Summary

buildAgentCommandInput (openai-http.ts) and runResponsesAgentCommand
(openresponses-http.ts) hardcoded senderIsOwner: true, granting owner-level
MCP tool authority to UNAUTHENTICATED callers on an auth:"none" gateway — an
IDOR-class authorization gap. Owner authority is now derived from the gateway
auth method that satisfied the connect check.

Closes #2735

Resulting derivation

A header-less auth:"none" chat call still works (200, not 403): the
chat.send method-scope gate stays permissive — the fix downscopes owner, it
does not reject the caller.

⚠️ This owner-derivation is a FORK-INTRODUCED divergence — do NOT "sync back"

Upstream OpenClaw, for a trusted (non-shared-secret) request that sends no
x-*-scopes header, returns CLI_DEFAULT_OPERATOR_SCOPES (which includes
operator.admin) — i.e. upstream intentionally grants owner to a header-less
caller on auth:"none" (matching pre-openclaw#57783 "trusted local CLI" behavior).

RemoteClaw runs gateways network-exposed over messaging channels, where
auth:"none" + no-header is the realistic attacker, not a trusted local CLI.
The fork therefore deliberately returns [] (→ NOT owner) on the
non-shared-secret no-header path, in resolveTrustedHttpOperatorScopes
(http-utils.ts).

This is a deliberate hardening divergence, NOT a restored upstream control.
A future DIFF-SYNC MUST NOT re-adopt upstream's
no-header → CLI_DEFAULT_OPERATOR_SCOPES branch — doing so silently re-opens
this IDOR. The divergence is guarded three ways (parallel to the #2733
re-introduction guard; ADR-0011):

1. A function-level FORK-INTRODUCED SECURITY DIVERGENCE (#2735) comment in
   http-utils.ts documenting the upstream posture and why the fork differs.
2. A unit table (http-utils.owner-derivation.test.ts) pinning the
   no-header → [] branch and the gate-vs-owner split.
3. A CI-assert guard (scripts/check-openai-http-owner-derivation.mjs + a
   gateway meta-test owner-derivation-guard.test.ts) that fails if the
   literal unauthenticated-no-header senderIsOwner:false anchor test is
   removed, skipped, or stops asserting not-owner — so green CI stays a faithful
   proxy for "the hole is closed".

Changes

• http-utils.ts: ported trust-gate machinery into the fork's consolidated
  layout — resolveTrustedHttpOperatorScopes (the divergence),
  resolveHttpSenderIsOwner, and the OpenAI-compat resolvers
  (resolveOpenAiCompatibleHttpOperatorScopes = method-scope gate, stays
  permissive on no-header; resolveOpenAiCompatibleHttpSenderIsOwner = owner,
  strict). usesSharedSecretGatewayMethod distinguishes the bearer short-circuit.
• http-auth-helpers.ts: new authorizeGatewayHttpRequestOrReply surfaces
  the satisfying auth method (AuthorizedGatewayHttpRequest) so owner-derivation
  can run; the boolean authorizeGatewayBearerRequestOrReply is retained for
  tools-invoke-http (allow/deny only).
• http-endpoint-helpers.ts: threads requestAuth back to callers and
  accepts a resolveOperatorScopes override for the compat scope model.
• openai-http.ts / openresponses-http.ts: derive senderIsOwner from
  requestAuth and thread it into the agent command (no more hardcoded true).
  tools-invoke-http.ts is unchanged.
• gateway test-suite remediation (#2720): deferred cleanups, parity gaps, and skip-restorations #2724 auth-wiring tripwire (server.plugin-gateway-auth-tripwire.test.ts):
  re-pointed the JSON-endpoint chokepoint row to the new
  authorizeGatewayHttpRequestOrReply and added a row for the bearer
  chokepoint's remaining tools-invoke-http call site (count 4 → 5);
  strengthened the rate-limiter-threading check to require every chokepoint
  wrapper forward the limiter.

Validation

• Full gateway lane green: 146 files, 1605 passed, 6 skipped, 0 failed
  (vitest run --config vitest.gateway.config.ts --pool=forks).
• pnpm check (oxfmt + tsgo + oxlint + custom lints) green.
• Fork-integrity gates green: rebrand, zombie-import, stub-debt
  (zero @ts-expect-error), throwing-stub-callers.
• The CI-assert guard was negative-tested against skip / xit / it.only /
  renamed-anchor / flipped-assertion mutations — all correctly fail the gate.
• No src/middleware/ changes, so the LIVE smoke lane is not required.

Do NOT merge from here. Per the orchestration plan, the orchestrator
verifies the no-header hole is closed + the literal-no-header test + the
CI-assert guard, then merges.

🤖 Generated with Claude Code