fix(sessions): derive channel from account-scoped DM session keys in send-policy

yetval · yetval · commit 3adee187627d · 2026-06-13T20:42:56.000Z
diff --git a/src/sessions/send-policy.test.ts b/src/sessions/send-policy.test.ts
@@ -2,6 +2,7 @@
 import { describe, expect, it } from "vitest";
 import type { OpenClawConfig } from "../config/config.js";
 import type { SessionEntry } from "../config/sessions.js";
+import { buildAgentPeerSessionKey } from "../routing/session-key.js";
 import { resolveSendPolicy } from "./send-policy.js";
 
 describe("resolveSendPolicy", () => {
@@ -73,6 +74,19 @@ describe("resolveSendPolicy", () => {
       sessionKey: "demo-channel:direct:user-1",
       expected: "deny",
     },
+    {
+      name: "channel-scoped deny fires for per-account-channel-peer DM key without explicit channel field",
+      cfg: cfgWithRules([{ action: "deny", match: { channel: "demo-channel" } }]),
+      sessionKey: buildAgentPeerSessionKey({
+        agentId: "main",
+        channel: "demo-channel",
+        accountId: "acct-1",
+        peerKind: "direct",
+        peerId: "user-1",
+        dmScope: "per-account-channel-peer",
+      }),
+      expected: "deny",
+    },
   ])("$name", ({ cfg, entry, sessionKey, expected }) => {
     expect(resolveSendPolicy({ cfg, entry, sessionKey })).toBe(expected);
   });
diff --git a/src/sessions/send-policy.ts b/src/sessions/send-policy.ts
@@ -46,12 +46,11 @@ function deriveChannelFromKey(key?: string) {
     return undefined;
   }
   const parts = normalizedKey.split(":").filter(Boolean);
-  // Canonical key layout is <channel>:<peerKind>:<peerId>; parts[0] is the channel
-  // for direct/dm peers too, so channel-scoped rules also fire for direct chats.
-  if (
-    parts.length >= 3 &&
-    (parts[1] === "group" || parts[1] === "channel" || parts[1] === "direct" || parts[1] === "dm")
-  ) {
+  // Key layout is <channel>:[<accountId>:]<peerKind>:<peerId>; parts[0] is the
+  // channel for account-scoped DM keys too, so channel-scoped rules also fire
+  // for per-account-channel-peer sessions, not just 3-part direct/group keys.
+  const peerKinds = new Set(["group", "channel", "direct", "dm"]);
+  if (parts.length >= 3 && parts.slice(1).some((part) => peerKinds.has(part))) {
     return normalizeMatchValue(parts[0]);
   }
   return undefined;
