openclaw - ✅(Solved) Fix [Bug]: macOS App node repeatedly disconnects with "cancelled" while CLI node works [1 pull requests, 2 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#74848Fetched 2026-05-01 05:40:45
View on GitHub
Comments
2
Participants
2
Timeline
8
Reactions
2
Author
Timeline (top)
commented ×2labeled ×2cross-referenced ×1mentioned ×1

When running OpenClaw macOS App in remote mode, the app successfully connects the control channel, but the mac node repeatedly fails with: mac node disconnected: connect failed: connect to gateway @ wss://oc.xxx.xyz: cancelled

Meanwhile, a CLI node (openclaw node run) on the same environment works correctly and registers without issues.

Error Message

2026-04-30 12:23:52.591329+0800 0xf0921 Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node disconnected: connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:23:52.591353+0800 0xf0921 Error 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway ws connect failed connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:23:52.591405+0800 0xecf7e Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node gateway connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:03.230932+0800 0xef1b4 Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node disconnected: connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:03.230951+0800 0xef1b4 Error 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway ws connect failed connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:03.234473+0800 0xecf7e Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node gateway connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:16.408010+0800 0xf0e4d Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node disconnected: connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:16.408032+0800 0xf0e4d Error 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway ws connect failed connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:16.408091+0800 0xecf7e Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node gateway connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:19.181938+0800 0xef1b4 Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node disconnected: connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:19.181963+0800 0xef1b4 Error 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway ws connect failed connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:19.181982+0800 0xef1b4 Error 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway watchdog reconnect failed gateway watchdog reconnect: connect to gateway @ wss://oc. .xyz: cancelled

Root Cause

When running OpenClaw macOS App in remote mode, the app successfully connects the control channel, but the mac node repeatedly fails with: mac node disconnected: connect failed: connect to gateway @ wss://oc.xxx.xyz: cancelled

Meanwhile, a CLI node (openclaw node run) on the same environment works correctly and registers without issues.

Fix Action

Fixed

PR fix notes

PR #75228: fix(macos): auto-repair stale gateway TLS pins on system-trusted hosts (#74848)

Description (problem / solution / changelog)

Summary

The macOS companion app pins gateway TLS leaf fingerprints with required: true. Until now, auto-repair of a stale pin only ran for loopback and .ts.net hosts (added in #75038). For any other wss:// host — e.g. a self-hosted gateway behind a public ACME-issued cert that just rotated — the companion app sat in a permanent reconnect loop emitting mac node disconnected: connect failed: connect to gateway @ wss://… : cancelled, while the CLI node on the same host connected fine because the CLI uses the default URLSession with no pinning (apps/macos/Sources/OpenClawMacCLI/ConnectCommand.swift:137).

This PR extends shouldAutoRepairStaleTLSPin to allow self-healing on any wss:// host whose new cert chain still validates against the system trust store. Self-signed / private-CA scenarios are unaffected because failure.systemTrustOk is false for them, so the strict path keeps protecting development setups and intentionally pinned private gateways.

Rationale matches the existing .ts.net carve-out: the system trust store is the primary defense against MitM; the pin is a secondary check, and a mismatch under valid system trust is overwhelmingly a legitimate cert rotation rather than an attack.

Fixes #74848.

Changes

  • apps/macos/Sources/OpenClaw/NodeMode/MacNodeModeCoordinator.swift — collapse the loopback / .ts.net allowlist into a single failure.systemTrustOk check (loopback still passes since loopback challenges yield systemTrustOk == true for an OS-trusted local cert; self-signed loopback still requires the explicit untrusted path which remains rejected).
  • apps/macos/Tests/OpenClawIPCTests/MacNodeModeCoordinatorTests.swift — add auto repairs trusted public host pin mismatch; flip does not auto repair untrusted remote pin mismatch to systemTrustOk: false to match the new policy boundary. Existing loopback / .ts.net / storeKey / scheme guards remain covered.
  • CHANGELOG.md### Fixes entry.

3 files, +24 / −15.

Security note

Pin auto-repair still requires:

  1. failure.kind == .pinMismatch (not untrustedCertificate or certificateUnavailable)
  2. url.scheme == wss
  3. failure.storeKey matches the URL's pin store key
  4. failure.systemTrustOk == true
  5. The observed fingerprint hasn't been auto-repaired on this run already (per-storeKey deduplication via autoRepairedTLSFingerprintsByStoreKey)

Self-signed gateways, private-CA gateways, and any host whose new chain fails system trust still hit the strict failure path with no auto-repair.

Test plan

  • New unit tests in MacNodeModeCoordinatorTests cover the trusted-public-host repair path and the untrusted-host strict path.
  • Manual: connect macOS companion to a wss:// gateway, rotate its public cert, observe the next reconnect cycle replaces the stale pin and continues without falling into the cancelled loop.
  • Manual: connect to a self-signed dev gateway with a stored fingerprint, confirm a deliberate fingerprint mismatch still surfaces a TLS certificate pin mismatch error and is not auto-repaired.

Changed files

  • CHANGELOG.md (modified, +1/-0)
  • apps/macos/Sources/OpenClaw/NodeMode/MacNodeModeCoordinator.swift (modified, +17/-3)
  • apps/macos/Sources/OpenClaw/OpenClawConfigFile.swift (modified, +15/-0)
  • apps/macos/Tests/OpenClawIPCTests/MacNodeModeCoordinatorTests.swift (modified, +33/-1)

Code Example

openclaw node run --host oc.xxx.xyz --port 443 --tls

---

[ai.openclaw:mac-node] mac node disconnected: connect failed: connect to gateway @ wss://oc.xxx.xyz: cancelled
[ai.openclaw:gateway] gateway ws connect failed connect to gateway @ wss://oc.xxx.xyz: cancelled
[ai.openclaw:gateway] gateway watchdog reconnect failed ...

---
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

When running OpenClaw macOS App in remote mode, the app successfully connects the control channel, but the mac node repeatedly fails with: mac node disconnected: connect failed: connect to gateway @ wss://oc.xxx.xyz: cancelled

Meanwhile, a CLI node (openclaw node run) on the same environment works correctly and registers without issues.

Steps to reproduce

2026-04-30 12:23:52.040716+0800 0xef1b2 Info 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway connect auth=shared-token 2026-04-30 12:23:52.591329+0800 0xf0921 Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node disconnected: connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:23:52.591353+0800 0xf0921 Error 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway ws connect failed connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:23:52.591405+0800 0xecf7e Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node gateway connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:02.628139+0800 0xef1b2 Info 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway connect auth=shared-token 2026-04-30 12:24:03.230932+0800 0xef1b4 Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node disconnected: connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:03.230951+0800 0xef1b4 Error 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway ws connect failed connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:03.234473+0800 0xecf7e Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node gateway connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:13.277514+0800 0xf0921 Info 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway connect auth=shared-token 2026-04-30 12:24:16.408010+0800 0xf0e4d Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node disconnected: connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:16.408032+0800 0xf0e4d Error 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway ws connect failed connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:16.408091+0800 0xecf7e Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node gateway connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:18.560154+0800 0xf0e4d Info 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway connect auth=shared-token 2026-04-30 12:24:19.181938+0800 0xef1b4 Error 0x0 72764 0 OpenClaw: [ai.openclaw:mac-node] mac node disconnected: connect failed: connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:19.181963+0800 0xef1b4 Error 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway ws connect failed connect to gateway @ wss://oc. .xyz: cancelled 2026-04-30 12:24:19.181982+0800 0xef1b4 Error 0x0 72764 0 OpenClaw: [ai.openclaw:gateway] gateway watchdog reconnect failed gateway watchdog reconnect: connect to gateway @ wss://oc. .xyz: cancelled

Expected behavior

Control channel connects successfully: App shows: Connected with gateway token WebSocket is working (verified via browser devtools, returns 101)

CLI node works perfectly:

openclaw node run --host oc.xxx.xyz --port 443 --tls Node registers and executes tasks normally

Actual behavior

What works

  • Control channel connects successfully:

    • App shows: Connected with gateway token
  • WebSocket is working (verified via browser devtools, returns 101)

  • CLI node works perfectly:

    openclaw node run --host oc.xxx.xyz --port 443 --tls
    • Node registers and executes tasks normally

What does NOT work

  • macOS App node never stays connected
  • Repeated logs:
[ai.openclaw:mac-node] mac node disconnected: connect failed: connect to gateway @ wss://oc.xxx.xyz: cancelled
[ai.openclaw:gateway] gateway ws connect failed connect to gateway @ wss://oc.xxx.xyz: cancelled
[ai.openclaw:gateway] gateway watchdog reconnect failed ...

OpenClaw version

2026.4。27

Operating system

macos 26.3

Install method

mac app

Model

kimi2

Provider / routing chain

openclaw -zai code

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response

extent analysis

TL;DR

The macOS App node fails to stay connected to the gateway due to a connection failure, while the control channel and CLI node work correctly, suggesting a potential issue with the WebSocket connection or node configuration.

Guidance

  • Verify the WebSocket connection settings and ensure they match between the macOS App and CLI node.
  • Check the gateway configuration and logs for any errors or discrepancies that might be causing the connection failure.
  • Compare the connection parameters used by the CLI node (--host oc.xxx.xyz --port 443 --tls) with those used by the macOS App to identify any potential differences.
  • Investigate the gateway watchdog reconnect failed error to determine if it's related to the connection issue.

Example

No code example is provided as the issue seems to be related to configuration or connection settings rather than code.

Notes

The issue might be specific to the macOS App or the environment it's running in, as the CLI node works correctly. Further investigation into the App's configuration and the gateway settings is needed to resolve the issue.

Recommendation

Apply a workaround by verifying and adjusting the WebSocket connection settings and gateway configuration to match the working CLI node setup, as the root cause of the issue is not immediately clear and may require further debugging.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Control channel connects successfully: App shows: Connected with gateway token WebSocket is working (verified via browser devtools, returns 101)

CLI node works perfectly:

openclaw node run --host oc.xxx.xyz --port 443 --tls Node registers and executes tasks normally

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: macOS App node repeatedly disconnects with "cancelled" while CLI node works [1 pull requests, 2 comments, 2 participants]