feat: run OpenClaw in an owned isolated agent session

[paulcam206]

What Problem This Solves

Guest Node installation and persisted session ownership must be reliable before later gateway, recovery, and support workflows can depend on them.

User Impact

clawctl setup installs the agent-profile Node runtime, records a ready setup marker, and verifies that the saved sandbox identity belongs to this installation. openclaw routes through that owned session when isolation is selected.

Why This Change Was Made

The session lifecycle uses durable session.json and setup.json ownership records to provision or reuse the agent session, stage the helper, and make setup, status, and teardown explainable. The agent profile receives Node with PATH precedence; direct execution remains an explicit route.

Review fixes addressed

• Guest runtime installation uses the buffered MXC executor: stdin is closed, the operator console is not inherited, and a missing helper result includes captured executor output.
• Setup writes the ready marker before later commands require it, and persists the directory that actually contains node.exe rather than its parent directory.
• Session-state reads reject a sandbox identity issued to another application. The identity remains opaque when its ownership encoding cannot be read, preserving forward compatibility.
• Automatic-mode fallback is limited to a structurally identified unavailable-session capability. A foreign, mismatched, or unreadable owned-session record refuses before either the isolated or host launch path can run, rather than relocating the command into the signed-in user's profile.

Current validation

Latest hosted follow-up: CodeQL traced the runtime install destination to .NET's environment-sensitive Environment.GetFolderPath implementation. The session host now resolves the Windows LocalAppData known folder directly with SHGetKnownFolderPath before constructing any install path; focused installer tests, the 628-test suite, the static-analysis quality gate, and an x64 NativeAOT session-host publish pass.

Latest review hardening: helper staging now binds source and destination operations to validated handles and the pinned session generation; missing trusted reads preserve their specific diagnostic; existing agent Node is reused only after its executable reports the expected version; status includes recorded detail; and automatic routing performs capability preflight before requiring setup.

Latest authority-chain follow-up: host helper staging and guest diagnostic output now create directories and files relative to validated parent handles with NtCreateFile, so ancestor replacement cannot redirect a destructive create or truncate an outside sentinel. Automatic direct fallback validates any saved ownership first, and unlaunchable existing Node executables are treated as repairable. Focused authority/runtime/routing tests pass; integrated static analysis is warning-free and the full suite passes 642/642.

Product transition decision: this is a pre-release isolation stack with no supported legacy-user migration requirement. Automatic mode intentionally selects isolation on supported packaged hosts and requires explicit clawctl setup; it does not retain host-profile execution or copy host credentials/configuration into the isolated account. Explicit direct-host mode and unsupported-host fallback remain available, and saved ownership is validated before fallback.

Final directory-authority follow-up: trusted workspace roots and descendants now retain share-enforced read/list handles without delete sharing. CreateNew returns a stream that owns the complete protected directory chain until the write stream is disposed, so guest code cannot relocate a validated parent between creation and the final host write. Recursive cleanup holds traversal authority separately and obtains delete access only after child traversal. The focused relocation/cleanup set passes 39/39 and the settled integrated tree passes 642/642.

Current layer head: 47c7de26076bd91f9d1b8941e4658e479f067ea1. This layer is included in the final integrated stack tip cce2b02f3acd5791654b7a6b1a5a9c27db5ff63b rebased onto 685ee93b7ebbec1e784205a3544c460bea740e11.

Integrated local gates: exact .NET SDK 10.0.100; Test-DotNetQuality.ps1 with 0 warnings/errors; full solution tests 642/642; NativeAOT x64 and ARM64 publishes for both launcher and session host; NativeAOT CLI, deployment, MXC, signing, runtime-input, release-identity, bundle, isolation-plugin, and packaging-relevance policy suites.

Live x64 MXC evidence: final-tip Developer Mode deployment registered OpenClaw.Gateway_0.1.2451.40134_x64__kaa03rpbbqef6 from workflow payload run 35191206689; openclaw --version returned OpenClaw 2026.9.4 (3a9d69d); clawctl status confirmed the isolated session was running. Earlier final-tip validation also exercised setup, Node.js 24.20.0 reuse, package-qualified activation, detached gateway launch, and redacted diagnostics collection.

Signed package evidence: local NativeAOT x64 and ARM64 packages and a multi-architecture bundle were composed and test-signed. Elevated upgrade validation passed all four proof-release transitions (v0.0.0.0 and v0.0.0.1, standalone and bundle), retained package-family LocalState in every transition, and accepted fresh standalone and bundle installs. The temporary certificate and test package were removed, then the Developer Mode registration was restored.

Layer 4 of 12. Parent: #45 - feat/session-guest-execution. Child: #47 - feat/session-agent-shell

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 17, 2026, 4:01 PM ET / 20:01 UTC (Revision 28).

ClawSweeper review

What this changes

Adds owned isolated Windows sessions, setup/status/teardown commands, guest Node installation, and routing of OpenClaw commands into the agent account.

Merge readiness

⛔ Blocked before merge - 5 items remain

This remains useful work absent from main. The directory-relocation finding is addressed, and the pre-release profile transition is explicitly intentional; the remaining blocker is evidence that in-flight session authority cannot survive teardown.

Priority: P2
Reviewed head: 47c7de26076bd91f9d1b8941e4658e479f067ea1

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Useful implementation and positive Windows evidence address the prior code finding, but the remaining authority boundary prevents merge readiness.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: Authority-chain proof required: the captured integrated Windows report supports normal setup, isolated execution, and package upgrades, and the new regression exercises relocation protection through real filesystem operations. It does not show an already-staged request invalidated by teardown being rejected before guest execution. Only this authority-specific gap applies to the collaborator author. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: Authority-chain proof required: the captured integrated Windows report supports normal setup, isolated execution, and package upgrades, and the new regression exercises relocation protection through real filesystem operations. It does not show an already-staged request invalidated by teardown being rejected before guest execution. Only this authority-specific gap applies to the collaborator author. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	9 items	Current main and release still use host execution: Main's launcher resolves host Node and invokes GatewayLauncher with isolation disabled. Its source tree lacks the session lifecycle subsystem. The latest release tag points to this same revision. Release identity: The tag check returned v2026.9.4-msix.0 at the inspected main revision. Previous directory-relocation finding addressed: CreateNew now transfers the protected directory chain into the returned stream. Root and descendant handles request read access without delete sharing, retaining protection through the final write.
Findings	None	None.
Security	Needs attention	Revocation between request staging and execution remains unproven: The generation check precedes an asynchronous request write, while the next explicit check follows MXC execution. Available coverage rejects an already-stale record, but does not establish that teardown or replacement during this interval prevents the final guest process launch.

How this fits together

The Windows package launcher receives OpenClaw commands and selects host execution or an isolated agent account. Persisted ownership records and the MXC backend coordinate that account, while shared workspace files carry requests to its guest helper.

flowchart TD
  A[OpenClaw command] --> B[Select execution mode]
  B --> C[Direct host execution]
  B --> D[Validate setup and session ownership]
  D --> E[MXC isolated account]
  D --> F[Protected workspace request]
  F --> E
  E --> G[Guest helper and Node]
  G --> H[Command result]

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: Authority-chain proof required: the captured integrated Windows report supports normal setup, isolated execution, and package upgrades, and the new regression exercises relocation protection through real filesystem operations. It does not show an already-staged request invalidated by teardown being rejected before guest execution. Only this authority-specific gap applies to the collaborator author. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve security concern: Revocation between request staging and execution remains unproven - The generation check precedes an asynchronous request write, while the next explicit check follows MXC execution. Available coverage rejects an already-stale record, but does not establish that teardown or replacement during this interval prevents the final guest process launch.
• Resolve merge risk (P1) - A command staged before teardown can reach MXC without another launcher-side generation check; rejection before guest execution remains unproven.
• Resolve merge risk (P1) - Automatic isolation changes the account and profile used on supported packaged hosts and requires setup. The collaborator explicitly accepts this pre-release transition; host credentials and configuration are not migrated.
• Complete next step (P2) - Add Windows production-path evidence for revocation after request staging and before guest execution. Terminal output or logs are appropriate; redact credentials, private paths, IP addresses, and non-public endpoints.

Findings

• [medium] Revocation between request staging and execution remains unproven — src/OpenClaw.Launcher/Session/SessionExecutor.cs:147

Agent review details

Security

Needs attention: The relocation repair is present; in-flight revocation at the real execution boundary remains an evidence gap, not a confirmed exploit.

Review metrics

Metric	Value	Why it matters
Production and test growth	production +4,018 net lines; tests +3,082 net lines; 41 files	The stated lifecycle, ownership, guest-runtime, and filesystem-boundary responsibilities explain the production growth.

Merge-risk options

Maintainer options:

1. Establish revocation at the execution boundary (recommended)
   Provide production-path evidence that an owned command succeeds while a request invalidated after staging cannot execute, repairing dispatch ordering if that check fails.
2. Retain the documented pre-release transition
   Carry forward the explicit isolation-default decision and package-transition evidence without implying host-profile migration.

Technical review

Best possible solution:

Retain the accepted pre-release isolation model and protected workspace writes, with demonstrated rejection of revoked session authority before guest execution.

Do we have a high-confidence way to reproduce the issue?

Not applicable to the feature itself. The previous relocation defect has a focused regression; no failing current-head execution was established for the remaining revocation uncertainty.

Is this the best way to solve the issue?

Yes for the overall architecture: package-scoped ownership, guest-side runtime installation, and protected workspace operations fit this boundary. Final-effect revocation evidence is still needed before accepting the security contract.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 685ee93b7ebb.

Labels

Label justifications:

• P2: This is a substantial, bounded Windows isolation feature without evidence of an urgent shipped regression.
• merge-risk: 🚨 security-boundary: Persisted session authority crosses into an isolated account, and revocation during an in-flight dispatch remains unproven.
• merge-risk: 🚨 compatibility: The intentional automatic-isolation default changes the execution profile and setup requirements on supported packaged hosts.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Authority-chain proof required: the captured integrated Windows report supports normal setup, isolated execution, and package upgrades, and the new regression exercises relocation protection through real filesystem operations. It does not show an already-staged request invalidated by teardown being rejected before guest execution. Only this authority-specific gap applies to the collaborator author. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

Security concerns:

• [medium] Revocation between request staging and execution remains unproven — src/OpenClaw.Launcher/Session/SessionExecutor.cs:147
  The generation check precedes an asynchronous request write, while the next explicit check follows MXC execution. Available coverage rejects an already-stale record, but does not establish that teardown or replacement during this interval prevents the final guest process launch.
  Confidence: 0.88

What I checked:

• Current main and release still use host execution: Main's launcher resolves host Node and invokes GatewayLauncher with isolation disabled. Its source tree lacks the session lifecycle subsystem. The latest release tag points to this same revision. (src/OpenClaw.Launcher/Program.cs:151, 685ee93b7ebb)
• Release identity: The tag check returned v2026.9.4-msix.0 at the inspected main revision. (685ee93b7ebb)
• Previous directory-relocation finding addressed: CreateNew now transfers the protected directory chain into the returned stream. Root and descendant handles request read access without delete sharing, retaining protection through the final write. (src/OpenClaw.Launcher/Session/TrustedPath.cs:279, 47c7de26076b)
• Concrete relocation regression: CreatedFileRetainsDirectoryAuthorityUntilTheWriteCompletes attempts Directory.Move while the production workspace write stream is open, expects rejection, and verifies the write remains inside the workspace. This addresses the previous regression-coverage request. (tests/OpenClaw.Launcher.Tests/Session/SessionHelperStagerTests.cs:86, 47c7de26076b)
• Remaining in-flight authority uncertainty: Execution releases the startup lifecycle lock before request staging. The workspace checks generation before writing, but attached execution dispatches after that await and checks generation again only after execution. Teardown clears the ownership record after backend deprovision. The supplied evidence does not establish the final-effect ordering when teardown overlaps this interval. (src/OpenClaw.Launcher/Session/SessionExecutor.cs:147, 47c7de26076b)
• Existing stale-generation coverage is narrower: StaleSessionGenerationIsRejectedBeforeWritingARequest supplies an already-false generation predicate and a fake backend. It proves rejection before staging, but not revocation after staging or before the real backend launches a process. (tests/OpenClaw.Launcher.Tests/Session/SessionExecutorTests.cs:381, 47c7de26076b)

Likely related people:

• paulcam206: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Linus Huang: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Provide redacted production-path output showing an allowed command succeeds and the same path cannot launch after its staged session authority is invalidated by teardown.
• Update the PR body with that evidence to trigger a fresh review; if needed, ask a maintainer to comment @clawsweeper re-review.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (27 earlier review cycles; latest 8 shown)

• reviewed 2026-09-17T16:33:11.840Z sha 82d2864 :: needs real behavior proof before merge. :: [P1] [P1] Bind helper staging writes to protected destination objects | [P1] [P1] Resolve unsupported-host routing before requiring session setup | [P2] [P2] Display the recorded ownership rejection in status | [P2] [P2] Preserve missing-result diagnostics through the trusted reader
• reviewed 2026-09-17T16:38:28.788Z sha 82d2864 :: needs real behavior proof before merge. :: [P1] [P1] Bind helper staging writes to protected destination objects | [P1] [P1] Resolve unsupported-host routing before requiring session setup | [P2] [P2] Display the recorded ownership rejection in status | [P2] [P2] Preserve missing-result diagnostics through the trusted reader | [P2] [P2] Validate the existing guest runtime before reusing it
• reviewed 2026-09-17T16:56:46.634Z sha 82d2864 :: needs real behavior proof before merge. :: [P1] [P1] Bind helper staging writes to protected destination objects | [P1] [P1] Resolve unsupported-host routing before requiring session setup | [P2] [P2] Display the recorded ownership rejection in status | [P2] [P2] Preserve missing-result diagnostics through the trusted reader | [P2] [P2] Validate the existing guest runtime before reusing it
• reviewed 2026-09-17T17:05:23.291Z sha 82d2864 :: needs real behavior proof before merge. :: [P1] [P1] Bind helper staging writes to protected destination objects | [P1] [P1] Resolve unsupported-host routing before requiring session setup | [P2] [P2] Display the recorded ownership rejection in status | [P2] [P2] Preserve missing-result diagnostics through the trusted reader | [P2] [P2] Validate the existing guest runtime before reusing it
• reviewed 2026-09-17T18:19:54.224Z sha b934e40 :: needs real behavior proof before merge. :: [P1] [P1] Bind staging creation to protected parent objects | [P1] [P1] Validate existing ownership before automatic host fallback | [P2] [P2] Treat an unlaunchable existing Node executable as repairable
• reviewed 2026-09-17T19:01:54.400Z sha d7cfcde :: needs real behavior proof before merge. :: [P1] Bind helper cleanup to the validated parent handle
• reviewed 2026-09-17T19:23:22.676Z sha 130242b :: needs real behavior proof before merge. :: [P1] Preserve existing profiles until isolation is explicitly selected
• reviewed 2026-09-17T19:41:02.094Z sha 130242b :: needs real behavior proof before merge. :: [P1] Prevent staging directories from moving during host I/O

[paulcam206]

Correction: the merge conflict is real, not stale cache. Earlier evidence tested #46 head against its immediate base, which is a clean fast-forward, but the full stack has not been replayed onto current main. The stack root is 3a0491c while origin/main is e6cac4e; #46 is the first layer with a Program.cs overlap. Resolving via a full gh stack rebase from #43, preserving the stack relationship.