🔒 Aisle Security Analysis

✅ We scanned this PR and did not find any security vulnerabilities.

_{Aisle supplements but does not replace security review.}

Analyzed PR: #57650 at commit 5fda7a3

_{Last updated on: 2026-03-30T15:55:42Z}

Greptile Summary

This PR hardens the approval authentication and routing layer across several dimensions: it closes an authorization bypass in the /approve command by requiring explicit channel-level approval authorization (not just the default pass-through), gates the Telegram plugin.approval.resolve fallback behind a new allowPluginFallback flag, scopes Telegram plugin approval delivery to the originating account, tightens origin-target cross-validation for both Telegram and Discord native approvals, and makes the shared approval channel runtime more robust with payload validation, a bounded pending-approvals map, and safe async error handling.

Key changes:

• channel-approval-auth.ts: New explicit field distinguishes a real channel decision from the implicit { authorized: true } default; callers now have enough signal to require affirmative authorization.
• commands-approve.ts: Gate changed from !authorized to !(explicit && authorized) — the implicit default no longer serves as a bypass for non-isAuthorizedSender callers.
• exec-approval-resolver.ts: allowPluginFallback must be explicitly true for the plugin.approval.resolve retry to be attempted; a "not found" error no longer silently escalates.
• bot-handlers.runtime.ts: allowPluginFallback is wired to whether the sender is a known plugin approver; raw gateway error strings are replaced with a sanitized message.
• exec-approvals-handler.ts: resolveBoundTelegramAccountId prevents cross-account plugin approval delivery via a new filter in matchesFilters.
• exec-approval-channel-runtime.ts: Incoming gateway event payloads are validated before processing; pending approvals are capped at 1 000 entries / 30-minute TTL; void promise is replaced with a spawn helper that logs rejections.
• approval-native.ts (Telegram & Discord): Origin-target resolution now validates account-ID and channel-target consistency across both turn-source and session-key sources.

Confidence Score: 5/5

Safe to merge — changes are well-scoped security hardening with comprehensive test coverage and no identified P0/P1 issues.

All changed logic is covered by new unit tests, the security fixes are straightforward and correctly implemented, and no P0/P1 defects were found during review.

No files require special attention.

_{Reviews (1): Last reviewed commit: "test(exec): drop unused commands import" | Re-trigger Greptile}

💡 Codex Review

Infer plugin approvals from payload instead of ID prefix

deliverRequested classifies approval kind only via request.id.startsWith("plugin:"), so legacy plugin approvals that use unprefixed IDs are treated as exec approvals. In that case this path builds an exec payload from a plugin request object, which drops plugin title/description context and can render misleading blank command prompts. Since this change also introduces legacy unprefixed-plugin resolve fallback, request-kind detection should use request shape (or event kind) rather than ID prefix.

Superseded by the reviewable split here:

• refactor(exec): unify channel approvals and restore routing/auth #57838
• fix(exec): harden shell-side approval guardrails #57839

Closing this stacked PR so the approval work only has two active review surfaces: one main approval/runtime/routing/auth PR and one shell /approve hardening PR.