u/Cute_Account_3251

I used Tailscale to connect (to) my phone, but all that follows is manual configuration, ending in unfinished work, maybe a developer can oversee that and make it work in future.

It is one of my first posts, so I am quite new to it here.

Here is my workflow:

## OpenClaw Android → gateway: pairing, operator scopes, node commands, and a media delivery rabbit hole

Spent an evening getting my Pixel 9a paired with an OpenClaw gateway over Tailscale. Every step had a gotcha. Here's the full walkthrough for anyone else doing this.

**Stack:**
 Gateway on a Linux box, `gateway.tailscale.mode=serve` (wss://). Pixel 9a, Android 16, OpenClaw app 2026.4.5.

---

### 1. Pairing as a node
Straightforward. Scan the QR / enter the setup code, approve via `openclaw devices approve`, done.

### 2. "Connected (operator offline)"
That's the app's way of saying "I'm a node, waiting for an operator to control me." Not a bug — expected behavior. If you want to control things 
*from*
 the phone, you need operator scope.


### 3. Node → operator scope upgrade
I removed the node pairing, generated a fresh setup code, and re-paired. The phone then requested a scope upgrade. Approve that, and the Pixel becomes both a node 
*and*
 an operator in one device.


### 4. Node card disappeared
After re-pairing, the node tab just vanished from the phone's UI. Force-stopping the app brought it back. Seems like a race condition in the app after re-pairing.


### 5. Node command ACL
By default, a paired node can invoke quite a few things. To configure access, add/edit the `nodes` section to your gateway config (example for camera and location):


```json
"nodes": {
  "denyCommands": [
    "contacts.add",
    "calendar.add",
    "reminders.add",
    "sms.send",
    "sms.search"
  ],
  "allowCommands": [
    "camera.snap",
    "camera.clip",
    "screen.record",
    "screen.capture",
    "location.get"
  ]
}
```

This explicitly permits camera, screen, and location access while blocking sensitive actions like SMS sending and contact/calendar writes (also possible to enable in the app). After config changes, restart the gateway.


### 6. Testing node commands
After setting up the ACL, we tested a few of the allowed commands. All worked over Tailscale:


```bash
# Grab device location
openclaw nodes location --node "Pixel 9a"


# List available cameras
openclaw nodes camera list --node "Pixel 9a"


# Capture a 5-second video clip
openclaw nodes camera clip --node "Pixel 9a" --facing back --duration 5s


# Take a photo
openclaw nodes camera snap --node "Pixel 9a" --facing back
```


`location.get` returned coordinates, `camera.snap` grabbed photos, `camera.clip` recorded video with audio. Both back and front cameras work. All remote commands returned valid results without any fuss.


### 7. And then the media delivery hell
Getting that video 
*back*
 into the webchat UI is where things fell apart. Every `MEDIA:` line attempt resulted in:


> "Unavailable — Outside allowed folders"


Despite the file being valid, sitting in the workspace, in `media/outbound/`, everywhere. Root cause is [a known Control UI bug (#67915)](
https://github.com/openclaw/openclaw/issues/67915
):


> The UI checks `localMediaPreviewRoots` BEFORE the bootstrap config loads. When config hasn't arrived yet, the list is `[]`, so every local path gets rejected instantly. The server-side `/assistant-media` endpoint correctly returns `available: true` — but the UI never gets that far.


[PR #78034](
https://github.com/openclaw/openclaw/pull/78034
) has a fix, but hasn't landed yet.


### TL;DR


- Pairing works, scopes are granular
- Node command ACL keeps things safe
- `nodes camera` commands work well remotely
- 
**BUT**
 local media attachments (`MEDIA:` lines) are broken in Control UI due to a timing bug — the allowed-folders check runs before the config loads
- Workaround: grab files directly on the gateway, or wait for PR #78034 to ship