Catch-up merge: openclaw/openclaw@d1b33a6 → platform-runtime (openclaw#1733)

Fork was a true git-fork 127 ahead / 17,806 behind upstream. This is the curated catch-up merge (real merge-base be8b4dc8), conflicts resolved per a pre-vetted per-file triage.

Status: DRAFT — merge fully resolved (0 unmerged paths, 0 conflict markers), branch pushed. Build/typecheck/test + one ssh.ts API-mapping verification are pending a follow-up commit on this branch.

Resolution plan applied

• Take-upstream (low fork divergence): ssh-config, ssh-tunnel, settings-runtime, docker-backend (+re-graft owned-env), etc.
• Keep-ours (11 Rockie isolation surfaces): owner-only-tools.ts, fs-pinned-path-helper.ts, fs-pinned-write-helper.ts (all 3 deleted upstream — kept), sandbox/ssh.ts, ssh-backend.ts, docker.ts, workspace-mounts.ts, tool-policy-audit.ts, tls/gateway.ts, ffmpeg-exec.ts, local-media-access.ts.
• Careful re-graft (thin Rockie hook over big upstream churn): bash-tools.exec*, process/exec, mcp-stdio-transport, tool-policy-pipeline, gateway/server.impl, gateway/server-node-events, sandbox/browser, supervisor/*, etc.

🔒 SECURITY HUNKS FOR REVIEW (please verify before merge)

Isolation guards grep-confirmed present post-merge:

• buildOwnedChildEnv + secret-redactor in sandbox/ssh.ts
• assertProductionSshConfigDoesNotMaterializeIdentityData in sandbox/ssh-backend.ts
• read-only tenant skill-mount isolation in sandbox/docker.ts
• owner-only-tools.ts, fs-pinned-{path,write}-helper.ts retained (not deleted)
• token-auth in gateway/server.impl.ts

One open item: sandbox/ssh.ts symlink-escape guard — upstream renamed the API resolveBoundaryPath → resolveRootPath (@openclaw/fs-safe/advanced). The follow-up commit must confirm the call is mapped to the new signature and the boundary check still throws on escape.

Follow-up before ready-for-review

1. Verify the resolveBoundaryPath→resolveRootPath mapping in ssh.ts.
2. pnpm install + build + typecheck + test; fix breakages (incl. the lint RangeError a format hook hit on one file).
3. Re-run the isolation-guard self-check; mark PR ready.

Refs openclaw#1733. Do not merge until the security hunks are reviewed.