SSHFS Workspace Plugin

OpenClaw plugin that makes an SSH sandbox workspace the durable filesystem and mounts it into the gateway with SSHFS. The plugin is intentionally topology neutral: every host, path, identity, command, and backend id is supplied through OpenClaw config.

What it registers

• openclaw sshfs-workspace preflight
• openclaw sshfs-workspace feed
• openclaw sshfs-workspace mount
• A sandbox backend whose id defaults to sshfs-workspace-ssh
• A startup service that can run the initial feed and mount when enabled

Prerequisites

The gateway host must have:

• passwordless SSH access to the sandbox target
• strict host key checking with a configured known-hosts file
• ssh, sftp, sshfs, fusermount3, and findmnt

The sandbox host must allow SSH and SFTP for the configured user, and the configured remote canonical workspace path must be writable by that user.

Config Shape

{
  plugins: {
    entries: {
      "sshfs-workspace": {
        enabled: true,
        config: {
          enabled: true,
          mountOnStartup: true,
          initialFeedOnStartup: false,
          backendId: "sshfs-workspace-ssh",
          commands: {
            ssh: "ssh",
            sftp: "sftp",
            sshfs: "sshfs",
            fusermount: "fusermount3",
            findmnt: "findmnt",
          },
          ssh: {
            target: "<ssh-target>",
            identityFile: "<gateway-private-key-path>",
            knownHostsFile: "<gateway-known-hosts-path>",
            strictHostKeyChecking: true,
            updateHostKeys: false,
          },
          workspace: {
            agentId: "<agent-id>",
            localMountPath: "<gateway-mount-path>",
            remoteCanonicalPath: "<sandbox-canonical-workspace-path>",
            localBackupRoot: "<gateway-backup-root>",
            markerRelativePath: ".openclaw/sshfs-workspace/initial-feed.json",
            failureSentinelName: "MOUNT_FAILED.md",
          },
        },
      },
    },
  },
}

Configure the agent sandbox backend separately:

{
  agents: {
    list: [
      {
        id: "<agent-id>",
        sandbox: {
          backend: "sshfs-workspace-ssh",
        },
      },
    ],
  },
}

Build And Install

mise exec -- npm test
mise exec -- npm run build
mise exec -- npm pack
openclaw plugins install @kim-company/[email protected] --force
openclaw daemon restart

Run checks before enabling the backend:

openclaw sshfs-workspace preflight
openclaw sshfs-workspace feed
openclaw sshfs-workspace mount