openclaw - 💡(How to fix) Fix tools.exec.safeBins not inherited by isolated cron/heartbeat sessions [1 participants]

Bug Description

tools.exec.safeBins configured at the global level (tools.exec.safeBins) or per-agent level (agents[].tools.exec.safeBins) is not propagated to isolated sessions spawned by cron jobs or heartbeat polls (when isolatedSession: true).

Commands that should bypass approval via safeBins still trigger the approval flow in isolated cron sessions, where no human is present to approve — causing them to hang or silently fail.

Reproduction

1. Configure tools.exec.safeBins in openclaw.json:

{
  "tools": {
    "exec": {
      "security": "allowlist",
      "ask": "on-miss",
      "safeBins": ["ls", "cat", "grep", "brew", "npm", "gh", "qmd"]
    }
  }
}

1. Create a cron job for any agent that uses exec commands with one of the safeBins:

{
  "cron": [
    {
      "schedule": "0 8 * * *",
      "agent": "main",
      "task": "Check system status",
      "model": "anthropic/claude-sonnet-4-20250514",
      "isolated": true
    }
  ]
}

1. When the cron fires and the agent runs exec with a safeBin command (e.g., ls, gh issue list), the command hits the approval flow instead of being auto-approved.

Expected Behavior

Isolated cron/heartbeat sessions should inherit the full tools.exec config from their resolved agent config, including:

• safeBins
• safeBinProfiles
• safeBinTrustedDirs
• strictInlineEval

These properties are already correctly propagated in regular (non-isolated) sessions.

Actual Behavior

The isolated session constructs its ExecToolDefaults without merging safeBins (and related properties) from the resolved agent/global config. The processGatewayAllowlist() function receives an empty safeBins set, so all exec commands require explicit approval.

Environment

• OpenClaw version: v2026.4.2
• OS: macOS 26.3 (Apple Silicon)
• Channel: Telegram (exec approvals enabled)

Related Issues

This appears to be part of a broader pattern where isolated cron sessions do not fully inherit their parent agent config:

• #58542 — LiveSessionModelSwitchError in isolated cron jobs
• #58568 — isolated cron sessions inherit parent agent's model override
• #56572 — Isolated cron run sessions never transition to 'done'

Willingness to Contribute

I would like to contribute a fix for this. The likely location is wherever isolated sessions assemble their ExecToolDefaults — the same code path that already copies security, ask, and host should also copy safeBins, safeBinProfiles, safeBinTrustedDirs, and strictInlineEval.

🤖 This issue was drafted with AI assistance (OpenClaw + Claude). The bug was discovered and verified through real-world cron job usage.