[Ubuntu 26.04][Sandbox] snapshot restore fails deterministically when an unsafe file sits at the MCP projection path

[hulynn]

Description

snapshot restore fails deterministically (3 out of 3 attempts) when an unsafe file (dangling symlink or FIFO) has been placed at the managed MCP projection path inside the sandbox. The restore reports a failed file and leaves the sandbox not fully returned to the clean snapshot state — the unsafe file itself is also left in place afterward.

Platform scope: Reproduced on Ubuntu 26.04 x86_64 with a Deep Agents Code sandbox; other agents/platforms not tested.
Regression: Unknown — earlier versions not tested.
OpenShell issue: No

Environment

Device:        x86_64 server, NVIDIA RTX PRO 6000 Blackwell Server Edition
OS:            Ubuntu 26.04 LTS
Architecture:  x86_64
Node.js:       v22.23.2
npm:           10.9.8
Docker:        29.7.2
OpenShell CLI: 0.0.106
NemoClaw:      v0.0.117
OpenClaw:      N/A (Deep Agents Code sandbox tested; no OpenClaw sandbox involved in this repro)

Steps to Reproduce

1. Onboard a Deep Agents Code sandbox, add a healthy managed MCP server, and create a snapshot while it is healthy:

   nemoclaw {sandbox} snapshot create --name qa-clean

2. Replace the managed MCP projection file with an unsafe type, e.g. a dangling symlink:

   nemoclaw {sandbox} exec -- sh -lc 'rm -f /sandbox/.deepagents/.nemoclaw-mcp.json && ln -s /tmp/missing-nemoclaw-mcp.json /sandbox/.deepagents/.nemoclaw-mcp.json'

3. Attempt to restore the snapshot:

   nemoclaw {sandbox} snapshot restore qa-clean --yes

4. Repeat step 2 (using a FIFO instead of a symlink this time) and step 3 again.

Expected Result

The restore completes successfully, exits 0, and returns the sandbox (including the projection path) to the clean snapshot state.

Actual Result

Both attempts (symlink case and FIFO case) failed identically:

Using snapshot v1 name=qa-clean
Restoring snapshot into '{sandbox}'...
Restore failed.
Partial: .state, skills
Failed files: config.toml
EXITCODE:1

The unsafe file at the projection path remained in place after each failed restore attempt — the sandbox was not returned to Ready/clean state either time.

Logs

Not captured (terminal output above is the complete evidence for this defect).