Problem

On Windows, the exec tool hardcodes PowerShell as the shell. There's no config option to override this. For agents that need to run complex shell commands with pipes, jq, nested quoting, regex, etc., PowerShell's quoting rules make this extremely painful - especially when the command involves JSON processing or nested string literals.

WSL is widely available on Windows dev machines and provides a proper bash environment, but the only way to use it today is prefixing every command with wsl bash -c '...', which still goes through PowerShell's quote mangling before reaching bash. Piping works for simple cases (gh api ... | wsl jq ".field"), but anything with nested quotes in jq filters, select(), or string comparisons breaks.

Current workarounds:

• Write a .sh or .py script file for every non-trivial command
• Use wsl jq -f filter.jq (write jq filters to files)
• Use PTY mode (pty: true) to get an interactive WSL session and write commands via process

All of these work but add significant friction for what should be one-liners in bash.

Proposal

Add a tools.exec.shell config option that lets users override the default shell for exec tool invocations.

{
  tools: {
    exec: {
      shell: "wsl bash"  // or "/usr/bin/bash", "pwsh", etc.
    }
  }
}

Design considerations

• Security surface: The exec tool has allowlists, approvals, safe bins, and PATH restrictions. A shell override interacts with all of these. For example, safeBins trust paths like /bin and /usr/bin - do those apply inside WSL? How does the allowlist model work when the outer shell is different?
• PATH handling: The current Windows exec merges login-shell PATH. With WSL, PATH semantics are different (Linux paths vs Windows paths, though WSL interop makes .exe files available).
• Working directory translation: Workspace paths are Windows-style (C:\Users\...) but WSL sees /mnt/c/Users/.... The workdir parameter would need translation when the shell is WSL-based.
• Non-WSL use cases: This could also be useful for forcing bash over zsh on macOS, or selecting between pwsh and legacy powershell on Windows.
• Validation: Should probably validate that the configured shell exists and is executable at gateway start.

Environment

• Windows 11, WSL2 with Ubuntu
• OpenClaw 2026.3.13
• Agent runs on gateway (no sandbox)