Skip device signature on initial connect - use token auth only until paired

app/src/main/java/com/nexlab/openclaw/node/data/remote/NodeClient.kt

@@ -272,7 +272,8 @@ class NodeClient() {
                                     // Get the token from the response and reconnect
                                     val newToken = json.optJSONObject("payload")?.optString("token", "") ?: ""
                                     isPairingMode = false
-                                    sendConnectRequestWithChallenge(nodeId, newToken, capabilities)
+                                    // After pairing, include device info for authenticated connection
+                                    sendConnectRequestWithChallenge(nodeId, newToken, capabilities, includeDevice = true)
                                 }
                             }
                         }
@@ -365,7 +366,7 @@ class NodeClient() {
         })
     }
 
-    private fun sendConnectRequest(nodeId: String, token: String, capabilities: NodeCapabilities) {
+    private fun sendConnectRequest(nodeId: String, token: String, capabilities: NodeCapabilities, includeDevice: Boolean = false) {
         pendingRequestId = "connect-${System.currentTimeMillis()}"
         
         val connectParams = JSONObject().apply {
@@ -401,12 +402,15 @@ class NodeClient() {
             put("auth", JSONObject().apply {
                 put("token", token)
             })
+            // Only include device info if explicitly requested (after pairing)
+            if (includeDevice) {
                 put("device", JSONObject().apply {
                     put("id", deviceId)
                     put("publicKey", devicePublicKey)
                     put("si", deviceId)  // Service identity = device ID
                     put("signature", signData(token))  // Sign the token
                 })
+            }
             put("locale", "en-US")
             put("userAgent", "openclaw-android/1.0.0")
         }
@@ -421,14 +425,15 @@ class NodeClient() {
         sendJson(connectRequest)
     }
 
-    private fun sendConnectRequestWithChallenge(nodeId: String, token: String, capabilities: NodeCapabilities) {
+    private fun sendConnectRequestWithChallenge(nodeId: String, token: String, capabilities: NodeCapabilities, includeDevice: Boolean = false) {
         pendingRequestId = "connect-${System.currentTimeMillis()}"
         
-        // Use v3 signature format
+        // Use v3 signature format - only if including device info
         val scopesArray = JSONArray()
         
-        // Sign the v3 payload - clientId should be deviceId
-        val signature = signV3Payload(
+        // Only generate signature if we're including device info
+        val signature = if (includeDevice) {
+            signV3Payload(
                 nonce = challengeNonce,
                 clientId = deviceId,  // Use device ID for signature
                 role = "node",
@@ -437,6 +442,9 @@ class NodeClient() {
                 platform = "android",
                 deviceFamily = "phone"
             )
+        } else {
+            ""
+        }
         
         val connectParams = JSONObject().apply {
             put("minProtocol", 3)
@@ -471,6 +479,8 @@ class NodeClient() {
             put("auth", JSONObject().apply {
                 put("token", token)
             })
+            // Only include device info if explicitly requested (after pairing)
+            if (includeDevice) {
                 put("device", JSONObject().apply {
                     put("id", deviceId)
                     put("publicKey", devicePublicKey)
@@ -478,6 +488,7 @@ class NodeClient() {
                     put("signedAt", challengeTimestamp)
                     put("nonce", challengeNonce)
                 })
+            }
             put("locale", "en-US")
             put("userAgent", "openclaw-android/1.0.0")
         }