Claude-coauthored approval code used a privileged internal client, letting users limited to operator.write approve or deny command executions.

@@ -9,7 +10,10 @@ import {

+          expiresAtMs: record.expiresAtMs,+        })+        .catch((err) => {+          context.logGateway?.error?.(`exec approvals: forward request failed: ${String(err)}`);+        });

+      void opts?.forwarder+        ?.handleResolved({ id: p.id, decision, resolvedBy, ts: Date.now() })+        .catch((err) => {+          context.logGateway?.error?.(`exec approvals: forward resolve failed: ${String(err)}`);+        });       respond(true, { ok: true }, undefined);     },   };

+import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "../../utils/message-channel.js";+import type { EventFrame } from "../../gateway/protocol/index.js";+import type { ExecApprovalDecision } from "../../infra/exec-approvals.js";+import { createDiscordClient } from "../send.shared.js";+import { logDebug, logError } from "../../logger.js";+import type { DiscordExecApprovalConfig } from "../../config/types.discord.js";+import type { RuntimeEnv } from "../../runtime.js";++const EXEC_APPROVAL_KEY = "execapproval";++export type ExecApprovalRequest = {+  id: string;+  request: {+    command: string;+    cwd?: string | null;+    host?: string | null;+    security?: string | null;+    ask?: string | null;+    agentId?: string | null;+    resolvedPath?: string | null;+    sessionKey?: string | null;+  };+  createdAtMs: number;+  expiresAtMs: number;+};++export type ExecApprovalResolved = {+  id: string;+  decision: ExecApprovalDecision;+  resolvedBy?: string | null;+  ts: number;+};++type PendingApproval = {+  discordMessageId: string;+  discordChannelId: string;+  timeoutId: NodeJS.Timeout;+};++function encodeCustomIdValue(value: string): string {+  return encodeURIComponent(value);+}++function decodeCustomIdValue(value: string): string {+  try {+    return decodeURIComponent(value);+  } catch {+    return value;+  }+}++export function buildExecApprovalCustomId(+  approvalId: string,+  action: ExecApprovalDecision,+): string {+  return [`${EXEC_APPROVAL_KEY}:id=${encodeCustomIdValue(approvalId)}`, `action=${action}`].join(+    ";",+  );+}++export function parseExecApprovalData(+  data: ComponentData,+): { approvalId: string; action: ExecApprovalDecision } | null {+  if (!data || typeof data !== "object") return null;+  const coerce = (value: unknown) =>+    typeof value === "string" || typeof value === "number" ? String(value) : "";+  const rawId = coerce(data.id);+  const rawAction = coerce(data.action);+  if (!rawId || !rawAction) return null;+  const action = rawAction as ExecApprovalDecision;+  if (action !== "allow-once" && action !== "allow-always" && action !== "deny") {+    return null;+  }+  return {+    approvalId: decodeCustomIdValue(rawId),+    action,+  };+}++function formatExecApprovalEmbed(request: ExecApprovalRequest) {+  const commandText = request.request.command;+  const commandPreview =+    commandText.length > 1000 ? `${commandText.slice(0, 1000)}...` : commandText;+  const expiresIn = Math.max(0, Math.round((request.expiresAtMs - Date.now()) / 1000));+

++const COMMAND = "/approve";++const DECISION_ALIASES: Record<string, "allow-once" | "allow-always" | "deny"> = {+  allow: "allow-once",+  once: "allow-once",+  "allow-once": "allow-once",+  allowonce: "allow-once",+  always: "allow-always",+  "allow-always": "allow-always",+  allowalways: "allow-always",+  deny: "deny",+  reject: "deny",+  block: "deny",+};++type ParsedApproveCommand =+  | { ok: true; id: string; decision: "allow-once" | "allow-always" | "deny" }+  | { ok: false; error: string };++function parseApproveCommand(raw: string): ParsedApproveCommand | null {+  const trimmed = raw.trim();+  if (!trimmed.toLowerCase().startsWith(COMMAND)) return null;+  const rest = trimmed.slice(COMMAND.length).trim();+  if (!rest) {+    return { ok: false, error: "Usage: /approve <id> allow-once|allow-always|deny" };+  }+  const tokens = rest.split(/\s+/).filter(Boolean);+  if (tokens.length < 2) {+    return { ok: false, error: "Usage: /approve <id> allow-once|allow-always|deny" };+  }++  const first = tokens[0].toLowerCase();+  const second = tokens[1].toLowerCase();++  if (DECISION_ALIASES[first]) {+    return {+      ok: true,+      decision: DECISION_ALIASES[first],+      id: tokens.slice(1).join(" ").trim(),+    };+  }+  if (DECISION_ALIASES[second]) {+    return {+      ok: true,+      decision: DECISION_ALIASES[second],+      id: tokens[0],+    };+  }+  return { ok: false, error: "Usage: /approve <id> allow-once|allow-always|deny" };+}++function buildResolvedByLabel(params: Parameters<CommandHandler>[0]): string {+  const channel = params.command.channel;+  const sender = params.command.senderId ?? "unknown";+  return `${channel}:${sender}`;+}++export const handleApproveCommand: CommandHandler = async (params, allowTextCommands) => {+  if (!allowTextCommands) return null;+  const normalized = params.command.commandBodyNormalized;+  const parsed = parseApproveCommand(normalized);+  if (!parsed) return null;+  if (!params.command.isAuthorizedSender) {+    logVerbose(+      `Ignoring /approve from unauthorized sender: ${params.command.senderId || "<unknown>"}`,+    );+    return { shouldContinue: false };+  }++  if (!parsed.ok) {+    return { shouldContinue: false, reply: { text: parsed.error } };+  }++  const resolvedBy = buildResolvedByLabel(params);+  try {+    await callGateway({+      method: "exec.approval.resolve",+      params: { id: parsed.id, decision: parsed.decision },+      clientName: GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT,+      clientDisplayName: `Chat approval (${resolvedBy})`,+      mode: GATEWAY_CLIENT_MODES.BACKEND,+    });+  } catch (err) {+    return {

-import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "../../utils/message-channel.js";

 @@ -82,6 +86,20 @@ export const handleApproveCommand: CommandHandler = async (params, allowTextComm

+  }+   const resolvedBy = buildResolvedByLabel(params);   try {     await callGateway({