From 8b8fce53713721e3058e58a7c1b5e3296bb0bd34 Mon Sep 17 00:00:00 2001
From: wakingcan <wakingcan@users.noreply.github.com>
Date: Tue, 27 Jan 2026 00:33:24 -0600
Subject: [PATCH 1/2] fix(discord): add warning log when slash command rejected
 due to missing allowlist

When a Discord slash command is rejected because no user allowlist is configured,
log a helpful warning message to assist users in debugging the issue.

The warning includes:
- The user ID that was rejected
- Instructions to configure channels.discord.guilds.<id>.users or dm.allowFrom

This maintains the secure-by-default behavior (deny when no allowlist) while
making it easier for users to understand why commands are being rejected.

Example log:
discord: slash command rejected for user 123456 - no allowlist configured.
Configure channels.discord.guilds.<id>.users or channels.discord.dm.allowFrom to allow users.
---
 src/discord/monitor/native-command.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/discord/monitor/native-command.ts b/src/discord/monitor/native-command.ts
index 2340da2da..c4df21bfc 100644
--- a/src/discord/monitor/native-command.ts
+++ b/src/discord/monitor/native-command.ts
@@ -38,6 +38,7 @@ import {
   readChannelAllowFromStore,
   upsertChannelPairingRequest,
 } from "../../pairing/pairing-store.js";
+import { logVerbose } from "../../globals.js";
 import { resolveAgentRoute } from "../../routing/resolve-route.js";
 import { loadWebMedia } from "../../web/media.js";
 import { chunkDiscordTextWithMode } from "../chunk.js";
@@ -656,6 +657,14 @@ async function dispatchDiscordCommandInteraction(params: {
       modeWhenAccessGroupsOff: "configured",
     });
     if (!commandAuthorized) {
+      // Log warning when no allowlist is configured to help users debug
+      const anyAuthorizerConfigured = authorizers.some((entry) => entry.configured);
+      if (!anyAuthorizerConfigured) {
+        logVerbose(
+          `discord: slash command rejected for user ${user.id} - no allowlist configured. ` +
+            `Configure channels.discord.guilds.<id>.users or channels.discord.dm.allowFrom to allow users.`,
+        );
+      }
       await respond("You are not authorized to use this command.", { ephemeral: true });
       return;
     }

From 54a592711e0331daa406f9094fdcb188e0d677ca Mon Sep 17 00:00:00 2001
From: wakingcan <wakingcan@users.noreply.github.com>
Date: Tue, 27 Jan 2026 01:16:40 -0600
Subject: [PATCH 2/2] fix(discord): allow all channels when no channel
 allowlist is configured

When a guild is in the allowlist but has no channels configured,
all channels should be allowed. Previously, an empty channels object
({}) would cause channelConfig to return {allowed: false}, blocking
all messages.

Now the code checks for both null/undefined AND empty object,
returning null in both cases which results in channelAllowed=true.
---
 src/discord/monitor/allow-list.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/discord/monitor/allow-list.ts b/src/discord/monitor/allow-list.ts
index 12c2d1d39..645847889 100644
--- a/src/discord/monitor/allow-list.ts
+++ b/src/discord/monitor/allow-list.ts
@@ -258,7 +258,8 @@ export function resolveDiscordChannelConfigWithFallback(params: {
     scope,
   } = params;
   const channels = guildInfo?.channels;
-  if (!channels) return null;
+  // Return null if channels is undefined, null, or empty object - allows all channels when no allowlist is configured
+  if (!channels || Object.keys(channels).length === 0) return null;
   const resolvedParentSlug = parentSlug ?? (parentName ? normalizeDiscordSlug(parentName) : "");
   const match = resolveDiscordChannelEntryMatch(
     channels,