openclaw - 💡(How to fix) Fix exec: chicken-and-egg problem when configuring approval policy [1 participants]

Problem

When trying to configure OpenClaw to run exec commands without requiring approval every time, there is a chicken-and-egg problem:

• Running openclaw config set tools.exec.ask "off" itself requires exec approval
• Running openclaw config set tools.exec.security "full" also requires exec approval
• There is no way to configure this from the agent side without already having prior approved exec access

Steps to reproduce

1. Start with default OpenClaw config
2. Agent tries to run shell commands via exec tool
3. Every command requires /approve <id> allow-once|allow-always|deny
4. Agent tries to fix this by running openclaw config set tools.exec.security "full"
5. This command itself also requires approval — circular dependency

Expected behavior

One of:

• openclaw config set should be exempt from exec approval (it's a config change, not an arbitrary shell command)
• Provide a way to set exec policy via direct config file edit that is documented clearly
• Or the docs should explain how to bootstrap the allowlist from scratch without needing prior approval

Workaround

User must manually SSH into the server and run config commands in a local terminal. Not ideal for remote/headless setups where the agent is the primary interface.

Environment

• OpenClaw on Linux (Debian, production server)
• Channel: WhatsApp
• Model: anthropic/claude-sonnet-4-6