@openclaw/openshell-sandbox 2026.6.8 → 2026.6.9-beta.1

package/dist/index.js

@@ -312,12 +312,8 @@ var OpenShellFsBridge = class {
 			allowMissingLeaf: true,
 			allowFinalSymlinkForUnlink: false
 		});
+		await this.backend.mkdirpRemotePath(target.containerPath, params.signal);
 		await fs.mkdir(hostPath, { recursive: true });
-		await this.backend.runRemoteShellScript({
-			script: "mkdir -p -- \"$1\"",
-			args: [target.containerPath],
-			signal: params.signal
-		});
 	}
 	async remove(params) {
 		const target = this.resolveTarget(params);
@@ -329,16 +325,15 @@ var OpenShellFsBridge = class {
 			allowMissingLeaf: params.force !== false,
 			allowFinalSymlinkForUnlink: true
 		});
+		await this.backend.removeRemotePath(target.containerPath, {
+			recursive: params.recursive ?? false,
+			signal: params.signal,
+			ignoreMissing: params.force !== false
+		});
 		await fs.rm(hostPath, {
 			recursive: params.recursive ?? false,
 			force: params.force !== false
 		});
-		await this.backend.runRemoteShellScript({
-			script: params.recursive ? "rm -rf -- \"$1\"" : "if [ -d \"$1\" ] && [ ! -L \"$1\" ]; then rmdir -- \"$1\"; elif [ -e \"$1\" ] || [ -L \"$1\" ]; then rm -f -- \"$1\"; fi",
-			args: [target.containerPath],
-			signal: params.signal,
-			allowFailure: params.force !== false
-		});
 	}
 	async rename(params) {
 		const { from, to } = this.resolveRenameTargets(params);
@@ -356,16 +351,12 @@ var OpenShellFsBridge = class {
 			allowMissingLeaf: true,
 			allowFinalSymlinkForUnlink: false
 		});
+		await this.backend.renameRemotePath(from.containerPath, to.containerPath, params.signal);
 		await fs.mkdir(path.dirname(toHostPath), { recursive: true });
 		await movePathWithCopyFallback({
 			from: fromHostPath,
 			to: toHostPath
 		});
-		await this.backend.runRemoteShellScript({
-			script: "mkdir -p -- \"$(dirname -- \"$2\")\" && mv -- \"$1\" \"$2\"",
-			args: [from.containerPath, to.containerPath],
-			signal: params.signal
-		});
 	}
 	async stat(params) {
 		const target = this.resolveTarget(params);
@@ -544,7 +535,108 @@ async function resolveCanonicalCandidate(targetPath) {
 //#endregion
 //#region extensions/openshell/src/backend.ts
 const MATERIALIZED_SKILLS_REMOTE_PARTS = [".openclaw", "sandbox-skills"];
-const ENSURE_REMOTE_REAL_DIRECTORY_SCRIPT = [
+const PINNED_REMOTE_PATH_MUTATION_SCRIPT = [
+	"set -eu",
+	"die() { echo \"$1\" >&2; exit 1; }",
+	"validate_basename() {",
+	"  case \"$1\" in \"\"|\".\"|\"..\"|*/*) die \"unsafe remote basename: $1\" ;; esac",
+	"}",
+	"pin_dir() {",
+	"  root=\"$1\"",
+	"  relative=\"$2\"",
+	"  create=\"$3\"",
+	"  case \"$root\" in /*) ;; *) die \"remote root must be absolute: $root\" ;; esac",
+	"  root=\"${root%/}\"",
+	"  [ -n \"$root\" ] || root=\"/\"",
+	"  if [ -L \"$root\" ]; then die \"unsafe remote root symlink: $root\"; fi",
+	"  mkdir -p -- \"$root\"",
+	"  canonical_root=\"$(cd \"$root\" && pwd -P)\"",
+	"  current=\"$canonical_root\"",
+	"  relative=\"${relative#/}\"",
+	"  while [ -n \"$relative\" ]; do",
+	"    part=\"${relative%%/*}\"",
+	"    if [ \"$part\" = \"$relative\" ]; then relative=\"\"; else relative=\"${relative#*/}\"; fi",
+	"    [ -n \"$part\" ] || continue",
+	"    case \"$part\" in \".\"|\"..\") die \"unsafe remote directory component: $part\" ;; esac",
+	"    if [ \"$current\" = \"/\" ]; then next=\"/$part\"; else next=\"$current/$part\"; fi",
+	"    if [ -L \"$next\" ]; then die \"unsafe remote directory symlink: $next\"; fi",
+	"    if [ -e \"$next\" ]; then",
+	"      if [ ! -d \"$next\" ]; then die \"unsafe remote directory component: $next\"; fi",
+	"    else",
+	"      if [ \"$create\" != \"1\" ]; then die \"remote directory not found: $next\"; fi",
+	"      mkdir -- \"$next\"",
+	"    fi",
+	"    current=\"$next\"",
+	"  done",
+	"  printf \"%s\\n\" \"$current\"",
+	"}",
+	"pin_dir_or_missing() {",
+	"  root=\"$1\"",
+	"  relative=\"$2\"",
+	"  missing_ok=\"$3\"",
+	"  case \"$root\" in /*) ;; *) die \"remote root must be absolute: $root\" ;; esac",
+	"  root=\"${root%/}\"",
+	"  [ -n \"$root\" ] || root=\"/\"",
+	"  if [ -L \"$root\" ]; then die \"unsafe remote root symlink: $root\"; fi",
+	"  if [ ! -d \"$root\" ]; then",
+	"    if [ -e \"$root\" ]; then die \"unsafe remote root component: $root\"; fi",
+	"    if [ \"$missing_ok\" = \"1\" ]; then printf \"\\n\"; return 0; fi",
+	"    die \"remote directory not found: $root\"",
+	"  fi",
+	"  canonical_root=\"$(cd \"$root\" && pwd -P)\"",
+	"  current=\"$canonical_root\"",
+	"  relative=\"${relative#/}\"",
+	"  while [ -n \"$relative\" ]; do",
+	"    part=\"${relative%%/*}\"",
+	"    if [ \"$part\" = \"$relative\" ]; then relative=\"\"; else relative=\"${relative#*/}\"; fi",
+	"    [ -n \"$part\" ] || continue",
+	"    case \"$part\" in \".\"|\"..\") die \"unsafe remote directory component: $part\" ;; esac",
+	"    if [ \"$current\" = \"/\" ]; then next=\"/$part\"; else next=\"$current/$part\"; fi",
+	"    if [ -L \"$next\" ]; then die \"unsafe remote directory symlink: $next\"; fi",
+	"    if [ -e \"$next\" ]; then",
+	"      if [ ! -d \"$next\" ]; then die \"unsafe remote directory component: $next\"; fi",
+	"    else",
+	"      if [ \"$missing_ok\" = \"1\" ]; then printf \"\\n\"; return 0; fi",
+	"      die \"remote directory not found: $next\"",
+	"    fi",
+	"    current=\"$next\"",
+	"  done",
+	"  printf \"%s\\n\" \"$current\"",
+	"}",
+	"operation=\"$1\"",
+	"case \"$operation\" in",
+	"  mkdirp)",
+	"    pin_dir \"$2\" \"$3\" 1 >/dev/null",
+	"    ;;",
+	"  remove)",
+	"    validate_basename \"$4\"",
+	"    parent=\"$(pin_dir_or_missing \"$2\" \"$3\" \"${5:-0}\")\"",
+	"    [ -n \"$parent\" ] || exit 0",
+	"    target=\"$parent/$4\"",
+	"    if [ -d \"$target\" ] && [ ! -L \"$target\" ]; then rm -rf -- \"$target\"; elif [ -e \"$target\" ] || [ -L \"$target\" ]; then rm -f -- \"$target\"; fi",
+	"    ;;",
+	"  removefile)",
+	"    validate_basename \"$4\"",
+	"    parent=\"$(pin_dir_or_missing \"$2\" \"$3\" \"${5:-0}\")\"",
+	"    [ -n \"$parent\" ] || exit 0",
+	"    target=\"$parent/$4\"",
+	"    if [ -d \"$target\" ] && [ ! -L \"$target\" ]; then rmdir -- \"$target\"; elif [ -e \"$target\" ] || [ -L \"$target\" ]; then rm -f -- \"$target\"; fi",
+	"    ;;",
+	"  rename)",
+	"    src_parent=\"$(pin_dir \"$2\" \"$3\" 0)\"",
+	"    validate_basename \"$4\"",
+	"    dst_parent=\"$(pin_dir \"$5\" \"$6\" 1)\"",
+	"    validate_basename \"$7\"",
+	"    if [ -L \"$dst_parent/$7\" ]; then die \"unsafe remote rename target symlink: $dst_parent/$7\"; fi",
+	"    if [ -d \"$dst_parent/$7\" ]; then die \"unsafe remote rename target directory: $dst_parent/$7\"; fi",
+	"    mv -- \"$src_parent/$4\" \"$dst_parent/$7\"",
+	"    ;;",
+	"  *)",
+	"    die \"unknown remote path mutation: $operation\"",
+	"    ;;",
+	"esac"
+].join("\n");
+const ENSURE_OPEN_SHELL_REMOTE_REAL_DIRECTORY_SCRIPT = [
 	"set -e",
 	"target=\"$1\"",
 	"root=\"${2:-$1}\"",
@@ -555,13 +647,14 @@ const ENSURE_REMOTE_REAL_DIRECTORY_SCRIPT = [
 	"[ -n \"$target\" ] || target=\"/\"",
 	"[ -n \"$root\" ] || root=\"/\"",
 	"case \"$target/\" in \"$root\"/*|\"$root/\") ;; *) echo \"remote directory must stay under root: $target\" >&2; exit 1 ;; esac",
-	"old_ifs=\"$IFS\"",
-	"IFS=\"/\"",
-	"set -- ${target#/} ${root#/}",
-	"IFS=\"$old_ifs\"",
-	"for part do",
-	"  [ -n \"$part\" ] || continue",
-	"  case \"$part\" in \".\"|\"..\") echo \"unsafe remote directory component: $part\" >&2; exit 1 ;; esac",
+	"for path_to_check in \"$target\" \"$root\"; do",
+	"  relative=\"${path_to_check#/}\"",
+	"  while [ -n \"$relative\" ]; do",
+	"    part=\"${relative%%/*}\"",
+	"    if [ \"$part\" = \"$relative\" ]; then relative=\"\"; else relative=\"${relative#*/}\"; fi",
+	"    [ -n \"$part\" ] || continue",
+	"    case \"$part\" in \".\"|\"..\") echo \"unsafe remote directory component: $part\" >&2; exit 1 ;; esac",
+	"  done",
 	"done",
 	"if [ -L \"$root\" ]; then echo \"unsafe remote root symlink: $root\" >&2; exit 1; fi",
 	"mkdir -p -- \"$root\"",
@@ -569,10 +662,9 @@ const ENSURE_REMOTE_REAL_DIRECTORY_SCRIPT = [
 	"relative=\"${target#\"$root\"}\"",
 	"relative=\"${relative#/}\"",
 	"current=\"$canonical_root\"",
-	"IFS=\"/\"",
-	"set -- $relative",
-	"IFS=\"$old_ifs\"",
-	"for part do",
+	"while [ -n \"$relative\" ]; do",
+	"  part=\"${relative%%/*}\"",
+	"  if [ \"$part\" = \"$relative\" ]; then relative=\"\"; else relative=\"${relative#*/}\"; fi",
 	"  [ -n \"$part\" ] || continue",
 	"  if [ \"$current\" = \"/\" ]; then next=\"/$part\"; else next=\"$current/$part\"; fi",
 	"  if [ -L \"$next\" ]; then echo \"unsafe remote directory symlink: $next\" >&2; exit 1; fi",
@@ -680,6 +772,9 @@ async function createOpenShellSandboxBackend(params) {
 		remoteWorkspaceDir: params.pluginConfig.remoteWorkspaceDir,
 		remoteAgentWorkspaceDir: params.pluginConfig.remoteAgentWorkspaceDir,
 		runRemoteShellScript: async (command) => await impl.runRemoteShellScript(command),
+		mkdirpRemotePath: async (remotePath, signal) => await impl.mkdirpRemotePath(remotePath, signal),
+		removeRemotePath: async (remotePath, removeParams) => await impl.removeRemotePath(remotePath, removeParams),
+		renameRemotePath: async (fromRemotePath, toRemotePath, signal) => await impl.renameRemotePath(fromRemotePath, toRemotePath, signal),
 		syncLocalPathToRemote: async (localPath, remotePath) => await impl.syncLocalPathToRemote(localPath, remotePath)
 	};
 }
@@ -727,6 +822,9 @@ var OpenShellSandboxBackendImpl = class {
 				backend: this.asHandle()
 			}),
 			runRemoteShellScript: async (command) => await this.runRemoteShellScript(command),
+			mkdirpRemotePath: async (remotePath, signal) => await this.mkdirpRemotePath(remotePath, signal),
+			removeRemotePath: async (remotePath, removeParams) => await this.removeRemotePath(remotePath, removeParams),
+			renameRemotePath: async (fromRemotePath, toRemotePath, signal) => await this.renameRemotePath(fromRemotePath, toRemotePath, signal),
 			syncLocalPathToRemote: async (localPath, remotePath) => await this.syncLocalPathToRemote(localPath, remotePath)
 		};
 	}
@@ -774,6 +872,46 @@ var OpenShellSandboxBackendImpl = class {
 		if (!await this.maybeSeedRemoteWorkspace()) await this.syncSkillsWorkspaceToRemote();
 		return await this.runRemoteShellScriptInternal(params);
 	}
+	async mkdirpRemotePath(remotePath, signal) {
+		const target = this.resolveRemoteTarget(remotePath);
+		await this.runPinnedRemotePathMutation({
+			args: [
+				"mkdirp",
+				target.root,
+				target.relativePath
+			],
+			signal
+		});
+	}
+	async removeRemotePath(remotePath, params) {
+		const target = this.resolveRemoteTarget(remotePath);
+		await this.runPinnedRemotePathMutation({
+			args: [
+				params?.recursive ? "remove" : "removefile",
+				target.root,
+				path.posix.dirname(target.relativePath) === "." ? "" : path.posix.dirname(target.relativePath),
+				path.posix.basename(target.relativePath),
+				params?.ignoreMissing ? "1" : "0"
+			],
+			signal: params?.signal
+		});
+	}
+	async renameRemotePath(fromRemotePath, toRemotePath, signal) {
+		const from = this.resolveRemoteTarget(fromRemotePath);
+		const to = this.resolveRemoteTarget(toRemotePath);
+		await this.runPinnedRemotePathMutation({
+			args: [
+				"rename",
+				from.root,
+				path.posix.dirname(from.relativePath) === "." ? "" : path.posix.dirname(from.relativePath),
+				path.posix.basename(from.relativePath),
+				to.root,
+				path.posix.dirname(to.relativePath) === "." ? "" : path.posix.dirname(to.relativePath),
+				path.posix.basename(to.relativePath)
+			],
+			signal
+		});
+	}
 	async runRemoteShellScriptInternal(params) {
 		const session = await createOpenShellSshSession({ context: this.params.execContext });
 		try {
@@ -797,34 +935,37 @@ var OpenShellSandboxBackendImpl = class {
 	async syncLocalPathToRemote(localPath, remotePath) {
 		await this.ensureSandboxExists();
 		await this.maybeSeedRemoteWorkspace();
+		const target = this.resolveRemoteTarget(remotePath);
 		const stats = await fs.lstat(localPath).catch(() => null);
 		if (!stats) {
-			await this.runRemoteShellScript({
-				script: "rm -rf -- \"$1\"",
-				args: [remotePath],
-				allowFailure: true
-			});
+			await this.runPinnedRemotePathMutation({ args: [
+				"remove",
+				target.root,
+				path.posix.dirname(target.relativePath) === "." ? "" : path.posix.dirname(target.relativePath),
+				path.posix.basename(target.relativePath),
+				"1"
+			] });
 			return;
 		}
 		if (stats.isSymbolicLink()) {
-			await this.runRemoteShellScript({
-				script: "rm -rf -- \"$1\"",
-				args: [remotePath],
-				allowFailure: true
-			});
+			await this.runPinnedRemotePathMutation({ args: [
+				"remove",
+				target.root,
+				path.posix.dirname(target.relativePath) === "." ? "" : path.posix.dirname(target.relativePath),
+				path.posix.basename(target.relativePath),
+				"1"
+			] });
 			return;
 		}
 		if (stats.isDirectory()) {
-			await this.runRemoteShellScript({
-				script: "mkdir -p -- \"$1\"",
-				args: [remotePath]
-			});
+			await this.mkdirpRemotePath(remotePath);
 			return;
 		}
-		await this.runRemoteShellScript({
-			script: "mkdir -p -- \"$(dirname -- \"$1\")\"",
-			args: [remotePath]
-		});
+		await this.runPinnedRemotePathMutation({ args: [
+			"mkdirp",
+			target.root,
+			path.posix.dirname(target.relativePath) === "." ? "" : path.posix.dirname(target.relativePath)
+		] });
 		const result = await runOpenShellCli({
 			context: this.params.execContext,
 			args: [
@@ -839,6 +980,25 @@ var OpenShellSandboxBackendImpl = class {
 		});
 		if (result.code !== 0) throw new Error(result.stderr.trim() || "openshell sandbox upload failed");
 	}
+	async runPinnedRemotePathMutation(params) {
+		return await this.runRemoteShellScript({
+			script: PINNED_REMOTE_PATH_MUTATION_SCRIPT,
+			args: params.args,
+			signal: params.signal
+		});
+	}
+	resolveRemoteTarget(remotePath) {
+		const normalized = normalizeRemotePath(remotePath);
+		const roots = [normalizeRemotePath(this.params.remoteWorkspaceDir), normalizeRemotePath(this.params.remoteAgentWorkspaceDir)].toSorted((a, b) => b.length - a.length);
+		for (const root of roots) if (isRemotePathInside(root, normalized)) {
+			const relativePath = path.posix.relative(root, normalized);
+			return {
+				root,
+				relativePath: relativePath === "." ? "" : relativePath
+			};
+		}
+		throw new Error(`Remote path escapes OpenShell managed roots: ${remotePath}`);
+	}
 	async ensureSandboxExists() {
 		if (this.ensurePromise) return await this.ensurePromise;
 		this.ensurePromise = this.ensureSandboxExistsInner();
@@ -901,7 +1061,7 @@ var OpenShellSandboxBackendImpl = class {
 		if (this.params.createParams.cfg.workspaceAccess !== "rw" || !this.params.createParams.skillsWorkspaceDir) return;
 		const remoteSkillsWorkspaceDir = resolveRemoteMaterializedSkillsWorkspaceDir(this.params.remoteWorkspaceDir);
 		await this.runRemoteShellScriptInternal({
-			script: `${ENSURE_REMOTE_REAL_DIRECTORY_SCRIPT}\nfind "$1" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +`,
+			script: `${ENSURE_OPEN_SHELL_REMOTE_REAL_DIRECTORY_SCRIPT}\nfind "$1" -mindepth 1 -maxdepth 1 -exec rm -rf -- {} +`,
 			args: [remoteSkillsWorkspaceDir, this.params.remoteWorkspaceDir]
 		});
 		const stats = await fs.lstat(this.params.createParams.skillsWorkspaceDir).catch(() => null);
@@ -1067,6 +1227,15 @@ async function restoreMaterializedSkillsShadow(params) {
 function resolveOpenShellTmpRoot() {
 	return path.resolve(resolvePreferredOpenClawTmpDir());
 }
+function normalizeRemotePath(remotePath) {
+	const normalized = path.posix.normalize(remotePath.replace(/\\/g, "/"));
+	if (!path.posix.isAbsolute(normalized)) throw new Error(`OpenShell remote path must be absolute: ${remotePath}`);
+	return normalized;
+}
+function isRemotePathInside(root, candidate) {
+	const relative = path.posix.relative(root, candidate);
+	return relative === "" || relative !== ".." && !relative.startsWith("../") && !path.posix.isAbsolute(relative);
+}
 //#endregion
 //#region extensions/openshell/index.ts
 var openshell_default = definePluginEntry({

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/openshell-sandbox",
-  "version": "2026.6.8",
+  "version": "2026.6.9-beta.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/openshell-sandbox",
-      "version": "2026.6.8",
+      "version": "2026.6.9-beta.1",
       "dependencies": {
         "zod": "4.4.3"
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/openshell-sandbox",
-  "version": "2026.6.8",
+  "version": "2026.6.9-beta.1",
   "description": "OpenClaw sandbox backend for the NVIDIA OpenShell CLI with mirrored local workspaces and SSH command execution.",
   "repository": {
     "type": "git",
@@ -20,10 +20,10 @@
       "minHostVersion": ">=2026.5.12-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.6.8"
+      "pluginApi": ">=2026.6.9-beta.1"
     },
     "build": {
-      "openclawVersion": "2026.6.8",
+      "openclawVersion": "2026.6.9-beta.1",
       "bundledDist": false
     },
     "release": {
@@ -41,7 +41,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.6.8"
+    "openclaw": ">=2026.6.9-beta.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {