How AI contributed: Direct introductionPublished Mar 3, 2026 in 
openclaw/openclawAll 35 findings in this repository
The embedded agent runner gained a native image path: when the active model accepts images, the runner scans the current prompt and earlier user messages for image references, loads each referenced file, and attaches the result to the request as vision input. Paths on that path were resolved with the sandbox filesystem bridge, which maps a requested path onto the session's mounts, and a path under a mounted directory resolves successfully even when it sits outside the workspace. That gap left images reachable through any mounted directory. With a sandbox in a workspace-only configuration, a prompt or a stored message that named a path under a mount such as /agent/secret.png had the file read and sent to the model as an image. The fix puts the workspace check back on the auto-load path: the loader takes a workspace-only flag from the effective agent configuration, checks each resolved path against the allowed root before reading, and the added tests drive both the current prompt and a history reference through a sandbox that mounts a directory outside the workspace.
A prompt image loader turned each detected reference into a file read, and with a sandbox in play it resolved that path through the sandbox filesystem bridge, which maps the session's mounts to host paths; anything that mapped into a mount was accepted, so the workspace-only restriction the file tools enforce was never applied to the images the runner pulled into the prompt.
Root cause
The vision feature added the auto-load path that scans a prompt and earlier turns for image references, loads the files and attaches them to the request; its only sandbox guard compared paths to a sandbox root, and the workspace-only setting that the file tools later gained was never consulted here.
Fix
The loader now takes the workspace-only flag from the effective agent configuration, rejects any resolved path that falls outside the allowed root, and skips the image; the new tests exercise a prompt reference and a history reference against a sandbox that mounts a directory outside the workspace.
Fix by Peter Steinberger · no AI marker found
Case facts
Claude--- /dev/null+++ b/src/agents/pi-embedded-runner/run/images.ts@@ -0,0 +1,379 @@+export async function loadImageFromRef(+ ref: DetectedImageRef,+ workspaceDir: string,+ options?: {+ maxBytes?: number;+ /** If set, enforce that file paths are within this sandbox root */+ sandboxRoot?: string;+ },+): Promise<ImageContent | null> {+ try {+ let targetPath = ref.resolved;++ // When sandbox is enabled, block remote URL loading to maintain network boundary+ if (ref.type === "url" && options?.sandboxRoot) {+ log.debug(`Native image: rejecting remote URL in sandboxed session: ${ref.resolved}`);+ return null;+ }++ // For file paths, resolve relative to the appropriate root:+ // - When sandbox is enabled, resolve relative to sandboxRoot for security+ // - Otherwise, resolve relative to workspaceDir+ if (ref.type === "path" && !path.isAbsolute(targetPath)) {+ const resolveRoot = options?.sandboxRoot ?? workspaceDir;+ targetPath = path.resolve(resolveRoot, targetPath);+ }++ // Enforce sandbox restrictions if sandboxRoot is set+ if (ref.type === "path" && options?.sandboxRoot) {+ try {+ const validated = await assertSandboxPath({+ filePath: targetPath,+ cwd: options.sandboxRoot,+ root: options.sandboxRoot,+ });+ targetPath = validated.resolved;+ } catch (err) {+ // Log the actual error for debugging (sandbox violation or other path error)+ log.debug(`Native image: sandbox validation failed for ${ref.resolved}: ${err instanceof Error ? err.message : String(err)}`);+ return null;+ }+ }@@ -181,6 +182,7 @@ export async function loadImageFromRef( workspaceDir: string, options?: { maxBytes?: number;+ workspaceOnly?: boolean; sandbox?: { root: string; bridge: SandboxFsBridge }; }, ): Promise<ImageContent | null> {@@ -211,6 +213,14 @@ export async function loadImageFromRef( } else if (!path.isAbsolute(targetPath)) { targetPath = path.resolve(workspaceDir, targetPath); }+ if (options?.workspaceOnly) {+ const root = options?.sandbox?.root ?? workspaceDir;+ await assertSandboxPath({+ filePath: targetPath,+ cwd: root,+ root,+ });+ } } // loadWebMedia handles local file paths (including file:// URLs)@@ -422,6 +433,7 @@ export async function detectAndLoadPromptImages(params: { for (const ref of allRefs) { const image = await loadImageFromRef(ref, params.workspaceDir, { maxBytes: params.maxBytes,+ workspaceOnly: params.workspaceOnly, sandbox: params.sandbox, }); if (image) {@@ -363,6 +363,9 @@ export async function runEmbeddedAttempt( config: params.config, agentId: params.agentId, });+ const effectiveFsWorkspaceOnly =+ (resolveAgentConfig(params.config ?? {}, sessionAgentId)?.tools?.fs?.workspaceOnly ??+ params.config?.tools?.fs?.workspaceOnly) === true; // Check if the model supports native image input const modelHasVision = params.model.input?.includes("image") ?? false; const toolsRaw = params.disableTools@@ -1087,6 +1090,7 @@ export async function runEmbeddedAttempt( historyMessages: activeSession.messages, maxBytes: MAX_IMAGE_BYTES, maxDimensionPx: resolveImageSanitizationLimits(params.config).maxDimensionPx,+ workspaceOnly: effectiveFsWorkspaceOnly, // Enforce sandbox path restrictions when sandbox is enabled sandbox: sandbox?.enabled && sandbox?.fsBridgeAI-assisted change ea2d5eb364431f5e3d64313bcd6d0ff9892cabc8b3c15f78e0b5b3ae8c7dbbfc · Fix 1b903e9ccbf048cbdc4464b105eefe41d0d2c0eadcae0065186e7344c21bf186