refactor: Rework sandbox tool registration logic, simplify sandbox state directory paths, and update default container image and prefix.

pkg/agent/instance.go

@@ -59,30 +59,42 @@ func NewAgentInstance(
 
 	restrict := defaults.RestrictToWorkspace
 	sb := sandbox.NewFromConfigWithAgent(workspace, restrict, cfg, agentID)
-	readSb := sb
+	isSandboxOff := true
-	if !sandbox.IsToolSandboxEnabled(cfg, "read_file") {
+	if cfg != nil {
-		readSb = nil
+		mode := strings.ToLower(strings.TrimSpace(cfg.Agents.Defaults.Sandbox.Mode))
+		if mode == "all" || mode == "non-main" {
+			isSandboxOff = false
 		}
-	writeSb := sb
-	if !sandbox.IsToolSandboxEnabled(cfg, "write_file") {
-		writeSb = nil
-	}
-	execSb := sb
-	if !sandbox.IsToolSandboxEnabled(cfg, "exec") {
-		execSb = nil
 	}
 	roContainer := isContainerReadOnlySandbox(cfg)
+
 	toolsRegistry := tools.NewToolRegistry()
-	toolsRegistry.Register(tools.NewReadFileToolWithSandbox(workspace, restrict, readSb))
+
-	if !roContainer {
+	// Helper to check if tool is allowed (either sandbox is off or policy allows it)
-		toolsRegistry.Register(tools.NewWriteFileToolWithSandbox(workspace, restrict, writeSb))
+	isAllowed := func(toolName string) bool {
+		return isSandboxOff || sandbox.IsToolSandboxEnabled(cfg, toolName)
 	}
+
+	if isAllowed("read_file") {
+		toolsRegistry.Register(tools.NewReadFileToolWithSandbox(workspace, restrict, sb))
+	}
+	if !roContainer && isAllowed("write_file") {
+		toolsRegistry.Register(tools.NewWriteFileToolWithSandbox(workspace, restrict, sb))
+	}
+	if isAllowed("list_dir") {
 		toolsRegistry.Register(tools.NewListDirTool(workspace, restrict))
-	toolsRegistry.Register(tools.NewExecToolWithSandbox(workspace, restrict, cfg, execSb))
+	}
+	if isAllowed("exec") {
+		toolsRegistry.Register(tools.NewExecToolWithSandbox(workspace, restrict, cfg, sb))
+	}
 	if !roContainer {
+		if isAllowed("edit_file") {
 			toolsRegistry.Register(tools.NewEditFileTool(workspace, restrict))
+		}
+		if isAllowed("append_file") {
 			toolsRegistry.Register(tools.NewAppendFileTool(workspace, restrict))
 		}
+	}
 
 	sessionsDir := filepath.Join(workspace, "sessions")
 	sessionsManager := session.NewSessionManager(sessionsDir)

pkg/agent/sandbox/container.go

@@ -73,7 +73,7 @@ func NewContainerSandbox(cfg ContainerSandboxConfig) *ContainerSandbox {
 		cfg.Image = "openclaw-sandbox:bookworm-slim"
 	}
 	if strings.TrimSpace(cfg.ContainerPrefix) == "" {
-		cfg.ContainerPrefix = "picoclaw-sandbox-"
+		cfg.ContainerPrefix = "picoclaw-sbx-"
 	}
 	if strings.TrimSpace(cfg.ContainerName) == "" {
 		cfg.ContainerName = cfg.ContainerPrefix + "default"
@@ -375,7 +375,7 @@ func (c *ContainerSandbox) registryPath() string {
 }
 
 func (c *ContainerSandbox) sandboxStateDir() string {
-	return filepath.Join(resolvePicoClawHomeDir(), "state", "sandbox")
+	return filepath.Join(resolvePicoClawHomeDir(), "sandbox")
 }
 
 func resolvePicoClawHomeDir() string {

pkg/agent/sandbox/container_test.go

@@ -270,7 +270,7 @@ func TestContainerSandbox_RegistryPath_UsesSandboxStateDir(t *testing.T) {
 		Workspace:     "/tmp/ws",
 		WorkspaceRoot: "/tmp/sbx",
 	})
-	want := filepath.Join(home, ".picoclaw", "state", "sandbox", "containers.json")
+	want := filepath.Join(home, ".picoclaw", "sandbox", "containers.json")
 	if got := sb.registryPath(); got != want {
 		t.Fatalf("registryPath = %q, want %q", got, want)
 	}
@@ -280,7 +280,7 @@ func TestContainerSandbox_RegistryPath_UsesPicoClawHomeOverride(t *testing.T) {
 	picoHome := t.TempDir()
 	t.Setenv("PICOCLAW_HOME", picoHome)
 	sb := NewContainerSandbox(ContainerSandboxConfig{})
-	want := filepath.Join(picoHome, "state", "sandbox", "containers.json")
+	want := filepath.Join(picoHome, "sandbox", "containers.json")
 	if got := sb.registryPath(); got != want {
 		t.Fatalf("registryPath = %q, want %q", got, want)
 	}

pkg/agent/sandbox/manager.go

@@ -269,7 +269,7 @@ func (m *scopedSandboxManager) pruneOnce(ctx context.Context) error {
 		return nil
 	}
 
-	regPath := filepath.Join(resolvePicoClawHomeDir(), "state", "sandbox", defaultSandboxRegistryFile)
+	regPath := filepath.Join(resolvePicoClawHomeDir(), "sandbox", defaultSandboxRegistryFile)
 	registryMu.Lock()
 	data, err := loadRegistry(regPath)
 	registryMu.Unlock()

pkg/agent/sandbox/manager_test.go

@@ -90,7 +90,7 @@ func TestScopedSandboxManager_PruneLoopLifecycle(t *testing.T) {
 func TestScopedSandboxManager_PruneOnceLoadRegistryError(t *testing.T) {
 	home := t.TempDir()
 	t.Setenv("HOME", home)
-	stateDir := filepath.Join(home, ".picoclaw", "state", "sandbox")
+	stateDir := filepath.Join(home, ".picoclaw", "sandbox")
 	if err := os.MkdirAll(stateDir, 0o755); err != nil {
 		t.Fatalf("mkdir state dir: %v", err)
 	}

pkg/config/defaults.go

@@ -23,8 +23,8 @@ func DefaultConfig() *Config {
 					WorkspaceAccess: "none",
 					WorkspaceRoot:   "~/.picoclaw/sandboxes",
 					Docker: AgentSandboxDockerConfig{
-						Image:           "debian:bookworm-slim",
+						Image:           "openclaw-sandbox:bookworm-slim",
-						ContainerPrefix: "picoclaw-sandbox-",
+						ContainerPrefix: "picoclaw-sbx-",
 						Workdir:         "/workspace",
 						ReadOnlyRoot:    true,
 						Tmpfs:           []string{"/tmp", "/var/tmp", "/run"},