Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix bug(discord): unconfigured channels bypass allowlist when channelAllowlistConfigured=true [2 pull requests, 1 comments, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#54277•Fetched 2026-04-08 01:29:47
View on GitHub
Comments
1
Participants
1
Timeline
5
Reactions
0
Author
supperdsjsupperdsj
Participants
supperdsjsupperdsj
Timeline (top)
cross-referenced ×2referenced ×2commented ×1

When a Discord guild has groupPolicy: allowlist and a non-empty channels config (so channelAllowlistConfigured = true), any channel that is not listed in channels is incorrectly allowed through instead of being blocked.

Root Cause

In extensions/discord/src/monitor/message-handler.preflight.ts:

const channelAllowed = channelConfig?.allowed !== false;

When channelConfig is undefined (channel not in config), undefined !== false evaluates to true, so channelAllowed = true.

This value is then passed to isDiscordGroupAllowedByPolicy as channelAllowed: true, making the policy think the channel is explicitly allowed.

Fix Action

Fixed

PR fix notes

PR #54282: fix(discord): block unconfigured channels under groupPolicy allowlist

Description (problem / solution / changelog)

Problem

Fixes #54277

When groupPolicy: allowlist is set on a Discord guild and at least one channel is explicitly configured in channels, any channel not in the channels config is incorrectly allowed through.

Root cause

// message-handler.preflight.ts
const channelAllowed = channelConfig?.allowed !== false;

When channelConfig is undefined (channel not configured), undefined !== false evaluates to true, so channelAllowed = true. This causes isDiscordGroupAllowedByPolicy to treat the channel as allowlisted.

Fix

When an allowlist is configured (channelAllowlistConfigured = true), require explicit allow: true for a channel to be considered matched. For unconfigured guilds (no channel config at all), keep the old behaviour to avoid breaking the no-allowlist case.

// After
const channelAllowed = channelAllowlistConfigured
  ? channelConfig?.allowed === true
  : channelConfig?.allowed !== false;

Changes

  • extensions/discord/src/monitor/message-handler.preflight.ts: fix channelAllowed logic
  • extensions/discord/src/monitor/message-handler.preflight.test.ts: add regression test for unconfigured channel bypass

Test

New test: "drops guild messages from unconfigured channels when allowlist is configured (issue #54277)"

All 21 existing preflight tests continue to pass.

Changed files

  • extensions/discord/src/monitor/message-handler.preflight.test.ts (added, +874/-0)
  • extensions/discord/src/monitor/message-handler.preflight.ts (added, +952/-0)

PR #54353: fix(discord): block unconfigured channels under groupPolicy allowlist

Description (problem / solution / changelog)

Problem

Fixes #54277

When groupPolicy: allowlist is set on a Discord guild and at least one channel is explicitly configured in channels, any channel not in the channels config is incorrectly allowed through.

Root cause

// message-handler.preflight.ts
const channelAllowed = channelConfig?.allowed !== false;

When channelConfig is undefined (channel not configured), undefined !== false evaluates to true, so channelAllowed = true. This causes isDiscordGroupAllowedByPolicy to treat the channel as allowlisted.

Fix

When an allowlist is configured (channelAllowlistConfigured = true), require explicit allow: true for a channel to be considered matched. For unconfigured guilds (no channel config at all), keep the old behaviour to avoid breaking the no-allowlist case.

// After
const channelAllowed = channelAllowlistConfigured
  ? channelConfig?.allowed === true
  : channelConfig?.allowed !== false;

Changes

  • extensions/discord/src/monitor/message-handler.preflight.ts: 6-line logic fix
  • extensions/discord/src/monitor/message-handler.preflight.test.ts: 36-line regression test

Test

New test: "drops guild messages from unconfigured channels when allowlist is configured (issue #54277)"

All 21 existing preflight tests continue to pass.

Changed files

  • extensions/discord/src/monitor/message-handler.preflight.test.ts (added, +874/-0)
  • extensions/discord/src/monitor/message-handler.preflight.ts (added, +952/-0)

Code Example

const channelAllowed = channelConfig?.allowed !== false;

---

// Before
const channelAllowed = channelConfig?.allowed !== false;

// After  
const channelAllowed = channelConfig?.allowed === true;
RAW_BUFFERClick to expand / collapse

Summary

When a Discord guild has groupPolicy: allowlist and a non-empty channels config (so channelAllowlistConfigured = true), any channel that is not listed in channels is incorrectly allowed through instead of being blocked.

Root Cause

In extensions/discord/src/monitor/message-handler.preflight.ts:

const channelAllowed = channelConfig?.allowed !== false;

When channelConfig is undefined (channel not in config), undefined !== false evaluates to true, so channelAllowed = true.

This value is then passed to isDiscordGroupAllowedByPolicy as channelAllowed: true, making the policy think the channel is explicitly allowed.

Expected Behavior

Under groupPolicy: allowlist, a channel with no config entry should be treated as not allowlisted and blocked, consistent with the allowlist semantics in evaluateGroupRouteAccessForPolicy (reason: route_not_allowlisted).

Actual Behavior

An unconfigured channel is silently allowed through whenever another channel in the same guild is explicitly configured (making channelAllowlistConfigured = true).

Reproduction

  1. Set groupPolicy: allowlist on a Discord guild
  2. Add at least one channel to channels (so the allowlist is non-empty)
  3. Send a message in any channel that is not in the channels config
  4. The message is processed by the agent despite not being allowlisted

Proposed Fix

Change the channelAllowed resolution to treat undefined config as not matched:

// Before
const channelAllowed = channelConfig?.allowed !== false;

// After  
const channelAllowed = channelConfig?.allowed === true;

Or alternatively pass whether the channel was actually found in config as a separate boolean to isDiscordGroupAllowedByPolicy.

Environment

  • Confirmed in source: extensions/discord/src/monitor/message-handler.preflight.ts
  • Related: src/plugin-sdk/group-access.ts evaluateGroupRouteAccessForPolicy

extent analysis

Fix Plan

To fix the issue, update the channelAllowed resolution in extensions/discord/src/monitor/message-handler.preflight.ts to treat undefined config as not matched.

  • Replace the existing line:
const channelAllowed = channelConfig?.allowed !== false;
  • With the corrected line:
const channelAllowed = channelConfig?.allowed === true;

Alternatively, pass whether the channel was actually found in config as a separate boolean to isDiscordGroupAllowedByPolicy.

Verification

To verify the fix:

  1. Set groupPolicy: allowlist on a Discord guild.
  2. Add at least one channel to channels.
  3. Send a message in any channel that is not in the channels config.
  4. The message should be blocked by the agent.

Extra Tips

  • Ensure to test the fix in a non-production environment before deploying it to production.
  • Review related code in src/plugin-sdk/group-access.ts and evaluateGroupRouteAccessForPolicy to ensure consistency with the allowlist semantics.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#retriever error#indexing error#inference speed#output truncation#response parsing

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING