Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix Feature Request: User approval gate for config.patch beyond allowlist [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#73901•Fetched 2026-04-29 06:13:31
View on GitHub
Comments
1
Participants
2
Timeline
1
Reactions
0
Author
RoseKongPSRoseKongPS
Participants
clawsweeper[bot]clawsweeper[bot]RoseKongPSRoseKongPS
Timeline (top)
commented ×1

Currently, gateway config.patch enforces a strict allowlist (ALLOWED_GATEWAY_CONFIG_PATHS) that only permits changes to low-risk paths (agent model/thinking/prompt, channel requireMention). This was introduced in v2026.4.20 as a fix for GHSA-7jm2-g593-4qrc.

Problem: The allowlist is too narrow for legitimate operator workflows. Plugin configurations, memory settings (e.g., LCM thresholds, Dreaming phases), and other non-critical-but-frequently-adjusted settings cannot be modified via config.patch. Operators are forced to directly edit openclaw.json + restart, which:

  1. Requires manual approval for every change (exec inline keyboard)
  2. Requires a full gateway restart (vs. hot-reload)
  3. Is error-prone for nested JSON editing

Meanwhile, exec (which can run arbitrary shell commands) already has a robust user approval flow via inline keyboard confirmation in Telegram/Discord. The security boundary is already at the operator confirmation layer, not at the path allowlist layer.

Error Message

  1. Is error-prone for nested JSON editing

Root Cause

  • The current design assumes config.patch is low-risk because it only modifies config — but so does exec sed -i openclaw.json, which already goes through approval
  • Moving the security boundary from "allowlist restriction" to "operator confirmation" is strictly more flexible without being less secure
  • Operators who prefer the current behavior can keep the default (reject non-allowlisted paths)

Fix Action

Fix / Workaround

Currently, gateway config.patch enforces a strict allowlist (ALLOWED_GATEWAY_CONFIG_PATHS) that only permits changes to low-risk paths (agent model/thinking/prompt, channel requireMention). This was introduced in v2026.4.20 as a fix for GHSA-7jm2-g593-4qrc.

Problem: The allowlist is too narrow for legitimate operator workflows. Plugin configurations, memory settings (e.g., LCM thresholds, Dreaming phases), and other non-critical-but-frequently-adjusted settings cannot be modified via config.patch. Operators are forced to directly edit openclaw.json + restart, which:

Add an optional operator approval gate for config.patch that applies when the target path is outside the current allowlist:

RAW_BUFFERClick to expand / collapse

Summary

Currently, gateway config.patch enforces a strict allowlist (ALLOWED_GATEWAY_CONFIG_PATHS) that only permits changes to low-risk paths (agent model/thinking/prompt, channel requireMention). This was introduced in v2026.4.20 as a fix for GHSA-7jm2-g593-4qrc.

Problem: The allowlist is too narrow for legitimate operator workflows. Plugin configurations, memory settings (e.g., LCM thresholds, Dreaming phases), and other non-critical-but-frequently-adjusted settings cannot be modified via config.patch. Operators are forced to directly edit openclaw.json + restart, which:

  1. Requires manual approval for every change (exec inline keyboard)
  2. Requires a full gateway restart (vs. hot-reload)
  3. Is error-prone for nested JSON editing

Meanwhile, exec (which can run arbitrary shell commands) already has a robust user approval flow via inline keyboard confirmation in Telegram/Discord. The security boundary is already at the operator confirmation layer, not at the path allowlist layer.

Proposal

Add an optional operator approval gate for config.patch that applies when the target path is outside the current allowlist:

  1. When config.patch targets a non-allowlisted path, instead of silently rejecting, prompt the operator for approval (similar to exec approval flow in chat channels)
  2. If approved, apply the patch and hot-reload
  3. If the operator has explicitly configured an expanded allowlist (e.g., gateway.configPatchAllowlist), skip the approval prompt for those paths

This preserves the security model (human-in-the-loop for sensitive changes) while dramatically improving the operator experience.

Rationale

  • The current design assumes config.patch is low-risk because it only modifies config — but so does exec sed -i openclaw.json, which already goes through approval
  • Moving the security boundary from "allowlist restriction" to "operator confirmation" is strictly more flexible without being less secure
  • Operators who prefer the current behavior can keep the default (reject non-allowlisted paths)

Environment

  • OpenClaw: v2026.4.23 (locked, skipped v4.24 due to regressions)
  • Channel: Telegram with inline keyboard approval enabled

extent analysis

TL;DR

Implement an optional operator approval gate for config.patch to allow changes outside the current allowlist, enhancing flexibility while maintaining security.

Guidance

  • Introduce a new configuration option, such as gateway.configPatchAllowlist, to enable operators to specify paths that should bypass the approval prompt.
  • Modify the config.patch command to prompt operators for approval when targeting non-allowlisted paths, utilizing a similar approval flow to exec commands.
  • Update the config.patch logic to apply the patch and hot-reload if approved, or reject the change if denied.
  • Consider adding a default expanded allowlist for common use cases, such as plugin configurations and memory settings, to simplify the operator experience.

Example

// Example openclaw.json configuration with expanded allowlist
{
  "gateway": {
    "configPatchAllowlist": [
      "/plugin/config",
      "/memory/lcm/thresholds",
      "/memory/dreaming/phases"
    ]
  }
}

Notes

The proposed solution relies on the existing operator confirmation layer, which is already used for exec commands, to ensure security. This approach allows for more flexibility in managing gateway configurations while maintaining the security boundary.

Recommendation

Apply the workaround by implementing the optional operator approval gate for config.patch, as it provides a more flexible and secure solution for managing gateway configurations.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#prompt formatting#chain error#conversation history#tool integration#LLM response

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix Feature Request: User approval gate for config.patch beyond allowlist [1 comments, 2 participants]