openclaw - 💡(How to fix) Fix exec preflight blocks legitimate interpreter+pipe commands even when exec.security is "full"

Summary

The exec preflight in bash-tools-*.js (v2026.5.26) refuses any command where an interpreter invocation (python/node) is combined with "complex syntax" (pipes, &&, ;, redirects), with the message:

exec preflight: complex interpreter invocation detected; refusing to run without script preflight validation. Use a direct python <file>.py or node <file>.js command.

This fires before exec policy is consulted — so even with tools.exec.security: "full" the command is still blocked. I can't find a config flag to relax it.

Reproduction

A bot whose openclaw.json has tools.exec.security: "full" runs:

python3 some_script.py | head -30

Result: blocked by the preflight.

The script is in the bot's own workspace, has no special privilege, and runs fine when invoked without the pipe. The operator has already declared exec.security: "full", which I'd expect to opt out of additional gating.

Impact

For an autonomous agent that runs its own scripts and wants to bound output size, the workarounds are unfriendly:

1. Edit the script each time to limit its own output, or
2. Have the script write to a temp file and read it back via the file-read tool (two tool calls plus disk churn instead of one exec).

The preflight surfaces frequently enough in our gateway logs to be real friction.

Suggestion

Pick one of:

• Honor tools.exec.security: "full" as an override — the operator has already declared "this agent can exec arbitrary things".
• Add an opt-out knob like tools.exec.preflight: "off" (per-agent) so operators who've made the policy call can act on it.
• Tighten the heuristic. The rule appears aimed at python -c "..." style inline-code injection, but it also catches python file.py | head -N and node file.js > out.json, which are common benign patterns. Flagging only -c inline-code or process-substitution would catch the attack shape without the false-positive cost.

Environment

• openclaw v2026.5.26
• Node 22.x
• macOS

Code pointer

dist/bash-tools-*.js, shouldFailClosedInterpreterPreflight. The check is:

hasInterpreterInvocation && hasComplexSyntax && (
  hasInterpreterSegmentScriptHint
  || hasInterpreterPipelineScriptHint
  || (hasProcessSubstitution && isDirectInterpreterCommand)
)