fix(permissions): add tool name aliases + approval bridge in always_ask

Two fixes for the always_ask flow:
1. Tool name alias: OpenClaw normalizes "bash" to "exec" internally.
   The confirm-tools plugin now expands common aliases so both the
   user-facing name and the internal name are matched.
2. WS approval bridge: executeInBackground now subscribes to
   plugin.approval.requested on the container's WS client when the
   agent has always_ask policy. Pending approvals are stored in a
   per-session Map and emitted as agent.tool_confirmation_request
   SSE events on each poll tick and heartbeat.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stainlu

docker/confirm-tools-plugin/index.js

@@ -13,9 +13,18 @@ import { definePluginEntry } from "openclaw/plugin-sdk/core";
 
 const raw = (process.env.OPENCLAW_CONFIRM_TOOLS || "").trim();
 const confirmAll = raw === "__ALL__";
-const confirmTools = confirmAll
+
+// OpenClaw normalizes tool names internally: "bash" becomes "exec",
+// "apply-patch" becomes "apply_patch", etc. The hook receives the
+// normalized name, so we expand common aliases to match both forms.
+const ALIASES = { bash: "exec", "apply-patch": "apply_patch" };
+const rawTools = confirmAll
   ? []
   : raw.split(",").map((t) => t.trim()).filter(Boolean);
+const confirmTools = [
+  ...rawTools,
+  ...rawTools.map((t) => ALIASES[t]).filter(Boolean),
+];
 
 export default definePluginEntry({
   id: "confirm-tools",