mirror of
https://github.com/openclaw/openclaw.git
synced 2026-03-19 14:00:51 +00:00
docs: fix tools nav A-Z, split plugin page, consolidate sandbox docs, add OpenShell page (#50055)
* docs: fix A-Z built-in tools nav, split plugin page, consolidate sandbox docs * docs: add dedicated OpenShell sandbox backend page * style: format markdown tables * docs: trim plugin page, restructure available plugins into table + categories
This commit is contained in:
Vincent Koc
@@ -990,9 +990,8 @@
|
||||
"pages": [
|
||||
"tools/apply-patch",
|
||||
"brave-search",
|
||||
"perplexity",
|
||||
"tools/btw",
|
||||
"tools/diffs",
|
||||
"tools/pdf",
|
||||
"tools/elevated",
|
||||
"tools/exec",
|
||||
"tools/exec-approvals",
|
||||
@@ -1000,10 +999,11 @@
|
||||
"tools/llm-task",
|
||||
"tools/lobster",
|
||||
"tools/loop-detection",
|
||||
"tools/pdf",
|
||||
"perplexity",
|
||||
"tools/reactions",
|
||||
"tools/thinking",
|
||||
"tools/web",
|
||||
"tools/btw"
|
||||
"tools/web"
|
||||
]
|
||||
},
|
||||
{
|
||||
@@ -1038,6 +1038,7 @@
|
||||
"group": "Extensions",
|
||||
"pages": [
|
||||
"plugins/building-extensions",
|
||||
"plugins/architecture",
|
||||
"plugins/community",
|
||||
"plugins/bundles",
|
||||
"plugins/voice-call",
|
||||
@@ -1208,6 +1209,7 @@
|
||||
"pages": [
|
||||
"gateway/security/index",
|
||||
"gateway/sandboxing",
|
||||
"gateway/openshell",
|
||||
"gateway/sandbox-vs-tool-policy-vs-elevated"
|
||||
]
|
||||
},
|
||||
@@ -1581,13 +1583,13 @@
|
||||
"pages": [
|
||||
"zh-CN/tools/apply-patch",
|
||||
"zh-CN/brave-search",
|
||||
"zh-CN/perplexity",
|
||||
"zh-CN/tools/elevated",
|
||||
"zh-CN/tools/exec",
|
||||
"zh-CN/tools/exec-approvals",
|
||||
"zh-CN/tools/firecrawl",
|
||||
"zh-CN/tools/llm-task",
|
||||
"zh-CN/tools/lobster",
|
||||
"zh-CN/perplexity",
|
||||
"zh-CN/tools/reactions",
|
||||
"zh-CN/tools/thinking",
|
||||
"zh-CN/tools/web"
|
||||
@@ -1623,6 +1625,7 @@
|
||||
{
|
||||
"group": "扩展",
|
||||
"pages": [
|
||||
"zh-CN/plugins/architecture",
|
||||
"zh-CN/plugins/voice-call",
|
||||
"zh-CN/plugins/zalouser",
|
||||
"zh-CN/plugins/manifest",
|
||||
|
||||
307
docs/gateway/openshell.md
Normal file
307
docs/gateway/openshell.md
Normal file
@@ -0,0 +1,307 @@
|
||||
---
|
||||
title: OpenShell
|
||||
summary: "Use OpenShell as a managed sandbox backend for OpenClaw agents"
|
||||
read_when:
|
||||
- You want cloud-managed sandboxes instead of local Docker
|
||||
- You are setting up the OpenShell plugin
|
||||
- You need to choose between mirror and remote workspace modes
|
||||
---
|
||||
|
||||
# OpenShell
|
||||
|
||||
OpenShell is a managed sandbox backend for OpenClaw. Instead of running Docker
|
||||
containers locally, OpenClaw delegates sandbox lifecycle to the `openshell` CLI,
|
||||
which provisions remote environments with SSH-based command execution.
|
||||
|
||||
The OpenShell plugin reuses the same core SSH transport and remote filesystem
|
||||
bridge as the generic [SSH backend](/gateway/sandboxing#ssh-backend). It adds
|
||||
OpenShell-specific lifecycle (`sandbox create/get/delete`, `sandbox ssh-config`)
|
||||
and an optional `mirror` workspace mode.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- The `openshell` CLI installed and on `PATH` (or set a custom path via
|
||||
`plugins.entries.openshell.config.command`)
|
||||
- An OpenShell account with sandbox access
|
||||
- OpenClaw Gateway running on the host
|
||||
|
||||
## Quick start
|
||||
|
||||
1. Enable the plugin and set the sandbox backend:
|
||||
|
||||
```json5
|
||||
{
|
||||
agents: {
|
||||
defaults: {
|
||||
sandbox: {
|
||||
mode: "all",
|
||||
backend: "openshell",
|
||||
scope: "session",
|
||||
workspaceAccess: "rw",
|
||||
},
|
||||
},
|
||||
},
|
||||
plugins: {
|
||||
entries: {
|
||||
openshell: {
|
||||
enabled: true,
|
||||
config: {
|
||||
from: "openclaw",
|
||||
mode: "remote",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
```
|
||||
|
||||
2. Restart the Gateway. On the next agent turn, OpenClaw creates an OpenShell
|
||||
sandbox and routes tool execution through it.
|
||||
|
||||
3. Verify:
|
||||
|
||||
```bash
|
||||
openclaw sandbox list
|
||||
openclaw sandbox explain
|
||||
```
|
||||
|
||||
## Workspace modes
|
||||
|
||||
This is the most important decision when using OpenShell.
|
||||
|
||||
### `mirror`
|
||||
|
||||
Use `plugins.entries.openshell.config.mode: "mirror"` when you want the **local
|
||||
workspace to stay canonical**.
|
||||
|
||||
Behavior:
|
||||
|
||||
- Before `exec`, OpenClaw syncs the local workspace into the OpenShell sandbox.
|
||||
- After `exec`, OpenClaw syncs the remote workspace back to the local workspace.
|
||||
- File tools still operate through the sandbox bridge, but the local workspace
|
||||
remains the source of truth between turns.
|
||||
|
||||
Best for:
|
||||
|
||||
- You edit files locally outside OpenClaw and want those changes visible in the
|
||||
sandbox automatically.
|
||||
- You want the OpenShell sandbox to behave as much like the Docker backend as
|
||||
possible.
|
||||
- You want the host workspace to reflect sandbox writes after each exec turn.
|
||||
|
||||
Tradeoff: extra sync cost before and after each exec.
|
||||
|
||||
### `remote`
|
||||
|
||||
Use `plugins.entries.openshell.config.mode: "remote"` when you want the
|
||||
**OpenShell workspace to become canonical**.
|
||||
|
||||
Behavior:
|
||||
|
||||
- When the sandbox is first created, OpenClaw seeds the remote workspace from
|
||||
the local workspace once.
|
||||
- After that, `exec`, `read`, `write`, `edit`, and `apply_patch` operate
|
||||
directly against the remote OpenShell workspace.
|
||||
- OpenClaw does **not** sync remote changes back into the local workspace.
|
||||
- Prompt-time media reads still work because file and media tools read through
|
||||
the sandbox bridge.
|
||||
|
||||
Best for:
|
||||
|
||||
- The sandbox should live primarily on the remote side.
|
||||
- You want lower per-turn sync overhead.
|
||||
- You do not want host-local edits to silently overwrite remote sandbox state.
|
||||
|
||||
Important: if you edit files on the host outside OpenClaw after the initial seed,
|
||||
the remote sandbox does **not** see those changes. Use
|
||||
`openclaw sandbox recreate` to re-seed.
|
||||
|
||||
### Choosing a mode
|
||||
|
||||
| | `mirror` | `remote` |
|
||||
| ------------------------ | -------------------------- | ------------------------- |
|
||||
| **Canonical workspace** | Local host | Remote OpenShell |
|
||||
| **Sync direction** | Bidirectional (each exec) | One-time seed |
|
||||
| **Per-turn overhead** | Higher (upload + download) | Lower (direct remote ops) |
|
||||
| **Local edits visible?** | Yes, on next exec | No, until recreate |
|
||||
| **Best for** | Development workflows | Long-running agents, CI |
|
||||
|
||||
## Configuration reference
|
||||
|
||||
All OpenShell config lives under `plugins.entries.openshell.config`:
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
| ------------------------- | ------------------------ | ------------- | ----------------------------------------------------- |
|
||||
| `mode` | `"mirror"` or `"remote"` | `"mirror"` | Workspace sync mode |
|
||||
| `command` | `string` | `"openshell"` | Path or name of the `openshell` CLI |
|
||||
| `from` | `string` | `"openclaw"` | Sandbox source for first-time create |
|
||||
| `gateway` | `string` | — | OpenShell gateway name (`--gateway`) |
|
||||
| `gatewayEndpoint` | `string` | — | OpenShell gateway endpoint URL (`--gateway-endpoint`) |
|
||||
| `policy` | `string` | — | OpenShell policy ID for sandbox creation |
|
||||
| `providers` | `string[]` | `[]` | Provider names to attach when sandbox is created |
|
||||
| `gpu` | `boolean` | `false` | Request GPU resources |
|
||||
| `autoProviders` | `boolean` | `true` | Pass `--auto-providers` during sandbox create |
|
||||
| `remoteWorkspaceDir` | `string` | `"/sandbox"` | Primary writable workspace inside the sandbox |
|
||||
| `remoteAgentWorkspaceDir` | `string` | `"/agent"` | Agent workspace mount path (for read-only access) |
|
||||
| `timeoutSeconds` | `number` | `120` | Timeout for `openshell` CLI operations |
|
||||
|
||||
Sandbox-level settings (`mode`, `scope`, `workspaceAccess`) are configured under
|
||||
`agents.defaults.sandbox` as with any backend. See
|
||||
[Sandboxing](/gateway/sandboxing) for the full matrix.
|
||||
|
||||
## Examples
|
||||
|
||||
### Minimal remote setup
|
||||
|
||||
```json5
|
||||
{
|
||||
agents: {
|
||||
defaults: {
|
||||
sandbox: {
|
||||
mode: "all",
|
||||
backend: "openshell",
|
||||
},
|
||||
},
|
||||
},
|
||||
plugins: {
|
||||
entries: {
|
||||
openshell: {
|
||||
enabled: true,
|
||||
config: {
|
||||
from: "openclaw",
|
||||
mode: "remote",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
```
|
||||
|
||||
### Mirror mode with GPU
|
||||
|
||||
```json5
|
||||
{
|
||||
agents: {
|
||||
defaults: {
|
||||
sandbox: {
|
||||
mode: "all",
|
||||
backend: "openshell",
|
||||
scope: "agent",
|
||||
workspaceAccess: "rw",
|
||||
},
|
||||
},
|
||||
},
|
||||
plugins: {
|
||||
entries: {
|
||||
openshell: {
|
||||
enabled: true,
|
||||
config: {
|
||||
from: "openclaw",
|
||||
mode: "mirror",
|
||||
gpu: true,
|
||||
providers: ["openai"],
|
||||
timeoutSeconds: 180,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
```
|
||||
|
||||
### Per-agent OpenShell with custom gateway
|
||||
|
||||
```json5
|
||||
{
|
||||
agents: {
|
||||
defaults: {
|
||||
sandbox: { mode: "off" },
|
||||
},
|
||||
list: [
|
||||
{
|
||||
id: "researcher",
|
||||
sandbox: {
|
||||
mode: "all",
|
||||
backend: "openshell",
|
||||
scope: "agent",
|
||||
workspaceAccess: "rw",
|
||||
},
|
||||
},
|
||||
],
|
||||
},
|
||||
plugins: {
|
||||
entries: {
|
||||
openshell: {
|
||||
enabled: true,
|
||||
config: {
|
||||
from: "openclaw",
|
||||
mode: "remote",
|
||||
gateway: "lab",
|
||||
gatewayEndpoint: "https://lab.example",
|
||||
policy: "strict",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
```
|
||||
|
||||
## Lifecycle management
|
||||
|
||||
OpenShell sandboxes are managed through the normal sandbox CLI:
|
||||
|
||||
```bash
|
||||
# List all sandbox runtimes (Docker + OpenShell)
|
||||
openclaw sandbox list
|
||||
|
||||
# Inspect effective policy
|
||||
openclaw sandbox explain
|
||||
|
||||
# Recreate (deletes remote workspace, re-seeds on next use)
|
||||
openclaw sandbox recreate --all
|
||||
```
|
||||
|
||||
For `remote` mode, **recreate is especially important**: it deletes the canonical
|
||||
remote workspace for that scope. The next use seeds a fresh remote workspace from
|
||||
the local workspace.
|
||||
|
||||
For `mirror` mode, recreate mainly resets the remote execution environment because
|
||||
the local workspace remains canonical.
|
||||
|
||||
### When to recreate
|
||||
|
||||
Recreate after changing any of these:
|
||||
|
||||
- `agents.defaults.sandbox.backend`
|
||||
- `plugins.entries.openshell.config.from`
|
||||
- `plugins.entries.openshell.config.mode`
|
||||
- `plugins.entries.openshell.config.policy`
|
||||
|
||||
```bash
|
||||
openclaw sandbox recreate --all
|
||||
```
|
||||
|
||||
## Current limitations
|
||||
|
||||
- Sandbox browser is not supported on the OpenShell backend.
|
||||
- `sandbox.docker.binds` does not apply to OpenShell.
|
||||
- Docker-specific runtime knobs under `sandbox.docker.*` apply only to the Docker
|
||||
backend.
|
||||
|
||||
## How it works
|
||||
|
||||
1. OpenClaw calls `openshell sandbox create` (with `--from`, `--gateway`,
|
||||
`--policy`, `--providers`, `--gpu` flags as configured).
|
||||
2. OpenClaw calls `openshell sandbox ssh-config <name>` to get SSH connection
|
||||
details for the sandbox.
|
||||
3. Core writes the SSH config to a temp file and opens an SSH session using the
|
||||
same remote filesystem bridge as the generic SSH backend.
|
||||
4. In `mirror` mode: sync local to remote before exec, run, sync back after exec.
|
||||
5. In `remote` mode: seed once on create, then operate directly on the remote
|
||||
workspace.
|
||||
|
||||
## See also
|
||||
|
||||
- [Sandboxing](/gateway/sandboxing) -- modes, scopes, and backend comparison
|
||||
- [Sandbox vs Tool Policy vs Elevated](/gateway/sandbox-vs-tool-policy-vs-elevated) -- debugging blocked tools
|
||||
- [Multi-Agent Sandbox and Tools](/tools/multi-agent-sandbox-tools) -- per-agent overrides
|
||||
- [Sandbox CLI](/cli/sandbox) -- `openclaw sandbox` commands
|
||||
@@ -126,3 +126,9 @@ Fix-it keys (pick one):
|
||||
### "I thought this was main, why is it sandboxed?"
|
||||
|
||||
In `"non-main"` mode, group/channel keys are _not_ main. Use the main session key (shown by `sandbox explain`) or switch mode to `"off"`.
|
||||
|
||||
## See also
|
||||
|
||||
- [Sandboxing](/gateway/sandboxing) -- full sandbox reference (modes, scopes, backends, images)
|
||||
- [Multi-Agent Sandbox & Tools](/tools/multi-agent-sandbox-tools) -- per-agent overrides and precedence
|
||||
- [Elevated Mode](/tools/elevated)
|
||||
|
||||
@@ -65,6 +65,18 @@ Not sandboxed:
|
||||
SSH-specific config lives under `agents.defaults.sandbox.ssh`.
|
||||
OpenShell-specific config lives under `plugins.entries.openshell.config`.
|
||||
|
||||
### Choosing a backend
|
||||
|
||||
| | Docker | SSH | OpenShell |
|
||||
| ------------------- | -------------------------------- | ------------------------------ | --------------------------------------------------- |
|
||||
| **Where it runs** | Local container | Any SSH-accessible host | OpenShell managed sandbox |
|
||||
| **Setup** | `scripts/sandbox-setup.sh` | SSH key + target host | OpenShell plugin enabled |
|
||||
| **Workspace model** | Bind-mount or copy | Remote-canonical (seed once) | `mirror` or `remote` |
|
||||
| **Network control** | `docker.network` (default: none) | Depends on remote host | Depends on OpenShell |
|
||||
| **Browser sandbox** | Supported | Not supported | Not supported yet |
|
||||
| **Bind mounts** | `docker.binds` | N/A | N/A |
|
||||
| **Best for** | Local dev, full isolation | Offloading to a remote machine | Managed remote sandboxes with optional two-way sync |
|
||||
|
||||
### SSH backend
|
||||
|
||||
Use `backend: "ssh"` when you want OpenClaw to sandbox `exec`, file tools, and media reads on
|
||||
@@ -120,6 +132,18 @@ Important consequences:
|
||||
- Browser sandboxing is not supported on the SSH backend.
|
||||
- `sandbox.docker.*` settings do not apply to the SSH backend.
|
||||
|
||||
### OpenShell backend
|
||||
|
||||
Use `backend: "openshell"` when you want OpenClaw to sandbox tools in an
|
||||
OpenShell-managed remote environment. For the full setup guide, configuration
|
||||
reference, and workspace mode comparison, see the dedicated
|
||||
[OpenShell page](/gateway/openshell).
|
||||
|
||||
OpenShell reuses the same core SSH transport and remote filesystem bridge as the
|
||||
generic SSH backend, and adds OpenShell-specific lifecycle
|
||||
(`sandbox create/get/delete`, `sandbox ssh-config`) plus the optional `mirror`
|
||||
workspace mode.
|
||||
|
||||
```json5
|
||||
{
|
||||
agents: {
|
||||
@@ -153,9 +177,6 @@ OpenShell modes:
|
||||
- `mirror` (default): local workspace stays canonical. OpenClaw syncs local files into OpenShell before exec and syncs the remote workspace back after exec.
|
||||
- `remote`: OpenShell workspace is canonical after the sandbox is created. OpenClaw seeds the remote workspace once from the local workspace, then file tools and exec run directly against the remote sandbox without syncing changes back.
|
||||
|
||||
OpenShell reuses the same core SSH transport and remote filesystem bridge as the generic SSH backend.
|
||||
The plugin adds OpenShell-specific lifecycle (`sandbox create/get/delete`, `sandbox ssh-config`) and the optional `mirror` mode.
|
||||
|
||||
Remote transport details:
|
||||
|
||||
- OpenClaw asks OpenShell for sandbox-specific SSH config via `openshell sandbox ssh-config <name>`.
|
||||
@@ -168,11 +189,11 @@ Current OpenShell limitations:
|
||||
- `sandbox.docker.binds` is not supported on the OpenShell backend
|
||||
- Docker-specific runtime knobs under `sandbox.docker.*` still apply only to the Docker backend
|
||||
|
||||
## OpenShell workspace modes
|
||||
#### Workspace modes
|
||||
|
||||
OpenShell has two workspace models. This is the part that matters most in practice.
|
||||
|
||||
### `mirror`
|
||||
##### `mirror`
|
||||
|
||||
Use `plugins.entries.openshell.config.mode: "mirror"` when you want the **local workspace to stay canonical**.
|
||||
|
||||
@@ -192,7 +213,7 @@ Tradeoff:
|
||||
|
||||
- extra sync cost before and after exec
|
||||
|
||||
### `remote`
|
||||
##### `remote`
|
||||
|
||||
Use `plugins.entries.openshell.config.mode: "remote"` when you want the **OpenShell workspace to become canonical**.
|
||||
|
||||
@@ -219,7 +240,7 @@ Use this when:
|
||||
Choose `mirror` if you think of the sandbox as a temporary execution environment.
|
||||
Choose `remote` if you think of the sandbox as the real workspace.
|
||||
|
||||
## OpenShell lifecycle
|
||||
#### OpenShell lifecycle
|
||||
|
||||
OpenShell sandboxes are still managed through the normal sandbox lifecycle:
|
||||
|
||||
@@ -441,6 +462,8 @@ See [Multi-Agent Sandbox & Tools](/tools/multi-agent-sandbox-tools) for preceden
|
||||
|
||||
## Related docs
|
||||
|
||||
- [OpenShell](/gateway/openshell) -- managed sandbox backend setup, workspace modes, and config reference
|
||||
- [Sandbox Configuration](/gateway/configuration#agentsdefaults-sandbox)
|
||||
- [Multi-Agent Sandbox & Tools](/tools/multi-agent-sandbox-tools)
|
||||
- [Sandbox vs Tool Policy vs Elevated](/gateway/sandbox-vs-tool-policy-vs-elevated) -- debugging "why is this blocked?"
|
||||
- [Multi-Agent Sandbox & Tools](/tools/multi-agent-sandbox-tools) -- per-agent overrides and precedence
|
||||
- [Security](/gateway/security)
|
||||
|
||||
1344
docs/plugins/architecture.md
Normal file
1344
docs/plugins/architecture.md
Normal file
File diff suppressed because it is too large
Load Diff
@@ -1,40 +1,25 @@
|
||||
---
|
||||
summary: "Per-agent sandbox + tool restrictions, precedence, and examples"
|
||||
summary: “Per-agent sandbox + tool restrictions, precedence, and examples”
|
||||
title: Multi-Agent Sandbox & Tools
|
||||
read_when: "You want per-agent sandboxing or per-agent tool allow/deny policies in a multi-agent gateway."
|
||||
read_when: “You want per-agent sandboxing or per-agent tool allow/deny policies in a multi-agent gateway.”
|
||||
status: active
|
||||
---
|
||||
|
||||
# Multi-Agent Sandbox & Tools Configuration
|
||||
|
||||
## Overview
|
||||
Each agent in a multi-agent setup can override the global sandbox and tool
|
||||
policy. This page covers per-agent configuration, precedence rules, and
|
||||
examples.
|
||||
|
||||
Each agent in a multi-agent setup can now have its own:
|
||||
|
||||
- **Sandbox configuration** (`agents.list[].sandbox` overrides `agents.defaults.sandbox`)
|
||||
- **Tool restrictions** (`tools.allow` / `tools.deny`, plus `agents.list[].tools`)
|
||||
|
||||
This allows you to run multiple agents with different security profiles:
|
||||
|
||||
- Personal assistant with full access
|
||||
- Family/work agents with restricted tools
|
||||
- Public-facing agents in sandboxes
|
||||
|
||||
`setupCommand` belongs under `sandbox.docker` (global or per-agent) and runs once
|
||||
when the container is created.
|
||||
|
||||
Auth is per-agent: each agent reads from its own `agentDir` auth store at:
|
||||
|
||||
```
|
||||
~/.openclaw/agents/<agentId>/agent/auth-profiles.json
|
||||
```
|
||||
- **Sandbox backends and modes**: see [Sandboxing](/gateway/sandboxing).
|
||||
- **Debugging blocked tools**: see [Sandbox vs Tool Policy vs Elevated](/gateway/sandbox-vs-tool-policy-vs-elevated) and `openclaw sandbox explain`.
|
||||
- **Elevated exec**: see [Elevated Mode](/tools/elevated).
|
||||
|
||||
Auth is per-agent: each agent reads from its own `agentDir` auth store at
|
||||
`~/.openclaw/agents/<agentId>/agent/auth-profiles.json`.
|
||||
Credentials are **not** shared between agents. Never reuse `agentDir` across agents.
|
||||
If you want to share creds, copy `auth-profiles.json` into the other agent's `agentDir`.
|
||||
|
||||
For how sandboxing behaves at runtime, see [Sandboxing](/gateway/sandboxing).
|
||||
For debugging “why is this blocked?”, see [Sandbox vs Tool Policy vs Elevated](/gateway/sandbox-vs-tool-policy-vs-elevated) and `openclaw sandbox explain`.
|
||||
|
||||
---
|
||||
|
||||
## Configuration Examples
|
||||
@@ -222,30 +207,9 @@ If `agents.list[].tools.sandbox.tools` is set, it replaces `tools.sandbox.tools`
|
||||
If `agents.list[].tools.profile` is set, it overrides `tools.profile` for that agent.
|
||||
Provider tool keys accept either `provider` (e.g. `google-antigravity`) or `provider/model` (e.g. `openai/gpt-5.2`).
|
||||
|
||||
### Tool groups (shorthands)
|
||||
Tool policies support `group:*` shorthands that expand to multiple tools. See [Tool groups](/gateway/sandbox-vs-tool-policy-vs-elevated#tool-groups-shorthands) for the full list.
|
||||
|
||||
Tool policies (global, agent, sandbox) support `group:*` entries that expand to multiple concrete tools:
|
||||
|
||||
- `group:runtime`: `exec`, `bash`, `process`
|
||||
- `group:fs`: `read`, `write`, `edit`, `apply_patch`
|
||||
- `group:sessions`: `sessions_list`, `sessions_history`, `sessions_send`, `sessions_spawn`, `session_status`
|
||||
- `group:memory`: `memory_search`, `memory_get`
|
||||
- `group:ui`: `browser`, `canvas`
|
||||
- `group:automation`: `cron`, `gateway`
|
||||
- `group:messaging`: `message`
|
||||
- `group:nodes`: `nodes`
|
||||
- `group:openclaw`: all built-in OpenClaw tools (excludes provider plugins)
|
||||
|
||||
### Elevated Mode
|
||||
|
||||
`tools.elevated` is the global baseline (sender-based allowlist). `agents.list[].tools.elevated` can further restrict elevated for specific agents (both must allow).
|
||||
|
||||
Mitigation patterns:
|
||||
|
||||
- Deny `exec` for untrusted agents (`agents.list[].tools.deny: ["exec"]`)
|
||||
- Avoid allowlisting senders that route to restricted agents
|
||||
- Disable elevated globally (`tools.elevated.enabled: false`) if you only want sandboxed execution
|
||||
- Disable elevated per agent (`agents.list[].tools.elevated.enabled: false`) for sensitive profiles
|
||||
Per-agent elevated overrides (`agents.list[].tools.elevated`) can further restrict elevated exec for specific agents. See [Elevated Mode](/tools/elevated) for details.
|
||||
|
||||
---
|
||||
|
||||
@@ -390,8 +354,11 @@ After configuring multi-agent sandbox and tools:
|
||||
|
||||
---
|
||||
|
||||
## See Also
|
||||
## See also
|
||||
|
||||
- [Sandboxing](/gateway/sandboxing) -- full sandbox reference (modes, scopes, backends, images)
|
||||
- [Sandbox vs Tool Policy vs Elevated](/gateway/sandbox-vs-tool-policy-vs-elevated) -- debugging "why is this blocked?"
|
||||
- [Elevated Mode](/tools/elevated)
|
||||
- [Multi-Agent Routing](/concepts/multi-agent)
|
||||
- [Sandbox Configuration](/gateway/configuration#agentsdefaults-sandbox)
|
||||
- [Session Management](/concepts/session)
|
||||
|
||||
2392
docs/tools/plugin.md
2392
docs/tools/plugin.md
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user