fix(security): gate slash/control commands

src/auto-reply/command-auth.ts

@@ -1,7 +1,7 @@
 import type { ChannelDock } from "../channels/dock.js";
 import { getChannelDock, listChannelDocks } from "../channels/dock.js";
 import type { ChannelId } from "../channels/plugins/types.js";
-import { normalizeChannelId } from "../channels/plugins/index.js";
+import { normalizeAnyChannelId } from "../channels/registry.js";
 import type { ClawdbotConfig } from "../config/config.js";
 import type { MsgContext } from "./templating.js";
 
@@ -16,15 +16,15 @@ export type CommandAuthorization = {
 
 function resolveProviderFromContext(ctx: MsgContext, cfg: ClawdbotConfig): ChannelId | undefined {
   const direct =
-    normalizeChannelId(ctx.Provider) ??
-    normalizeChannelId(ctx.Surface) ??
-    normalizeChannelId(ctx.OriginatingChannel);
+    normalizeAnyChannelId(ctx.Provider) ??
+    normalizeAnyChannelId(ctx.Surface) ??
+    normalizeAnyChannelId(ctx.OriginatingChannel);
   if (direct) return direct;
   const candidates = [ctx.From, ctx.To]
     .filter((value): value is string => Boolean(value?.trim()))
     .flatMap((value) => value.split(":").map((part) => part.trim()));
   for (const candidate of candidates) {
-    const normalized = normalizeChannelId(candidate);
+    const normalized = normalizeAnyChannelId(candidate);
     if (normalized) return normalized;
   }
   const configured = listChannelDocks()

src/auto-reply/reply/abort.ts

@@ -119,14 +119,6 @@ export async function tryFastAbortFromMessage(params: {
   cfg: ClawdbotConfig;
 }): Promise<{ handled: boolean; aborted: boolean; stoppedSubagents?: number }> {
   const { ctx, cfg } = params;
-  const commandAuthorized = ctx.CommandAuthorized ?? true;
-  const auth = resolveCommandAuthorization({
-    ctx,
-    cfg,
-    commandAuthorized,
-  });
-  if (!auth.isAuthorizedSender) return { handled: false, aborted: false };
-
   const targetKey = resolveAbortTargetKey(ctx);
   const agentId = resolveSessionAgentId({
     sessionKey: targetKey ?? ctx.SessionKey ?? "",
@@ -140,6 +132,14 @@ export async function tryFastAbortFromMessage(params: {
   const abortRequested = normalized === "/stop" || isAbortTrigger(stripped);
   if (!abortRequested) return { handled: false, aborted: false };
 
+  const commandAuthorized = ctx.CommandAuthorized ?? true;
+  const auth = resolveCommandAuthorization({
+    ctx,
+    cfg,
+    commandAuthorized,
+  });
+  if (!auth.isAuthorizedSender) return { handled: false, aborted: false };
+
   const abortKey = targetKey ?? auth.from ?? auth.to;
   const requesterSessionKey = targetKey ?? ctx.SessionKey ?? abortKey;