fix(security): include Windows home env roots

luoyanglang · luoyanglang · commit 3b219e794794 · 2026-04-25T07:43:57.000Z
diff --git a/src/agents/sandbox/validate-sandbox-security.ts b/src/agents/sandbox/validate-sandbox-security.ts
@@ -156,6 +156,7 @@ function getBlockedHostPaths(): string[] {
     home: process.env.HOME,
     openclawHome: process.env.OPENCLAW_HOME,
     osHome: os.homedir(),
+    userProfile: process.env.USERPROFILE,
   });
   if (blockedHostPathsCache?.key === cacheKey) {
     return blockedHostPathsCache.paths;
@@ -173,9 +174,15 @@ function getBlockedHostPaths(): string[] {
 function getBlockedHomeRoots(): string[] {
   const roots = new Set<string>();
   for (const candidate of [
+    process.env.OPENCLAW_HOME,
+    process.env.HOME,
+    process.env.USERPROFILE,
     resolveRequiredHomeDir(process.env, os.homedir),
     resolveRequiredOsHomeDir(process.env, os.homedir),
   ]) {
+    if (!candidate) {
+      continue;
+    }
     const normalized = normalizeHostPath(candidate);
     if (normalized !== "/") {
       roots.add(normalized);
