-
-
Notifications
You must be signed in to change notification settings - Fork 80.7k
Remote node registration: token scopes empty, nodes approve API incomplete #91126
Copy link
Copy link
Open
Labels
P2Normal backlog priority with limited blast radius.Normal backlog priority with limited blast radius.clawsweeper:needs-maintainer-reviewClawSweeper marked this issue as needing maintainer review before automation.ClawSweeper marked this issue as needing maintainer review before automation.clawsweeper:needs-product-decisionClawSweeper marked this issue as needing a product or behavior decision.ClawSweeper marked this issue as needing a product or behavior decision.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.ClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.ClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.impact:auth-providerAuth, provider routing, model choice, or SecretRef resolution may break.Auth, provider routing, model choice, or SecretRef resolution may break.impact:otherThis issue has meaningful maintainer-visible impact outside the owned taxonomy.This issue has meaningful maintainer-visible impact outside the owned taxonomy.impact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.Security boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.
Description
Metadata
Metadata
Assignees
Labels
P2Normal backlog priority with limited blast radius.Normal backlog priority with limited blast radius.clawsweeper:needs-maintainer-reviewClawSweeper marked this issue as needing maintainer review before automation.ClawSweeper marked this issue as needing maintainer review before automation.clawsweeper:needs-product-decisionClawSweeper marked this issue as needing a product or behavior decision.ClawSweeper marked this issue as needing a product or behavior decision.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.ClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.ClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.impact:auth-providerAuth, provider routing, model choice, or SecretRef resolution may break.Auth, provider routing, model choice, or SecretRef resolution may break.impact:otherThis issue has meaningful maintainer-visible impact outside the owned taxonomy.This issue has meaningful maintainer-visible impact outside the owned taxonomy.impact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.Security boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.
Type
Fields
Priority
None yet
Bug: Remote node registration — node token scopes not assigned, approval API incomplete
Summary
When a node client (e.g. OpenClaw Windows Hub in Node Mode) connects to a remote gateway via WebSocket (
wss://), the gateway issues the node token with empty scopes and theopenclaw nodes approveAPI doesn't match node-specific pairing requests.This is the server-side counterpart to the client-side issues tracked in my new issue on
openclaw/openclaw-windows-node(replacing the locked #663).Symptom 1: Node token scopes empty
After device pairing and approval via
openclaw devices approve, the resulting token for the node role hasscopes: []while the operator token for the same device gets proper scopes.This suggests the gateway's token scope assignment in the device registration/approval flow doesn't differentiate between
role: nodeandrole: operatorfor remote connections. (Local loopback connections may work because scopes are bypassed or default to full access.)Symptom 2:
openclaw nodes approvereturnsunknown requestIdNode-specific pairing requests (
nodes approve) never surface as pending. The pairing request ID submitted by the Windows node client isn't visible to the CLI'snodes approvecommand — the pending list on the gateway is likely filtered or the node request is registered under a different namespace.Symptom 3: Token rotation for node role denied
openclaw devices rotate --role nodeis rejected. The CLI or the server-side handler doesn't accept the node role parameter for rotation.Related issues
openclaw/openclaw-windows-node#xx (new) — Client-side symptom trackingSuggested investigation
role: nodevsrole: operatornodes approverequest ID matching — is the node registration registered under a different key?devices rotatehandles the--role nodeparameterHappy to provide gateway logs,
paired.jsonexcerpts, and reproduce on demand.