Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Elevated exec still flaps after PR #74666 (v2026.4.29) [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#75832•Fetched 2026-05-02 05:29:22
View on GitHub
Comments
1
Participants
2
Timeline
1
Reactions
2
Author
jameyedwardsjameyedwards
Participants
clawsweeper[bot]clawsweeper[bot]jameyedwardsjameyedwards
Timeline (top)
commented ×1

Elevated exec permissions drop after the first approved command completes in the same assistant turn. PR #74666 ("preserve turnSourceChannel as messageProvider in approval followup runs") was expected to fix this, but the issue persists on v2026.4.29 (a448042).

Error Message

  1. Actual: Error returned immediately:
  • Subsequent elevated commands in the same turn fail with the "not available" error
  • The error claims tools.elevated.enabled is the failing gate, but elevated is configured as on

Root Cause

Elevated exec permissions drop after the first approved command completes in the same assistant turn. PR #74666 ("preserve turnSourceChannel as messageProvider in approval followup runs") was expected to fix this, but the issue persists on v2026.4.29 (a448042).

Fix Action

Workaround

Have the user send a new message between each elevated command, or ask the user to run commands manually.

Code Example

elevated is not available right now (runtime=sandboxed).
Failing gates: enabled (tools.elevated.enabled / agents.list[].tools.elevated.enabled)
Context: provider=telegram session=agent:main:telegram:direct:<chat_id>
RAW_BUFFERClick to expand / collapse

Summary

Elevated exec permissions drop after the first approved command completes in the same assistant turn. PR #74666 ("preserve turnSourceChannel as messageProvider in approval followup runs") was expected to fix this, but the issue persists on v2026.4.29 (a448042).

Environment

  • OpenClaw version: 2026.4.29 (a448042)
  • OS: Ubuntu Linux 6.8.0-110-generic (x64)
  • Node: v22.22.1
  • Channel: Telegram (direct chat)
  • Runtime: docker/non-main (sandboxed agent)
  • Elevated level: on (ask mode — requires per-command approval)

Repro Steps

  1. Agent sends an elevated exec command (e.g., echo "test" with elevated: true)
  2. User approves via /approve <id> allow-once
  3. Command completes successfully
  4. Agent sends a second elevated exec command in the same turn
  5. Expected: Approval prompt appears again
  6. Actual: Error returned immediately:
elevated is not available right now (runtime=sandboxed).
Failing gates: enabled (tools.elevated.enabled / agents.list[].tools.elevated.enabled)
Context: provider=telegram session=agent:main:telegram:direct:<chat_id>

Key Observations

  • The first elevated command in a turn always works (approval flow is correct)
  • Subsequent elevated commands in the same turn fail with the "not available" error
  • The error claims tools.elevated.enabled is the failing gate, but elevated is configured as on
  • After the user sends a new message (new turn), elevated works again for one command
  • This is 100% reproducible — happens every time, not intermittent
  • Non-elevated exec commands work fine throughout

Workaround

Have the user send a new message between each elevated command, or ask the user to run commands manually.

Related

  • PR #74666 — partial fix for turnSourceChannel preservation
  • Original bug report filed by this deployment (elevated flapping, April 2026)

extent analysis

TL;DR

The issue can be temporarily worked around by having the user send a new message between each elevated command, which resets the elevated permissions.

Guidance

  • Verify that the tools.elevated.enabled configuration is indeed set to on and not overridden anywhere else in the configuration.
  • Check the approval flow for subsequent commands in the same turn to see if the turnSourceChannel is being preserved correctly, as intended by PR #74666.
  • Test if the issue persists when running the agent in a non-sandboxed environment to isolate if the issue is related to the sandboxed runtime.
  • Review the code changes in PR #74666 to ensure that the fix was correctly implemented and did not introduce any new issues.

Example

No code snippet is provided as the issue does not explicitly mention a specific code section that needs modification.

Notes

The issue seems to be related to the preservation of elevated permissions across commands in the same turn, which was attempted to be fixed by PR #74666. However, the root cause of the issue is still unclear, and further investigation is needed.

Recommendation

Apply the workaround of having the user send a new message between each elevated command, as this is the most straightforward way to reset the elevated permissions and avoid the error.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#retrieval issue#search optimization#API routing#API middleware#SSR setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix Elevated exec still flaps after PR #74666 (v2026.4.29) [1 comments, 2 participants]