feat: stage guest diagnostics

[paulcam206]

What Problem This Solves

Later support workflows need a guest-side staging boundary without prematurely presenting a collection command as complete.

User Impact

This change only adds guest diagnostic staging. It does not expose a completed operator-facing diagnostics workflow.

Scope

The implementation stages the guest diagnostic material needed by a later layer. It intentionally defers all of the following:

• clawctl collect-logs command integration;
• redaction policy and redaction execution; and
• diagnostics bundle creation, manifesting, and output handling.

Why This Change Was Made

Keeping staging separate makes its guest-boundary contract reviewable without claiming that collection, sanitization, or packaging is available. Those capabilities belong to the follow-on diagnostics layer.

Current validation

Latest hosted follow-up: CodeQL traced diagnostic source operations to .NET's environment-sensitive profile lookup. The guest collector now resolves the Windows user profile known folder directly with SHGetKnownFolderPath; 16 focused collector tests, the static-analysis quality gate, the full 628-test suite, and an x64 NativeAOT session-host publish pass.

Latest review hardening: diagnostic collection opens guest sources and staging destinations by handle, rejects reparse redirection, verifies final paths remain under their trusted roots, and applies exclusions to the opened source object. Source-link and destination-link adversarial tests pass.

Latest authority-chain follow-up: host helper staging and guest diagnostic output now create directories and files relative to validated parent handles with NtCreateFile, so ancestor replacement cannot redirect a destructive create or truncate an outside sentinel. Automatic direct fallback validates any saved ownership first, and unlaunchable existing Node executables are treated as repairable. Focused authority/runtime/routing tests pass; integrated static analysis is warning-free and the full suite passes 642/642.

Final-effect containment follow-up: destination root and descendant handles now request share-enforced read/list access without delete sharing and remain open through file creation and copying, preventing same-volume relocation of the validated tree. Output files use create-new semantics rather than overwrite-or-create, so a pre-existing hard link cannot truncate its outside target. Focused Windows tests cover a populated directory relocation attempt and a hard-linked sentinel; 20/20 collector tests pass.

Current layer head: a6fe3ed09ad5f310572c3b02f247f0ddaa409fef. This layer is included in the final integrated stack tip cce2b02f3acd5791654b7a6b1a5a9c27db5ff63b rebased onto 685ee93b7ebbec1e784205a3544c460bea740e11.

Integrated local gates: exact .NET SDK 10.0.100; Test-DotNetQuality.ps1 with 0 warnings/errors; full solution tests 642/642; NativeAOT x64 and ARM64 publishes for both launcher and session host; NativeAOT CLI, deployment, MXC, signing, runtime-input, release-identity, bundle, isolation-plugin, and packaging-relevance policy suites.

Live x64 MXC evidence: final-tip Developer Mode deployment registered OpenClaw.Gateway_0.1.2451.40134_x64__kaa03rpbbqef6 from workflow payload run 35191206689; openclaw --version returned OpenClaw 2026.9.4 (3a9d69d); clawctl status confirmed the isolated session was running. Earlier final-tip validation also exercised setup, Node.js 24.20.0 reuse, package-qualified activation, detached gateway launch, and redacted diagnostics collection.

Signed package evidence: local NativeAOT x64 and ARM64 packages and a multi-architecture bundle were composed and test-signed. Elevated upgrade validation passed all four proof-release transitions (v0.0.0.0 and v0.0.0.1, standalone and bundle), retained package-family LocalState in every transition, and accepted fresh standalone and bundle installs. The temporary certificate and test package were removed, then the Developer Mode registration was restored.

Layer 8 of 12. Parent: #49 - feat/session-logon-recovery. Child: #51 - fix/session-lifecycle-recovery

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 17, 2026, 4:01 PM ET / 20:01 UTC (Revision 30).

ClawSweeper review

What this changes

Adds a guest helper mode and launcher protocol that copy selected agent-profile diagnostics into the shared workspace and report per-file outcomes.

Merge readiness

✅ Ready for maintainer review

This collaborator-authored PR remains distinct from current main. The earlier containment blockers are addressed, and no new blocking defect was found.

Priority: P2
Reviewed head: a6fe3ed09ad5f310572c3b02f247f0ddaa409fef

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused staging layer with resolved containment findings and useful filesystem regression coverage.
Proof confidence	🌊 off-meta tidepool	Not applicable: The ordinary proof gate is exempt for this collaborator-authored PR; inspection of the collector's final-I/O guards and adversarial coverage identified no unresolved authority case requiring an additional proof gate.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The ordinary proof gate is exempt for this collaborator-authored PR; inspection of the collector's final-I/O guards and adversarial coverage identified no unresolved authority case requiring an additional proof gate.
Evidence reviewed	7 items	Introduced scope: The pinned parent-to-head delta contains six files: collection dispatch, protocol, collector, launcher exchange, and tests. It does not introduce operator-facing collection, redaction, or bundling. Containment fixes: Source handles are checked before copying and exclusions use the resolved source name. Destination creation is relative to validated parent handles; directory handles retain read access without delete sharing, and output files use create-new semantics. Adversarial regression coverage: The collector tests exercise real filesystem operations, including source links, redirected destinations, directory relocation during creation, hard-linked output sentinels, live log handles, and deferred enumeration failures. These tests were inspected, not executed.
Findings	None	None.
Security	None	None.

How this fits together

The Windows launcher uses a helper inside the isolated agent account to access diagnostics that the host cannot read directly. Host-specified sources and exclusions enter the helper; staged files and collection results return through the shared workspace.

flowchart LR
 A[Host collection request] --> B[Isolated guest helper]
 C[Agent profile files] --> B
 B --> D[Validate paths and exclusions]
 D --> E[Create protected staging files]
 E --> F[Shared workspace]
 F --> G[Launcher reads collection result]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	Production +1180/-1 lines; tests +549/-0 lines	The growth implements the stated guest staging boundary, including Windows handle-based containment and focused regression coverage.

Technical review

Best possible solution:

Keep staging as a bounded internal operation, with sanitization and safe bundle export owned by the follow-on diagnostics layer.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR adds an internal capability rather than reporting a current-main bug; Windows regression tests were inspected but not run.

Is this the best way to solve the issue?

Yes: guest-side staging addresses the account-access boundary while keeping redaction and operator-facing export outside this layer.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 685ee93b7ebb.

Labels

Label justifications:

• P2: This is a bounded diagnostics foundation for the isolated Windows runtime, without an urgent shipped regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary proof gate is exempt for this collaborator-authored PR; inspection of the collector's final-I/O guards and adversarial coverage identified no unresolved authority case requiring an additional proof gate.

Evidence

What I checked:

• Introduced scope: The pinned parent-to-head delta contains six files: collection dispatch, protocol, collector, launcher exchange, and tests. It does not introduce operator-facing collection, redaction, or bundling. (src/OpenClaw.Launcher/Session/SessionExecutor.cs:165, a6fe3ed09ad5)
• Containment fixes: Source handles are checked before copying and exclusions use the resolved source name. Destination creation is relative to validated parent handles; directory handles retain read access without delete sharing, and output files use create-new semantics. (src/OpenClaw.SessionHost/SessionCollector.cs:295, a6fe3ed09ad5)
• Adversarial regression coverage: The collector tests exercise real filesystem operations, including source links, redirected destinations, directory relocation during creation, hard-linked output sentinels, live log handles, and deferred enumeration failures. These tests were inspected, not executed. (tests/OpenClaw.Launcher.Tests/Session/SessionCollectorTests.cs:146, a6fe3ed09ad5)
• Re-review continuity: GitHub Contents identifies the previous reviewed collector blob as 9b797d22634656d7f7dc720153611d08469d3f24, identical to this checkout. The previous and current collector-test blobs also match at 542d70a831518f95023feb934fbd030a799cc4de. Local comparison against the earlier commit was unavailable, so endpoint drift was not used to attribute changes. (src/OpenClaw.SessionHost/SessionCollector.cs, 88f8476c432f)
• Current-main and release boundary: The fetched default-branch tree has host diagnostic logging but no guest collector or collection protocol. The local v2026.9.4-msix.0 tag points to that same default-branch commit; this staging capability is not already implemented there. (src/OpenClaw.Launcher/HostDiagnosticLog.cs:32, 685ee93b7ebb)
• Contributor validation and scope: The captured PR body identifies this layer head and reports 20 passing collector tests, NativeAOT publishes, and integrated Windows deployment validation. Its version/status output does not independently demonstrate diagnostic staging. The collaborator explicitly defers redaction and bundle export; the ordinary external-contributor proof gate does not apply. (a6fe3ed09ad5)

Likely related people:

• paulcam206: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (29 earlier review cycles; latest 8 shown)

• reviewed 2026-09-17T16:31:37.632Z sha 51cc4e6 :: needs real behavior proof before merge. :: [P2] Validate source objects before copying through filesystem links | [P2] Constrain the complete destination before creating or truncating it
• reviewed 2026-09-17T16:38:30.768Z sha 8ea748b :: needs real behavior proof before merge. :: [P2] Validate source objects before copying through filesystem links | [P2] Constrain the complete destination before creating or truncating it
• reviewed 2026-09-17T16:55:56.859Z sha 728849c :: needs real behavior proof before merge. :: [P2] Validate source objects before copying through filesystem links | [P2] Constrain the complete destination before creating or truncating it
• reviewed 2026-09-17T17:04:36.753Z sha 728849c :: needs real behavior proof before merge. :: [P2] Validate source objects before copying through filesystem links | [P2] Constrain the complete destination before creating or truncating it
• reviewed 2026-09-17T18:19:06.371Z sha e01726d :: needs real behavior proof before merge. :: [P2] Validate destination authority before creating or truncating files
• reviewed 2026-09-17T19:01:11.580Z sha 982e79a :: needs real behavior proof before merge. :: [P2] Prevent validated destination directories from being renamed
• reviewed 2026-09-17T19:22:50.974Z sha a49dfdf :: needs real behavior proof before merge. :: [P2] Use directory access that actually enforces rename exclusion | [P2] Create staging outputs without overwriting existing hard links
• reviewed 2026-09-17T19:39:41.670Z sha 88f8476 :: needs maintainer review before merge. :: none

[paulcam206]

CodeQL aggregate check is stale: it failed at 00:25:25Z, before matching C# analyses completed successfully at 00:26:15Z and 00:26:42Z. The remediation commit is 1fbd7e5; CodeQL rerun is disabled for this workflow. Repo code-scanning reports no open alerts on this branch (the remaining six are on main).