Summary

Fixes two regressions introduced by PR #27750 which changed the session key format for group/channel keys to include accountId.

Problem

PR #27750 changed the session key format:

• Old format: agent:<agentId>:<channel>:<peerKind>:<peerId>
• New format: agent:<agentId>:<channel>:<accountId>:<peerKind>:<peerId>

This broke two critical features:

1. Channel derivation in send policy (deriveChannelFromKey)

• Expected parts[1] to be peerKind (group/channel)
• Now parts[1] is accountId, causing channel-scoped deny rules to be skipped
• Impact: First-use sessions with group/channel keys bypass channel-based send policies

2. Discord exec approvals channel extraction (extractDiscordChannelId)

• Regex /discord:(?:channel|group):(\d+)/ no longer matches new format
• New format: discord:<accountId>:channel:<id>
• Impact: Channel-targeted approval workflows cannot resolve channelId and silently fall back to DM-only behavior

Solution

Updated deriveChannelFromKey

• Now checks both parts[1] and parts[2] for peerKind markers
• Supports both old and new session key formats
• Correctly extracts channel from both formats

Updated extractDiscordChannelId

• Changed regex to /discord:(?:[^:]+:)?(?:channel|group):(\d+)/
• Optionally matches accountId segment: [^:]+:
• Works with both old and new formats

Testing

Added comprehensive test cases:

• Old format session keys (backward compatibility)
• New format session keys with accountId
• Channel-scoped send policy rules
• Discord channel ID extraction for both formats

All tests passing.