Bug Report

Version: 2026.2.21-2 (updated from 2026.2.19-2)
OS: macOS 26.3 (arm64), Mac mini M-series
Node: v24.13.0
Bind: loopback, auth mode: token

Issue

sessions_spawn fails with gateway closed (1008): pairing required for ALL sub-agent spawns. This worked correctly on 2026.2.19-2.

Log signature

security audit: device access upgrade requested reason=scope-upgrade
  device=05eb09d4...
  scopesFrom=operator.admin,operator.approvals,operator.pairing,operator.read
  scopesTo=operator.write
  client=gateway-client

gateway connect failed: Error: pairing required

What happens

The embedded agent runtime tries to spawn a sub-agent session via sessions_spawn. The gateway rejects it because the device only has operator.read scope but the spawn requires operator.write. This scope-upgrade path has no approval mechanism for the embedded agent runtime.

This was NOT required in 2026.2.19-2 — sub-agent spawns worked without any scope-upgrade.

Repro steps

1. Update from 2026.2.19-2 to 2026.2.21-2 (npm install -g openclaw@latest)
2. openclaw gateway install --force && openclaw gateway restart
3. From main agent session, call sessions_spawn with any task
4. Fails with "pairing required" (scope-upgrade rejected)

Attempted workarounds (none worked)

• openclaw gateway restart
• openclaw gateway install --force
• openclaw doctor / openclaw doctor --fix
• Token rotation + reinstall
• Full stop/start cycle (launchctl bootout + fresh install)

Expected behavior

Embedded agent runtime should have operator.write scope by default for sub-agent spawns, matching pre-update (2026.2.19-2) behavior.

Config (relevant sections)

{
  gateway: {
    port: 18789,
    mode: "local",
    bind: "loopback",
    auth: { mode: "token" }
  },
  agents: {
    defaults: {
      maxConcurrent: 4,
      subagents: { maxConcurrent: 8 }
    }
  }
}