Bug type
Behavior bug (incorrect output/state without crash)
Beta release blocker
No
Summary
devices approve --token on loopback still sends the local CLI device identity during WebSocket connect, causing the gateway to generate a new scope upgrade request that supersedes the one being approved, making CLI-only scope approval impossible.
Steps to reproduce
- Install OpenClaw on macOS with a local gateway (loopback).
- Pair a device with operator.read scope only.
- Run: openclaw devices approve --token
- Observe: approve call connects as the local CLI device, gateway closes with 1008 (pairing required), and a new pending request is generated with a new ID.
- Repeat — the loop never resolves.
Expected behavior
devices approve --token on loopback should authenticate using the shared gateway credential only, without presenting the local CLI device identity during the WebSocket connect.
Actual behavior
The approve command connects as the local CLI device during the WebSocket handshake. The gateway closes with code 1008 (pairing required) and generates a new scope upgrade request ID, superseding the one being approved. The loop repeats indefinitely.
OpenClaw version
2026.6.10 (aa69b12)
Operating system
macOS 26.3 (arm64)
Install method
npm global
Model
anthropic/claude-sonnet-4-6
Provider / routing chain
openclaw -> anthropic
Additional provider/model setup details
gateway connect failed: GatewayClientRequestError: scope upgrade pending approval (requestId: b60d2c18-62da-4be9-9ae2-7451e4db51f5)
Direct scope access failed; using local fallback.
gateway connect failed: GatewayClientRequestError: scope upgrade pending approval (requestId: b60d2c18-62da-4be9-9ae2-7451e4db51f5)
Direct scope access failed; using local fallback.
Approved 6302fe8e3c30343602dcf83f5da682d853516ab393425f1489bea1e3c2aa87b3 (b60d2c18-62da-4be9-9ae2-7451e4db51f5)
[openclaw] Reason: gateway closed (1008): pairing required: device is asking for more scopes than currently approved (requestId: 2245cd67-f2a8-42cf-b107-5e11420cab31)
Logs
Screenshots, recordings, and evidence
No response
Impact and severity
Affected: Any macOS local install where the CLI device is paired with operator.read only
Severity: High (blocks all scope upgrades — CLI cannot bootstrap itself to admin)
Frequency: 4/4 observed attempts, fully deterministic
Consequence: Slack agent cannot connect, gog skill disabled, all tool integrations blocked
Additional information
NOT_ENOUGH_INFO
Bug type
Behavior bug (incorrect output/state without crash)
Beta release blocker
No
Summary
devices approve --token on loopback still sends the local CLI device identity during WebSocket connect, causing the gateway to generate a new scope upgrade request that supersedes the one being approved, making CLI-only scope approval impossible.
Steps to reproduce
Expected behavior
devices approve --token on loopback should authenticate using the shared gateway credential only, without presenting the local CLI device identity during the WebSocket connect.
Actual behavior
The approve command connects as the local CLI device during the WebSocket handshake. The gateway closes with code 1008 (pairing required) and generates a new scope upgrade request ID, superseding the one being approved. The loop repeats indefinitely.
OpenClaw version
2026.6.10 (aa69b12)
Operating system
macOS 26.3 (arm64)
Install method
npm global
Model
anthropic/claude-sonnet-4-6
Provider / routing chain
openclaw -> anthropic
Additional provider/model setup details
gateway connect failed: GatewayClientRequestError: scope upgrade pending approval (requestId: b60d2c18-62da-4be9-9ae2-7451e4db51f5)
Direct scope access failed; using local fallback.
gateway connect failed: GatewayClientRequestError: scope upgrade pending approval (requestId: b60d2c18-62da-4be9-9ae2-7451e4db51f5)
Direct scope access failed; using local fallback.
Approved 6302fe8e3c30343602dcf83f5da682d853516ab393425f1489bea1e3c2aa87b3 (b60d2c18-62da-4be9-9ae2-7451e4db51f5)
[openclaw] Reason: gateway closed (1008): pairing required: device is asking for more scopes than currently approved (requestId: 2245cd67-f2a8-42cf-b107-5e11420cab31)
Logs
Screenshots, recordings, and evidence
No response
Impact and severity
Affected: Any macOS local install where the CLI device is paired with operator.read only
Severity: High (blocks all scope upgrades — CLI cannot bootstrap itself to admin)
Frequency: 4/4 observed attempts, fully deterministic
Consequence: Slack agent cannot connect, gog skill disabled, all tool integrations blocked
Additional information
NOT_ENOUGH_INFO