Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: Exec allowlist fails silently in long-running sessions (race condition in exec-approvals.json) Body: [1 pull requests, 2 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#63707•Fetched 2026-04-10 03:42:08
View on GitHub
Comments
2
Participants
2
Timeline
9
Reactions
0
Author
JericherryJericherry
Participants
ArtyomkunArtyomkunJericherryJericherry
Timeline (top)
commented ×2cross-referenced ×2labeled ×2mentioned ×1

Exec commands fail with "allowlist miss" errors in long-running sessions, even when the allowlist file on disk contains all expected entries. Elevated exec bypasses the allowlist and continues working. Fresh session (/new) temporarily restores functionality.

Root cause is non-atomic file writes to exec-approvals.json combined with a silent empty-allowlist fallback on JSON parse failure.

Root Cause

Root cause is non-atomic file writes to exec-approvals.json combined with a silent empty-allowlist fallback on JSON parse failure.

Fix Action

Fixed

PR fix notes

PR #63843: fix(exec-approvals): use atomic write to prevent race condition

Description (problem / solution / changelog)

Summary

Replace non-atomic fs.writeFileSync in saveExecApprovals() with saveJsonFile(), which writes to a temp file first then renames. This prevents race conditions that could corrupt the exec-approvals.json file.

Closes #63707

Testing

  • Relevant tests pass

This PR was developed with AI assistance (Claude). All code has been reviewed and tested. Built with islo.dev

Changed files

  • src/infra/exec-approvals.ts (modified, +2/-13)
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

Exec commands fail with "allowlist miss" errors in long-running sessions, even when the allowlist file on disk contains all expected entries. Elevated exec bypasses the allowlist and continues working. Fresh session (/new) temporarily restores functionality.

Root cause is non-atomic file writes to exec-approvals.json combined with a silent empty-allowlist fallback on JSON parse failure.

Steps to reproduce

  1. Start OpenClaw with allowlist security mode and ~40 exec allowlist entries.
  2. Run multiple exec calls over time, particularly with concurrent subagents or cron jobs firing.
  3. Observe non-elevated exec calls failing with "allowlist miss" even though the file on disk is intact.
  4. Elevated exec continues working throughout.
  5. /new (fresh session) temporarily restores functionality.

Expected behavior

Exec commands work reliably regardless of session age or concurrent load.

Actual behavior

Non-elevated exec fails with "allowlist miss" in long-running sessions while the allowlist file on disk remains intact. Elevated exec unaffected.

OpenClaw version

2026.4.8

Operating system

Linux (Docker container on Ubuntu)

Install method

Docker

Model

venice/minimax-m27 (any model affected

Provider / routing chain

venice.ai direct

Additional provider/model setup details

Root cause confirmed from source code analysis:

  1. saveExecApprovals() uses fs.writeFileSync which truncates before writing — any concurrent loadExecApprovals() call reads an empty file and JSON.parse("") throws.

  2. The catch block silently returns { version: 1, agents: {} } — zero allowlist entries — no warning, no retry.

  3. Two writes per exec call (ensureExecApprovals + recordAllowlistMatchesUse) double the race window.

The codebase already has writeJsonAtomic (json-files-CwBCD9zc.js) and withFileLock (file-lock-DOCzEB3j.js) — neither is used by exec-approvals.

Logs, screenshots, and evidence

Impact and severity

Affected: All exec-dependent workflows in long-running sessions (cron jobs, subagents, scripts) Severity: High (blocks cron jobs, subagent exec, daily automation) Frequency: Intermittent — probability increases with concurrent load Consequence: Cron jobs fail silently, exec unreliable after ~5-30 minutes

Additional information

Root cause confirmed from source code analysis:

  1. saveExecApprovals() uses fs.writeFileSync which truncates before writing — any concurrent loadExecApprovals() call reads an empty file and JSON.parse("") throws.

  2. The catch block silently returns { version: 1, agents: {} } — zero allowlist entries — no warning, no retry.

  3. Two writes per exec call (ensureExecApprovals + recordAllowlistMatchesUse) double the race window.

The codebase already has writeJsonAtomic (json-files-CwBCD9zc.js) and withFileLock (file-lock-DOCzEB3j.js) — neither is used by exec-approvals.

extent analysis

TL;DR

  • Replace fs.writeFileSync with writeJsonAtomic in saveExecApprovals() to ensure atomic file writes and prevent allowlist misses.

Guidance

  • Identify and replace all instances of fs.writeFileSync with writeJsonAtomic in the codebase, particularly in saveExecApprovals(), to prevent file truncation and empty file reads.
  • Consider using withFileLock to synchronize access to the allowlist file and prevent concurrent modifications.
  • Review the catch block in loadExecApprovals() to handle JSON parse errors more robustly, such as logging a warning or retrying the operation.
  • Test the changes under concurrent load to verify that the allowlist misses are resolved.

Example

// Before
fs.writeFileSync('exec-approvals.json', JSON.stringify(approvals));

// After
writeJsonAtomic('exec-approvals.json', approvals);

Notes

  • The existing writeJsonAtomic and withFileLock functions in the codebase can be leveraged to address the root cause of the issue.
  • Additional testing and verification may be necessary to ensure that the changes do not introduce new issues or regressions.

Recommendation

  • Apply workaround: Replace fs.writeFileSync with writeJsonAtomic in saveExecApprovals() to ensure atomic file writes and prevent allowlist misses. This change addresses the root cause of the issue and should resolve the allowlist misses in long-running sessions.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Exec commands work reliably regardless of session age or concurrent load.

#latency issue#model loading#dependency error#configuration error#environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING