Cannot generate QR code for pairing (mirror of upstream gateway issue)

[samanthamsong]

Problem: The app can't generate a QR code for pairing. A corresponding issue was filed upstream in the gateway repo; tracking here for the Windows node side.

Impact: Pairing - QR-based pairing path unavailable.

Epic: should ladder up to #835 (S2 - Connect & pair).

[clawsweeper]

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve. Reviewed July 1, 2026, 4:53 PM ET / 20:53 UTC.

Summary
Keep open: this is a fresh QR-generation pairing report, the upstream gateway issue/output is not linked, and current main only proves the Windows happy path when openclaw qr --json returns the expected payload.

Reproducibility: no. The report names a QR-generation failure and an upstream mirror, but it does not include the upstream issue URL, openclaw qr --json output, setup logs, or a complete current-main reproduction path.

Ways to help us reproduce this

• Add a screenshot or short recording showing the behavior.
• Add expected vs actual behavior.

Next step
Maintainer triage is needed to connect this mirror to the upstream gateway issue or redacted runtime output before an automated fix can choose the Windows-vs-gateway owner.

Review details

Best possible solution:

Link the upstream gateway report and add redacted openclaw qr --json output or setup logs, then fix the narrow owner: upstream QR minting/output if the gateway is wrong, or the Windows SetupEngine parsing/invocation path if the wrapper is wrong.

Do we have a high-confidence way to reproduce the issue?

No. The report names a QR-generation failure and an upstream mirror, but it does not include the upstream issue URL, openclaw qr --json output, setup logs, or a complete current-main reproduction path.

Is this the best way to solve the issue?

Unclear. Current Windows code already invokes and parses openclaw qr --json and applies setup codes, so the narrow fix depends on whether the failure is upstream gateway QR minting/output or the Windows wrapper around it.

AGENTS.md: found and applied where relevant.

Remaining risk / open question:

• The upstream gateway issue is not linked, so the exact failing command, gateway version, output shape, and ownership boundary are unknown.
• Current main has QR/setup-code happy-path coverage, but that does not prove the reported gateway-side QR generation failure is fixed.
• Any fix in this area must preserve bootstrap-token handling, device-token precedence, and pairing approval boundaries.

Codex review notes: model internal, reasoning high; reviewed against 8b857ecbb1f5.

Label changes

Label justifications:

• P1: QR-based pairing being unavailable blocks the core connect-and-pair workflow for affected users.
• impact:auth-provider: The report is about QR/bootstrap pairing, which controls gateway credentials, device tokens, and pairing approval.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read fully; its connection, pairing, onboarding, credential-precedence, and proof guidance is relevant to this issue. (AGENTS.md:1, 8b857ecbb1f5)
• Issue report lacks the upstream failure details: The issue body says the app cannot generate a QR code and that an upstream gateway issue exists, but it does not include the upstream URL, failing command output, logs, or environment.
• Windows-side QR minting wrapper exists: Current main runs openclaw qr --json in WSL, reads bootstrapToken or setupCode, and fails closed if the gateway output does not contain a usable bootstrap credential. (src/OpenClaw.SetupEngine/SetupSteps.cs:1673, 8b857ecbb1f5)
• Windows-side setup-code application path exists: GatewayConnectionManager decodes setup codes, validates the gateway URL, stores the bootstrap token on the gateway record, clears role tokens, and reconnects through the managed path. (src/OpenClaw.Connection/GatewayConnectionManager.cs:521, 8b857ecbb1f5)
• Happy-path E2E coverage exists: The E2E suite mints a real gateway setup code with openclaw qr --json, applies it through tray MCP, and asserts durable operator and node credentials. (tests/OpenClaw.E2ETests/Setup/SetupAndConnectTests.cs:243, 8b857ecbb1f5)
• Related epic remains open: The referenced S2 epic remains open and explicitly includes robust QR pairing for local and remote gateways, so this report belongs in that active pairing area rather than being external-only cleanup.

Likely related people:

• ranjeshj: Authored the SetupEngine redesign and merged the gateway connection hardening work that established much of the setup-code and pairing lifecycle. (role: feature-history owner; confidence: high; commits: cefce3952ab1, ea36b12f9e4c, ffeff39c16c5; files: src/OpenClaw.SetupEngine/SetupSteps.cs, src/OpenClaw.Connection/GatewayConnectionManager.cs, tests/OpenClaw.Connection.Tests/SetupCodeFlowTests.cs)
• shanselman: Recent release history carries the current QR minting, setup-code application, and QR E2E lines through the v0.6.12 commit, and PR metadata maps that commit to this handle. (role: recent area contributor; confidence: medium; commits: 4166e0fd63f8; files: src/OpenClaw.SetupEngine/SetupSteps.cs, src/OpenClaw.Connection/GatewayConnectionManager.cs, tests/OpenClaw.E2ETests/Setup/SetupAndConnectTests.cs)
• bkudiess: Recent remote gateway setup and connection recovery work touched the same pairing and gateway setup boundary that would own a Windows-side QR generation wrapper bug. (role: recent adjacent contributor; confidence: medium; commits: f51a8618ed7b, 9f4d23804122; files: src/OpenClaw.Connection/GatewayConnectionManager.cs, tests/OpenClaw.E2ETests/Setup/SetupAndConnectTests.cs)

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.