fix: discord client bugs

Author: achetronic

.agents/AGENTS.md

@@ -211,6 +211,8 @@ log:
 
 ## Code Patterns
 
+## Code Patterns
+
 ### Go Conventions
 
 - **Store-based resources**: All entities managed via admin API, persisted to `data/store.json`
@@ -235,6 +237,14 @@ log:
 - **Session middleware**: `SessionEnsure` prevents overwriting existing sessions (protects ContextGuard summaries). `SessionStateSeed` injects empty outputKey values so flow agents don't fail on template vars
 - **Flow wrapAgent pattern**: Same agent can appear in multiple flow steps — `wrapAgent()` creates uniquely-named delegate agents to satisfy ADK's single-parent constraint
 
+### Design Philosophy
+
+**DRY, KISS, elegant, and decoupled does not mean over-engineered.** When two options exist — one simple and one cleverly abstracted — prefer the simple one. Specifically:
+
+- Don't avoid a straightforward API call (with built-in cache + HTTP fallback) just to use a lower-level cache-only lookup that may silently miss. `s.Channel()` is the right call in discordgo; `s.State.Channel()` is an unnecessary micro-optimisation that trades reliability for nothing.
+- Don't redesign function signatures (variadic, extra parameters, new types) when the problem is already solved at the call site with one extra line.
+- Complexity is only justified when it removes real duplication or real coupling — not hypothetical ones.
+
 ### Frontend Conventions (admin-ui)
 
 - **Vue 3 Composition API**: `<script setup>` everywhere, no Options API

.agents/DISCORD_CLIENT.md

@@ -53,6 +53,8 @@ discordgo.IntentGuildMessageReactions |
 discordgo.IntentDirectMessageReactions
 ```
 
+`IntentGuilds` is intentionally omitted. Thread/channel metadata is resolved on demand via `s.Channel()` (HTTP fallback) rather than relying on the state cache being fully populated.
+
 **Message Content Intent** is privileged. Must be toggled ON in Developer Portal → Bot → Privileged Gateway Intents. Without it, `m.Content` is always empty.
 
 ## Data Model
@@ -186,13 +188,15 @@ Uses `msgutil.SplitMessage(text, msgutil.DiscordMaxMessageLength)` with Discord'
 ## Access control
 
 ```go
-func (c *Client) isAllowed(userID, channelID string) bool
+func (c *Client) isAllowed(userID string, channelIDs ...string) bool
 ```
 
 - Both lists empty → open access
-- Either list populated → OR allowlist: user allowed if in `AllowedUsers` OR channel in `AllowedChannels`
+- Either list populated → OR allowlist: user allowed if in `AllowedUsers` OR any of the `channelIDs` in `AllowedChannels`
 - Neither matches → denied (silently dropped, logged at debug level)
 
+**Thread IDs are different from their parent channel ID.** When a message arrives inside a thread, `m.ChannelID` is the thread's own ID — not the parent channel. `onMessageCreate` resolves the parent ID via `s.Channel()` (state cache + HTTP fallback) and passes both to `isAllowed`, so that a thread created from an allowed channel is itself allowed.
+
 ## Wiring (main.go)
 
 Same pattern as Telegram and Slack:

.agents/RELEASE_NOTES_TEMPLATE.md

@@ -0,0 +1,56 @@
+# Release Notes Template
+
+## Format
+
+```markdown
+## vX.Y.Z
+
+### 🐛 Bug fixes
+
+- **Short title describing the fix** — What was broken, why it was broken, what was changed to fix it.
+
+### ✨ Features
+
+- **Short title describing the feature** — What it does and why it's useful.
+
+### 🔧 Improvements
+
+- **Short title describing the improvement** — What changed and what's better now.
+
+### 💥 Breaking changes
+
+- **Short title** — What changed, what breaks, and how to migrate.
+```
+
+## Rules
+
+- **English only**, plain language — no jargon, no internal references
+- **Only include sections that have entries** — omit empty sections entirely
+- **One bullet per change** — if a fix touches multiple files, it's still one bullet
+- **Bullet structure**: `**Title** — cause, effect, fix` (for bugs) or `**Title** — what it does` (for features)
+- **No emojis inside bullets** — only on section headings
+- **Version follows semver**: `MAJOR.MINOR.PATCH`
+  - `PATCH` — bug fixes only
+  - `MINOR` — new features, backwards compatible
+  - `MAJOR` — breaking changes
+
+## Section icons
+
+| Section | Icon |
+|---------|------|
+| Bug fixes | 🐛 |
+| Features | ✨ |
+| Improvements | 🔧 |
+| Breaking changes | 💥 |
+
+## Example
+
+```markdown
+## v0.15.1
+
+### 🐛 Bug fixes
+
+- **Discord: thread messages ignored when `allowedChannels` is set** — Messages inside a thread were silently dropped even when the thread was created from an allowed channel. Discord threads have their own ID, different from the parent channel, so they were failing the permission check. The bot now also checks the parent channel ID when deciding whether to allow a message.
+
+- **Discord/Slack: `threadHistoryLimit` could not be updated from the Admin UI** — When saving a client from the edit form, the value was sent as a string instead of a number. The backend rejected the request with a deserialization error. The form now correctly sends integer and number fields as numbers.
+```

frontend/admin-ui/src/views/clients/ClientDialog.vue

@@ -464,6 +464,11 @@ async function save() {
         if (Array.isArray(val) && val.length) {
           typeCfg[key] = val
         }
+      } else if (propSchema.type === 'integer' || propSchema.type === 'number') {
+        const n = Number(val)
+        if (!isNaN(n) && val !== '' && val !== null && val !== undefined) {
+          typeCfg[key] = propSchema.type === 'integer' ? Math.trunc(n) : n
+        }
       } else if (val?.toString().trim()) {
         typeCfg[key] = val.toString().trim()
       }

server/clients/discord/bot.go

@@ -119,7 +119,11 @@ func (c *Client) onMessageCreate(s *discordgo.Session, m *discordgo.MessageCreat
 		return
 	}
 
-	if !c.isAllowed(m.Author.ID, m.ChannelID) {
+	parentID := ""
+	if ch, err := s.Channel(m.ChannelID); err == nil && isDiscordThread(ch.Type) {
+		parentID = ch.ParentID
+	}
+	if !c.isAllowed(m.Author.ID, m.ChannelID, parentID) {
 		c.logger.Debug("Unauthorized Discord message", "user", m.Author.ID, "channel", m.ChannelID)
 		return
 	}
@@ -861,16 +865,21 @@ func (c *Client) setAuthHeader(req *http.Request) {
 	}
 }
 
-func (c *Client) isAllowed(userID, channelID string) bool {
+// isAllowed checks whether a user/channel combination is permitted.
+// channelIDs accepts the direct channel and optionally the parent channel ID
+// (for threads, whose IDs differ from the parent channel they belong to).
+func (c *Client) isAllowed(userID string, channelIDs ...string) bool {
 	cfg := c.clientDef.Config.Discord
 	if len(cfg.AllowedUsers) == 0 && len(cfg.AllowedChannels) == 0 {
 		return true
 	}
 	if len(cfg.AllowedUsers) > 0 && slices.Contains(cfg.AllowedUsers, userID) {
 		return true
 	}
-	if len(cfg.AllowedChannels) > 0 && slices.Contains(cfg.AllowedChannels, channelID) {
-		return true
+	for _, id := range channelIDs {
+		if id != "" && slices.Contains(cfg.AllowedChannels, id) {
+			return true
+		}
 	}
 	return false
 }