fix(gateway): advertise exec approval node commands by steipete · Pull Request #100505 · openclaw/openclaw

steipete · 2026-07-06T00:30:51Z

What Problem This Solves

Desktop node hosts advertise system.execApprovals.get and system.execApprovals.set, but Gateway policy removed those commands before the approved node surface reached the Control UI. The dedicated exec-approval RPCs also relayed directly to the node without rechecking the effective paired surface or live gateway.nodes.denyCommands policy.

Closes #57775. Maintainer replay of #88296 because the stale contributor branch could not be safely updated in place.

Why This Change Was Made

Add the canonical exec-approval command list to desktop pairing defaults and reconnect preservation.
Keep new commands ineffective until pairing approval; existing nodes request reapproval and retain only their old effective surface meanwhile.
Enforce the effective node command surface and current runtime allowlist at the dedicated exec-approval relay boundary.
Preserve the explicit raw node.invoke rejection and operator.admin RPC scope.
Preserve Vincent Koc's authorship with a Co-authored-by trailer and changelog credit.

User Impact

The Control UI can read and update approval settings on approved capable desktop nodes. Pending pairing and operator deny rules remain fail-closed.

Evidence

Blacksmith Testbox focused gateway suite: 12 files, 126 tests passed.
Blacksmith Testbox pnpm check:changed: passed, including core/type/lint/policy guards.
Two fresh autoreview passes after the relay-policy fix: no actionable findings, 0.96 confidence.
Regression coverage includes initial pairing, old-node reapproval, approved reconnect, live deny rules, successful relay, raw invoke rejection, and unknown-node errors.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 933553f57f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-06T00:35:18Z


 const SYSTEM_COMMANDS = [
  ...NODE_SYSTEM_RUN_COMMANDS,
+  ...NODE_EXEC_APPROVALS_COMMANDS,


Require admin to approve exec-approval node commands

When a desktop node declares system.execApprovals.get/set, adding those commands to the pairable desktop command defaults means they can now be persisted in the paired-node command surface. However src/infra/node-pairing-authz.ts still only treats NODE_SYSTEM_RUN_COMMANDS as requiring operator.admin, so a caller with operator.pairing + operator.write can approve a node that gains the admin-scoped exec-approval command surface. Please include NODE_EXEC_APPROVALS_COMMANDS in the admin-required pairing-scope check before advertising them for pairing.

Useful? React with 👍 / 👎.

steipete · 2026-07-06T00:46:21Z

Land-ready at exact head 7b0dd7f17013504e524bc232c61614c320c02c40.

Work completed:

Replayed fix(gateway): advertise exec approval node commands #88296 onto current main as one verified maintainer commit, preserving Vincent Koc as co-author and in the changelog.
Strengthened reconnect coverage to prove the pending-reapproval and approved-reconnect state transition.
Fixed the security gap found during review: dedicated exec.approvals.node.get/set now enforce the node's effective paired command surface and current runtime allowlist, including live denyCommands, before relay.
Preserved raw node.invoke rejection, operator.admin method scope, and unknown-node UNAVAILABLE details.

Proof:

Blacksmith Testbox tbx_01kwtcfpcqcqm3370b63v9yycy: focused gateway suite, 12 files / 126 tests passed.
Blacksmith Testbox pnpm check:changed: passed with core type, lint, and policy guards.
Two fresh autoreview passes after the security fix: no actionable findings, 0.96 confidence.
Exact-head hosted CI: all 53 jobs passed or intentionally skipped: https://github.com/openclaw/openclaw/actions/runs/28760385558
Native prepare artifacts validated; hosted exact-head gate accepted.

Known proof gap: direct sanitized AWS contributor-head execution was unavailable because the shared lease pool was over capacity. The same reviewed tree was replayed by a maintainer and proved on Blacksmith Testbox plus exact-head hosted CI.

clawsweeper · 2026-07-06T00:47:37Z

Codex review: needs real behavior proof before merge. Reviewed July 5, 2026, 10:02 PM ET / 02:02 UTC.

Summary
This PR adds exec-approval command IDs to gateway desktop node allowlists, gates exec-approval node relays with node command policy, and adds gateway regression coverage.

PR surface: Source +27, Tests +206. Total +233 across 5 files.

Reproducibility: yes. as a source-level reproduction. Current source shows the node host advertises system.execApprovals.get/set and the UI requires those command IDs, while the gateway command policy needed this PR to preserve them for approved desktop nodes.

Review metrics: 1 noteworthy metric.

Exec-approval command IDs: 2 added to pairable desktop node command policy. These command IDs decide whether a node can be approved for remote exec-approval reads and writes, so pairing authz must match the admin-scoped RPC boundary.

Stored data model
Persistent data-model change detected: migration/backfill/repair: src/gateway/node-connect-reconcile.test.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #57775
Summary: This PR is the current focused fix candidate for the canonical Windows node exec-approval command advertisement issue; older and broader PRs overlap but do not make this maintainer-labeled replay safe to close.

Members:

canonical: Windows headless node host supports exec approvals via CLI, but nodes describe / Control UI do not advertise system.execApprovals.get/set #57775 - The PR body uses closing syntax for this issue, and the issue describes missing system.execApprovals.get/set advertisement that this diff targets.
superseded: fix(gateway): advertise exec approval node commands #88296 - The PR body says this is a maintainer replay of that older focused branch for the same gateway command-advertisement fix.
partial_overlap: fix(gateway): check node commands before exec-approvals invoke #97729 - That open PR also touches exec-approval relay checks and admin pairing authorization, but it targets a broader unsupported-capability error path.
partial_overlap: fix(gateway): reject invoke for unadvertised node commands #98051 - That open PR addresses unadvertised node command invocation more generally and does not replace this focused advertisement fix.
partial_overlap: [Bug]: OpenClaw CLI should handle node lacks exec approvals capability gracefully #97578 - That issue concerns structured errors when a node lacks exec-approval capability, which overlaps the relay guard but asks for a different user-visible outcome.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🌊 off-meta tidepool
Patch quality: 🧂 unranked krab
Result: blocked by patch quality or review findings.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Add the pairing-authz fix and regression coverage for system.execApprovals.get/set before merge.
[P2] Refresh focused gateway validation after the authz repair.

Risk before merge

[P1] Merging as-is would let a caller with operator.pairing plus operator.write approve a node surface containing system.execApprovals.get/set, even though the dedicated exec-approval node RPCs require operator.admin.
[P1] The latest diff adds relay and command-policy tests but still does not cover the pairing authorization helper or gateway RPC approval path for exec-approval commands.

Maintainer options:

Fix pairing authz before merge (recommended)
Require operator.admin for system.execApprovals.get/set during node pairing approval and add direct helper plus gateway RPC regression coverage.
Pause for boundary review
Keep the PR open without repair if maintainers want to reconsider whether exec-approval command advertisement should remain admin-only at pairing approval time.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Add NODE_EXEC_APPROVALS_COMMANDS to the admin-required command check in src/infra/node-pairing-authz.ts, cover system.execApprovals.get/set in src/infra/node-pairing-authz.test.ts and src/gateway/server.node-pairing-authz.test.ts, and leave node.invoke plus exec.approvals.node.* method scopes unchanged.

Next step before merge

[P1] A narrow automated repair can fix the remaining blocker by aligning node pairing authorization with the admin-scoped exec-approval RPC surface.

Security
Needs attention: The diff still introduces an authorization gap by making exec-approval node commands pairable without requiring admin approval for that command surface.

Review findings

[P1] Require admin for exec-approval pairing — src/gateway/node-command-policy.ts:58

Review details

Best possible solution:

Add exec-approval commands to the admin-required node pairing authorization set with focused helper and gateway RPC coverage, then land this focused gateway advertisement fix for #57775.

Do we have a high-confidence way to reproduce the issue?

Yes, as a source-level reproduction. Current source shows the node host advertises system.execApprovals.get/set and the UI requires those command IDs, while the gateway command policy needed this PR to preserve them for approved desktop nodes.

Is this the best way to solve the issue?

No, not yet. The command-policy and relay checks are the right layer for the advertisement bug, but the best fix must also update node pairing authorization so these admin-scoped commands require operator.admin when approved.

Full review comments:

[P1] Require admin for exec-approval pairing — src/gateway/node-command-policy.ts:58
This is the same blocker from the previous ClawSweeper cycles and remains on the latest head. Adding NODE_EXEC_APPROVALS_COMMANDS to the pairable desktop command surface means a caller with operator.pairing plus operator.write can approve system.execApprovals.get/set, but the dedicated exec.approvals.node.* RPCs are operator.admin; include these command IDs in resolveNodePairApprovalScopes and cover the authz path.
Confidence: 0.94

Overall correctness: patch is incorrect
Overall confidence: 0.94

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against d095f4755339.

Label changes

Label justifications:

P2: This is a bounded gateway bug-fix PR with a concrete security-boundary blocker, but it is not evidence of a broad outage or unusable runtime.
merge-risk: 🚨 security-boundary: The diff makes exec-approval node commands pairable while the pairing authz helper still allows non-admin approval for non-run command surfaces.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The external proof gate is not applied because this is a maintainer-labeled replay PR; hosted CI/Testbox evidence is supplemental, and the current blocker is source-level authorization.

Evidence reviewed

PR surface:

Source +27, Tests +206. Total +233 across 5 files.

View PR surface stats

Area	Files	Added	Net
Source	2	27	+27
Tests	3	206	+206
Docs	0	0	0
Config	0	0	0
Generated	0	0	0
Other	0	0	0
Total	5	233	+233

Security concerns:

[high] Non-admin pairing can approve exec-approval commands — src/gateway/node-command-policy.ts:58
The dedicated exec-approval node methods require operator.admin, but the pairing authz helper still classifies system.execApprovals.get/set as a non-run command surface requiring only pairing plus write scopes once this PR advertises them.
Confidence: 0.92

Acceptance criteria:

[P1] pnpm test src/infra/node-pairing-authz.test.ts src/gateway/server.node-pairing-authz.test.ts src/gateway/node-command-policy.test.ts src/gateway/server-methods/exec-approvals.test.ts.
[P1] pnpm check:changed.

What I checked:

PR head advertises exec-approval commands: The latest PR head adds NODE_EXEC_APPROVALS_COMMANDS to SYSTEM_COMMANDS and DESKTOP_HOST_COMMANDS, making system.execApprovals.get/set pairable and preservable for desktop nodes. (src/gateway/node-command-policy.ts:56, 865b8dbd5350)
Pairing authz still misses exec approvals: resolveNodePairApprovalScopes still checks only NODE_SYSTEM_RUN_COMMANDS for operator.admin and falls back to operator.write for other non-empty command lists, which now includes exec-approval commands. (src/infra/node-pairing-authz.ts:16, 865b8dbd5350)
Approval persists the scoped command surface: approveNodePairing resolves required scopes before writing pending.commands into the paired node record, so the helper's classification controls who can approve the exec-approval command surface. (src/infra/node-pairing.ts:534, 865b8dbd5350)
Dedicated RPCs are admin-scoped: exec.approvals.node.get and exec.approvals.node.set remain operator.admin methods, so pairing approval for their underlying node command surface should match that boundary. (src/gateway/methods/core-descriptors.ts:54, 865b8dbd5350)
Issue root cause remains matched: The Windows node host already advertises NODE_EXEC_APPROVALS_COMMANDS, and the Control UI selects exec-approval targets by system.execApprovals.get/set, matching the linked issue's hidden capability symptom. (src/node-host/runner.ts:290, 865b8dbd5350)
Exact-head CI status: The live PR reports head 865b8db as mergeable with successful CI run 28762641720, but green CI does not cover the missing pairing-authz invariant. (865b8dbd5350)

Likely related people:

steipete: GitHub path history shows recent work on node command policy and node-pairing authz, and this PR is the current replay commit for the focused fix. (role: recent gateway and node-pairing contributor; confidence: high; commits: 865b8dbd5350, 1fef99962edf, 2da49ef4acbf; files: src/gateway/node-command-policy.ts, src/infra/node-pairing-authz.ts, src/gateway/server-methods/exec-approvals.ts)
vincentkoc: PR 88296 is the earlier focused branch this PR replays, and path history shows adjacent exec-approvals node invoke work. (role: original focused fix author and adjacent exec-approvals contributor; confidence: high; commits: 486d285c24f1, c6232347dcb2; files: src/gateway/node-command-policy.ts, src/gateway/node-command-policy.test.ts, src/gateway/node-connect-reconcile.test.ts)
martins-oss: Recent path history shows work on exec-approvals handler error handling adjacent to the relay-policy changes in this PR. (role: adjacent exec-approvals contributor; confidence: medium; commits: 904c8717d0bb; files: src/gateway/server-methods/exec-approvals.ts, src/gateway/server-methods/exec-approvals.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (2 earlier review cycles)

reviewed 2026-07-06T00:52:24.031Z sha 3ed79f3 :: needs real behavior proof before merge. :: [P1] Require admin for exec-approval pairing
reviewed 2026-07-06T01:39:54.544Z sha 15d1912 :: needs real behavior proof before merge. :: [P1] Require admin for exec-approval pairing

steipete · 2026-07-06T01:16:11Z

Land-ready at exact head 3ed79f3cb4b612ba0b7e2f472780d201f28a34ea.

Review and proof completed:

traced desktop pairing, approved reconnect filtering, Control UI capability discovery, the dedicated exec-approval RPC, and the sibling raw node.invoke path
fixed the review-found bypass so pending pairing and live gateway.nodes.denyCommands now fail closed before the dedicated RPC relays to a node
Blacksmith Testbox focused proof: 12 files / 126 tests passed
Blacksmith Testbox pnpm check:changed passed on the prepared tree
two fresh autoreview passes: no actionable findings
hosted exact-head gates passed: CI run 28760804374 and Workflow Sanity 28760804436

The CI run's first compact-small shard attempt timed out in unrelated doctor-state-migrations.test.ts; rerunning only that failed job on the unchanged head passed. Repo-native OPENCLAW_TESTBOX=1 scripts/pr prepare-run 100505 then accepted the exact-head gates.

No known proof gaps remain.

steipete · 2026-07-06T01:28:36Z

Final resync proof for exact PR head bb7aef52414980d3785a2f5b2e884e5dccb495b5:

Hosted exact-head CI completed successfully: 54/54 jobs, run https://github.com/openclaw/openclaw/actions/runs/28761728533
The repository-native maintainer gate accepted that same remote head with OPENCLAW_TESTBOX=1 scripts/pr prepare-run 100505.
Review artifacts remain valid for the unchanged patch: direct node execution is classified through the approval path, shell behavior remains unchanged, and focused approval regressions cover allow/deny/ask plus remembered decisions.

No known proof gaps remain. Landing this exact head now.

Co-authored-by: Vincent Koc <[email protected]>

steipete · 2026-07-06T02:04:34Z

Final land-ready proof for the clean exact head 865b8dbd5350ad76d6b3c0f98536bb455c9ae3b7.

This is the intended five-file policy fix only:

preserve the canonical node exec-approval command IDs through desktop pairing/reconnect
require the effective session command surface before the dedicated approval RPC relays
re-check the live runtime allowlist so gateway.nodes.denyCommands cannot be bypassed
retain the raw node.invoke prohibition and operator-admin RPC boundary

Proof:

Blacksmith Testbox focused gateway proof: 12 files, 126 tests passed
Blacksmith Testbox pnpm check:changed: passed
two fresh autoreview passes: no actionable findings
exact-head CI: all jobs successful or intentionally skipped: https://github.com/openclaw/openclaw/actions/runs/28762641720
OPENCLAW_TESTBOX=1 scripts/pr prepare-run 100505: passed exact-head hosted gate; native policy reports changelog not required for this changed-file set

The earlier polluted sync head was explicitly discarded; this comment and the native gate apply only to 865b8db.

steipete · 2026-07-06T02:04:48Z

Merged via squash.

Prepared head SHA: 865b8dbd5350ad76d6b3c0f98536bb455c9ae3b7
Landed commit: fccb8888f062058b138461d8b33237742ed195b3

Co-authored-by: Vincent Koc <[email protected]>

openclaw-barnacle Bot added gateway Gateway runtime size: M maintainer Maintainer-authored PR size: L and removed size: M labels Jul 6, 2026

chatgpt-codex-connector Bot reviewed Jul 6, 2026

View reviewed changes

openclaw-barnacle Bot added the scripts Repository scripts label Jul 6, 2026

openclaw-barnacle Bot added docs Improvements or additions to documentation channel: discord Channel integration: discord channel: mattermost Channel integration: mattermost app: macos App: macos app: web-ui App: web-ui size: XL and removed size: L labels Jul 6, 2026

steipete force-pushed the codex/pr-88296-replay branch from bb7aef5 to 15d1912 Compare July 6, 2026 01:30

openclaw-barnacle Bot removed docs Improvements or additions to documentation channel: discord Channel integration: discord channel: mattermost Channel integration: mattermost app: macos App: macos app: web-ui App: web-ui scripts Repository scripts size: XL labels Jul 6, 2026

openclaw-barnacle Bot added the size: XL label Jul 6, 2026

fix(gateway): advertise exec approval node commands

865b8db

Co-authored-by: Vincent Koc <[email protected]>

steipete force-pushed the codex/pr-88296-replay branch from 72795db to 865b8db Compare July 6, 2026 01:46

openclaw-barnacle Bot added size: M and removed channel: telegram Channel integration: telegram channel: voice-call Channel integration: voice-call app: ios App: ios app: web-ui App: web-ui scripts Repository scripts agents Agent runtime and tooling size: XL labels Jul 6, 2026

steipete merged commit fccb888 into main Jul 6, 2026
109 of 114 checks passed

steipete deleted the codex/pr-88296-replay branch July 6, 2026 02:04

Haderach-Ram mentioned this pull request Jul 6, 2026

Ecosystem Digest — 2026-07-06 Haderach-Ram/openclaw-radar#70

Open

github-actions Bot mentioned this pull request Jul 6, 2026

📡 Upstream Digest — 2026-07-06 02:26 UTC curtismercier/openclaw-mods#1220

Open

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 6, 2026

fix(gateway): advertise exec approval node commands (openclaw#100505)

5cb07ef

Co-authored-by: Vincent Koc <[email protected]>

clawsweeper Bot mentioned this pull request Jul 7, 2026

fix(gateway): support native Windows exec approvals #101669

Merged

steipete mentioned this pull request Jul 7, 2026

fix(cli): harden Windows node pairing and approvals #88163

Closed

This was referenced Jul 7, 2026

[Bug]: nodes invoke reports raw JSON parse errors when --params is malformed #101835

Closed

[Bug]: Node approvals commands crash with undefined socket/file #102164

Closed

giodl73-repo pushed a commit to giodl73-repo/openclaw that referenced this pull request Jul 8, 2026

fix(gateway): advertise exec approval node commands (openclaw#100505)

375d113

Co-authored-by: Vincent Koc <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(gateway): advertise exec approval node commands#100505

fix(gateway): advertise exec approval node commands#100505
steipete merged 1 commit into
mainfrom
codex/pr-88296-replay

steipete commented Jul 6, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Jul 6, 2026

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

steipete commented Jul 6, 2026

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

clawsweeper Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Uh oh!

steipete commented Jul 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Jul 6, 2026 •

edited

Loading