PR #62401: fix(exec): align node shell allowlist wrappers

• Repository: openclaw/openclaw
• Author: ngutman
• State: closed | merged: True
• Link: https://github.com/openclaw/openclaw/pull/62401

Description (problem / solution / changelog)

Summary

• Problem: host=node POSIX exec runs were wrapped in /bin/sh -lc ..., but node-host policy still treated shell wrappers as approval-required even when inner allowlist analysis succeeded.
• Why it matters: tools.exec.security=allowlist + ask=on-miss became unusable for allowlisted node scripts and kept prompting for approval.
• What changed: node-host now keeps POSIX shell-wrapper decisions tied to existing inner-shell allowlist analysis, while Windows cmd.exe /c wrapper detection still stays approval-gated.
• What did NOT change (scope boundary): env-binding checks, approval replay binding, line-continuation fail-closed behavior, strict inline-eval protections, and Windows wrapper approval posture.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #61509
• Related #58792
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: node exec precheck evaluated the original shell payload, but node-host runtime policy later blanket-blocked shell wrappers in allowlist mode and overrode successful inner-command allowlist analysis.
• Missing detection / guardrail: there was no regression test covering an allowlisted inner POSIX script executed through the transport wrapper, and no end-to-end test protecting Windows wrapper detection after the policy change.
• Contributing context (if known): node transport intentionally uses shell wrappers (/bin/sh -lc on POSIX, cmd.exe /d /s /c on Windows), so policy must distinguish transport wrappers from the analyzed inner command payload.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: src/node-host/invoke-system-run.test.ts
• Scenario the test should lock in: allowlisted POSIX inner scripts auto-run through /bin/sh -lc, while Windows cmd.exe transport wrappers still require approval.
• Why this is the smallest reliable guardrail: the regression lived in the parse -> policy -> execution wiring, not just pure allowlist analysis.
• Existing test that already covers this (if any): src/node-host/exec-policy.test.ts keeps Windows-specific guidance covered at the policy layer.
• If no new test is added, why not: N/A

User-visible / Behavior Changes

• host=node allowlisted POSIX shell-wrapper commands no longer prompt unnecessarily when the inner command satisfies the allowlist.
• Windows cmd.exe /c transport wrappers remain approval-gated.

Diagram (if applicable)

Before:
allowlisted inner script -> /bin/sh -lc wrapper -> node policy forces approval -> denied/prompted

After:
allowlisted inner script -> /bin/sh -lc wrapper -> inner payload allowlist passes -> runs

Windows remains:
allowlisted inner command -> cmd.exe /d /s /c wrapper -> approval required

Security Impact (required)

• New permissions/capabilities? (Yes/No) No
• Secrets/tokens handling changed? (Yes/No) No
• New/changed network calls? (Yes/No) No
• Command/tool execution surface changed? (Yes/No) Yes
• Data access scope changed? (Yes/No) No
• If any Yes, explain risk + mitigation:
  • The node-host allowlist decision for POSIX transport wrappers now follows the existing inner-shell allowlist analysis instead of a blanket wrapper block. Risk is unintended policy widening; mitigation is preserving existing fail-closed shell parsing/binding rules, keeping Windows cmd.exe wrappers approval-gated, and adding regression coverage for both paths.

Repro + Verification

Environment

• OS: macOS 26.3.1 (host), simulated Windows path in test via process.platform spy
• Runtime/container: local repo test harness
• Model/provider: N/A
• Integration/channel (if any): node exec path
• Relevant config (redacted): tools.exec.security=allowlist, tools.exec.ask=on-miss, tools.exec.host=node

Steps

1. Allowlist a node script path.
2. Execute it via the node transport wrapper (/bin/sh -lc ...).
3. Observe approval behavior before and after the fix.

Expected

• POSIX allowlisted inner scripts should run without prompting.
• Windows cmd.exe wrappers should still require approval.

Actual

• Before: POSIX wrapped scripts still returned SYSTEM_RUN_DENIED: approval required.
• After: POSIX wrapped scripts execute; Windows wrapper path remains approval-gated.

Evidence

Attach at least one:

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Human Verification (required)

• Verified scenarios: manually reproduced the reported POSIX host=node wrapper failure with a temp allowlisted script before the fix, reran the same repro after the fix and confirmed execution succeeds without an approval event.
• Edge cases checked: Windows cmd.exe transport wrappers still require approval in the seam test; targeted node/gateway approval tests still pass.
• What you did not verify: real Windows host execution on a Windows machine.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? (Yes/No) Yes
• Config/env changes? (Yes/No) No
• Migration needed? (Yes/No) No
• If yes, exact upgrade steps: N/A

Risks and Mitigations

• Risk: wrapper detection could drift again between parse-time analysis and runtime policy.
  • Mitigation: added seam coverage for both POSIX transport wrappers and Windows cmd.exe wrappers.

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/node-host/exec-policy.test.ts (modified, +5/-4)
• src/node-host/exec-policy.ts (modified, +9/-2)
• src/node-host/invoke-system-run.test.ts (modified, +89/-1)
• src/node-host/invoke-system-run.ts (modified, +6/-10)