20 replies

# Wildcard allowlist (`"*"`) not working in v2026.3.2 (and .1)

✅Solved

Environment: OpenClaw v2026.3.2, macOS 15.7.3,

.nop

.nop

LaunchAgent

Issue: Wildcard allowlist entries (

agents."*".allowlist

agents."*".allowlist

) are completely ignored. Commands fail with "allowlist miss" or "exec approval isn't available in cron context" even when explicitly added to wildcard allowlist.

Root cause (confirmed via testing):
-

/opt/homebrew/bin/clawvault

/opt/homebrew/bin/clawvault

in wildcard

"*"

"*"

allowlist →

fails in all contexts
- Same path in

main

main

agent allowlist →

works immediately
- Same path in

minimax

minimax

agent allowlist →

works in cron

Config:

"*": {
  "allowlist": [
    {"pattern": "/opt/homebrew/bin/clawvault"}
  ]
}

"*": {
  "allowlist": [
    {"pattern": "/opt/homebrew/bin/clawvault"}
  ]
}

These entries are ignored by all agents.

"exec": {
  "security": "allowlist",
  "ask": "off"
}

"exec": {
  "security": "allowlist",
  "ask": "off"
}

Expected: Wildcard

"*"

"*"

entries should apply to all agents and reduce duplication.

Actual: Only agent-specific allowlist entries work. Must duplicate for each agent.

Workaround (confirmed working for binaries):

openclaw approvals allowlist add --agent main "/opt/homebrew/bin/clawvault"
openclaw approvals allowlist add --agent minimax "/opt/homebrew/bin/clawvault"

openclaw approvals allowlist add --agent main "/opt/homebrew/bin/clawvault"
openclaw approvals allowlist add --agent minimax "/opt/homebrew/bin/clawvault"

Verified (tested 2026-03-03):
-

Binary (

clawvault

clawvault

) works from main agent exec after adding to main agent allowlist
-

Binary expected to work in cron after adding to minimax agent allowlist
-

Live test:

clawvault search "test"

clawvault search "test"

succeeded from agent context
-

Bash scripts still fail from agent exec even with script +

/bin/bash

/bin/bash

allowlisted
-

Scripts work from terminal (bypasses allowlist)

Question: Is wildcard support intended in v2026.3.2? Docs don't mention restrictions on wildcard usage.

Solution

Thanks Krill! That completely clarifies the behavior. Filed as https://github.com/openclaw/openclaw/issues/33268

Understood on the safeBins vs approvals model - not a regression, just stricter enforcement once the approvals file exists. Agent-specific allowlist entries are working now, and we've got the bash wrapper pattern for scripts.

Really appreciate the detailed explanation of the exec architecture - helped us understand what's actually happening under the hood.

Jump to solution

FotC�

Friends of the Crustacean 🦞🤝•7d ago•

20 replies

aboveUAV

# Wildcard allowlist (`"*"`) not working in v2026.3.2 (and .1)

✅Solved

Environment: OpenClaw v2026.3.2, macOS 15.7.3,

.nop

.nop

LaunchAgent

Issue: Wildcard allowlist entries (

agents."*".allowlist

agents."*".allowlist

/opt/homebrew/bin/clawvault

/opt/homebrew/bin/clawvault

in wildcard

"*"

"*"

allowlist →

fails in all contexts
- Same path in

main

main

agent allowlist →

works immediately
- Same path in

minimax

minimax

agent allowlist →

works in cron

Config:

"*": {
  "allowlist": [
    {"pattern": "/opt/homebrew/bin/clawvault"}
  ]
}

"*": {
  "allowlist": [
    {"pattern": "/opt/homebrew/bin/clawvault"}
  ]
}

These entries are ignored by all agents.

"exec": {
  "security": "allowlist",
  "ask": "off"
}

"exec": {
  "security": "allowlist",
  "ask": "off"
}

Expected: Wildcard

"*"

"*"

entries should apply to all agents and reduce duplication.

Actual: Only agent-specific allowlist entries work. Must duplicate for each agent.

Workaround (confirmed working for binaries):

openclaw approvals allowlist add --agent main "/opt/homebrew/bin/clawvault"
openclaw approvals allowlist add --agent minimax "/opt/homebrew/bin/clawvault"

openclaw approvals allowlist add --agent main "/opt/homebrew/bin/clawvault"
openclaw approvals allowlist add --agent minimax "/opt/homebrew/bin/clawvault"

Verified (tested 2026-03-03):
-

Binary (

clawvault

clawvault

) works from main agent exec after adding to main agent allowlist
-

Binary expected to work in cron after adding to minimax agent allowlist
-

Live test:

clawvault search "test"

clawvault search "test"

succeeded from agent context
-

Bash scripts still fail from agent exec even with script +

/bin/bash

/bin/bash

allowlisted
-

Scripts work from terminal (bypasses allowlist)

Question: Is wildcard support intended in v2026.3.2? Docs don't mention restrictions on wildcard usage.

Solution

Jump to solution

# Wildcard allowlist (`"*"`) not working in v2026.3.2 (and .1)

# Wildcard allowlist (`"*"`) not working in v2026.3.2 (and .1)

Similar Threads

Similar Threads

Similar Threads