fix(openclaw): allow xai-x-search, xai-web-search and WebFetch via ConfigMap

[boxp]

daily-morning-trend-research cron が 6日間連続で承認ブロックされ機能停止していた問題を修正。settings.json を ConfigMap として外部化し必要な権限を静的に定義。前案では deployment の起動スクリプトに node -e でインラインJS を埋め込み settings.json を動的パッチしていたが責務過剰かつ不透明だった。ConfigMap-only に変更: configmap-claude-settings.yaml (新規) で settings.json 全内容を静的定義し volumeMount(subPath) でマウント。node -e パッチ削除。settings.json は静的設定であり動的処理不要なため ConfigMap-only で成立する。Codex レビュー OK。Generated with Claude Code

[github-actions]

ArgoCD Diff Result

Auth path: tailscale

アプリケーション: openclaw の差分

パス: argoproj/openclaw

===== apps/Deployment openclaw/openclaw ======
713a714,737
>           # Patch settings.json to allow cron-invoked skills (xai-x-search,
>           # xai-web-search) and WebFetch so daily-morning-trend-research
>           # is not blocked by approval prompts.
>           node -e "
>             const fs = require('fs');
>             const p = '/home/node/.claude/settings.json';
>             try {
>               const s = JSON.parse(fs.readFileSync(p, 'utf8'));
>               const add = [
>                 'Bash(bash /home/node/.claude/skills/xai-x-search/scripts/search.sh *)',
>                 'Bash(bash /home/node/.claude/skills/xai-web-search/scripts/search.sh *)',
>                 'WebFetch'
>               ];
>               s.permissions = s.permissions || {};
>               s.permissions.allow = s.permissions.allow || [];
>               const before = JSON.stringify(s);
>               add.forEach(t => { if (!s.permissions.allow.includes(t)) s.permissions.allow.push(t); });
>               if (JSON.stringify(s) !== before) {
>                 fs.writeFileSync(p, JSON.stringify(s, null, 2) + '\n');
>               }
>             } catch (e) {
>               console.error('settings.json patch skipped:', e.message);
>             }
>           "
ℹ️ 上記の差分が見つかりました

[github-actions]

ArgoCD Diff Result

Auth path: tailscale

アプリケーション: openclaw の差分

パス: argoproj/openclaw

===== apps/Deployment openclaw/openclaw ======
704c704
<           # and settings.json (trustedWorkspaces, allowedCommands).
---
>           # and ConfigMap-mounted settings.json.
846a847,850
>         - mountPath: /home/node/.claude/settings.json
>           name: claude-settings
>           readOnly: true
>           subPath: settings.json
1116a1121,1124
>       - configMap:
>           defaultMode: 420
>           name: claude-settings
>         name: claude-settings

===== /ConfigMap openclaw/claude-settings ======
0a1,64
> apiVersion: v1
> data:
>   settings.json: |
>     {
>       "permissions": {
>         "defaultMode": "acceptEdits",
>         "allow": [
>           "Read",
>           "Glob",
>           "Grep",
>           "Bash(git *)",
>           "Bash(gh *)",
>           "Bash(ghq *)",
>           "Bash(gwq *)",
>           "Bash(mkdir *)",
>           "Bash(touch *)",
>           "Bash(cp *)",
>           "Bash(mv *)",
>           "Bash(rm *)",
>           "Bash(ls *)",
>           "Bash(cat *)",
>           "Bash(head *)",
>           "Bash(tail *)",
>           "Bash(find *)",
>           "Bash(grep *)",
>           "Bash(sed *)",
>           "Bash(awk *)",
>           "Bash(sort *)",
>           "Bash(uniq *)",
>           "Bash(wc *)",
>           "Bash(diff *)",
>           "Bash(chmod *)",
>           "Bash(ln *)",
>           "Bash(curl *)",
>           "Bash(tar *)",
>           "Bash(xargs *)",
>           "Bash(dirname *)",
>           "Bash(basename *)",
>           "Bash(tee *)",
>           "Bash(codex *)",
>           "Bash(docker *)",
>           "Bash(bb *)",
>           "Bash(man *)",
>           "Bash(apt-get *)",
>           "Bash(apt *)",
>           "Bash(bash /home/node/.claude/skills/xai-x-search/scripts/search.sh *)",
>           "Bash(bash /home/node/.claude/skills/xai-web-search/scripts/search.sh *)",
>           "WebFetch",
>           "mcp__grafana__*"
>         ]
>       },
>       "mcpServers": {
>         "grafana": {
>           "command": "mcp-grafana",
>           "args": ["--transport", "stdio", "--disable-write"]
>         }
>       }
>     }
> kind: ConfigMap
> metadata:
>   annotations:
>     argocd.argoproj.io/tracking-id: openclaw:/ConfigMap:openclaw/claude-settings
>   name: claude-settings
>   namespace: openclaw
ℹ️ 上記の差分が見つかりました