OpenClaw merged PR #118231, "fix: recover Control UI access after device-auth upgrades", a P1 Gateway and web UI fix for a frustrating post-upgrade lockout.
The issue hit users opening the remote Control UI after a device-auth upgrade. Their browser could no longer present a usable paired-device credential, leaving them at a generic Gateway connection error instead of a guided recovery path.
That is especially painful because the Control UI is often the place operators go to fix setup problems. If the recovery surface is behind the broken credential state, the error becomes harder to diagnose than the underlying upgrade.
What Changed
The PR introduces a dashboard recovery path. After openclaw dashboard proves Gateway readiness and local listener ownership, it can mint a short-lived, single-use Control UI bootstrap URL.
That bootstrap provisions a durable device-bound credential for the current shared-auth generation. The PR says the bootstrap is removed from the browser URL and cannot be replayed. Ordinary shared-token remote access still remains pairing-gated, so copied shared Gateway tokens do not become a backdoor around device pairing.
The change keeps the legacy url JSON field for Quick Chat compatibility and adds a browser-specific browserUrl field for the bootstrap handoff. In headless or SecretRef-managed setups, the CLI points operators to the explicit JSON handoff if automatic browser delivery cannot complete.
Why It Matters
This is a security-boundary fix with a usability shape. OpenClaw is not loosening remote access rules to make the problem go away. It is adding a trusted-host recovery path that still binds the resulting session to a durable device credential.
The operator impact is direct:
- a generic connection error becomes a concrete recovery command
- reloads continue working after the recovered browser connects
- one-time bootstrap URLs cannot be reused
- shared remote tokens still require pairing in a fresh browser
- headless recovery has an explicit JSON path
That combination is the right posture for a local-first Gateway. Recovery should be simple from the trusted machine and still strict from everywhere else.
Evidence
The PR includes packaged-runtime acceptance on an OCM-managed macOS instance behind Tailscale Serve. The before state showed a generic connection failure with a valid shared token rejected by device pairing. The after state opened a one-time browser URL, connected successfully, removed the bootstrap fragment from the address bar, and stayed connected across reload.
Replaying the bootstrap URL was rejected. A fresh browser using only the ordinary shared token still required pairing.
Focused validation covered dashboard links, dashboard JSON output, QR dashboard integration, the Gateway auth control-UI bootstrap path, and login-gate localization. The PR reports 35 dashboard tests, two QR dashboard integration tests, one focused Gateway auth test, and 41 registry tests passing, along with git diff --check.
For OpenClaw operators, this is the sort of fix that will mostly be noticed when it is needed: upgrades become less likely to strand the browser at exactly the moment the operator needs the browser most.