openclaw - 💡(How to fix) Fix No config path enables exec for agents in isolated sessions — sandbox blocks before exec-approvals [2 comments, 1 participants]

Summary

In OpenClaw 2026.3.31 (213a704), there is no configuration path that enables exec for agents running in isolated sessions. The sandbox policy blocks exec before exec-approvals.json is even consulted, and the elevated escape hatch doesn't work because isolated sessions report channel: (unknown), which no allowFrom entry can match.

This affects any agent that needs to run shell commands autonomously — trading bots, monitoring agents, CI/CD pipelines. Our agent Maverick (a trading bot running 5-min governor heartbeats with Python script exec) is completely blocked from executing its governor scripts after upgrading to 2026.3.31.

Steps to Reproduce

1. Configure an agent (e.g., Maverick) with heartbeat.every: "5m" and governor scripts that require exec
2. Set heartbeat.target: "discord" — exec is denied: exec denied: allowlist miss (Discord exec gate)
3. Set heartbeat.target: "isolated" — config validation fails: unknown heartbeat target: isolated
4. Remove target entirely — heartbeat skipped with reason: "target-none"
5. Create a cron workaround with sessionTarget: "isolated" — job fires successfully, but exec is still denied inside the agent turn:

   Heartbeat tick not run: exec denied by sandbox policy (allowlist miss); mode/MTM/actions unavailable.

Full Configuration Attempted (Exhaustive)

Every combination below was tested with a gateway restart after each change. None enabled exec.

1. exec-approvals.json

Maverick configured with security: "full" + ask: "off" — should be unrestricted ("YOLO mode") per docs. Result: Still blocked. Sandbox denies exec before exec-approvals is consulted.

2. openclaw.json — agent-level tools

elevated.enabled: true on Maverick's agent config. Result: Still blocked.

3. openclaw.json — global tools

{
  "tools": {
    "elevated": {
      "enabled": true,
      "allowFrom": {
        "discord": ["*"],
        "isolated": ["*"]
      }
    }
  }
}

Result: Still blocked.

4. Cron with sessionTarget: "isolated"

openclaw cron add \
  --agent maverick \
  --name "maverick-governor-heartbeat-5min" \
  --cron "*/5 9-16 * * 1-5" \
  --tz "America/New_York" \
  --session isolated \
  --exact \
  --message "Run governor heartbeat tick..." \
  --announce --to <discord-channel-id> --channel discord

Cron job fires (status: ok, delivered to Discord), but exec is denied inside the agent turn.

5. openclaw sandbox explain

$ openclaw sandbox explain --agent maverick

Elevated:
  enabled: true
  channel: (unknown)
  allowedByConfig: false

allowedByConfig is always false regardless of configuration. The channel: (unknown) for isolated sessions means no allowFrom entry ever matches — the channel resolution runs before the allowlist lookup, and isolated sessions have no channel identity to resolve.

Root Cause Analysis

The exec authorization chain is:

1. Sandbox policy checks elevated.enabled + allowFrom[channel]
2. If sandbox allows → exec-approvals.json checks agent-level permissions
3. If exec-approvals allows → exec runs

The bug is in step 1: isolated sessions set channel: (unknown), and the allowFrom matcher has no way to match an unknown channel. So the sandbox always blocks exec for isolated sessions, regardless of what's configured in exec-approvals.json or openclaw.json.

This is a regression — prior to 2026.3.31, agents could exec in their heartbeat loops without issue.

Impact

• Any agent requiring autonomous shell exec (trading bots, monitoring, CI/CD) is broken after upgrading to 2026.3.31
• No workaround exists within the OpenClaw config system
• The only remaining path is using Claude Code with dangerouslyDisableSandbox, which defeats the purpose of the sandbox entirely

Proposed Fix

Either (or both):

1. Allow "isolated" as a heartbeat.target and ensure the sandbox allowFrom matcher recognizes "isolated" as a valid channel — heartbeats that need exec should be able to use isolated sessions just like crons
2. Register isolated sessions with a known channel identity (e.g., channel: "isolated") instead of (unknown), so allowFrom.isolated entries can match
3. Decouple exec approval from channel transport — if an agent has security: "full" in exec-approvals.json, the sandbox should respect that regardless of channel origin

Environment

• OpenClaw: 2026.3.31 (213a704)
• OS: macOS Darwin 25.3.0
• Agent: Maverick — trading bot running 5-min governor heartbeats with Python script exec