From e95134ba3fa5dc2337fcce596d04677c18d29dc6 Mon Sep 17 00:00:00 2001
From: Vignesh Natarajan <vigneshnatarajan92@gmail.com>
Date: Mon, 16 Feb 2026 11:30:31 -0800
Subject: [PATCH] fix (commands): keep webchat auth on internal provider

---
 src/auto-reply/command-auth.ts         | 17 ++++++++++++++++-
 src/auto-reply/command-control.test.ts | 22 ++++++++++++++++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/src/auto-reply/command-auth.ts b/src/auto-reply/command-auth.ts
index f2d8f64d8c..252bf5cdcf 100644
--- a/src/auto-reply/command-auth.ts
+++ b/src/auto-reply/command-auth.ts
@@ -4,6 +4,7 @@ import type { OpenClawConfig } from "../config/config.js";
 import type { MsgContext } from "./templating.js";
 import { getChannelDock, listChannelDocks } from "../channels/dock.js";
 import { normalizeAnyChannelId } from "../channels/registry.js";
+import { INTERNAL_MESSAGE_CHANNEL, normalizeMessageChannel } from "../utils/message-channel.js";
 
 export type CommandAuthorization = {
   providerId?: ChannelId;
@@ -16,7 +17,15 @@ export type CommandAuthorization = {
 };
 
 function resolveProviderFromContext(ctx: MsgContext, cfg: OpenClawConfig): ChannelId | undefined {
+  const explicitMessageChannel =
+    normalizeMessageChannel(ctx.Provider) ??
+    normalizeMessageChannel(ctx.Surface) ??
+    normalizeMessageChannel(ctx.OriginatingChannel);
+  if (explicitMessageChannel === INTERNAL_MESSAGE_CHANNEL) {
+    return undefined;
+  }
   const direct =
+    normalizeAnyChannelId(explicitMessageChannel ?? undefined) ??
     normalizeAnyChannelId(ctx.Provider) ??
     normalizeAnyChannelId(ctx.Surface) ??
     normalizeAnyChannelId(ctx.OriginatingChannel);
@@ -27,7 +36,13 @@ function resolveProviderFromContext(ctx: MsgContext, cfg: OpenClawConfig): Chann
     .filter((value): value is string => Boolean(value?.trim()))
     .flatMap((value) => value.split(":").map((part) => part.trim()));
   for (const candidate of candidates) {
-    const normalized = normalizeAnyChannelId(candidate);
+    const normalizedCandidateChannel = normalizeMessageChannel(candidate);
+    if (normalizedCandidateChannel === INTERNAL_MESSAGE_CHANNEL) {
+      return undefined;
+    }
+    const normalized =
+      normalizeAnyChannelId(normalizedCandidateChannel ?? undefined) ??
+      normalizeAnyChannelId(candidate);
     if (normalized) {
       return normalized;
     }
diff --git a/src/auto-reply/command-control.test.ts b/src/auto-reply/command-control.test.ts
index a8f2abf94a..660889eca6 100644
--- a/src/auto-reply/command-control.test.ts
+++ b/src/auto-reply/command-control.test.ts
@@ -212,6 +212,28 @@ describe("resolveCommandAuthorization", () => {
     expect(auth.ownerList).toEqual(["123"]);
   });
 
+  it("does not infer a provider from channel allowlists for webchat command contexts", () => {
+    const cfg = {
+      channels: { whatsapp: { allowFrom: ["+15551234567"] } },
+    } as OpenClawConfig;
+
+    const ctx = {
+      Provider: "webchat",
+      Surface: "webchat",
+      OriginatingChannel: "webchat",
+      SenderId: "openclaw-control-ui",
+    } as MsgContext;
+
+    const auth = resolveCommandAuthorization({
+      ctx,
+      cfg,
+      commandAuthorized: true,
+    });
+
+    expect(auth.providerId).toBeUndefined();
+    expect(auth.isAuthorizedSender).toBe(true);
+  });
+
   describe("commands.allowFrom", () => {
     const commandsAllowFromConfig = {
       commands: {