Description

After upgrading to the latest version, the system prompt injects the host workspace path (/home/openclaw/.openclaw/workspace) into the sandbox runtime context. Inside the sandbox container, the workspace is actually mounted at /workspace. The path /home/openclaw/.openclaw/workspace does not exist in the container.

Impact

• Agent file operations fail on first attempt every session
• Burns 3-4 extra tool calls per session discovering the real path
• Skills and scripts referencing the injected path break
• Exec error surfacing bug (separate known issue) makes these failures visible to end users

Environment

• Container user: sandbox (uid 1000)
• Container HOME: /workspace
• Actual mount: /dev/vda1 mounted at /workspace
• Injected path: /home/openclaw/.openclaw/workspace (does not exist)
• PID 1: sleep infinity

Expected Behavior

The system prompt should inject the sandbox-side mount path (/workspace) when running in sandbox mode, not the host-side path.

Workaround

Add a symlink in the sandbox Dockerfile:

RUN mkdir -p /home/openclaw/.openclaw && ln -s /workspace /home/openclaw/.openclaw/workspace

Suggested Fix

When building the runtime section of the system prompt, detect sandbox mode and substitute the container workspace path instead of the host path.