Fail closed on exec approval timeout by drobison00 · Pull Request #89938 · openclaw/openclaw

drobison00 · 2026-06-03T17:06:51Z

Summary

Problem: Unanswered exec approval requests used the built-in fallback that treated timeout silence as approval.
Why it matters: Operators who enable approval gating expect commands to require a human decision instead of eventually running after no response.
What changed: The default exec approval ask fallback now denies on timeout, and focused unit tests assert the new effective policy and decision behavior.
What did NOT change (scope boundary): Explicit configurations that set a different fallback are still parsed through the existing policy machinery; no workflow, CI, release, or automation files changed.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes #
Related Changelog: drop self-thanks #691
This PR fixes a bug or regression

Root Cause (if applicable)

Root cause: The built-in exec approval ask fallback was full, so a missing approval decision after timeout resolved as approved instead of denied.
Missing detection / guardrail: The effective policy test expected the permissive built-in default, and there was no direct shared-decision test locking in fail-closed timeout behavior for the default path.
Contributing context (if known): The timeout resolver already supports fail-closed behavior when askFallback is deny; the default selected the permissive branch.

Regression Test Plan (if applicable)

Coverage level that should have caught this:
- Unit test
- Seam / integration test
- End-to-end test
- Existing coverage already sufficient
Target test or file: src/agents/bash-tools.exec-host-shared.test.ts, src/infra/exec-approvals-policy.test.ts
Scenario the test should lock in: An omitted approval fallback reports the OpenClaw default as deny, and a null approval decision with fail-closed fallback returns approval-timeout without approval.
Why this is the smallest reliable guardrail: The bug is selected by the shared default and shared decision helper, so unit coverage at those two points catches both policy reporting and execution-path decision semantics.
Existing test that already covers this (if any): Gateway and node approval suites already cover explicit fallback handling and were rerun after the default change.
If no new test is added, why not: N/A.

User-visible / Behavior Changes

Unanswered exec approval requests now deny by default after the configured approval timeout. Operators who intentionally want timeout auto-approval must configure that fallback explicitly.

Diagram (if applicable)

Before:
[approval request] -> [no human decision before timeout] -> [default fallback full] -> [command approved]

After:
[approval request] -> [no human decision before timeout] -> [default fallback deny] -> [command denied]

Security Impact (required)

New permissions/capabilities? No
Secrets/tokens handling changed? No
New/changed network calls? No
Command/tool execution surface changed? Yes
Data access scope changed? No
If any Yes, explain risk + mitigation: Command execution approval timeout behavior now fails closed by default, reducing unattended execution risk. Explicit fallback configuration remains available for operators who deliberately choose it.

Repro + Verification

Environment

OS: Linux 6.8.0-117-generic x86_64
Runtime/container: Node v22.14.0, pnpm 11.2.2; repo warns that Node >=22.19.0 is preferred
Model/provider: N/A
Integration/channel (if any): N/A
Relevant config (redacted): Default exec approval policy with omitted askFallback

Steps

Inspect the built-in exec approval fallback in src/infra/exec-approvals.ts.
Resolve the effective exec approval policy with an approvals file that omits askFallback.
Resolve a base exec approval decision with decision: null and fail-closed fallback.
Run the focused shared, policy, gateway, and node approval test suites.

Expected

The omitted fallback resolves to deny from the OpenClaw default.
A timed-out, unanswered approval resolves to approvedByAsk: false with approval-timeout.
Gateway and node approval tests still pass.

Actual

Matches expected behavior after the fix.

Evidence

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Targeted validation passed:

pnpm test src/agents/bash-tools.exec-host-shared.test.ts src/infra/exec-approvals-policy.test.ts
Test Files 2 passed; Tests 84 passed

pnpm test src/agents/bash-tools.exec-host-gateway.test.ts src/agents/bash-tools.exec-host-node.test.ts
Test Files 2 passed; Tests 64 passed

Human Verification (required)

What you personally verified (not just CI), and how:

Verified scenarios: Default fallback constant is deny; policy summary reports OpenClaw default (deny); shared timeout decision denies with approval-timeout; gateway/node approval suites pass.
Edge cases checked: Existing explicit fallback handling remains covered by the focused gateway/node suites.
What you did not verify: Full repository test suite; runtime manual approval UI flow.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

Compatibility / Migration

Backward compatible? No for deployments that depended on silent timeout auto-approval without explicitly configuring it; yes for operators who already configured their desired fallback.
Config/env changes? No
Migration needed? Yes
If yes, exact upgrade steps: Operators who deliberately want timeout auto-approval should set askFallback explicitly in their exec approvals policy.

Risks and Mitigations

Risk: Unattended workflows that implicitly relied on timeout approval may now stop at approval timeout.
- Mitigation: The safer default matches approval-gating intent; operators can explicitly configure a permissive fallback if they accept that behavior.

clawsweeper · 2026-06-03T17:08:43Z

Codex review: needs maintainer review before merge. Reviewed June 10, 2026, 11:59 AM ET / 15:59 UTC.

Summary
The PR changes the omitted exec-approval timeout fallback from full to deny, updates effective-policy assertions, adds timeout-decision coverage, and documents explicit permissive configuration for unattended hosts.

PR surface: Source 0, Tests +14, Docs +5. Total +19 across 6 files.

Reproducibility: yes. Current main has a high-confidence source path: omitted askFallback resolves to full, and a null approval decision with that fallback returns timeout approval; this review did not execute a live 30-minute approval flow.

Review metrics: 1 noteworthy metric.

Config/default surfaces: 1 default changed, 0 options added, 0 migrations added. The existing askFallback option remains available, but omission changes meaning for upgrades without a machine-applied migration.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Obtain owner approval that the shipped omitted fallback may change and that documentation-only upgrade guidance is sufficient.

Risk before merge

[P2] Existing installations that omit askFallback can change from timeout auto-approval to approval-timeout denial after upgrade, stopping unattended or no-UI exec workflows until operators explicitly configure full.
[P1] The docs explain the required explicit setting, but the PR provides no automatic migration because omission itself currently encodes the shipped permissive behavior; maintainers must decide whether documentation-only upgrade guidance is sufficient.

Maintainer options:

Approve fail-closed as an intentional breaking default (recommended)
Land the coherent patch only after an owner explicitly accepts that previously unattended omitted-config workflows may stop and confirms the documentation is the intended upgrade path.
Preserve the shipped omitted behavior
Keep full as the omitted fallback and use the existing explicit policy and cautious preset paths for operators who want timeout denial.

Next step before merge

[P1] The next action is explicit approval from the exec-approval owners on whether to accept the shipped-default compatibility break; no narrow automated repair remains.

Security
Cleared: The diff reduces unattended command-execution authority and introduces no new dependency, secret, permission, download, workflow, or supply-chain surface.

Review details

Best possible solution:

Adopt one explicit permanent policy: either approve the fail-closed omitted default with prominent upgrade guidance and deliberate compatibility ownership, or preserve the shipped omitted behavior and require security-conscious operators and presets to select askFallback: "deny" explicitly.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main has a high-confidence source path: omitted askFallback resolves to full, and a null approval decision with that fallback returns timeout approval; this review did not execute a live 30-minute approval flow.

Is this the best way to solve the issue?

Unclear pending product judgment. The implementation is the narrowest code change for a fail-closed default, but changing an established shipped default is not automatically the best upgrade policy merely because it is safer.

AGENTS.md: found and applied where relevant.

Codex review notes: reasoning high; reviewed against e24c3df27d28.

Label changes

Label changes:

add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Override: A maintainer applied proof: override for this PR.
remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

P2: This is meaningful command-execution security hardening with limited scope, but it is not an active core outage or demonstrated urgent regression.
merge-risk: 🚨 compatibility: Merging changes a shipped omitted-config default and can halt existing unattended exec workflows after upgrade.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Override: A maintainer applied proof: override for this PR.

Evidence reviewed

PR surface:

Source 0, Tests +14, Docs +5. Total +19 across 6 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	1	1	0
Tests	3	20	6	+14
Docs	2	10	5	+5
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	6	31	12	+19

What I checked:

Current-main behavior: Current main resolves an omitted askFallback through DEFAULT_EXEC_APPROVAL_ASK_FALLBACK = "full", and the shared decision helper treats a null decision with full fallback as approved after timeout. (src/infra/exec-approvals.ts:285, e24c3df27d28)
Complete patch alignment: The current PR head changes the single runtime default and consistently updates CLI reporting, policy tests, shared timeout coverage, and both public approval docs; no unresolved line-level correctness defect remains in the reviewed diff. (src/infra/exec-approvals.ts:285, a9df494150b7)
Shipped compatibility provenance: The permissive default was introduced with the exec-approval effective-policy unification and is present in release tags beginning with v2026.4.2, including latest release v2026.6.5; this is therefore an upgrade-sensitive default change, not correction of an unreleased typo. (src/infra/exec-approvals.ts:285, ba735d015809)
Existing explicit policy path: OpenClaw already supports explicit deny, allowlist, and full fallback values, and the yolo and cautious presets write explicit choices, so the unresolved question is the permanent omitted-value policy rather than a missing configuration mechanism. (src/cli/exec-policy-cli.ts:35, e24c3df27d28)
Repository policy application: The full root and scoped policies were applied: fallback and default changes that can stop existing workflows require compatibility and upgrade review, while docs must state the operator-facing behavior. (AGENTS.md:61, e24c3df27d28)

Likely related people:

@gumadeiras: Introduced the current effective-policy reporting and permissive omitted fallback in the merged exec approvals unification work, making this the strongest history signal for the default contract. (role: feature owner; confidence: high; commits: ba735d015809; files: src/infra/exec-approvals.ts, src/infra/exec-approvals-policy.test.ts, src/cli/exec-approvals-cli.ts)
Vincent Koc: Recent main history carries the current approval implementation and related release state, so this person is a secondary routing candidate for current-tree context; the historical ownership signal is weaker than the unification author. (role: recent area contributor; confidence: low; commits: 5181e4f7c82b; files: src/infra/exec-approvals.ts, src/agents/bash-tools.exec-host-shared.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

* Fail closed on exec approval timeout * Align exec approval fallback default docs

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

Fail closed on exec approval timeout

2bc3d7d

openclaw-barnacle Bot added agents Agent runtime and tooling size: XS maintainer Maintainer-authored PR labels Jun 3, 2026

drobison00 added the proof: override Maintainer override for the external PR real behavior proof gate. label Jun 9, 2026

Merge branch 'main' into exec-approval-timeout-deny

4bcc989

Align exec approval fallback default docs

a9df494

drobison00 requested a review from a team as a code owner June 10, 2026 15:54

openclaw-barnacle Bot added docs Improvements or additions to documentation cli CLI command changes labels Jun 10, 2026

Merge branch 'main' into exec-approval-timeout-deny

b6e0b30

drobison00 merged commit 49737a5 into openclaw:main Jun 10, 2026
158 checks passed

github-actions Bot mentioned this pull request Jun 10, 2026

📡 Upstream Digest — 2026-06-10 16:54 UTC curtismercier/openclaw-mods#1053

Open

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 11, 2026

Fail closed on exec approval timeout (openclaw#89938)

c6d09c1

* Fail closed on exec approval timeout * Align exec approval fallback default docs

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fail closed on exec approval timeout#89938

Fail closed on exec approval timeout#89938
drobison00 merged 4 commits into
openclaw:mainfrom
drobison00:exec-approval-timeout-deny

drobison00 commented Jun 3, 2026

Uh oh!

clawsweeper Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

drobison00 commented Jun 3, 2026

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Root Cause (if applicable)

Regression Test Plan (if applicable)

User-visible / Behavior Changes

Diagram (if applicable)

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Risks and Mitigations

Uh oh!

clawsweeper Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Jun 3, 2026 •

edited

Loading