openclaw - 💡(How to fix) Fix [Bug]: tools.exec.ask=off and exec-approvals.json defaults ignored — approval popups cannot be disabled [5 comments, 5 participants]

Bug type

Behavior bug (regression from recent updates)

Summary

Prior to recent updates, exec commands ran without approval popups for local single-user gateway setups. After updating, the approval popup system activates on every exec command and cannot be disabled despite setting `tools.exec.ask=off` globally and per-agent, and setting `defaults.ask=off` + `agents.*.ask=off` in `exec-approvals.json`.

The popup always shows `Security: allowlist` and `Ask: on-miss` regardless of config, indicating the runtime is not reading the configured values.

Steps to reproduce

1. Single-user local gateway setup (macOS, LaunchAgent)
2. Set `tools.exec.ask = "off"` via `openclaw config set tools.exec.ask off`
3. Set per-agent `tools.exec.ask = "off"` and `tools.exec.host = "gateway"`
4. Set `defaults.ask = "off"` and `agents.*.ask = "off"` in `~/.openclaw/exec-approvals.json`
5. Restart gateway
6. Agent (Arthur, id: main) attempts any exec command (e.g. `/Users/greg/clawd/.venv/bin/python script.py`)
7. Approval popup appears every time — never skipped

Expected behavior

With `ask=off` set at both global and per-agent level, exec commands should run without any approval prompt. This worked correctly before recent updates to the exec approval system.

Actual behavior

Every exec command triggers an approval popup. Clicking "Always allow" registers the entry but the popup reappears on the next gateway restart. Cron-triggered agents cannot self-approve, making all scheduled exec tasks completely broken.

The popup shows:

• Security: `allowlist`
• Ask: `on-miss`

...regardless of configuration.

Environment

• Version: 2026.4.1
• Platform: macOS (LaunchAgent gateway)
• Agent sandbox: `workspaceRoot` + `workspaceAccess: rw`
• `tools.exec.host = "gateway"` set globally and per-agent

Impact

This regression makes all cron-triggered exec commands non-functional in single-user private setups where approval popups are inappropriate. The feature worked before the exec approval system was introduced/changed.