AgentClaw CLI validation, 2026-09-06
Scope: macOS, isolated configuration. No real model or approval end-to-end claim.
Temporary directory paths replaced with <isolated-lab>.

Node v24.15.0

$ openclaw --version
OpenClaw 2026.9.2 (3928bad)

$ openclaw exec-policy set --help

OpenClaw 2026.9.2 (3928bad) — All your chats, one OpenClaw.

Usage: openclaw exec-policy set [options]

Synchronize local config and host approvals using explicit values

Options:
  --ask <mode>           Exec ask mode: off|on-miss|always
  --ask-fallback <mode>  Host approvals fallback: deny|allowlist|full
  -h, --help             Display help for command
  --host <host>          Exec host target: auto|sandbox|gateway|node
  --json                 Output as JSON (default: false)
  --security <mode>      Exec security: deny|allowlist|full

$ openclaw approvals pending --help

OpenClaw 2026.9.2 (3928bad) — All your chats, one OpenClaw.

Usage: openclaw approvals pending [options]

List pending exec, plugin, and system-agent approvals

Options:
  -h, --help       Display help for command
  --json           Output JSON (default: false)
  --timeout <ms>   Timeout in ms (default: "10000")
  --token <token>  Gateway token (if required)
  --url <url>      Gateway WebSocket URL (defaults to gateway.remote.url when
                   configured)

$ openclaw nodes invoke --help

OpenClaw 2026.9.2 (3928bad) — All your chats, one OpenClaw.

Usage: openclaw nodes invoke [options]

Invoke a command on a paired node

Options:
  --command <command>      Command (e.g. canvas.navigate)
  -h, --help               Display help for command
  --idempotency-key <key>  Idempotency key (optional)
  --invoke-timeout <ms>    Node invoke timeout in ms (default 15000) (default:
                           "15000")
  --json                   Output JSON (default: false)
  --node <idOrNameOrIp>    Node id, name, or IP
  --params <json>          JSON object string for params (default: "{}")
  --timeout <ms>           Timeout in ms (default: "30000")
  --token <token>          Gateway token (if required)
  --url <url>              Gateway WebSocket URL (defaults to gateway.remote.url
                           when configured)

$ openclaw exec-policy set --host gateway --security allowlist --ask always --ask-fallback deny --json
{"applied":{"host":"gateway","security":"allowlist","ask":"always","askFallback":"deny"},"configPath":"<isolated-lab>/config.json","approvalsPath":"<isolated-lab>/state/state/openclaw.sqlite#exec_approvals_config","approvalsExists":true,"effectivePolicy":{"note":"Effective exec policy is the host approvals policy intersected with requested tools.exec policy. Per-session /exec overrides are not included; run /exec in the relevant session to inspect its current defaults.","scopes":[{"scopeLabel":"tools.exec","configPath":"tools.exec","agentId":"main","host":{"requested":"gateway","requestedSource":"tools.exec.host"},"mode":{"requested":"ask","requestedSource":"derived from tools.exec.security and tools.exec.ask","effective":"ask","note":"requested mode applies"},"security":{"requested":"allowlist","requestedSource":"tools.exec.security","host":"allowlist","hostSource":"<isolated-lab>/state/state/openclaw.sqlite#exec_approvals_config defaults.security","effective":"allowlist","note":"requested security applies"},"ask":{"requested":"always","requestedSource":"tools.exec.ask","host":"always","hostSource":"<isolated-lab>/state/state/openclaw.sqlite#exec_approvals_config defaults.ask","effective":"always","note":"requested ask applies"},"askFallback":{"effective":"deny","source":"<isolated-lab>/state/state/openclaw.sqlite#exec_approvals_config defaults.askFallback"},"runtimeApprovalsSource":"local-file"}]}}

$ openclaw exec-policy show --json
{"configPath":"<isolated-lab>/config.json","approvalsPath":"<isolated-lab>/state/state/openclaw.sqlite#exec_approvals_config","approvalsExists":true,"effectivePolicy":{"note":"Effective exec policy is the host approvals policy intersected with requested tools.exec policy. Per-session /exec overrides are not included; run /exec in the relevant session to inspect its current defaults.","scopes":[{"scopeLabel":"tools.exec","configPath":"tools.exec","agentId":"main","host":{"requested":"gateway","requestedSource":"tools.exec.host"},"mode":{"requested":"ask","requestedSource":"derived from tools.exec.security and tools.exec.ask","effective":"ask","note":"requested mode applies"},"security":{"requested":"allowlist","requestedSource":"tools.exec.security","host":"allowlist","hostSource":"<isolated-lab>/state/state/openclaw.sqlite#exec_approvals_config defaults.security","effective":"allowlist","note":"requested security applies"},"ask":{"requested":"always","requestedSource":"tools.exec.ask","host":"always","hostSource":"<isolated-lab>/state/state/openclaw.sqlite#exec_approvals_config defaults.ask","effective":"always","note":"requested ask applies"},"askFallback":{"effective":"deny","source":"<isolated-lab>/state/state/openclaw.sqlite#exec_approvals_config defaults.askFallback"},"runtimeApprovalsSource":"local-file"}]}}