docs: refresh mcp approvals and hooks refs

docs/cli/approvals.md

@@ -11,6 +11,8 @@ title: "approvals"
 Manage exec approvals for the **local host**, **gateway host**, or a **node host**.
 By default, commands target the local approvals file on disk. Use `--gateway` to target the gateway, or `--node` to target a specific node.
 
+Alias: `openclaw exec-approvals`
+
 Related:
 
 - Exec approvals: [Exec approvals](/tools/exec-approvals)
@@ -41,10 +43,15 @@ Precedence is intentional:
 
 ```bash
 openclaw approvals set --file ./exec-approvals.json
+openclaw approvals set --stdin <<'EOF'
+{ version: 1, defaults: { security: "full", ask: "off" } }
+EOF
 openclaw approvals set --node <id|name|ip> --file ./exec-approvals.json
 openclaw approvals set --gateway --file ./exec-approvals.json
 ```
 
+`set` accepts JSON5, not only strict JSON. Use either `--file` or `--stdin`, not both.
+
 ## "Never prompt" / YOLO example
 
 For a host that should never stop on exec approvals, set the host approvals defaults to `full` + `off`:
@@ -103,6 +110,24 @@ openclaw approvals allowlist add --agent "*" "/usr/bin/uname"
 openclaw approvals allowlist remove "~/Projects/**/bin/rg"
 ```
 
+## Common options
+
+`get`, `set`, and `allowlist add|remove` all support:
+
+- `--node <id|name|ip>`
+- `--gateway`
+- shared node RPC options: `--url`, `--token`, `--timeout`, `--json`
+
+Targeting notes:
+
+- no target flags means the local approvals file on disk
+- `--gateway` targets the gateway host approvals file
+- `--node` targets one node host after resolving id, name, IP, or id prefix
+
+`allowlist add|remove` also supports:
+
+- `--agent <id>` (defaults to `*`)
+
 ## Notes
 
 - `--node` uses the same resolver as `openclaw nodes` (id, name, ip, or id prefix).