openclaw - 💡(How to fix) Fix ensureAgentWorkspace re-seeds over wiped workspace without confirmation [1 pull requests]

Summary

ensureAgentWorkspace (dist/workspace-BxBAoMrZ.js:447) re-templates a workspace dir when workspace-state.json is missing and BOOTSTRAP.md is absent. If an external process (e.g. a misconfigured vitest cleanup hook) deletes the workspace contents, the next agent prelude silently reseeds BOOTSTRAP templates on top of the now-empty dir — destroying the recovery surface and masking the wipe.

Reproduction

1. Healthy install at ~/.openclaw/workspace/ with .openclaw/workspace-state.json present.
2. External process runs fs.rmSync('~/.openclaw/workspace', {recursive:true, force:true}).
3. Next agent run: ensureAgentWorkspace sees empty dir, no bootstrapSeededAt, no setupCompletedAt, no BOOTSTRAP.md → loads templates, writes new workspace-state.json with fresh bootstrapSeededAt.
4. User loses visibility that a wipe occurred. No WORKSPACE_VANISHED event emitted.

Real-world incident

On 2026-05-29 17:33:59 UTC, a vitest test suite in a downstream repo wiped its installer's workspace (module-eval WORKSPACE_PATH fallback bound to the production path; afterEach rmSync nuked it). OpenClaw runtime then reseeded BOOTSTRAP 5 seconds later. Recovered from off-host git mirror only because the workspace happened to be a git repo with a remote.

workspace.broken/.openclaw/workspace-state.json post-incident: ```json {"version":1,"bootstrapSeededAt":"2026-05-29T17:34:04.200Z"} ```

Proposed fix

ensureAgentWorkspace should refuse to seed when:

1. A sibling marker ~/.openclaw/workspace.attested was touched within the prior 24h, OR
2. ~/.openclaw/.workspace-attested-history contains a recent attestation, OR
3. .git/HEAD previously existed (track via attestation log).

If any condition met → abort seed, emit WORKSPACE_VANISHED event, write diagnostic to stderr + log, exit non-zero so the agent host sees it and refuses to silently continue.

Daily attestation: runtime touches ~/.openclaw/workspace.attested once per successful boot and appends a line to .workspace-attested-history.

Impact

Without this guard, any test/CI/dev-loop bug that deletes the workspace dir is silently papered over by BOOTSTRAP reseeding. Wipe causes are hidden, recovery requires off-host backups, and there's no audit signal.

Environment

• OpenClaw runtime hash: dist/workspace-BxBAoMrZ.js
• Node: v22.22.2
• OS: Linux 6.8.0-117-generic