openclaw - 💡(How to fix) Fix Telegram /restart command: "You are not authorized" despite sender in commands.allowFrom [1 comments, 2 participants]

Bug Description

Telegram DM from an authorized sender (8601703373, listed in credentials/telegram-default-allowFrom.json) fails with "You are not authorized to use this command." when running /restart.

The same sender is already in credentials/telegram-default-allowFrom.json which works for session routing, but NOT for native command authorization.

Steps to Reproduce

1. Set up Telegram bot with dmPolicy: \"pairing\"
2. Pair/authorize a sender (sender ID appears in credentials/telegram-default-allowFrom.json)
3. Send /restart command in Telegram DM
4. Bot responds: "You are not authorized to use this command."

Config Used

{
  \"allowFrom\": [\"8601703373\"],
  \"commands\": {
    \"allowFrom\": {
      \"telegram\": [\"8601703373\"]
    },
    \"ownerAllowFrom\": [\"8601703373\"],
    \"restart\": true
  },
  \"channels\": {
    \"telegram\": {
      \"allowFrom\": [\"8601703373\"],
      \"dmPolicy\": \"pairing\"
    }
  }
}

Sender also confirmed in credentials/telegram-default-allowFrom.json:

{\"version\": 1, \"allowFrom\": [\"8601703373\", \"8641935340\"]}

Expected Behavior

/restart should execute for authorized sender (same sender works fine for regular chat sessions).

Analysis

• commands.allowFrom.telegram is configured → commandsAllowFromConfigured = true
• resolveCommandAuthorization() is called → resolveCommandsAllowFromList() resolves to [\"8601703373\"]
• resolveSenderCandidates() produces sender candidates from Telegram msg.from.id (8601703373)
• BUT resolveCommandSenderAuthorization() checks commandsAllowFromConfigured && !providerResolutionError first, and requires an exact match in commandsAllowFromList
• The matching appears to fail silently, resulting in isAuthorizedSender: false
• The "not authorized" rejection happens in bot-gUR32RLX.js:rejectNotAuthorized() → called when requireAuth && !commandAuthorized

Possible Cause

The issue may be in how normalizeAllowFromEntry() / formatAllowFromList() processes the sender ID when comparing against commandsAllowFromList. The Telegram sender ID (8601703373 as a numeric string) may not be matching the configured list entry despite appearing identical.