@openclaw/openshell-sandbox 2026.9.5 → 2026.9.7

package/dist/index.js

@@ -5,6 +5,7 @@ import fsSync from "node:fs";
 import fsPromises from "node:fs/promises";
 import path from "node:path";
 import { movePathWithCopyFallback } from "@openclaw/fs-safe/atomic";
+import { GUEST_FILESYSTEM_PYTHON } from "@openclaw/fs-safe/guest";
 import { createDeferred, formatPluginConfigIssue, mapPluginConfigIssues } from "openclaw/plugin-sdk/extension-shared";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
 import { FsSafeError, canonicalPathFromExistingAncestor, extractErrorCode } from "openclaw/plugin-sdk/security-runtime";
@@ -12,7 +13,7 @@ import { normalizeLowercaseStringOrEmpty } from "openclaw/plugin-sdk/string-coer
 import { buildPluginConfigSchema } from "openclaw/plugin-sdk/core";
 import { MAX_TIMER_TIMEOUT_SECONDS } from "openclaw/plugin-sdk/number-runtime";
 import { z } from "zod";
-import { isPathInside, root } from "openclaw/plugin-sdk/file-access-runtime";
+import { assertNoSymlinkParents, isPathInside, root } from "openclaw/plugin-sdk/file-access-runtime";
 import pLimit from "p-limit";
 //#region extensions/openshell/src/cli.ts
 function buildOpenShellBaseArgv(config) {
@@ -63,17 +64,6 @@ const DEFAULT_REMOTE_WORKSPACE_DIR = "/sandbox";
 const DEFAULT_REMOTE_AGENT_WORKSPACE_DIR = "/agent";
 const DEFAULT_TIMEOUT_MS = 12e4;
 const OPEN_SHELL_MANAGED_REMOTE_ROOTS = [DEFAULT_REMOTE_WORKSPACE_DIR, DEFAULT_REMOTE_AGENT_WORKSPACE_DIR];
-function normalizeProviders(value) {
-	const seen = /* @__PURE__ */ new Set();
-	const providers = [];
-	for (const entry of value ?? []) {
-		const normalized = entry.trim();
-		if (seen.has(normalized)) continue;
-		seen.add(normalized);
-		providers.push(normalized);
-	}
-	return providers;
-}
 const nonEmptyTrimmedString = (message) => z.string({ error: message }).trim().min(1, { error: message });
 const openShellManagedRemotePath = (fieldName) => nonEmptyTrimmedString(`${fieldName} must be a non-empty string`).regex(/^\/(?:sandbox|agent)(?:\/|$)/, { error: (issue) => String(issue.input).startsWith("/") ? `OpenShell ${fieldName} must stay under /sandbox or /agent` : `OpenShell ${fieldName} must be absolute` }).refine((value) => isManagedOpenShellRemotePath(path.posix.normalize(value)), { error: `OpenShell ${fieldName} must stay under /sandbox or /agent` });
 const openShellWorkspaceName = z.string({ error: "workspace must be a valid OpenShell workspace name" }).trim().min(1, { error: "workspace must be a valid OpenShell workspace name" }).max(19, { error: "workspace must be at most 19 characters" }).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, { error: "workspace must contain lowercase alphanumeric characters or single hyphens and must not start or end with a hyphen" });
@@ -120,22 +110,7 @@ function createOpenShellPluginConfigSchema() {
 	} });
 }
 function resolveOpenShellPluginConfig(value) {
-	if (value === void 0) return {
-		mode: DEFAULT_MODE,
-		command: DEFAULT_COMMAND,
-		gateway: void 0,
-		gatewayEndpoint: void 0,
-		workspace: void 0,
-		from: DEFAULT_SOURCE,
-		policy: void 0,
-		providers: [],
-		gpu: false,
-		autoProviders: true,
-		remoteWorkspaceDir: DEFAULT_REMOTE_WORKSPACE_DIR,
-		remoteAgentWorkspaceDir: DEFAULT_REMOTE_AGENT_WORKSPACE_DIR,
-		timeoutMs: DEFAULT_TIMEOUT_MS
-	};
-	const parsed = OpenShellPluginConfigSchema.safeParse(value);
+	const parsed = OpenShellPluginConfigSchema.safeParse(value === void 0 ? {} : value);
 	if (!parsed.success) {
 		const message = formatPluginConfigIssue(parsed.error.issues[0]);
 		throw new Error(`Invalid openshell plugin config: ${message}`);
@@ -149,7 +124,7 @@ function resolveOpenShellPluginConfig(value) {
 		workspace: cfg.workspace,
 		from: cfg.from ?? DEFAULT_SOURCE,
 		policy: cfg.policy,
-		providers: normalizeProviders(cfg.providers),
+		providers: [...new Set(cfg.providers ?? [])],
 		gpu: cfg.gpu ?? false,
 		autoProviders: cfg.autoProviders ?? true,
 		remoteWorkspaceDir: normalizeOpenShellRemotePath(cfg.remoteWorkspaceDir, DEFAULT_REMOTE_WORKSPACE_DIR, "remoteWorkspaceDir"),
@@ -196,72 +171,49 @@ var OpenShellFsBridge = class {
 	}
 	async readFile(params) {
 		const target = this.resolveTarget(params);
-		const hostPath = this.requireHostPath(target);
-		let opened;
+		const hostPath = target.hostPath;
 		try {
-			await assertLocalPathSafety({
-				target,
-				root: target.mountHostRoot,
-				allowMissingLeaf: false,
-				allowFinalSymlinkForUnlink: false
-			});
-			const root$1 = await root(target.mountHostRoot);
-			if (params.maxBytes !== void 0) return (await root$1.read(path.relative(target.mountHostRoot, hostPath), {
+			return (await (await root(target.mountHostRoot)).read(relativeToRoot(target, hostPath), {
 				hardlinks: "reject",
-				maxBytes: params.maxBytes
+				maxBytes: params.maxBytes ?? Infinity
 			})).buffer;
-			opened = await root$1.open(path.relative(target.mountHostRoot, hostPath), { hardlinks: "reject" });
-			try {
-				return await opened.handle.readFile();
-			} finally {
-				await opened.handle.close();
-			}
 		} catch (err) {
 			throw new Error(`Sandbox boundary checks failed; cannot read files: ${target.containerPath}`, { cause: err });
 		}
 	}
 	async readDirectory(params) {
 		const target = this.resolveTarget(params);
-		const hostPath = this.requireHostPath(target);
-		await assertLocalPathSafety({
-			target,
-			root: target.mountHostRoot,
-			allowMissingLeaf: false,
-			allowFinalSymlinkForUnlink: false
-		});
-		return (await (await root(target.mountHostRoot)).list(relativeToRoot(target, hostPath), { withFileTypes: true })).map(({ name, isDirectory }) => ({
+		const hostPath = target.hostPath;
+		const root$1 = await root(target.mountHostRoot);
+		const entries = [];
+		for await (const { name, isDirectory } of root$1.entries(relativeToRoot(target, hostPath), { order: "sorted" })) entries.push({
 			name,
 			isDirectory
-		}));
+		});
+		return entries;
 	}
 	async writeFile(params) {
 		const target = this.resolveTarget(params);
-		const hostPath = this.requireHostPath(target);
+		const hostPath = target.hostPath;
 		this.ensureWritable(target, "write files");
-		await assertLocalPathSafety({
-			target,
-			root: target.mountHostRoot,
-			allowMissingLeaf: true,
-			allowFinalSymlinkForUnlink: false
-		});
 		const buffer = Buffer.isBuffer(params.data) ? params.data : Buffer.from(params.data, params.encoding ?? "utf8");
-		await (await root(target.mountHostRoot)).write(path.relative(target.mountHostRoot, hostPath), buffer, { mkdir: params.mkdir });
+		await (await root(target.mountHostRoot)).write(relativeToRoot(target, hostPath), buffer, {
+			mkdir: params.mkdir,
+			mutationSymlinks: "reject"
+		});
 		await this.backend.syncLocalPathToRemote(hostPath, target.containerPath);
 	}
 	async createFileExclusive(params) {
 		const target = this.resolveTarget(params);
-		const hostPath = this.requireHostPath(target);
+		const hostPath = target.hostPath;
 		this.ensureWritable(target, "create files");
-		await assertLocalPathSafety({
-			target,
-			root: target.mountHostRoot,
-			allowMissingLeaf: true,
-			allowFinalSymlinkForUnlink: false
-		});
 		const buffer = Buffer.isBuffer(params.data) ? params.data : Buffer.from(params.data, params.encoding ?? "utf8");
 		const root$2 = await root(target.mountHostRoot);
 		try {
-			await root$2.create(path.relative(target.mountHostRoot, hostPath), buffer, { mkdir: params.mkdir !== false });
+			await root$2.create(relativeToRoot(target, hostPath), buffer, {
+				mkdir: params.mkdir !== false,
+				mutationSymlinks: "reject"
+			});
 		} catch (error) {
 			if (error instanceof FsSafeError && error.code === "already-exists") return "exists";
 			throw error;
@@ -271,12 +223,10 @@ var OpenShellFsBridge = class {
 	}
 	async mkdirp(params) {
 		const target = this.resolveTarget(params);
-		const hostPath = this.requireHostPath(target);
+		const hostPath = target.hostPath;
 		this.ensureWritable(target, "create directories");
 		await assertLocalPathSafety({
 			target,
-			root: target.mountHostRoot,
-			allowMissingLeaf: true,
 			allowFinalSymlinkForUnlink: false
 		});
 		await this.backend.mkdirpRemotePath(target.containerPath, params.signal);
@@ -287,12 +237,10 @@ var OpenShellFsBridge = class {
 	}
 	async remove(params) {
 		const target = this.resolveTarget(params);
-		const hostPath = this.requireHostPath(target);
+		const hostPath = target.hostPath;
 		this.ensureWritable(target, "remove files", params.recursive);
 		await assertLocalPathSafety({
 			target,
-			root: target.mountHostRoot,
-			allowMissingLeaf: params.force !== false,
 			allowFinalSymlinkForUnlink: true
 		});
 		await this.backend.removeRemotePath(target.containerPath, {
@@ -309,18 +257,14 @@ var OpenShellFsBridge = class {
 	}
 	async rename(params) {
 		const { from, to } = this.resolveRenameTargets(params);
-		const fromHostPath = this.requireHostPath(from);
-		const toHostPath = this.requireHostPath(to);
+		const fromHostPath = from.hostPath;
+		const toHostPath = to.hostPath;
 		await assertLocalPathSafety({
 			target: from,
-			root: from.mountHostRoot,
-			allowMissingLeaf: false,
 			allowFinalSymlinkForUnlink: true
 		});
 		await assertLocalPathSafety({
 			target: to,
-			root: to.mountHostRoot,
-			allowMissingLeaf: true,
 			allowFinalSymlinkForUnlink: false
 		});
 		await assertRenameSourceSupported(fromHostPath);
@@ -340,13 +284,11 @@ var OpenShellFsBridge = class {
 	}
 	async stat(params) {
 		const target = this.resolveTarget(params);
-		const hostPath = this.requireHostPath(target);
+		const hostPath = target.hostPath;
 		const stats = await fsPromises.lstat(hostPath).catch(() => null);
 		if (!stats) return null;
 		await assertLocalPathSafety({
 			target,
-			root: target.mountHostRoot,
-			allowMissingLeaf: false,
 			allowFinalSymlinkForUnlink: false
 		});
 		return {
@@ -366,10 +308,6 @@ var OpenShellFsBridge = class {
 			workdir
 		})), ...this.sandbox.readOnlyResourceMounts ?? []];
 	}
-	requireHostPath(target) {
-		if (!target.hostPath) throw new Error(`OpenShell mirror bridge requires a local host path: ${target.containerPath}`);
-		return target.hostPath;
-	}
 	containerMounts(readOnlyMounts = this.readOnlyMounts()) {
 		const workspaceRoot = path.resolve(this.sandbox.workspaceDir);
 		const agentRoot = path.resolve(this.sandbox.agentWorkspaceDir);
@@ -468,7 +406,7 @@ async function removeLocalRootPath(params) {
 	const relativePath = relativeToRoot(params.target, params.hostPath);
 	try {
 		if (params.force === false) await fsPromises.lstat(params.hostPath);
-		const targets = params.recursive && !relativePath ? await root$3.list("") : [relativePath];
+		const targets = params.recursive && !relativePath ? (await root$3.list("")).map((name) => relativeToRoot(params.target, path.join(params.hostPath, name))) : [relativePath];
 		for (const target of targets) await root$3.remove(target, {
 			force: params.force !== false,
 			...params.recursive ? {
@@ -497,7 +435,7 @@ async function mkdirParentPath(root, relativePath) {
 }
 function relativeToRoot(target, hostPath) {
 	const relativePath = path.relative(target.mountHostRoot, hostPath);
-	return relativePath === "." ? "" : relativePath;
+	return relativePath ? `.${path.sep}${relativePath}` : "";
 }
 async function assertRenameSourceSupported(fromHostPath) {
 	const stats = await fsPromises.lstat(fromHostPath);
@@ -531,40 +469,19 @@ async function nearestExistingDirectoryStats(params) {
 	return await fsPromises.lstat(rootPath);
 }
 function isNotFoundError(err) {
-	return err instanceof FsSafeError && err.code === "not-found" || typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+	return err instanceof FsSafeError && err.code === "not-found" || extractErrorCode(err) === "ENOENT";
 }
 async function assertLocalPathSafety(params) {
-	if (!params.target.hostPath) throw new Error(`Missing local host path for ${params.target.containerPath}`);
-	const canonicalRoot = await fsPromises.realpath(params.root).catch(() => path.resolve(params.root));
-	const targetStats = await fsPromises.lstat(params.target.hostPath).catch(() => null);
-	const candidate = params.allowFinalSymlinkForUnlink && targetStats?.isSymbolicLink() ? path.resolve(canonicalRoot, path.relative(params.root, params.target.hostPath)) : await resolveCanonicalCandidate(params.target.hostPath);
-	if (!isPathInside(canonicalRoot, candidate)) throw new Error(`Sandbox path escapes allowed mounts; cannot access: ${params.target.containerPath}`);
-	const segments = path.relative(params.root, params.target.hostPath).split(path.sep).filter(Boolean);
-	let cursor = params.root;
-	for (const [index, segment] of segments.entries()) {
-		cursor = path.join(cursor, segment);
-		const stats = await fsPromises.lstat(cursor).catch(() => null);
-		if (!stats) {
-			if (index === segments.length - 1 && params.allowMissingLeaf) return;
-			continue;
-		}
-		const isFinal = index === segments.length - 1;
-		if (stats.isSymbolicLink() && (!isFinal || !params.allowFinalSymlinkForUnlink)) throw new Error(`Sandbox boundary checks failed: ${params.target.containerPath}`);
-	}
-}
-async function resolveCanonicalCandidate(targetPath) {
-	const missing = [];
-	let cursor = path.resolve(targetPath);
-	while (true) {
-		if (await fsPromises.lstat(cursor).then(() => true).catch(() => false)) {
-			const canonical = await fsPromises.realpath(cursor).catch(() => cursor);
-			return path.resolve(canonical, ...missing);
-		}
-		const parent = path.dirname(cursor);
-		if (parent === cursor) return path.resolve(cursor, ...missing);
-		missing.unshift(path.basename(cursor));
-		cursor = parent;
-	}
+	const { hostPath, mountHostRoot } = params.target;
+	const unlinkSymlink = params.allowFinalSymlinkForUnlink && hostPath !== mountHostRoot && (await fsPromises.lstat(hostPath).catch((error) => {
+		if (isNotFoundError(error)) return null;
+		throw error;
+	}))?.isSymbolicLink();
+	await assertNoSymlinkParents({
+		rootDir: mountHostRoot,
+		targetPath: unlinkSymlink ? path.dirname(hostPath) : hostPath,
+		messagePrefix: `Sandbox boundary checks failed: ${params.target.containerPath}`
+	});
 }
 //#endregion
 //#region extensions/openshell/src/mirror.ts
@@ -651,107 +568,28 @@ function buildOpenShellDirectoryUploadArgs(params) {
 	];
 }
 const REMOTE_MANAGED_ROOTS_EMPTY_SCRIPT = "for root in \"$@\"; do if [ -d \"$root\" ] && [ -n \"$(ls -A \"$root\")\" ]; then printf \"1\\n\"; exit 0; fi; done; printf \"0\\n\"";
-const PINNED_REMOTE_PATH_MUTATION_SCRIPT = [
-	"set -eu",
-	"die() { echo \"$1\" >&2; exit 1; }",
-	"validate_basename() {",
-	"  case \"$1\" in \"\"|\".\"|\"..\"|*/*) die \"unsafe remote basename: $1\" ;; esac",
-	"}",
-	"pin_dir() {",
-	"  root=\"$1\"",
-	"  relative=\"$2\"",
-	"  create=\"$3\"",
-	"  case \"$root\" in /*) ;; *) die \"remote root must be absolute: $root\" ;; esac",
-	"  root=\"${root%/}\"",
-	"  [ -n \"$root\" ] || root=\"/\"",
-	"  if [ -L \"$root\" ]; then die \"unsafe remote root symlink: $root\"; fi",
-	"  mkdir -p -- \"$root\"",
-	"  canonical_root=\"$(cd \"$root\" && pwd -P)\"",
-	"  current=\"$canonical_root\"",
-	"  relative=\"${relative#/}\"",
-	"  while [ -n \"$relative\" ]; do",
-	"    part=\"${relative%%/*}\"",
-	"    if [ \"$part\" = \"$relative\" ]; then relative=\"\"; else relative=\"${relative#*/}\"; fi",
-	"    [ -n \"$part\" ] || continue",
-	"    case \"$part\" in \".\"|\"..\") die \"unsafe remote directory component: $part\" ;; esac",
-	"    if [ \"$current\" = \"/\" ]; then next=\"/$part\"; else next=\"$current/$part\"; fi",
-	"    if [ -L \"$next\" ]; then die \"unsafe remote directory symlink: $next\"; fi",
-	"    if [ -e \"$next\" ]; then",
-	"      if [ ! -d \"$next\" ]; then die \"unsafe remote directory component: $next\"; fi",
-	"    else",
-	"      if [ \"$create\" != \"1\" ]; then die \"remote directory not found: $next\"; fi",
-	"      mkdir -- \"$next\"",
-	"    fi",
-	"    current=\"$next\"",
-	"  done",
-	"  printf \"%s\\n\" \"$current\"",
-	"}",
-	"pin_dir_or_missing() {",
-	"  root=\"$1\"",
-	"  relative=\"$2\"",
-	"  missing_ok=\"$3\"",
-	"  case \"$root\" in /*) ;; *) die \"remote root must be absolute: $root\" ;; esac",
-	"  root=\"${root%/}\"",
-	"  [ -n \"$root\" ] || root=\"/\"",
-	"  if [ -L \"$root\" ]; then die \"unsafe remote root symlink: $root\"; fi",
-	"  if [ ! -d \"$root\" ]; then",
-	"    if [ -e \"$root\" ]; then die \"unsafe remote root component: $root\"; fi",
-	"    if [ \"$missing_ok\" = \"1\" ]; then printf \"\\n\"; return 0; fi",
-	"    die \"remote directory not found: $root\"",
-	"  fi",
-	"  canonical_root=\"$(cd \"$root\" && pwd -P)\"",
-	"  current=\"$canonical_root\"",
-	"  relative=\"${relative#/}\"",
-	"  while [ -n \"$relative\" ]; do",
-	"    part=\"${relative%%/*}\"",
-	"    if [ \"$part\" = \"$relative\" ]; then relative=\"\"; else relative=\"${relative#*/}\"; fi",
-	"    [ -n \"$part\" ] || continue",
-	"    case \"$part\" in \".\"|\"..\") die \"unsafe remote directory component: $part\" ;; esac",
-	"    if [ \"$current\" = \"/\" ]; then next=\"/$part\"; else next=\"$current/$part\"; fi",
-	"    if [ -L \"$next\" ]; then die \"unsafe remote directory symlink: $next\"; fi",
-	"    if [ -e \"$next\" ]; then",
-	"      if [ ! -d \"$next\" ]; then die \"unsafe remote directory component: $next\"; fi",
-	"    else",
-	"      if [ \"$missing_ok\" = \"1\" ]; then printf \"\\n\"; return 0; fi",
-	"      die \"remote directory not found: $next\"",
-	"    fi",
-	"    current=\"$next\"",
-	"  done",
-	"  printf \"%s\\n\" \"$current\"",
-	"}",
-	"operation=\"$1\"",
-	"case \"$operation\" in",
-	"  mkdirp)",
-	"    pin_dir \"$2\" \"$3\" 1 >/dev/null",
-	"    ;;",
-	"  remove)",
-	"    validate_basename \"$4\"",
-	"    parent=\"$(pin_dir_or_missing \"$2\" \"$3\" \"${5:-0}\")\"",
-	"    [ -n \"$parent\" ] || exit 0",
-	"    target=\"$parent/$4\"",
-	"    if [ -d \"$target\" ] && [ ! -L \"$target\" ]; then rm -rf -- \"$target\"; elif [ -e \"$target\" ] || [ -L \"$target\" ]; then rm -f -- \"$target\"; fi",
-	"    ;;",
-	"  removefile)",
-	"    validate_basename \"$4\"",
-	"    parent=\"$(pin_dir_or_missing \"$2\" \"$3\" \"${5:-0}\")\"",
-	"    [ -n \"$parent\" ] || exit 0",
-	"    target=\"$parent/$4\"",
-	"    if [ -d \"$target\" ] && [ ! -L \"$target\" ]; then rmdir -- \"$target\"; elif [ -e \"$target\" ] || [ -L \"$target\" ]; then rm -f -- \"$target\"; fi",
-	"    ;;",
-	"  rename)",
-	"    src_parent=\"$(pin_dir \"$2\" \"$3\" 0)\"",
-	"    validate_basename \"$4\"",
-	"    dst_parent=\"$(pin_dir \"$5\" \"$6\" 1)\"",
-	"    validate_basename \"$7\"",
-	"    if [ -L \"$dst_parent/$7\" ]; then die \"unsafe remote rename target symlink: $dst_parent/$7\"; fi",
-	"    if [ -d \"$dst_parent/$7\" ]; then die \"unsafe remote rename target directory: $dst_parent/$7\"; fi",
-	"    mv -- \"$src_parent/$4\" \"$dst_parent/$7\"",
-	"    ;;",
-	"  *)",
-	"    die \"unknown remote path mutation: $operation\"",
-	"    ;;",
-	"esac"
-].join("\n");
+const OPEN_SHELL_GUEST_MUTATION_PYTHON = `
+import os, sys
+guest = sys.argv.pop(1)
+ignore_missing_parent = sys.argv.pop(1) == '1'
+operation = sys.argv[1]
+for index in ((2, 5) if operation == 'rename' else (2,)):
+    root = sys.argv[index].rstrip('/') or '/'
+    sys.argv[index] = root
+    if not os.path.isabs(root) or os.path.islink(root):
+        raise OSError('unsafe remote root: ' + root)
+    if operation != 'remove':
+        os.makedirs(root, exist_ok=True)
+if operation == 'rename':
+    target = os.path.join(sys.argv[5], sys.argv[6], sys.argv[7])
+    if os.path.islink(target) or os.path.isdir(target):
+        raise OSError('unsafe remote rename target: ' + target)
+try:
+    exec(guest)
+except FileNotFoundError:
+    if operation != 'remove' or not ignore_missing_parent:
+        raise
+`;
 const ENSURE_OPEN_SHELL_REMOTE_REAL_DIRECTORY_SCRIPT = [
 	"set -e",
 	"target=\"$1\"",
@@ -799,9 +637,6 @@ const ENSURE_OPEN_SHELL_REMOTE_REAL_DIRECTORY_SCRIPT = [
 	"  current=\"$next\"",
 	"done"
 ].join("\n");
-function buildOpenShellSshExecEnv() {
-	return sanitizeEnvVars(process.env).allowed;
-}
 function createOpenShellSandboxBackendFactory(params) {
 	return async (createParams) => await createOpenShellSandboxBackend({
 		...params,
@@ -900,7 +735,7 @@ var OpenShellSandboxBackendImpl = class {
 				});
 				return {
 					argv: pending.argv,
-					env: buildOpenShellSshExecEnv(),
+					env: sanitizeEnvVars(process.env).allowed,
 					stdinMode: "pipe-open",
 					finalizeToken: pending.token
 				};
@@ -1036,16 +871,7 @@ var OpenShellSandboxBackendImpl = class {
 	}
 	resolveWorkdirValidationRoot(workdir) {
 		try {
-			const normalized = normalizeRemotePath(workdir);
-			return resolveOpenShellWorkspaceRoot([{
-				remote: normalizeRemotePath(this.params.remoteWorkspaceDir),
-				owner: "workspace",
-				value: void 0
-			}, {
-				remote: normalizeRemotePath(this.params.remoteAgentWorkspaceDir),
-				owner: "agent",
-				value: void 0
-			}], normalized)?.remote ?? this.params.remoteWorkspaceDir;
+			return this.resolveRemoteTarget(workdir).root;
 		} catch {
 			return this.params.remoteWorkspaceDir;
 		}
@@ -1112,12 +938,14 @@ var OpenShellSandboxBackendImpl = class {
 		const target = this.resolveRemoteTarget(remotePath);
 		await this.runPinnedRemotePathMutation({
 			args: [
-				params?.recursive ? "remove" : "removefile",
+				"remove",
 				target.root,
 				path.posix.dirname(target.relativePath) === "." ? "" : path.posix.dirname(target.relativePath),
 				path.posix.basename(target.relativePath),
-				params?.ignoreMissing ? "1" : "0"
+				params?.recursive ? "1" : "0",
+				"1"
 			],
+			ignoreMissingParent: params?.ignoreMissing,
 			signal: params?.signal
 		});
 	}
@@ -1132,7 +960,8 @@ var OpenShellSandboxBackendImpl = class {
 				path.posix.basename(from.relativePath),
 				to.root,
 				path.posix.dirname(to.relativePath) === "." ? "" : path.posix.dirname(to.relativePath),
-				path.posix.basename(to.relativePath)
+				path.posix.basename(to.relativePath),
+				"1"
 			],
 			signal
 		});
@@ -1162,24 +991,11 @@ var OpenShellSandboxBackendImpl = class {
 		await this.maybeSeedRemoteWorkspace();
 		const target = this.resolveRemoteTarget(remotePath);
 		const stats = await fsPromises.lstat(localPath).catch(() => null);
-		if (!stats) {
-			await this.runPinnedRemotePathMutation({ args: [
-				"remove",
-				target.root,
-				path.posix.dirname(target.relativePath) === "." ? "" : path.posix.dirname(target.relativePath),
-				path.posix.basename(target.relativePath),
-				"1"
-			] });
-			return;
-		}
-		if (stats.isSymbolicLink()) {
-			await this.runPinnedRemotePathMutation({ args: [
-				"remove",
-				target.root,
-				path.posix.dirname(target.relativePath) === "." ? "" : path.posix.dirname(target.relativePath),
-				path.posix.basename(target.relativePath),
-				"1"
-			] });
+		if (!stats || stats.isSymbolicLink()) {
+			await this.removeRemotePath(remotePath, {
+				recursive: true,
+				ignoreMissing: true
+			});
 			return;
 		}
 		if (stats.isDirectory()) {
@@ -1207,8 +1023,13 @@ var OpenShellSandboxBackendImpl = class {
 	}
 	async runPinnedRemotePathMutation(params) {
 		return await this.runRemoteShellScript({
-			script: PINNED_REMOTE_PATH_MUTATION_SCRIPT,
-			args: params.args,
+			script: "python_script=\"$1\"; shift; python3 -c \"$python_script\" \"$@\"",
+			args: [
+				OPEN_SHELL_GUEST_MUTATION_PYTHON,
+				GUEST_FILESYSTEM_PYTHON,
+				params.ignoreMissingParent ? "1" : "0",
+				...params.args
+			],
 			signal: params.signal
 		});
 	}
@@ -1444,7 +1265,7 @@ var OpenShellSandboxBackendImpl = class {
 					}
 					const relativeSkillsPath = path.posix.relative(root.remote, remoteSkillsWorkspaceDir);
 					if (relativeSkillsPath === "" || !relativeSkillsPath.startsWith("../") && !path.posix.isAbsolute(relativeSkillsPath)) await removeDownloadedWorkspacePath(tmpDir, relativeSkillsPath.split("/").filter(Boolean));
-					if (root.owner === "workspace") await moveLocalShadowAside({
+					await moveLocalShadowAside({
 						workspaceDir: root.local,
 						tmpDir,
 						relativeParts: MATERIALIZED_SKILLS_REMOTE_PARTS,
@@ -1599,14 +1420,7 @@ async function removeDownloadedWorkspacePath(tmpDir, parts) {
 		const next = path.join(cursor, part);
 		const stats = await fsPromises.lstat(next).catch(() => null);
 		if (!stats) return;
-		if (index === parts.length - 1) {
-			await fsPromises.rm(next, {
-				recursive: true,
-				force: true
-			});
-			return;
-		}
-		if (stats.isSymbolicLink() || !stats.isDirectory()) {
+		if (index === parts.length - 1 || stats.isSymbolicLink() || !stats.isDirectory()) {
 			await fsPromises.rm(next, {
 				recursive: true,
 				force: true