PR #60788: fix(agents): restore exec host=node routing and per-call override from auto

• Repository: openclaw/openclaw
• Author: openperf
• State: closed | merged: True
• Link: https://github.com/openclaw/openclaw/pull/60788

Description (problem / solution / changelog)

Summary

• Problem: Since 2026.4.2, exec host=node no longer routes commands to paired nodes — every command executes on the gateway instead. All four configuration paths are broken: global tools.exec.host: "node" silently runs on gateway; tools.exec.host: "auto" with per-call host=node throws "exec host not allowed"; subagent host=node also throws; and disabling elevated does not help. This leaves zero remaining paths to execute commands on paired nodes from agents (#60772, same root cause as stale #20669).

• Root Cause: Two regressions in resolveExecTarget() and isRequestedExecTargetAllowed() in src/agents/bash-tools.exec-runtime.ts:

  1. Elevated override (line 238–245): elevatedRequested unconditionally returns effectiveHost: "gateway", ignoring configuredTarget: "node". When a channel has elevated defaults enabled (defaultLevel: "on"), the elevated mode resolves to "ask" → elevatedRequested = true → gateway forced, even though the user explicitly configured host=node.
  2. Strict equality gate (line 224–228): isRequestedExecTargetAllowed uses requestedTarget === configuredTarget. When configuredTarget is "auto", any per-call override to a concrete host (node, gateway, sandbox) is rejected. The comment says "auto is a routing strategy, not a wildcard allowlist", but this contradicts the documented behavior where auto should allow runtime host selection.

• Fix:

  1. Elevated: When configuredTarget === "node", preserve effectiveHost: "node" instead of forcing gateway. The node's own approval/security layer handles elevated semantics on the remote host. All other configured targets (auto, sandbox, gateway) still redirect elevated to gateway as before.
  2. Auto override: Allow isRequestedExecTargetAllowed to return true when configuredTarget === "auto", enabling per-call overrides to any concrete host. Non-auto concrete targets still require exact match to prevent silent host-hopping.

• What changed:

  • src/agents/bash-tools.exec-runtime.ts: Fixed isRequestedExecTargetAllowed to allow per-call overrides under auto; fixed resolveExecTarget elevated path to honour node binding.
  • src/agents/bash-tools.exec-runtime.test.ts: Updated 2 existing tests and added 5 new tests covering auto→node override, auto→gateway override, auto→sandbox override, cross-host rejection for concrete targets, elevated+node routing, and elevated+node without per-call override.

• What did NOT change (scope boundary): Node transport layer (bash-tools.exec-host-node.ts), approval policy resolution (exec-approvals.ts), sandbox isolation checks in bash-tools.exec.ts, and the elevated gate logic in createExecTool.execute are all untouched. The fix is strictly limited to target selection in resolveExecTarget.

Reproduction

1. Pair a Windows node (connected, system.run capability advertised).
2. Set tools.exec.host: "node" and tools.exec.node: "<node-id>" in config.
3. Run exec hostname from an agent session.
4. Before fix: Returns gateway hostname (Linux). After fix: Returns node hostname (Windows).
5. Alternatively, set tools.exec.host: "auto" and run exec host=node: hostname.
6. Before fix: Throws "exec host not allowed". After fix: Routes to node correctly.

Risk / Mitigation

• Risk: Allowing per-call overrides under auto could let a sandboxed session escape to gateway/node.
• Mitigation: Sandbox isolation is enforced independently in bash-tools.exec.ts (line 1338: target.selectedTarget === "sandbox" && !sandbox check) and by the approval layer (line 1322: host === "sandbox" ? "deny" : "full"). The new tests explicitly verify that cross-host overrides between concrete targets (e.g. node → gateway) are still rejected. The elevated fix only applies to configuredTarget === "node", which is an explicit admin choice — no implicit escalation path is opened.

Change Type (select all)

• Bug fix

Scope (select all touched areas)

• Gateway
• Agent Tools
• Exec Runtime

Linked Issue/PR

Fixes #60772

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/agents/bash-tools.exec-runtime.test.ts (modified, +103/-5)
• src/agents/bash-tools.exec-runtime.ts (modified, +33/-6)