Summary

The 2026.4.1 update introduced sandboxing and exec approval changes that completely broke exec for all existing single-operator setups. There was no migration guide, no warning on startup, and no way to opt out using documented config options. A full working day was lost trying to recover.

What broke

1. Docker sandbox auto-created for all agents with no sandbox config (via agents.defaults.sandbox.mode = "all" set automatically by update)
2. Sandbox container persists across gateway restarts via ~/.openclaw/sandbox/containers.json — removing it manually doesn't work because the gateway recreates it
3. tools.exec.ask = "off" does nothing — ask and security are separate axes, but this is not documented
4. tools.exec.security = "none" is rejected — not a valid value, but the valid values (deny, allowlist, full) are not shown in help or docs
5. exec-approvals.json is undocumented — its location, format, purpose, and valid values are unknown to operators
6. security: "none" in exec-approvals.json silently falls back to allowlist — no error, just broken
7. tools.exec.host = "gateway" ignored while sandbox container exists — routing config has no effect inside a sandbox session

Impact

• All cron exec jobs fail silently
• Agents report "allowlist miss" or "exec denied" on every command
• Approval popups appear that cannot be permanently dismissed
• No amount of config changes fixes it without also destroying the sandbox container AND removing its registry entry from containers.json
• Required 4+ separate GitHub issues and 2+ hours of debugging to partially recover

What was needed (not documented anywhere)

// ~/.openclaw/exec-approvals.json
{
  "defaults": { "ask": "off", "security": "full" },
  "agents": { "*": { "ask": "off", "security": "full" } }
}

Plus manually: docker rm -f openclaw-sbx-agent-main-* AND remove entry from ~/.openclaw/sandbox/containers.json

Request

• Do not silently enable sandboxing on existing setups during updates
• Document exec-approvals.json properly with all valid values
• openclaw doctor --fix should detect broken exec approval state and offer to fix it
• Add an operator or private mode that disables all approval friction for single-user setups
• Ship a migration guide when security defaults change between versions