Description

Fresh auto-pair on localhost only grants operator.admin, operator.approvals, operator.pairing scopes. When the agent/backend subsequently requests operator.read or operator.write, the gateway sees a scope upgrade and requires manual pairing approval - but on localhost there's nobody to approve it, so it fails with "pairing required".

This breaks: sub-agent spawning, cron jobs, openclaw devices list, openclaw status (partial), and any gateway RPC that needs read/write scope.

Environment

• OpenClaw 2026.2.19-2
• macOS 26.1 (arm64)
• Local loopback gateway (default config)

Steps to Reproduce

1. Fresh install or openclaw devices clear --yes
2. openclaw gateway restart
3. Device auto-pairs on localhost with limited scopes
4. Any operation requiring operator.read or operator.write fails with "gateway closed (1008): pairing required"
5. openclaw devices list shows scopes: operator.admin, operator.approvals, operator.pairing (missing read/write)

Root Cause

CLI_DEFAULT_OPERATOR_SCOPES in dist/call-DZzTR0NL.js (and 5 other dist bundles) only includes [admin, approvals, pairing]. Missing READ_SCOPE and WRITE_SCOPE.

Workaround

Patch CLI_DEFAULT_OPERATOR_SCOPES in all 6 dist bundles to include read and write scopes, then openclaw devices clear --yes && openclaw gateway restart.

Expected Behavior

Localhost auto-pair should grant all 5 operator scopes: admin, approvals, pairing, read, write.