Summary

Fixes #25082.

The matchAllowlist() function in exec-command-resolution.ts skips any allowlist pattern that does not contain a path separator (/, \, or ~). When a user adds a bare * wildcard via openclaw approvals allowlist add --gateway "*", the pattern is stored correctly in exec-approvals.json but is silently skipped at runtime, causing every command to fail with "exec denied: allowlist miss".

Even if the pattern reached the glob matcher, a single * maps to the regex [^/]* (matches only within one path segment), so it would still fail against absolute resolved paths like /usr/bin/python3.

Root Cause

// Before (line ~235 of exec-command-resolution.ts)
const hasPath = pattern.includes("/") || pattern.includes("\\") || pattern.includes("~");
if (!hasPath) {
  continue;  // bare "*" is skipped here
}

Fix

Handle bare * as a special case that matches any resolved executable path, short-circuiting before the path-presence check and glob expansion:

if (pattern === "*") {
  return entry;  // match everything
}

Tests Added

1. matchAllowlist unit tests — bare * matches against /opt/homebrew/bin/rg and /usr/bin/python3
2. evaluateShellAllowlist integration test — bare * satisfies the full shell allowlist pipeline with a real temp binary on PATH

All 38 existing allowlist tests continue to pass.

Greptile Summary

Added special-case handling for bare * wildcard in matchAllowlist() to match any executable path, fixing the issue where openclaw approvals allowlist add --gateway "*" stored the pattern but silently skipped it at runtime.

• Bare * now short-circuits before the path-separator check and glob expansion
• Without this fix, * would be skipped by hasPath check or fail in glob matcher (converts to [^/]* which doesn't match absolute paths)
• Added 2 unit tests for matchAllowlist() with different resolved paths
• Added 1 integration test for evaluateShellAllowlist() with a real temp binary

Confidence Score: 5/5

• This PR is safe to merge - it fixes a specific bug with a minimal, well-tested change
• Score reflects: (1) targeted fix with clear rationale, (2) excellent test coverage including unit and integration tests, (3) proper placement before the hasPath check, (4) all existing tests pass, (5) no security concerns - the feature is intentional and requires explicit user action
• No files require special attention

_{Last reviewed commit: 8717ea4}