Skip device signature on initial connect - use token auth only until paired

app/src/main/java/com/nexlab/openclaw/node/data/remote/NodeClient.kt

@@ -272,7 +272,8 @@ class NodeClient() {
                                     // Get the token from the response and reconnect
                                     val newToken = json.optJSONObject("payload")?.optString("token", "") ?: ""
                                     isPairingMode = false
-                                    sendConnectRequestWithChallenge(nodeId, newToken, capabilities)
+                                    // After pairing, include device info for authenticated connection
+                                    sendConnectRequestWithChallenge(nodeId, newToken, capabilities, includeDevice = true)
                                 }
                             }
                         }
@@ -365,7 +366,7 @@ class NodeClient() {
         })
     }
 
-    private fun sendConnectRequest(nodeId: String, token: String, capabilities: NodeCapabilities) {
+    private fun sendConnectRequest(nodeId: String, token: String, capabilities: NodeCapabilities, includeDevice: Boolean = false) {
         pendingRequestId = "connect-${System.currentTimeMillis()}"
         
         val connectParams = JSONObject().apply {
@@ -401,12 +402,15 @@ class NodeClient() {
             put("auth", JSONObject().apply {
                 put("token", token)
             })
-            put("device", JSONObject().apply {
-                put("id", deviceId)
-                put("publicKey", devicePublicKey)
-                put("si", deviceId)  // Service identity = device ID
-                put("signature", signData(token))  // Sign the token
-            })
+            // Only include device info if explicitly requested (after pairing)
+            if (includeDevice) {
+                put("device", JSONObject().apply {
+                    put("id", deviceId)
+                    put("publicKey", devicePublicKey)
+                    put("si", deviceId)  // Service identity = device ID
+                    put("signature", signData(token))  // Sign the token
+                })
+            }
             put("locale", "en-US")
             put("userAgent", "openclaw-android/1.0.0")
         }
@@ -421,22 +425,26 @@ class NodeClient() {
         sendJson(connectRequest)
     }
 
-    private fun sendConnectRequestWithChallenge(nodeId: String, token: String, capabilities: NodeCapabilities) {
+    private fun sendConnectRequestWithChallenge(nodeId: String, token: String, capabilities: NodeCapabilities, includeDevice: Boolean = false) {
         pendingRequestId = "connect-${System.currentTimeMillis()}"
         
-        // Use v3 signature format
+        // Use v3 signature format - only if including device info
         val scopesArray = JSONArray()
         
-        // Sign the v3 payload - clientId should be deviceId
-        val signature = signV3Payload(
-            nonce = challengeNonce,
-            clientId = deviceId,  // Use device ID for signature
-            role = "node",
-            scopes = scopesArray,
-            token = token,
-            platform = "android",
-            deviceFamily = "phone"
-        )
+        // Only generate signature if we're including device info
+        val signature = if (includeDevice) {
+            signV3Payload(
+                nonce = challengeNonce,
+                clientId = deviceId,  // Use device ID for signature
+                role = "node",
+                scopes = scopesArray,
+                token = token,
+                platform = "android",
+                deviceFamily = "phone"
+            )
+        } else {
+            ""
+        }
         
         val connectParams = JSONObject().apply {
             put("minProtocol", 3)
@@ -471,13 +479,16 @@ class NodeClient() {
             put("auth", JSONObject().apply {
                 put("token", token)
             })
-            put("device", JSONObject().apply {
-                put("id", deviceId)
-                put("publicKey", devicePublicKey)
-                put("signature", signature)
-                put("signedAt", challengeTimestamp)
-                put("nonce", challengeNonce)
-            })
+            // Only include device info if explicitly requested (after pairing)
+            if (includeDevice) {
+                put("device", JSONObject().apply {
+                    put("id", deviceId)
+                    put("publicKey", devicePublicKey)
+                    put("signature", signature)
+                    put("signedAt", challengeTimestamp)
+                    put("nonce", challengeNonce)
+                })
+            }
             put("locale", "en-US")
             put("userAgent", "openclaw-android/1.0.0")
         }