ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-25 20:05:46 -06:00
Code Issues Packages Projects Releases Wiki Activity

feat(pairing): one-paste device pairing via oc-pair setup links (#120768)

Browse Source 
* feat(pairing): one-paste device pairing via oc-pair setup links

Implements milestone 3 from docs/plan/runners.md.

* fix(pairing): sign bootstrap handshake, keep URL candidates, wire pairing countdown

* test(gateway): update client callsite guard

* fix(pairing): preserve setup URL context paths

* fix(ui): keep pairing help aligned with setup mode

* fix(pairing): isolate bootstrap credentials

* perf(ui): keep one-paste pairing within bundle budget

* refactor(pairing): isolate native pair URL prefix parsing

* fix(pairing): preserve candidate lifecycle state

* fix(pairing): retire shared credentials after bootstrap

* fix(pairing): apply rotated manifest through client owner

* test(pairing): prove bootstrap retirement across reconnect

* fix(pairing): preserve native gateway context paths

* fix(pairing): carry native context paths through reconnect

* fix(ios): preserve encoded gateway context path

* chore(plugin-sdk): refresh pairing API baselines
This commit is contained in:
Peter Steinberger
2026-08-12 02:01:33 -07:00
committed by GitHub
parent 3b01ea7905
commit d44f70eb4b
92 changed files with 2432 additions and 545 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/cli/node.md
+15
View File
@@ -74,9 +74,18 @@ Disable it on the node if needed:
openclaw node run --host <gateway-host> --port 18789
```
Or paste a short-lived node setup link from the Control UI Devices page:
```bash
openclaw node run --pair "oc-pair://<setup-code>"
```
Options:
- `--host <host>`: Gateway WebSocket host (default: `127.0.0.1`)
- `--pair <code-or-url>`: Read the Gateway endpoint, bootstrap token, TLS mode,
and optional certificate pin from a setup code or `oc-pair://` URL. Explicit
gateway flags override values from `--pair`.
- `--port <port>`: Gateway WebSocket port (default: `18789`)
- `--context-path <path>`: Gateway WebSocket context path (e.g. `/openclaw-gw`). Appended to the WebSocket URL.
- `--tls`: Use TLS for the gateway connection
@@ -87,6 +96,12 @@ Options:
## Gateway auth for node host
`--pair` uses a 10-minute single-use bootstrap token for the first connection.
After pairing, reconnects use the durable device credential. The setup link
does not pre-approve `system.run`; normal node approval and SSH verification
remain in force. `node install --pair` is intentionally unavailable because a
short-lived bearer setup link must not be persisted in service arguments.
`openclaw node run` and `openclaw node install` resolve gateway auth from config/env (no `--token`/`--password` flags on node commands):
- `OPENCLAW_GATEWAY_TOKEN` / `OPENCLAW_GATEWAY_PASSWORD` are checked first.