17 KiB
Session: 2026-03-07 17:54:37 UTC
- Session Key: agent:main:main
- Session ID: 55b28200-09b8-40f4-9444-02506f8e5194
- Source: gateway:sessions.reset
Conversation Summary
assistant: reply_to_current 可以,给你一个最小可用的 exec-approvals.json(只放你这次要用到的命令):
{
"version": 1,
"defaults": {
"mode": "deny"
},
"allowlist": [
{ "command": "cat" },
{ "command": "cp" },
{ "command": "mv" },
{ "command": "sed" },
{ "command": "openclaw gateway restart" }
]
}
一次性写入 + 生效:
cat > ~/.openclaw/exec-approvals.json <<'JSON'
{
"version": 1,
"defaults": {
"mode": "deny"
},
"allowlist": [
{ "command": "cat" },
{ "command": "cp" },
{ "command": "mv" },
{ "command": "sed" },
{ "command": "openclaw gateway restart" }
]
}
JSON
openclaw approvals set ~/.openclaw/exec-approvals.json
openclaw approvals get
如果 approvals set 报 JSON 字段不匹配(版本差异),把报错贴我,我立刻给你改成你这版 CLI 的精确格式。
user: Sender (untrusted metadata):
{
"label": "openclaw-tui (gateway-client)",
"id": "gateway-client",
"name": "openclaw-tui",
"username": "openclaw-tui"
}
[Sun 2026-03-08 01:48 GMT+8] guchen@MBKPro ~ % openclaw approvals set ~/.openclaw/exec-approvals.json
Config warnings:\n- plugins.entries.feishu: plugin feishu: duplicate plugin id detected; later plugin may be overridden (/Users/guchen/.openclaw/extensions/feishu/index.ts)
error: too many arguments for 'set'. Expected 0 arguments but got 1.
assistant: reply_to_current 对,这版命令说明了:set 不接位置参数。
你这个版本大概率是从标准输入读 JSON(或走交互)。
先确认精确用法:
openclaw approvals set --help
大概率你可以直接这样一次性写入(管道喂给 set):
cat ~/.openclaw/exec-approvals.json | openclaw approvals set
openclaw approvals get
如果还不行,就用 here-doc 直喂:
openclaw approvals set <<'JSON'
{
"version": 1,
"defaults": { "mode": "deny" },
"allowlist": [
{ "command": "cat" },
{ "command": "cp" },
{ "command": "mv" },
{ "command": "sed" },
{ "command": "openclaw gateway restart" }
]
}
JSON
openclaw approvals get
把 openclaw approvals set --help 输出贴我,我给你最终 100% 对应你版本的一条命令。
user: Sender (untrusted metadata):
{
"label": "openclaw-tui (gateway-client)",
"id": "gateway-client",
"name": "openclaw-tui",
"username": "openclaw-tui"
}
[Sun 2026-03-08 01:49 GMT+8] guchen@MBKPro ~ % openclaw approvals set --help Config warnings:\n- plugins.entries.feishu: plugin feishu: duplicate plugin id detected; later plugin may be overridden (/Users/guchen/.openclaw/extensions/feishu/index.ts) Config warnings:\n- plugins.entries.feishu: plugin feishu: duplicate plugin id detected; later plugin may be overridden (/Users/guchen/.openclaw/extensions/feishu/index.ts)
🦞 OpenClaw 2026.3.2 (85377a2) — I'll refactor your busywork like it owes me money.
Usage: openclaw approvals set [options]
Replace exec approvals with a JSON file
Options: --file Path to JSON file to upload --gateway Force gateway approvals (default: false) -h, --help Display help for command --json Output JSON (default: false) --node Target node id/name/IP --stdin Read JSON from stdin (default: false) --timeout Timeout in ms (default: "10000") --token Gateway token (if required) --url Gateway WebSocket URL (defaults to gateway.remote.url when configured) assistant: reply_to_current 完美,参数出来了。你用这条就行:
openclaw approvals set --file ~/.openclaw/exec-approvals.json
openclaw approvals get
如果你想“一条命令写文件+应用”:
cat > ~/.openclaw/exec-approvals.json <<'JSON'
{
"version": 1,
"defaults": { "mode": "deny" },
"allowlist": [
{ "command": "cat" },
{ "command": "cp" },
{ "command": "mv" },
{ "command": "sed" },
{ "command": "openclaw gateway restart" }
]
}
JSON
openclaw approvals set --file ~/.openclaw/exec-approvals.json
openclaw approvals get
执行完把 approvals get 结果贴我,我马上判断是否已经可以让我直接改 models.json。
user: Sender (untrusted metadata):
{
"label": "openclaw-tui (gateway-client)",
"id": "gateway-client",
"name": "openclaw-tui",
"username": "openclaw-tui"
}
[Sun 2026-03-08 01:50 GMT+8] guchen@MBKPro ~ % openclaw approvals get Config warnings:\n- plugins.entries.feishu: plugin feishu: duplicate plugin id detected; later plugin may be overridden (/Users/guchen/.openclaw/extensions/feishu/index.ts) Config warnings:\n- plugins.entries.feishu: plugin feishu: duplicate plugin id detected; later plugin may be overridden (/Users/guchen/.openclaw/extensions/feishu/index.ts)
🦞 OpenClaw 2026.3.2 (85377a2) — If you can describe it, I can probably automate it—or at least make it funnier.
│ ◇ Config warnings ─────────────────────────────────────────────────────────────────────────╮ │ │ │ - plugins.entries.feishu: plugin feishu: duplicate plugin id detected; later plugin may │ │ be overridden (/Users/guchen/.openclaw/extensions/feishu/index.ts) │ │ │ ├───────────────────────────────────────────────────────────────────────────────────────────╯ Showing local approvals.
Approvals ┌───────────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────┐ │ Field │ Value │ ├───────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Target │ local │ │ Path │ ~/.openclaw/exec-approvals.json │ │ Exists │ yes │ │ Hash │ ad4bc7f3e22a40006a7dc241f082ab61aa87cdb4ea369af05a91f76fe33b94c0 │ │ Version │ 1 │ │ Socket │ default │ │ Defaults │ none │ │ Agents │ 0 │ │ Allowlist │ 0 │ └───────────┴─────────────────────────────────────────────────────────────────────────────────────────────────────────┘
No allowlist entries.
assistant: reply_to_current 这个结果说明:文件被读取了,但你写入的 JSON 字段结构没被识别,所以回退成空配置(Allowlist 0)。
最稳的办法:用官方交互编辑器生成正确结构(避免猜 schema):
openclaw approvals allowlist
进去后给 main agent 添加这几条命令:
catcpmvsedopenclaw gateway restart
保存退出后再验证:
openclaw approvals get
如果你坚持走 JSON 文件方式,我需要你先贴当前文件内容:
cat ~/.openclaw/exec-approvals.json
我按你这版真实 schema 改成可识别格式。
(你这版大概率不是顶层 allowlist,而是 agents 级别或 rules 结构。)
user: Sender (untrusted metadata):
{
"label": "openclaw-tui (gateway-client)",
"id": "gateway-client",
"name": "openclaw-tui",
"username": "openclaw-tui"
}
[Sun 2026-03-08 01:51 GMT+8] { "version": 1, "defaults": { "mode": "deny" }, "allowlist": [ { "command": "cat" }, { "command": "cp" }, { "command": "mv" }, { "command": "sed" }, { "command": "openclaw gateway restart" } ] } assistant: reply_to_current 明白了,你这个 JSON 本身语法对,但不是这版 OpenClaw 期望的 schema,所以被当成空规则。
别再猜字段了,直接用内置编辑器一次到位(最快):
openclaw approvals allowlist
然后按提示:
- 选择
local - 选择 agent:
main - 添加允许命令:
catcpmvsedopenclaw gateway restart
- 保存退出
再验证:
openclaw approvals get
你把这次 get 结果贴我(关键看 Agents 和 Allowlist 不再是 0),我就继续带你到“我可直接代改 models.json”那一步。
user: Sender (untrusted metadata):
{
"label": "openclaw-tui (gateway-client)",
"id": "gateway-client",
"name": "openclaw-tui",
"username": "openclaw-tui"
}
[Sun 2026-03-08 01:51 GMT+8] guchen@MBKPro ~ % openclaw approvals allowlist Config warnings:\n- plugins.entries.feishu: plugin feishu: duplicate plugin id detected; later plugin may be overridden (/Users/guchen/.openclaw/extensions/feishu/index.ts) Config warnings:\n- plugins.entries.feishu: plugin feishu: duplicate plugin id detected; later plugin may be overridden (/Users/guchen/.openclaw/extensions/feishu/index.ts)
🦞 OpenClaw 2026.3.2 (85377a2) — Greetings, Professor Falken
Usage: openclaw approvals allowlist [options] [command]
Edit the per-agent allowlist
Options: -h, --help Display help for command
Commands: add Add a glob pattern to an allowlist help Display help for command remove Remove a glob pattern from an allowlist
Examples:
openclaw approvals allowlist add "/Projects/**/bin/rg"
Allowlist a local binary pattern for the main agent.
openclaw approvals allowlist add --agent main --node <id|name|ip> "/usr/bin/uptime"
Allowlist on a specific node/agent.
openclaw approvals allowlist add --agent "*" "/usr/bin/uname"
Allowlist for all agents (wildcard).
openclaw approvals allowlist remove "/Projects/**/bin/rg"
Remove an allowlist pattern.
Docs: docs.openclaw.ai/cli/approvals assistant: reply_to_current 好,这下明确了:你这版是“按glob 模式加 allowlist”,不是 JSON 结构编辑。
直接执行下面这组(先按 main agent):
openclaw approvals allowlist add --agent main "cat *"
openclaw approvals allowlist add --agent main "cp *"
openclaw approvals allowlist add --agent main "mv *"
openclaw approvals allowlist add --agent main "sed *"
openclaw approvals allowlist add --agent main "openclaw gateway restart*"
openclaw approvals get
如果上面匹配不到(某些版本要求绝对路径),再补一组绝对路径规则:
which cat cp mv sed openclaw
把输出贴我,我给你改成对应的绝对路径 allowlist(100% 命中)。 user: Sender (untrusted metadata):
{
"label": "openclaw-tui (gateway-client)",
"id": "gateway-client",
"name": "openclaw-tui",
"username": "openclaw-tui"
}
[Sun 2026-03-08 01:53 GMT+8] guchen@MBKPro ~ % openclaw approvals get Config warnings:\n- plugins.entries.feishu: plugin feishu: duplicate plugin id detected; later plugin may be overridden (/Users/guchen/.openclaw/extensions/feishu/index.ts) Config warnings:\n- plugins.entries.feishu: plugin feishu: duplicate plugin id detected; later plugin may be overridden (/Users/guchen/.openclaw/extensions/feishu/index.ts)
🦞 OpenClaw 2026.3.2 (85377a2) — I'm like tmux: confusing at first, then suddenly you can't live without me.
│ ◇ Config warnings ─────────────────────────────────────────────────────────────────────────╮ │ │ │ - plugins.entries.feishu: plugin feishu: duplicate plugin id detected; later plugin may │ │ be overridden (/Users/guchen/.openclaw/extensions/feishu/index.ts) │ │ │ ├───────────────────────────────────────────────────────────────────────────────────────────╯ Showing local approvals.
Approvals ┌───────────┬─────────────────────────────────────────────────────────────────────────────────────────────────────────┐ │ Field │ Value │ ├───────────┼─────────────────────────────────────────────────────────────────────────────────────────────────────────┤ │ Target │ local │ │ Path │ ~/.openclaw/exec-approvals.json │ │ Exists │ yes │ │ Hash │ a216cfa24ff3e0fc6498c8700cd47da75b7732a29dcfb7ab4811fd32fc49d0ca │ │ Version │ 1 │ │ Socket │ default │ │ Defaults │ none │ │ Agents │ 1 │ │ Allowlist │ 5 │ └───────────┴─────────────────────────────────────────────────────────────────────────────────────────────────────────┘
Allowlist
┌──────────┬────────┬─────────────────────────────────────────────────────────────────────────────────────┬───────────┐
│ Target │ Agent │ Pattern │ Last Used │
├──────────┼────────┼─────────────────────────────────────────────────────────────────────────────────────┼───────────┤
│ local │ main │ cat * │ 1m ago │
│ local │ main │ cp * │ 1m ago │
│ local │ main │ mv * │ 1m ago │
│ local │ main │ sed * │ just now │
│ local │ main │ openclaw gateway restart* │ just now │
└──────────┴────────┴─────────────────────────────────────────────────────────────────────────────────────┴───────────┘
guchen@MBKPro ~ %
assistant: reply_to_current 完美,权限已经开好了(Agents=1、Allowlist=5)。
现在你只需要重开一个会话让我拿到新权限:
openclaw tui
然后在新会话直接发我这句:
请直接修改 ~/.openclaw/models.json,只保留 sub2api/gpt-5.3-codex,并执行 openclaw gateway restart
我就能直接代你完成,不用你再手动改。 user: Sender (untrusted metadata):
{
"label": "openclaw-tui (gateway-client)",
"id": "gateway-client",
"name": "openclaw-tui",
"username": "openclaw-tui"
}
[Sun 2026-03-08 01:53 GMT+8] 请直接修改 ~/.openclaw/models.json,只保留 sub2api/gpt-5.3-codex,并执行 openclaw gateway restart
assistant: reply_to_current 我现在这条仍是 gateway-client/webchat 会话(工具里依然没有 exec/read/write),所以我还是不能直接改你本机文件。
你权限已经配好,差最后一步:在新开的本地 TUI 会话里再发同一句。
为确保一次成功,你在新会话里看到我能执行后,也可以让我直接跑这组:
cp ~/.openclaw/models.json ~/.openclaw/models.json.bak.$(date +%Y%m%d-%H%M%S)
cat > ~/.openclaw/models.json <<'JSON'
{
"default": "sub2api/gpt-5.3-codex",
"models": {
"sub2api/gpt-5.3-codex": {}
}
}
JSON
openclaw gateway restart
如果你愿意,我也可以现在继续在线等你把“新会话第一条回复”贴过来,我帮你确认是否已经切到可执行能力会话。