[freeqaz]

Problem

#3960 fills tools.exec.mode: "full" so the corporate security preset no longer refuses every shell command without an approval client. The pinned OpenClaw's corporate preset also fills tools.exec.strictInlineEval: true. That setting asks for an explicit approval of each inline program (python3 -c, node -e, an awk program, and the other interpreters in OpenClaw's inline-eval list) on the Gateway exec host, whatever the security or mode. OCE has no approval client, so under corporate those commands still fail:

exec denied: Headless runs cannot wait for interactive exec approval.

Plain commands such as echo ok run. Agents often use inline programs, so a corporate Agent still loses part of its shell.

Change

• admitGatewaySecurityDefaults also fills tools.exec.strictInlineEval: false, the personal preset's value. The fill applies only where exec runs in mode full (filled by admission or set in the Configuration) and tools.exec sets no security or ask. A Configuration that sets its own exec policy (mode ask or allowlist, or a legacy security/ask pair) keeps the preset's value, and an explicit strictInlineEval: true is kept.
• Each fill now takes a predicate on its parent object instead of a list of sibling names. The new rule reads the mode filled just before it.
• With this rule, a revision deployed after fix(occ): run shell commands without an approval client and refuse the sandbox exec host #3960 (it has the mode but not strictInlineEval) still counts as the first-agent helper's own prior revision (fix(scripts): let first-agent reruns accept their own older revision #3954): filling it gives the same document.
• The reference and the configuration-driver flow describe the extra fill. The reference stays under the length limit (2478 words).

Verification

• Proof against the pinned OpenClaw (a3b12ef6), on a remote test VM: a Vitest case in an OpenClaw snapshot calls createExecTool with host gateway, mode full, and the corporate preset's strictInlineEval. The Gateway mock returns the no-route answer (decision: null). With strictInlineEval: true, echo ok completes, and python3 -c, node -e and an awk program fail with the error above. With strictInlineEval: false, all three complete.
• tests/conformance/configuration-occ.test.mjs: unset (filled), corporate (filled), explicit strictInlineEval: true (kept), explicit mode full (filled), explicit mode ask and legacy security/ask (not filled).
• tests/integration/first-agent-startup.test.mjs: a prior revision without the rule matches, and an explicit true is drift.
• On a remote test VM, 3/3 at 2 CPUs each: configuration-occ, secret-occ, first-agent-startup, configuration-controller. tsc --build is clean, and docs:check-length passes.

Risks

• Under corporate, inline programs now run without approval wherever exec runs in mode full. That is the same trade fix(occ): run shell commands without an approval client and refuse the sandbox exec host #3960 made for every other command. OCE's Sandbox Driver, IAM and Credential Proxy contain the commands. An operator who wants inline programs refused can set tools.exec.strictInlineEval: true. Without an approval client, those commands are then refused, as before this change.
• Revision snapshots gain one key, so the next deploy of an unchanged Configuration differs from the earlier revision by this fill only.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

This PR defaults strictInlineEval to false when the global exec policy uses mode full.

Example: A corporate Agent runs python3 -c 'print(42)' without an approval client.

• Before: The inline program requires approval and fails in the headless Gateway.
• After: The admitted default allows it to execute when the effective exec policy is full.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The repair has clear value and useful admission coverage, but a concrete approval regression blocks merging and the supplied mock-based experiment does not prove the changed authority boundary.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🦪 silver shellfish (2/6)	Security review found an item that needs attention.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: Corporate Agents can run plain shell commands but lose inline Python, Node, and awk programs because OCE has no approval client.
Reason: The maintainer-authored direction extends the existing headless exec repair, and explicit stricter policies must remain effective.

Merge readiness

⛔ Blocked before merge - 4 items remain

Keep this PR open: it addresses a real exec failure, but the global default can also weaken an Agent entry’s explicit allowlist policy.

Priority: P1
Reviewed head: ce8050bfe8f577f2790476a73ad7bd46694c61dd

Before merge

• Add real behavior proof - Authority-chain proof required: the supplied exec-tool experiment mocks the approval route and does not exercise an OCE-deployed Agent. Show allowed full-mode inline execution and rejection before process spawn for the nearest forbidden case: a corporate Agent entry with a stricter allowlist policy and inherited inline approval, including policy revocation before delayed execution. Provide redacted runtime logs or terminal output without credentials or private endpoints. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Preserve inline approval for stricter per-Agent exec policies (P1) - With security.preset corporate, global tools.exec.mode full, and agents.entries.main.tools.exec.mode allowlist, this predicate fills global strictInlineEval false. The pinned runtime layers the entry’s allowlist mode over global mode, but independently inherits strictInlineEval from the global object (src/agents/lazy-exec-tool.ts:109–126). If the host allowlist permits /usr/bin/python3, python3 -c 'print(42)' consequently loses the corporate preset’s additional inline-program approval requirement and can execute without approval. This also occurs when admission itself fills the global mode. Account for the effective per-entry policy before applying the default, and retain the corporate approval behavior for stricter entries.
• Resolve security concern: Global default reaches stricter Agent entries - The finding concerns approval enforcement at interpreter execution, not broader IAM or container-isolation failure; those separate controls do not preserve this approval requirement.
• Add data-model compatibility proof - The review found that existing stored data may not work after upgrade. Show that existing data still loads and works with this change.

Findings

• [P1] Preserve inline approval for stricter per-Agent exec policies — packages/occ/src/gateway-security-defaults.ts:43-45
• [high] Global default reaches stricter Agent entries — packages/occ/src/gateway-security-defaults.ts:45

Tests

• Missing end-to-end proof: No supplied OCE runtime run proves inline execution, preservation of stricter per-Agent approval, or an upgrade with existing settings intact; a base-fail/head-pass comparison for the changed target tests is also not shown.

Agent review details

How this fits together

OCC admission transforms a saved Configuration into an immutable Agent revision; Compute renders that snapshot for OpenClaw, which combines global and per-Agent exec settings before authorizing process execution.

flowchart TB
A[Saved Configuration] --> B[OCC admission]
B --> C[Agent revision]
C --> D[Compute rendering]
D --> E[OpenClaw exec policy]
E --> F[Process execution]

Loading

Technical review

Best possible solution:

Keep admission as the single owner, but apply the inline-program default according to each Agent’s effective exec policy while preserving stricter inherited policies.

Do we have a high-confidence way to reproduce the issue?

The pinned corporate preset sets strictInlineEval true, and Gateway source requires approval for detected inline programs even with mode full; the reported failure is source-reproducible, without a reviewer-run reproduction.

Is this the best way to solve the issue?

Admission is the appropriate shared owner, but checking only the global policy misses OpenClaw’s independently layered per-Agent exec policy.

Full review comments:

• [P1] Preserve inline approval for stricter per-Agent exec policies — packages/occ/src/gateway-security-defaults.ts:43-45
  With security.preset corporate, global tools.exec.mode full, and agents.entries.main.tools.exec.mode allowlist, this predicate fills global strictInlineEval false. The pinned runtime layers the entry’s allowlist mode over global mode, but independently inherits strictInlineEval from the global object (src/agents/lazy-exec-tool.ts:109–126). If the host allowlist permits /usr/bin/python3, python3 -c 'print(42)' consequently loses the corporate preset’s additional inline-program approval requirement and can execute without approval. This also occurs when admission itself fills the global mode. Account for the effective per-entry policy before applying the default, and retain the corporate approval behavior for stricter entries.
  Confidence: 0.94

Overall correctness: patch is incorrect
Overall confidence: 0.94

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 2bd3868c3765.

Provenance checked

• Gateway security default admission keeps the original intent (build(runtime): bump openclaw to 8e328edad39 #3903: Centralize preset adjustments in immutable revision admission so rendering changes do not invalidate existing deployments.)
• Exec policy preservation changes intended behavior with a stated reason (fix(occ): run shell commands without an approval client and refuse the sandbox exec host #3960: Make headless shell execution usable while retaining explicit mode and legacy security/ask choices.)
• First-Agent prior revision comparison keeps the original intent (fix(scripts): let first-agent reruns accept their own older revision #3954: Normalize missing defaults only on the helper’s identified prior revision while retaining explicit-value drift checks.)

Testing

Proof path: in-process harness.

Security

Needs attention: The inherited default can remove a command-approval boundary outside the intended full-mode scope.

Evidence

Security concerns:

• [high] Global default reaches stricter Agent entries — packages/occ/src/gateway-security-defaults.ts:45
  The finding concerns approval enforcement at interpreter execution, not broader IAM or container-isolation failure; those separate controls do not preserve this approval requirement.
  Confidence: 0.94

What I checked:

• Introduced default: The predicate examines only global tools.exec. It does not inspect agents.entries policies before adding a globally inherited strictInlineEval value. (packages/occ/src/gateway-security-defaults.ts:45, ce8050bfe8f5)
• Production admission boundary: agentRuntimeConfiguration applies the defaults after Sandbox configuration and before logging admission; deployment subsequently validates and stores the resulting snapshot. (packages/occ/src/index.ts:14464, ce8050bfe8f5)
• Pinned dependency contract: The target runtime explicitly pins this OpenClaw commit, and the PR relies on its exec contract. The corporate preset fills strictInlineEval true independently of exec mode; personal fills false. Dependency policy was read because this runtime implements the changed behavior. (src/config/security-presets.ts:32, a3b12ef66cb9)
• Per-Agent inheritance: resolveExecToolConfig layers the Agent entry’s mode/security/ask over the global policy, but resolves strictInlineEval independently with agentExec.strictInlineEval ?? globalExec.strictInlineEval. (src/agents/lazy-exec-tool.ts:126, a3b12ef66cb9)
• Approval and final effect: The Gateway detects inline programs only when strictInlineEval is true and adds that result to policyRequiresAsk. An otherwise allowed command proceeds through committed authorization to runExecProcess, so disabling the inherited flag removes an additional approval boundary. (src/agents/bash-tools.exec-host-gateway.ts:261, a3b12ef66cb9)
• Coverage boundary: The changed conformance case exercises real OCC deployment admission and global policy preservation for embedded and dedicated revisions, but does not cover a stricter agents.entries.main.tools.exec policy or execute the resulting Gateway command. (tests/conformance/configuration-occ.test.mjs:1185, ce8050bfe8f5)

Review metrics

Metric	Value	Why it matters
Production change	+30 / -15 lines	One existing admission module gains the conditional default; no additional production subsystem is introduced.

Labels

Label changes:

• add P1: The PR restores common Agent shell operations but currently removes an approval requirement from a supported stricter per-Agent policy.
• add merge-risk: 🚨 security-boundary: A globally filled flag can bypass corporate inline-program approval for an Agent entry that explicitly uses allowlist mode.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P1: The PR restores common Agent shell operations but currently removes an approval requirement from a supported stricter per-Agent policy.
• merge-risk: 🚨 security-boundary: A globally filled flag can bypass corporate inline-program approval for an Agent entry that explicitly uses allowlist mode.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 28, 2026, 11:59 AM ET / 15:59 UTC.