2026-02-02 00:17:38 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： OpenClaw是一个自托管AIAgent框架，采用Gateway与Workspace设计，将Agent视为进程管理。支持多模型与IM交互，具备自我修复能力。本文解析其核心架构、部署代理配置、自定义Skills机制，以及基于sessions工具的多Agent编排与通信模式，为构建本地自动化智能助手提供参考。 综合评分： 91 文章分类： AI安全,安全工具,解决方案,安全运营

cover_image

OpenClaw 架构解析：一个把 Agent 当作“操作系统进程”来设计的 AI 框架

原创

做安全的小明同学做安全的小明同学

大山子雪人

2026年2月1日 09:10 北京

openclaw技术架构解析

0x00 openclaw是什么

• 自托管（self-hosted）的 AI Agent 框架
• 能部署在自己的服务器 / 本地硬件上运行
• 以类 Agent 的方式自动执行任务，而不是简单聊天
• 能集成多种大模型（Claude、GPT、Gemini 等）
• 可通过消息平台（如 WhatsApp、Telegram、iMessage 等）与它交互
• 有自动重启、自我修复、插件扩展（skill）能力
• 类似自动化、可执行任务版的智能助手框架

0x01 openclaw的架构

总体架构：一个“常驻 Gateway + 多会话 Agent + Skills/Tools + 多端接入”的系统

可以把 OpenClaw 理解为：你自己机器上的 Agent OS，外面通过经过适配的IM软件的“聊天入口”来操控。它的核心是 Gateway（常驻服务），负责把消息 → 会话 → 模型推理 → 工具执行 → 回复 这一整条链路串起来。

整体架构

┌──────────────────────────────────────────────────────────┐
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;User / External World &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp;(Telegram / Discord / CLI / HTTP / Webhook) &nbsp; &nbsp; &nbsp; &nbsp;│
└───────────────────────────▲──────────────────────────────┘
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ inbound messages / events
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
┌───────────────────────────┴──────────────────────────────┐
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Gateway &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp;────────────────────────────────────────────────────── &nbsp;│
│ &nbsp;• Channel adapters (tg / dc / http / cli …) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;• bindings &nbsp;(peer / accountId → agentId) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp;• agent registry (agents.list) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;• auth profiles / secrets &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp;• sandbox & tool policy enforcement &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
└───────────────────────────▲──────────────────────────────┘
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ route to agent
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
┌───────────────────────────┴──────────────────────────────┐
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Agent Runtime &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;(per agent, isolated workspace + persona) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;┌────────────────────────────────────────────────────┐ &nbsp;│
│ &nbsp;│ &nbsp;Workspace (agent local universe) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;│
│ &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp;│
│ &nbsp;│ &nbsp;IDENTITY.md &nbsp; → 我是谁（角色 / 边界） &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;│
│ &nbsp;│ &nbsp;SOUL.md &nbsp; &nbsp; &nbsp; → 行为哲学 / 推理风格 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp;│
│ &nbsp;│ &nbsp;AGENTS.md &nbsp; &nbsp; → ⭐ 多 agent 编排规则 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;│
│ &nbsp;│ &nbsp;TOOLS.md &nbsp; &nbsp; &nbsp;→ 工具使用协议 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;│
│ &nbsp;│ &nbsp;BOOTSTRAP.md &nbsp;→ 启动注入上下文 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;│
│ &nbsp;│ &nbsp;USER.md &nbsp; &nbsp; &nbsp; → 用户画像 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ &nbsp;│
│ &nbsp;│ &nbsp;HEARTBEAT.md &nbsp;→ 周期性守护 / 自检 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp;│
│ &nbsp;│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp;│
│ &nbsp;│ &nbsp;memory/ &nbsp; &nbsp; &nbsp; → 长期 / 短期记忆 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp;│
│ &nbsp;│ &nbsp;skills/ &nbsp; &nbsp; &nbsp; → 能力描述（函数 / MCP 客户端） &nbsp; &nbsp; &nbsp; &nbsp;│ &nbsp;│
│ &nbsp;└────────────────────────────────────────────────────┘ &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;──────────────── Tool Invocation Layer ─────────────── &nbsp;│
│ &nbsp;• exec / apply_patch / web / fs &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;• sessions_spawn (sub-agents) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;• MCP calls &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
└───────────────────────────▲──────────────────────────────┘
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ spawn / call
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
┌───────────────────────────┴──────────────────────────────┐
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Sub-Agent Sessions &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;(research / coder / reviewer / ops …) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;• 独立 agentId / workspace / tools &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp;• 独立 sandbox 权限 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;• 异步执行 → result announce 回主 agent &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
└───────────────────────────▲──────────────────────────────┘
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │ tool reminding / execution
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
┌───────────────────────────┴──────────────────────────────┐
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Tool & MCP Ecosystem &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;• Built-in tools (exec, patch, web, fs) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
│ &nbsp;• MCP Servers (ADB / Frida / Git / Scanner / CI) &nbsp; &nbsp; &nbsp; &nbsp; │
│ &nbsp;• External services (cloud, repos, infra) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;│
└──────────────────────────────────────────────────────────┘

workspace目录结构

一个workspace定可以理解为对应的一个数字人, 这个“人”有id，有大脑，有记忆，有行为规则，有工具箱。并且定义了可以和哪些其他数字人进行交互。 ~/.openclaw/workspace

AGENTS.md &nbsp; &nbsp;BOOTSTRAP.md HEARTBEAT.md IDENTITY.md &nbsp;memory &nbsp; &nbsp; &nbsp; skills &nbsp; &nbsp; &nbsp; SOUL.md &nbsp; &nbsp; &nbsp;TOOLS.md &nbsp; &nbsp; USER.md

这些文件表示OpenClaw / Agent Runtime 的角色分工接口。可以把 workspace 看成一个「agent 的可执行人格与运行态目录」，这些文件分别对应身份、启动、能力、记忆、心跳、用户态输入等不同“通道”。

• IDENTITY.md —— “我是谁”，定义 agent 的身份、定位、边界
• SOUL.md —— “我怎么思考 & 行事”，定义 agent 的性格、思维方式、价值排序
• AGENTS.md —— 多 agent 编排的核心，定义如何调用 / 派发其他 agent
• TOOLS.md —— 工具使用协议，描述什么时候使用什么工具，什么时候不能使用，用前/用后应该注意什么
• skills/ —— 能力实现层（函数 / MCP / 插件）
• BOOTSTRAP.md —— 启动注入，一次性的
• USER.md —— 用户画像 / 偏好，描述用户是谁 & 怎么协作
• memory/ —— 长期 & 短期记忆
• HEARTBEAT.md —— 周期性自检 / 守护逻辑

0x02 部署

curl -fsSL https://openclaw.bot/install.sh | bash

特殊配置 大部分模型需要特殊的网络环境才能访问，而Node 运行环境里的 fetch（通常是 Node 18+ 内置的 undici fetch）默认不会读取 HTTP_PROXY/HTTPS_PROXY 环境变量。所以即使设置了HTTP_PROXY/HTTPS_PROXY也不会走代理。需要对openclaw进行一些小的改动

npm install undici

在openclaw启动脚本注入一段代码，我放在了~/.config/openclaw/proxy-bootstrap.mjs

import&nbsp;{ setGlobalDispatcher,&nbsp;ProxyAgent&nbsp;}&nbsp;from&nbsp;"undici";

const&nbsp;proxy = process.env.OC_PROXY&nbsp;|| process.env.HTTP_PROXY&nbsp;|| process.env.HTTPS_PROXY;
if&nbsp;(!proxy) {
&nbsp;&nbsp;console.error("[proxy-bootstrap] no proxy set");
}&nbsp;else&nbsp;{
&nbsp;&nbsp;setGlobalDispatcher(new&nbsp;ProxyAgent(proxy));
&nbsp;&nbsp;console.error("[proxy-bootstrap] undici proxy =", proxy);
}

export&nbsp;OC_PROXY="http://127.0.0.1:8080"
export&nbsp;NODE_OPTIONS="--import ~/.config/openclaw/proxy-bootstrap.mjs"

这样，就可以使得所有请求经过自定义代理。在浏览器打开http://127.0.0.1:18789/

0x03 添加自定义skills

OpenClaw 的 skill = 一个可被 LLM 调用的工具目录.本质是： 描述文件（SKILL.md） + 可执行入口（脚本/程序） + 可选权限声明

skill的默认目录在~/.openclaw/workspace/skills/,每个 skill 一个子目录，例如：

~/.openclaw/workspace/skills/
└── my-http-fetch/
&nbsp; &nbsp; ├── SKILL.md
&nbsp; &nbsp; ├── fetch.sh
&nbsp; &nbsp; └── fetch.py

➜ &nbsp;workspace git:(master) ✗ tree
.
├── AGENTS.md
├── BOOTSTRAP.md
├── HEARTBEAT.md
├── IDENTITY.md
├── memory
│ &nbsp; └── 2026-01-31-0712.md
├── skills
│ &nbsp; └── claude-android-skill
│ &nbsp; &nbsp; &nbsp; ├── assets
│ &nbsp; &nbsp; &nbsp; │ &nbsp; └── templates
│ &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; ├── libs.versions.toml.template
│ &nbsp; &nbsp; &nbsp; │ &nbsp; &nbsp; &nbsp; └── settings.gradle.kts.template
│ &nbsp; &nbsp; &nbsp; ├── LICENSE
│ &nbsp; &nbsp; &nbsp; ├── README.md
│ &nbsp; &nbsp; &nbsp; ├── references
│ &nbsp; &nbsp; &nbsp; │ &nbsp; ├── architecture.md
│ &nbsp; &nbsp; &nbsp; │ &nbsp; ├── compose-patterns.md
│ &nbsp; &nbsp; &nbsp; │ &nbsp; ├── gradle-setup.md
│ &nbsp; &nbsp; &nbsp; │ &nbsp; ├── modularization.md
│ &nbsp; &nbsp; &nbsp; │ &nbsp; └── testing.md
│ &nbsp; &nbsp; &nbsp; ├── scripts
│ &nbsp; &nbsp; &nbsp; │ &nbsp; └── generate_feature.py
│ &nbsp; &nbsp; &nbsp; └── SKILL.md

执行命令openclaw skills list, 可以看到配置的skill已生效

通过具体看skill代码，其实发现，skill是对能力的详细描述，能做什么，不能做什么，有什么权限，什么时候用。要写一个skill其实是很复杂的事情，不过我们可以通过LLM帮助我们写好skill。

有了skill后，就可以在最少量token实现和其他tools，mcp的互相调用。

• Skill 是能力接口与使用语义的声明层
• Tool / MCP Server 是能力的执行实现层
• Agent（LLM）负责在运行时把目标 → Skill → Tool/MCP串起来

0x04 agent之间互相调用

在 OpenClaw 里，“多个 agent 互相调用”的主流实现不是让 agent 直接 import 彼此，而是通过 Session Tools（sessions_*）做 跨会话消息编排：一个 agent 把任务发给另一个 agent 的 session，对方处理完再回消息.

核心工具：sessions_*（agent-to-agent 通信骨架）

OpenClaw 内置一组专门为“agent-to-agent”设计的小工具集：

• sessions_list：列出当前有哪些 session（包含 agent / channel / 元数据）
• sessions_history：取某个 session 的对话历史（用于“读结果”）
• sessions_send：给另一个 session 发消息（用于“派活”）
• sessions_spawn：创建/拉起一个新 session（用于“起一个子 agent/子会话”）

这套工具的设计目标就是“少而不易误用”，用来让 agent 能发现其他 session、发消息、取结果

典型模式：Coordinator（主控）→ Worker（执行）

A. 主控发现可用 worker

主控调用 sessions_list 找到目标 worker 的 sessionId。

B. 主控派发任务

用 sessions_send 把任务发给 worker，例如：

“去总结日志”,“去跑一次 adb 检查”,“去做 web research（如果该 agent 有浏览权限）”

C. 收集结果

两种拿结果方式：让 worker 回消息给主控；主控用 sessions_history 主动拉 worker 会话最近输出再提取要点.

tips

把“回执协议”写进 system prompt。比如：coordinator 给 worker 的消息都以：TASK: 开头。附带 REPLY_TO_SESSION=<id>. worker 输出必须包含：RESULT:（摘要）, ARTIFACTS:（文件路径/链接）,NEXT:（是否需要追问）.这样 coordinator 用 sessions_history 抓取时非常稳，不会被闲聊污染。

0x05 如何编排多个agent

在 OpenClaw 里，编排多个agent通常分两层来做：入口路由（谁接这条消息） + 任务分解（一个 agent 拉起多个 sub-agent 干活）。

入口层：用 agents.list + bindings 把不同消息路由到不同 agent

可以在同一个 Gateway 里配置多个完全隔离的 agent（各自 workspace、agentDir、session store、auth profiles），然后用 bindings 把不同平台/账号/群聊映射到不同 agent。

agents.list：定义多个 agent（workspace、model、tools/sandbox 等）

bindings：把 inbound channel 的“来源（账号/群/peer）”绑定到某个 agent

执行层：用 sessions_spawn 把复杂任务拆给 sub-agent

当同一个入口 agent需要并行/分工时，就需要用到 subagents 机制。

1. 先用 agents_list 看当前会话允许 spawn 哪些 agentId（受 subagents.allowAgents 限制）
2. 再用 sessions_spawn 启动子会话去跑一个明确的 task，完成后会把结果返回主agent

下面给一个多agent的demo config，默认放在~/.openclaw/gateway/config.json

{
&nbsp;&nbsp;"agents":{
&nbsp; &nbsp;&nbsp;"defaults":{
&nbsp; &nbsp; &nbsp;&nbsp;"workspace":"~/.openclaw/workspace-main",

&nbsp; &nbsp; &nbsp;&nbsp;// Default model (can be overridden per agent via agents.list[].model)
&nbsp; &nbsp; &nbsp;&nbsp;// String form is allowed: "provider/model"
&nbsp; &nbsp; &nbsp;&nbsp;"model":"openai/gpt-5.2",

&nbsp; &nbsp; &nbsp;&nbsp;// Sandbox defaults (can be overridden per agent via agents.list[].sandbox)
&nbsp; &nbsp; &nbsp;&nbsp;// mode: "off" | "non-main" | "all"
&nbsp; &nbsp; &nbsp;&nbsp;// workspaceAccess: "none" | "ro" | "rw"
&nbsp; &nbsp; &nbsp;&nbsp;"sandbox":{
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"mode":"non-main",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"workspaceAccess":"rw",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"scope":"session"
&nbsp; &nbsp; &nbsp;&nbsp;},

&nbsp; &nbsp; &nbsp;&nbsp;// Defaults for subagent runs (optional; subagent inherits caller unless overridden)
&nbsp; &nbsp; &nbsp;&nbsp;"subagents":{
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// If you want a different default model for spawned subagents, set it here.
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// "model": "openai/gpt-5.2"
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"archiveAfterMinutes":60
&nbsp; &nbsp; &nbsp;&nbsp;}
&nbsp; &nbsp;&nbsp;},

&nbsp; &nbsp;&nbsp;// ====== Multi-agent routing + per-agent overrides ======
&nbsp; &nbsp;&nbsp;"list":[
&nbsp; &nbsp; &nbsp;&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"id":"main",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"default":true,
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"name":"Orchestrator",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"workspace":"~/.openclaw/workspace-main",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"agentDir":"~/.openclaw/agents/main/agent",

&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// The key: main is allowed to spawn these worker agent ids via sessions_spawn.agentId
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"subagents":{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"allowAgents":["research","coder","reviewer"]
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;},

&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// Orchestrator usually needs "sessions_spawn" + some minimal runtime tools.
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// Tool policy shape: allow/deny + profile; deny always wins.:contentReference[oaicite:1]{index=1}
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"tools":{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"profile":"default",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"allow":[
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// keep minimal; add more as you need
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"sessions_spawn",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"agents_list"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;],
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"deny":[]
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;},

&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// You can choose to keep orchestrator less privileged too; sample keeps defaults.
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"sandbox":{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"mode":"non-main",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"workspaceAccess":"rw",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"scope":"session"
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;}
&nbsp; &nbsp; &nbsp;&nbsp;},

&nbsp; &nbsp; &nbsp;&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"id":"research",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"name":"Research Worker",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"workspace":"~/.openclaw/workspace-research",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"agentDir":"~/.openclaw/agents/research/agent",

&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// A common pattern: research agent can browse/search but has no shell / write access.
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"sandbox":{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"mode":"all",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"workspaceAccess":"ro",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"scope":"session"
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;},
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"tools":{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"profile":"default",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"allow":[
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// put your web tools here if you use them
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"web_search",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"web_fetch"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;],
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"deny":[
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"exec",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"apply_patch"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;]
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;}
&nbsp; &nbsp; &nbsp;&nbsp;},

&nbsp; &nbsp; &nbsp;&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"id":"coder",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"name":"Coding Worker",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"workspace":"~/.openclaw/workspace-coder",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"agentDir":"~/.openclaw/agents/coder/agent",

&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// Coding worker: typically needs rw workspace + patch/apply tools; keep sandboxed.
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"sandbox":{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"mode":"all",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"workspaceAccess":"rw",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"scope":"session"
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;},
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"tools":{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"profile":"default",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"allow":[
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"apply_patch",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"exec"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;],
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"deny":[]
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;}
&nbsp; &nbsp; &nbsp;&nbsp;},

&nbsp; &nbsp; &nbsp;&nbsp;{
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"id":"reviewer",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"name":"Review Worker",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"workspace":"~/.openclaw/workspace-reviewer",
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"agentDir":"~/.openclaw/agents/reviewer/agent",

&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// Reviewer: ro workspace, no shell, focus on reading + reasoning.
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"sandbox":{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"mode":"all",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"workspaceAccess":"ro",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"scope":"session"
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;},
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"tools":{
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"profile":"default",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"allow":[],
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"deny":[
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"exec",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"apply_patch"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;]
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;}
&nbsp; &nbsp; &nbsp;&nbsp;}
&nbsp; &nbsp;&nbsp;]
},

// ====== Bindings: route inbound messages to an agent ======
// Deterministic match order exists (peer/guild/team/accountId/*/default).:contentReference[oaicite:2]{index=2}
"bindings":[
&nbsp; &nbsp;&nbsp;// Example: route YOUR DM (peer id) to main orchestrator
&nbsp; &nbsp;&nbsp;{"match":{"peer":"your-peer-id-here"},"agent":"main"},

&nbsp; &nbsp;&nbsp;// Fallback: route everything else to main (channel-wide)
&nbsp; &nbsp;&nbsp;{"match":{"accountId":"*"},"agent":"main"}
]
}

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：大山子雪人做安全的小明同学做安全的小明同学《OpenClaw 架构解析：一个把 Agent 当作“操作系统进程”来设计的 AI 框架》