@open-mercato/channel-discord 0.6.8-develop.7090.1.4dbca7b350

package/src/modules/channel_discord/backend/channel_discord/channels/[id]/ai-auto-reply/page.tsx

@@ -0,0 +1,288 @@
+'use client'
+
+import * as React from 'react'
+import { useParams } from 'next/navigation'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { Page, PageBody } from '@open-mercato/ui/backend/Page'
+import { CrudForm, type CrudField } from '@open-mercato/ui/backend/CrudForm'
+import { ErrorMessage, LoadingMessage, RecordNotFoundState } from '@open-mercato/ui/backend/detail'
+import { flash } from '@open-mercato/ui/backend/FlashMessages'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { updateCrud } from '@open-mercato/ui/backend/utils/crud'
+import { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'
+
+type EligibleAgent = {
+  id: string
+  label: string
+  description: string
+  requiredFeatures: string[]
+  /** Whether the auto-reply principal holds the agent's `requiredFeatures`. */
+  invocable: boolean
+  missingFeatures: string[]
+}
+
+type AiAutoReplySettings = {
+  channelId: string
+  displayName: string
+  updatedAt: string | null
+  aiAutoReplyEnabled: boolean
+  aiAgentId: string | null
+  aiAutoReplyLastError: string | null
+  aiAutoReplyLastErrorAt: string | null
+  defaultAgentId: string
+  aiAvailable: boolean
+  agents: EligibleAgent[]
+}
+
+type FormValues = {
+  id: string
+  updatedAt: string | null
+  aiAutoReplyEnabled: boolean
+  aiAgentId: string
+}
+
+const CHANNELS_LIST_HREF = '/backend/communication_channels/channels'
+
+/**
+ * Per-channel AI auto-reply settings (issue #4778) — the surface that writes
+ * `aiAutoReplyEnabled` / `aiAgentId`, the two keys the subscriber reads.
+ *
+ * It is a `CrudForm` rather than a hand-rolled form so the save inherits the
+ * platform's contract for free: zod validation with field-level errors, and the
+ * optimistic-lock header auto-derived from `initialValues.updatedAt`, so a save
+ * from a tab opened before someone else touched the channel surfaces the shared
+ * conflict bar instead of overwriting them.
+ */
+export default function DiscordAiAutoReplyPage() {
+  const t = useT()
+  const params = useParams<{ id: string }>()
+  const channelId = (params?.id as string) ?? ''
+
+  const [settings, setSettings] = React.useState<AiAutoReplySettings | null>(null)
+  const [isLoading, setIsLoading] = React.useState(true)
+  const [errorMessage, setErrorMessage] = React.useState<string | null>(null)
+  const [notFound, setNotFound] = React.useState(false)
+
+  const load = React.useCallback(async () => {
+    if (!channelId) return
+    setIsLoading(true)
+    setErrorMessage(null)
+    setNotFound(false)
+    const response = await apiCall<AiAutoReplySettings>(
+      `/api/channel_discord/channels/${encodeURIComponent(channelId)}/ai-auto-reply`,
+    ).catch(() => null)
+    if (!response || !response.ok) {
+      const status = (response as { status?: number } | null)?.status
+      if (status === 404) {
+        setNotFound(true)
+      } else {
+        const body = response?.result as { error?: string } | undefined
+        setErrorMessage(
+          body?.error ?? t('channel_discord.aiAutoReply.errors.load', 'Failed to load AI auto-reply settings'),
+        )
+      }
+      setSettings(null)
+    } else {
+      setSettings(response.result ?? null)
+    }
+    setIsLoading(false)
+  }, [channelId, t])
+
+  React.useEffect(() => {
+    void load()
+  }, [load])
+
+  const fields = React.useMemo<CrudField[]>(() => {
+    // An agent the auto-reply principal cannot invoke stays in the list — hiding
+    // it would leave the operator wondering where an agent they can see elsewhere
+    // went — but it says what it needs, so the requirement is visible before the
+    // save rather than only in the 400 that follows.
+    const agentOptions = (settings?.agents ?? []).map((agent) => ({
+      value: agent.id,
+      label: agent.invocable
+        ? agent.label
+        : t(
+          'channel_discord.aiAutoReply.fields.agentMissingFeatures',
+          '{label} — needs {features}',
+          { label: agent.label, features: agent.missingFeatures.join(', ') },
+        ),
+    }))
+    return [
+      {
+        id: 'aiAutoReplyEnabled',
+        type: 'checkbox',
+        label: t('channel_discord.aiAutoReply.fields.enabled', 'Answer inbound Discord messages with AI'),
+        description: t(
+          'channel_discord.aiAutoReply.fields.enabledHelp',
+          'Off by default. When on, straightforward messages are answered automatically; anything sensitive, low-confidence or suspicious is proposed for a human to approve instead.',
+        ),
+        disabled: !settings?.aiAvailable,
+      },
+      {
+        id: 'aiAgentId',
+        type: 'select',
+        label: t('channel_discord.aiAutoReply.fields.agent', 'Agent'),
+        description: t(
+          'channel_discord.aiAutoReply.fields.agentHelp',
+          'Only agents that produce structured output can answer a channel. Grant the tenant channel-bot user the agent’s required features before choosing an agent from another module.',
+        ),
+        options: agentOptions,
+        required: true,
+        visibleWhen: { field: 'aiAutoReplyEnabled', equals: true },
+      },
+    ]
+  }, [settings, t])
+
+  const initialValues = React.useMemo<Partial<FormValues>>(() => {
+    if (!settings) return {}
+    // Default to an agent the principal can actually invoke, so the form does not
+    // pre-select a choice the save will reject.
+    const invocable = settings.agents.filter((agent) => agent.invocable)
+    const fallbackAgentId = invocable.some((agent) => agent.id === settings.defaultAgentId)
+      ? settings.defaultAgentId
+      : (invocable[0]?.id ?? settings.agents[0]?.id ?? '')
+    return {
+      id: settings.channelId,
+      updatedAt: settings.updatedAt,
+      aiAutoReplyEnabled: settings.aiAutoReplyEnabled,
+      aiAgentId: settings.aiAgentId ?? fallbackAgentId,
+    }
+  }, [settings])
+
+  const onSubmit = React.useCallback(
+    async (values: FormValues) => {
+      const enabled = Boolean(values.aiAutoReplyEnabled)
+      const agentId = (values.aiAgentId ?? '').trim()
+      if (enabled && !agentId) {
+        throw createCrudFormError(
+          t('channel_discord.aiAutoReply.errors.agentRequired', 'Choose the agent that should answer this channel'),
+          { aiAgentId: t('channel_discord.aiAutoReply.errors.agentRequired', 'Choose the agent that should answer this channel') },
+        )
+      }
+      // The route enforces this too — it has to, since a role can change between
+      // the load and the save. Checking here as well turns the common case into an
+      // inline field error instead of a round trip.
+      const chosen = settings?.agents.find((agent) => agent.id === agentId)
+      if (enabled && chosen && !chosen.invocable) {
+        const message = t(
+          'channel_discord.aiAutoReply.errors.agentFeaturesMissing',
+          'The channel-bot user is missing the features this agent needs: {features}. Grant them first, or pick another agent.',
+          { features: chosen.missingFeatures.join(', ') },
+        )
+        throw createCrudFormError(message, { aiAgentId: message })
+      }
+      // Deliberately unguarded: a 409 from the optimistic-lock check has to reach
+      // CrudForm, which renders it on the shared conflict bar. Catching it here
+      // would surface the same bar and then let the form believe the save
+      // succeeded.
+      await updateCrud(
+        `channel_discord/channels/${encodeURIComponent(channelId)}/ai-auto-reply`,
+        {
+          aiAutoReplyEnabled: enabled,
+          aiAgentId: enabled ? agentId : undefined,
+        },
+        {
+          errorMessage: t(
+            'channel_discord.aiAutoReply.errors.save',
+            'Failed to save AI auto-reply settings',
+          ),
+        },
+      )
+      flash(t('channel_discord.aiAutoReply.saved', 'AI auto-reply settings saved.'), 'success')
+      await load()
+    },
+    [channelId, load, settings, t],
+  )
+
+  if (isLoading) {
+    return (
+      <Page>
+        <PageBody>
+          <LoadingMessage label={t('channel_discord.aiAutoReply.loading', 'Loading AI auto-reply settings...')} />
+        </PageBody>
+      </Page>
+    )
+  }
+
+  if (notFound) {
+    return (
+      <Page>
+        <PageBody>
+          <RecordNotFoundState
+            label={t('channel_discord.aiAutoReply.notFound', 'Discord channel not found')}
+            backHref={CHANNELS_LIST_HREF}
+          />
+        </PageBody>
+      </Page>
+    )
+  }
+
+  if (errorMessage || !settings) {
+    return (
+      <Page>
+        <PageBody>
+          <ErrorMessage
+            label={
+              errorMessage
+              ?? t('channel_discord.aiAutoReply.errors.load', 'Failed to load AI auto-reply settings')
+            }
+          />
+        </PageBody>
+      </Page>
+    )
+  }
+
+  return (
+    <Page>
+      <PageBody>
+        <CrudForm<FormValues>
+          title={t('channel_discord.aiAutoReply.page.title', 'Discord AI auto-reply')}
+          backHref={CHANNELS_LIST_HREF}
+          cancelHref={CHANNELS_LIST_HREF}
+          fields={fields}
+          initialValues={initialValues}
+          onSubmit={onSubmit}
+          submitLabel={t('channel_discord.aiAutoReply.save', 'Save')}
+          contentHeader={
+            <div className="mb-4 space-y-2 text-sm text-muted-foreground">
+              <p>
+                {t(
+                  'channel_discord.aiAutoReply.intro',
+                  'Choose whether this Discord channel may answer on its own, and which agent drafts the reply.',
+                )}{' '}
+                <span className="font-medium text-foreground">{settings.displayName}</span>
+              </p>
+              {settings.aiAvailable ? null : (
+                <p>
+                  {t(
+                    'channel_discord.aiAutoReply.unavailable',
+                    'The AI assistant module is not installed in this deployment, so auto-reply cannot be enabled. The channel keeps working as a normal inbox.',
+                  )}
+                </p>
+              )}
+              {settings.aiAutoReplyLastError ? (
+                // An armed channel whose runtime call keeps being refused is the
+                // dormancy failure wearing a green tag. It is reported here, on the
+                // surface that armed it, rather than only in a subscriber log line.
+                <p className="rounded-md border border-status-error-border bg-status-error-bg p-3 text-status-error-text">
+                  {t(
+                    'channel_discord.aiAutoReply.lastError',
+                    'The last auto-reply attempt on this channel produced nothing: {reason}',
+                    { reason: settings.aiAutoReplyLastError },
+                  )}
+                  {settings.aiAutoReplyLastErrorAt ? (
+                    <span className="ml-1">
+                      {t('channel_discord.aiAutoReply.lastErrorAt', '(first seen {at})', {
+                        at: new Date(settings.aiAutoReplyLastErrorAt).toLocaleString(),
+                      })}
+                    </span>
+                  ) : null}
+                </p>
+              ) : null}
+            </div>
+          }
+        />
+      </PageBody>
+    </Page>
+  )
+}

package/src/modules/channel_discord/cli.ts

@@ -0,0 +1,234 @@
+import { readFile } from 'node:fs/promises'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { ModuleCli } from '@open-mercato/shared/modules/registry'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { createCredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'
+import { createIntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'
+import { parseDiscordCredentialsOrThrow } from './lib/credentials'
+import { getDiscordRestClient } from './lib/discord-rest'
+import { applyDiscordEnvPreset } from './lib/preset'
+import { assertInboundDeliverable } from './lib/queue-strategy'
+import { DISCORD_DEFAULT_SLASH_COMMANDS, parseSlashCommandDefinitions } from './lib/slash-commands'
+import gatewayHandle, { CHANNEL_DISCORD_GATEWAY_QUEUE } from './workers/discord-gateway'
+
+const logger = createLogger('channel_discord').child({ component: 'cli' })
+
+/**
+ * Split `--key value` pairs from bare `--flag` switches so a boolean flag does
+ * not shift the positional pairing of the remaining arguments.
+ */
+export function parseFlagsAndValues(args: string[]): { flags: Set<string>; values: Record<string, string> } {
+  const flags = new Set<string>()
+  const values: Record<string, string> = {}
+  for (let index = 0; index < args.length; index += 1) {
+    const token = args[index]
+    if (!token?.startsWith('-')) continue
+    const key = token.replace(/^-+/, '')
+    const next = args[index + 1]
+    if (next && !next.startsWith('-')) {
+      values[key] = next
+      index += 1
+    } else {
+      flags.add(key)
+    }
+  }
+  return { flags, values }
+}
+
+/**
+ * Start the Discord Gateway bridge.
+ *
+ * WHY THIS EXISTS: the provider advertises `realtimePush: true`, so the hub's
+ * polling scheduler skips Discord channels — inbound relies entirely on this
+ * long-running gateway worker. Nothing enqueues the `channel_discord_gateway`
+ * job automatically (no hub "channel connected" event exists), so inbound is
+ * dead until an operator starts this process. This command enqueues the initial
+ * bootstrap job, runs the worker, and (by default) re-enqueues a refresh job on
+ * an interval so newly connected channels are picked up and deactivated /
+ * soft-deleted channels are reconciled away (sockets closed).
+ *
+ * The refresh job is a reconciler, not a re-connector: the worker leaves every
+ * channel whose gateway session is still running untouched, so a short interval
+ * costs one query per tick and never disturbs a healthy socket.
+ *
+ * Usage:
+ *   mercato channel_discord start-gateway [--tenant <tenantId>] [--refresh <seconds>]
+ *
+ * `--refresh 0` disables the periodic refresh (single reconciliation at startup).
+ * Set `OM_CHANNEL_DISCORD_GATEWAY_DISABLED=1` to make the worker a no-op.
+ */
+const startGateway: ModuleCli = {
+  command: 'start-gateway',
+  async run(rest: string[]) {
+    const { values } = parseFlagsAndValues(rest)
+    const tenantId = values.tenant ?? values.tenantId ?? values.t
+    const refreshSeconds = Number.isFinite(Number(values.refresh ?? values.r))
+      ? Math.max(0, Number(values.refresh ?? values.r))
+      : 60
+
+    assertInboundDeliverable(process.env.QUEUE_STRATEGY)
+
+    logger.info('starting Discord gateway bridge', {
+      queue: CHANNEL_DISCORD_GATEWAY_QUEUE,
+      tenantId: tenantId ?? 'all',
+      refreshSeconds,
+    })
+
+    const container = await createRequestContainer()
+
+    const { createModuleQueue, runWorker } = await import('@open-mercato/queue')
+
+    const jobPayload = tenantId ? { tenantId } : {}
+
+    // The worker context only needs `.resolve`; the queue runner's own ctx does
+    // not carry the DI container, so we close over the request container here
+    // (mirrors workflows' `start-worker`).
+    const handler = async (job: { payload?: Record<string, unknown> }): Promise<void> => {
+      await gatewayHandle(job as never, { resolve: (name: string) => container.resolve(name) } as never)
+    }
+
+    await runWorker({
+      queueName: CHANNEL_DISCORD_GATEWAY_QUEUE,
+      handler: handler as never,
+      concurrency: 1,
+      gracefulShutdown: true,
+      background: true,
+    })
+
+    const queue = createModuleQueue<Record<string, unknown>>(CHANNEL_DISCORD_GATEWAY_QUEUE, { concurrency: 1 })
+    await queue.enqueue({ ...jobPayload, reason: 'startup' })
+    logger.info('enqueued gateway bootstrap job')
+
+    if (refreshSeconds > 0) {
+      setInterval(() => {
+        queue
+          .enqueue({ ...jobPayload, reason: 'refresh' })
+          .catch((err) => logger.warn('failed to enqueue gateway refresh job', { err }))
+      }, refreshSeconds * 1000)
+    }
+
+    logger.info('Discord gateway bridge running — press Ctrl+C to stop')
+    // Keep the process alive so the sockets + refresh interval persist.
+    await new Promise<void>(() => {})
+  },
+}
+
+/**
+ * Rerun the provider-owned env preconfiguration for one tenant + organization.
+ *
+ * `setup.ts` applies the same preset when a tenant is created; this command
+ * exists so an operator can apply it to tenants that already existed when the
+ * `OM_CHANNEL_DISCORD_*` vars were introduced, or re-apply it after rotating the
+ * bot token (with `--force`). Idempotent: without `--force` an existing
+ * credential record is left untouched.
+ */
+const configureFromEnv: ModuleCli = {
+  command: 'configure-from-env',
+  async run(rest: string[]) {
+    const { flags, values } = parseFlagsAndValues(rest)
+    const tenantId = values.tenant ?? values.tenantId
+    const organizationId = values.org ?? values.organization ?? values.organizationId
+
+    if (!tenantId || !organizationId) {
+      logger.error('configure-from-env requires --tenant <tenantId> --org <organizationId>')
+      throw new Error('[internal] channel_discord configure-from-env requires --tenant and --org')
+    }
+
+    const container = await createRequestContainer()
+    const em = container.resolve('em') as EntityManager
+    const result = await applyDiscordEnvPreset({
+      credentialsService: createCredentialsService(em),
+      integrationLogService: createIntegrationLogService(em),
+      scope: { tenantId, organizationId },
+      force: flags.has('force'),
+    })
+
+    if (result.status === 'configured') {
+      logger.info('Discord integration preconfigured from environment', { tenantId, organizationId })
+    } else {
+      logger.info('Discord env preconfiguration skipped', { tenantId, organizationId, reason: result.reason })
+    }
+  },
+}
+
+/**
+ * Register the provider's application (slash) commands against one guild.
+ *
+ * WHY IT EXISTS: a slash command only appears in Discord once the application
+ * has registered it. Nothing does that automatically — registration is a
+ * per-guild, operator-scoped decision — so without this command the Interactions
+ * endpoint is reachable but nobody can produce an interaction to send to it.
+ *
+ * Guild-scoped (`PUT /applications/{app}/guilds/{guild}/commands`) rather than
+ * global on purpose: guild registrations take effect immediately, while global
+ * ones take up to an hour to propagate, and the provider already recommends
+ * scoping the bot to one server.
+ *
+ * The call REPLACES the guild's command list for this application, so it is
+ * idempotent — re-running it converges rather than accumulating duplicates.
+ *
+ * Usage:
+ *   mercato channel_discord register-slash-commands --tenant <id> --org <id>
+ *     [--guild <guildId>] [--commands <path-to-json>]
+ *
+ * `--guild` overrides the `guildId` credential; `--commands` registers an
+ * operator-authored definition array instead of the shipped default.
+ */
+const registerSlashCommands: ModuleCli = {
+  command: 'register-slash-commands',
+  async run(rest: string[]) {
+    const { values } = parseFlagsAndValues(rest)
+    const tenantId = values.tenant ?? values.tenantId
+    const organizationId = values.org ?? values.organization ?? values.organizationId
+
+    if (!tenantId || !organizationId) {
+      logger.error('register-slash-commands requires --tenant <tenantId> --org <organizationId>')
+      throw new Error('[internal] channel_discord register-slash-commands requires --tenant and --org')
+    }
+
+    const container = await createRequestContainer()
+    const em = container.resolve('em') as EntityManager
+    const credentials = await createCredentialsService(em).resolve('channel_discord', {
+      tenantId,
+      organizationId,
+    })
+    if (!credentials) {
+      throw new Error(
+        `[internal] No Discord credentials for tenant ${tenantId} / organization ${organizationId}. ` +
+          'Connect the channel in /backend/integrations first.',
+      )
+    }
+    const parsed = parseDiscordCredentialsOrThrow(credentials)
+
+    const guildId = values.guild ?? values.guildId ?? parsed.guildId
+    if (!guildId) {
+      throw new Error(
+        '[internal] channel_discord register-slash-commands needs a guild: set the guildId credential ' +
+          'or pass --guild <guildId>.',
+      )
+    }
+
+    const commands = values.commands
+      ? parseSlashCommandDefinitions(JSON.parse(await readFile(values.commands, 'utf-8')))
+      : DISCORD_DEFAULT_SLASH_COMMANDS
+
+    await getDiscordRestClient().registerGuildCommands(
+      { botToken: parsed.botToken },
+      parsed.applicationId,
+      guildId,
+      commands,
+    )
+
+    logger.info('registered Discord guild slash commands', {
+      tenantId,
+      organizationId,
+      guildId,
+      commands: commands.map((command) => command.name),
+    })
+  },
+}
+
+const channelDiscordCliCommands = [startGateway, configureFromEnv, registerSlashCommands]
+
+export default channelDiscordCliCommands

package/src/modules/channel_discord/commands/__tests__/ai-reply-proposal.test.ts

@@ -0,0 +1,155 @@
+/**
+ * The approval surface's two commands (issue #4778).
+ *
+ * The propose-only guarantee has two halves. The subscriber owns "never send
+ * without a human" (covered in `subscribers/__tests__/ai-auto-reply.test.ts`);
+ * these commands own "when a human does approve, send exactly what they saw, in
+ * the right conversation, attributed to them" — and refuse to send anything else.
+ */
+jest.mock('@open-mercato/shared/lib/encryption/find', () => ({
+  findOneWithDecryption: jest.fn(),
+}))
+
+import { approveProposalCommand, dismissProposalCommand } from '../ai-reply-proposal'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { CHANNEL_DISCORD_AI_PROPOSAL_MESSAGE_TYPE } from '../../message-types'
+
+const findOne = findOneWithDecryption as unknown as jest.Mock
+
+const TENANT = '11111111-1111-4111-8111-111111111111'
+const ORG = '22222222-2222-4222-8222-222222222222'
+const OPERATOR = '44444444-4444-4444-8444-444444444444'
+const PROPOSAL_ID = '55555555-5555-4555-8555-555555555555'
+const INBOUND_ID = '66666666-6666-4666-8666-666666666666'
+
+function makeCtx() {
+  const em = { fork: () => ({}) }
+  const commandBus = { execute: jest.fn(async () => ({ result: { id: 'sent-1', threadId: 'thread-1' } })) }
+  return {
+    ctx: {
+      container: { resolve: (name: string) => (name === 'em' ? em : commandBus) },
+      auth: { sub: OPERATOR, tenantId: TENANT, orgId: ORG },
+      organizationScope: null,
+      selectedOrganizationId: ORG,
+      organizationIds: [ORG],
+    } as never,
+    commandBus,
+  }
+}
+
+function proposalRow(overrides: Record<string, unknown> = {}) {
+  return {
+    id: PROPOSAL_ID,
+    type: CHANNEL_DISCORD_AI_PROPOSAL_MESSAGE_TYPE,
+    body: 'We open at 9 and close at 5.',
+    sourceEntityId: INBOUND_ID,
+    ...overrides,
+  }
+}
+
+function inboundRow() {
+  return {
+    id: INBOUND_ID,
+    type: 'channel.discord',
+    subject: 'Opening hours',
+    threadId: 'thread-1',
+  }
+}
+
+const actionInput = { messageId: PROPOSAL_ID, actionId: 'approve_send' }
+
+describe('channel_discord.ai_reply_proposal.approve', () => {
+  beforeEach(() => {
+    findOne.mockReset()
+  })
+
+  it('sends the proposed text into the original thread, attributed to the approver', async () => {
+    findOne.mockResolvedValueOnce(proposalRow()).mockResolvedValueOnce(inboundRow())
+    const { ctx, commandBus } = makeCtx()
+
+    const result = await approveProposalCommand.execute(actionInput as never, ctx)
+
+    expect(result).toMatchObject({ ok: true, sentMessageId: 'sent-1' })
+    const [commandId, args] = commandBus.execute.mock.calls[0]
+    expect(commandId).toBe('messages.messages.compose')
+    expect(args.input).toMatchObject({
+      body: 'We open at 9 and close at 5.',
+      visibility: 'public',
+      isDraft: false,
+      parentMessageId: 'thread-1',
+      // The human who pressed approve owns the send, not the bot.
+      userId: OPERATOR,
+      tenantId: TENANT,
+      organizationId: ORG,
+    })
+  })
+
+  it('refuses to send a message that is not one of its own proposals', async () => {
+    findOne.mockResolvedValueOnce(proposalRow({ type: 'channel.discord' }))
+    const { ctx, commandBus } = makeCtx()
+
+    await expect(approveProposalCommand.execute(actionInput as never, ctx)).rejects.toThrow(
+      /not a Discord AI reply proposal/i,
+    )
+    expect(commandBus.execute).not.toHaveBeenCalled()
+  })
+
+  it('refuses when the conversation it answers is gone', async () => {
+    findOne.mockResolvedValueOnce(proposalRow()).mockResolvedValueOnce(null)
+    const { ctx, commandBus } = makeCtx()
+
+    await expect(approveProposalCommand.execute(actionInput as never, ctx)).rejects.toThrow(
+      /no longer exists/i,
+    )
+    expect(commandBus.execute).not.toHaveBeenCalled()
+  })
+
+  it('refuses an empty proposal rather than posting a blank Discord message', async () => {
+    findOne.mockResolvedValueOnce(proposalRow({ body: '   ' })).mockResolvedValueOnce(inboundRow())
+    const { ctx, commandBus } = makeCtx()
+
+    await expect(approveProposalCommand.execute(actionInput as never, ctx)).rejects.toThrow(/empty body/i)
+    expect(commandBus.execute).not.toHaveBeenCalled()
+  })
+
+  it('requires an authenticated actor — nothing approves itself', async () => {
+    const { ctx } = makeCtx()
+    const anonymous = { ...(ctx as unknown as Record<string, unknown>), auth: null } as never
+
+    await expect(approveProposalCommand.execute(actionInput as never, anonymous)).rejects.toThrow(
+      /authenticated actor/i,
+    )
+  })
+
+  it('declares itself non-undoable — a posted Discord message cannot be recalled', () => {
+    expect(approveProposalCommand.isUndoable).toBe(false)
+  })
+})
+
+describe('channel_discord.ai_reply_proposal.dismiss', () => {
+  beforeEach(() => {
+    findOne.mockReset()
+  })
+
+  it('acknowledges without sending anything', async () => {
+    findOne.mockResolvedValueOnce(proposalRow())
+    const { ctx, commandBus } = makeCtx()
+
+    const result = await dismissProposalCommand.execute(
+      { messageId: PROPOSAL_ID, actionId: 'dismiss' } as never,
+      ctx,
+    )
+
+    expect(result).toEqual({ ok: true, dismissed: true })
+    expect(commandBus.execute).not.toHaveBeenCalled()
+  })
+
+  it('refuses to acknowledge a message that is not one of its own proposals', async () => {
+    findOne.mockResolvedValueOnce(proposalRow({ type: 'channel.discord' }))
+    const { ctx } = makeCtx()
+
+    await expect(
+      dismissProposalCommand.execute({ messageId: PROPOSAL_ID, actionId: 'dismiss' } as never, ctx),
+    ).rejects.toThrow(/not a Discord AI reply proposal/i)
+  })
+})