bug(cli): --no-keep discards the sandbox audit logs; OCSF lines also flush 1-2 s after exit #4295

Activity

1. github-actions

   added

   state:triage-neededOpened without agent diagnostics and needs triageOpened without agent diagnostics and needs triage

   on Oct 7, 2026
2. github-actions commented on Oct 22, 2026

   

   github-actionsBot

   on Oct 22, 2026 – with GitHub Actions

   More actions

   This issue has had no activity for 14 days and is now marked stale. It may be closed in 14 days if there is no further activity. Comment or remove the state:stale label to keep it open.
3. github-actions

   added

   state:staleInactive item at risk of automatic closure.Inactive item at risk of automatic closure.

   on Oct 22, 2026
4. krishicks commented on Oct 23, 2026

   

   krishicks

   on Oct 23, 2026

   Collaborator

   More actions

   Thanks for the report. We're treating this as a feature request rather than a bug, with the scope reframed as follows.

   Retaining logs after a sandbox exits. --no-keep deleting the sandbox and its gateway-side log buffer is expected today, but we think the gateway should retain, or at least be able to retain, a sandbox's logs for some period after it exits. The gateway already holds the human-readable OCSF shorthand for the sandbox in memory, so serving it for a while after the sandbox is gone is a natural extension of what openshell logs already does. How long to retain is not clear yet (a fixed default, a configurable period, size caps) and needs a design decision.

   Why not just a collector. Configuring [openshell.gateway.otlp.ocsf] is the supported way to keep a durable audit trail, and the supervisor flushes the exporter on exit. But a collector receives the OCSF JSONL, not the shorthand, so it does not give the readable view this issue asks for.

   The 1-2 s tail. Retention depends on this. The OTLP exporter flushes on shutdown, so the late lines are most likely on the gateway log-stream path that openshell logs reads. If the tail is lost there, retained logs will be incomplete, so the flush-on-exit behavior needs to be investigated and fixed as part of this work. Until then, a logs call right after exit can miss the last lines.

   Smaller pieces that can land independently:

   • A notice on --no-keep (or documentation) that logs are not retrievable after the sandbox is deleted.
   • Documenting where sandbox and OCSF logs live and how long they are kept, which overlaps docs: document sandbox and OCSF log retention, rotation and on-disk location per driver #4297.

   Open question: what retention period and limits make sense for retained logs?
5. github-actions

   removed

   state:staleInactive item at risk of automatic closure.Inactive item at risk of automatic closure.

   on Oct 24, 2026