@openclaw/openshell-sandbox 2026.8.2 → 2026.9.1

package/dist/index.js

@@ -1,5 +1,5 @@
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
-import { buildRemoteCommand, buildRemoteWorkdirValidationCommand, buildValidatedExecRemoteCommand, createRemoteShellSandboxFsBridge, createSshSandboxSessionFromConfigText, createWritableRenameTargetResolver, disposeSshSandboxSession, prepareSshSandboxExec, registerSandboxBackend, resolvePreferredOpenClawTmpDir, runPluginCommandWithTimeout, runSshSandboxCommand, sanitizeEnvVars, shellEscape, withTempWorkspace } from "openclaw/plugin-sdk/sandbox";
+import { buildRemoteCommand, buildRemoteWorkdirValidationCommand, buildValidatedExecRemoteCommand, createRemoteShellSandboxFsBridge, createSshSandboxSessionFromConfigText, createWritableRenameTargetResolver, disposeSshSandboxSession, prepareSshSandboxExec, registerSandboxBackend, resolvePreferredOpenClawTmpDir, resolveReadOnlyWorkspaceSkillMounts, runPluginCommandWithTimeout, runSshSandboxCommand, sanitizeEnvVars, shellEscape, withTempWorkspace } from "openclaw/plugin-sdk/sandbox";
 import { createHash } from "node:crypto";
 import fsPromises from "node:fs/promises";
 import path from "node:path";
@@ -175,11 +175,6 @@ function resolveOpenShellWorkspaceRoot(roots, candidate) {
 }
 //#endregion
 //#region extensions/openshell/src/fs-bridge.ts
-const MATERIALIZED_SKILLS_CONTAINER_PARTS = [
-	".openclaw",
-	"sandbox-skills",
-	"skills"
-];
 function createOpenShellFsBridge(params) {
 	return new OpenShellFsBridge(params.sandbox, params.backend);
 }
@@ -187,7 +182,7 @@ var OpenShellFsBridge = class {
 	constructor(sandbox, backend) {
 		this.sandbox = sandbox;
 		this.backend = backend;
-		this.resolveRenameTargets = createWritableRenameTargetResolver((target) => this.resolveTarget(target), (target, action) => this.ensureWritable(target, action));
+		this.resolveRenameTargets = createWritableRenameTargetResolver((target) => this.resolveTarget(target), (target, action) => this.ensureWritable(target, action, true));
 	}
 	resolvePath(params) {
 		const target = this.resolveTarget(params);
@@ -277,7 +272,7 @@ var OpenShellFsBridge = class {
 	async remove(params) {
 		const target = this.resolveTarget(params);
 		const hostPath = this.requireHostPath(target);
-		this.ensureWritable(target, "remove files");
+		this.ensureWritable(target, "remove files", params.recursive);
 		await assertLocalPathSafety({
 			target,
 			root: target.mountHostRoot,
@@ -344,8 +339,16 @@ var OpenShellFsBridge = class {
 			mtimeMs: stats.mtimeMs
 		};
 	}
-	ensureWritable(target, action) {
-		if (this.sandbox.workspaceAccess !== "rw" || !target.writable) throw new Error(`Sandbox path is read-only; cannot ${action}: ${target.containerPath}`);
+	ensureWritable(target, action, includeDescendants = false) {
+		if (this.sandbox.workspaceAccess === "ro" || !target.writable || includeDescendants && this.readOnlyMounts().some((mount) => isOpenShellRemotePathInside(target.containerPath, mount.containerPath))) throw new Error(`Sandbox path is read-only; cannot ${action}: ${target.containerPath}`);
+	}
+	readOnlyMounts() {
+		const workdirs = [this.sandbox.containerWorkdir];
+		if (this.sandbox.workspaceAccess !== "none" && path.resolve(this.sandbox.workspaceDir) !== path.resolve(this.sandbox.agentWorkspaceDir)) workdirs.push(this.backend.remoteAgentWorkspaceDir || "/agent");
+		return [...workdirs.flatMap((workdir) => resolveReadOnlyWorkspaceSkillMounts({
+			...this.sandbox,
+			workdir
+		})), ...this.sandbox.readOnlyResourceMounts ?? []];
 	}
 	requireHostPath(target) {
 		if (!target.hostPath) throw new Error(`OpenShell mirror bridge requires a local host path: ${target.containerPath}`);
@@ -357,24 +360,14 @@ var OpenShellFsBridge = class {
 		const hasAgentMount = this.sandbox.workspaceAccess !== "none" && workspaceRoot !== agentRoot;
 		const agentContainerRoot = (this.backend.remoteAgentWorkspaceDir || "/agent").replace(/\\/g, "/");
 		const workspaceContainerRoot = this.sandbox.containerWorkdir.replace(/\\/g, "/");
-		const skillsRoot = this.sandbox.skillsWorkspaceDir ? path.resolve(this.sandbox.skillsWorkspaceDir, "skills") : void 0;
-		const skillsContainerRoot = path.posix.join(workspaceContainerRoot, ...MATERIALIZED_SKILLS_CONTAINER_PARTS);
-		const workspaceSkillsShadowRoot = path.resolve(workspaceRoot, ...MATERIALIZED_SKILLS_CONTAINER_PARTS);
 		const input = params.filePath.trim();
-		if (skillsRoot && this.sandbox.workspaceAccess === "rw") {
-			const protectedSkillTarget = resolveProtectedSkillTarget({
-				input,
-				skillsRoot,
-				skillsContainerRoot
-			});
-			if (protectedSkillTarget) return protectedSkillTarget;
-		}
+		const readOnlyMounts = this.readOnlyMounts();
 		const containerMounts = [{
 			remote: workspaceContainerRoot,
 			owner: "workspace",
 			value: {
 				hostRoot: workspaceRoot,
-				writable: this.sandbox.workspaceAccess === "rw"
+				writable: this.sandbox.workspaceAccess !== "ro"
 			}
 		}, ...hasAgentMount ? [{
 			remote: agentContainerRoot,
@@ -384,6 +377,14 @@ var OpenShellFsBridge = class {
 				writable: this.sandbox.workspaceAccess === "rw"
 			}
 		}] : []];
+		containerMounts.unshift(...readOnlyMounts.map((mount) => ({
+			remote: mount.containerPath,
+			owner: resolveOpenShellWorkspaceRoot(containerMounts, mount.containerPath)?.owner ?? "workspace",
+			value: {
+				hostRoot: path.resolve(mount.hostPath),
+				writable: false
+			}
+		})));
 		const resolveContainerTarget = (containerPath) => {
 			const containerMount = resolveOpenShellWorkspaceRoot(containerMounts, containerPath);
 			if (!containerMount) return;
@@ -392,11 +393,10 @@ var OpenShellFsBridge = class {
 			if (!isPathInside(containerMount.value.hostRoot, hostPath)) throw new Error(`Sandbox path escapes allowed mounts; cannot access: ${input}`);
 			return {
 				hostPath,
-				relativePath: containerMount.owner === "agent" ? relative ? containerMount.remote + "/" + relative : containerMount.remote : relative,
+				relativePath: containerMount.owner === "agent" ? relative ? containerMount.remote + "/" + relative : containerMount.remote : path.posix.relative(workspaceContainerRoot, containerPath),
 				containerPath: relative ? path.posix.join(containerMount.remote, relative) : containerMount.remote,
 				mountHostRoot: containerMount.value.hostRoot,
-				writable: containerMount.value.writable,
-				source: containerMount.owner
+				writable: containerMount.value.writable
 			};
 		};
 		const containerCwd = params.cwd?.replace(/\\/g, "/");
@@ -409,30 +409,14 @@ var OpenShellFsBridge = class {
 		}
 		const cwd = params.cwd ? path.resolve(params.cwd) : workspaceRoot;
 		const hostPath = path.isAbsolute(input) ? path.resolve(input) : path.resolve(cwd, input);
-		if (skillsRoot && this.sandbox.workspaceAccess === "rw") {
-			const protectedSkillShadowTarget = resolveProtectedSkillShadowTarget({
-				hostPath,
-				workspaceSkillsShadowRoot,
-				skillsRoot,
-				skillsContainerRoot
-			});
-			if (protectedSkillShadowTarget) return protectedSkillShadowTarget;
+		for (const mount of readOnlyMounts) if (isPathInside(mount.hostPath, hostPath)) {
+			const relative = path.relative(mount.hostPath, hostPath).split(path.sep).join(path.posix.sep);
+			return expectResolvedContainerTarget(resolveContainerTarget(path.posix.join(mount.containerPath, relative)), input);
 		}
 		if (isPathInside(workspaceRoot, hostPath)) {
 			const relative = path.relative(workspaceRoot, hostPath).split(path.sep).join(path.posix.sep);
 			return expectResolvedContainerTarget(resolveContainerTarget(path.posix.join(workspaceContainerRoot, relative)), input);
 		}
-		if (skillsRoot && this.sandbox.workspaceAccess === "rw" && isPathInside(skillsRoot, hostPath)) {
-			const relative = path.relative(skillsRoot, hostPath).split(path.sep).join(path.posix.sep);
-			return {
-				hostPath,
-				relativePath: relative ? path.posix.join(...MATERIALIZED_SKILLS_CONTAINER_PARTS, relative) : path.posix.join(...MATERIALIZED_SKILLS_CONTAINER_PARTS),
-				containerPath: relative ? path.posix.join(skillsContainerRoot, relative) : skillsContainerRoot,
-				mountHostRoot: skillsRoot,
-				writable: false,
-				source: "protectedSkill"
-			};
-		}
 		if (hasAgentMount && isPathInside(agentRoot, hostPath)) {
 			const relative = path.relative(agentRoot, hostPath).split(path.sep).join(path.posix.sep);
 			return expectResolvedContainerTarget(resolveContainerTarget(path.posix.join(agentContainerRoot, relative)), input);
@@ -530,38 +514,6 @@ async function nearestExistingDirectoryStats(params) {
 function isNotFoundError(err) {
 	return err instanceof FsSafeError && err.code === "not-found" || typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
 }
-function resolveProtectedSkillTarget(params) {
-	const relativeRoot = path.posix.join(...MATERIALIZED_SKILLS_CONTAINER_PARTS);
-	const normalizedInput = path.posix.normalize(params.input.replace(/\\/g, "/"));
-	const isAbsoluteContainer = normalizedInput === params.skillsContainerRoot || normalizedInput.startsWith(`${params.skillsContainerRoot}/`);
-	const isRelativeContainer = normalizedInput === relativeRoot || normalizedInput.startsWith(`${relativeRoot}/`);
-	if (!isAbsoluteContainer && !isRelativeContainer) return null;
-	const relative = isAbsoluteContainer ? path.posix.relative(params.skillsContainerRoot, normalizedInput) : path.posix.relative(relativeRoot, normalizedInput);
-	const safeRelative = relative === "." ? "" : relative;
-	return {
-		hostPath: safeRelative ? path.resolve(params.skillsRoot, ...safeRelative.split("/")) : params.skillsRoot,
-		relativePath: safeRelative ? path.posix.join(relativeRoot, safeRelative) : relativeRoot,
-		containerPath: safeRelative ? path.posix.join(params.skillsContainerRoot, safeRelative) : params.skillsContainerRoot,
-		mountHostRoot: params.skillsRoot,
-		writable: false,
-		source: "protectedSkill"
-	};
-}
-function resolveProtectedSkillShadowTarget(params) {
-	if (!isPathInside(params.workspaceSkillsShadowRoot, params.hostPath)) return null;
-	const relative = path.relative(params.workspaceSkillsShadowRoot, params.hostPath).split(path.sep).join(path.posix.sep);
-	const safeRelative = relative === "." ? "" : relative;
-	const hostPath = safeRelative ? path.resolve(params.skillsRoot, ...safeRelative.split("/")) : params.skillsRoot;
-	const relativeRoot = path.posix.join(...MATERIALIZED_SKILLS_CONTAINER_PARTS);
-	return {
-		hostPath,
-		relativePath: safeRelative ? path.posix.join(relativeRoot, safeRelative) : relativeRoot,
-		containerPath: safeRelative ? path.posix.join(params.skillsContainerRoot, safeRelative) : params.skillsContainerRoot,
-		mountHostRoot: params.skillsRoot,
-		writable: false,
-		source: "protectedSkill"
-	};
-}
 async function assertLocalPathSafety(params) {
 	if (!params.target.hostPath) throw new Error(`Missing local host path for ${params.target.containerPath}`);
 	const canonicalRoot = await fsPromises.realpath(params.root).catch(() => path.resolve(params.root));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/openshell-sandbox",
-  "version": "2026.8.2",
+  "version": "2026.9.1",
   "description": "OpenClaw sandbox backend for the NVIDIA OpenShell CLI with mirrored local workspaces and SSH command execution.",
   "repository": {
     "type": "git",
@@ -21,10 +21,10 @@
       "minHostVersion": ">=2026.5.12-beta.1"
     },
     "compat": {
-      "pluginApi": ">=2026.8.2"
+      "pluginApi": ">=2026.9.1"
     },
     "build": {
-      "openclawVersion": "2026.8.2",
+      "openclawVersion": "2026.9.1",
       "bundledDist": false
     },
     "release": {
@@ -41,7 +41,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.8.2"
+    "openclaw": ">=2026.9.1"
   },
   "peerDependenciesMeta": {
     "openclaw": {