Summary

Owner-only tools (cron, gateway) are never available to agents in the normal message flow because senderIsOwner is not forwarded to runEmbeddedPiAgent.

Root Cause

resolveCommandAuthorization() correctly determines senderIsOwner: true, and get-reply-run.ts correctly stores it in followupRun.run.senderIsOwner. However, the helper functions that construct parameters for runEmbeddedPiAgent omit it:

1. agent-runner-utils.ts:buildEmbeddedRunBaseParams() — copies many properties from params.run but omits senderIsOwner
2. followup-runner.ts — manually lists properties from queued.run but omits senderIsOwner
3. queue/types.ts:FollowupRun["run"] — the type definition is missing senderIsOwner

Because senderIsOwner arrives as undefined at pi-tools.ts, the guard options?.senderIsOwner === true evaluates to false, and applyOwnerOnlyToolPolicy strips all owner-only tools.

Reproduction

1. Configure an agent with tools.allow: ["cron"] and commands.ownerAllowFrom set to a valid sender ID
2. Send a message from that sender asking the agent to schedule a cron reminder
3. The cron tool is not available to the agent despite the sender being correctly identified as owner

Debug logging confirms:

[AUTH] ownerList=["1846655641"] senderCandidates=["1846655641"] matchedSender=1846655641
[TOOLS] senderIsOwner=false ownerOnlyTools=['cron','gateway']

Fix

Three one-line changes:

src/auto-reply/reply/queue/types.ts — add to FollowupRun["run"]:

senderIsOwner?: boolean;

src/auto-reply/reply/agent-runner-utils.ts — add to buildEmbeddedRunBaseParams return:

senderIsOwner: params.run.senderIsOwner,

src/auto-reply/reply/followup-runner.ts — add to runEmbeddedPiAgent call:

senderIsOwner: queued.run.senderIsOwner,

Environment

• OpenClaw version: 2026.2.20
• Channel: Telegram
• Possibly related to [Bug]: Clawd bot can't use it's own cron tool, claims documentation doesn't explain it. #4862 (which may have fixed a different code path but missed the agent-runner refactor)