{"record":{"id":"cc7a94ea186553a2","repo":"openclaw/openclaw","slug":"codex-app-server-local-execution-is-unavailable-be","errorCode":null,"errorMessage":"Codex app-server local execution is unavailable because effective tools.exec.mode=${mode}. Execution-host approvals are authoritative. For gateway turns, inspect them with `openclaw approvals get --gateway` and update that same target with `openclaw approvals set --gateway --stdin`; for local `agent exec`, omit `--gateway`. Intentionally align that host policy before retrying.","messagePattern":"Codex app-server local execution is unavailable because effective tools\\.exec\\.mode=(.+?)\\. Execution-host approvals are authoritative\\. For gateway turns, inspect them with `openclaw approvals get --gateway` and update that same target with `openclaw approvals set --gateway --stdin`; for local `agent exec`, omit `--gateway`\\. Intentionally align that host policy before retrying\\.","errorType":"exception","errorClass":"AgentHarnessPreflightError","httpStatus":null,"severity":"error","filePath":"extensions/codex/src/app-server/config-exec-policy.ts","lineNumber":154,"sourceCode":"    return params.execPolicy.mode;\n  }\n  return params.execMode;\n}\n\nexport function resolveCodexPolicyModeForOpenClawExecMode(\n  mode: OpenClawExecMode | undefined,\n): CodexAppServerPolicyMode | undefined {\n  if (!mode || mode === \"full\") {\n    return undefined;\n  }\n  return \"guardian\";\n}\n\nexport function assertCodexAppServerAllowedForOpenClawExecMode(\n  mode: OpenClawExecMode | undefined,\n): void {\n  if (mode === \"deny\" || mode === \"allowlist\") {\n    throw new AgentHarnessPreflightError(\n      `Codex app-server local execution is unavailable because effective tools.exec.mode=${mode}. ` +\n        \"Execution-host approvals are authoritative. For gateway turns, inspect them with `openclaw approvals get --gateway` and update that same target with `openclaw approvals set --gateway --stdin`; for local `agent exec`, omit `--gateway`. Intentionally align that host policy before retrying.\",\n      { scope: \"harness\" },\n    );\n  }\n}\n\nfunction createDefaultOpenClawExecPolicy(): OpenClawExecPolicy {\n  return {\n    security: \"full\",\n    ask: \"off\",\n    touched: false,\n  };\n}\n\nfunction applyOpenClawExecPolicyLayer(\n  base: OpenClawExecPolicy,\n  exec?: { mode?: unknown; security?: unknown; ask?: unknown },","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/openclaw/openclaw/blob/01804a75319da4b69c9ab98ceaa30477e22b8c0b/extensions/codex/src/app-server/config-exec-policy.ts#L136-L172","documentation":"An AgentHarnessPreflightError thrown during harness preflight when the effective tools.exec.mode is 'deny' or 'allowlist'. Under those modes the Codex app-server cannot perform local execution because execution-host approvals are authoritative. The message instructs the operator to inspect and align host approvals before retrying.","triggerScenarios":"assertCodexAppServerAllowedForOpenClawExecMode(mode) in config-exec-policy.ts called with mode === 'deny' or mode === 'allowlist'. Triggered during harness/preflight checks before local app-server execution.","commonSituations":"Operator or an approvals file set tools.exec.mode to deny or allowlist; attempting local `agent exec` or gateway turns under a restrictive host policy that blocks local execution; stale approvals targeting the wrong scope.","solutions":["Inspect execution-host approvals for gateway turns: `openclaw approvals get --gateway`.","Align the host policy: `openclaw approvals set --gateway --stdin` with the corrected target.","For local `agent exec`, omit --gateway so the local approvals target is used.","Change tools.exec.mode to full, auto, or ask if local execution is intended."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check exec mode before invoking the harness preflight\nimport { assertCodexAppServerAllowedForOpenClawExecMode } from './config-exec-policy.js';\nfunction isAllowedForLocalExec(mode) { return mode !== 'deny' && mode !== 'allowlist'; }\nif (!isAllowedForLocalExec(execMode)) {\n  // align approvals via CLI before retrying instead of letting preflight throw\n}","typeGuard":null,"tryCatchPattern":"try {\n  assertCodexAppServerAllowedForOpenClawExecMode(mode);\n} catch (error) {\n  if (error instanceof AgentHarnessPreflightError) {\n    // surface operator-facing guidance; do not silently retry the same mode\n  }\n  throw error;\n}","preventionTips":["Inspect execution-host approvals with `openclaw approvals get --gateway` before gateway turns.","Keep tools.exec.mode aligned with the host approvals target.","For local `agent exec`, omit --gateway so the correct local target is consulted."],"tags":["exec-policy","approvals","harness","preflight","agent-exec"],"backgroundTag":null,"analyzedSha":"01804a75319da4b69c9ab98ceaa30477e22b8c0b","analyzedAt":"2026-08-12T04:37:58.197Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}