Remote Sandbox Workspace Unification

Remote sandbox mode has two issues:

1. Workspace path leakage: The LLM sees host paths (e.g. /app/.xbot/users/ou_xxx/workspace) instead of the runner’s workspace. This is because SandboxWorkDir is "" for remote mode, causing all path fallbacks to use host paths.

2. Global skills/agents not available: Skills and agents on the server are not copied to the runner, so the LLM cannot discover or use them.

• sandboxWorkDir() returns "" for non-docker modes
• SandboxEnabled is a.sandboxMode == "docker" — false for remote
• buildPrompt() only handles docker mode for workDir
• EnsureSynced() skips remote mode entirely
• Path guard functions (defaultWorkspaceRoot, shouldUseSandbox) gate on SandboxEnabled || SandboxWorkDir != ""

Add one method to tools.Sandbox interface:

Workspace(userID string) string

Implementations:

All functions in tools/path_guard.go that currently read ctx.SandboxWorkDir or ctx.SandboxEnabled switch to use the Sandbox interface:

// Before
func defaultWorkspaceRoot(ctx *ToolContext) string {
    if ctx.SandboxEnabled && ctx.SandboxWorkDir != "" { return ctx.SandboxWorkDir }
    ...
}

// After
func defaultWorkspaceRoot(ctx *ToolContext) string {
    if ctx.Sandbox != nil && ctx.Sandbox.Name() != "none" {
        return ctx.Sandbox.Workspace(ctx.OriginUserID)
    }
    ...
}

Affected functions:

• defaultWorkspaceRoot — use sandbox.Workspace()
• sandboxBaseDir — use sandbox.Workspace()
• shouldUseSandbox — use sandbox.Name() != "none"
• sandboxReadOnlyRoots — keep for docker, return as-is for remote (empty SandboxWorkDir triggers passthrough)

Each tool that dispatches on SandboxEnabled updates its guard:

// Before
if ctx.SandboxEnabled && ctx.WorkspaceRoot != "" { ... }

// After (for tools using Sandbox API — Read, Write, Glob, Grep, Cd)
if shouldUseSandbox(ctx) { ... }

// After (for Shell tool — already uses sandbox.Name() switch)
// Already correct after previous fix

buildBaseRunConfig / buildToolExecutor:

• Remove SandboxWorkDir: a.sandboxWorkDir()
• Change SandboxEnabled: a.sandboxMode == "docker" → SandboxEnabled: a.sandboxMode != "none"

buildPrompt / initPipelines:

• promptWorkDir switches on sandboxMode:

  switch sandboxMode {
  case "docker": promptWorkDir = "/workspace"
  case "remote": promptWorkDir = sandbox.Workspace(senderID)
  default: promptWorkDir = a.workDir
  }
  

sandboxWorkDir() method:

• Remove. All callers use sandbox.Workspace(userID) directly.

ensureWorkspace:

• Already sandbox-aware (sandbox.MkdirAll when sandbox != nil).
• os.MkdirAll(wsRoot) calls in engine_wire.go:545 and interactive.go:346 need to use sandbox API or skip for remote mode.

When a runner connects and registers (RemoteSandbox.handleRegister):

1. RemoteSandbox stores globalSkillDirs and agentsDir (passed at init time)
2. On registration, triggers a one-time sync:
   • Read server-side globalSkillDirs contents via os.ReadDir
   • Write each skill subdirectory to runner via Sandbox.MkdirAll + Sandbox.WriteFile
   • Read server-side agentsDir contents via os.ReadDir
   • Write each agent .md file to runner via Sandbox.WriteFile
3. Skills/agents land at {runner_workspace}/.skills/ and {runner_workspace}/.agents/
4. LLM discovers them via normal workspace scanning (SkillTool, SubAgentTool)

Sync happens once per runner connection. Reconnection re-triggers sync.

SubAgent inherits Sandbox from parent ToolContext. buildSubAgentRunConfig:

• Uses sandbox.Workspace(userID) for prompt workDir
• Uses sandbox.Name() != "none" for SandboxEnabled

• MCP stdio in remote mode (architecturally incompatible)
• CdTool path resolution in remote mode (CurrentDir semantics need separate design)
• SubAgent CWD inheritance in remote mode