fix(exec): respect OPENCLAW_STATE_DIR for exec approvals

openclaw-clownfish[bot] · openclaw-clownfish[bot] · commit 3acd66879e0a · 2026-04-29T02:43:05.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -13,6 +13,7 @@ Docs: https://docs.openclaw.ai
 
 ### Fixes
 
+- Exec approvals: honor `OPENCLAW_STATE_DIR` for the local approvals JSON, default socket, and effective policy host-source path while keeping the unset default at `~/.openclaw`. (#65736) Thanks @oinoom.
 - Gateway/shutdown: report structured shutdown warnings and HTTP close timeout warnings through `ShutdownResult` while preserving lifecycle hook hardening. Carries forward #41296. Thanks @edenfunf.
 - Plugins/QA: prebuild the private QA channel runtime before plugin gauntlet source runs so wrapper CPU/RSS measurements are not polluted by private QA dist rebuild work. Thanks @vincentkoc.
 - Gateway/reload: bound default restart deferral and SIGUSR1 restart drain to five minutes while preserving explicit `deferralTimeoutMs: 0` indefinite waits, so stale active work accounting cannot block config reloads forever. Thanks @vincentkoc.
diff --git a/docs/tools/exec-approvals.md b/docs/tools/exec-approvals.md
@@ -19,7 +19,7 @@ skips approvals).
 Effective policy is the **stricter** of `tools.exec.*` and approvals
 defaults; if an approvals field is omitted, the `tools.exec` value is
 used. Host exec also uses local approvals state on that machine — a
-host-local `ask: "always"` in `~/.openclaw/exec-approvals.json` keeps
+host-local `ask: "always"` in the execution host approvals file keeps
 prompting even if session or config defaults request `ask: "on-miss"`.
 </Note>
 
@@ -68,12 +68,20 @@ Exec approvals are enforced locally on the execution host:
 
 ## Settings and storage
 
-Approvals live in a local JSON file on the execution host:
+Approvals live in a local JSON file on the execution host. When
+`OPENCLAW_STATE_DIR` is set, the file follows that state directory;
+otherwise it uses the default OpenClaw state directory:
 
 ```text
+$OPENCLAW_STATE_DIR/exec-approvals.json
+# otherwise
 ~/.openclaw/exec-approvals.json
 ```
 
+The default approval socket follows the same root:
+`$OPENCLAW_STATE_DIR/exec-approvals.sock`, or
+`~/.openclaw/exec-approvals.sock` when the variable is unset.
+
 Example schema:
 
 ```json
@@ -170,7 +178,7 @@ automatically.
 If you want host exec to run without approval prompts, you must open
 **both** policy layers — requested exec policy in OpenClaw config
 (`tools.exec.*`) **and** host-local approvals policy in
-`~/.openclaw/exec-approvals.json`.
+the execution host approvals file.
 
 YOLO is the default host behavior unless you tighten it explicitly:
 
@@ -237,7 +245,7 @@ openclaw exec-policy preset yolo
 That local shortcut updates both:
 
 - Local `tools.exec.host/security/ask`.
-- Local `~/.openclaw/exec-approvals.json` defaults.
+- Local approvals file defaults.
 
 It is intentionally local-only. To change gateway-host or node-host
 approvals remotely, use `openclaw approvals set --gateway` or
@@ -339,7 +347,7 @@ shows last-used metadata per pattern so you can keep the list tidy.
 The target selector chooses **Gateway** (local approvals) or a **Node**.
 Nodes must advertise `system.execApprovals.get/set` (macOS app or
 headless node host). If a node does not advertise exec approvals yet,
-edit its local `~/.openclaw/exec-approvals.json` directly.
+edit its local approvals file directly.
 
 CLI: `openclaw approvals` supports gateway or node editing — see
 [Approvals CLI](/cli/approvals).
diff --git a/src/infra/exec-approvals-effective.ts b/src/infra/exec-approvals-effective.ts
@@ -3,6 +3,7 @@ import { DEFAULT_AGENT_ID } from "../routing/session-key.js";
 import {
   DEFAULT_EXEC_APPROVAL_ASK_FALLBACK,
   resolveExecApprovalAllowedDecisions,
+  resolveExecApprovalsDisplayPath,
   type ExecApprovalDecision,
   maxAsk,
   minSecurity,
@@ -15,7 +16,6 @@ import {
 
 const DEFAULT_REQUESTED_SECURITY: ExecSecurity = "full";
 const DEFAULT_REQUESTED_ASK: ExecAsk = "off";
-const DEFAULT_HOST_PATH = "~/.openclaw/exec-approvals.json";
 const REQUESTED_DEFAULT_LABEL = {
   security: DEFAULT_REQUESTED_SECURITY,
   ask: DEFAULT_REQUESTED_ASK,
@@ -234,7 +234,7 @@ export function resolveExecPolicyScopeSnapshot(params: {
       ask: requestedAsk.value,
     },
   });
-  const hostPath = params.hostPath ?? DEFAULT_HOST_PATH;
+  const hostPath = params.hostPath ?? resolveExecApprovalsDisplayPath();
   const effectiveSecurity = minSecurity(requestedSecurity.value, resolved.agent.security);
   const effectiveAsk = maxAsk(requestedAsk.value, resolved.agent.ask);
   const effectiveAskFallback = minSecurity(effectiveSecurity, resolved.agent.askFallback);
diff --git a/src/infra/exec-approvals-policy.test.ts b/src/infra/exec-approvals-policy.test.ts
@@ -1,3 +1,4 @@
+import path from "node:path";
 import { describe, expect, it } from "vitest";
 import type { OpenClawConfig } from "../config/config.js";
 import { DEFAULT_AGENT_ID } from "../routing/session-key.js";
@@ -306,6 +307,37 @@ describe("exec approvals policy helpers", () => {
     });
   });
 
+  it("uses OPENCLAW_STATE_DIR when reporting default host sources", () => {
+    const originalOpenClawStateDir = process.env.OPENCLAW_STATE_DIR;
+    const stateDir = path.join(process.cwd(), ".tmp-openclaw-state");
+    process.env.OPENCLAW_STATE_DIR = stateDir;
+    try {
+      const summary = resolveExecPolicyScopeSummary({
+        approvals: {
+          version: 1,
+          defaults: {
+            security: "allowlist",
+          },
+        },
+        scopeExecConfig: {
+          security: "full",
+        },
+        configPath: "tools.exec",
+        scopeLabel: "tools.exec",
+      });
+
+      expect(summary.security.hostSource).toBe(
+        `${path.join(stateDir, "exec-approvals.json")} defaults.security`,
+      );
+    } finally {
+      if (originalOpenClawStateDir === undefined) {
+        delete process.env.OPENCLAW_STATE_DIR;
+      } else {
+        process.env.OPENCLAW_STATE_DIR = originalOpenClawStateDir;
+      }
+    }
+  });
+
   it("does not let host ask=off suppress a stricter requested ask", () => {
     const summary = resolveExecPolicyScopeSummary({
       approvals: {
diff --git a/src/infra/exec-approvals-store.test.ts b/src/infra/exec-approvals-store.test.ts
@@ -29,6 +29,7 @@ let saveExecApprovals: ExecApprovalsModule["saveExecApprovals"];
 
 const tempDirs: string[] = [];
 const originalOpenClawHome = process.env.OPENCLAW_HOME;
+const originalOpenClawStateDir = process.env.OPENCLAW_STATE_DIR;
 
 beforeAll(async () => {
   ({
@@ -59,6 +60,11 @@ afterEach(() => {
   } else {
     process.env.OPENCLAW_HOME = originalOpenClawHome;
   }
+  if (originalOpenClawStateDir === undefined) {
+    delete process.env.OPENCLAW_STATE_DIR;
+  } else {
+    process.env.OPENCLAW_STATE_DIR = originalOpenClawStateDir;
+  }
   for (const dir of tempDirs.splice(0)) {
     fs.rmSync(dir, { recursive: true, force: true });
   }
@@ -68,6 +74,7 @@ function createHomeDir(): string {
   const dir = makeTempDir();
   tempDirs.push(dir);
   process.env.OPENCLAW_HOME = dir;
+  delete process.env.OPENCLAW_STATE_DIR;
   return dir;
 }
 
@@ -91,6 +98,39 @@ describe("exec approvals store helpers", () => {
     );
   });
 
+  it("uses OPENCLAW_STATE_DIR for default file and socket paths", () => {
+    const dir = createHomeDir();
+    const stateDir = path.join(dir, "custom-state");
+    process.env.OPENCLAW_STATE_DIR = stateDir;
+
+    expect(path.normalize(resolveExecApprovalsPath())).toBe(
+      path.normalize(path.join(stateDir, "exec-approvals.json")),
+    );
+    expect(path.normalize(resolveExecApprovalsSocketPath())).toBe(
+      path.normalize(path.join(stateDir, "exec-approvals.sock")),
+    );
+
+    const ensured = ensureExecApprovals();
+
+    expect(ensured.socket?.path).toBe(resolveExecApprovalsSocketPath());
+    expect(fs.existsSync(path.join(stateDir, "exec-approvals.json"))).toBe(true);
+    expect(fs.existsSync(approvalsFilePath(dir))).toBe(false);
+  });
+
+  it("keeps the default approvals path in .openclaw when only legacy state exists", () => {
+    const dir = createHomeDir();
+    fs.mkdirSync(path.join(dir, ".clawdbot"), { recursive: true });
+
+    expect(path.normalize(resolveExecApprovalsPath())).toBe(
+      path.normalize(path.join(dir, ".openclaw", "exec-approvals.json")),
+    );
+
+    ensureExecApprovals();
+
+    expect(fs.existsSync(approvalsFilePath(dir))).toBe(true);
+    expect(fs.existsSync(path.join(dir, ".clawdbot", "exec-approvals.json"))).toBe(false);
+  });
+
   it("merges socket defaults from normalized, current, and built-in fallback", () => {
     const normalized = normalizeExecApprovals({
       version: 1,
diff --git a/src/infra/exec-approvals.ts b/src/infra/exec-approvals.ts
@@ -11,7 +11,7 @@ import {
 import { resolveAllowAlwaysPatternEntries } from "./exec-approvals-allowlist.js";
 import type { ExecCommandSegment } from "./exec-approvals-analysis.js";
 import type { ExecAllowlistEntry } from "./exec-approvals.types.js";
-import { expandHomePrefix, resolveRequiredHomeDir } from "./home-dir.js";
+import { expandHomePrefix, resolveHomeRelativePath, resolveRequiredHomeDir } from "./home-dir.js";
 import { requestJsonlSocket } from "./jsonl-socket.js";
 export * from "./exec-approvals-analysis.js";
 export * from "./exec-approvals-allowlist.js";
@@ -171,8 +171,9 @@ const DEFAULT_SECURITY: ExecSecurity = "full";
 const DEFAULT_ASK: ExecAsk = "off";
 export const DEFAULT_EXEC_APPROVAL_ASK_FALLBACK: ExecSecurity = "full";
 const DEFAULT_AUTO_ALLOW_SKILLS = false;
-const DEFAULT_SOCKET = "~/.openclaw/exec-approvals.sock";
-const DEFAULT_FILE = "~/.openclaw/exec-approvals.json";
+const DEFAULT_EXEC_APPROVALS_STATE_DIR = "~/.openclaw";
+const EXEC_APPROVALS_FILE = "exec-approvals.json";
+const EXEC_APPROVALS_SOCKET = "exec-approvals.sock";
 
 function hashExecApprovalsRaw(raw: string | null): string {
   return crypto
@@ -181,12 +182,37 @@ function hashExecApprovalsRaw(raw: string | null): string {
     .digest("hex");
 }
 
+function resolveExecApprovalsStateDir(env: NodeJS.ProcessEnv = process.env): {
+  path: string;
+  displayPath: string;
+} {
+  const override = env.OPENCLAW_STATE_DIR?.trim();
+  if (override) {
+    const resolved = resolveHomeRelativePath(override, { env });
+    return {
+      path: resolved,
+      displayPath: resolved,
+    };
+  }
+  return {
+    path: expandHomePrefix(DEFAULT_EXEC_APPROVALS_STATE_DIR, { env }),
+    displayPath: DEFAULT_EXEC_APPROVALS_STATE_DIR,
+  };
+}
+
 export function resolveExecApprovalsPath(): string {
-  return expandHomePrefix(DEFAULT_FILE);
+  return path.join(resolveExecApprovalsStateDir().path, EXEC_APPROVALS_FILE);
 }
 
 export function resolveExecApprovalsSocketPath(): string {
-  return expandHomePrefix(DEFAULT_SOCKET);
+  return path.join(resolveExecApprovalsStateDir().path, EXEC_APPROVALS_SOCKET);
+}
+
+export function resolveExecApprovalsDisplayPath(): string {
+  const stateDir = resolveExecApprovalsStateDir().displayPath;
+  return stateDir === DEFAULT_EXEC_APPROVALS_STATE_DIR
+    ? `${stateDir}/${EXEC_APPROVALS_FILE}`
+    : path.join(stateDir, EXEC_APPROVALS_FILE);
 }
 
 function normalizeAllowlistPattern(value: string | undefined): string | null {
