Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/state/sandbox.ts (1)

472-476: Run the state lifecycle E2E set for this change path.

Since this touches sandbox backup/restore SSH-config retrieval, please run state-backup-restore-e2e, snapshot-commands-e2e, and rebuild-openclaw-e2e on this branch before merge.

As per coding guidelines: "src/lib/state/sandbox.ts: This file manages sandbox state (backup, restore, rebuild, snapshot). Changes affect data persistence across sandbox lifecycle operations." and the listed E2E test recommendation.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/state/sandbox.ts` around lines 472 - 476, This change touches sandbox
SSH-config retrieval in src/lib/state/sandbox.ts (specifically the call to
captureSandboxSshConfigCommand and the result handling) and requires running the
full state lifecycle E2E suites before merging: execute
state-backup-restore-e2e, snapshot-commands-e2e, and rebuild-openclaw-e2e on
this branch to validate backup/restore/snapshot/rebuild behavior; if any
failures appear, reproduce them locally while inspecting
captureSandboxSshConfigCommand and related backup/restore logic in sandbox.ts to
determine whether the SSH-config fallback (ignoreError: true) or result.status
handling should be adjusted and then re-run the E2Es until all pass.

src/lib/sandbox/version.test.ts (1)

31-31: ⚡ Quick win

Remove unused mock for captureOpenshellCommand.

The mock for captureOpenshellCommand is no longer used after the refactor to captureSandboxSshConfigCommand. All tests now reference the new helper. Removing this line will prevent confusion for future maintainers.

🧹 Proposed cleanup

   versionGte: (left = "0.0.0", right = "0.0.0") => {
     const lhs = String(left).split(".").map((p) => parseInt(p, 10) || 0);
     const rhs = String(right).split(".").map((p) => parseInt(p, 10) || 0);
     const length = Math.max(lhs.length, rhs.length);
     for (let i = 0; i < length; i++) {
       const a = lhs[i] || 0;
       const b = rhs[i] || 0;
       if (a > b) return true;
       if (a < b) return false;
     }
     return true;
   },
-  captureOpenshellCommand: vi.fn(),
   captureSandboxSshConfigCommand: vi.fn(),
 }));

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/sandbox/version.test.ts` at line 31, Remove the unused mock property
captureOpenshellCommand from the test mocks in version.test.ts: locate the mock
object that currently defines captureOpenshellCommand: vi.fn() and delete that
entry so only the active helper (captureSandboxSshConfigCommand) remains; ensure
no other tests reference captureOpenshellCommand and run the test suite to
confirm no breakage.

src/lib/actions/sandbox/skill-install.ts (1)

171-173: ⚡ Quick win

Add an explicit timeout to SSH-config capture in skill install.

Line 171 performs a blocking OpenShell probe without an explicit timeout; a hung CLI call can stall the command.

♻️ Proposed patch

 import { captureSandboxSshConfig } from "../../adapters/openshell/runtime";
+import { OPENSHELL_PROBE_TIMEOUT_MS } from "../../adapters/openshell/timeouts";
@@
   const sshConfigResult = captureSandboxSshConfig(sandboxName, {
     ignoreError: true,
+    timeout: OPENSHELL_PROBE_TIMEOUT_MS,
   });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/actions/sandbox/skill-install.ts` around lines 171 - 173, The call to
captureSandboxSshConfig(sandboxName, { ignoreError: true }) can block
indefinitely; add an explicit timeout (e.g., 5–15s) so the skill install cannot
hang: either extend the call to pass a timeout option if captureSandboxSshConfig
supports it (e.g., { ignoreError: true, timeoutMs: 10000 } or an AbortSignal),
or wrap the call in a Promise.race that rejects after the timeout and then
handle the timeout error the same way ignoreError is handled; update the
invocation in skill-install.ts (the captureSandboxSshConfig usage) to use the
timeout and ensure any thrown timeout is caught/logged consistent with existing
error handling.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/state/sandbox.ts (1)

1376-1389: Run the targeted lifecycle E2E suites before merge.

This restore-path update changes backup/restore persistence behavior; please run state-backup-restore-e2e, snapshot-commands-e2e, and rebuild-openclaw-e2e for confidence on state integrity.

As per coding guidelines: src/lib/state/sandbox.ts changes should validate state-backup-restore-e2e, snapshot-commands-e2e, and rebuild-openclaw-e2e.

Also applies to: 1401-1406

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/state/sandbox.ts` around lines 1376 - 1389, This change around
restore behavior (calling shouldPreserveOpenClawManagedExtensions,
buildRestoreTarArgs and using spawnSync to run tar producing tarResult) requires
running the targeted lifecycle E2E suites to validate state integrity; run
state-backup-restore-e2e, snapshot-commands-e2e, and rebuild-openclaw-e2e
against the branch and confirm backups/restores and snapshots behave as before
(including the alternate code paths at the nearby block referenced around lines
where buildRestoreTarArgs/spawnSync/tarResult are used), fix any failing
assertions or state drift observed, and update tests or code
(preserveManagedExtensions handling in shouldPreserveOpenClawManagedExtensions
or argument construction in buildRestoreTarArgs) until all three suites pass.