Security fix: removed curl|sudo install path. See openclaw/clawhub#1376

Breaking change

• localPath default changed from "shared" to "" (workspace root). Most users want to sync the entire workspace, not a subfolder. If you relied on the "shared" default, explicitly set "localPath": "shared" in your config.

Safety fix

• Absolute paths rejected: localPath must now be a relative path. Absolute paths like "/" are rejected with a clear error. Previously, localPath: "/" caused path.join(workspace, "/") to resolve to /, making rclone sync the entire container filesystem to the remote and deleting files from cloud storage.

Docs

• Config table updated with clear localPath explanation
• Common pitfalls section updated with absolute path warning
• Example configs updated to remove localPath: "/"

Bug fix

• Session hooks now respect sync mode. The onSessionStart and onSessionEnd hooks were hardcoded to run bisync regardless of the configured mode. Now they correctly dispatch: mailbox runs push, mirror runs pull, bisync runs bisync. This caused unexpected bisync attempts when mode was set to mailbox.

What's new

• Encrypted backup feature — stream encrypted snapshots (tar | openssl | rclone rcat) of your entire agent system to S3, R2, B2, or any rclone backend. Zero local temp files, automatic retention pruning.
• Nested config format — new { sync: {}, backup: {} } config structure (flat format still supported for backward compatibility).
• README restructured — sync and backup presented as equal peers with a "What's included" overview table, better section ordering, and clearer navigation.
• Vertical backup diagram — backup pipeline Mermaid diagram now renders top-down for better readability.

See the README for full documentation.

Fix: add mode, ingest, ingestPath to configSchema (fixes config validation error)

What's new in 2.1.x

Mailbox sync mode (v2.1.0)

New mailbox mode — the safest sync pattern. The agent workspace pushes to the cloud; users drop files in _outbox/ to send them to the agent's _inbox/.

Each sync cycle:

1. rclone sync pushes the workspace to the cloud (excluding _inbox/ and _outbox/)
2. rclone move drains the cloud _outbox/ into the workspace _inbox/, deleting from cloud after transfer

On startup, the plugin bootstraps both directories automatically.

Three modes now available:

• mailbox — push + inbox/outbox (safest, recommended)
• mirror — remote→local one-way (safe)
• bisync — bidirectional (advanced)

Mermaid diagrams rendered for npm (v2.1.1)

Added a prepublish script that renders Mermaid flowcharts to SVG so diagrams display correctly on npmjs.com (npm doesn't render Mermaid natively). GitHub continues to render the Mermaid source blocks directly.

Dropbox setup docs (v2.1.0)

• Added Redirect URI step (http://localhost:53682/) — required for rclone OAuth to work with Dropbox scoped apps (fixes #1)
• Clarified that remotePath must be "" when using app folder scoped Dropbox apps (fixes #2)

New rclone operations

• runMove — wraps rclone move (used for mailbox drain)
• runMkdir — wraps rclone mkdir (used for mailbox bootstrap)

Critical Fix

• --resync is never automatic. The plugin will never auto-resync — not in the periodic sync manager, not in runBisync retry logic. --resync only happens when the user explicitly passes it via CLI. Previously, a failed sync could trigger repeated --resync cycles that copied the entire remote back to local, undoing deletions.

Fixes

• Concurrency guard: If a sync is still running when the periodic timer fires, the cycle is skipped instead of starting a second parallel sync.
• Minimal default excludes: Only **/.DS_Store is excluded by default. All other patterns (.git, node_modules, etc.) are the user's choice via config.
• Auto-clear stale lock files: Detects and clears stale rclone lock files before retrying. --max-lock 15m expires locks older than 15 minutes.
• Resilient sync: --recover and --resilient flags for automatic recovery from interrupted syncs.
• Real-time streaming output: Rclone output streamed line-by-line; errors/warnings at info level, details at debug.
• Configurable timeout: timeout config option (seconds, default 1800 / 30 min).
• Verbose via core flag: Controlled by OpenClaw's --verbose / --log-level debug.

Docs

• Prominent --resync warning in README and SKILL.md explaining that it is destructive and should only be used when explicitly needed.
• Updated config reference, auto-recovery docs, and troubleshooting.

OpenClaw Workspace Cloud Sync Plugin

Bidirectional workspace sync between your OpenClaw agent and cloud storage via rclone.

Install

openclaw plugins install openclaw-workspace-sync

Features

• Bidirectional sync via rclone bisync — changes flow both ways
• Config-driven setup — no manual rclone.conf editing needed
• Session hooks — auto-sync on session start/end
• Background sync — interval-based periodic sync (zero LLM cost)
• Bundled agent skill — the agent can trigger sync operations
• CLI commands — openclaw workspace setup/sync/status/authorize/list

Supported Providers

All providers are fully config-driven. The custom provider gives access to all 70+ rclone backends (SFTP, B2, Mega, pCloud, Azure Blob, etc.).

Links

• npm: openclaw-workspace-sync
• Docs: README
• Meta issue: openclaw/openclaw#18106