edf4aca7bc
* fix(agents): stop apply_patch from silently overwriting existing files An "*** Add File:" hunk wrote its target unconditionally. When the path already existed, apply_patch replaced the entire file, returned Success, and listed the path under "added", so neither the model nor the UI got any signal that existing content had been destroyed. The "*** Move to:" destination of an update hunk had the same gap and reported the clobbered path as merely modified. The add and move-to branches now check the destination through the patch file ops before writing and fail closed when it exists. Routing the check through fileOps keeps it correct on all three backends (workspace-scoped fs-safe root, raw fs, sandbox bridge). The check runs per hunk in patch order, so deleting a path earlier in the same patch and recreating it still works. * fix(agents): make apply_patch destination creation atomic The previous guard checked that an add or move-to destination was absent and then wrote it. A competing writer could create the path in that gap, after which the write still replaced it, so the no-clobber guarantee did not hold under contention. Destination creation now goes through a single exclusive create-if-absent operation on every patch backend: Root.create for the workspace-scoped default, an O_EXCL write for the raw filesystem, and a new pinned create operation in the sandbox mutation helper that opens the target with O_CREAT|O_EXCL and reports a reserved exit code when it already exists. PatchFileOps drops its separate existence check. Resolving the host ops behind an early return removes the repeated workspaceOnly branch inside each operation and the optional-call dance that let a missing root silently skip a write. * fix(agents): complete atomic apply-patch creation * fix(agents): preserve raced create replacements * fix(agents): handle fs-safe patch collisions * fix(agents): publish sandbox creates atomically * test(agents): cover exclusive create provenance rollback * fix(agents): use typed exclusive-create signal --------- Co-authored-by: Vincent Koc <vincentkoc@ieee.org> |
||
|---|---|---|
| .. | ||
| src | ||
| index.ts | ||
| openclaw.plugin.json | ||
| package.json | ||
| README.md | ||
| tsconfig.json | ||
@openclaw/openshell-sandbox
Official NVIDIA OpenShell sandbox backend for OpenClaw.
This plugin lets OpenClaw use OpenShell-managed sandboxes with mirrored local workspaces and SSH command execution.
Configuring an OpenShell workspace requires OpenShell v0.0.88 or newer. The
plugin supports OpenShell control-plane workspaces through
plugins.entries.openshell.config.workspace; this is separate from OpenClaw's
local/remote filesystem workspace mode. The setting applies to the whole plugin
instance, not individual agents or sessions. When unset, the plugin preserves
the OpenShell CLI's ambient OPENSHELL_WORKSPACE selection, or its default
fallback when no ambient selection exists.
Install
openclaw plugins install @openclaw/openshell-sandbox
Restart the Gateway after installing or updating the plugin.
Configure
Use the OpenShell docs for credentials, workspace mirroring, runtime selection, and troubleshooting:
Package
- Plugin id:
openshell - Package:
@openclaw/openshell-sandbox - Minimum OpenClaw host:
2026.5.12-beta.1