Bug Description

sessions_spawn and internal RPC fail with WebSocket close code 1008 'pairing required' on Windows Server 2025 (loopback bind). Main session works fine but all internal agent-to-gateway RPC is blocked.

Environment

• OpenClaw version: 2026.4.1
• OS: Windows Server 2025 (10.0.26100)
• Node.js: v24.14.0
• Install method: npm global
• Gateway bind: loopback (127.0.0.1)
• Auth mode: token

Steps to Reproduce

1. Have a running OpenClaw main session via webchat or Telegram on a loopback gateway
2. Call sessions_spawn with any task and mode='run'
3. Observe: the spawn immediately fails with gateway closed (1008): pairing required

What Works vs What Doesn't

• Main agent session responds normally (webchat, Telegram) ✅
• exec tool works (after setting gateway.controlUi.allowInsecureAuth: true) ✅
• sessions_spawn (subagents) fail immediately with pairing required ❌
• gateway tool (config.patch/config.get) fails with pairing required ❌
• Any internal RPC from agent to gateway ❌

Error

Gateway target: ws://127.0.0.1:18789
Source: local loopback
Config: C:\Users\Administrator\.openclaw\openclaw.json
Bind: loopback

What We Tried

• Clearing devices/ folder and restarting gateway
• Setting gateway.controlUi.allowInsecureAuth: true (fixes exec, not subagents)
• allowlist set to * pattern
• Multiple gateway restarts
• Checking pending.json and attempting devices approve

Workaround

Run task logic sequentially in main session using background exec processes instead of sessions_spawn.

Impact

Blocks all parallel/isolated sub-agent patterns and internal agent-to-gateway RPC.