.openclaw folder split broke exec-approvals.json

[oparoz]

Description

The .openclaw folder was recently split in two, with the writable part sent to .openclaw-data and new permissions applied.
Then people realised that some files were missing and added them in commit #1519.
Unfortunately, that doesn't work for exec-approvals. It needs to be a real file, not a symlink.

Reproduction Steps

Try to get the assistant to use any tool.

Environment

DGX Spark 7.5.0
OC-2026.04.10
OS-0.0.26

Debug Output

Logs

error [tools] exec failed: Refusing to write exec approvals via symlink: /sandbox/.openclaw/exec-approvals.json raw_params={"command":"openclaw version"}

Checklist

• I confirmed this bug is reproducible
• I searched existing issues and this is not a duplicate

[oparoz]

For people running into the same issue. You can fix it on your own by live patching the sandbox. The paths to exec-approvals.json are hard-coded in /usr/local/lib/node_modules/openclaw/dist/exec-approvals-effective-*.js

[skainguyen1412]

I would like to work on this. At first inspect, exec-approvals broke because OpenClaw now requires a real file at ~/.openclaw/exec-approvals.json, but NemoClaw provides a symlink.

[skainguyen1412]

Hi can you check if #1823 fix your problem @oparoz ?

[oparoz]

Hi can you check if #1823 fix your problem @oparoz ?

Tested on 2026.4.12. I didn't have to patch the sandbox again! Thank you :)