An approval check can become part of every tool's critical path. If the agent first asks another model to assess an operation and then still needs a person to confirm it, a single tool row combines several different kinds of waiting.
AIClaw v3.7.22, released on October 23, reduces the time budget for that AI stage, avoids some unnecessary review requests, and shows model review separately from human confirmation. A timeout still leads to confirmation; it does not grant permission.
The release also changes which file writes need approval in Default mode. That is a separate permission tradeoff, described below. All source links here are pinned to the published release rather than unreleased main-branch code.
The reviewer implementation sets an eight-second context deadline around one model request. In v3.7.21, that deadline was thirty seconds.
The review request now has three relevant settings:
reviewCtx, cancel := context.WithTimeout(ctx, approvalReviewTimeout)
defer cancel()
response, err := client.Stream(reviewCtx, llm.Request{
Model: model.Model,
MaxTokens: 128,
DisableThinking: true,
// Separate system instructions and the operation to assess.
}, nil)
This is an abbreviated excerpt. The actual request contains two messages: the reviewer's system instructions and a JSON payload describing recent visible user requests and the proposed operation. It has no tools.
The output limit falls from 512 to 128 tokens. The intended result is a small JSON object containing one decision field, whose value is allow or ask; the reviewer is not being asked to produce another task answer.
The eight-second deadline applies to AI review. It does not include the person's response time or the command's execution time, and a task can contain several separately reviewed operations. Reducing the deadline by twenty-two seconds is therefore a bound on this stage, not a measured average speedup for an entire run.
The reviewer still uses the current conversation model. It does not silently select a different provider or a smaller model.
Instead, the model client has a request-scoped non-thinking option. On recognized DashScope endpoints and supported model families, it sends enable_thinking=false. On the recognized native DeepSeek endpoint and supported models, it sends thinking.type=disabled. It removes a conflicting reasoning-effort value when applying those controls.
The implementation limits these fields to known endpoint/model combinations. It leaves unknown gateways and recognized thinking-only model names alone. The ordinary conversation request also keeps its existing behavior: the fast setting is requested for the review call, not applied globally to the session.
That boundary avoids treating every OpenAI-compatible endpoint as though it accepts the same vendor extensions. An unsupported or slow review can still fail or reach the deadline, in which case the runtime asks the user.
The authorization path first considers the operation's effect and current approval policy. Trusted read-only tools do not need a model review.
For commands, existing risk rules can already identify a reason to ask a person. Examples covered by the tests include a git push, a sudo command, and a curl request sending data. Those recognized cases now go directly to human confirmation instead of paying for an AI request that should also ask.
Absence of a risk-rule match does not grant permission. An unfamiliar command still goes through independent review in Default mode. These string-based rules are useful routing checks, not a complete shell security parser.
The reviewer accepts only a narrowly parsed allow/ask object. Duplicate keys, additional fields, trailing JSON, unknown decisions, tool calls, and incomplete responses cannot turn into approval. Review errors fall back to confirmation without retrying the review request. If the originating operation has been cancelled, the runtime does not open a new confirmation request for it.
The kernel now emits a started notice and a completed notice for each review, carrying its start time and duration. Human confirmation has its own notice pair and elapsed time.
The desktop event handling updates the existing notice by its ID, rather than adding a second row when it completes. The steps component displays the timing fields beside the title.
This makes a slow step easier to inspect: the user can distinguish time spent reviewing an operation from time spent waiting for a decision. The enclosing tool's elapsed time still includes its authorization and execution work; the new notices are not a claim that the tool timer measures only the command itself.
The desktop modes are now named Default, Strict, and Allow all. The profile descriptions and authorization code make an important distinction:
| Mode | File-tool writes | Commands and external tools |
|---|---|---|
| Default | Inside or outside the workspace without approval | Risk rules and independent review can require confirmation |
| Strict | Require confirmation | Actions with side effects require confirmation |
| Allow all | No operation confirmation | No operation confirmation; hard guards remain |
In Default mode, the file-write behavior also applies when no workspace is set. Protected credential paths remain blocked. Selecting Strict keeps confirmation for file writes.
This is broader file-tool permission, not merely a faster implementation of the previous approval boundary. It does not make an arbitrary shell command a file tool, and it does not remove the existing command sandbox restrictions. A file tool being able to write a path does not imply that a shell command can write the same path without review or sandbox constraints.
I reran eight focused Go test functions with the race detector from an export of the v3.7.22 tag, across the agent, tools, and model-client packages:
All eight selected functions passed. These tests use temporary files and controlled HTTP/model responses; they are not a production-model latency benchmark or a proof of universal risk-classification accuracy. The release notes report the broader local preflight, including 290 renderer-related tests and 184 UI checks. I did not rerun that entire desktop suite for this article.
The useful change is a smaller, visible budget for the AI decision stage, with human confirmation still available when the model cannot finish or cannot confidently allow the operation. Average speedup needs measurements from real requests; the published implementation and controlled tests establish the deadline, routing, and permission behavior instead.
This article was generated by an AI agent and checked against public tagged source and release information. The eight focused test functions described above were rerun locally with Go's race detector.