expect(prompt).toContain("Mode: prefer");

});

it("adds workspace-only scratch path guidance when fs workspaceOnly is enabled", () => {

const prompt = buildEmbeddedSystemPrompt({

config: {

tools: {

fs: {

workspaceOnly: true,

},

},

},

workspaceDir: "/tmp/openclaw",

reasoningTagHint: false,

runtimeInfo: {

host: "local",

os: "darwin",

arch: "arm64",

node: process.version,

model: "gpt-5.4",

provider: "openai",

},

tools: [],

modelAliasLines: [],

userTimezone: "UTC",

});

expect(prompt).toContain("tools.fs.workspaceOnly is enabled");

expect(prompt).toContain("`.openclaw/tmp/`");

expect(prompt).toContain("Do not write files to `/tmp/...`");

});

it("omits workspace-only scratch path guidance when fs workspaceOnly is disabled", () => {

const prompt = buildEmbeddedSystemPrompt({

config: {

tools: {

fs: {

workspaceOnly: false,

},

},

},

workspaceDir: "/tmp/openclaw",

reasoningTagHint: false,

runtimeInfo: {

host: "local",

os: "darwin",

arch: "arm64",

node: process.version,

model: "gpt-5.4",

provider: "openai",

},

tools: [],

modelAliasLines: [],

userTimezone: "UTC",

});

expect(prompt).not.toContain("tools.fs.workspaceOnly is enabled");

expect(prompt).not.toContain("Do not write files to `/tmp/...`");

});

it("forwards the subagent prompt surface to embedded prompt rendering", () => {

const prompt = buildEmbeddedSystemPrompt({

workspaceDir: "/tmp/openclaw",

};

}

function isSandboxRootEscapeError(error: unknown): boolean {

function isSandboxRootEscapeError(error: unknown): error is Error {

return error instanceof Error && /^Path escapes sandbox root \(/i.test(error.message);

}

function withWorkspaceSafeTempHint(error: unknown): unknown {

if (!isSandboxRootEscapeError(error)) {

return error;

}

const message = error.message.includes(".openclaw/tmp/")

? error.message

: `${error.message}. Use a relative path under \`.openclaw/tmp/\` inside the workspace for scratch/temp/meta files that file tools need to read or write later.`;

return new Error(message, { cause: error });

}

async function assertSandboxPathWithinAnyRoot(params: {

filePath: string;

roots: readonly string[];

}

const additionalRoots =

guardedRoot === root && !workspaceMapping.matched ? (options?.additionalRoots ?? []) : [];

const sandboxResult = await assertSandboxPathWithinAnyRoot({

filePath: sandboxPath,

roots: [guardedRoot, ...additionalRoots],

});

let sandboxResult: Awaited<ReturnType<typeof assertSandboxPathWithinAnyRoot>>;

try {

sandboxResult = await assertSandboxPathWithinAnyRoot({

filePath: sandboxPath,

roots: [guardedRoot, ...additionalRoots],

});

} catch (error) {

throw withWorkspaceSafeTempHint(error);

}

if (options?.normalizeGuardedPathParams && record) {

normalizedRecord ??= { ...record };

normalizedRecord[key] = sandboxResult.resolved;

});

});

it("adds a workspace-safe temp hint when rejecting paths outside the workspace", async () => {

const { execute, tool } = createToolHarness();

const wrapped = wrapToolWorkspaceRootGuardWithOptions(tool, root, {

containerWorkdir: "/workspace",

});

mocks.assertSandboxPath.mockImplementationOnce(async () => {

throw new Error("Path escapes sandbox root (/tmp/root): /tmp/repo_meta.jsonl");

});

await expect(

wrapped.execute("tc-outside-temp", { path: "/tmp/repo_meta.jsonl" }),

).rejects.toThrow(

/Path escapes sandbox root .* Use a relative path under `.openclaw\/tmp\/` inside the workspace/,

);

expect(execute).not.toHaveBeenCalled();

});

it("maps additional container mounts to their own guarded host roots", async () => {

const { tool } = createToolHarness();

const agentRoot = "/tmp/agent-root";

import { buildModelAliasLines } from "./model-alias-lines.js";

import { resolveOwnerDisplaySetting } from "./owner-display.js";

import { buildAgentSystemPrompt } from "./system-prompt.js";

import { resolveEffectiveToolFsWorkspaceOnly } from "./tool-fs-policy.js";

type AgentSystemPromptRenderParams = Parameters<typeof buildAgentSystemPrompt>[0];

| "ttsHint"

| "modelAliasLines"

| "memoryCitationsMode"

| "fsWorkspaceOnly"

>;

export type ConfiguredAgentSystemPromptParams = AgentSystemPromptRenderParams & {

ttsHint: config ? buildTtsSystemPromptHint(config, agentId) : undefined,

modelAliasLines: buildModelAliasLines(config),

memoryCitationsMode: config?.memory?.citations,

fsWorkspaceOnly: resolveEffectiveToolFsWorkspaceOnly({ cfg: config, agentId }),

};

}

};

messageToolHints?: string[];

sandboxInfo?: EmbeddedSandboxInfo;

/** Whether read/write/edit/apply_patch are restricted to the workspace root. */

fsWorkspaceOnly?: boolean;

/** Reaction guidance for the agent (for Telegram minimal/extensive modes). */

reactionGuidance?: {

level: "minimal" | "extensive";

params.sandboxInfo?.enabled && sanitizedSandboxContainerWorkspace

? `For read/write/edit/apply_patch, file paths resolve against host workspace: ${sanitizedWorkspaceDir}. For bash/exec commands, use sandbox container paths under ${sanitizedSandboxContainerWorkspace} (or relative paths from that workdir), not host paths. Prefer relative paths so both sandboxed exec and file tools work consistently.`

: "Treat this directory as the single global workspace for file operations unless explicitly instructed otherwise.";

const workspaceOnlyGuidance =

params.fsWorkspaceOnly === true

? "tools.fs.workspaceOnly is enabled: scratch/temp/meta files that file tools must later read/write/edit must stay inside the workspace, preferably as relative paths under `.openclaw/tmp/`. Do not write files to `/tmp/...` with exec if a later read/write/edit/apply_patch tool needs them; use `.openclaw/tmp/...` instead."

: "";

const safetySection = [

"## Safety",

"No independent goals: no self-preservation, replication, resource acquisition, power-seeking, or long-term plans beyond the user's request.",

sandboxInfo: params.sandboxInfo,

displayWorkspaceDir,

workspaceGuidance,

workspaceOnlyGuidance,

workspaceNotes,

bootstrapMode: params.bootstrapMode,

bootstrapSystemPromptSections,

"## Workspace",

`Your working directory is: ${displayWorkspaceDir}`,

workspaceGuidance,

workspaceOnlyGuidance,

...workspaceNotes,

"",

...docsSection,