docs(sandbox): clarify process visibility boundary

Explain that Windows UI API compatibility changes Win32k behavior but does not provide a supported host-wide process inventory. Preserve clipboard policy and input-injection denial guidance across all locales.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 27dc9d2f-ee94-48f1-bf06-8f3d10414fc9

Author: shanselman

docs/OPENCLAW_GATEWAY_NODE_EXEC_FAQ.md

@@ -648,11 +648,30 @@ fallback if MXC is unavailable. Enabling **block host fallback when MXC is
 unavailable** changes that case to a deny. The actual result reports whether
 execution used sandbox, host fallback, or host mode.
 
-MXC also blocks Win32k system calls by default. PowerShell, `whoami`, `tasklist`,
-and many other console programs initialize Windows UI APIs even when they do not
-show a window. Enable **Allow Windows UI APIs** on the Node Sandbox page when
-those programs are required. This keeps filesystem, network, clipboard, timeout,
-and command approval controls in force, but removes the Win32k syscall boundary.
+MXC also blocks Win32k system calls by default. PowerShell (all versions) and
+some console programs initialize Windows UI APIs even when they do not show a
+window. Enable **Allow Windows UI APIs** on the Node Sandbox page when those
+programs require Win32k compatibility. This keeps filesystem, network,
+clipboard, timeout, and command approval controls in force, but removes the
+Win32k syscall boundary. Clipboard policy and the input-injection denial remain
+in force.
+
+Windows UI access is not a process-enumeration permission and does not provide a
+supported host-wide process inventory. In the behavior reported in
+[issue #1149](https://github.com/openclaw/openclaw-windows-node/issues/1149),
+`Get-CimInstance Win32_Process` could not connect and `tasklist` failed to
+complete. `Get-Process` output must not be treated as either a complete host
+inventory or a security guarantee that all host process metadata is hidden.
+[PR #1151](https://github.com/openclaw/openclaw-windows-node/pull/1151),
+merged as
+[`36928782`](https://github.com/openclaw/openclaw-windows-node/commit/369287826f3966d67da251a91272dced1132a814),
+bounds cancellation cleanup so a killed or timed-out sandbox invocation
+returns; it does not change process visibility. Host-wide process inspection
+requires uncontained host execution with the applicable approvals.
+
+OpenClaw's `process` tool is a separate abstraction. It lists OpenClaw-managed
+background exec sessions for the same agent, not arbitrary operating-system
+processes.
 
 **Evidence:** local runner wiring is in
 [`NodeService.cs`](https://github.com/openclaw/openclaw-windows-node/blob/d7d153ca5d409487e06ef584b1de1184520e90e6/src/OpenClaw.Tray.WinUI/Services/NodeService.cs#L589-L679).

src/OpenClaw.Shared/Mxc/MxcPolicyBuilder.cs

@@ -23,7 +23,7 @@ namespace OpenClaw.Shared.Mxc;
 /// <item><c>network.allowOutbound</c> — bound by <see cref="SettingsData.SystemRunAllowOutbound"/>.</item>
 /// <item><c>ui</c> — Win32k access is bound by
 /// <see cref="SettingsData.SystemRunAllowWindowsUi"/> and remains denied by
-/// default. PowerShell-family shells and many console utilities require this
+/// default. PowerShell-family shells and some console utilities require this
 /// opt-in on MXC 0.7.</item>
 /// </list>
 /// </remarks>

src/OpenClaw.Shared/SettingsData.cs

@@ -183,7 +183,7 @@ public record class SettingsData
 
     /// <summary>
     /// When sandboxed, allow system.run commands to use Windows UI system calls.
-    /// This is required by PowerShell and many console utilities on current MXC
+    /// This is required by PowerShell and some console utilities on current MXC
     /// processcontainer backends. Default false preserves Win32k syscall blocking.
     /// </summary>
     public bool SystemRunAllowWindowsUi { get; set; } = false;

src/OpenClaw.Tray.WinUI/Pages/SandboxPage.xaml

@@ -403,7 +403,7 @@
                                       OnContent="On: PowerShell and similar tools can start"
                                       Toggled="OnWindowsUiToggled" />
                         <TextBlock x:Uid="SandboxPage_WindowsUiCompatibilityDescription"
-                                   Text="PowerShell, whoami, tasklist, and many other console tools use Windows UI APIs during startup."
+                                   Text="PowerShell (all versions) and some console tools use Windows UI APIs during startup. This setting does not provide a supported host-wide process inventory."
                                    TextWrapping="Wrap"
                                    Foreground="{ThemeResource TextFillColorSecondaryBrush}" />
                         <InfoBar x:Uid="SandboxPage_WindowsUiWarning"
@@ -412,7 +412,7 @@
                                  IsClosable="False"
                                  Severity="Warning"
                                  Title="Win32k boundary disabled"
-                                 Message="File, network, clipboard, timeout, and command approval controls still apply, but Win32k system calls are allowed." />
+                                 Message="File, network, clipboard, timeout, and command approval controls still apply. Win32k system calls are allowed; clipboard policy and the input-injection denial remain in force." />
                     </StackPanel>
                 </Expander>
 

src/OpenClaw.Tray.WinUI/Services/SettingsManager.cs

@@ -163,7 +163,7 @@ public List<string> A2UIImageHosts
     public bool SystemRunBlockHostFallbackWhenMxcUnavailable { get => _data.SystemRunBlockHostFallbackWhenMxcUnavailable; set => _data = _data with { SystemRunBlockHostFallbackWhenMxcUnavailable = value }; }
     /// <summary>When sandboxed, allow system.run commands to reach the public internet. Default false.</summary>
     public bool SystemRunAllowOutbound { get => _data.SystemRunAllowOutbound; set => _data = _data with { SystemRunAllowOutbound = value }; }
-    /// <summary>When sandboxed, allow Windows UI system calls required by PowerShell and many console utilities. Default false.</summary>
+    /// <summary>When sandboxed, allow Windows UI system calls required by PowerShell and some console utilities. Default false.</summary>
     public bool SystemRunAllowWindowsUi { get => _data.SystemRunAllowWindowsUi; set => _data = _data with { SystemRunAllowWindowsUi = value }; }
     // ── MXC sandbox: additional knobs (Sandbox page) ─────────────────
     public SandboxClipboardMode SandboxClipboard { get => _data.SandboxClipboard; set => _data = _data with { SandboxClipboard = value }; }

src/OpenClaw.Tray.WinUI/Strings/en-us/Resources.resw

@@ -4693,19 +4693,19 @@ Commands are blocked while sandboxing is unavailable because strict fallback blo
     <value>Allow Windows UI APIs for sandboxed commands</value>
   </data>
   <data name="SandboxPage_WindowsUiCompatibilityDescription.Text" xml:space="preserve">
-    <value>PowerShell, whoami, tasklist, and many other console tools use Windows UI APIs during startup.</value>
+    <value>PowerShell (all versions) and some console tools use Windows UI APIs during startup. This setting does not provide a supported host-wide process inventory.</value>
   </data>
   <data name="SandboxPage_WindowsUiWarning.Title" xml:space="preserve">
     <value>Win32k boundary disabled</value>
   </data>
   <data name="SandboxPage_WindowsUiWarning.Message" xml:space="preserve">
-    <value>File, network, clipboard, timeout, and command approval controls still apply, but Win32k system calls are allowed.</value>
+    <value>File, network, clipboard, timeout, and command approval controls still apply. Win32k system calls are allowed; clipboard policy and the input-injection denial remain in force.</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogTitle" xml:space="preserve">
     <value>Allow Windows UI APIs?</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogContent" xml:space="preserve">
-    <value>This lets sandboxed commands use Windows UI system calls. PowerShell, whoami, tasklist, and other console tools need this to start on current MXC versions.&#xA;&#xA;File, network, clipboard, timeout, and command approval controls still apply, but Win32k syscall blocking will be disabled. Only enable this if you need broader command compatibility.</value>
+    <value>This lets sandboxed commands use Windows UI system calls. PowerShell (all versions) and some console tools need this to start on current MXC versions. This setting does not grant a supported host-wide process inventory: CIM/WMI host enumeration is not supported and has been observed to fail, tasklist may fail or time out, and Get-Process output should not be treated as complete inventory or a process-metadata secrecy boundary.&#xA;&#xA;File, network, clipboard, timeout, and command approval controls still apply, but Win32k syscall blocking will be disabled. Clipboard policy and the input-injection denial remain in force. Only enable this if you need broader command compatibility.</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogPrimary" xml:space="preserve">
     <value>Allow UI APIs</value>

src/OpenClaw.Tray.WinUI/Strings/fr-fr/Resources.resw

@@ -4646,19 +4646,19 @@ Les commandes sont bloquées tant que le sandboxing est indisponible, car le blo
     <value>Autoriser les API d’interface Windows pour les commandes en bac à sable</value>
   </data>
   <data name="SandboxPage_WindowsUiCompatibilityDescription.Text" xml:space="preserve">
-    <value>PowerShell, whoami, tasklist et de nombreux autres outils de console utilisent les API d’interface Windows au démarrage.</value>
+    <value>PowerShell (toutes les versions) et certains outils de console utilisent les API d’interface Windows au démarrage. Ce paramètre ne fournit pas d’inventaire pris en charge de tous les processus hôtes.</value>
   </data>
   <data name="SandboxPage_WindowsUiWarning.Title" xml:space="preserve">
     <value>Limite Win32k désactivée</value>
   </data>
   <data name="SandboxPage_WindowsUiWarning.Message" xml:space="preserve">
-    <value>Les contrôles des fichiers, du réseau, du presse-papiers, du délai d’expiration et de l’approbation des commandes restent actifs, mais les appels système Win32k sont autorisés.</value>
+    <value>Les contrôles des fichiers, du réseau, du presse-papiers, du délai d’expiration et de l’approbation des commandes restent actifs. Les appels système Win32k sont autorisés ; la stratégie du presse-papiers et l’interdiction de l’injection d’entrée restent appliquées.</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogTitle" xml:space="preserve">
     <value>Autoriser les API d’interface Windows ?</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogContent" xml:space="preserve">
-    <value>Cette option permet aux commandes en bac à sable d’utiliser les appels système de l’interface Windows. PowerShell, whoami, tasklist et d’autres outils de console en ont besoin pour démarrer avec les versions actuelles de MXC.&#xA;&#xA;Les contrôles des fichiers, du réseau, du presse-papiers, du délai d’expiration et de l’approbation des commandes restent actifs, mais le blocage des appels système Win32k sera désactivé. Activez cette option uniquement si vous avez besoin d’une compatibilité de commande plus large.</value>
+    <value>Cette option permet aux commandes en bac à sable d’utiliser les appels système de l’interface Windows. PowerShell (toutes les versions) et certains outils de console en ont besoin pour démarrer avec les versions actuelles de MXC. Ce paramètre n’accorde pas d’inventaire pris en charge de tous les processus hôtes : l’énumération CIM/WMI de l’hôte n’est pas prise en charge et a été observée en échec, tasklist peut échouer ou expirer et la sortie de Get-Process ne doit pas être considérée comme un inventaire complet ni comme une limite de confidentialité des métadonnées de processus.&#xA;&#xA;Les contrôles des fichiers, du réseau, du presse-papiers, du délai d’expiration et de l’approbation des commandes restent actifs, mais le blocage des appels système Win32k sera désactivé. La stratégie du presse-papiers et l’interdiction de l’injection d’entrée restent appliquées. Activez cette option uniquement si vous avez besoin d’une compatibilité de commande plus large.</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogPrimary" xml:space="preserve">
     <value>Autoriser les API d’interface</value>

src/OpenClaw.Tray.WinUI/Strings/nl-nl/Resources.resw

@@ -4647,19 +4647,19 @@ Opdrachten worden geblokkeerd zolang sandboxing niet beschikbaar is, omdat strik
     <value>Windows UI-API's toestaan voor opdrachten in de sandbox</value>
   </data>
   <data name="SandboxPage_WindowsUiCompatibilityDescription.Text" xml:space="preserve">
-    <value>PowerShell, whoami, tasklist en veel andere consolehulpprogramma's gebruiken Windows UI-API's tijdens het opstarten.</value>
+    <value>PowerShell (alle versies) en sommige consolehulpprogramma's gebruiken Windows UI-API's tijdens het opstarten. Deze instelling biedt geen ondersteunde inventaris van alle hostprocessen.</value>
   </data>
   <data name="SandboxPage_WindowsUiWarning.Title" xml:space="preserve">
     <value>Win32k-grens uitgeschakeld</value>
   </data>
   <data name="SandboxPage_WindowsUiWarning.Message" xml:space="preserve">
-    <value>Bestands-, netwerk-, klembord-, time-out- en opdrachtgoedkeuringsregels blijven gelden, maar Win32k-systeemaanroepen zijn toegestaan.</value>
+    <value>Bestands-, netwerk-, klembord-, time-out- en opdrachtgoedkeuringsregels blijven gelden. Win32k-systeemaanroepen zijn toegestaan; het klembordbeleid en het verbod op invoerinjectie blijven van kracht.</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogTitle" xml:space="preserve">
     <value>Windows UI-API's toestaan?</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogContent" xml:space="preserve">
-    <value>Hiermee kunnen opdrachten in de sandbox Windows UI-systeemaanroepen gebruiken. PowerShell, whoami, tasklist en andere consolehulpprogramma's hebben dit nodig om met huidige MXC-versies te starten.&#xA;&#xA;Bestands-, netwerk-, klembord-, time-out- en opdrachtgoedkeuringsregels blijven gelden, maar de blokkering van Win32k-systeemaanroepen wordt uitgeschakeld. Schakel dit alleen in als u bredere opdrachtcompatibiliteit nodig hebt.</value>
+    <value>Hiermee kunnen opdrachten in de sandbox Windows UI-systeemaanroepen gebruiken. PowerShell (alle versies) en sommige consolehulpprogramma's hebben dit nodig om met huidige MXC-versies te starten. Deze instelling verleent geen ondersteunde inventaris van alle hostprocessen: CIM/WMI-enumeratie van de host wordt niet ondersteund en is waargenomen als mislukt, tasklist kan mislukken of een time-out krijgen en de uitvoer van Get-Process mag niet worden beschouwd als een volledige inventaris of als een geheimhoudingsgrens voor procesmetadata.&#xA;&#xA;Bestands-, netwerk-, klembord-, time-out- en opdrachtgoedkeuringsregels blijven gelden, maar de blokkering van Win32k-systeemaanroepen wordt uitgeschakeld. Het klembordbeleid en het verbod op invoerinjectie blijven van kracht. Schakel dit alleen in als u bredere opdrachtcompatibiliteit nodig hebt.</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogPrimary" xml:space="preserve">
     <value>UI-API's toestaan</value>

src/OpenClaw.Tray.WinUI/Strings/zh-cn/Resources.resw

@@ -4646,19 +4646,19 @@
     <value>允许沙盒命令使用 Windows UI API</value>
   </data>
   <data name="SandboxPage_WindowsUiCompatibilityDescription.Text" xml:space="preserve">
-    <value>PowerShell、whoami、tasklist 及许多其他控制台工具在启动时会使用 Windows UI API。</value>
+    <value>PowerShell（所有版本）和某些控制台工具在启动时会使用 Windows UI API。此设置不提供受支持的完整主机进程清单。</value>
   </data>
   <data name="SandboxPage_WindowsUiWarning.Title" xml:space="preserve">
     <value>Win32k 边界已禁用</value>
   </data>
   <data name="SandboxPage_WindowsUiWarning.Message" xml:space="preserve">
-    <value>文件、网络、剪贴板、超时和命令审批控制仍然有效，但允许使用 Win32k 系统调用。</value>
+    <value>文件、网络、剪贴板、超时和命令审批控制仍然有效。允许使用 Win32k 系统调用；剪贴板策略和输入注入禁令仍然有效。</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogTitle" xml:space="preserve">
     <value>允许 Windows UI API？</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogContent" xml:space="preserve">
-    <value>这将允许沙盒命令使用 Windows UI 系统调用。当前 MXC 版本中的 PowerShell、whoami、tasklist 和其他控制台工具需要此权限才能启动。&#xA;&#xA;文件、网络、剪贴板、超时和命令审批控制仍然有效，但 Win32k 系统调用阻止将被禁用。仅在需要更广泛的命令兼容性时启用。</value>
+    <value>这将允许沙盒命令使用 Windows UI 系统调用。当前 MXC 版本中的 PowerShell（所有版本）和某些控制台工具需要此权限才能启动。此设置不会授予受支持的完整主机进程清单：CIM/WMI 主机枚举不受支持，并已观察到失败；tasklist 可能失败或超时；Get-Process 的输出不应被视为完整清单或进程元数据的保密边界。&#xA;&#xA;文件、网络、剪贴板、超时和命令审批控制仍然有效，但 Win32k 系统调用阻止将被禁用。剪贴板策略和输入注入禁令仍然有效。仅在需要更广泛的命令兼容性时启用。</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogPrimary" xml:space="preserve">
     <value>允许 UI API</value>

src/OpenClaw.Tray.WinUI/Strings/zh-tw/Resources.resw

@@ -4646,19 +4646,19 @@
     <value>允許沙箱命令使用 Windows UI API</value>
   </data>
   <data name="SandboxPage_WindowsUiCompatibilityDescription.Text" xml:space="preserve">
-    <value>PowerShell、whoami、tasklist 及許多其他主控台工具在啟動時會使用 Windows UI API。</value>
+    <value>PowerShell（所有版本）和某些主控台工具在啟動時會使用 Windows UI API。此設定不提供受支援的完整主機處理程序清單。</value>
   </data>
   <data name="SandboxPage_WindowsUiWarning.Title" xml:space="preserve">
     <value>Win32k 邊界已停用</value>
   </data>
   <data name="SandboxPage_WindowsUiWarning.Message" xml:space="preserve">
-    <value>檔案、網路、剪貼簿、逾時和命令核准控制仍然有效，但允許使用 Win32k 系統呼叫。</value>
+    <value>檔案、網路、剪貼簿、逾時和命令核准控制仍然有效。允許使用 Win32k 系統呼叫；剪貼簿原則和輸入插入禁止仍然有效。</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogTitle" xml:space="preserve">
     <value>允許 Windows UI API？</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogContent" xml:space="preserve">
-    <value>這將允許沙箱命令使用 Windows UI 系統呼叫。目前 MXC 版本中的 PowerShell、whoami、tasklist 和其他主控台工具需要此權限才能啟動。&#xA;&#xA;檔案、網路、剪貼簿、逾時和命令核准控制仍然有效，但 Win32k 系統呼叫封鎖將會停用。僅在需要更廣泛的命令相容性時啟用。</value>
+    <value>這將允許沙箱命令使用 Windows UI 系統呼叫。目前 MXC 版本中的 PowerShell（所有版本）和某些主控台工具需要此權限才能啟動。此設定不會授與受支援的完整主機處理程序清單：CIM/WMI 主機列舉不受支援，且已觀察到失敗；tasklist 可能失敗或逾時；Get-Process 的輸出不應視為完整清單或處理程序中繼資料的保密邊界。&#xA;&#xA;檔案、網路、剪貼簿、逾時和命令核准控制仍然有效，但 Win32k 系統呼叫封鎖將會停用。剪貼簿原則和輸入插入禁止仍然有效。僅在需要更廣泛的命令相容性時啟用。</value>
   </data>
   <data name="SandboxPage_AllowWindowsUiDialogPrimary" xml:space="preserve">
     <value>允許 UI API</value>