openclaw - 💡(How to fix) Fix fix(discord): native slash built-in commands can acknowledge /think selections before final auth

Summary

Discord native slash commands can show success-like UI for built-in control commands such as /think even when the downstream built-in command/directive auth path will reject the change.

Observed behavior in Discord:

• menu/UI ack shows ✅ Selected xhigh.
• follow-up may fall back to ✅ Done.
• actual session state remains unchanged (Think: low)

Likely cause

The native Discord command layer currently performs channel/guild access checks, but the final built-in command authorization used by the reply pipeline is stricter and happens later. For directive-only built-ins like /think, that later auth can strip the directive silently, leaving no deliverable reply and triggering the generic ✅ Done. fallback.

A second UX problem is that the command-arg component UI says Selected ... before the command application is actually verified.

Scope

• Discord native slash command execution path
• built-in commands/directives such as /think
• command-arg component interaction UX

Acceptance criteria

• Native built-in slash commands run the same final authorization check before menu/display success or dispatch.
• Unauthorized built-in slash invocations return You are not authorized to use this command. instead of falling through to ✅ Done.
• Command-arg component UI no longer implies successful application before the command result is known.
• Add focused tests covering the stricter built-in authorization path.

Test evidence expected

• Focused Vitest coverage for Discord native slash auth behavior.
• Repro test that fails before the fix and passes after.

Rollback considerations

• If the early native auth gate causes regressions, revert the native pre-dispatch gate and keep the UI wording change separately.