bug(cli): --no-keep discards the sandbox audit logs; OCSF lines also flush 1-2 s after exit #4295

Activity

1. github-actions

   added

   state:triage-neededOpened without agent diagnostics and needs triageOpened without agent diagnostics and needs triage

   on Oct 7, 2026
2. github-actions commented on Oct 22, 2026

   

   github-actionsBot

   on Oct 22, 2026 – with GitHub Actions

   More actions

   This issue has had no activity for 14 days and is now marked stale. It may be closed in 14 days if there is no further activity. Comment or remove the state:stale label to keep it open.
3. github-actions

   added

   state:staleInactive item at risk of automatic closure.Inactive item at risk of automatic closure.

   on Oct 22, 2026
4. krishicks commented on Oct 23, 2026

   

   krishicks

   on Oct 23, 2026

   Collaborator

   More actions

   Thanks for the report. We're treating this as a feature request rather than a bug, with the scope reframed as follows.

   Retaining logs after a sandbox exits. --no-keep deleting the sandbox and its gateway-side log buffer is expected today, but we think the gateway should retain, or at least be able to retain, a sandbox's logs for some period after it exits. The gateway already holds the human-readable OCSF shorthand for the sandbox in memory, so serving it for a while after the sandbox is gone is a natural extension of what openshell logs already does. How long to retain is not clear yet (a fixed default, a configurable period, size caps) and needs a design decision.

   Why not just a collector. Configuring [openshell.gateway.otlp.ocsf] is the supported way to keep a durable audit trail, and the supervisor flushes the exporter on exit. But a collector receives the OCSF JSONL, not the shorthand, so it does not give the readable view this issue asks for.

   The 1-2 s tail. Retention depends on this. The OTLP exporter flushes on shutdown, so the late lines are most likely on the gateway log-stream path that openshell logs reads. If the tail is lost there, retained logs will be incomplete, so the flush-on-exit behavior needs to be investigated and fixed as part of this work. Until then, a logs call right after exit can miss the last lines.

   Smaller pieces that can land independently:

   • A notice on --no-keep (or documentation) that logs are not retrievable after the sandbox is deleted.
   • Documenting where sandbox and OCSF logs live and how long they are kept, which overlaps docs: document sandbox and OCSF log retention, rotation and on-disk location per driver #4297.

   Open question: what retention period and limits make sense for retained logs?
5. github-actions

   removed

   state:staleInactive item at risk of automatic closure.Inactive item at risk of automatic closure.

   on Oct 24, 2026
6. RafiB982 commented on Nov 14, 2026

   

   RafiB982

   on Nov 14, 2026

   More actions

   Still relevant on 0.1.9-pre.3 (snap rev 2564, Docker driver), and the loss is wider than --no-keep:

   1. Plain sandbox delete (kept sandbox): openshell logs <name> returns "sandbox not found" right away. The gateway DB went from 13 objects to 1 (workspace), so the sandbox's draft policy chunks and policy history were deleted along with the logs. A reviewer can't see later what was proposed, by whom (agent or mechanistic), or what was approved.
   2. Gateway restart (systemctl --user restart, or a snap refresh followed by a restart): the sandbox comes back (same container, /sandbox intact), but openshell logs <name> -n 100000 afterwards contains only post-restart events. Everything before the restart is gone from openshell logs. A running openshell logs <name> --tail exits with rc=1 when the gateway stops, and a new --tail doesn't backfill. The supervisor container is recreated, so its docker logs start fresh too.

   Timeline from the restart test: event A at 15:40:09.7, a once-per-second marker loop B, restart at 15:40:15.1, gateway up 15:40:21.2, sandbox Ready 15:40:22.8, event C at 15:40:53. The snapshot before the restart had A + B01–B05. The snapshot after it had only C.

   Today the only copies that survive either case are an external --tail that was running at the time, or the OTLP export ([openshell.gateway.otlp.ocsf]), which worked well in our tests. It would help if the retention design covered the restart case too. If the intended answer is "use OTLP for anything durable", it would help to state that next to openshell logs in the docs, since the retention page from #4297 is where people will look.