Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [2026.5.2 Regression] CLI device lacks operator.admin, creating approval deadlock [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#77195•Fetched 2026-05-05 05:51:15
View on GitHub
Comments
1
Participants
2
Timeline
2
Reactions
2
Author
wyh757787026wyh757787026
Participants
clawsweeper[bot]clawsweeper[bot]wyh757787026wyh757787026
Timeline (top)
closed ×1commented ×1

After upgrading to OpenClaw 2026.5.2 (also affects 2026.3.13+), the CLI device is paired with only operator.pairing scope. This creates a deadlock: you cannot approve new devices because openclaw devices approve requires operator.admin, but you cannot gain operator.admin because you cannot run devices approve.

This is a regression — previous versions worked correctly.

Error Message

  1. Error: GatewayClientRequestError: missing scope: operator.admin

Root Cause

The CLI device in paired.json only has:

"scopes": ["operator.pairing"],
"approvedScopes": ["operator.pairing"]

The gateway.operators config does not seem to grant operator.admin to the CLI device. This creates a chicken-and-egg problem:

  • Need operator.admin to approve devices
  • Need to approve devices to get operator.admin

Fix Action

Workaround

Manually edit ~/.openclaw/devices/paired.json to add full scopes:

"scopes": [
  "operator.admin",
  "operator.read",
  "operator.write",
  "operator.approvals",
  "operator.pairing"
],
"approvedScopes": [
  "operator.admin",
  "operator.read",
  "operator.write",
  "operator.approvals",
  "operator.pairing"
]

Then restart gateway.

Code Example

"scopes": ["operator.pairing"],
"approvedScopes": ["operator.pairing"]

---

"scopes": [
  "operator.admin",
  "operator.read",
  "operator.write",
  "operator.approvals",
  "operator.pairing"
],
"approvedScopes": [
  "operator.admin",
  "operator.read",
  "operator.write",
  "operator.approvals",
  "operator.pairing"
]
RAW_BUFFERClick to expand / collapse

Description

After upgrading to OpenClaw 2026.5.2 (also affects 2026.3.13+), the CLI device is paired with only operator.pairing scope. This creates a deadlock: you cannot approve new devices because openclaw devices approve requires operator.admin, but you cannot gain operator.admin because you cannot run devices approve.

This is a regression — previous versions worked correctly.

Environment

  • OpenClaw 2026.5.2
  • Linux (x64), Node v25.9.0
  • Gateway: bind: loopback (127.0.0.1:18789)
  • Auth: mode: token
  • Fresh install

Reproduction

  1. Fresh install OpenClaw 2026.5.2
  2. Complete onboarding/wizard
  3. A device requests pairing (e.g., Control UI webchat)
  4. Run openclaw devices approve <device-id>
  5. Error: GatewayClientRequestError: missing scope: operator.admin

Root Cause Analysis

The CLI device in paired.json only has:

"scopes": ["operator.pairing"],
"approvedScopes": ["operator.pairing"]

The gateway.operators config does not seem to grant operator.admin to the CLI device. This creates a chicken-and-egg problem:

  • Need operator.admin to approve devices
  • Need to approve devices to get operator.admin

Expected Behavior

One of the following should work:

  1. CLI device automatically gets operator.admin (like previous versions)
  2. gateway.operators config grants admin scope to listed users
  3. openclaw devices approve should not require operator.admin for the initial scope upgrade

Workaround

Manually edit ~/.openclaw/devices/paired.json to add full scopes:

"scopes": [
  "operator.admin",
  "operator.read",
  "operator.write",
  "operator.approvals",
  "operator.pairing"
],
"approvedScopes": [
  "operator.admin",
  "operator.read",
  "operator.write",
  "operator.approvals",
  "operator.pairing"
]

Then restart gateway.

Related Issues

  • #47640 — Similar scope regression in 2026.3.13 (operator.read)
  • #56390 — CLI cannot approve device pairing (operator.talk.secrets)

Impact

  • Critical for new users: Fresh installs cannot approve any devices
  • Blocks entire workflow: cannot add nodes, cannot use Control UI fully
  • Requires manual file editing to recover

extent analysis

TL;DR

Manually editing the paired.json file to include the operator.admin scope and restarting the gateway may resolve the issue.

Guidance

  • Verify that the paired.json file only contains the operator.pairing scope, as indicated in the Root Cause Analysis section.
  • Manually edit the ~/.openclaw/devices/paired.json file to add the required scopes, including operator.admin, as shown in the Workaround section.
  • Restart the gateway after making changes to the paired.json file to apply the updates.
  • Consider reviewing related issues (#47640 and #56390) for potential connections to this problem.

Example

"scopes": [
  "operator.admin",
  "operator.read",
  "operator.write",
  "operator.approvals",
  "operator.pairing"
],
"approvedScopes": [
  "operator.admin",
  "operator.read",
  "operator.write",
  "operator.approvals",
  "operator.pairing"
]

Notes

This workaround may not be a permanent solution, as it involves manual editing of configuration files. The underlying issue may still exist and require a fix in a future version of OpenClaw.

Recommendation

Apply the workaround by manually editing the paired.json file, as it provides a temporary solution to the critical issue of being unable to approve new devices.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#model save/load#optimization#mixed precision#training loop#device allocation

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING