From 43b55a8c3a1ee4c1ba40041de1cbd0a2bce48d0e Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Thu, 22 Jan 2026 03:11:06 +0000
Subject: [PATCH] fix: enforce strict exec approval optionals (#1414) (thanks
 @czekaj)

---
 CHANGELOG.md                                  |  1 +
 .../server-methods/exec-approval.test.ts      | 39 +++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d350d3a63..7e92973a1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@ Docs: https://docs.clawd.bot
 - Config: avoid stack traces for invalid configs and log the config path.
 - Doctor: warn when gateway.mode is unset with configure/config guidance.
 - macOS: include Textual syntax highlighting resources in packaged app to prevent chat crashes. (#1362)
+- Exec approvals: send optional approval params as undefined instead of null. (#1414) Thanks @czekaj.
 - UI: refresh debug panel on route-driven tab changes. (#1373) Thanks @yazinsai.
 
 ## 2026.1.21
diff --git a/src/gateway/server-methods/exec-approval.test.ts b/src/gateway/server-methods/exec-approval.test.ts
index 8142b281f..f40d6c003 100644
--- a/src/gateway/server-methods/exec-approval.test.ts
+++ b/src/gateway/server-methods/exec-approval.test.ts
@@ -47,6 +47,45 @@ describe("exec approval handlers", () => {
       };
       expect(validateExecApprovalRequestParams(params)).toBe(false);
     });
+
+    it("accepts request with sessionKey omitted", () => {
+      const params = {
+        command: "echo hi",
+        cwd: "/tmp",
+        host: "node",
+      };
+      expect(validateExecApprovalRequestParams(params)).toBe(true);
+    });
+
+    it("accepts request with sessionKey as string", () => {
+      const params = {
+        command: "echo hi",
+        cwd: "/tmp",
+        host: "node",
+        sessionKey: "session-1",
+      };
+      expect(validateExecApprovalRequestParams(params)).toBe(true);
+    });
+
+    it("accepts request with sessionKey as undefined", () => {
+      const params = {
+        command: "echo hi",
+        cwd: "/tmp",
+        host: "node",
+        sessionKey: undefined,
+      };
+      expect(validateExecApprovalRequestParams(params)).toBe(true);
+    });
+
+    it("rejects request with sessionKey as null", () => {
+      const params = {
+        command: "echo hi",
+        cwd: "/tmp",
+        host: "node",
+        sessionKey: null,
+      };
+      expect(validateExecApprovalRequestParams(params)).toBe(false);
+    });
   });
 
   it("broadcasts request + resolve", async () => {