fix(security): require sender-only matching for elevated allowFrom

Co-authored-by: coygeek <coygeek@users.noreply.github.com>

src/auto-reply/reply/reply-elevated.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it } from "vitest";
+import type { OpenClawConfig } from "../../config/config.js";
+import type { MsgContext } from "../templating.js";
+import { resolveElevatedPermissions } from "./reply-elevated.js";
+
+function buildConfig(allowFrom: string[]): OpenClawConfig {
+  return {
+    tools: {
+      elevated: {
+        allowFrom: {
+          whatsapp: allowFrom,
+        },
+      },
+    },
+  } as OpenClawConfig;
+}
+
+function buildContext(overrides?: Partial<MsgContext>): MsgContext {
+  return {
+    Provider: "whatsapp",
+    Surface: "whatsapp",
+    From: "whatsapp:+15550001111",
+    SenderE164: "+15550001111",
+    To: "+15559990000",
+    ...overrides,
+  } as MsgContext;
+}
+
+describe("resolveElevatedPermissions", () => {
+  it("authorizes when sender matches allowFrom", () => {
+    const result = resolveElevatedPermissions({
+      cfg: buildConfig(["+15550001111"]),
+      agentId: "main",
+      provider: "whatsapp",
+      ctx: buildContext(),
+    });
+
+    expect(result.enabled).toBe(true);
+    expect(result.allowed).toBe(true);
+    expect(result.failures).toHaveLength(0);
+  });
+
+  it("does not authorize when only recipient matches allowFrom", () => {
+    const result = resolveElevatedPermissions({
+      cfg: buildConfig(["+15559990000"]),
+      agentId: "main",
+      provider: "whatsapp",
+      ctx: buildContext(),
+    });
+
+    expect(result.enabled).toBe(true);
+    expect(result.allowed).toBe(false);
+    expect(result.failures).toContainEqual({
+      gate: "allowFrom",
+      key: "tools.elevated.allowFrom.whatsapp",
+    });
+  });
+});

src/auto-reply/reply/reply-elevated.ts

@@ -97,8 +97,6 @@ function isApprovedElevatedSender(params: {
   addToken(params.ctx.SenderE164);
   addToken(params.ctx.From);
   addToken(stripSenderPrefix(params.ctx.From));
-  addToken(params.ctx.To);
-  addToken(stripSenderPrefix(params.ctx.To));
 
   for (const rawEntry of allowTokens) {
     const entry = rawEntry.trim();