Problem

When an exec approval is triggered for a compound command starting with a shell builtin (e.g. cd deer-flow && ls), the user receives a standard approval prompt. Choosing allow-always returns ✅ Exec approval allowed always, but no pattern is actually persisted to the allowlist.

On the next attempt to run the same (or similar) command, the agent is blocked again and requests approval for the same command that was already "always allowed".

Root cause

allow-always resolves the approved binary's path (e.g. /usr/bin/ls → pattern /usr/bin/ls) and adds it to exec-approvals.json. But cd is a shell builtin — it has no resolved path. The allowlist entry is never created, yet the user receives a success confirmation.

Steps to reproduce

1. Agent runs a compound command: cd some-dir && ls
2. Approval notification appears (because cd doesn't match any allowlist pattern)
3. User replies: /approve <id> allow-always
4. System responds: ✅ Exec approval allowed always
5. Agent retries the same command → blocked again, requests approval
6. Check exec-approvals.json — no new entry was added

Expected behavior

Either:

• Persist a pattern that covers the builtin (e.g. allow the compound command), or
• Return an error/warning: "Cannot add shell builtin cd to allowlist. Use allow-once instead."

The current silent success + no persistence is misleading.

Environment

• OpenClaw 2026.3.2
• Ubuntu Linux 6.8.0-100-generic
• Channel: Telegram