Bug type

Regression (worked before, now fails)

Summary

After upgrading from v2026.3.2 to v2026.3.7, Docker sandbox containers receive the OpenClaw
sandbox directory at /agent/ instead of the actual configured workspace path.

Steps to reproduce

docker inspect on a v2026.3.7 container:
[
{"Source": "/.openclaw/sandboxes/agent--subagent-", "Destination": "/workspace",
"Mode": "ro"},
{"Source": "/.openclaw/sandboxes/agent--slack-channel-", "Destination": "/agent",
"Mode": "ro"}
]

On v2026.3.2, the same config mounted the actual workspace directory at /agent/, confirmed by
subagent logs successfully executing scripts at /agent/ paths on 2026-03-07. After upgrading to
v2026.3.7 on 2026-03-08, all /agent/ paths return [Errno 2] No such file or directory.

Expected behavior

/agent/ in the container maps to the configured agents.defaults.workspace path, giving
subagents read-only access to workspace files (scripts, tools, data).

Actual behavior

/agent/ maps to ~/.openclaw/sandboxes/agent--slack-channel-/, which only contains
bootstrap files (SOUL.md, AGENTS.md, TOOLS.md, IDENTITY.md, USER.md, HEARTBEAT.md) and the
built-in skills scaffold. No workspace files are accessible.

Config:
"sandbox": {
"mode": "non-main",
"scope": "session",
"workspaceAccess": "ro"
}

OpenClaw version

2026.3.7

Operating system

,acOS

Install method

npm global

Logs, screenshots, and evidence

Impact and severity

Completely broke sandboxed sub-agent setup.

Additional information

Workaround: Rolled back to v2026.3.2.