[Repo Assist] fix(security): catch all-wildcard allow patterns in exec approval policy

[github-actions]

🤖 This is an automated PR from Repo Assist.

Problem

ValidateExecApprovalRules in SystemCapability guards against remote agents setting overly broad system.execApprovals.set policies, but it only checked for the exact string "*" and a few explicit shell-prefix patterns. The pattern "**" — and similar all-wildcard variants like "***", "?", "* ?" — slipped through.

MatchesPattern converts "**" to the regex ^.*.*$, which matches every command string exactly like "*" does. An agent that can call system.execApprovals.set with a valid baseHash could use this to allow all commands:

{
  "baseHash": "<current hash>",
  "rules": [{"pattern": "**", "action": "allow", "enabled": true}],
  "defaultAction": "deny"
}

Fix

Replace the literal is "*" or "* *" check with a wildcard-stripping check:

// Strip every wildcard char ('*', '?') and whitespace; if nothing remains
// the pattern is an all-wildcard glob that matches any command.
var nonWildcardContent = normalized.Replace("*", "").Replace("?", "").Trim();
if (string.IsNullOrEmpty(nonWildcardContent))
    return $"Broad allow rule is not permitted: {pattern}";

This catches *, **, ***, ?, * ?, ? *, etc. in a single rule. The explicit shell-prefix checks (powershell *, pwsh *, cmd *, cmd.exe *) are preserved as they have non-wildcard content but are still too broad.

Tests

Added "**", "***", "?", "? *", "* ?" to the ExecApprovalsSet_RejectsUnsafeAllowRules theory.

Test Status

Suite	Result
OpenClaw.Shared.Tests	✅ 1046 passed (+5 new), 5 pre-existing McpHttpServer failures, 20 skipped
OpenClaw.Tray.Tests	✅ 245 passed, 0 failed
./build.ps1	⚠️ Not runnable on Linux CI; Shared build succeeded.

Generated by 🌈 Repo Assist, see workflow run. Learn more.

Generated by 🌈 Repo Assist, see workflow run. Learn more.

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@97143ac59cb3a13ef2a77581f929f06719c7402a