Bug type
Behavior bug (incorrect approval state without a crash)
Beta release blocker
No
Summary
Exec auto-review decisions are not consistently bound to the exact executable and complete reviewer result across gateway, node-host, and Codex app-server approval paths.
Steps to reproduce
- Configure exec approvals with auto-review enabled and an allowlist miss.
- Exercise a command whose executable resolution can differ from the raw command, or return a partial/contradictory custom reviewer result.
- On the Codex app-server path, issue multiple execve approval requests that share a parent item ID.
- Observe that the reviewed target, fallback state, or approval correlation can diverge from the exact command that ultimately reaches execution policy.
Expected behavior
An automatic approval applies only to a completed, low-risk reviewer decision for the exact resolved command. Cancellation and unsupported reviewer results fail closed, and each Codex execve approval retains its unique approval ID.
Actual behavior
Some paths could review raw command text but execute a fresh PATH lookup, accept non-stop partial model output, omit cancellation checks before dispatch, treat a contradictory non-low allow result as eligible for permissive timeout fallback, or deduplicate distinct Codex execve approvals by their shared parent item ID.
OpenClaw version
2026.6.11 source checkout
Operating system
Cross-platform execution paths; reproduced with the unit harness on macOS and Linux.
Install method
Source checkout (pnpm)
Model
Any configured exec auto-review model; custom reviewer boundary also affected.
Provider / routing chain
OpenClaw exec tool -> configured auto-review model -> gateway/node/Codex approval bridge
Evidence
Independent code audits identified the boundary mismatches. Regression tests cover executable pinning, model completion status, cancellation, risk gating, prompt sanitization, strict fallback behavior, Codex approval correlation, and fail-closed Codex reviewer configuration parsing.
Impact and severity
Affected: operators using exec auto-review or the Codex native approval bridge.
Severity: high because approval metadata could diverge from the eventual execution decision.
Frequency: edge-case dependent, but deterministic for contradictory custom reviewer output and shared-parent Codex execve approvals.
Consequence: an execution may receive broader approval treatment than the exact reviewed command/result warrants.
Bug type
Behavior bug (incorrect approval state without a crash)
Beta release blocker
No
Summary
Exec auto-review decisions are not consistently bound to the exact executable and complete reviewer result across gateway, node-host, and Codex app-server approval paths.
Steps to reproduce
Expected behavior
An automatic approval applies only to a completed, low-risk reviewer decision for the exact resolved command. Cancellation and unsupported reviewer results fail closed, and each Codex execve approval retains its unique approval ID.
Actual behavior
Some paths could review raw command text but execute a fresh PATH lookup, accept non-stop partial model output, omit cancellation checks before dispatch, treat a contradictory non-low allow result as eligible for permissive timeout fallback, or deduplicate distinct Codex execve approvals by their shared parent item ID.
OpenClaw version
2026.6.11 source checkout
Operating system
Cross-platform execution paths; reproduced with the unit harness on macOS and Linux.
Install method
Source checkout (pnpm)
Model
Any configured exec auto-review model; custom reviewer boundary also affected.
Provider / routing chain
OpenClaw exec tool -> configured auto-review model -> gateway/node/Codex approval bridge
Evidence
Independent code audits identified the boundary mismatches. Regression tests cover executable pinning, model completion status, cancellation, risk gating, prompt sanitization, strict fallback behavior, Codex approval correlation, and fail-closed Codex reviewer configuration parsing.
Impact and severity
Affected: operators using exec auto-review or the Codex native approval bridge.
Severity: high because approval metadata could diverge from the eventual execution decision.
Frequency: edge-case dependent, but deterministic for contradictory custom reviewer output and shared-parent Codex execve approvals.
Consequence: an execution may receive broader approval treatment than the exact reviewed command/result warrants.