1. src/channels/mention-gating.ts, line 184-191 (link)

   suppressIfOtherAgentMentioned silently dropped by deprecated flat-params path

   normalizeMentionDecisionParams converts the legacy flat call shape to the nested form but never forwards suppressIfOtherAgentMentioned. Because ResolveInboundMentionDecisionFlatParams is InboundMentionFacts & InboundMentionPolicy, TypeScript happily accepts the field on the flat form — but it is destroyed during normalization and the suppression never fires.

   Or, to avoid the cast, destructure suppressIfOtherAgentMentioned alongside the other policy fields at line 165 and include it in the returned object.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: src/channels/mention-gating.ts
   Line: 184-191
   
   Comment:
   **`suppressIfOtherAgentMentioned` silently dropped by deprecated flat-params path**
   
   `normalizeMentionDecisionParams` converts the legacy flat call shape to the nested form but never forwards `suppressIfOtherAgentMentioned`. Because `ResolveInboundMentionDecisionFlatParams` is `InboundMentionFacts & InboundMentionPolicy`, TypeScript happily accepts the field on the flat form — but it is destroyed during normalization and the suppression never fires.
   
   
   
   Or, to avoid the cast, destructure `suppressIfOtherAgentMentioned` alongside the other policy fields at line 165 and include it in the returned object.
   
   How can I resolve this? If you propose a fix, please make it concise.

Best possible solution:

Land a narrower routing change or replacement branch that introduces a typed explicit-agent-target signal, wires only channels that can prove that signal, preserves Discord role context, separates postinstall cleanup into a security-reviewed patch, and adds focused shared plus channel regression coverage with a changelog entry.

Do we have a high-confidence way to reproduce the issue?

Yes. Current-main behavior is reproducible by code inspection of resolveInboundMentionDecision and the channel drop guards; the PR regressions are reproducible with always-on group cases containing a non-agent user/role mention and with Discord preflight role-context checks.

Is this the best way to solve the issue?

No. The requested behavior belongs in the shared mention-policy area, but this implementation is not the best fix because it uses generic platform mention evidence as agent-target evidence and mixes unrelated install-script cleanup into a routing feature.

Full review comments:

• [P1] Restrict suppression to agent-target mentions — src/channels/mention-gating.ts:133-139
  The new suppression path treats hasAnyMention as proof that another OpenClaw agent was targeted, but several call sites pass generic platform mentions such as Slack users, Discord users/roles/everyone, Teams mention entities, or WhatsApp JIDs. In always-on groups this drops normal chatter that mentions a person or role, even though no other agent was addressed.
  Confidence: 0.9
• [P1] Restore Discord member role ids — extensions/discord/src/monitor/message-handler.preflight.ts:1085-1086
  The returned preflight context no longer includes memberRoleIds, while downstream Discord processing forwards that field into MemberRoleIds. This loses sender role context for role-scoped routing, policy, and prompt behavior, so the payload should include it again.
  Confidence: 0.93
• [P1] Validate dist extension roots before deleting — scripts/postinstall-bundled-plugins.mjs:671-673
pruneBundledDistPluginNodeModules recursively removes dist/extensions/*/node_modules after only checking existence and Dirent metadata. If dist/extensions or a plugin directory is redirected, postinstall can delete outside the OpenClaw package tree; reuse the existing realpath/lstat boundary checks before calling rmSync.
  Confidence: 0.88
• [P3] Add the required changelog entry — src/channels/mention-gating.ts:51-56
  This is a user-facing routing feature across bundled channel plugins, but the PR does not update CHANGELOG.md. Add a single-line entry under the active release section with appropriate non-bot contributor credit before landing.
  Confidence: 0.86

Overall correctness: patch is incorrect
Overall confidence: 0.91

Security concerns:

• [high] Postinstall recursive deletion lacks root validation — scripts/postinstall-bundled-plugins.mjs:673
  The new pruneBundledDistPluginNodeModules deletes join(extensionsDir, entry.name, "node_modules") recursively during postinstall without proving that extensionsDir and each target resolve under the OpenClaw package root. A redirected or symlinked dist tree could cause deletion outside the install directory.
  Confidence: 0.88

Acceptance criteria:

• pnpm test src/channels/mention-gating.test.ts
• pnpm test extensions/discord/src/monitor/message-handler.preflight.test.ts extensions/slack/src/monitor/message-handler/prepare.test.ts extensions/msteams/src/monitor-handler/message-handler.test.ts
• pnpm test test/scripts/postinstall-bundled-plugins.test.ts if postinstall cleanup remains
• pnpm check:changed in Testbox before handoff

What I checked:

• Current main lacks always-on suppression: InboundMentionPolicy has no suppressIfOtherAgentMentioned field, InboundMentionDecision has no suppression result, and shouldSkip is still gated by requireMention, so always-on agents cannot be skipped by the shared helper on current main. (src/channels/mention-gating.ts:47, 9e5d0380b0ec)
• Slack any-mention signal is generic: Current Slack code sets hasAnyMention for any Slack user or subteam mention, so using that signal as proof of another OpenClaw agent target would suppress normal human or group mentions. (extensions/slack/src/monitor/message-handler/prepare.ts:289, 9e5d0380b0ec)
• Discord any-mention signal is generic: Current Discord preflight treats mentioned users, roles, and everyone as hasAnyMention; that is not equivalent to a configured agent target and overlaps existing ignoreOtherMentions semantics. (extensions/discord/src/monitor/message-handler.preflight.ts:320, 9e5d0380b0ec)
• Discord role context regression: Current main computes memberRoleIds, uses it in access checks, and passes it into the preflight context; the PR diff removes memberRoleIds from the return payload, which would drop downstream role context. (extensions/discord/src/monitor/message-handler.preflight.ts:642, 9e5d0380b0ec)
• Postinstall deletion must use root-boundary checks: Current main's installed-dist pruning validates the real dist root and uses assertSafeInstalledDistPath before removals; the PR adds a separate recursive deletion path for dist/extensions/*/node_modules without those checks. (scripts/postinstall-bundled-plugins.mjs:134, 9e5d0380b0ec)
• No changelog entry for user-facing routing change: The PR files do not include CHANGELOG.md, and a repo search found no mention of suppressIfOtherAgentMentioned, suppressedByOtherAgentMention, or the linked routing feature in the changelog. (CHANGELOG.md:5, 9e5d0380b0ec)

Likely related people:

• steipete: Current-main blame and log in this checkout point the shared mention-gating, Discord preflight, and postinstall paths at the recent refactor commit by Peter Steinberger; deeper original history was not available in the shallow checkout. (role: recent maintainer; confidence: high; commits: affca3da1f; files: src/channels/mention-gating.ts, extensions/discord/src/monitor/message-handler.preflight.ts, scripts/postinstall-bundled-plugins.mjs)
• joshavant: The PR author explicitly requested review from this maintainer in the PR discussion for the channel-routing change; local code-history evidence for this checkout was limited. (role: requested reviewer; confidence: low; files: src/channels/mention-gating.ts, extensions/discord/src/monitor/message-handler.preflight.ts)
• gumadeiras: The PR author explicitly requested review from this maintainer in the PR discussion for the channel-routing change; local code-history evidence for this checkout was limited. (role: requested reviewer; confidence: low; files: src/channels/mention-gating.ts, extensions/*/src)

Remaining risk / open question:

• The patch would suppress always-on agents on generic human, role, or group mentions rather than only configured OpenClaw agent mentions.
• The postinstall pruning change performs recursive deletion during install and needs the same package-root realpath boundary checks as current installed-dist pruning.
• The branch overlaps recent Discord and postinstall refactors on current main, so a direct merge may be stale even after functional fixes.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 9e5d0380b0ec.