refactor: share allowFrom stringification helpers

extensions/bluebubbles/src/monitor-processing.ts

@@ -8,6 +8,7 @@ import {
   logAckFailure,
   logInboundDrop,
   logTypingFailure,
+  mapAllowFromEntries,
   readStoreAllowFromForDmPolicy,
   recordPendingHistoryEntryIfEnabled,
   resolveAckReaction,
@@ -510,7 +511,7 @@ export async function processMessage(
 
   const dmPolicy = account.config.dmPolicy ?? "pairing";
   const groupPolicy = account.config.groupPolicy ?? "allowlist";
-  const configuredAllowFrom = (account.config.allowFrom ?? []).map((entry) => String(entry));
+  const configuredAllowFrom = mapAllowFromEntries(account.config.allowFrom);
   const storeAllowFrom = await readStoreAllowFromForDmPolicy({
     provider: "bluebubbles",
     accountId: account.accountId,

extensions/zalo/src/channel.ts

@@ -159,10 +159,8 @@ export const zaloPlugin: ChannelPlugin<ResolvedZaloAccount> = {
       if (groupPolicy !== "open") {
         return [];
       }
-      const explicitGroupAllowFrom = (account.config.groupAllowFrom ?? []).map((entry) =>
+      const explicitGroupAllowFrom = mapAllowFromEntries(account.config.groupAllowFrom);
-        String(entry),
+      const dmAllowFrom = mapAllowFromEntries(account.config.allowFrom);
-      );
-      const dmAllowFrom = (account.config.allowFrom ?? []).map((entry) => String(entry));
       const effectiveAllowFrom =
         explicitGroupAllowFrom.length > 0 ? explicitGroupAllowFrom : dmAllowFrom;
       if (effectiveAllowFrom.length > 0) {

src/channels/allowlists/resolve-utils.ts

@@ -1,3 +1,4 @@
+import { mapAllowFromEntries } from "../../plugin-sdk/channel-config-helpers.js";
 import type { RuntimeEnv } from "../../runtime.js";
 
 export type AllowlistUserResolutionLike = {
@@ -28,10 +29,7 @@ export function mergeAllowlist(params: {
   existing?: Array<string | number>;
   additions: string[];
 }): string[] {
-  return dedupeAllowlistEntries([
+  return dedupeAllowlistEntries([...mapAllowFromEntries(params.existing), ...params.additions]);
-    ...(params.existing ?? []).map((entry) => String(entry)),
-    ...params.additions,
-  ]);
 }
 
 export function buildAllowlistResolutionSummary<T extends AllowlistUserResolutionLike>(

src/channels/plugins/directory-config.ts

@@ -1,5 +1,6 @@
 import type { OpenClawConfig } from "../../config/types.js";
 import { inspectDiscordAccount } from "../../discord/account-inspect.js";
+import { mapAllowFromEntries } from "../../plugin-sdk/channel-config-helpers.js";
 import { inspectSlackAccount } from "../../slack/account-inspect.js";
 import { inspectTelegramAccount } from "../../telegram/account-inspect.js";
 import { resolveWhatsAppAccount } from "../../web/accounts.js";
@@ -161,7 +162,7 @@ export async function listTelegramDirectoryPeersFromConfig(
 ): Promise<ChannelDirectoryEntry[]> {
   const account = inspectTelegramAccount({ cfg: params.cfg, accountId: params.accountId });
   const raw = [
-    ...(account.config.allowFrom ?? []).map((entry) => String(entry)),
+    ...mapAllowFromEntries(account.config.allowFrom),
     ...Object.keys(account.config.dms ?? {}),
   ];
   const ids = Array.from(

src/infra/outbound/targets.ts

@@ -5,6 +5,7 @@ import type { OpenClawConfig } from "../../config/config.js";
 import type { SessionEntry } from "../../config/sessions.js";
 import type { AgentDefaultsConfig } from "../../config/types.agent-defaults.js";
 import { parseDiscordTarget } from "../../discord/targets.js";
+import { mapAllowFromEntries } from "../../plugin-sdk/channel-config-helpers.js";
 import { normalizeAccountId } from "../../routing/session-key.js";
 import { parseSlackTarget } from "../../slack/targets.js";
 import { parseTelegramTarget, resolveTelegramTargetChatType } from "../../telegram/targets.js";
@@ -203,7 +204,7 @@ export function resolveOutboundTarget(params: {
           accountId: params.accountId ?? undefined,
         })
       : undefined);
-  const allowFrom = allowFromRaw?.map((entry) => String(entry));
+  const allowFrom = allowFromRaw ? mapAllowFromEntries(allowFromRaw) : undefined;
 
   // Fall back to per-channel defaultTo when no explicit target is provided.
   const effectiveTo =
@@ -496,9 +497,7 @@ function resolveHeartbeatSenderId(params: {
     provider && lastTo ? `${provider}:${lastTo}` : undefined,
   ].filter((val): val is string => Boolean(val?.trim()));
 
-  const allowList = allowFrom
+  const allowList = mapAllowFromEntries(allowFrom).filter((entry) => entry && entry !== "*");
-    .map((entry) => String(entry))
-    .filter((entry) => entry && entry !== "*");
   if (allowFrom.includes("*")) {
     return candidates[0] ?? "heartbeat";
   }
@@ -536,7 +535,7 @@ export function resolveHeartbeatSenderContext(params: {
         accountId,
       }) ?? [])
     : [];
-  const allowFrom = allowFromRaw.map((entry) => String(entry));
+  const allowFrom = mapAllowFromEntries(allowFromRaw);
 
   const sender = resolveHeartbeatSenderId({
     allowFrom,

src/infra/system-run-normalize.ts

@@ -1,3 +1,5 @@
+import { mapAllowFromEntries } from "../plugin-sdk/channel-config-helpers.js";
+
 export function normalizeNonEmptyString(value: unknown): string | null {
   if (typeof value !== "string") {
     return null;
@@ -7,5 +9,5 @@ export function normalizeNonEmptyString(value: unknown): string | null {
 }
 
 export function normalizeStringArray(value: unknown): string[] {
-  return Array.isArray(value) ? value.map((entry) => String(entry)) : [];
+  return Array.isArray(value) ? mapAllowFromEntries(value) : [];
 }

src/plugin-sdk/bluebubbles.ts

@@ -88,6 +88,7 @@ export { formatDocsLink } from "../terminal/links.js";
 export type { WizardPrompter } from "../wizard/prompts.js";
 export { isAllowedParsedChatSender } from "./allow-from.js";
 export { readBooleanParam } from "./boolean-param.js";
+export { mapAllowFromEntries } from "./channel-config-helpers.js";
 export { createScopedPairingAccess } from "./pairing-access.js";
 export { issuePairingChallenge } from "../pairing/pairing-challenge.js";
 export { resolveRequestUrl } from "./request-url.js";