Root Cause

Two sequential authorization gates both independently blocked bot messages, making DISCORD_ALLOW_BOTS completely ineffective:

Gate 1 — discord.py on_message (line ~552 on main):

# _is_allowed_user ran BEFORE the bot filter
if not self._is_allowed_user(str(message.author.id)):
    return  # bot dropped here — DISCORD_ALLOW_BOTS never reached

if getattr(message.author, "bot", False):
    allow_bots = os.getenv("DISCORD_ALLOW_BOTS", "none")
    ...  # never reached for bots not in DISCORD_ALLOWED_USERS

Gate 2 — gateway/run.py _is_user_authorized:
Even if a bot somehow passed Gate 1, the gateway-level allowlist check would reject it, producing the WARNING gateway.run: Unauthorized user: <bot_id> message reported in the issue.

Fix

gateway/platforms/discord.py — reorder on_message checks so DISCORD_ALLOW_BOTS runs before _is_allowed_user. Bots that pass the bot filter (mentions/all) skip the user allowlist entirely; non-bots are still checked as before.

gateway/session.py — add is_bot: bool = False to SessionSource so the gateway layer can distinguish bot senders.

gateway/platforms/base.py — expose is_bot parameter in build_source and pass it through to SessionSource.

gateway/platforms/discord.py _handle_message — set is_bot=True for bot authors when building SessionSource.

gateway/run.py _is_user_authorized — when source.is_bot is True and DISCORD_ALLOW_BOTS is mentions or all, return True early (platform filter already validated the message).

Result

Fixes #4466

🤖 Generated with Claude Code