Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

Despite PR #22280 being merged (which fixes "Local paired-device scope upgrades can require interactive pairing"), the issue persists on OpenClaw 2026.4.25 with a VPS/lan bind configuration.

Steps to reproduce

1. Install OpenClaw (if not already):

   npm install -g [email protected]
   openclaw --version  # Should show: 2026.4.25 (aa36ee6)

2. Configure gateway with lan bind: Edit ~/.openclaw/openclaw.json:

   {
     "gateway": {
       "mode": "local",
       "auth": {
         "mode": "token",
         "token": "any-token-here"
       },
       "port": 18789,
       "bind": "lan",
       "nodes": {
         "denyCommands": [],
         "allowCommands": ["sessions.spawn"],
         "pairing": {
           "autoApproveCidrs": ["127.0.0.1/8", "0.0.0.0/0"]
         }
       }
     }
   }

3. Start gateway:

   openclaw gateway restart
   # Verify: openclaw gateway probe (shows "Reachable: yes")

4. Attempt any scope-requiring command:

   openclaw cron list
   # OR: openclaw agents spawn --task "test"
   # OR: openclaw sessions spawn --task "test"

5. Observe error:

   • Expected: Command executes successfully
   • Actual: Error: scope upgrade pending approval / pairing required

Environment Verification

# Confirm versions
openclaw --version  # 2026.4.25 (aa36ee6)

# Confirm gateway is reachable
openclaw gateway probe
# Output shows: Reachable: yes, but scope commands fail

# Confirm config is loaded
grep -A5 '"allowCommands"' ~/.openclaw/openclaw.json
# Should show: ["sessions.spawn", ...]

Alternative: Quick Test Script

#!/bin/bash
# save as: test-scope.sh
openclaw gateway restart
sleep 3
openclaw cron list 2>&1 | grep -E "(scope|pairing|Error)" && echo "BUG REPRODUCED" || echo "WORKING"

Run: chmod +x test-scope.sh && ./test-scope.sh

Expected behavior

Per PR #22280, local paired-device scope upgrades should silently auto-approve when:

• Device has existing paired-device context
• Connection is local (127.0.0.1/localhost)
• Using allowCommands + autoApproveCidrs configuration

Actual behavior

Persistent "scope upgrade pending approval" error preventing sessions.spawn and related commands.

OpenClaw version

2026.4.25 (aa36ee6)

Operating system

Ubuntu 24.04.4 LTS

Install method

npm/pnpm

Model

ollama/kimi-k2.5:cloud

Provider / routing chain

openclaw -> ollama -> kimi-k2.5

Additional provider/model setup details

Environment

• OpenClaw Version: 2026.4.25 (aa36ee6)
• OS: Ubuntu 24.04.4 LTS
• Install Method: npm/pnpm
• Gateway Bind: lan (0.0.0.0:18789)
• Auth Mode: token

Error Message

gateway connect failed: GatewayClientRequestError: scope upgrade pending approval (requestId: ...)
Error: gateway closed (1008): pairing required: device is asking for more scopes than currently approved

Configuration

gateway.nodes

"nodes": {
  "denyCommands": [
    "camera.list",
    "screen.capture",
    "contacts.list",
    "sms.list"
  ],
  "allowCommands": [
    "sessions.spawn",
    "sessions.list",
    "sessions.send",
    "exec.run",
    "exec.spawn"
  ],
  "pairing": {
    "autoApproveCidrs": [
      "127.0.0.1/8",
      "0.0.0.0/0"
    ]
  },
  "trust": "permissive"
}

session.dmScope

Tried both "per-channel-peer" and "permissive".

What We've Tried

• Added allowCommands to gateway.nodes (via Control UI and manual edit)
• Added pairing.autoApproveCidrs with 127.0.0.1/8 and 0.0.0.0/0
• Changed session.dmScope to "permissive"
• Tried auth.mode: "none" (caused gateway crash, reverted)
• Made config file immutable with chattr +i (prevented reverting)
• Verified config persists after restarts
• Gateway runs and listens on port 18789
• Tried /pair command (gives iOS pairing code, not applicable)
• Verified with openclaw gateway probe — gateway reachable but scope blocked

Related Issues/PRs

• Issue #22279: "Local paired-device scope upgrades can require interactive pairing instead of silent approval"
• PR #22280: "Fix local paired-device reconnect regressions where role/scope upgrades could return pairing required"

Impact

• Severity: Medium-High (blocks multi-agent workflows)
• Workaround: None for sessions.spawn
• Mitigation: Trading scripts run independently (don't need gateway)
• Use Case Affected: VPS deployments with bind: "lan" for remote access

Hypothesis

PR #22280 may not cover the bind: "lan" case (0.0.0.0:18789), only bind: "loopback". The VPS configuration with lan binding may be treated differently than true localhost.

Request

1. Confirm if PR #22280 covers bind: "lan" configurations
2. Advise on additional configuration needed for VPS/lan deployments
3. Or confirm if this is a regression requiring additional fix

Logs, screenshots, and evidence

Impact and severity

Affected: VPS and remote server deployments using gateway bind: "lan" (0.0.0.0:18789). Primarily affects users running OpenClaw on cloud servers with remote SSH access. Does NOT affect standard localhost/loopback installations. Severity: Blocks workflow Frequency: Always (for affected lan bind configurations) Consequence: Cannot spawn subagents/sessions via sessions.spawn, preventing multi-agent workflows, real-time agent delegation, and advanced automation patterns. Forces workaround using Oracle CLI or direct script execution instead of native OpenClaw agent spawning.

Additional information

NOT_ENOUGH_INFO