PR #62078: fix: this is a real approval boundary bypass that tur (#323)

• Repository: openclaw/openclaw
• Author: drobison00
• State: closed | merged: True
• Link: https://github.com/openclaw/openclaw/pull/62078

Description (problem / solution / changelog)

Summary

• Problem: timed-out exec approval requests could still proceed on gateway or node hosts when strictInlineEval required explicit approval for inline interpreter execution.
• Why it matters: operators enabling strictInlineEval expect timeout fallback to keep those commands blocked instead of silently turning a missed approval into execution.
• What changed: the shared exec-host approval flow now fails closed for timed-out strictInlineEval requests, and gateway/node host tests lock in the timeout paths that used to proceed.
• What did NOT change (scope boundary): this does not change normal explicit allow-once / allow-always approvals, broader exec policy defaults, or node-side system.run policy behavior outside the host timeout path.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #323
• Related #
• This PR fixes a bug or regression

Root Cause / Regression History (if applicable)

• Root cause: host-side timeout fallback treated a timed-out approval as execution permission before the strict inline-eval requirement was re-applied.
• Missing detection / guardrail: there was no final host-side check that "timed out" is not equivalent to an explicit operator approval for inline interpreter forms.
• Prior context (git blame, prior PR, issue, or refactor if known): the node-side system.run guard already handled missing approval, but the gateway and node host approval paths still converted timeout fallback into approvedByAsk: true / allow-once.
• Why this regressed now: strict inline-eval approval was enforced earlier in the request flow, but timeout fallback stayed generic and did not re-check that stricter requirement at the last host decision point.
• If unknown, what was ruled out: N/A

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: src/agents/bash-tools.exec-host-shared.test.ts, src/agents/bash-tools.exec-host-gateway.test.ts, src/agents/bash-tools.exec-host-node.test.ts
• Scenario the test should lock in: timed-out approval fallback must not execute strictInlineEval commands on gateway or node hosts, including the gateway askFallback: "allowlist" timeout path.
• Why this is the smallest reliable guardrail: the bug lives in the host approval boundary, so the closest reliable seam is the shared approval helper plus the mocked gateway/node host flows that decide whether execution proceeds.
• Existing test that already covers this (if any): node-side invoke-system-run tests already covered explicit inline-eval approval behavior after the host decision is made.
• If no new test is added, why not: N/A

User-visible / Behavior Changes

• strictInlineEval commands now stay blocked when the approval request times out on gateway or node exec hosts, even if timeout fallback would otherwise auto-approve the request.

Security Impact (required)

• New permissions/capabilities? (Yes/No) No
• Secrets/tokens handling changed? (Yes/No) No
• New/changed network calls? (Yes/No) No
• Command/tool execution surface changed? (Yes/No) Yes
• Data access scope changed? (Yes/No) No
• If any Yes, explain risk + mitigation: command execution now fails closed for timed-out inline-eval approval requests; explicit approvals still work as before, and focused tests cover the gateway and node timeout paths.

Repro + Verification

Environment

• OS: Linux
• Runtime/container: local worktree runtime
• Model/provider: N/A
• Integration/channel (if any): N/A
• Relevant config (redacted): exec approvals with strictInlineEval: true

Steps

1. Configure exec approvals so inline interpreter forms require explicit approval.
2. Trigger a gateway or node exec request that uses an inline interpreter form such as python3 -c ....
3. Let the approval request time out without an explicit operator decision.

Expected

• The command remains blocked and the follow-up reports an approval timeout.

Actual

• Before this change, timeout fallback could be converted into execution permission on gateway and node hosts.

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

• Verified scenarios: shared host timeout enforcement, gateway async timeout denial, gateway allowlist-timeout denial, and node async timeout denial via focused Vitest coverage.
• Edge cases checked: explicit approvals remain allowed by keeping the shared helper limited to timed-out fallback cases only.
• What you did not verify: full repo-wide build and end-to-end approval flows; the service-managed pnpm build remains post-turn validation.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

Compatibility / Migration

• Backward compatible? (Yes/No) Yes
• Config/env changes? (Yes/No) No
• Migration needed? (Yes/No) No
• If yes, exact upgrade steps:

Failure Recovery (if this breaks)

• How to disable/revert this change quickly: revert the host approval-boundary helper and its gateway/node call sites.
• Files/config to restore: src/agents/bash-tools.exec-host-shared.ts, src/agents/bash-tools.exec-host-gateway.ts, src/agents/bash-tools.exec-host-node.ts
• Known bad symptoms reviewers should watch for: timed-out inline-eval approvals still executing, or explicit inline-eval approvals being denied unexpectedly.

Risks and Mitigations

• Risk: host timeout denial could accidentally block explicit inline-eval approvals.
  • Mitigation: the shared helper only changes timed-out fallback cases, and the focused tests keep explicit approvals out of the deny path.

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/agents/bash-tools.exec-host-gateway.test.ts (modified, +128/-9)
• src/agents/bash-tools.exec-host-gateway.ts (modified, +16/-2)
• src/agents/bash-tools.exec-host-node.test.ts (modified, +58/-2)
• src/agents/bash-tools.exec-host-node.ts (modified, +23/-6)
• src/agents/bash-tools.exec-host-shared.test.ts (modified, +32/-0)
• src/agents/bash-tools.exec-host-shared.ts (modified, +27/-0)