From 85549ac3b6dc112fb3be7ea1eb65b39e48ef0b48 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Mon, 5 Jan 2026 00:48:16 +0000
Subject: [PATCH] fix: gate group activation by owner

---
 src/auto-reply/reply/commands.ts | 6 +++++-
 src/discord/monitor.ts           | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/auto-reply/reply/commands.ts b/src/auto-reply/reply/commands.ts
index d76de7b2f..dbe9d2367 100644
--- a/src/auto-reply/reply/commands.ts
+++ b/src/auto-reply/reply/commands.ts
@@ -89,7 +89,11 @@ export function buildCommandContext(params: {
   const ownerList = ownerCandidates
     .map((entry) => normalizeE164(entry))
     .filter((entry): entry is string => Boolean(entry));
-  const isAuthorizedSender = commandAuthorized;
+  const isOwner =
+    !isWhatsAppSurface ||
+    ownerList.length === 0 ||
+    (senderE164 ? ownerList.includes(senderE164) : false);
+  const isAuthorizedSender = commandAuthorized && isOwner;
 
   return {
     surface,
diff --git a/src/discord/monitor.ts b/src/discord/monitor.ts
index c82f07420..4b7f6c94b 100644
--- a/src/discord/monitor.ts
+++ b/src/discord/monitor.ts
@@ -20,7 +20,10 @@ import { hasControlCommand } from "../auto-reply/command-detection.js";
 import { formatAgentEnvelope } from "../auto-reply/envelope.js";
 import { getReplyFromConfig } from "../auto-reply/reply.js";
 import type { ReplyPayload } from "../auto-reply/types.js";
-import type { ReplyToMode } from "../config/config.js";
+import type {
+  DiscordSlashCommandConfig,
+  ReplyToMode,
+} from "../config/config.js";
 import { loadConfig } from "../config/config.js";
 import {
   resolveSessionKey,
@@ -43,6 +46,7 @@ export type MonitorDiscordOpts = {
   mediaMaxMb?: number;
   historyLimit?: number;
   replyToMode?: ReplyToMode;
+  slashCommand?: DiscordSlashCommandConfig;
 };
 
 type DiscordMediaInfo = {