feat(openclaw): normalize host paths for split-root workspace routing

.env.example

@@ -54,6 +54,10 @@ ARCHIVE_ON_STARTUP=false
 # Production: http://openclaw-workspace.<namespace>.svc.cluster.local:8080
 OPENCLAW_WORKSPACE_URL=http://localhost:8080
 OPENCLAW_WORKSPACE_TOKEN=your-workspace-token
+# Optional: additional remap prefixes (comma-separated).
+# Built-in prefixes are always active:
+#   /home/node/.openclaw/workspace, ~/.openclaw/workspace, /home/node/.openclaw, ~/.openclaw
+OPENCLAW_PATH_REMAP_PREFIXES=
 
 # ── OpenClaw Gateway Integration (optional) ──────────────────
 # Local dev: kubectl port-forward -n <namespace> svc/openclaw 18789:18789

README.md

@@ -130,7 +130,13 @@ To use agent management, workspace browsing, and org chart features, MosBot API
 
 - **OpenClaw runs on a VPS or remote host** — Expose ports 8080 and 18789 on the VPS (firewall/security group). If MosBot API runs on the **same** VPS, use `http://localhost:8080` and `http://localhost:18789`. If the API runs elsewhere, use the VPS hostname or IP (e.g. `http://openclaw.example.com:8080`). Prefer a VPN or private network when exposing these services across the internet.
 
-Add to `.env`: `OPENCLAW_WORKSPACE_URL`, `OPENCLAW_WORKSPACE_TOKEN`, `OPENCLAW_GATEWAY_URL`, `OPENCLAW_GATEWAY_TOKEN`. See [docs/openclaw/README.md](docs/openclaw/README.md) and [docs/guides/openclaw-local-development.md](docs/guides/openclaw-local-development.md) for details.
+Add to `.env`: `OPENCLAW_WORKSPACE_URL`, `OPENCLAW_WORKSPACE_TOKEN`, `OPENCLAW_GATEWAY_URL`,
+`OPENCLAW_GATEWAY_TOKEN`, and optionally `OPENCLAW_PATH_REMAP_PREFIXES` for extra host-path
+remaps. Built-in prefixes are always active:
+`/home/node/.openclaw/workspace`, `~/.openclaw/workspace`, `/home/node/.openclaw`,
+`~/.openclaw` (most specific prefix wins). See
+[docs/openclaw/README.md](docs/openclaw/README.md) and
+[docs/guides/openclaw-local-development.md](docs/guides/openclaw-local-development.md) for details.
 
 > **Production build:** to run the dashboard as an optimised nginx bundle instead, use `make up-prod` (or `docker compose -f docker-compose.yml -f docker-compose.prod.yml up --build`). This is only needed for production deployments — day-to-day development uses `make up`.
 

docs/configuration.md

@@ -68,6 +68,7 @@ Test database (optional — used for integration tests when set):
 | -------- | ------- | ----------- |
 | `OPENCLAW_WORKSPACE_URL` | — | URL of the OpenClaw workspace service |
 | `OPENCLAW_WORKSPACE_TOKEN` | — | Bearer token for workspace service auth |
+| `OPENCLAW_PATH_REMAP_PREFIXES` | `''` | Comma-separated additional host path prefixes remapped to virtual workspace paths before allowlist checks. Built-ins are always active: `/home/node/.openclaw/workspace`, `~/.openclaw/workspace`, `/home/node/.openclaw`, `~/.openclaw` (most specific prefix wins). |
 
 ## OpenClaw Gateway (optional)
 

docs/getting-started/first-run.md

@@ -75,6 +75,10 @@ If you have an OpenClaw instance, add the integration variables to `.env`:
 ```bash
 OPENCLAW_WORKSPACE_URL=http://localhost:8080
 OPENCLAW_WORKSPACE_TOKEN=your-workspace-token
+# Optional extra remap prefixes. Built-ins are always active:
+# /home/node/.openclaw/workspace, ~/.openclaw/workspace, /home/node/.openclaw, ~/.openclaw
+# Most specific prefix wins when multiple prefixes match.
+OPENCLAW_PATH_REMAP_PREFIXES=
 OPENCLAW_GATEWAY_URL=http://localhost:18789
 OPENCLAW_GATEWAY_TOKEN=your-gateway-token
 ```

src/config.js

@@ -64,6 +64,9 @@ const config = {
     get workspaceToken() {
       return process.env.OPENCLAW_WORKSPACE_TOKEN || null;
     },
+    get pathRemapPrefixes() {
+      return process.env.OPENCLAW_PATH_REMAP_PREFIXES || '';
+    },
     subagentRetentionDays: parseInt(process.env.SUBAGENT_RETENTION_DAYS || '30', 10),
     activityLogRetentionDays: parseInt(process.env.ACTIVITY_LOG_RETENTION_DAYS || '7', 10),
   },