openclaw - 💡(How to fix) Fix CLI 'devices approve' fails with 'missing scope: operator.talk.secrets' when Android app requests talk.secrets [1 participants]

Bug type

Behavior bug (incorrect output/state without crash)

Summary

openclaw devices approve fails with missing scope: operator.talk.secrets when trying to approve an Android app pairing request that includes the operator.talk.secrets scope.

The CLI itself fails to start — the error occurs before the approve command runs, likely during CLI startup when talk.config(includeSecrets: true) is called.

openclaw devices list works fine (read-only, no talk.secrets needed).

Steps to reproduce

1. Install OpenClaw Android app (2026.3.29) and pair via Tailscale Serve
2. Android app requests scopes: operator.read, operator.write, operator.talk.secrets
3. openclaw devices list shows the pending request correctly
4. openclaw devices approve <requestId> fails immediately:

[openclaw] Failed to start CLI: GatewayClientRequestError: missing scope: operator.talk.secrets
  at GatewayClient.handleMessage (...)

1. openclaw devices approve --latest also fails with same error
2. Providing explicit --token also fails

Expected behavior

openclaw devices approve should work. The CLI connects with operator.admin scope, and operatorScopeSatisfied() in pairing-token should treat operator.admin as covering all operator.* scopes including operator.talk.secrets.

Actual behavior

The CLI fails to start before reaching the approve logic. The error appears to originate from a talk.config method call during CLI initialization that checks canReadTalkSecrets(client) against client.connect.scopes.

Analysis

• operatorScopeSatisfied() correctly returns true when operator.admin is in the granted set
• But the error suggests client.connect.scopes does not contain operator.admin at the point where talk.config(includeSecrets: true) is called during CLI startup
• devices list works because it does not trigger talk.config with includeSecrets

Environment

• OpenClaw: 2026.4.2 (d74a122) — also reproduced on 2026.4.1
• OS: macOS 15 (Apple M4 Pro)
• Gateway: local loopback, Tailscale Serve
• Auth: token
• Android app: 2026.3.29, Samsung SM-F968N, Android 16 (SDK 36)

Workaround

None found through supported CLI paths. Manual JSON file manipulation (moving pending to paired) works but is not a proper fix.