An approval-gated exec refuses a command that prints one URL.
/usr/bin/printf '%s\n' 'http://127.0.0.1:9876/oauth2/callback?state=synthetic&code=synthetic'
The URL is single-quoted, so the ampersand is a literal. The refusal comes back anyway, and no approval request is ever created.
SYSTEM_RUN_DENIED: approval cannot safely bind this interpreter/runtime command
Double quotes reproduce it. Escaping the ampersand reproduces it. The same call with a single query parameter passes. This is openclaw/openclaw#173240, fixed in PR #173273.
Why it happens
The binder that decides whether a shell payload can be attached to a stable script operand starts by testing the raw command text against a metacharacter pattern. That test runs before the string is split into argv, so it cannot tell a quoted literal from active shell syntax. An OAuth callback URL legitimately carries & between query parameters, and the raw-text match treats it as a command separator. The request is refused during preparation, which is earlier than approval - so the operator never even gets a prompt to decline.
The fix
Parse the shell payload into argv first, then run the metacharacter test over what is left as syntax. The landed fix points the binder at the canonical shell-argv parser for the sh payloads node exec generates, so quoted and escaped separators survive as literal characters while unquoted globs and nested shells still go to a human. The existing execution policy, working-directory identity and mutable-script binding checks all stay in place.
The general shape is worth keeping. Any safety check that inspects text before the text has been tokenised is answering a question about the wrong string. Decide what counts as syntax after quoting is resolved, not before.