fix(config): add approvalRunningNoticeMs to ToolExecBaseShape#1652
Open
BingqingLyu wants to merge 6 commits into
Open
fix(config): add approvalRunningNoticeMs to ToolExecBaseShape#1652BingqingLyu wants to merge 6 commits into
BingqingLyu wants to merge 6 commits into
Conversation
…d units The gateway installer was writing secret values from ~/.openclaw/.env directly into the systemd unit file as inline Environment= directives. This meant that any backup of the service file (e.g. .bak files) would also contain the secrets in plaintext, and the openclaw doctor audit tool would flag the resulting config as non-standard. This change adds an environmentFile field to GatewayServiceRenderArgs and teaches buildSystemdUnit to emit EnvironmentFile= when that field is set. writeSystemdUnit now detects the .env file, references it via EnvironmentFile=, and filters its keys out of the inline environment so they are no longer duplicated in the unit file. Fixes: openclaw#54521
tools.exec.approvalRunningNoticeMs was only in AgentToolExecSchema (per-agent exec config) but missing from ToolExecBaseShape, so ToolExecSchema (.strict()) rejected it as an unrecognized key at the global tools.exec level. Moving the field to ToolExecBaseShape makes it available in both the global tools.exec schema and per-agent exec configs, matching the documented behavior and the ExecToolConfig TypeScript type. Regenerated schema.base.generated.ts to reflect the fix. Fixes openclaw#57270 Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Copilot <[email protected]>
- Reject EnvironmentFile paths containing whitespace, which systemd treats as a field separator and would silently produce an invalid unit file (expands the existing \r\n check to all whitespace) - Narrow the .env access catch to ENOENT only so unexpected errors (EACCES, parse failures, etc.) are not silently swallowed and do not cause secrets to be inlined as a silent fallback Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tools.exec.approvalRunningNoticeMswas documented and implemented in the runtime but missing fromToolExecBaseShapein the Zod schema, soToolExecSchema(used for the globaltools.execpath) rejected it as an unrecognized key under.strict()modeapprovalRunningNoticeMsintoToolExecBaseShapeso both the globaltools.execschema (ToolExecSchema) and per-agent exec config (AgentToolExecSchema) accept the fieldschema.base.generated.tsto reflect the fixFixes
Closes openclaw#57270
Root cause
In
zod-schema.agent-runtime.ts,ToolExecBaseShapeis the shared shape for bothToolExecSchema(tools.exec) andAgentToolExecSchema(per-agent exec). The field was accidentally added only toAgentToolExecSchemaextra fields rather than to the shared base, so it was accepted for agent-level config but rejected for globaltools.exec.Test plan
pnpm config:schema:checkpassesvitest run src/config/— 889 tests pass; 1 pre-existing Windows symlink failure inload-channel-config-surface.test.tsunrelated to this changevitest run src/config/schema.help.quality.test.tspasses (20/20)vitest run src/config/schema.base.generated.test.tspassesToolsSchema.safeParse({ exec: { approvalRunningNoticeMs: 3000 } })returnssuccess: true.strict()mode still rejects unknown keysAI-assisted
🤖 Generated with Claude Code