Summary

Describe the problem and fix in 2-5 bullets:

• Problem: clearUnboundScopes() unconditionally strips operator scopes for non-local clients without device identity, even when token auth succeeds. This breaks chat.send and other operator.write-scoped methods for backend clients connecting over network with valid --token auth.
• Why it matters: Backend clients authenticating with a valid token over a remote connection get their requested scopes stripped, while localhost works fine. This prevents valid token-authenticated operators from using write methods.
• What changed: In evaluateMissingDeviceIdentity, treat authOk + authMethod token/password as sufficient for operator device-skip (alongside sharedAuthOk), so non-local token-auth clients retain their self-declared scopes.
• What did NOT change (scope boundary): No change to Control UI, device pairing, or trusted-proxy auth. Only fixes the operator + token/password path when sharedAuthOk might disagree with primary auth.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes [Bug]: clearUnboundScopes strips operator scopes unconditionally for non-local token-auth clients openclaw/openclaw#51396
• Related #

User-visible / Behavior Changes

Non-local backend clients connecting with valid token auth now retain their requested scopes (e.g. operator.admin), so chat.send and other operator.write methods work as they do for localhost.

Security Impact (required)

• New permissions/capabilities? (No)
• Secrets/tokens handling changed? (No)
• New/changed network calls? (No)
• Command/tool execution surface changed? (No)
• Data access scope changed? (No)
• If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

• OS: Debian 12 (per issue); Windows 10 (local verification)
• Runtime/container: Node / npm global
• Model/provider: anthropic/opus-4.6
• Integration/channel (if any): openclaw gateway with --bind tailnet --token
• Relevant config (redacted): Gateway token auth

Steps

1. Start gateway with openclaw gateway --bind tailnet --token <token>
2. Connect from a remote host (non-loopback) via WebSocket with valid token in auth.token and scopes: ["operator.admin"]
3. Call chat.send

Expected

• Connection succeeds; chat.send succeeds (operator.admin implies operator.write).

Actual

• Before fix: missing scope "operator.write". After fix: scopes retained, chat.send works.

Evidence

Attach at least one:

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

connect-policy.test.ts includes a regression test: operator + sharedAuthOk=false but authOk=true + authMethod=token + isLocalClient=false now returns allow. All tests pass.

Human Verification (required)

What you personally verified (not just CI), and how:

• Verified scenarios: Ran pnpm exec vitest run src/gateway/server/ws-connection/connect-policy.test.ts 鈥?all tests pass.
• Edge cases checked: Existing tests for operator+sharedAuthOk, Control UI, trusted-proxy, node role remain correct.
• What you did not verify: End-to-end remote WebSocket connect with real gateway (no local repro of exact issue setup).

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

Compatibility / Migration

• Backward compatible? (Yes)
• Config/env changes? (No)
• Migration needed? (No)
• If yes, exact upgrade steps: N/A

Failure Recovery (if this breaks)

• How to disable/revert this change quickly: Revert the commit; no feature flags.
• Files/config to restore: src/gateway/server/ws-connection/connect-policy.ts, connect-policy.test.ts, message-handler.ts
• Known bad symptoms reviewers should watch for: None anticipated.

Risks and Mitigations

List only real risks for this PR. Add/remove entries as needed. If none, write None.

None. The change narrows the condition under which scopes are stripped; token-authenticated operators already pass auth and are trusted. No new trust boundary is introduced.