Greptile Summary

This PR fixes a regression introduced by the skills realpath boundary hardening in 2026.3.9, where managed skills installed via symlink/junction-backed layouts (e.g. clawhub on WSL) were incorrectly rejected with "Skipping skill path that resolves outside its configured root."

Root cause fix: The new shouldEnforceContainedSkillPaths(source) function scopes the realpath containment checks to "openclaw-workspace", "openclaw-extra", and "agents-skills-project" sources only, leaving "openclaw-managed", "openclaw-bundled", and "agents-skills-personal" free to resolve skill roots via symlinks that point outside their parent directory.

Security boundary maintained: The new resolveContainedPathWithinSkillRoot helper is still called for all sources when checking whether a skill's SKILL.md resides inside its own skill directory (not the broader source root). This preserves the protection against a skill dir that is itself legitimately symlinked somewhere else but whose SKILL.md is then further symlinked to an arbitrary location.

Test coverage:

• Regression case: managed skill dir symlinked outside managed root now loads successfully.
• The old "skips workspace skill directories" test was gated to non-Windows; it's now split into a cross-platform version (using the symlinkDir helper, which falls back to junctions on Windows) and a separate file-symlink test that remains gated since file symlinks still require elevated privileges on Windows.
• A new test verifies that a managed skill whose SKILL.md is further symlinked outside its own dir is still blocked.

Confidence Score: 5/5

• Safe to merge — the fix is minimal, well-reasoned, and the security boundary for workspace/extra sources is fully preserved.
• All remaining findings are P2. The core logic is correct: containment enforcement is now scoped to the untrusted workspace/extra/project roots, while the per-skill-dir SKILL.md check still guards all sources against deeper symlink traversal. Tests cover the regression scenario, the kept workspace security case, and the edge case of a doubly-symlinked SKILL.md in a managed skill.
• No files require special attention.

This is a comment left during a code review.
Path: src/agents/skills/workspace.ts
Line: 406-416

Comment:
**`skillDirRealPath` unused after guard**

When `enforceContainedRealpath` is `true`, `resolveContainedSkillPath` resolves and returns the real path of `skillDir`, but that resolved path is assigned to `skillDirRealPath` and then immediately discarded — neither the `filterLoadedSkillsInsideRoot` call nor any later code uses `skillDirRealPath`. The pre-existing code did the same thing, so this isn't a regression, but now that the block is visually isolated it's easier to see that the variable serves only as a guard (non-null == "path is inside root"). A `void` or simple boolean pattern would make the intent clearer, though this is not functionally wrong.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix: re-add loadEnabledClaudeBundleComma..." | Re-trigger Greptile}

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/25444488325
• Updated: 2026-05-06T15:28:00.143Z

Any chance this "Error: [vitest] No "sanitizeUserFacingText" export is defined on the "../pi-embedded-helpers.js" mock. Did you forget to return it from "vi.mock"?" can get addressed so this PR can be merged? It'll really help to cut down on noisy logs.

Addressed.

This PR now includes the follow-up fixes that were needed to get the branch back into a mergeable state after drift with current main:

• fixed the noisy Vitest mock error by updating partial pi-embedded-helpers.js mocks to inherit real exports via vi.importActual(...), so newer exports like
  sanitizeUserFacingText are preserved
• merged latest main and resolved the conflict in src/agents/skills.loadworkspaceskillentries.test.ts while keeping both the newer warning/home-env coverage and this PR’s
  managed-symlink regression coverage
• restored bundled skill roots to containment enforcement so bundled symlink escapes remain fail-closed, while still leaving managed/personal roots outside that root-level
  enforcement

Relevant commits:

• 3d44f1053b test: preserve pi-embedded helper exports in mocks
• dd30cd7792 Merge upstream/main into fix/44051-managed-skills-realpath-scope-clean
• ec9aed9b5d fix(skills): re-enforce bundled skill path containment

Codex review: needs maintainer review before merge.

Summary
The PR scopes skill realpath containment by source, canonicalizes exempt managed/personal skill paths, adds regression coverage and a changelog entry, and updates related pi-embedded test mocks/expectations.

Reproducibility: yes. A high-confidence source reproduction is to put a symlink or junction-backed skill under the managed skills root; current main sends openclaw-managed through the same resolveContainedSkillPath() child-directory check and skips the skill when its realpath leaves that root.

Real behavior proof
Sufficient (terminal): The PR body supplies after-fix terminal output from a real Windows loader run showing a managed symlinked skill loaded from its external realpath target; the official WSL ClawHub CLI was not run, but the same OpenClaw loader path is exercised.

Next step before merge
No automated repair is needed; the latest head addresses prior blockers and should proceed through maintainer review plus required exact-head CI.

Security
Cleared: The diff touches a security-sensitive path boundary, but the latest code keeps untrusted root containment and per-skill SKILL.md containment, with no dependency, workflow, lockfile, or release-script changes.

I ported the fix onto current main and kept the current grouped-skill discovery path intact. The loader now only relaxes root-level realpath containment for managed/
personal skill roots, while workspace, extra, project-agent, and bundled roots remain fail-closed. Per-skill SKILL.md containment still applies for all sources, including
managed symlink/junction-backed skills.

Also added the required CHANGELOG.md entry for #44051 / #59219.

Additional cleanup:

• Added regression coverage for managed symlink/junction skill directories.
• Preserved grouped skills such as skills///SKILL.md.
• Kept workspace and bundled symlink escape behavior covered.
• Fixed the compact harness expectation drift on Windows after the current-main merge