Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

Bug Description

The Control UI Settings/Exec section displays Exec Policy: allowlist even after the user has set tools.exec.security to "full" in openclaw.json. Restarting the gateway does not fix it because the frontend reads from an incorrect (non-existent) config path.

Root Cause

The Control UI frontend reads from agents.defaults.exec.security, but the actual config key that controls exec security policy is tools.exec.security. These are different config paths.
User sets: tools.exec.security = "full" ✅ (takes effect immediately)
UI reads: agents.defaults.exec.security ❌ (path doesn't exist, falls back to default "allowlist")

Expected Behavior

UI should read from tools.exec.security and display the correct value (full).

Actual Config (verified working via CLI):

$ openclaw config get tools.exec.security
full

Config file path: ~/.openclaw/openclaw.json

Proposed Fix

Update the Control UI settings component to read tools.exec.security instead of agents.defaults.exec.security.

Steps to reproduce

1. Edit ~/.openclaw/openclaw.json and add "tools": { "exec": { "security": "full", "ask": "off" } }
2. Open Control UI Settings page
3. Observe that Exec Policy still shows allowlist

Expected behavior

NOT_ENOUGH_INFO

Actual behavior

NOT_ENOUGH_INFO

OpenClaw version

2026.5.4

Operating system

macOS 15.7.5

Install method

No response

Model

Qwen3.6-35B-A3B

Provider / routing chain

openclaw -> newapi -> Qwen3.6-35B-A3B

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response