Fix: Always send connect first, then pairing request after rejection

app/src/main/java/com/nexlab/openclaw/node/data/remote/NodeClient.kt

@@ -227,15 +227,12 @@ class NodeClient() {
                                 hasReceivedChallenge = true
                                 Log.d(TAG, "Received challenge: nonce=$challengeNonce, ts=$challengeTimestamp")
                                 
-                                // Check if we need to send pairing request instead of connect
-                                if (pendingPairingAfterConnect) {
-                                    pendingPairingAfterConnect = false
-                                    Log.d(TAG, "Sending pairing request after reconnect")
-                                    sendPairingRequest(nodeId, token, capabilities)
-                                } else {
-                                    // Now send connect request with proper v3 signature
-                                    sendConnectRequestWithChallenge(nodeId, token, capabilities)
-                                }
+                                // BUG FIX: Always send connect first - the gateway requires "connect" as the first request
+                                // If connect is rejected with "device-required", we handle that in the response handler
+                                // This was causing "invalid handshake: first request must be connect" error
+                                pendingPairingAfterConnect = false
+                                Log.d(TAG, "Always sending connect request first (protocol requirement)")
+                                sendConnectRequestWithChallenge(nodeId, token, capabilities)
                             } else if (event == "node.pair.resolved") {
                                 // Pairing was approved, now reconnect with token
                                 val approved = json.optJSONObject("payload")?.optBoolean("approved", false)
@@ -263,9 +260,10 @@ class NodeClient() {
                                     if ((error?.contains("device-required") == true || 
                                          error?.contains("device signature") == true ||
                                          error?.contains("invalid") == true) && isPairingMode) {
-                                        // Set flag to send pairing request after reconnect
-                                        pendingPairingAfterConnect = true
-                                        Log.d(TAG, "Will send pairing request on reconnect after connection rejection")
+                                        // Device not paired - send pairing request on THIS connection
+                                        Log.d(TAG, "Device not paired, sending pairing request")
+                                        sendPairingRequest(nodeId, token, capabilities)
+                                        // Don't close - wait for pairing response
                                     } else {
                                         _connectionStatus.trySend(ConnectionStatus(false, nodeId))
                                     }