-
-
Notifications
You must be signed in to change notification settings - Fork 80.7k
[Feature]: One-step mobile QR/setup-code pairing #98242
Copy link
Copy link
Open
Labels
P2Normal backlog priority with limited blast radius.Normal backlog priority with limited blast radius.clawsweeper:linked-pr-openClawSweeper found an open linked pull request for this issue.ClawSweeper found an open linked pull request for this issue.clawsweeper:needs-maintainer-reviewClawSweeper marked this issue as needing maintainer review before automation.ClawSweeper marked this issue as needing maintainer review before automation.clawsweeper:needs-product-decisionClawSweeper marked this issue as needing a product or behavior decision.ClawSweeper marked this issue as needing a product or behavior decision.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.ClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.ClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.enhancementNew feature or requestNew feature or requestimpact:auth-providerAuth, provider routing, model choice, or SecretRef resolution may break.Auth, provider routing, model choice, or SecretRef resolution may break.impact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.Security boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.maintainerMaintainer-authored PRMaintainer-authored PRmaturity:stableIssue affects a taxonomy feature currently scored M4/M5.Issue affects a taxonomy feature currently scored M4/M5.
Description
Metadata
Metadata
Assignees
Labels
P2Normal backlog priority with limited blast radius.Normal backlog priority with limited blast radius.clawsweeper:linked-pr-openClawSweeper found an open linked pull request for this issue.ClawSweeper found an open linked pull request for this issue.clawsweeper:needs-maintainer-reviewClawSweeper marked this issue as needing maintainer review before automation.ClawSweeper marked this issue as needing maintainer review before automation.clawsweeper:needs-product-decisionClawSweeper marked this issue as needing a product or behavior decision.ClawSweeper marked this issue as needing a product or behavior decision.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.ClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.ClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.enhancementNew feature or requestNew feature or requestimpact:auth-providerAuth, provider routing, model choice, or SecretRef resolution may break.Auth, provider routing, model choice, or SecretRef resolution may break.impact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.Security boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.maintainerMaintainer-authored PRMaintainer-authored PRmaturity:stableIssue affects a taxonomy feature currently scored M4/M5.Issue affects a taxonomy feature currently scored M4/M5.
Type
Fields
Priority
None yet
Summary
Make mobile QR/setup-code onboarding one-step for fresh OpenClaw Gateway pairing.
Problem to solve
Fresh iOS/Android users should not have to scan or paste setup material, then manually approve separate mobile device, node, and operator handoff requests. The current product goal is that a setup QR or setup code fully configures the app and lets the Gateway approve the fresh baseline mobile node/device/operator handoff automatically, while keeping later upgrades explicit.
Proposed solution
Use the existing setup-code bootstrap profile as the trusted fresh-mobile baseline: QR/setup code carries gateway URL plus bootstrap token, the app saves that connection profile, and the Gateway silently approves the fresh device and node pairing when the bootstrap metadata proves native mobile onboarding. Add a short-code redemption seam for same-Gateway setup-code payloads where the app already knows the Gateway URL.
Alternatives considered
Impact
Affected: new mobile users pairing iOS/Android with an OpenClaw Gateway.
Severity: Medium to high onboarding friction today.
Frequency: Every fresh mobile pairing.
Consequence: Users currently face extra setup and approval steps instead of one QR/setup-code action.
Evidence/examples
/tmp/openclaw-setup-proof/setup-code-flow.gifduring implementation proof.Additional information
Security requirements: short codes are TTL-bound and single-use, setup-code bootstrap remains bounded to node/operator baseline roles, no admin/pairing scopes are granted by default, and public cleartext Gateway URLs remain rejected outside loopback/private LAN allowances.