Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

[Bug]: cron add fails with "pairing required" on local loopback mode (macOS)

Bug type

Regression (worked before, now fails)

Summary

The cron tool's add action consistently fails with gateway closed (1008): pairing required error when called from an agent session, even on a local loopback setup with proper authentication.

Affected operations:

• ‚ùå cron add (write operation) ‚Üí fails with "pairing required"
• ‚úÖ cron status (read operation) ‚Üí works
• ‚úÖ cron list (read operation) ‚Üí works

This makes it impossible to create cron jobs from the agent, CLI, or any interface, breaking a core automation feature.

Environment

• OpenClaw: 2026.4.5 (updated from 2026.4.2, bug persists)
• Node.js: v24.1.0
• OS: macOS 15.6.1 (Darwin 24.6.0, x64)
• Gateway: running as LaunchAgent
• Mode: gateway.mode: "local" (loopback 127.0.0.1)
• Auth: gateway.auth.mode: "token" (token present and valid)
• Model: anthropic/claude-sonnet-4-5

Steps to Reproduce

From agent tool

// Agent tool call (from agent session)
cron.add({
  name: "Test reminder",
  schedule: { kind: "at", at: "2026-04-06T11:50:00+02:00" },
  payload: { kind: "systemEvent", text: "Test message" },
  delivery: { mode: "announce", channel: "telegram", to: "1539169764" },
  deleteAfterRun: true
})

Result:

{
  "status": "error",
  "tool": "cron",
  "error": "gateway closed (1008): pairing required\nGateway target: ws://127.0.0.1:18789\nSource: local loopback\nConfig: /Users/needhelp/.openclaw/openclaw.json\nBind: loopback"
}

From CLI

openclaw cron add \
  --name "Test" \
  --at "2026-04-06T11:50:00+02:00" \
  --system-event "Test message" \
  --channel telegram \
  --to 1539169764 \
  --delete-after-run

Result:

gateway connect failed: GatewayClientRequestError: pairing required
Error: gateway closed (1008): pairing required
Gateway target: ws://127.0.0.1:18789
Source: local loopback
Config: /Users/needhelp/.openclaw/openclaw.json
Bind: loopback

Expected behavior

On a local loopback setup with valid token authentication, cron add should work without requiring device pairing. The agent session should have sufficient permissions for cron write operations.

Actual behavior

The Gateway rejects cron add requests with "pairing required", treating the local agent session as if it were an untrusted external device.

What we tried

1. Verified authentication

• gateway.auth.mode: "token" with valid token ‚úÖ
• Token is present and used by other tools successfully ‚úÖ
• gateway tool works (config.get, etc.) ‚úÖ

2. Updated OpenClaw

• Updated from 2026.4.2 to 2026.4.5 ‚úÖ
• Bug persists in both versions ‚ùå

3. Tested auth.mode: "none"

• Set gateway.auth.mode: "none" temporarily
• Error changed to "device identity required" ‚ùå
• Even without auth, device pairing is still required

4. Checked pairing status

• openclaw pairing list ‚Üí No pending requests
• No way to pair the local agent/CLI with the Gateway
• openclaw pairing only handles channel pairing (Telegram, etc.)

Root cause analysis

The Gateway enforces device identity verification for cron write operations, even on local loopback connections. This security layer was likely designed for remote nodes (iOS, Android) but incorrectly applies to:

• Local agent sessions (web UI)
• CLI commands from the same machine
• Local loopback WebSocket connections

There is no mechanism to pair a local agent/CLI as a "device" with the Gateway. The pairing system only covers:

• Channel DM pairing (Telegram, Discord, etc.)
• Remote node pairing (iOS, Android apps)

Impact

Severity: High — Core automation feature is completely broken.

• Cannot create any cron jobs from the agent
• Cannot create cron jobs from CLI
• No workaround available within OpenClaw
• Users must implement external scheduling systems

Related issues

• #57688 ‚Äî Same bug reported for OpenClaw 2026.3.28
• #24667 ‚Äî cron tool WebSocket pairing error
• #22275 ‚Äî gateway pairing required error on CLI spawn/cron manual runs

Workaround (external)

We built a custom reminder system using:

• Shell scripts + system cron
• Direct Telegram API calls
• JSON storage for reminder metadata

This works but bypasses OpenClaw's cron infrastructure entirely.

Script: /Users/needhelp/.openclaw/workspace/reminders/reminder-manager-cron.sh

Suggested fix

Option A: Exempt local loopback from device pairing

When gateway.mode: "local" and the connection is from 127.0.0.1, skip device identity checks for write operations. Local connections with valid auth tokens should be trusted.

Option B: Auto-pair local agent sessions

Automatically grant device identity to agent sessions initiated from the same machine as the Gateway.

Option C: Add explicit local trust mode

Add a config option like gateway.auth.trustLocal: true to explicitly allow local loopback write operations without device pairing.

Configuration

{
  "gateway": {
    "mode": "local",
    "auth": {
      "mode": "token",
      "token": "e43da50b241177e4de117dacf80308436f9212373bd7a1dc"
    }
  },
  "agents": {
    "defaults": {
      "workspace": "/Users/needhelp/.openclaw/workspace"
    },
    "list": [
      {
        "id": "main",
        "model": "anthropic/claude-sonnet-4-5"
      }
    ]
  },
  "channels": {
    "telegram": {
      "botToken": "[REDACTED]",
      "dmPolicy": "pairing",
      "allowFrom": [],
      "groupPolicy": "allowlist",
      "streaming": "partial",
      "enabled": true
    }
  }
}

Additional context

This bug makes OpenClaw's cron system unusable for standard local setups. Many users likely hit this issue but may not report it, assuming they misconfigured something.

The error message "pairing required" is misleading because there's no way to complete the pairing for local agent/CLI access.

Steps to reproduce

### From agent tool

```javascript
// Agent tool call (from agent session)
cron.add({
  name: "Test reminder",
  schedule: { kind: "at", at: "2026-04-06T11:50:00+02:00" },
  payload: { kind: "systemEvent", text: "Test message" },
  delivery: { mode: "announce", channel: "telegram", to: "1539169764" },
  deleteAfterRun: true
})

Result:

{
  "status": "error",
  "tool": "cron",
  "error": "gateway closed (1008): pairing required\nGateway target: ws://127.0.0.1:18789\nSource: local loopback\nConfig: /Users/needhelp/.openclaw/openclaw.json\nBind: loopback"
}

From CLI

openclaw cron add \
  --name "Test" \
  --at "2026-04-06T11:50:00+02:00" \
  --system-event "Test message" \
  --channel telegram \
  --to 1539169764 \
  --delete-after-run

Result:

gateway connect failed: GatewayClientRequestError: pairing required
Error: gateway closed (1008): pairing required
Gateway target: ws://127.0.0.1:18789
Source: local loopback
Config: /Users/needhelp/.openclaw/openclaw.json
Bind: loopback

### Expected behavior

local loopback setup with valid token authentication, `cron add` should work without requiring device pairing. The agent session should have sufficient permissions for cron write operations.


### Actual behavior

The Gateway rejects `cron add` requests with "pairing required", treating the local agent session as if it were an untrusted external device.


### OpenClaw version

2026.4.5

### Operating system

macOS 15.6.1 (Darwin 24.6.0, x64)

### Install method

npm

### Model

anthropic/claude-sonnet-4-5

### Provider / routing chain

openclaw -> anthropic

### Additional provider/model setup details

_No response_

### Logs, screenshots, and evidence

```shell

Impact and severity

No response

Additional information

No response