Description

openclaw sandbox explain --agent <id> reports the same workspaceRoot: ~/.openclaw/sandboxes value regardless of the agent's actual effective workspaceAccess mode (none vs rw), which is misleading — with workspaceAccess: rw, the container's /workspace is actually bind-mounted directly to the agent's real configured workspace path (e.g. ~/.openclaw/workspace-<agent>), not anywhere under ~/.openclaw/sandboxes.

Environment

• OpenClaw 2026.6.11
• Docker sandbox backend, scope: session

Repro

1. Set workspaceAccess: rw on an agent, restart gateway
2. Run openclaw sandbox explain --agent <id> — note the reported workspaceRoot
3. Start a session for that agent, have it write a file
4. Run docker inspect <container-name> --format '{{json .Mounts}}' on the resulting sandbox container

Expected

sandbox explain's reported root/mount info should reflect where files actually land for the effective mode, or at least clearly indicate the real bind-mount target in rw mode.

Actual

workspaceRoot shows ~/.openclaw/sandboxes in both none and rw modes, even though in rw mode the real host destination is a completely different path (the agent's configured workspace directory). This sent me hunting for output files in the wrong directory tree entirely.