Best possible solution:

Keep the centralized physical-path validation and rollback design, obtain release/secops confirmation of its lifecycle invariant, then rerun focused and immutable installer smoke on the final integrated head.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: the pre-fix helper follows candidate-owned packages and packages/ai components during trusted artifact moves, and the added fixtures deterministically model both escape paths. This read-only review did not execute the fixture itself.

Is this the best way to solve the issue?

Yes, conditionally: validating once inside the existing shared restore helper and reusing those physical paths for swaps and rollback is the narrowest maintainable fix, provided workflow owners confirm the no-concurrency invariant.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 13819996adca.

Label changes:

• add P2: This is bounded release-validation hardening with important but limited direct user blast radius.
• add merge-risk: 🚨 security-boundary: Merge safety depends on the trusted release workflow preventing candidate-controlled path mutation after validation.
• add proof: sufficient: Contributor real behavior proof is sufficient. Exact-head Testbox results and an immutable full installer smoke demonstrate the after-fix package-integrity, fresh-install, update, doctor, freshness, and non-root paths with an observed successful result.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): Exact-head Testbox results and an immutable full installer smoke demonstrate the after-fix package-integrity, fresh-install, update, doctor, freshness, and non-root paths with an observed successful result.

Label justifications:

• P2: This is bounded release-validation hardening with important but limited direct user blast radius.
• merge-risk: 🚨 security-boundary: Merge safety depends on the trusted release workflow preventing candidate-controlled path mutation after validation.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): Exact-head Testbox results and an immutable full installer smoke demonstrate the after-fix package-integrity, fresh-install, update, doctor, freshness, and non-root paths with an observed successful result.
• proof: sufficient: Contributor real behavior proof is sufficient. Exact-head Testbox results and an immutable full installer smoke demonstrate the after-fix package-integrity, fresh-install, update, doctor, freshness, and non-root paths with an observed successful result.

PR surface:

Tests +43, Other +26. Total +69 across 2 files.

Security concerns:

• [medium] Confirm the no-concurrent-candidate-process invariant — scripts/lib/docker-e2e-package.sh:214
  The guard resolves and validates pathnames once, then later performs pathname-based moves; this is safe only if candidate-controlled code cannot mutate those directories concurrently, as the new comment asserts.
  Confidence: 0.9

What I checked:

• Current-main behavior: Current main still detects and swaps the bundled AI artifact through $ROOT_DIR/packages/ai, so a candidate-owned intermediate symlink can redirect trusted restore operations. (scripts/lib/docker-e2e-package.sh:208, 13819996adca)
• Containment implementation: The branch resolves the restore root physically, rejects linked package owners, proves the AI package remains below the root, and completes these checks before Docker creation or filesystem swaps. (scripts/lib/docker-e2e-package.sh:210, 8ebe7753772d)
• Regression coverage: The added fixtures exercise both a symlinked packages directory and a symlinked packages/ai directory, verify external data remains unchanged, and prove Docker is not invoked. (test/scripts/test-install-sh-docker.test.ts:530, 8ebe7753772d)
• Real behavior proof: The PR supplies exact-head focused Testbox results, successful hosted CI, and an immutable full installer smoke covering package integrity, fresh install, stable-to-candidate update, doctor, freshness policy, and non-root installers. (8ebe7753772d)
• Clean current-main integration: A read-only three-way merge calculation against current main completed without conflicts; main-side drift in the touched test file is unrelated build-identity coverage. (test/scripts/test-install-sh-docker.test.ts:636, 13819996adca)
• Feature provenance: The shared root-and-AI artifact restore helper was introduced by the merged installer-smoke repair, and this branch is a distinct containment follow-up rather than duplicate work already on main. (scripts/lib/docker-e2e-package.sh:155, 8755077fe45b)

Likely related people:

• vincentkoc: Authored and merged the preceding installer-smoke repair that introduced the shared artifact restore lifecycle this PR hardens. (role: introduced behavior; confidence: high; commits: 0a7de77e44f5, e92771a1c2d3, 8755077fe45b; files: scripts/lib/docker-e2e-package.sh, scripts/docker/install-sh-smoke/run.sh, scripts/e2e/bun-global-install-smoke.sh)
• steipete: Contributed prior merged installer-smoke hardening, including the loadability check in the preceding repair, and has repeated history in the affected install-smoke tests. (role: recent area contributor; confidence: high; commits: 3118589702f4, 6709589117ce, ec3bbae49b14; files: scripts/lib/docker-e2e-package.sh, test/scripts/test-install-sh-docker.test.ts, scripts/check-openclaw-package-tarball.mjs)
• joshavant: The PR discussion explicitly requests his combined release-packaging and secops trust-boundary review, making him a likely approval owner for the remaining gate. (role: requested owner reviewer; confidence: medium; files: scripts/lib/docker-e2e-package.sh)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.