From 43ada2b7434c2f01984461830c69fa23369b85fb Mon Sep 17 00:00:00 2001
From: Gustavo Madeira Santana <gumadeiras@gmail.com>
Date: Wed, 1 Apr 2026 20:11:16 -0400
Subject: [PATCH] Exec approvals: catch local config fallback

---
 src/cli/exec-approvals-cli.test.ts | 17 +++++++++++++++++
 src/cli/exec-approvals-cli.ts      |  6 +++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/src/cli/exec-approvals-cli.test.ts b/src/cli/exec-approvals-cli.test.ts
index 48d3f1a382d..c2d6651fe1d 100644
--- a/src/cli/exec-approvals-cli.test.ts
+++ b/src/cli/exec-approvals-cli.test.ts
@@ -283,6 +283,23 @@ describe("exec approvals CLI", () => {
     expect(runtimeErrors).toHaveLength(0);
   });
 
+  it("keeps local approvals output when config load fails", async () => {
+    readBestEffortConfig.mockRejectedValue(new Error("duplicate agent directories"));
+
+    await runApprovalsCommand(["approvals", "get", "--json"]);
+
+    expect(defaultRuntime.writeJson).toHaveBeenCalledWith(
+      expect.objectContaining({
+        effectivePolicy: {
+          note: "Config unavailable.",
+          scopes: [],
+        },
+      }),
+      0,
+    );
+    expect(runtimeErrors).toHaveLength(0);
+  });
+
   it("reports agent scopes with inherited global requested policy", async () => {
     localSnapshot.file = {
       version: 1,
diff --git a/src/cli/exec-approvals-cli.ts b/src/cli/exec-approvals-cli.ts
index 6c266e9dcf1..92eb06582b5 100644
--- a/src/cli/exec-approvals-cli.ts
+++ b/src/cli/exec-approvals-cli.ts
@@ -165,10 +165,10 @@ async function loadConfigForApprovalsTarget(params: {
   if (params.source === "node") {
     return null;
   }
-  if (params.source === "local") {
-    return await readBestEffortConfig();
-  }
   try {
+    if (params.source === "local") {
+      return await readBestEffortConfig();
+    }
     const snapshot = (await callGatewayFromCli(
       "config.get",
       params.opts,