fix(security): gate slash/control commands

src/channels/registry.ts

@@ -1,4 +1,6 @@
 import type { ChannelMeta } from "./plugins/types.js";
+import type { ChannelId } from "./plugins/types.js";
+import { getActivePluginRegistry } from "../plugins/runtime.js";
 
 // Channel docking: add new channels here (order + meta + aliases), then
 // register the plugin in src/channels/plugins/index.ts and keep protocol IDs in sync.
@@ -111,6 +113,29 @@ export function normalizeChannelId(raw?: string | null): ChatChannelId | null {
   return normalizeChatChannelId(raw);
 }
 
+// Normalizes core chat channels plus any *already-loaded* plugin channels.
+//
+// Keep this light: we do not import core channel plugins here (those are "heavy" and can pull in
+// monitors, web login, etc). If plugins are not loaded (e.g. in many tests), only core channel IDs
+// resolve.
+export function normalizeAnyChannelId(raw?: string | null): ChannelId | null {
+  const core = normalizeChatChannelId(raw);
+  if (core) return core;
+
+  const key = normalizeChannelKey(raw);
+  if (!key) return null;
+
+  const registry = getActivePluginRegistry();
+  if (!registry) return null;
+
+  const hit = registry.channels.find((entry) => {
+    const id = String(entry.plugin.id ?? "").trim().toLowerCase();
+    if (id && id === key) return true;
+    return (entry.plugin.meta.aliases ?? []).some((alias) => alias.trim().toLowerCase() === key);
+  });
+  return (hit?.plugin.id as ChannelId | undefined) ?? null;
+}
+
 export function formatChannelPrimerLine(meta: ChatChannelMeta): string {
   return `${meta.label}: ${meta.blurb}`;
 }