Summary

• senderIsOwner was dropped when forwarding parameters to runEmbeddedPiAgent, causing owner-only tools (cron, gateway) to be stripped from every agent run
• Added the missing property forwarding in three locations

Details

resolveCommandAuthorization() correctly determines senderIsOwner and get-reply-run.ts stores it in followupRun.run. However, the helper functions that construct parameters for runEmbeddedPiAgent omitted it:

1. agent-runner-utils.ts:buildEmbeddedRunBaseParams() — did not include senderIsOwner
2. followup-runner.ts — same omission in the direct runEmbeddedPiAgent call
3. queue/types.ts:FollowupRun["run"] — type was missing senderIsOwner

Because senderIsOwner arrived as undefined, the guard options?.senderIsOwner === true in pi-tools.ts evaluated to false, and applyOwnerOnlyToolPolicy stripped all owner-only tools.

Fixes #22295

Test plan

• Verify owner-only tools (cron, gateway) are available when sender matches commands.ownerAllowFrom
• Verify owner-only tools are still stripped for non-owner senders
• Verify followup/queued runs also preserve senderIsOwner

🤖 Generated with Claude Code

Greptile Summary

Adds the missing senderIsOwner property forwarding in three locations where parameters are constructed for runEmbeddedPiAgent, fixing a bug where owner-only tools (cron, gateway) were incorrectly stripped from all embedded agent runs.

Changes made:

• agent-runner-utils.ts:buildEmbeddedRunBaseParams() — now forwards senderIsOwner from params.run
• followup-runner.ts — now includes senderIsOwner when calling runEmbeddedPiAgent for queued runs
• queue/types.ts:FollowupRun["run"] — added senderIsOwner?: boolean to the type definition

The fix ensures that authorization context determined by resolveCommandAuthorization() is properly propagated through the entire embedded agent execution pipeline, so applyOwnerOnlyToolPolicy in pi-tools.ts correctly evaluates options?.senderIsOwner === true.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The changes are straightforward property forwarding fixes that restore intended functionality. All three changes add the same missing property (senderIsOwner) in parallel code paths, with consistent typing. The fix aligns with the existing authorization infrastructure and doesn't introduce new logic or side effects.
• No files require special attention

_{Last reviewed commit: 29c23f7}

_{(2/5) Greptile learns from your feedback when you react with thumbs up/down!}