Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: openclaw status reports healthy local gateway as unreachable [2 pull requests, 2 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#51016•Fetched 2026-04-08 01:05:31
View on GitHub
Comments
2
Participants
2
Timeline
10
Reactions
0
Author
OSINTv96OSINTv96
Participants
OSINTv96OSINTv96RyceRyce
Timeline (top)
referenced ×4commented ×2cross-referenced ×2labeled ×2

openclaw status misreports a healthy local loopback gateway as unreachable when gateway.auth.token is SecretRef-backed and the CLI is already paired as an operator device.

Error Message

openclaw gateway status reported the service as loaded and running with RPC probe OK, and openclaw gateway call status succeeded, but openclaw status showed Gateway: local · ws://127.0.0.1:18789 (local loopback) · unreachable with connect failed: device identity required; gateway.auth.token SecretRef is unresolved in this command path; probing without configured auth credentials., and openclaw status --json returned "reachable": false with the same error. "error": "connect failed: device identity required; gateway.auth.token SecretRef is unresolved in this command path; probing without configured auth credentials.", "error": null,

Root Cause

openclaw status misreports a healthy local loopback gateway as unreachable when gateway.auth.token is SecretRef-backed and the CLI is already paired as an operator device.

Fix Action

Fix / Workaround

With the local patch applied, openclaw status reported the gateway as reachable and openclaw status --json returned "reachable": true, so the unpatched command should report the healthy local gateway as reachable instead of unreachable.

Affected users/systems/channels: operators using openclaw status to troubleshoot a local loopback gateway with token auth via SecretRef and a paired CLI device. Severity: false negative in the primary troubleshooting command. Frequency: observed on this machine/configuration. Consequence: a healthy gateway is reported as unreachable, which can send troubleshooting in the wrong direction and encourage manual token-export workarounds.

After a local patch to the installed dist bundle, openclaw status and openclaw status --all reported the gateway as reachable, and openclaw status --json returned: { "reachable": true, "error": null, "authWarning": null }

PR fix notes

PR #51042: fix(gateway): enable device identity for loopback probes when token SecretRef is unresolved (#51016)

Description (problem / solution / changelog)

Summary

Fixes #51016 - openclaw status misreports a healthy local loopback gateway as unreachable when gateway.auth.token is a SecretRef that cannot be resolved in the status command path.

Changes

  • Modified disableDeviceIdentity logic in probeGateway() to always enable device identity for loopback probes
  • Previously, loopback probes without explicit auth disabled device identity, causing probes to fail with 'device identity required' error
  • Now paired operator devices can authenticate via device identity even when the token SecretRef cannot be resolved

Testing

✅ Unit tests pass (5 probe tests, 11 status.gather tests)

Impact

  • Minimal change
  • No breaking changes
  • Only affects loopback probe behavior when token SecretRef is unresolved

Changed files

  • AGENTS.md (modified, +1/-0)
  • CHANGELOG.md (modified, +1/-0)
  • docs/.generated/config-baseline.json (modified, +31/-42)
  • docs/.generated/config-baseline.jsonl (modified, +21/-21)
  • docs/docs.json (modified, +1/-0)
  • docs/install/azure.md (modified, +2/-0)
  • docs/plugins/building-extensions.md (modified, +167/-150)
  • docs/plugins/sdk-migration.md (added, +144/-0)
  • docs/reference/test.md (modified, +2/-1)
  • extensions/feishu/runtime-api.ts (modified, +1/-1)
  • extensions/googlechat/runtime-api.ts (modified, +1/-1)
  • extensions/irc/src/runtime-api.ts (modified, +1/-1)
  • extensions/line/runtime-api.ts (modified, +3/-3)
  • extensions/line/src/config-adapter.ts (modified, +1/-1)
  • extensions/line/src/group-policy.ts (modified, +1/-1)
  • extensions/line/src/setup-core.ts (modified, +2/-2)
  • extensions/line/src/setup-surface.ts (modified, +2/-2)
  • extensions/mattermost/runtime-api.ts (modified, +1/-1)
  • extensions/msteams/runtime-api.ts (modified, +1/-1)
  • extensions/msteams/src/graph-upload.test.ts (modified, +1/-1)
  • extensions/msteams/src/messenger.test.ts (modified, +11/-0)
  • extensions/msteams/src/monitor-handler.file-consent.test.ts (modified, +4/-0)
  • extensions/nextcloud-talk/runtime-api.ts (modified, +1/-1)
  • extensions/nostr/runtime-api.ts (modified, +1/-1)
  • extensions/signal/src/runtime-api.ts (modified, +1/-1)
  • extensions/telegram/src/bot-message-dispatch.test.ts (modified, +35/-0)
  • extensions/telegram/src/bot-message-dispatch.ts (modified, +21/-2)
  • extensions/telegram/src/bot/delivery.replies.ts (modified, +33/-19)
  • extensions/telegram/src/bot/delivery.ts (modified, +1/-1)
  • extensions/telegram/src/lane-delivery-text-deliverer.ts (modified, +61/-25)
  • extensions/telegram/src/lane-delivery.test.ts (modified, +56/-20)
  • extensions/tlon/runtime-api.ts (modified, +1/-1)
  • extensions/twitch/runtime-api.ts (modified, +1/-1)
  • extensions/voice-call/runtime-api.ts (modified, +1/-1)
  • extensions/zalo/runtime-api.ts (modified, +1/-1)
  • extensions/zalouser/runtime-api.ts (modified, +1/-1)
  • package.json (modified, +60/-0)
  • scripts/lib/plugin-sdk-entrypoints.json (modified, +15/-0)
  • scripts/test-parallel.mjs (modified, +56/-15)
  • scripts/test-runner-manifest.mjs (modified, +15/-0)
  • src/agents/subagent-depth.test.ts (modified, +27/-0)
  • src/agents/subagent-depth.ts (modified, +2/-2)
  • src/cli/config-cli.test.ts (modified, +11/-0)
  • src/cli/config-cli.ts (modified, +4/-4)
  • src/config/paths.ts (modified, +1/-1)
  • src/cron/store.test.ts (modified, +32/-0)
  • src/cron/store.ts (modified, +2/-2)
  • src/gateway/probe.test.ts (modified, +3/-3)
  • src/gateway/probe.ts (modified, +1/-11)
  • src/infra/archive.test.ts (modified, +44/-11)
  • src/plugin-sdk/acp-runtime.ts (modified, +6/-1)
  • src/plugin-sdk/compat.ts (modified, +2/-2)
  • src/plugin-sdk/line-core.ts (modified, +1/-1)
  • src/plugin-sdk/provider-auth.ts (modified, +4/-0)
  • src/plugin-sdk/root-alias.cjs (modified, +9/-0)
  • src/plugin-sdk/root-alias.test.ts (modified, +5/-1)
  • src/plugin-sdk/runtime-api-guardrails.test.ts (modified, +2/-2)
  • src/plugin-sdk/subpaths.test.ts (modified, +0/-15)
  • src/utils/parse-json-compat.ts (added, +9/-0)
  • test/scripts/test-runner-manifest.test.ts (modified, +43/-0)
  • ui/src/ui/views/config.ts (modified, +2/-2)

PR #51172: fix(gateway): enable device identity for loopback probes when token SecretRef is unresolved (#51016)

Description (problem / solution / changelog)

Summary

Fixes #51016 - openclaw status misreports a healthy local loopback gateway as unreachable when gateway.auth.token is a SecretRef that cannot be resolved in the status command path.

Changes

  • Modified probeGateway() to always enable device identity for probes
  • This allows paired operator devices to authenticate via device identity when gateway.auth.token is a SecretRef that cannot be resolved

Testing

  • Unit tests updated and passing (5 probe tests)

Impact

  • Minimal change
  • No breaking changes

Changed files

  • src/gateway/probe.test.ts (modified, +3/-3)
  • src/gateway/probe.ts (modified, +1/-11)

Code Example

openclaw gateway status reported the service as loaded and running, with RPC probe OK.
openclaw gateway call status succeeded.

openclaw status:
Gateway: local · ws://127.0.0.1:18789 (local loopback) · unreachable
connect failed: device identity required; gateway.auth.token SecretRef is unresolved in this command path; probing without configured auth credentials.

openclaw status --json:
{
  "reachable": false,
  "error": "connect failed: device identity required; gateway.auth.token SecretRef is unresolved in this command path; probing without configured auth credentials.",
  "authWarning": null
}
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Summary

openclaw status misreports a healthy local loopback gateway as unreachable when gateway.auth.token is SecretRef-backed and the CLI is already paired as an operator device.

Steps to reproduce

  1. Configure a local loopback gateway with gateway.auth.mode="token".

  2. Store gateway.auth.token as a SecretRef via a file-backed provider.

  3. Pair the local CLI as an operator device with operator.read.

  4. Start the gateway successfully.

  5. Run openclaw status or openclaw status --json.

Expected behavior

With the local patch applied, openclaw status reported the gateway as reachable and openclaw status --json returned "reachable": true, so the unpatched command should report the healthy local gateway as reachable instead of unreachable.

Actual behavior

openclaw gateway status reported the service as loaded and running with RPC probe OK, and openclaw gateway call status succeeded, but openclaw status showed Gateway: local · ws://127.0.0.1:18789 (local loopback) · unreachable with connect failed: device identity required; gateway.auth.token SecretRef is unresolved in this command path; probing without configured auth credentials., and openclaw status --json returned "reachable": false with the same error.

OpenClaw version

2026.3.13

Operating system

macOS 26.3.1 arm64

Install method

global install under /opt/homebrew/lib/node_modules/openclaw

Model

N/A

Provider / routing chain

local CLI -> local loopback gateway (ws://127.0.0.1:18789)

Additional provider/model setup details

Repro does not require a model request. The bug occurs in the CLI status/probe path against a local loopback gateway before any provider/model routing.

Logs, screenshots, and evidence

openclaw gateway status reported the service as loaded and running, with RPC probe OK.
openclaw gateway call status succeeded.

openclaw status:
Gateway: local · ws://127.0.0.1:18789 (local loopback) · unreachable
connect failed: device identity required; gateway.auth.token SecretRef is unresolved in this command path; probing without configured auth credentials.

openclaw status --json:
{
  "reachable": false,
  "error": "connect failed: device identity required; gateway.auth.token SecretRef is unresolved in this command path; probing without configured auth credentials.",
  "authWarning": null
}

Impact and severity

Affected users/systems/channels: operators using openclaw status to troubleshoot a local loopback gateway with token auth via SecretRef and a paired CLI device. Severity: false negative in the primary troubleshooting command. Frequency: observed on this machine/configuration. Consequence: a healthy gateway is reported as unreachable, which can send troubleshooting in the wrong direction and encourage manual token-export workarounds.

Additional information

If I manually exported OPENCLAW_GATEWAY_TOKEN and reran the summary status path, the failure changed from "device identity required" to "missing scope: operator.read".

After a local patch to the installed dist bundle, openclaw status and openclaw status --all reported the gateway as reachable, and openclaw status --json returned: { "reachable": true, "error": null, "authWarning": null }

extent analysis

Fix Plan

To resolve the issue of openclaw status misreporting a healthy local loopback gateway as unreachable, we need to ensure that the gateway.auth.token SecretRef is properly resolved and used for authentication.

Here are the steps to fix the issue:

  • Update the openclaw configuration to include the gateway.auth.token SecretRef in the CLI's authentication path.
  • Ensure that the SecretRef is properly resolved and the token is exported as an environment variable.
  • Modify the openclaw status command to use the exported token for authentication.

Example code to export the token as an environment variable:

export OPENCLAW_GATEWAY_TOKEN=$(secret-ref-provider get gateway.auth.token)

Then, update the openclaw configuration to include the exported token in the authentication path:

// openclaw.config.js
module.exports = {
  // ...
  gateway: {
    auth: {
      mode: 'token',
      token: process.env.OPENCLAW_GATEWAY_TOKEN,
    },
  },
};

Verification

To verify that the fix worked, run the following commands:

  • openclaw status
  • openclaw status --json The output should indicate that the gateway is reachable:
{
  "reachable": true,
  "error": null,
  "authWarning": null
}

Extra Tips

  • Ensure that the SecretRef provider is properly configured and the token is correctly resolved.
  • Consider adding additional logging or debugging statements to the openclaw configuration to help troubleshoot any future issues.
  • If using a CI/CD pipeline, consider adding automated tests to verify the openclaw status command is working correctly.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

With the local patch applied, openclaw status reported the gateway as reachable and openclaw status --json returned "reachable": true, so the unpatched command should report the healthy local gateway as reachable instead of unreachable.

#api#ssr#installation#tensor shape#autograd error#authentication setup#request error#file not found#serialization error#model compatibility

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING