diff --git a/src/agents/bash-tools.exec-runtime.ts b/src/agents/bash-tools.exec-runtime.ts
index b8721d12e45..4f1d0469afd 100644
--- a/src/agents/bash-tools.exec-runtime.ts
+++ b/src/agents/bash-tools.exec-runtime.ts
@@ -254,7 +254,11 @@ export function resolveExecTarget(params: {
   }
   const selectedTarget = requestedTarget ?? configuredTarget;
   const effectiveHost =
-    selectedTarget === "auto" ? (params.sandboxAvailable ? "sandbox" : "gateway") : selectedTarget;
+    selectedTarget === "auto"
+      ? params.sandboxAvailable
+        ? "sandbox"
+        : "gateway"
+      : selectedTarget;
   return {
     configuredTarget,
     requestedTarget,
diff --git a/src/agents/bash-tools.exec.ts b/src/agents/bash-tools.exec.ts
index 7010be52272..1c6b4270d40 100644
--- a/src/agents/bash-tools.exec.ts
+++ b/src/agents/bash-tools.exec.ts
@@ -1,7 +1,12 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import type { AgentTool, AgentToolResult } from "@mariozechner/pi-agent-core";
-import { type ExecHost, loadExecApprovals, maxAsk, minSecurity } from "../infra/exec-approvals.js";
+import {
+  type ExecHost,
+  loadExecApprovals,
+  maxAsk,
+  minSecurity,
+} from "../infra/exec-approvals.js";
 import { resolveExecSafeBinRuntimePolicy } from "../infra/exec-safe-bin-runtime-policy.js";
 import { sanitizeHostExecEnvWithDiagnostics } from "../infra/host-env-security.js";
 import {
diff --git a/src/gateway/sessions-patch.ts b/src/gateway/sessions-patch.ts
index a0c3cb3553b..be8b6db6abb 100644
--- a/src/gateway/sessions-patch.ts
+++ b/src/gateway/sessions-patch.ts
@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { resolveDefaultAgentId } from "../agents/agent-scope.js";
 import type { ModelCatalogEntry } from "../agents/model-catalog.js";
+import { normalizeExecTarget } from "../infra/exec-approvals.js";
 import {
   resolveAllowedModelRef,
   resolveDefaultModelForAgent,
@@ -19,7 +20,6 @@ import {
 } from "../auto-reply/thinking.js";
 import type { OpenClawConfig } from "../config/config.js";
 import type { SessionEntry } from "../config/sessions.js";
-import { normalizeExecTarget } from "../infra/exec-approvals.js";
 import {
   isAcpSessionKey,
   isSubagentSessionKey,