fix: harden discord ack auth and gate fallout (#60081) (thanks @FunJim)

extensions/discord/src/monitor/message-handler.process.test.ts

@@ -303,14 +303,31 @@ describe("processDiscordMessage ack reactions", () => {
 
   it("sends ack reactions for mention-gated guild messages when mentioned", async () => {
     const ctx = await createBaseContext({
+      accountId: "ops",
       shouldRequireMention: true,
       effectiveWasMentioned: true,
+      route: {
+        agentId: "main",
+        channel: "discord",
+        accountId: "ops",
+        sessionKey: "agent:main:discord:channel:c1",
+        mainSessionKey: "agent:main:main",
+      },
     });
 
     // oxlint-disable-next-line typescript/no-explicit-any
     await processDiscordMessage(ctx as any);
 
-    expect(sendMocks.reactMessageDiscord.mock.calls[0]).toEqual(["c1", "m1", "👀", { rest: {}, cfg: expect.objectContaining({ messages: { ackReaction: "👀" } }) }]);
+    expect(sendMocks.reactMessageDiscord.mock.calls[0]).toEqual([
+      "c1",
+      "m1",
+      "👀",
+      {
+        rest: {},
+        cfg: expect.objectContaining({ messages: { ackReaction: "👀" } }),
+        accountId: "ops",
+      },
+    ]);
   });
 
   it("uses preflight-resolved messageChannelId when message.channelId is missing", async () => {
@@ -332,7 +349,11 @@ describe("processDiscordMessage ack reactions", () => {
       "fallback-channel",
       "m1",
       "👀",
-      { rest: {}, cfg: expect.objectContaining({ messages: { ackReaction: "👀" } }) },
+      {
+        rest: {},
+        cfg: expect.objectContaining({ messages: { ackReaction: "👀" } }),
+        accountId: "default",
+      },
     ]);
   });
 
@@ -488,7 +509,21 @@ describe("processDiscordMessage ack reactions", () => {
     // oxlint-disable-next-line typescript/no-explicit-any
     await processDiscordMessage(ctx as any);
 
-    expect(sendMocks.removeReactionDiscord).toHaveBeenCalledWith("c1", "m1", "👀", expect.objectContaining({ rest: {}, cfg: expect.objectContaining({ messages: expect.objectContaining({ ackReaction: "👀", removeAckAfterReply: true }) }) }));
+    expect(sendMocks.removeReactionDiscord).toHaveBeenCalledWith(
+      "c1",
+      "m1",
+      "👀",
+      expect.objectContaining({
+        rest: {},
+        cfg: expect.objectContaining({
+          messages: expect.objectContaining({
+            ackReaction: "👀",
+            removeAckAfterReply: true,
+          }),
+        }),
+        accountId: "default",
+      }),
+    );
   });
 
   it("removes the plain ack reaction when status reactions are disabled and removeAckAfterReply is enabled", async () => {

extensions/discord/src/subagent-hooks.ts

@@ -26,14 +26,14 @@ type DiscordSubagentSpawningEvent = {
     threadId?: string | number;
   };
   childSessionKey: string;
-  agentId?: string;
+  agentId: string;
   label?: string;
 };
 
 type DiscordSubagentEndedEvent = {
   targetSessionKey: string;
   accountId?: string;
-  targetKind?: string;
+  targetKind?: ThreadBindingTargetKind;
   reason?: string;
   sendFarewell?: boolean;
 };

extensions/telegram/src/approval-native.ts

@@ -119,7 +119,7 @@ const resolveTelegramApproveCommandBehavior: NonNullable<
     isTelegramExecApprovalAuthorizedSender({ cfg, accountId, senderId }) &&
     !isTelegramExecApprovalApprover({ cfg, accountId, senderId })
   ) {
-    return { kind: "ignore" };
+    return undefined;
   }
   return {
     kind: "reply",