fix(cron/whatsapp): route implicit delivery to allowlisted recipients (openclaw#21533) thanks @Takhoffman

Verified:
- pnpm build
- pnpm check
- pnpm test:macmini

Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>

src/cron/isolated-agent/delivery-target.test.ts

@@ -12,8 +12,18 @@ vi.mock("../../infra/outbound/channel-selection.js", () => ({
   resolveMessageChannelSelection: vi.fn().mockResolvedValue({ channel: "telegram" }),
 }));
 
+vi.mock("../../pairing/pairing-store.js", () => ({
+  readChannelAllowFromStoreSync: vi.fn(() => []),
+}));
+
+vi.mock("../../web/accounts.js", () => ({
+  resolveWhatsAppAccount: vi.fn(() => ({ allowFrom: [] })),
+}));
+
 import { loadSessionStore } from "../../config/sessions.js";
 import { resolveMessageChannelSelection } from "../../infra/outbound/channel-selection.js";
+import { readChannelAllowFromStoreSync } from "../../pairing/pairing-store.js";
+import { resolveWhatsAppAccount } from "../../web/accounts.js";
 import { resolveDeliveryTarget } from "./delivery-target.js";
 
 function makeCfg(overrides?: Partial<OpenClawConfig>): OpenClawConfig {
@@ -50,6 +60,46 @@ async function resolveForAgent(params: {
 }
 
 describe("resolveDeliveryTarget", () => {
+  it("reroutes implicit whatsapp delivery to authorized allowFrom recipient", async () => {
+    setMainSessionEntry({
+      sessionId: "sess-w1",
+      updatedAt: 1000,
+      lastChannel: "whatsapp",
+      lastTo: "+15550000099",
+    });
+    vi.mocked(resolveWhatsAppAccount).mockReturnValue({
+      allowFrom: [],
+    } as unknown as ReturnType<typeof resolveWhatsAppAccount>);
+    vi.mocked(readChannelAllowFromStoreSync).mockReturnValue(["+15550000001"]);
+
+    const cfg = makeCfg({ bindings: [] });
+    const result = await resolveDeliveryTarget(cfg, AGENT_ID, { channel: "last", to: undefined });
+
+    expect(result.channel).toBe("whatsapp");
+    expect(result.to).toBe("+15550000001");
+  });
+
+  it("keeps explicit whatsapp target unchanged", async () => {
+    setMainSessionEntry({
+      sessionId: "sess-w2",
+      updatedAt: 1000,
+      lastChannel: "whatsapp",
+      lastTo: "+15550000099",
+    });
+    vi.mocked(resolveWhatsAppAccount).mockReturnValue({
+      allowFrom: [],
+    } as unknown as ReturnType<typeof resolveWhatsAppAccount>);
+    vi.mocked(readChannelAllowFromStoreSync).mockReturnValue(["+15550000001"]);
+
+    const cfg = makeCfg({ bindings: [] });
+    const result = await resolveDeliveryTarget(cfg, AGENT_ID, {
+      channel: "whatsapp",
+      to: "+15550000099",
+    });
+
+    expect(result.to).toBe("+15550000099");
+  });
+
   it("falls back to bound accountId when session has no lastAccountId", async () => {
     setMainSessionEntry(undefined);