openclaw - 💡(How to fix) Fix [Bug]: SPAWN_ALLOWLIST environment variable is ignored, preventing agent spawning [1 pull requests]

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

The sessions_spawn tool fails with a forbidden error, even when the AGENTS and SPAWN_ALLOWLIST environment variables are correctly configured. The system behaves as if SPAWN_ALLOWLIST is not set, returning allowed: none.

This issue persists after multiple redeploys and even a full stop/start of the Docker containers.

Steps to reproduce

1. Deploy OpenClaw using a docker-compose.yml file.
2. In the openclaw service definition, add the following environment variables:

• 'AGENTS=[{"id":"basic-agent","label":"Basic Agent","description":"A generic agent for simple tasks.","model":"google/gemini-2.5-pro","systemPrompt":"You are a sub-agent. Be concise and efficient."}]'
• 'SPAWN_ALLOWLIST=*' Save the configuration and redeploy the application to ensure the new variables are loaded. From any session, attempt to call the sessions_spawn tool: { "tool": "sessions_spawn", "agentId": "basic-agent", "task": "This is a test task." }

Expected behavior

The sessions_spawn tool call should succeed, creating a new isolated session for the basic-agent.

Actual behavior

The tool call fails with a permission error. The output is:

{ "status": "forbidden", "error": "agentId is not allowed for sessions_spawn (allowed: none)" } This indicates that the allowlist is empty, despite the environment variable being set to *.

OpenClaw version

coollabsio/openclaw:2026.2.6

Operating system

Standard Server (Linux)

Install method

Docker Compose managed by Coolify

Model

gemini 2.5

Provider / routing chain

openclaw -> coolify

Additional provider/model setup details

To confirm the environment variable is correctly passed to the container, we executed a command inside the running openclaw container:

Command:

exec "env | grep SPAWN_ALLOWLIST" Output:

SPAWN_ALLOWLIST=* This proves that the variable is present and correctly set within the agent's environment, but the permission service responsible for authorizing sessions_spawn is not reading or respecting it.

Relevant docker-compose.yml Snippet services: openclaw: image: 'coollabsio/openclaw:2026.2.6' environment: # ... other variables - 'AGENTS=[{"id":"basic-agent","label":"Basic Agent","description":"A generic agent for simple tasks.","model":"google/gemini-2.5-pro","systemPrompt":"You are a sub-agent. Be concise and efficient."}]' - 'SPAWN_ALLOWLIST=*' volumes: - 'openclaw-data:/data' # ... rest of the service definition La publication de ce rapport est notre meilleur

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response