- `read` auto-approval is scoped to the current working directory (`--cwd` when set).

- ACP only auto-approves narrow readonly classes: scoped `read` calls under the active cwd plus readonly search tools (`search`, `web_search`, `memory_search`). Unknown/non-core tools, out-of-scope reads, exec-capable tools, control-plane tools, mutating tools, and interactive flows always require explicit prompt approval.

- Server-provided `toolCall.kind` is treated as untrusted metadata (not an authorization source).

- This ACP bridge policy is separate from ACPX harness permissions. If you run OpenClaw through the `acpx` backend, `plugins.entries.acpx.config.permissionMode=approve-all` is the break-glass “yolo” switch for that harness session.

- This ACP bridge policy is separate from ACPX harness permissions. If you run OpenClaw through the `acpx` backend, `plugins.entries.acpx.config.permissionMode=approve-all` is the break-glass "yolo" switch for that harness session.

## How to use this

## Zed editor setup

Add a custom ACP agent in `~/.config/zed/settings.json` (or use Zed’s Settings UI):

Add a custom ACP agent in `~/.config/zed/settings.json` (or use Zed's Settings UI):

```json

{

}

```

In Zed, open the Agent panel and select “OpenClaw ACP” to start a thread.

In Zed, open the Agent panel and select "OpenClaw ACP" to start a thread.

## Session mapping

summary: "CLI reference for `openclaw status` (diagnostics, probes, usage snapshots)"

read_when:

- You want a quick diagnosis of channel health + recent session recipients

- You want a pasteable “all” status for debugging

title: "Status"

- You want a pasteable "all" status for debugging

title: "openclaw status"

---

# `openclaw status`

Diagnostics for channels + sessions.

```bash

- Overview includes update channel + git SHA (for source checkouts).

- Update info surfaces in the Overview; if an update is available, status prints a hint to run `openclaw update` (see [Updating](/install/updating)).

- Read-only status surfaces (`status`, `status --json`, `status --all`) resolve supported SecretRefs for their targeted config paths when possible.

- If a supported channel SecretRef is configured but unavailable in the current command path, status stays read-only and reports degraded output instead of crashing. Human output shows warnings such as “configured token unavailable in this command path”, and JSON output includes `secretDiagnostics`.

- When command-local SecretRef resolution succeeds, status prefers the resolved snapshot and clears transient “secret unavailable” channel markers from the final output.

- If a supported channel SecretRef is configured but unavailable in the current command path, status stays read-only and reports degraded output instead of crashing. Human output shows warnings such as "configured token unavailable in this command path", and JSON output includes `secretDiagnostics`.

- When command-local SecretRef resolution succeeds, status prefers the resolved snapshot and clears transient "secret unavailable" channel markers from the final output.

- `status --all` includes a Secrets overview row and a diagnosis section that summarizes secret diagnostics (truncated for readability) without stopping report generation.

## Related

title: "Background exec and process tool"

---

# Background Exec + Process Tool

OpenClaw runs shell commands through the `exec` tool and keeps long‑running tasks in memory. The `process` tool manages those background sessions.

OpenClaw runs shell commands through the `exec` tool and keeps long-running tasks in memory. The `process` tool manages those background sessions.

## exec tool

Key parameters:

- `command` (required)

- `yieldMs` (default 10000): auto‑background after this delay

- `yieldMs` (default 10000): auto-background after this delay

- `background` (bool): background immediately

- `timeout` (seconds, default `tools.exec.timeoutSec`): kill the process after this timeout; set `timeout: 0` only to disable the exec process timeout for that call

- `elevated` (bool): run outside the sandbox if elevated mode is enabled/allowed (`gateway` by default, or `node` when the exec target is `node`)

Environment overrides:

- `PI_BASH_YIELD_MS`: default yield (ms)

- `PI_BASH_MAX_OUTPUT_CHARS`: in‑memory output cap (chars)

- `PI_BASH_MAX_OUTPUT_CHARS`: in-memory output cap (chars)

- `OPENCLAW_BASH_PENDING_MAX_OUTPUT_CHARS`: pending stdout/stderr cap per stream (chars)

- `PI_BASH_JOB_TTL_MS`: TTL for finished sessions (ms, bounded to 1m–3h)

- **Images can be passed through** if the CLI accepts image paths.

This is designed as a **safety net** rather than a primary path. Use it when you

want “always works” text responses without relying on external APIs.

want "always works" text responses without relying on external APIs.

If you want a full harness runtime with ACP session controls, background tasks,

thread/conversation binding, and persistent external coding sessions, use

}

```

That’s it. No keys, no extra auth config needed beyond the CLI itself.

That's it. No keys, no extra auth config needed beyond the CLI itself.

If you use a bundled CLI backend as the **primary message provider** on a

gateway host, OpenClaw now auto-loads the owning bundled plugin when your config

`bundleMcp: true`.

- **Streaming is backend-specific.** Some backends stream JSONL; others buffer

until exit.

- **Structured outputs** depend on the CLI’s JSON format.

- **Structured outputs** depend on the CLI's JSON format.

- **Codex CLI sessions** resume via text output (no JSONL), which is less

structured than the initial `--json` run. OpenClaw sessions still work

normally.

OPENCLAW_PROFILE=dev openclaw tui

```

If you don’t have a global install yet, run the CLI via `pnpm openclaw ...`.

If you don't have a global install yet, run the CLI via `pnpm openclaw ...`.

What this does:

- Sets `agent.skipBootstrap=true` (no BOOTSTRAP.md).

- Seeds the workspace files if missing:

`AGENTS.md`, `SOUL.md`, `TOOLS.md`, `IDENTITY.md`, `USER.md`, `HEARTBEAT.md`.

- Default identity: **C3‑PO** (protocol droid).

- Default identity: **C3-PO** (protocol droid).

- Skips channel providers in dev mode (`OPENCLAW_SKIP_CHANNELS=1`).

Reset flow (fresh start):

`~/.pi-mono/logs/raw-openai-completions.jsonl`

> Note: this is only emitted by processes using pi-mono’s

> Note: this is only emitted by processes using pi-mono's

> `openai-completions` provider.

## Safety notes