Bug type

Regression (worked before, now fails)

Summary

Since updating to 2026.3.2, all nodes.run (system.run) commands fail with:INVALID_REQUEST: rawCommand does not match commandEvery command is affected — even echo hello. Both simple commands (["echo", "hello"]) and bash-wrapped commands (["bash", "-c", "echo hello"]) fail.Root Cause
The security fix for GHSA-h3f9-mjwj-w476 added rawCommand/command[] consistency validation. The nodes tool (or gateway forwarding layer) generates rawCommand and command[] that don't pass this new validation.SetupExpected: Commands execute normally (especially with security=full)
Actual: All commands rejected with rawCommand mismatch

Steps to reproduce

1. Update gateway and node (macOS companion app) to 2026.3.2
2. Confirm node is paired and connected (nodes status shows connected: true)
3. From an agent session, run any command via nodes.run, e.g. ["echo", "hello"]
4. Observe INVALID_REQUEST: rawCommand does not match command error
5. Same commands worked on 2026.2.26

Expected behavior

All nodes.run (system.run) commands execute normally on paired nodes, as they did on 2026.2.26.

Actual behavior

Every nodes.run command fails immediately with:

  INVALID_REQUEST: rawCommand does not match command

No command reaches the node for execution. Affects all commands including trivial ones like echo hello. Both ["echo", "hello"] and ["bash", "-c", "echo hello"] fail. Node exec-approvals are set to security=full, ask=off, askFallback=full.

OpenClaw version

2026.3.2

Operating system

macOS 15 (both gateway on Mac Mini M4 and node on MacBook Pro, Apple Silicon)

Install method

npm (Homebrew Node)

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response