fix(exec): avoid double prompts for approved wrappers

Author: vincentkoc

src/OpenClaw.Shared/Capabilities/SystemCapability.cs

@@ -396,12 +396,17 @@ private async Task<NodeInvokeResponse> HandleRunAsync(NodeInvokeRequest request)
         if (_approvalPolicy != null)
         {
             var approval = _approvalPolicy.Evaluate(fullCommand, shell);
-            if (!await EnsureApprovedAsync(fullCommand, shell, approval))
+            var approvalCheck = await EnsureApprovedAsync(fullCommand, shell, approval);
+            if (!approvalCheck.Allowed)
             {
                 Logger.Warn($"system.run DENIED: {fullCommand} ({approval.Reason})");
                 return Error($"Command denied by exec policy: {approval.Reason}");
             }
 
+            var outerApprovalCoversNestedTargets =
+                approvalCheck.PromptDecisionKind != null ||
+                IsExactAllowRuleForCommand(approval, fullCommand);
+
             var parseResult = ExecShellWrapperParser.Expand(fullCommand, shell);
             if (!string.IsNullOrWhiteSpace(parseResult.Error))
             {
@@ -412,7 +417,18 @@ private async Task<NodeInvokeResponse> HandleRunAsync(NodeInvokeRequest request)
             foreach (var target in parseResult.Targets)
             {
                 var innerApproval = _approvalPolicy.Evaluate(target.Command, target.Shell);
-                if (!await EnsureApprovedAsync(target.Command, target.Shell, innerApproval))
+                if (outerApprovalCoversNestedTargets && !IsExplicitDeny(innerApproval))
+                {
+                    if (!innerApproval.Allowed)
+                    {
+                        Logger.Info(
+                            $"system.run nested approval covered by approved wrapper: {target.Command} ({innerApproval.Reason})");
+                    }
+                    continue;
+                }
+
+                var innerApprovalCheck = await EnsureApprovedAsync(target.Command, target.Shell, innerApproval);
+                if (!innerApprovalCheck.Allowed)
                 {
                     Logger.Warn($"system.run DENIED: {target.Command} ({innerApproval.Reason})");
                     return Error($"Command denied by exec policy: {innerApproval.Reason}");
@@ -448,17 +464,17 @@ private async Task<NodeInvokeResponse> HandleRunAsync(NodeInvokeRequest request)
         }
     }
 
-    private async Task<bool> EnsureApprovedAsync(
+    private async Task<ExecApprovalCheckResult> EnsureApprovedAsync(
         string command,
         string? shell,
         ExecApprovalResult approval,
         CancellationToken cancellationToken = default)
     {
         if (approval.Allowed)
-            return true;
+            return new ExecApprovalCheckResult(true, null);
 
         if (approval.Action != ExecApprovalAction.Prompt || _promptHandler == null || _approvalPolicy == null)
-            return false;
+            return new ExecApprovalCheckResult(false, null);
 
         var decision = await _promptHandler.RequestAsync(new ExecApprovalPromptRequest
         {
@@ -471,7 +487,7 @@ private async Task<bool> EnsureApprovedAsync(
         if (decision.Kind == ExecApprovalPromptDecisionKind.Deny)
         {
             Logger.Warn($"system.run DENIED by prompt: {command} ({decision.Reason})");
-            return false;
+            return new ExecApprovalCheckResult(false, decision.Kind);
         }
 
         if (decision.Kind == ExecApprovalPromptDecisionKind.AlwaysAllow)
@@ -494,12 +510,28 @@ private async Task<bool> EnsureApprovedAsync(
         }
 
         Logger.Info($"system.run APPROVED by prompt: {command} ({decision.Kind})");
-        return true;
+        return new ExecApprovalCheckResult(true, decision.Kind);
     }
 
     private static bool CanPersistExactAllowRule(string command) =>
         !string.IsNullOrWhiteSpace(command) &&
         command.IndexOfAny(['*', '?']) < 0;
+
+    private static bool IsExactAllowRuleForCommand(ExecApprovalResult approval, string command) =>
+        approval.Allowed &&
+        approval.Action == ExecApprovalAction.Allow &&
+        !string.IsNullOrWhiteSpace(approval.MatchedPattern) &&
+        approval.MatchedPattern.IndexOfAny(['*', '?']) < 0 &&
+        string.Equals(approval.MatchedPattern, command, StringComparison.OrdinalIgnoreCase);
+
+    private static bool IsExplicitDeny(ExecApprovalResult approval) =>
+        !approval.Allowed &&
+        approval.Action == ExecApprovalAction.Deny &&
+        !string.IsNullOrWhiteSpace(approval.MatchedPattern);
+
+    private readonly record struct ExecApprovalCheckResult(
+        bool Allowed,
+        ExecApprovalPromptDecisionKind? PromptDecisionKind);
 
     private NodeInvokeResponse HandleExecApprovalsGet()
     {

tests/OpenClaw.Shared.Tests/SystemRunTests.cs

@@ -430,6 +430,42 @@ public async Task SystemRun_WithPromptPolicy_AllowsOnce_WhenUserApproves()
         }
     }
 
+    [Fact]
+    public async Task SystemRun_WithPromptPolicy_PromptsOnceForShellWrapper_WhenUserApprovesOnce()
+    {
+        var tempDir = Path.Combine(Path.GetTempPath(), $"test-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(tempDir);
+
+        try
+        {
+            var logger = new ExecTestLogger();
+            var policy = new ExecApprovalPolicy(tempDir, logger);
+            policy.SetRules(Array.Empty<ExecApprovalRule>(), ExecApprovalAction.Prompt);
+            var runner = new FakeCommandRunner();
+            var prompt = new FakePromptHandler(ExecApprovalPromptDecision.AllowOnce());
+            var cap = new SystemCapability(logger);
+            cap.SetCommandRunner(runner);
+            cap.SetApprovalPolicy(policy);
+            cap.SetPromptHandler(prompt);
+
+            var res = await cap.ExecuteAsync(new NodeInvokeRequest
+            {
+                Id = "prompt-wrapper-1",
+                Command = "system.run",
+                Args = Parse("""{"command":"cmd /c echo hello"}""")
+            });
+
+            Assert.True(res.Ok, res.Error);
+            Assert.NotNull(runner.LastRequest);
+            Assert.Equal(1, prompt.CallCount);
+            Assert.Empty(policy.Rules);
+        }
+        finally
+        {
+            try { Directory.Delete(tempDir, true); } catch { }
+        }
+    }
+
     [Fact]
     public async Task SystemRun_WithPromptPolicy_PersistsExactAllowRule_WhenUserAlwaysAllows()
     {
@@ -464,6 +500,88 @@ public async Task SystemRun_WithPromptPolicy_PersistsExactAllowRule_WhenUserAlwa
         }
     }
 
+    [Fact]
+    public async Task SystemRun_WithPromptPolicy_AlwaysAllowWrapperPersistsSingleRule_AndCoversRepeat()
+    {
+        var tempDir = Path.Combine(Path.GetTempPath(), $"test-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(tempDir);
+
+        try
+        {
+            var logger = new ExecTestLogger();
+            var policy = new ExecApprovalPolicy(tempDir, logger);
+            policy.SetRules(Array.Empty<ExecApprovalRule>(), ExecApprovalAction.Prompt);
+            var runner = new FakeCommandRunner();
+            var prompt = new FakePromptHandler(ExecApprovalPromptDecision.AlwaysAllow());
+            var cap = new SystemCapability(logger);
+            cap.SetCommandRunner(runner);
+            cap.SetApprovalPolicy(policy);
+            cap.SetPromptHandler(prompt);
+
+            var req = new NodeInvokeRequest
+            {
+                Id = "prompt-wrapper-2",
+                Command = "system.run",
+                Args = Parse("""{"command":"cmd /c echo repeat"}""")
+            };
+
+            var first = await cap.ExecuteAsync(req);
+            Assert.True(first.Ok, first.Error);
+            Assert.Equal(1, prompt.CallCount);
+            Assert.Single(policy.Rules);
+            Assert.Equal("cmd /c echo repeat", policy.Rules[0].Pattern);
+
+            var second = await cap.ExecuteAsync(req);
+            Assert.True(second.Ok, second.Error);
+            Assert.Equal(1, prompt.CallCount);
+        }
+        finally
+        {
+            try { Directory.Delete(tempDir, true); } catch { }
+        }
+    }
+
+    [Fact]
+    public async Task SystemRun_WithPromptPolicy_StillDeniesExplicitBlockedShellWrapperPayload()
+    {
+        var tempDir = Path.Combine(Path.GetTempPath(), $"test-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(tempDir);
+
+        try
+        {
+            var logger = new ExecTestLogger();
+            var policy = new ExecApprovalPolicy(tempDir, logger);
+            policy.SetRules(
+                new[]
+                {
+                    new ExecApprovalRule { Pattern = "del *", Action = ExecApprovalAction.Deny }
+                },
+                ExecApprovalAction.Prompt);
+            var runner = new FakeCommandRunner();
+            var prompt = new FakePromptHandler(ExecApprovalPromptDecision.AllowOnce());
+            var cap = new SystemCapability(logger);
+            cap.SetCommandRunner(runner);
+            cap.SetApprovalPolicy(policy);
+            cap.SetPromptHandler(prompt);
+
+            var res = await cap.ExecuteAsync(new NodeInvokeRequest
+            {
+                Id = "prompt-wrapper-3",
+                Command = "system.run",
+                Args = Parse("""{"command":"cmd /c del C:\\important.txt"}""")
+            });
+
+            Assert.False(res.Ok);
+            Assert.Contains("denied", res.Error!, StringComparison.OrdinalIgnoreCase);
+            Assert.Null(runner.LastRequest);
+            Assert.Equal(1, prompt.CallCount);
+        }
+        finally
+        {
+            try { Directory.Delete(tempDir, true); } catch { }
+        }
+    }
+
     [Fact]
     public async Task SystemRun_WithPromptPolicy_Denies_WhenUserDenies()
     {
@@ -525,10 +643,15 @@ public FakePromptHandler(ExecApprovalPromptDecision decision)
             _decision = decision;
         }
 
+        public int CallCount { get; private set; }
+
         public Task<ExecApprovalPromptDecision> RequestAsync(
             ExecApprovalPromptRequest request,
-            CancellationToken cancellationToken = default) =>
-            Task.FromResult(_decision);
+            CancellationToken cancellationToken = default)
+        {
+            CallCount++;
+            return Task.FromResult(_decision);
+        }
     }
 }