Codex review: needs real behavior proof before merge. Reviewed July 8, 2026, 9:46 AM ET / 13:46 UTC.

Summary
The branch adds shared npm/pnpm/yarn exec-wrapper parsing and uses it to retarget durable exec approval matching, allow-always persistence, and node-host mutable operand binding to the inner command.

PR surface: Source +390, Tests +1029. Total +1419 across 10 files.

Reproducibility: Source-reproducible: current main only has package-manager unwrapping in node-host mutable operand binding, while the PR adds infra-level allowlist and persistence retargeting with regression tests for stale wrapper approval reuse. I did not execute the repro because this review is read-only.

Review metrics: none identified.

Stored data model
Persistent data-model change detected: persistent cache schema: src/infra/package-manager-exec-wrapper.ts, persistent cache schema: src/node-host/invoke-system-run-plan.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Post current-head terminal/live proof for aba88fe showing stale outer approval denial and safe inner executable reuse, with secrets, IPs, phone numbers, and private endpoints redacted.
• After updating the PR body, let ClawSweeper re-review automatically or ask a maintainer to comment @clawsweeper re-review if it does not.

Proof guidance:

• [P1] Needs stronger real behavior proof before merge: Terminal-style proof exists for older head 86c7434, but the live head is aba88fe after later parser changes; please post current-head live output or logs with private details redacted, then update the PR body to trigger re-review.

Risk before merge

• [P1] The available real-behavior proof does not cover the current head after the final package-manager shorthand changes, so the security-boundary behavior is not yet proven for the exact code under review.
• [P1] The PR intentionally invalidates reusable stale outer package-manager approvals for delegated exec forms; existing operators may see fresh prompts or fail-closed behavior until they approve the inner executable.
• [P1] Because this changes durable process-exec approval semantics, green CI alone does not settle whether the compatibility/security tradeoff is acceptable.

Maintainer options:

1. Refresh proof, then accept tightening (recommended)
   Have the contributor prove the current head against the stale-wrapper denial and inner-executable reuse scenarios before maintainer security review decides whether to land.
2. Add an explicit compatibility story
   If the re-prompt behavior is too disruptive, require a documented transition, migration, or narrower compatibility-preserving default before merge.
3. Pause the branch
   If maintainers are not ready to change durable approval semantics, close or pause this PR and keep the approval model unchanged for now.

Next step before merge

• [P1] Needs current-head real behavior proof and maintainer/security-boundary review; there is no narrow ClawSweeper repair finding to queue.

Maintainer decision needed

• Question: Should OpenClaw accept the tighter package-manager exec durable-approval behavior once the contributor refreshes exact-head proof for aba88fe?
• Rationale: The code is a plausible security fix, but it intentionally changes reusable approval behavior for existing stale wrapper entries and therefore needs maintainer intent beyond automated code review.
• Likely owner: jesse-merhi — The changed path extends the command authorization planner rewrite jesse-merhi recently authored, making them the best code-history owner for the security-boundary choice.
• Options:
  • Accept after exact-head proof (recommended): Require current-head terminal or live output that proves stale outer approvals fail closed and safe inner executable approvals still reuse, then proceed with security-boundary review.
  • Require compatibility path: Ask for a narrower default or migration/docs path if maintainers do not want existing package-manager wrapper approvals to re-prompt without a transition.
  • Pause or close direction: Pause this branch if maintainers decide package-manager wrapper approval semantics should stay unchanged until a broader approval-model redesign.

Security
Cleared: No concrete supply-chain, secret, permission, dependency-source, or workflow security issue was found in the diff; the functional approval-boundary change remains a merge-risk decision.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

ClawSweeper proof for current head 86c74349aa760f8e30fe7ad6ba47e3702253c22a

Behavior proved: package-manager allow always approvals now persist and match the resolved inner executable for safe exec-style commands, while stale outer wrapper approvals fail closed for shell-carrier or chained package-manager exec paths. Non-exec script-runner forms such as yarn run keep existing approval behavior.

Environment and production path: local PR checkout at the current head, exercising OpenClaw's production approval-flow adapter functions (evaluateShellAllowlistWithAuthorization, requiresExecApproval, resolveAllowAlwaysPersistenceDecision, and planShellAuthorization) with real temporary executable files. The protected security boundary is the durable exec approval allowlist before the node-host subprocess launch path; a stale wrapper approval must not satisfy policy or allow the protected process execution sink to be reached without a fresh approval.

Command/artifact evidence:

• node --import tsx --input-type=module - <<'EOF' | tee auto-pr-issue-842.local-approval-proof.txt
• git diff --check origin/main...HEAD
• node scripts/run-oxlint.mjs src/infra/package-manager-exec-wrapper.ts src/infra/exec-allow-always-persistence.test.ts src/infra/exec-approvals-allow-always.test.ts
• node scripts/run-vitest.mjs src/infra/exec-allow-always-persistence.test.ts src/infra/exec-approvals-allow-always.test.ts src/node-host/invoke-system-run-plan.test.ts

Evidence:

• Fixed/denied: stale outer pnpm, chained pnpm -> npm, and stale outer yarn exec approvals did not satisfy the allowlist for shell-carrier package-manager exec paths; requiresExecApproval stayed true, so the protected process execution sink had subprocess calls=0 for stale-wrapper reuse and no subprocess spawn was authorized by the stale approval.
• Control: safe pnpm exec -- tsx ./run.ts persisted the inner tsx executable path, did not persist the outer pnpm wrapper, and the repeated safe package-manager exec was satisfied by the inner executable approval, so intended approval reuse still works.
• Benign compatibility control: yarn run build -- node remained allowed by an existing yarn script-runner approval, proving run is not treated as delegated package-manager exec.
• Proof output:
  • PASS allow-always persistence produces durable patterns for safe package-manager exec
  • PASS safe package-manager exec persists the inner executable path
  • PASS safe package-manager exec does not persist the outer pnpm wrapper
  • PASS positive control: repeated safe package-manager exec is satisfied by inner executable approval
  • PASS benign control: yarn run remains a script-runner approval, not delegated exec
  • PASS exploit denied: stale outer pnpm shell-carrier does not satisfy stale wrapper approvals
  • PASS exploit denied: stale outer pnpm shell-carrier still requires a fresh approval
  • PASS exploit denied: chained pnpm->npm shell carrier does not satisfy stale wrapper approvals
  • PASS exploit denied: chained pnpm->npm shell carrier still requires a fresh approval
  • PASS exploit denied: stale outer yarn exec shell carrier does not satisfy stale wrapper approvals
  • PASS exploit denied: stale outer yarn exec shell carrier still requires a fresh approval
  • JSON summary: {"ok":true,"head":"86c74349aa760f8e30fe7ad6ba47e3702253c22a","environment":"local source checkout","staleWrapperRequiresApproval":true,"chainedWrapperRequiresApproval":true,"yarnExecWrapperRequiresApproval":true,"yarnRunControlAllowed":true}

Validation status for this head: GHSA dry-run passed with ACCEPT/SOLVES/BC PASS; review-pr passed with no blocker or important findings; Claude autoreview passed with no accepted/actionable findings; focused local validation passed including pnpm tsgo:test; PR CI rollup is clean with no pending or failing current checks.

Compatibility/operator note: this intentionally tightens stale outer package-manager wrapper approvals for delegated exec forms. Existing stale wrapper entries may prompt again, but the stored approval schema is unchanged and the replacement durable approval is for the actual inner executable that will be reused. Script-runner forms such as npm/pnpm/yarn run are not treated as delegated exec and keep existing approval behavior.

Live gaps: I did not run a full live Gateway WebSocket approval transcript because no approved live setup or credentialed user environment is available in this orchestrator session. I inspected available package scripts for e2e/live/docker/qa/gateway harnesses; there is no targeted approval-flow live harness for this boundary, so this proof uses the nearest production adapter and the PR's CI/local validation.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper re-review

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

ClawSweeper proof for current head aba88fec0e3fed801884b7d2cdfae9677c40ca25

Behavior proved: package-manager allow always approvals persist and match the resolved inner executable for safe exec-style commands, while stale outer wrapper approvals fail closed for shell-carrier, cwd shorthand, and Yarn Classic run/bare executable-fallback paths.

Security boundary and protected sink: durable exec approval allowlist evaluation before the node-host subprocess launch path. The protected sink is the node-host subprocess launch behind the approval gate. In the exploit controls below the sink is not reached because policy returns allowlistSatisfied=false and requiresFreshApproval=true; no subprocess exec call is made from a stale package-manager wrapper approval, so the request cannot carry into process execution.

Production path exercised: OpenClaw approval-flow adapter functions evaluateShellAllowlistWithAuthorization, requiresExecApproval, resolveAllowAlwaysPersistenceDecision, and planShellAuthorization, with real temporary executable files on PATH. This proof stops at the approval boundary and does not invoke external provider credentials or native clients.

Dependency contract checked before relying on local proof: package.json exposes broader gateway/live/docker/e2e scripts, including test:e2e:gateway, test:gateway, test:live, and test:docker:live-gateway, but this issue boundary is the local durable exec approval decision before process launch. Yarn Classic official yarn run docs state that a run target can be a local node_modules/.bin executable and that bare yarn <name> is a shortcut for yarn run <name>, so the yarn fallback denial is part of the proof.

Positive controls:

• pnpm exec -- tsx ./run.ts: persisted against inner tsx; inner tsx allow-always entry reused successfully.
• pnpm -C ./package exec -- tsx ./run.ts: persisted against inner tsx; inner tsx allow-always entry reused successfully.
• yarn exec -- tsx ./run.ts: inner tsx allow-always entry reused successfully.

Denied exploit controls:

• pnpm exec sh -c 'id > marker' with stale outer pnpm allow-always entry: allowlistSatisfied=false, requiresFreshApproval=true.
• pnpm -C ./package eslint . with stale outer pnpm allow-always entry: allowlistSatisfied=false, requiresFreshApproval=true.
• yarn run eslint . with stale outer yarn allow-always entry: allowlistSatisfied=false, requiresFreshApproval=true.
• yarn eslint . with stale outer yarn allow-always entry: allowlistSatisfied=false, requiresFreshApproval=true.
• pnpm exec -- npm x sh -c 'echo warmup-ok': allow-always persistence decision is one-shot.

Protected sink result: all denied exploit controls stop at the approval boundary and require a fresh user approval, so runExecProcess/node-host subprocess launch is not authorized by the stale wrapper allow-always entry. This is 0 subprocess exec for the stale-wrapper exploit path. The positive controls prove intended approval behavior still works by reusing the inner tsx approval for safe package-manager exec forms.

Exact local commands already run for this head:

• git diff --check
• node scripts/run-oxlint.mjs src/infra/package-manager-exec-wrapper.ts src/node-host/invoke-system-run-plan.ts src/infra/exec-allow-always-persistence.test.ts src/infra/exec-approvals-allow-always.test.ts src/node-host/invoke-system-run-plan.test.ts
• node scripts/run-vitest.mjs src/infra/exec-allow-always-persistence.test.ts src/infra/exec-approvals-allow-always.test.ts src/node-host/invoke-system-run-plan.test.ts
• Security dry-run: ACCEPT / SOLVES / BC PASS for aba88fec0e3fed801884b7d2cdfae9677c40ca25.
• review-pr: READY FOR /prepare-pr, findings=0 for aba88fec0e3fed801884b7d2cdfae9677c40ca25.
• Claude autoreview: clean, no accepted/actionable findings for aba88fec0e3fed801884b7d2cdfae9677c40ca25.
• ClawSweeper source feedback: no source repair finding for aba88fec0e3fed801884b7d2cdfae9677c40ca25; proof-only blocker.
• CI/statusCheckRollup: relevant checks completed successfully for aba88fec0e3fed801884b7d2cdfae9677c40ca25; expected skipped/neutral entries only.

Current-head proof output:

{
  "head": "aba88fec0e3fed801884b7d2cdfae9677c40ca25",
  "protectedBoundary": "durable exec approval allowlist before node-host subprocess launch",
  "positiveControls": [
    {
      "command": "pnpm exec -- tsx ./run.ts",
      "persisted": "inner tsx",
      "reused": true
    },
    {
      "command": "pnpm -C ./package exec -- tsx ./run.ts",
      "persisted": "inner tsx",
      "reused": true
    },
    {
      "command": "yarn exec -- tsx ./run.ts",
      "reused": true
    }
  ],
  "deniedExploitControls": [
    {
      "command": "pnpm exec sh -c 'id > marker'",
      "allowlistSatisfied": false,
      "requiresFreshApproval": true
    },
    {
      "command": "pnpm -C ./package eslint .",
      "allowlistSatisfied": false,
      "requiresFreshApproval": true
    },
    {
      "command": "yarn run eslint .",
      "allowlistSatisfied": false,
      "requiresFreshApproval": true
    },
    {
      "command": "yarn eslint .",
      "allowlistSatisfied": false,
      "requiresFreshApproval": true
    }
  ],
  "oneShotControls": [
    {
      "command": "pnpm exec -- npm x sh -c 'echo warmup-ok'",
      "persistence": "one-shot"
    }
  ],
  "liveEnvironmentGaps": "No external provider/native client needed; proof uses production approval-flow adapters with real temporary executable files and stops before launching subprocesses."
}

@clawsweeper re-review