approval-gates - The LGTM

The LGTM

Sign in Subscribe

approval-gates

A collection of 7 posts

OpenClaw’s Inline-Eval Patch Is the Boring Guardrail Vibe Coding Needs

The boring parts of agent security keep doing the real work. OpenClaw PR #96216 is not glamorous: it teaches strict inline-eval detection that python3.13 -c, /usr/bin/pypy3.10 -c, PHP -B/-E/-R, and R/Rscript -e/--exec are still inline code execution. That sounds obvious. It was

OpenClaw Is Closing the Policy Gap Between Who Asked and What Tool Runs

OpenClaw Is Closing the Policy Gap Between Who Asked and What Tool Runs

Approval gates have a branding problem: they look like security controls, but too often they are just modal dialogs with incomplete context. OpenClaw PR #96211 is interesting because it goes after the field most agent platforms quietly hand-wave: requester origin. Not just “what tool is about to run,” but who

Qwen Code v0.19.1 Turns Auto Mode Safety Into Runtime Policy

Qwen Code v0.19.1 Turns Auto Mode Safety Into Runtime Policy

Qwen Code v0.19.1 is the kind of release that will not win a benchmark slide and absolutely should make security reviewers pay attention. The headline is not that Alibaba’s coding agent got better at writing code. It is that the runtime got more willing to say “no”

Task Guard’s NO_REPLY Bug Shows Why Agent Safety Instructions Need Exit Conditions

Task Guard’s NO_REPLY Bug Shows Why Agent Safety Instructions Need Exit Conditions

The uncomfortable thing about prompt-based safety is that the model keeps reading the prompt after the moment you meant it to apply. OpenClaw issue #95773 is a clean example: Task Guard tells the model that the final reply for the turn “must be and can only be NO_REPLY,” then

Grok Build’s Enterprise Docs Say the Quiet Part Out Loud: Coding Agents Are Endpoint Software Now

Grok Build’s refreshed enterprise documentation is not the sort of launch that wins a hype cycle. Good. It is more important than that. The page reads like xAI has accepted the thing every serious engineering org eventually learns about coding agents: once an agent can read a repo, run

Qwen Code’s June 20 Safety Fixes Are About Consent and Boundaries

Qwen Code’s June 20 Safety Fixes Are About Consent and Boundaries

The most important Qwen Code work on June 20 was not a model upgrade. It was a trio of small safety fixes about consent, path boundaries, and ignore-file semantics. That sounds painfully specific because it is. It is also exactly where local coding agents earn or lose trust. Shortly after

Qwen Code’s Nightly Makes sed -i Accountable

Qwen Code’s Nightly Makes sed -i Accountable

The least glamorous coding-agent feature is also one of the most important: knowing when the agent changed a file. Qwen Code’s June 18 nightly, v0.18.3-nightly.20260618.bc3e0b405, contains one substantive change, and it lands exactly on that fault line. Supported single-file sed -i substitutions now route through