[Bug]: DingTalk connector gets 403 "missing scope: operator.write" when calling gateway API

Bug type

Regression (worked before, now fails) / Authentication issue

Description

DingTalk connector successfully connects and creates AI Cards, but fails when calling the gateway streaming API (/v1/chat/completions) with error:

403 - {"ok":false,"error":{"type":"forbidden","message":"missing scope: operator.write"}}

Environment

• OpenClaw version: 2026.3.28 (f9b1079)
• DingTalk connector version: 0.8.8
• OS: Windows 10.0.26200 (x64)
• Node version: 24.14.0
• Gateway mode: local (loopback)

Configuration

{
  "gateway": {
    "port": 18789,
    "mode": "local",
    "bind": "loopback",
    "auth": {
      "mode": "token",
      "token": "e374f14b8f2a45425b1775b2fc7df7bd239c0860d409763f"
    }
  },
  "channels": {
    "dingtalk-connector": {
      "enabled": true,
      "clientId": "dingmtt4i1pr8byl530g",
      "clientSecret": "rLfKK1-F0dkPy3dG--msixBGyezpICJ0MOoWLMV2wS6SenUOoM2LQ9U3vkk1h1Rf",
      "gatewayToken": "e374f14b8f2a45425b1775b2fc7df7bd239c0860d409763f"
    }
  },
  "bindings": [
    {
      "type": "route",
      "agentId": "qa-engineer",
      "match": {
        "channel": "dingtalk-connector"
      }
    }
  ]
}

Steps to reproduce

1. Configure DingTalk connector with gatewayToken matching gateway.auth.token
2. Start gateway: openclaw gateway start
3. Send a message to DingTalk bot
4. Observe AI Card is created successfully
5. Gateway API call fails with 403 error

Expected behavior

DingTalk connector should be able to call gateway streaming API (/v1/chat/completions) successfully when authenticated with the correct gateway token.

Actual behavior

• AI Card creation: ✅ Success (status=200)
• Gateway API call: ❌ 403 Forbidden

  [DingTalk][Gateway] POST http://127.0.0.1:18789/v1/chat/completions
  [DingTalk][Gateway] 响应 status=403, ok=false
  [DingTalk][Gateway] 错误响应: {"ok":false,"error":{"type":"forbidden","message":"missing scope: operator.write"}}
  

Error log excerpt

{"subsystem":"gateway/channels/dingtalk-connector"}
"[DingTalk] Gateway 调用失败：Gateway error: 403 - {\"ok\":false,\"error\":{\"type\":\"forbidden\",\"message\":\"missing scope: operator.write\"}}"
Error: Gateway error: 403 - {"ok":false,"error":{"type":"forbidden","message":"missing scope: operator.write"}}
    at streamFromGateway (C:/Users/piece/.openclaw/extensions/dingtalk-connector/plugin.ts:1488:11)
    at handleDingTalkMessage (C:/Users/piece/.openclaw/extensions/dingtalk-connector/plugin.ts:2891:26)

Analysis

This appears to be related to issue #27494 where API clients authenticating via shared token (without device identity) have their scopes cleared by clearUnboundScopes() function.

The DingTalk connector uses Bearer token authentication:

headers['Authorization'] = `Bearer ${gatewayAuth}`;

But the gateway doesn't grant operator.write scope to token-authenticated connections without device identity.

Workaround attempted

• Updated dingtalk-connector from 0.7.9 to 0.8.8 (latest)
• Verified gatewayToken matches gateway.auth.token
• Confirmed gateway is running and accessible
• AI Card creation works, only streaming API calls fail

Related issues

• Operator scopes cleared for API clients authenticating via shared token (no device identity) #27494 - Operator scopes cleared for API clients authenticating via shared token
• [Bug]: openclaw-cli token auth scope operator.read missing #50474 - openclaw-cli token auth scope operator.read missing

Request

Please fix the scope authentication for plugin/channel connectors using token auth, or provide documentation on the correct authentication method for DingTalk connector to access gateway APIs.