Bug type

Crash (process/app exits or hangs)

Beta release blocker

No

Summary

openclaw approvals get --node <node-id> --json currently fails with a raw JavaScript TypeError when the selected node does not advertise the exec approvals capability.

Observed output:

Cannot read properties of undefined (reading 'socket')

The connected Windows node is otherwise usable and advertises system.run, system.run.prepare, and system.which, but it does not advertise system.execApprovals.get or system.execApprovals.set. In that state, OpenClaw should return a structured, actionable unsupported-capability error instead of exposing an internal TypeError.

Steps to reproduce

1. Run OpenClaw Gateway and CLI through Docker Compose.
2. Pair or connect a Windows node host that advertises system.run, system.run.prepare, and system.which, but does not advertise system.execApprovals.get or system.execApprovals.set.
3. Confirm the node is connected with:

openclaw nodes describe <node-id> --json

4. Request node exec approvals from the CLI:

openclaw approvals get --node <node-id> --json

Expected behavior

The CLI should fail gracefully with an actionable error, for example:

Node <node-id> does not support exec approvals management. The node must advertise system.execApprovals.get/system.execApprovals.set, or the operator must edit the node host approvals file directly.

The error should be structured for --json output and should not depend on internal socket/file/snapshot fields being present.

Actual behavior

The CLI returns:

Cannot read properties of undefined (reading 'socket')

This hides the real operator problem: the selected node lacks the exec approvals capability.

OpenClaw version

2026.6.10

Operating system

Dockerized OpenClaw Gateway/CLI on Linux under WSL2, with a paired Windows node host. Observed node details: text displayName: Windows Node platform: windows version: 0.6.3 clientId: node-host

Install method

Docker Compose using the local OpenClaw image, plus a paired Windows node host.

Model

openai/gpt-5.5

Provider / routing chain

OpenClaw CLI -> OpenClaw Gateway -> paired Windows node host.

Additional provider/model setup details

No response

Logs

The live repro from the Docker CLI container:


node dist/index.js approvals get --node <node-id> --json


returns:


Cannot read properties of undefined (reading 'socket')


The node capability list includes:


system.run
system.run.prepare
system.which


and does not include:


system.execApprovals.get
system.execApprovals.set

Screenshots, recordings, and evidence

No response

Impact and severity

Medium.

This blocks operators from diagnosing and repairing node exec policy denials through the CLI when the node lacks approvals-management support. It also turns a capability mismatch into a confusing internal TypeError, which makes the remediation unclear.

Additional information

This issue is about graceful error handling and capability detection. It does not require enabling remote approvals management for every node implementation.

A reasonable fix would be to detect missing system.execApprovals.get/set before invoking the node approval path, then return a structured unsupported-capability error that tells the operator to update the node host or edit the node-local approvals file directly.