Summary

Remove the entire Docker sandbox infrastructure. RemoteClaw delegates execution to CLI agents (Claude Code, Gemini CLI, Codex CLI, OpenCode) which have their own native sandboxing. The Docker sandbox from OpenClaw's in-process execution model is dead code.

Prerequisite: Pi-embedded agent tools are already removed (#66).

What to Delete

Phase 1: Core Sandbox Directory

Delete the entire src/agents/sandbox/ directory (~39 files):

• Container management: docker.ts, manage.ts, prune.ts, registry.ts, runtime-status.ts
• Filesystem: fs-bridge.ts, fs-paths.ts, host-paths.ts, path-utils.ts, workspace.ts
• Browser sandbox: browser.ts, browser-bridges.ts, novnc-auth.ts
• Config & hashing: config.ts, config-hash.ts, hash.ts, constants.ts
• Security: validate-sandbox-security.ts, sanitize-env-vars.ts, tool-policy.ts
• Networking: network-mode.ts, bind-spec.ts
• Types: types.ts, types.docker.ts, context.ts, shared.ts
• All associated test files (~13 tests)

Phase 2: Root-Level Sandbox Files

Delete sandbox-related files scattered across src/:

src/agents/ root (~20 files):

• sandbox.ts (main entry point), sandbox-paths.ts, sandbox-media-paths.ts
• sandbox-explain.ts, sandbox-tool-policy.ts
• Associated tests: sandbox.resolveSandboxContext.test.ts, sandbox-paths.test.ts,
  sandbox-create-args.test.ts, sandbox-explain.test.ts, sandbox-merge.test.ts,
  sandbox-agent-config.agent-specific-sandbox-config.test.ts,
  pi-tools.sandbox-mounted-paths.workspace-only.test.ts
• Test helpers: test-helpers/host-sandbox-fs-bridge.ts, test-helpers/pi-tools-sandbox-context.ts,
  test-helpers/unsafe-mounted-sandbox.ts, test-helpers/sandbox-agent-config-fixtures.ts

src/cli/:

• sandbox-cli.ts — sandbox CLI subcommand registration
• Remove sandbox entry from src/cli/program/register.subclis.ts

src/commands/ (~10 files):

• sandbox.ts, sandbox.test.ts — main sandbox command
• sandbox-explain.ts, sandbox-explain.test.ts — explain subcommand
• sandbox-formatters.ts, sandbox-formatters.test.ts — output formatting
• sandbox-display.ts — display subcommand
• doctor-sandbox.ts, doctor-sandbox.warns-sandbox-enabled-without-docker.test.ts — health check

src/config/:

• types.sandbox.ts — sandbox config types
• config.sandbox-docker.test.ts — sandbox Docker config tests

src/auto-reply/:

• reply/stage-sandbox-media.ts — sandbox media staging (dead without sandbox)
• stage-sandbox-media.test-harness.ts
• reply.triggers.trigger-handling.stages-inbound-media-into-sandbox-workspace.test.ts

Phase 3: Docker Infrastructure

Delete sandbox-only Docker files:

• Dockerfile.sandbox — minimal sandbox image
• Dockerfile.sandbox-browser — VNC-based browser sandbox
• Dockerfile.sandbox-common — developer sandbox base
• docker-setup.sh — sandbox setup script
• .dockerignore — sandbox build optimization (review: may serve distribution too)

Delete sandbox E2E test infrastructure:

• scripts/docker/install-sh-e2e/ (Dockerfile + run.sh)
• scripts/docker/install-sh-smoke/ (Dockerfile + run.sh)
• scripts/docker/install-sh-nonroot/ (Dockerfile + run.sh)
• scripts/docker/cleanup-smoke/ (Dockerfile + run.sh)

KEEP: Dockerfile (gateway distribution) and docker-compose.yml (gateway services) — these
are NOT sandbox-specific.

Phase 4: Import Cleanup (~15 MODIFY files)

Remove sandbox imports from surviving code:

• src/agents/openclaw-tools.ts — remove SandboxFsBridge type import
• src/security/audit.ts, audit-extra.async.ts, audit-extra.sync.ts — remove sandbox path validation
• src/config/zod-schema.agent-runtime.ts — remove sandbox config schema section
• src/agents/tool-policy.test.ts — remove sandbox tool policy assertions
• src/agents/pi-tools.read.ts — remove sandbox path reading

DO NOT modify files that will be deleted in later work items:

• src/agents/pi-embedded-runner/*.ts — deleted when the pi-embedded execution engine core is gutted
• src/agents/bash-tools.*.ts — deleted when bash/exec tools are gutted

Acceptance Criteria

• src/agents/sandbox/ directory deleted (39 files)
• All root-level *sandbox* files in src/agents/, src/commands/, src/cli/, src/config/ deleted
• Dockerfile.sandbox* (3 files) deleted; main Dockerfile and docker-compose.yml kept
• Sandbox test infrastructure in scripts/docker/ deleted
• Sandbox media staging in src/auto-reply/ deleted
• ~15 surviving files have sandbox imports removed
• sandbox CLI subcommand deregistered from register.subclis.ts
• pnpm build passes
• grep -r "sandbox" src/ shows zero references in surviving non-pi-embedded/non-bash-tools code
  (pi-embedded-runner and bash-tools files may still reference sandbox — they'll be deleted later)

Estimated Scale

~97 files deleted/modified. Large scope but mechanically straightforward — pure deletion with
targeted import cleanup.