fix(sandbox): repair Shields removal regressions

Dockerfile

@@ -188,10 +188,7 @@ RUN --network=none install -d -o root -g root -m 0755 /out/wechat-npm-cache \
     && chown -R root:root /out/wechat-npm-cache \
     && chmod -R a+rX,go-w /out/wechat-npm-cache
 
-# Fetch every locked messaging archive outside RUN instructions. BuildKit
-# verifies the committed SHA-256 source pins before the selected architecture
-# enters the cache stage; SHA-512 verification against package-lock.json and
-# every package-materialization command then execute with networking disabled.
+# Offline messaging archives.
 FROM scratch AS openclaw-managed-messaging-npm-common-archives-1
 
 ADD --chmod=0444 --checksum=sha256:d98ffa76628ea162ddf7539b7b84ab851ef889689b16d454483456ba2e166d84 https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz /abort-controller-2.1.2.tgz
@@ -265,6 +262,7 @@ ADD --chmod=0444 --checksum=sha256:703cdecfa6951d9ad258f615ab96895750add3cb2d95e
 ADD --chmod=0444 --checksum=sha256:21d4a36175672b9e6640c39a68613af73f9a4c47a4a4da39993e8cd085564eb6 https://registry.npmjs.org/eventemitter3/-/eventemitter3-5.0.4.tgz /eventemitter3-5.0.4.tgz
 ADD --chmod=0444 --checksum=sha256:1773a16c02b4422653479b9c4d211268f7022bdac0d817b5698535bb485dd005 https://registry.npmjs.org/express/-/express-5.2.1.tgz /express-5.2.1.tgz
 ADD --chmod=0444 --checksum=sha256:1d91d0b0faa50cba223fa937c7b5a4a662968b1d78b3e59dca5c917dd5cf72b2 https://registry.npmjs.org/extend/-/extend-3.0.2.tgz /extend-3.0.2.tgz
+ADD --chmod=0444 --checksum=sha256:264af0e32c4b7b7bcb9ce5b4623c82469ee3e69ba5d171920f1762d626db1064 https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz /fast-uri-3.1.6.tgz
 ADD --chmod=0444 --checksum=sha256:54481d9c62debce1c38b0239f2358eeb3b73f7bb1ba3105bd6123fd81b8b7268 https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz /fetch-1.1.1.tgz
 ADD --chmod=0444 --checksum=sha256:4abf0d58a4977fce2240e08c280a2bc59f5363e9553a4f236cea6d74cce40c52 https://registry.npmjs.org/fetch-blob/-/fetch-blob-3.2.0.tgz /fetch-blob-3.2.0.tgz
 ADD --chmod=0444 --checksum=sha256:87fdc6557e71ec47373edfbde774165e976c760845d02733f81fbfe1ad232780 https://registry.npmjs.org/file-type/-/file-type-22.0.1.tgz /file-type-22.0.1.tgz
@@ -920,9 +918,7 @@ RUN --network=default \
         echo "ERROR: Base image has OpenClaw $CUR_VER, which is newer than reviewed target $OPENCLAW_VERSION" >&2; exit 1; \
     else \
         echo "INFO: Base image OpenClaw $CUR_VER lacks matching reviewed provenance; installing $OPENCLAW_VERSION"; \
-        # npm 10's atomic-move install can hit EROFS on overlayfs when the prior
-        # install spans image layers. Removing it first also prevents unreviewed
-        # files from surviving a same-version reinstall.
+        # Remove the stale overlayfs install before replacement.
         rm -rf /usr/local/lib/node_modules/openclaw /usr/local/bin/openclaw; \
         if [ "$OPENCLAW_VERSION" = "2026.7.1" ]; then \
             node --experimental-strip-types /scripts/lib/reviewed-npm-archive.mts --verify-lock \
@@ -964,6 +960,7 @@ RUN --network=default \
             rm -rf "$OPENCLAW_PACK_DIR"; \
         fi; \
     fi; \
+    if [ "$OPENCLAW_VERSION" = "2026.7.1" ]; then rm -rf /usr/local/lib/node_modules/fast-uri; ln -s /usr/local/lib/nemoclaw/openclaw-runtime/node_modules/fast-uri /usr/local/lib/node_modules/fast-uri; node -e 'require.resolve("fast-uri", { paths: ["/usr/local/lib/node_modules/openclaw"] })'; fi; \
     case "$OPENCLAW_VERSION" in \
         2026.3.11) npm ls -g --depth=1 openclaw tar >/dev/null ;; \
     esac; \
@@ -973,8 +970,7 @@ RUN --network=default \
         node --experimental-strip-types /scripts/lib/reviewed-npm-archive.mts --verify-only \
             --package-spec "mcporter@${MCPORTER_VERSION}" --integrity "$MCPORTER_EXPECTED_INTEGRITY" \
             --tarball-url "$MCPORTER_EXPECTED_TARBALL" --label "mcporter ${MCPORTER_VERSION}"; \
-        # Reinstall from the committed lock when matching protected base provenance
-        # is unavailable; matching top-level versions can hide transitive drift.
+        # Reinstall the committed lock when base provenance is unavailable.
         echo "INFO: Installing locked mcporter $MCPORTER_VERSION dependency graph"; \
         rm -rf /usr/local/lib/node_modules/mcporter /usr/local/bin/mcporter; \
         npm --prefix /usr/local/lib/nemoclaw/mcporter-runtime ci \
@@ -997,7 +993,7 @@ node --experimental-strip-types /scripts/lib/npm-audit-receipt.mts \
             --package-json /usr/local/lib/nemoclaw/mcporter-runtime/package.json \
             --package-lock /usr/local/lib/nemoclaw/mcporter-runtime/package-lock.json \
             --raw-report "$MCPORTER_RAW_REPORT" --exceptions /scripts/npm-audit-exceptions.json \
-            --graph mcporter-runtime --npm-version "$(npm --version)" \
+            --graph mcporter-runtime --npm-version "10.9.4" \
 --registry https://registry.yarnpkg.com --threshold high --legacy-npmjs true; \
     else \
         node --experimental-strip-types /scripts/lib/reviewed-npm-audit.mts \
@@ -1917,7 +1913,7 @@ RUN managed_runtime_assertion_failed() { \
     && test -f /usr/local/lib/nemoclaw/managed-bootstrap-trampoline.sh \
     && test ! -L /usr/local/lib/nemoclaw/managed-bootstrap-trampoline.sh \
     && test "$(stat -c '%u:%g:%a' /usr/local/lib/nemoclaw/managed-bootstrap-trampoline.sh)" = '0:0:444' \
-    && install -d -o root -g root -m 0755 /run/nemoclaw
+    && install -d -o root -g root -m 0755 /run/nemoclaw /etc/nemoclaw
 
 # Copy startup script and shared sandbox initialisation library.
 RUN chmod 755 /usr/local/bin/nemoclaw-start /usr/local/bin/nemoclaw-codex-acp \

Dockerfile.base

@@ -593,7 +593,7 @@ RUN --mount=type=bind,source=nemoclaw-blueprint/blueprint.yaml,target=/tmp/bluep
             --package-json /usr/local/lib/nemoclaw/mcporter-runtime/package.json \
             --package-lock /usr/local/lib/nemoclaw/mcporter-runtime/package-lock.json \
             --raw-report "$MCPORTER_RAW_REPORT" --exceptions /scripts/npm-audit-exceptions.json \
-            --graph mcporter-runtime --npm-version "$(npm --version)" \
+            --graph mcporter-runtime --npm-version "10.9.4" \
             --registry https://registry.yarnpkg.com --threshold high \
             --legacy-npmjs true \
             --result /tmp/mcporter-npm-audit-policy.json; \

agents/hermes/Dockerfile

@@ -1192,7 +1192,6 @@ RUN set -eu; \
     rm -rf /root/.cache/pip /sandbox/.cache \
     && chown -R sandbox:sandbox /sandbox/.hermes \
     && chown gateway:sandbox \
-        /sandbox/.hermes/cron \
         /sandbox/.hermes/gateway \
         /sandbox/.hermes/runtime \
     && chmod 3770 /sandbox/.hermes \

agents/hermes/hermes-wrapper.py

@@ -82,6 +82,7 @@
 import ast
 import json
 import os
+import pwd
 import re
 import stat
 import subprocess
@@ -102,6 +103,7 @@
 _CLI_ADAPTER_DEV_FILENAME = "hermes-cli-adapter-v1.json"
 _HERMES_MAIN_DEV_FILENAME = "hermes-main.py"
 _GATEWAY_LAZY_INSTALL_TARGET = "/run/nemoclaw/hermes-gateway-lazy-packages"
+_SANDBOX_LAZY_INSTALL_TARGET = "/sandbox/.hermes/lazy-packages"
 _MANAGED_BUNDLED_PLUGINS = "/opt/hermes/plugins"
 _MANAGED_HERMES_HOME = "/sandbox/.hermes"
 _MANAGED_HOME = "/sandbox"
@@ -355,13 +357,25 @@
     return subprocess.call([python3, "-I", guard_path, "runtime-env"])
 
 
-def _harden_root_separated_gateway_package_env() -> None:
+def _managed_gateway_lazy_install_target() -> str:
+    """Return the identity-specific reviewed lazy-install directory."""
+
+    try:
+        if os.geteuid() == pwd.getpwnam("gateway").pw_uid:
+            return _GATEWAY_LAZY_INSTALL_TARGET
+    except KeyError:
+        pass
+    return _SANDBOX_LAZY_INSTALL_TARGET
+
+
+def _harden_gateway_package_env(lazy_install_target: str) -> None:
     """Remove sandbox-controlled installer inputs before gateway exec."""
 
     for key in tuple(os.environ):
         if key in _GATEWAY_PACKAGE_ENV_KEYS or key.startswith(_GATEWAY_PACKAGE_ENV_PREFIXES):
             os.environ.pop(key, None)
     os.environ.update(_GATEWAY_PACKAGE_ENV)
+    os.environ["UV_CACHE_DIR"] = f"{lazy_install_target}/.uv-cache"
 
 
 _SUPPORTED_CLI_ADAPTER_VERSION = 1
@@ -782,11 +796,12 @@
                 file=sys.stderr,
             )
             return 1
+        lazy_install_target = _managed_gateway_lazy_install_target()
         os.environ["HERMES_HOME"] = _MANAGED_HERMES_HOME
         os.environ["HERMES_BUNDLED_PLUGINS"] = _MANAGED_BUNDLED_PLUGINS
-        os.environ["HERMES_LAZY_INSTALL_TARGET"] = _GATEWAY_LAZY_INSTALL_TARGET
+        os.environ["HERMES_LAZY_INSTALL_TARGET"] = lazy_install_target
         os.environ["HOME"] = _MANAGED_HOME
-        _harden_root_separated_gateway_package_env()
+        _harden_gateway_package_env(lazy_install_target)
         rc = _run_gateway_guard(guard_path)
         if rc != 0:
             return rc

agents/hermes/start.sh

@@ -1139,6 +1139,10 @@ repair_hermes_startup_layout() {
   fi
 
   ensure_hermes_config_root_mode || return 1
+  # Cron definitions are sandbox-owned mutable state. Hermes can recreate this
+  # directory with a private umask; restore the shared sandbox-group mode before
+  # each managed gateway launch so the sandbox identity can back it up.
+  ensure_hermes_state_dir "${HERMES_DIR}/cron" 2770 || return 1
   repair_hermes_log_permissions || return 1
   ensure_hermes_state_dir "${HERMES_DIR}/hooks" 770 || return 1
   ensure_hermes_state_dir "${HERMES_DIR}/image_cache" 770 || return 1
@@ -2949,7 +2953,7 @@ launch_hermes_gateway_current_user() {
 
 HERMES_MANAGED_GATEWAY_EXIT_TIMES=()
 HERMES_MANAGED_GATEWAY_EXIT_COUNT=0
-readonly HERMES_MANAGED_EXPECTED_EXIT_DIR="/run/nemoclaw"
+readonly HERMES_MANAGED_EXPECTED_EXIT_DIR="/etc/nemoclaw/gateway-control"
 readonly HERMES_MANAGED_EXPECTED_EXIT_MARKER="managed-gateway-expected-exit"
 readonly HERMES_MANAGED_CONTROLLER_PATH="/usr/local/lib/nemoclaw/managed-gateway-control.py"
 

agents/openclaw/managed-image-messaging-runtime/package.json

@@ -14,6 +14,7 @@
     "@tencent-weixin/openclaw-weixin": "2.4.3",
     "agent-base": "6.0.2",
     "axios": "1.18.0",
+    "fast-uri": "3.1.6",
     "https-proxy-agent": "5.0.1",
     "undici": "8.10.0"
   },

scripts/lib/gateway-supervisor.sh

@@ -240,7 +240,7 @@ EOF
   return 1
 }
 
-NEMOCLAW_MANAGED_EXPECTED_EXIT_DIR="/run/nemoclaw"
+NEMOCLAW_MANAGED_EXPECTED_EXIT_DIR="/etc/nemoclaw/gateway-control"
 NEMOCLAW_MANAGED_EXPECTED_EXIT_MARKER="managed-gateway-expected-exit"
 NEMOCLAW_MANAGED_CONTROLLER_PATH="/usr/local/lib/nemoclaw/managed-gateway-control.py"
 

scripts/lib/openclaw-npm-remediation.mts

@@ -156,7 +156,7 @@ const REMEDIATIONS: Readonly<Record<string, Remediation>> = Object.freeze({
   },
   "@openclaw/slack@2026.7.1": {
     expectedPatchedTreeIntegrity:
-      "sha512-4ThnsNS+yBlFSkTaQn2xosxrDu1s0vrxcqka5QqFj+8dCEaTa9JVLRgNniYV/QNhO53wc7a2R5oQFElzYspT2w==",
+      "sha512-WvkzDMT9uDyWZop858eli9vbkuna1JgWpTdAt9e1zm008uc9YJqcCoLxB4WqATThBg93j317bobMjDK1GGGMWA==",
     kind: "axios",
     version: "2026.7.1",
   },
@@ -452,6 +452,7 @@ export function patchOpenClawPluginPackageGraph(
   const versionAt = packageSpec.lastIndexOf("@");
   const expectedName = packageSpec.slice(0, versionAt);
   const expectedVersion = packageSpec.slice(versionAt + 1);
+  const addFastUri = packageSpec === "@openclaw/slack@2026.7.1";
   requirePackageIdentity(packageJson, expectedName, expectedVersion, "OpenClaw plugin");
   if (packageJson.dependencies?.axios !== undefined) {
     throw new Error(`${packageSpec} already declares axios; review the remediation boundary`);
@@ -462,8 +463,19 @@ export function patchOpenClawPluginPackageGraph(
   if (packageJson.bundledDependencies.includes("axios")) {
     throw new Error(`${packageSpec} already bundles axios; review the remediation boundary`);
   }
-  packageJson.dependencies = sortedObject({ ...packageJson.dependencies, axios: AXIOS_VERSION });
-  packageJson.bundledDependencies = [...packageJson.bundledDependencies, "axios"];
+  if (addFastUri && packageJson.dependencies?.["fast-uri"] !== undefined) {
+    throw new Error(`${packageSpec} already declares fast-uri; review the remediation boundary`);
+  }
+  packageJson.dependencies = sortedObject({
+    ...packageJson.dependencies,
+    axios: AXIOS_VERSION,
+    ...(addFastUri ? { "fast-uri": CURRENT_FAST_URI_VERSION } : {}),
+  });
+  packageJson.bundledDependencies = [
+    ...packageJson.bundledDependencies,
+    "axios",
+    ...(addFastUri ? ["fast-uri"] : []),
+  ];
 
   const shrinkwrap = readJson(shrinkwrapPath);
   if (shrinkwrap.lockfileVersion !== 3 || !shrinkwrap.packages?.[""]) {
@@ -515,6 +527,22 @@ export function patchOpenClawPluginPackageGraph(
     dependencies: { debug: "4" },
     engines: { node: ">= 6.0.0" },
   };
+  if (addFastUri) {
+    const fastUriKey = "node_modules/fast-uri";
+    if (shrinkwrap.packages[fastUriKey]) {
+      throw new Error(`${packageSpec} already has the fast-uri remediation`);
+    }
+    shrinkwrap.packages[fastUriKey] = {
+      version: CURRENT_FAST_URI_VERSION,
+      resolved: CURRENT_FAST_URI_TARBALL,
+      integrity: CURRENT_FAST_URI_INTEGRITY,
+      license: "BSD-3-Clause",
+      funding: [
+        { type: "github", url: "https://github.com/sponsors/fastify" },
+        { type: "opencollective", url: "https://opencollective.com/fastify" },
+      ],
+    };
+  }
 
   writeJson(packageJsonPath, packageJson);
   writeJson(shrinkwrapPath, shrinkwrap);
@@ -1243,6 +1271,16 @@ export function buildRemediatedOpenClawPluginArchive(
       remediationRoot,
       env,
     );
+    const fastUriArchive =
+      request.packageSpec === "@openclaw/slack@2026.7.1"
+        ? packReplacement(
+            `fast-uri@${CURRENT_FAST_URI_VERSION}`,
+            CURRENT_FAST_URI_INTEGRITY,
+            CURRENT_FAST_URI_TARBALL,
+            remediationRoot,
+            env,
+          )
+        : undefined;
     const axiosPackage = extractArchive(
       axiosArchive.archivePath,
       join(remediationRoot, "axios"),
@@ -1261,6 +1299,14 @@ export function buildRemediatedOpenClawPluginArchive(
       remediationRoot,
       env,
     );
+    const fastUriPackage = fastUriArchive
+      ? extractArchive(
+          fastUriArchive.archivePath,
+          join(remediationRoot, "fast-uri"),
+          remediationRoot,
+          env,
+        )
+      : undefined;
     const axiosPackageJson = readJson(join(axiosPackage, "package.json"));
     const httpsProxyAgentPackageJson = readJson(join(httpsProxyAgentPackage, "package.json"));
     const agentBasePackageJson = readJson(join(agentBasePackage, "package.json"));
@@ -1304,6 +1350,9 @@ export function buildRemediatedOpenClawPluginArchive(
       agentBasePackage,
       join(axiosTarget, "node_modules", "https-proxy-agent", "node_modules", "agent-base"),
     );
+    if (fastUriPackage) {
+      copyReplacementPackage(fastUriPackage, join(sourcePackage, "node_modules", "fast-uri"));
+    }
     patchOpenClawPluginPackageGraph(sourcePackage, request.packageSpec);
   } else {
     const jaegerArchive = packReplacement(

scripts/managed-gateway-control.py

@@ -84,7 +84,7 @@
 POLL_SECONDS = 0.2
 PROCESS_PROOF_GRACE_SECONDS = 1.0
 PROCESS_PROOF_RETRY_SECONDS = 0.05
-NEMOCLAW_RUNTIME_DIR = "/run/nemoclaw"
+NEMOCLAW_RUNTIME_DIR = "/etc/nemoclaw/gateway-control"
 NEMOCLAW_RUNTIME_DIR_MODE = 0o711
 EXPECTED_EXIT_MARKER_NAME = "managed-gateway-expected-exit"
 EXPECTED_EXIT_LOCK_NAME = "managed-gateway-expected-exit.lock"

scripts/nemoclaw-start.sh

@@ -5807,6 +5807,48 @@ handle_openclaw_gateway_control_request() {
   gateway_control_complete ok "$old_pid" "$GATEWAY_PID"
 }
 
+restore_openclaw_weixin_extension_link() {
+  local state_root=/sandbox/.openclaw
+  local extension="$state_root/extensions/openclaw-weixin"
+  local projects="$state_root/npm/projects"
+  local project candidate selected=""
+
+  if [ -e "$extension" ]; then
+    [ -d "$extension" ] || {
+      echo "[SECURITY] refusing non-directory OpenClaw WeChat extension path" >&2
+      return 1
+    }
+    return 0
+  fi
+  if [ -L "$extension" ]; then
+    echo "[SECURITY] refusing broken OpenClaw WeChat extension link" >&2
+    return 1
+  fi
+  if [ ! -d "$projects" ] || [ -L "$projects" ]; then
+    return 0
+  fi
+
+  for project in "$projects"/*; do
+    if [ ! -d "$project" ] || [ -L "$project" ]; then
+      continue
+    fi
+    candidate="$project/node_modules/@tencent-weixin/openclaw-weixin"
+    if [ ! -f "$candidate/package.json" ] || [ -L "$candidate/package.json" ]; then
+      continue
+    fi
+    node -e 'const p=require(process.argv[1]); process.exit(p.name==="@tencent-weixin/openclaw-weixin"&&p.version==="2.4.3"?0:1)' \
+      "$candidate/package.json" || continue
+    [ -z "$selected" ] || {
+      echo "[SECURITY] refusing ambiguous OpenClaw WeChat package projects" >&2
+      return 1
+    }
+    selected="$candidate"
+  done
+  [ -n "$selected" ] || return 0
+  mkdir -p "$state_root/extensions"
+  ln -s "$selected" "$extension"
+}
+
 # ── Main ─────────────────────────────────────────────────────────
 
 # OpenClaw 2026.7.1 enforces owner-only SQLite and models-file modes on every
@@ -5834,6 +5876,7 @@ fi
 # Migrate legacy symlink layout before anything else reads .openclaw
 migrate_legacy_layout "/sandbox/.openclaw" "/sandbox/.openclaw-data" "openclaw" || exit 1
 remove_openclaw_legacy_update_check_state || exit 1
+restore_openclaw_weixin_extension_link || exit 1
 
 echo 'Setting up NemoClaw...' >&2
 # Best-effort: .env may not exist.