PR #71899: fix(agents): keep added workspaces peer-level

• Repository: openclaw/openclaw
• Author: neeravmakwana
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/71899

Description (problem / solution / changelog)

Summary

• Fix agents add workspace defaults so setup's main workspace directory is treated as the main agent workspace, not a shared base for new agents.
• Preserve custom shared workspace bases, where non-default agents still resolve under the configured base.
• Add regression coverage and a changelog entry for #71889.

Root Cause

openclaw setup stores the main workspace in agents.defaults.workspace. The agents add wizard asks resolveAgentWorkspaceDir() for the new agent's default, and the resolver appended non-default agent ids to any agents.defaults.workspace, including the setup-created main workspace. That produced nested paths like workspace/testbug instead of the documented peer-level workspace-testbug.

Why This Fix Is Safe

The resolver now only treats agents.defaults.workspace as a shared base when it differs from the normal main-agent workspace default. Explicit per-agent workspace values still win, default-agent resolution is unchanged, and intentionally custom bases such as /shared-ws/<agentId> keep the existing behavior.

Security / Runtime Controls

This changes the runtime workspace path resolver used by the CLI and Gateway paths; it does not rely on prompt text. Workspace sandboxing, fs-safe policy, workspace-only controls, and agent config authorization behavior are unchanged.

Self-Review

• Test helper defaults match production defaults: the regression uses resolveAgentWorkspaceDir() with OPENCLAW_HOME to model setup's default main workspace.
• Config defaults, schema help, and generated artifacts are unchanged; only the fallback interpretation changed.
• Security posture is unchanged because this affects path selection, not sandbox policy or permission checks.

Tests

• pnpm test src/agents/agent-scope.test.ts
• pnpm test src/agents/agent-scope.test.ts src/commands/agents.add.test.ts src/infra/changelog-unreleased.test.ts
• pnpm check:changed (failed in expanded agents test lane with Vitest worker OOM after 349/350 files passed; typecheck, lint, import-cycle, and guards passed)
• OPENCLAW_VITEST_MAX_WORKERS=1 pnpm check:changed

Notes

• AI-assisted: yes.

Made with Cursor

Changed files

• CHANGELOG.md (modified, +1/-0)
• docs/concepts/multi-agent.md (modified, +2/-0)
• src/agents/agent-scope-config.ts (modified, +25/-1)
• src/agents/agent-scope.test.ts (modified, +91/-0)

PR #71941: fix(agents/wizard): pre-fill peer-level workspace path on agents add for documented default

• Repository: openclaw/openclaw
• Author: willamhou
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/71941

Description (problem / solution / changelog)

Fixes #71889.

Root cause

openclaw setup writes agents.defaults.workspace = ~/.openclaw/workspace on first run. When the operator later runs openclaw agents add <id>, the wizard's "Workspace directory" prompt seeds initialValue from resolveAgentWorkspaceDir(cfg, agentId). For non-default agents that path resolves to path.join(defaults.workspace, id) (set by #59789) — i.e. ~/.openclaw/workspace/<id>, nested under the main agent's tree, not the peer-level ~/.openclaw/workspace-<id> documented in docs/concepts/multi-agent.md:57,67.

If the operator hits Enter, the nested layout becomes the persisted reality:

• Skill discovery walking ~/.openclaw/workspace/skills/ traverses <other-agent>/skills/ along with main's, leaking cross-agent skills under OpenClaw's "soft sandbox" model.
• rm -rf ~/.openclaw/workspace to reset main wipes every nested agent's workspace, memory, and skills.
• Recursive memory/grep/glob inside main's workspace silently treats other agents' private files as main's.

Fix

src/agents/agent-scope-config.ts — add suggestPeerAgentWorkspaceDir(cfg, id, env). The helper only overrides runtime resolution in the narrow post-setup scenario where agents.defaults.workspace exactly matches resolveDefaultAgentWorkspaceDir(env) (the value the setup wizard wrote). In that case it returns the documented peer-level form ~/.openclaw/workspace-<id>. Every other shape — unset defaults.workspace, custom shared roots like /srv/agents, /srv/workspace, /srv/workspace-prod, and OPENCLAW_STATE_DIR-isolated multi-gateway setups — defers to resolveAgentWorkspaceDir so the contracts from #59789 (shared-base nesting) and per-instance state-dir isolation stay intact.

src/commands/agents.commands.add.ts — the wizard uses the new helper as initialValue only for brand-new agents. When openclaw agents add <existing-id> is used to update an existing agent, the prompt still seeds from resolveAgentWorkspaceDir(cfg, agentId) so a pressed-Enter on a routine auth/binding update does not silently relocate the agent.

Runtime resolution via resolveAgentWorkspaceDir is intentionally unchanged. Existing per-agent workspace overrides take precedence, and the #59789 nested layout is preserved for everyone who explicitly configured it.

Verification

• node standalone trace through 8 representative configs (default install, OPENCLAW_PROFILE, OPENCLAW_STATE_DIR isolation, /srv/agents shared root, /srv/workspace and /srv/workspace-prod ambiguous bases, /shared-ws #59789, id normalization) — all behave as expected.
• Added 6 unit tests in agent-scope.test.ts covering each scenario above and 2 wizard tests in agents.add.test.ts covering both new-agent prefill and existing-agent update paths.
• oxfmt --check and npx oxlint clean on changed files.
• pnpm tsgo:core produces the same set of pre-existing unrelated errors as c070509b7f (verified by stashing and re-running on clean main).
• 4 review iterations with codex review --base origin/main against this diff. Final pass: "I did not identify any blocking correctness issues in the diff."

Test plan

• Unit tests added for the new helper covering all 6 documented config shapes.
• Wizard tests for both new-agent and existing-agent update paths.
• Codex review clean.
• Manual pnpm openclaw agents add testbug on a fresh ~/.openclaw to confirm the prompt prefill matches expectations.
• Manual pnpm openclaw agents add <existing-id> on a config with a customized agent workspace to confirm the prefill preserves it.

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/agents/agent-scope-config.ts (modified, +40/-0)
• src/agents/agent-scope.test.ts (modified, +65/-0)
• src/agents/agent-scope.ts (modified, +1/-0)
• src/commands/agents.add.test.ts (modified, +68/-0)
• src/commands/agents.commands.add.ts (modified, +7/-1)