fix: elevatedDefault should default to off when tools.elevated.enabled is true#19624
Open
stakeswky wants to merge 1 commit intoopenclaw:mainfrom
Open
fix: elevatedDefault should default to off when tools.elevated.enabled is true#19624stakeswky wants to merge 1 commit intoopenclaw:mainfrom
stakeswky wants to merge 1 commit intoopenclaw:mainfrom
Conversation
…d is true When tools.elevated.enabled is set to true but no explicit elevatedDefault is configured, the fallback was 'on' — causing ALL exec commands to route through the elevated approval gate, which times out silently after 120s. Changed the default fallback from 'on' to 'off' so elevated mode is opt-in per session via /elevated on or by setting elevatedDefault explicitly. Fixes openclaw#19574
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
353
to
+356
| ? (directives.elevatedLevel ?? | ||
| (sessionEntry?.elevatedLevel as ElevatedLevel | undefined) ?? | ||
| (agentCfg?.elevatedDefault as ElevatedLevel | undefined) ?? | ||
| "on") | ||
| "off") |
Contributor
There was a problem hiding this comment.
Consider updating documentation examples in docs/gateway/configuration-reference.md and docs/gateway/configuration-examples.md (plus zh-CN versions) - they currently show elevatedDefault: "on" which may confuse users with this new default.
Prompt To Fix With AI
This is a comment left during a code review.
Path: src/auto-reply/reply/get-reply-directives.ts
Line: 353:356
Comment:
Consider updating documentation examples in `docs/gateway/configuration-reference.md` and `docs/gateway/configuration-examples.md` (plus zh-CN versions) - they currently show `elevatedDefault: "on"` which may confuse users with this new default.
How can I resolve this? If you propose a fix, please make it concise.
Contributor
|
Important fix — defaulting elevated to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #19574
When
tools.elevated.enabledis set totruebut no explicitelevatedDefaultis configured, the fallback was"on"— causing all exec commands to route through the elevated approval gate, which times out silently after 120s.Changes
src/auto-reply/reply/get-reply-directives.ts: Changed the final fallback in theresolvedElevatedLevelresolution chain from"on"to"off", making elevated mode opt-in per session.src/auto-reply/reply/bash-command.ts: Changed the hardcodeddefaultLevel: "on"to"off"in the chat bash command elevated config."on"to"off"in the directive behavior test.Behavior
tools.elevated.enabledwithout settingelevatedDefaultcaused all exec commands to require elevated approval (defaulting to"on")."off". Users must explicitly opt in via/elevated on,/elevated ask, or by settingelevatedDefaultin their agent config.Greptile Summary
Changed the fallback default for
elevatedDefaultfrom"on"to"off"whentools.elevated.enabledistruebut no explicitelevatedDefaultis configured. This fixes issue #19574 where all exec commands were routing through the elevated approval gate and timing out silently after 120 seconds.The fix ensures elevated mode is now opt-in through:
/elevated on|ask|fulldirectives per sessionelevatedDefaultin agent config/elevateddirectives per messageChanges are applied consistently across:
get-reply-directives.ts:356)bash-command.ts:345)The logic is correct and well-tested. The change makes elevated mode behavior more explicit and prevents unexpected approval gate timeouts.
Confidence Score: 4/5
Last reviewed commit: cf6fe4f