import fs from "node:fs/promises";

import { loadConfig } from "../../config/config.js";

import type { OpenClawConfig } from "../../config/types.openclaw.js";

import { getRemoteSkillEligibility } from "../../infra/skills-remote.js";

import {

ensureBrowserControlAuth,

resolveBrowserControlAuth,

} from "../../plugin-sdk/browser-control-auth.js";

import { DEFAULT_BROWSER_EVALUATE_ENABLED } from "../../plugin-sdk/browser-profiles.js";

import { defaultRuntime } from "../../runtime.js";

import { resolveUserPath } from "../../utils.js";

import { canExecRequestNode } from "../exec-defaults.js";

import { syncSkillsToWorkspace } from "../skills.js";

import { DEFAULT_AGENT_WORKSPACE_DIR } from "../workspace.js";

import { requireSandboxBackendFactory } from "./backend.js";

import { ensureSandboxBrowser } from "./browser.js";

import { resolveSandboxConfigForAgent } from "./config.js";

import { createSandboxFsBridge } from "./fs-bridge.js";

import { maybePruneSandboxes } from "./prune.js";

import { updateRegistry } from "./registry.js";

import { resolveSandboxRuntimeStatus } from "./runtime-status.js";

import { resolveSandboxScopeKey, resolveSandboxWorkspaceDir } from "./shared.js";

);

if (cfg.workspaceAccess !== "rw") {

try {

const [{ getRemoteSkillEligibility }, { canExecRequestNode }, { syncSkillsToWorkspace }] =

await Promise.all([

import("../../infra/skills-remote.js"),

import("../exec-defaults.js"),

import("../skills.js"),

]);

await syncSkillsToWorkspace({

sourceWorkspaceDir: agentWorkspaceDir,

targetWorkspaceDir: sandboxWorkspaceDir,

}

const { rawSessionKey, cfg, runtime } = resolved;

await maybePruneSandboxes(cfg);

await (await import("./prune.js")).maybePruneSandboxes(cfg);

const { agentWorkspaceDir, scopeKey, workspaceDir } = await ensureSandboxWorkspaceLayout({

cfg,

? await (async () => {

// Sandbox browser bridge server runs on a loopback TCP port; always wire up

// the same auth that loopback browser clients will send (token/password).

const cfgForAuth = params.config ?? loadConfig();

const cfgForAuth = params.config ?? (await import("../../config/config.js")).loadConfig();

let browserAuth = resolveBrowserControlAuth(cfgForAuth);

try {

const ensured = await ensureBrowserControlAuth({ cfg: cfgForAuth });