 			return {
@@ -417,6 +433,15 @@ var OpenShellFsBridge = class {
 		}
 		const cwd = params.cwd ? path.resolve(params.cwd) : workspaceRoot;
 		const hostPath = path.isAbsolute(input) ? path.resolve(input) : path.resolve(cwd, input);
+		if (skillsRoot && this.sandbox.workspaceAccess === "rw") {
+			const protectedSkillShadowTarget = resolveProtectedSkillShadowTarget({
+				hostPath,
+				workspaceSkillsShadowRoot,
+				skillsRoot,
+				skillsContainerRoot
+			});
+			if (protectedSkillShadowTarget) return protectedSkillShadowTarget;
+		}
 		if (isPathInside(workspaceRoot, hostPath)) {
 			const relative = path.relative(workspaceRoot, hostPath).split(path.sep).join(path.posix.sep);
 			return {
@@ -428,6 +453,17 @@ var OpenShellFsBridge = class {
 				source: "workspace"
 			};
 		}
+		if (skillsRoot && this.sandbox.workspaceAccess === "rw" && isPathInside(skillsRoot, hostPath)) {
+			const relative = path.relative(skillsRoot, hostPath).split(path.sep).join(path.posix.sep);
+			return {
+				hostPath,
+				relativePath: relative ? path.posix.join(...MATERIALIZED_SKILLS_CONTAINER_PARTS, relative) : path.posix.join(...MATERIALIZED_SKILLS_CONTAINER_PARTS),
+				containerPath: relative ? path.posix.join(skillsContainerRoot, relative) : skillsContainerRoot,
+				mountHostRoot: skillsRoot,
+				writable: false,
+				source: "protectedSkill"
+			};
+		}
 		if (hasAgentMount && isPathInside(agentRoot, hostPath)) {
 			const relative = path.relative(agentRoot, hostPath).split(path.sep).join(path.posix.sep);
 			return {
@@ -442,6 +478,38 @@ var OpenShellFsBridge = class {
 		throw new Error(`Path escapes sandbox root (${workspaceRoot}): ${params.filePath}`);
 	}
 };
+function resolveProtectedSkillTarget(params) {
+	const relativeRoot = path.posix.join(...MATERIALIZED_SKILLS_CONTAINER_PARTS);
+	const normalizedInput = path.posix.normalize(params.input.replace(/\\/g, "/"));
+	const isAbsoluteContainer = normalizedInput === params.skillsContainerRoot || normalizedInput.startsWith(`${params.skillsContainerRoot}/`);
+	const isRelativeContainer = normalizedInput === relativeRoot || normalizedInput.startsWith(`${relativeRoot}/`);
+	if (!isAbsoluteContainer && !isRelativeContainer) return null;
+	const relative = isAbsoluteContainer ? path.posix.relative(params.skillsContainerRoot, normalizedInput) : path.posix.relative(relativeRoot, normalizedInput);
+	const safeRelative = relative === "." ? "" : relative;
+	return {
+		hostPath: safeRelative ? path.resolve(params.skillsRoot, ...safeRelative.split("/")) : params.skillsRoot,
+		relativePath: safeRelative ? path.posix.join(relativeRoot, safeRelative) : relativeRoot,
+		containerPath: safeRelative ? path.posix.join(params.skillsContainerRoot, safeRelative) : params.skillsContainerRoot,
+		mountHostRoot: params.skillsRoot,
+		writable: false,
+		source: "protectedSkill"
+	};
+}
+function resolveProtectedSkillShadowTarget(params) {
+	if (!isPathInside(params.workspaceSkillsShadowRoot, params.hostPath)) return null;
+	const relative = path.relative(params.workspaceSkillsShadowRoot, params.hostPath).split(path.sep).join(path.posix.sep);
+	const safeRelative = relative === "." ? "" : relative;
+	const hostPath = safeRelative ? path.resolve(params.skillsRoot, ...safeRelative.split("/")) : params.skillsRoot;
+	const relativeRoot = path.posix.join(...MATERIALIZED_SKILLS_CONTAINER_PARTS);
+	return {
+		hostPath,
+		relativePath: safeRelative ? path.posix.join(relativeRoot, safeRelative) : relativeRoot,
+		containerPath: safeRelative ? path.posix.join(params.skillsContainerRoot, safeRelative) : params.skillsContainerRoot,
+		mountHostRoot: params.skillsRoot,
+		writable: false,
+		source: "protectedSkill"
+	};
+}
 async function assertLocalPathSafety(params) {
 	if (!params.target.hostPath) throw new Error(`Missing local host path for ${params.target.containerPath}`);
 	if (!isPathInside(await fs.realpath(params.root).catch(() => path.resolve(params.root)), await resolveCanonicalCandidate(params.target.hostPath))) throw new Error(`Sandbox path escapes allowed mounts; cannot access: ${params.target.containerPath}`);
@@ -475,6 +543,47 @@ async function resolveCanonicalCandidate(targetPath) {
 }
 //#endregion
 //#region extensions/openshell/src/backend.ts
+const MATERIALIZED_SKILLS_REMOTE_PARTS = [".openclaw", "sandbox-skills"];
+const ENSURE_REMOTE_REAL_DIRECTORY_SCRIPT = [
+	"set -e",
+	"target=\"$1\"",
+	"root=\"${2:-$1}\"",
+	"case \"$target\" in /*) ;; *) echo \"remote directory must be absolute: $target\" >&2; exit 1 ;; esac",
+	"case \"$root\" in /*) ;; *) echo \"remote root must be absolute: $root\" >&2; exit 1 ;; esac",
+	"target=\"${target%/}\"",
+	"root=\"${root%/}\"",
+	"[ -n \"$target\" ] || target=\"/\"",
+	"[ -n \"$root\" ] || root=\"/\"",
+	"case \"$target/\" in \"$root\"/*|\"$root/\") ;; *) echo \"remote directory must stay under root: $target\" >&2; exit 1 ;; esac",
+	"old_ifs=\"$IFS\"",
+	"IFS=\"/\"",
+	"set -- ${target#/} ${root#/}",
+	"IFS=\"$old_ifs\"",
+	"for part do",
+	"  [ -n \"$part\" ] || continue",
+	"  case \"$part\" in \".\"|\"..\") echo \"unsafe remote directory component: $part\" >&2; exit 1 ;; esac",
+	"done",
+	"if [ -L \"$root\" ]; then echo \"unsafe remote root symlink: $root\" >&2; exit 1; fi",
+	"mkdir -p -- \"$root\"",
+	"canonical_root=\"$(cd \"$root\" && pwd -P)\"",
+	"relative=\"${target#\"$root\"}\"",
+	"relative=\"${relative#/}\"",
+	"current=\"$canonical_root\"",
+	"IFS=\"/\"",
+	"set -- $relative",
+	"IFS=\"$old_ifs\"",
+	"for part do",
+	"  [ -n \"$part\" ] || continue",
+	"  if [ \"$current\" = \"/\" ]; then next=\"/$part\"; else next=\"$current/$part\"; fi",
+	"  if [ -L \"$next\" ]; then echo \"unsafe remote directory symlink: $next\" >&2; exit 1; fi",
+	"  if [ -e \"$next\" ]; then",
+	"    if [ ! -d \"$next\" ]; then echo \"unsafe remote directory component: $next\" >&2; exit 1; fi",
+	"  else",
+	"    mkdir -- \"$next\"",
+	"  fi",
+	"  current=\"$next\"",
+	"done"
+].join("\n");
 function buildOpenShellSshExecEnv() {
 	return sanitizeEnvVars(process.env).allowed;
 }
@@ -629,7 +738,7 @@ var OpenShellSandboxBackendImpl = class {
 		});
 		await this.ensureSandboxExists();
 		if (this.params.execContext.config.mode === "mirror") await this.syncWorkspaceToRemote();
-		else await this.maybeSeedRemoteWorkspace();
+		else if (!await this.maybeSeedRemoteWorkspace()) await this.syncSkillsWorkspaceToRemote();
 		const sshSession = await createOpenShellSshSession({ context: this.params.execContext });
 		return {
 			argv: [
@@ -662,7 +771,7 @@ var OpenShellSandboxBackendImpl = class {
 	}
 	async runRemoteShellScript(params) {
 		await this.ensureSandboxExists();
-		await this.maybeSeedRemoteWorkspace();
+		if (!await this.maybeSeedRemoteWorkspace()) await this.syncSkillsWorkspaceToRemote();
 		return await this.runRemoteShellScriptInternal(params);
 	}
 	async runRemoteShellScriptInternal(params) {
@@ -786,6 +895,18 @@ var OpenShellSandboxBackendImpl = class {
 			});
 			await this.uploadPathToRemote(this.params.createParams.agentWorkspaceDir, this.params.remoteAgentWorkspaceDir);
 		}
+		await this.syncSkillsWorkspaceToRemote();
+	}
+	async syncSkillsWorkspaceToRemote() {
+		if (this.params.createParams.cfg.workspaceAccess !== "rw" || !this.params.createParams.skillsWorkspaceDir) return;
+		const remoteSkillsWorkspaceDir = resolveRemoteMaterializedSkillsWorkspaceDir(this.params.remoteWorkspaceDir);
+		await this.runRemoteShellScriptInternal({
+			script: `${ENSURE_REMOTE_REAL_DIRECTORY_SCRIPT}\nfind "$1" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +`,
+			args: [remoteSkillsWorkspaceDir, this.params.remoteWorkspaceDir]
+		});
+		const stats = await fs.lstat(this.params.createParams.skillsWorkspaceDir).catch(() => null);
+		if (!stats?.isDirectory() || stats.isSymbolicLink()) return;
+		await this.uploadPathToRemote(this.params.createParams.skillsWorkspaceDir, remoteSkillsWorkspaceDir);
 	}
 	async syncWorkspaceFromRemote() {
 		await withTempWorkspace({
@@ -804,11 +925,23 @@ var OpenShellSandboxBackendImpl = class {
 				cwd: this.params.createParams.workspaceDir
 			});
 			if (result.code !== 0) throw new Error(result.stderr.trim() || "openshell sandbox download failed");
-			await replaceDirectoryContents({
-				sourceDir: tmpDir,
-				targetDir: this.params.createParams.workspaceDir,
-				excludeDirs: DEFAULT_OPEN_SHELL_MIRROR_EXCLUDE_DIRS
+			await removeMaterializedSkillsFromDownloadedWorkspace(tmpDir);
+			const preservedSandboxSkills = await moveMaterializedSkillsShadowAside({
+				workspaceDir: this.params.createParams.workspaceDir,
+				tmpDir
 			});
+			try {
+				await replaceDirectoryContents({
+					sourceDir: tmpDir,
+					targetDir: this.params.createParams.workspaceDir,
+					excludeDirs: DEFAULT_OPEN_SHELL_MIRROR_EXCLUDE_DIRS
+				});
+			} finally {
+				await restoreMaterializedSkillsShadow({
+					workspaceDir: this.params.createParams.workspaceDir,
+					preserved: preservedSandboxSkills
+				});
+			}
 		});
 	}
 	async uploadPathToRemote(localPath, remotePath) {
@@ -836,10 +969,11 @@ var OpenShellSandboxBackendImpl = class {
 		});
 	}
 	async maybeSeedRemoteWorkspace() {
-		if (!this.remoteSeedPending) return;
+		if (!this.remoteSeedPending) return false;
 		this.remoteSeedPending = false;
 		try {
 			await this.syncWorkspaceToRemote();
+			return true;
 		} catch (error) {
 			this.remoteSeedPending = true;
 			throw error;
@@ -857,6 +991,79 @@ function buildOpenShellSandboxName(scopeKey) {
 	const hash = Array.from(trimmed).reduce((acc, char) => (acc * 33 ^ char.charCodeAt(0)) >>> 0, 5381);
 	return `openclaw-${safe || "session"}-${hash.toString(16).slice(0, 8)}`;
 }
+function resolveRemoteMaterializedSkillsWorkspaceDir(remoteWorkspaceDir) {
+	const root = remoteWorkspaceDir.replace(/\\/g, "/").replace(/\/+$/, "") || "/";
+	return path.posix.join(root, ...MATERIALIZED_SKILLS_REMOTE_PARTS);
+}
+async function removeMaterializedSkillsFromDownloadedWorkspace(tmpDir) {
+	let cursor = tmpDir;
+	for (const [index, part] of MATERIALIZED_SKILLS_REMOTE_PARTS.entries()) {
+		const next = path.join(cursor, part);
+		const stats = await fs.lstat(next).catch(() => null);
+		if (!stats) return;
+		if (index === MATERIALIZED_SKILLS_REMOTE_PARTS.length - 1) {
+			await fs.rm(next, {
+				recursive: true,
+				force: true
+			});
+			return;
+		}
+		if (stats.isSymbolicLink() || !stats.isDirectory()) {
+			await fs.rm(next, {
+				recursive: true,
+				force: true
+			});
+			return;
+		}
+		cursor = next;
+	}
+}
+async function moveMaterializedSkillsShadowAside(params) {
+	const shadowPath = path.join(params.workspaceDir, ...MATERIALIZED_SKILLS_REMOTE_PARTS);
+	const parentStats = await fs.lstat(path.dirname(shadowPath)).catch(() => null);
+	if (!parentStats?.isDirectory() || parentStats.isSymbolicLink()) return;
+	const shadowStats = await fs.lstat(shadowPath).catch(() => null);
+	if (!shadowStats || shadowStats.isSymbolicLink()) return;
+	const preserveRoot = await fs.mkdtemp(path.join(path.dirname(params.tmpDir), "openclaw-openshell-preserve-"));
+	const preservedPath = path.join(preserveRoot, "sandbox-skills");
+	await movePathWithCopyFallback({
+		from: shadowPath,
+		to: preservedPath
+	});
+	return {
+		preservedPath,
+		preserveRoot
+	};
+}
+async function restoreMaterializedSkillsShadow(params) {
+	if (!params.preserved) return;
+	let restored = false;
+	try {
+		const shadowPath = path.join(params.workspaceDir, ...MATERIALIZED_SKILLS_REMOTE_PARTS);
+		const parentPath = path.dirname(shadowPath);
+		const parentStats = await fs.lstat(parentPath).catch(() => null);
+		if (parentStats?.isSymbolicLink()) throw new Error(`Refusing to restore sandbox skills through symlink parent: ${parentPath}`);
+		if (parentStats && !parentStats.isDirectory()) await fs.rm(parentPath, {
+			recursive: true,
+			force: true
+		});
+		await fs.mkdir(parentPath, { recursive: true });
+		await fs.rm(shadowPath, {
+			recursive: true,
+			force: true
+		});
+		await movePathWithCopyFallback({
+			from: params.preserved.preservedPath,
+			to: shadowPath
+		});
+		restored = true;
+	} finally {
+		if (restored) await fs.rm(params.preserved.preserveRoot, {
+			recursive: true,
+			force: true
+		});
+	}
+}
 function resolveOpenShellTmpRoot() {
 	return path.resolve(resolvePreferredOpenClawTmpDir());
 }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/openshell-sandbox",
-  "version": "2026.6.5-beta.2",
+  "version": "2026.6.5-beta.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/openshell-sandbox",
-      "version": "2026.6.5-beta.2",
+      "version": "2026.6.5-beta.3",
       "dependencies": {
         "zod": "4.4.3"
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/openshell-sandbox",
-  "version": "2026.6.5-beta.2",
+  "version": "2026.6.5-beta.3",
   "description": "OpenClaw sandbox backend for the NVIDIA OpenShell CLI with mirrored local workspaces and SSH command execution.",
   "repository": {
     "type": "git",
@@ -20,10 +20,10 @@
       "minHostVersion": ">=2026.5.12-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.6.5-beta.2"
+      "pluginApi": ">=2026.6.5-beta.3"
     },
     "build": {
-      "openclawVersion": "2026.6.5-beta.2",
+      "openclawVersion": "2026.6.5-beta.3",
       "bundledDist": false
     },
     "release": {
@@ -41,7 +41,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.6.5-beta.2"
+    "openclaw": ">=2026.6.5-beta.3"
   },
   "peerDependenciesMeta": {
     "openclaw": {