Closing this PR because the author has more than 10 active PRs in this repo. Please reduce the active PR queue and reopen or resubmit once it is back under the limit. You can close your own PRs to get back under the limit.

Greptile Summary

This PR tightens sandbox bind validation by blocking eight credential-bearing home-directory subpaths (.aws, .cargo, .config, .docker, .gnupg, .netrc, .npm, .ssh) under both the effective OpenClaw home and the OS home directory, with symlink-resolution so alias paths cannot bypass the check. Test coverage is focused and well-structured, with proper afterEach(vi.unstubAllEnvs()) teardown.

Confidence Score: 5/5

Safe to merge; the security fix is correct and well-tested, with one minor documentation inaccuracy to clean up.

All findings are P2 (stale JSDoc claiming "no filesystem I/O" on getBlockedBindReason). The security logic is sound, both home roots are properly blocked, symlink aliases are resolved, and test coverage is comprehensive. No correctness or data-integrity issues found.

The JSDoc and inline comment on getBlockedBindReason in validate-sandbox-security.ts should be updated to remove the "no filesystem I/O" claim.

This is a comment left during a code review.
Path: src/agents/sandbox/validate-sandbox-security.ts
Line: 104-117

Comment:
**Stale "no filesystem I/O" JSDoc contract**

The exported JSDoc on `getBlockedBindReason` explicitly states "String-only blocked-path check (no filesystem I/O)", but after this PR the function calls `getBlockedHostPaths()` → `getBlockedHomeRoots()` → `resolveSandboxHostPathViaExistingAncestor()` which in turn calls `fs.existsSync` and `fs.realpathSync` to canonicalize the home directory. The inline comment at the call-site in `validateBindMounts` ("Fast string-only check") has the same inaccuracy. Callers such as `src/security/audit-extra.sync.ts` happen to tolerate synchronous I/O, but the published contract is now wrong and will mislead future readers.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (4): Last reviewed commit: "fix(sandbox): harden blocked credential ..." | Re-trigger Greptile}

@codex review

@greptile review

Codex Review: Didn't find any major issues. Delightful!

Closing this PR because the author has more than 10 active PRs in this repo. Please reduce the active PR queue and reopen or resubmit once it is back under the limit. You can close your own PRs to get back under the limit.