Bug Report

Version: 2026.4.5 (stable)
Platform: macOS (arm64), Darwin 25.4.0

Description

Isolated cron sessions are prompting for exec approval despite both the OpenClaw config and the local exec-approvals.json having security: "full" and ask: "off" configured for the agent.

The approval prompt message states "The effective approval policy requires approval every time, so Allow Always is unavailable" — which directly contradicts the configured effective policy.

Config (relevant parts)

openclaw.json — global exec policy:

"tools": {
  "exec": {
    "security": "full",
    "ask": "off"
  }
}

openclaw.json — per-agent override (partnerships agent):

{
  "id": "partnerships",
  "tools": {
    "exec": {
      "security": "full",
      "ask": "off"
    }
  }
}

~/.openclaw/exec-approvals.json — local approvals:

{
  "version": 1,
  "defaults": {
    "security": "full",
    "ask": "off",
    "askFallback": "full"
  },
  "agents": {
    "partnerships": {
      "security": "full",
      "ask": "off",
      "askFallback": "full"
    }
  }
}

Effective policy per openclaw approvals get

agent:partnerships  security=full  ask=off  (both requested and host agree)

Actual behavior

A cron job running as the partnerships agent in an isolated session triggered an exec approval prompt forwarded to WhatsApp. The prompt says:

Pending command:
cd ~/clawd && ./skills/mcp-direct/scripts/mcp-refresh.sh all && ...

The effective approval policy requires approval every time, so Allow Always is unavailable.

Host: gateway
CWD: /Users/clawd/.openclaw/workspace-partnerships

Expected behavior

With security=full and ask=off in both config layers, exec should run without prompting. This worked correctly in prior versions.

Steps to reproduce

1. Configure an agent with tools.exec.security: "full" and tools.exec.ask: "off"
2. Ensure ~/.openclaw/exec-approvals.json matches with ask: "off"
3. Create a cron job targeting that agent with sessionTarget: "isolated"
4. The cron job runs a shell command — approval prompt is triggered despite policy

Notes

• Interactive sessions for the same agent do NOT have this problem — only isolated cron sessions
• This started happening after updating to 2026.4.5 (did not occur on prior versions)
• The approval is forwarded to WhatsApp as a native approval client