openclaw - 💡(How to fix) Fix [Feature]: exec allowlist should support argument-level pattern matching, not just binary path [1 participants]

Summary

Allow exec allowlist entries to match against the full command (binary + arguments), so a restricted agent can be granted access to one specific script invocation without unlocking the entire interpreter.

Problem to solve

Currently, exec-approvals.json allowlist entries only match against the binary path. If I want a restricted agent (e.g. a group chat agent with minimal permissions) to run one specific Node.js script for moderation, I must either:

1. Deny exec entirely — the agent can't automate anything
2. Allowlist the node binary — the agent can run any Node.js code

There is no middle ground. This makes it impossible to safely delegate a narrow, script-level capability to a restricted agent.

Proposed solution

Extend the allowlist entry schema with an optional argsPattern field (glob-style) that is matched against the argv following the binary:

{
  "id": "...",
  "pattern": "/opt/homebrew/bin/node",
  "argsPattern": "/Users/me/.openclaw/mute_user.mjs * *",
  "description": "Allow mute_user.mjs moderation script only"
}

An entry with argsPattern would only match if both the binary path AND the argument pattern match, providing script-level authorization.

Alternatives considered

• Wrapping the script in a standalone binary (shell wrapper or compiled executable) so the allowlist can target it directly — works but adds operational complexity and breaks auditability. • Using a webhook/HTTP endpoint instead of exec — requires running an additional local service.

Impact

• Affected: Operators running restricted agents (group chat bots, low-trust contexts) • Severity: Blocks workflow — forces a choice between "no automation" and "unsafe broad access" • Frequency: Every time a restricted agent needs to call a single trusted script • Consequence: Either capability is lost or security is compromised

Evidence/examples

Exact use case: a Telegram group agent that should only be able to call node mute_user.mjs <chat_id> <user_id> to mute abusive users — but must not be able to run arbitrary Node.js code.

Additional information

No response