@openclaw/openshell-sandbox 2026.9.4 → 2026.9.6

package/assets/activity.svg

@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
+  <path fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5" d="M4 4h16v16H4ZM7 8l3 3-3 3M12 16h5" />
+</svg>

package/dist/index.js

@@ -12,7 +12,7 @@ import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coer
 import { buildPluginConfigSchema } from "openclaw/plugin-sdk/core";
 import { MAX_TIMER_TIMEOUT_SECONDS } from "openclaw/plugin-sdk/number-runtime";
 import { z } from "zod";
-import { isPathInside, root } from "openclaw/plugin-sdk/file-access-runtime";
+import { assertNoSymlinkParents, canonicalPathFromExistingAncestor as canonicalPathFromExistingAncestor$1, isPathInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import pLimit from "p-limit";
 //#region extensions/openshell/src/cli.ts
 function buildOpenShellBaseArgv(config) {
@@ -201,8 +201,6 @@ var OpenShellFsBridge = class {
 		try {
 			await assertLocalPathSafety({
 				target,
-				root: target.mountHostRoot,
-				allowMissingLeaf: false,
 				allowFinalSymlinkForUnlink: false
 			});
 			const root$1 = await root(target.mountHostRoot);
@@ -225,8 +223,6 @@ var OpenShellFsBridge = class {
 		const hostPath = this.requireHostPath(target);
 		await assertLocalPathSafety({
 			target,
-			root: target.mountHostRoot,
-			allowMissingLeaf: false,
 			allowFinalSymlinkForUnlink: false
 		});
 		return (await (await root(target.mountHostRoot)).list(relativeToRoot(target, hostPath), { withFileTypes: true })).map(({ name, isDirectory }) => ({
@@ -240,8 +236,6 @@ var OpenShellFsBridge = class {
 		this.ensureWritable(target, "write files");
 		await assertLocalPathSafety({
 			target,
-			root: target.mountHostRoot,
-			allowMissingLeaf: true,
 			allowFinalSymlinkForUnlink: false
 		});
 		const buffer = Buffer.isBuffer(params.data) ? params.data : Buffer.from(params.data, params.encoding ?? "utf8");
@@ -254,8 +248,6 @@ var OpenShellFsBridge = class {
 		this.ensureWritable(target, "create files");
 		await assertLocalPathSafety({
 			target,
-			root: target.mountHostRoot,
-			allowMissingLeaf: true,
 			allowFinalSymlinkForUnlink: false
 		});
 		const buffer = Buffer.isBuffer(params.data) ? params.data : Buffer.from(params.data, params.encoding ?? "utf8");
@@ -275,8 +267,6 @@ var OpenShellFsBridge = class {
 		this.ensureWritable(target, "create directories");
 		await assertLocalPathSafety({
 			target,
-			root: target.mountHostRoot,
-			allowMissingLeaf: true,
 			allowFinalSymlinkForUnlink: false
 		});
 		await this.backend.mkdirpRemotePath(target.containerPath, params.signal);
@@ -291,8 +281,6 @@ var OpenShellFsBridge = class {
 		this.ensureWritable(target, "remove files", params.recursive);
 		await assertLocalPathSafety({
 			target,
-			root: target.mountHostRoot,
-			allowMissingLeaf: params.force !== false,
 			allowFinalSymlinkForUnlink: true
 		});
 		await this.backend.removeRemotePath(target.containerPath, {
@@ -313,14 +301,10 @@ var OpenShellFsBridge = class {
 		const toHostPath = this.requireHostPath(to);
 		await assertLocalPathSafety({
 			target: from,
-			root: from.mountHostRoot,
-			allowMissingLeaf: false,
 			allowFinalSymlinkForUnlink: true
 		});
 		await assertLocalPathSafety({
 			target: to,
-			root: to.mountHostRoot,
-			allowMissingLeaf: true,
 			allowFinalSymlinkForUnlink: false
 		});
 		await assertRenameSourceSupported(fromHostPath);
@@ -345,8 +329,6 @@ var OpenShellFsBridge = class {
 		if (!stats) return null;
 		await assertLocalPathSafety({
 			target,
-			root: target.mountHostRoot,
-			allowMissingLeaf: false,
 			allowFinalSymlinkForUnlink: false
 		});
 		return {
@@ -370,16 +352,13 @@ var OpenShellFsBridge = class {
 		if (!target.hostPath) throw new Error(`OpenShell mirror bridge requires a local host path: ${target.containerPath}`);
 		return target.hostPath;
 	}
-	resolveTarget(params) {
+	containerMounts(readOnlyMounts = this.readOnlyMounts()) {
 		const workspaceRoot = path.resolve(this.sandbox.workspaceDir);
 		const agentRoot = path.resolve(this.sandbox.agentWorkspaceDir);
 		const hasAgentMount = this.sandbox.workspaceAccess !== "none" && workspaceRoot !== agentRoot;
 		const agentContainerRoot = (this.backend.remoteAgentWorkspaceDir || "/agent").replace(/\\/g, "/");
-		const workspaceContainerRoot = this.sandbox.containerWorkdir.replace(/\\/g, "/");
-		const input = params.filePath.trim();
-		const readOnlyMounts = this.readOnlyMounts();
 		const containerMounts = [{
-			remote: workspaceContainerRoot,
+			remote: this.sandbox.containerWorkdir.replace(/\\/g, "/"),
 			owner: "workspace",
 			value: {
 				hostRoot: workspaceRoot,
@@ -401,6 +380,23 @@ var OpenShellFsBridge = class {
 				writable: false
 			}
 		})));
+		return containerMounts;
+	}
+	get pathMappings() {
+		return this.containerMounts().toSorted((a, b) => Number(a.owner === "agent") - Number(b.owner === "agent")).map((mount) => ({
+			hostRoot: mount.value.hostRoot,
+			containerRoot: mount.remote
+		}));
+	}
+	resolveTarget(params) {
+		const workspaceRoot = path.resolve(this.sandbox.workspaceDir);
+		const agentRoot = path.resolve(this.sandbox.agentWorkspaceDir);
+		const hasAgentMount = this.sandbox.workspaceAccess !== "none" && workspaceRoot !== agentRoot;
+		const agentContainerRoot = (this.backend.remoteAgentWorkspaceDir || "/agent").replace(/\\/g, "/");
+		const workspaceContainerRoot = this.sandbox.containerWorkdir.replace(/\\/g, "/");
+		const input = params.filePath.trim();
+		const readOnlyMounts = this.readOnlyMounts();
+		const containerMounts = this.containerMounts(readOnlyMounts);
 		const resolveContainerTarget = (containerPath) => {
 			const containerMount = resolveOpenShellWorkspaceRoot(containerMounts, containerPath);
 			if (!containerMount) return;
@@ -454,32 +450,21 @@ async function removeLocalRootPath(params) {
 	const relativePath = relativeToRoot(params.target, params.hostPath);
 	try {
 		if (params.force === false) await fsPromises.lstat(params.hostPath);
-		if (params.recursive) {
-			if ((await fsPromises.lstat(params.hostPath).catch((err) => {
-				if (isNotFoundError(err)) return null;
-				throw err;
-			}))?.isSymbolicLink()) {
-				await root$3.remove(relativePath);
-				return;
-			}
-			await removeRootTree(root$3, relativePath);
-			return;
-		}
-		await root$3.remove(relativePath);
+		const targets = params.recursive && !relativePath ? await root$3.list("") : [relativePath];
+		for (const target of targets) await root$3.remove(target, {
+			force: params.force !== false,
+			...params.recursive ? {
+				recursive: true,
+				order: "sorted",
+				maxEntries: Infinity,
+				maxDepth: Infinity
+			} : {}
+		});
 	} catch (err) {
 		if (params.force !== false && isNotFoundError(err)) return;
 		throw err;
 	}
 }
-async function removeRootTree(root, relativePath, knownStats) {
-	const stats = knownStats ?? await root.stat(relativePath);
-	if (stats.isDirectory && !stats.isSymbolicLink) {
-		const entries = await root.list(relativePath, { withFileTypes: true });
-		for (const entry of entries) await removeRootTree(root, path.join(relativePath, entry.name), entry);
-		if (!relativePath) return;
-	}
-	await root.remove(relativePath);
-}
 async function moveLocalRootPath(params) {
 	const root$4 = await root(params.from.mountHostRoot);
 	const fromRelativePath = relativeToRoot(params.from, params.fromHostPath);
@@ -531,37 +516,23 @@ function isNotFoundError(err) {
 	return err instanceof FsSafeError && err.code === "not-found" || typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
 }
 async function assertLocalPathSafety(params) {
-	if (!params.target.hostPath) throw new Error(`Missing local host path for ${params.target.containerPath}`);
-	const canonicalRoot = await fsPromises.realpath(params.root).catch(() => path.resolve(params.root));
-	const targetStats = await fsPromises.lstat(params.target.hostPath).catch(() => null);
-	const candidate = params.allowFinalSymlinkForUnlink && targetStats?.isSymbolicLink() ? path.resolve(canonicalRoot, path.relative(params.root, params.target.hostPath)) : await resolveCanonicalCandidate(params.target.hostPath);
+	const { hostPath, mountHostRoot } = params.target;
+	if (!hostPath) throw new Error(`Missing local host path for ${params.target.containerPath}`);
+	const canonicalRoot = await fsPromises.realpath(mountHostRoot).catch((error) => {
+		if (isNotFoundError(error)) return path.resolve(mountHostRoot);
+		throw error;
+	});
+	const unlinkSymlink = params.allowFinalSymlinkForUnlink && hostPath !== mountHostRoot && (await fsPromises.lstat(hostPath).catch((error) => {
+		if (isNotFoundError(error)) return null;
+		throw error;
+	}))?.isSymbolicLink();
+	const candidate = unlinkSymlink ? path.resolve(canonicalRoot, path.relative(mountHostRoot, hostPath)) : await canonicalPathFromExistingAncestor$1(hostPath);
 	if (!isPathInside(canonicalRoot, candidate)) throw new Error(`Sandbox path escapes allowed mounts; cannot access: ${params.target.containerPath}`);
-	const segments = path.relative(params.root, params.target.hostPath).split(path.sep).filter(Boolean);
-	let cursor = params.root;
-	for (const [index, segment] of segments.entries()) {
-		cursor = path.join(cursor, segment);
-		const stats = await fsPromises.lstat(cursor).catch(() => null);
-		if (!stats) {
-			if (index === segments.length - 1 && params.allowMissingLeaf) return;
-			continue;
-		}
-		const isFinal = index === segments.length - 1;
-		if (stats.isSymbolicLink() && (!isFinal || !params.allowFinalSymlinkForUnlink)) throw new Error(`Sandbox boundary checks failed: ${params.target.containerPath}`);
-	}
-}
-async function resolveCanonicalCandidate(targetPath) {
-	const missing = [];
-	let cursor = path.resolve(targetPath);
-	while (true) {
-		if (await fsPromises.lstat(cursor).then(() => true).catch(() => false)) {
-			const canonical = await fsPromises.realpath(cursor).catch(() => cursor);
-			return path.resolve(canonical, ...missing);
-		}
-		const parent = path.dirname(cursor);
-		if (parent === cursor) return path.resolve(cursor, ...missing);
-		missing.unshift(path.basename(cursor));
-		cursor = parent;
-	}
+	await assertNoSymlinkParents({
+		rootDir: mountHostRoot,
+		targetPath: unlinkSymlink ? path.dirname(hostPath) : hostPath,
+		messagePrefix: `Sandbox boundary checks failed: ${params.target.containerPath}`
+	});
 }
 //#endregion
 //#region extensions/openshell/src/mirror.ts
@@ -927,6 +898,9 @@ var OpenShellSandboxBackendImpl = class {
 			}
 		});
 		return {
+			get pathMappings() {
+				return bridge.pathMappings;
+			},
 			resolvePath: (params) => bridge.resolvePath(params),
 			readFile: (params) => this.runWorkspaceOperation(() => bridge.readFile(params), params.signal),
 			readDirectory: (params) => this.runWorkspaceOperation(() => bridge.readDirectory(params), params.signal),