Environment

• OpenClaw: 2026.4.1 (da64a97)
• Platform: Linux 5.15.0-1100-oracle (arm64), Node.js v24.13.1
• Channel: QQBot (qqbot)
• Gateway bind: loopback (local only)
• Gateway auth mode: token
• Config: ~/.openclaw/openclaw.json

Relevant config excerpt:

{
  "gateway": {
    "mode": "local",
    "port": 18789,
    "bind": "loopback",
    "auth": { "mode": "token", "token": "48ac42b383d5bffd835a374f854c226ad305215baff943e1" },
    "controlUi": { "allowInsecureAuth": true }
  },
  "agents": {
    "defaults": {
      "subagents": { "maxConcurrent": 4 }
    }
  }
}

Issue Summary

sessions_spawn with runtime="subagent" fails in two scenarios:

1. Same-agent spawn (no agentId): fails with gateway closed (1008): pairing required
2. Cross-agent spawn (with agentId): fails with agentId is not allowed for sessions_spawn (allowed: none)

Both operations fail even though:

• The subagent tool/permission appears to be listed in OpenClaw default allowed permissions
• The QQBot channel does not support the standard openclaw pairing approval flow

Steps to Reproduce

same-agent subagent

sessions_spawn({
  task: "Reply with exactly: SUBAGENT_OK",
  runtime: "subagent",
  mode: "run",
  cleanup: "delete",
  timeoutSeconds: 20,
  runTimeoutSeconds: 20
})

Expected: Subagent session spawns and returns SUBAGENT_OK
Actual: gateway closed (1008): pairing required

cross-agent subagent (using a registered agent)

sessions_spawn({
  task: "Reply with exactly: FINANCE_AGENT_OK",
  runtime: "subagent",
  agentId: "finance-financial-forecaster",
  mode: "run",
  cleanup: "delete",
  timeoutSeconds: 20,
  runTimeoutSeconds: 20
})

Expected: Finance agent subagent spawns and returns FINANCE_AGENT_OK
Actual: agentId is not allowed for sessions_spawn (allowed: none)

Diagnosis So Far

1. The qqbot channel explicitly does not support pairing:

   Channel qqbot does not support pairing
   

2. The openclaw pairing list --channel qqbot command cannot be used to approve subagent sessions in this channel.
3. Changing gateway.bind from loopback to lan does not resolve the issue; it only adds security warnings and exposes the gateway.
4. The allowAgents field in agents.defaults.subagents appears to either not persist correctly or not be recognized by the running gateway process.

Questions

1. Is sessions_spawn intended to work from within an existing WebSocket client session, or only from external clients?
2. Is there a way to approve a subagent session for the qqbot channel (which reports Channel qqbot does not support pairing)?
3. Should allowAgents in agents.defaults.subagents gate both same-agent and cross-agent spawns, or only cross-agent?
4. Is there a gateway config field that controls whether the local gateway itself accepts child WebSocket connections from sessions_spawn?

Documentation References

• docs/zh-CN/tools/subagents.md — describes sessions_spawn tool and allowAgents configuration
• docs/zh-CN/gateway/pairing.md — documents pairing approval flow
• docs/zh-CN/gateway/configuration-reference.md — gateway config schema

This issue was filed from a local OpenClaw installation using the QQBot channel in local gateway mode.