Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: approvals.exec.mode accepts invalid value, approvals/subagents unreliable on main and channels [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#59125•Fetched 2026-04-08 02:28:22
View on GitHub
Comments
1
Participants
2
Timeline
8
Reactions
0
Author
SnakkazSnakkaz
Participants
jameslcowanjameslcowanSnakkazSnakkaz
Timeline (top)
labeled ×2subscribed ×2commented ×1cross-referenced ×1

The approvals.exec.mode config accepts values outside the allowed set ("session", "targets", "both"). Approvals are not reliably granted on main and channels, and subagent approval flows sometimes fail to trigger or complete as observed in logs.

Root Cause

The approvals.exec.mode config accepts values outside the allowed set ("session", "targets", "both"). Approvals are not reliably granted on main and channels, and subagent approval flows sometimes fail to trigger or complete as observed in logs.

Fix Action

Fixed

PR fix notes

PR #59187: fix(approvals): fall back to session mode for invalid exec mode values

Description (problem / solution / changelog)

Summary

  • Validate approvals.exec.mode at the consumption point in the approval forwarder
  • Invalid values (anything other than "session", "targets", "both") now log a warning and fall back to "session" instead of silently producing an empty target list

Why

The zod schema correctly constrains approvals.exec.mode to "session" | "targets" | "both", but openclaw config set in default (non-JSON) mode skips schema validation for speed. Users who set an invalid mode via config set or manual JSON editing end up with a value that passes through normalizeMode unchanged, never matches any routing branch, and silently drops all approval forwarding.

Fixes #59125

Testing

pnpm test -- src/infra/exec-approval-forwarder.test.ts

Added test: "falls back to session routing when mode is an invalid string"

Changed files

  • src/infra/exec-approval-forwarder.test.ts (modified, +23/-0)
  • src/infra/exec-approval-forwarder.ts (modified, +5/-0)

Code Example

Evidence: Documentation clearly lists allowed approvals.exec.mode values; system accepts others.
Logs show attempted main and channel approvals failing when config value is invalid; subagent log evidence demonstrates some approval flows not executed. No approval granted in those workflows even when expected.
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

Yes

Summary

The approvals.exec.mode config accepts values outside the allowed set ("session", "targets", "both"). Approvals are not reliably granted on main and channels, and subagent approval flows sometimes fail to trigger or complete as observed in logs.

Steps to reproduce

  1. Set approvals.exec.mode in config to an invalid value not in ["session", "targets", "both"].
  2. Trigger an approval on main or a channel, especially where subagent approval routing is active.
  3. Observe approvals not processed for main/channels, and subagent workflows intermittently not executing or failing altogether.

Expected behavior

  • Only the values "session", "targets", or "both" should be accepted for approvals.exec.mode (as shown in docs/examples).
  • Approval logic for main and all channels—including via subagents—should always function as documented (approvals granted where intended).

Actual behavior

  • System accepts invalid approvals.exec.mode values, which leads to unpredictable or blocked approval logic.
  • Approvals are not processed for all main/channel cases; subagents fail or do not trigger approval for some workflows, as confirmed by log and workflow observations.

OpenClaw version

v2026.3.31

Operating system

Ubuntu 24.04

Install method

npm global

Model

github copilot claude sonnet 4.6

Provider / routing chain

gateways, proxies

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Evidence: Documentation clearly lists allowed approvals.exec.mode values; system accepts others.
Logs show attempted main and channel approvals failing when config value is invalid; subagent log evidence demonstrates some approval flows not executed. No approval granted in those workflows even when expected.

Impact and severity

Affected: All workflows using main or channel approval logic, especially those routed via subagents Severity: Major—can block approvals and workflow progress across channels Frequency: Consistent when configuration is invalid or subagent routing is used Consequence: Approvals not granted as required; workflows can stall due to lack of approval even when evidence suggests they should complete.

Additional information

Request: Enforce that only allowed values are accepted for approvals.exec.mode. Ensure approval routing (including via subagents) always works as documented on main and all channels.

extent analysis

TL;DR

Enforce valid approvals.exec.mode values to prevent approval logic issues on main and channels, especially with subagent routing.

Guidance

  • Validate the approvals.exec.mode config value against the allowed set ("session", "targets", "both") before using it in approval logic.
  • Update the configuration to only accept these specified values to prevent unpredictable approval behavior.
  • Review logs and workflow outcomes to verify that approval logic functions as expected after enforcing valid config values.
  • Consider adding input validation for the approvals.exec.mode config to prevent future misconfigurations.

Example

const allowedModes = ["session", "targets", "both"];
if (!allowedModes.includes(approvals.exec.mode)) {
  throw new Error(`Invalid approvals.exec.mode value: ${approvals.exec.mode}`);
}

Notes

This solution assumes that the issue is primarily caused by the acceptance of invalid approvals.exec.mode values. Enforcing valid values should mitigate the approval logic issues, but further investigation may be needed to ensure all edge cases are handled.

Recommendation

Apply workaround: Enforce valid approvals.exec.mode values to prevent approval logic issues, as this directly addresses the identified problem and should improve the reliability of approval granting on main and channels.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

  • Only the values "session", "targets", or "both" should be accepted for approvals.exec.mode (as shown in docs/examples).
  • Approval logic for main and all channels—including via subagents—should always function as documented (approvals granted where intended).
#GPU setup#container setup#orchestration issue#cache issue#memory leak

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: approvals.exec.mode accepts invalid value, approvals/subagents unreliable on main and channels [1 pull requests, 1 comments, 2 participants]