From b6318d4df4a69c3a445fc9e4315224e9c67ffc57 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sat, 7 Mar 2026 23:43:55 +0000
Subject: [PATCH] fix: narrow dm shared group policy typing

---
 src/security/dm-policy-shared.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/security/dm-policy-shared.ts b/src/security/dm-policy-shared.ts
index c23833f9ec3..7f42f02519e 100644
--- a/src/security/dm-policy-shared.ts
+++ b/src/security/dm-policy-shared.ts
@@ -1,6 +1,7 @@
 import { mergeDmAllowFromSources, resolveGroupAllowFromSources } from "../channels/allow-from.js";
 import { resolveControlCommandGate } from "../channels/command-gating.js";
 import type { ChannelId } from "../channels/plugins/types.js";
+import type { GroupPolicy } from "../config/types.base.js";
 import { readChannelAllowFromStore } from "../pairing/pairing-store.js";
 import { evaluateMatchedGroupAccessForPolicy } from "../plugin-sdk/group-access.js";
 import { normalizeStringEntries } from "../shared/string-normalization.js";
@@ -114,7 +115,10 @@ export function resolveDmGroupAccessDecision(params: {
   reason: string;
 } {
   const dmPolicy = params.dmPolicy ?? "pairing";
-  const groupPolicy = params.groupPolicy ?? "allowlist";
+  const groupPolicy: GroupPolicy =
+    params.groupPolicy === "open" || params.groupPolicy === "disabled"
+      ? params.groupPolicy
+      : "allowlist";
   const effectiveAllowFrom = normalizeStringEntries(params.effectiveAllowFrom);
   const effectiveGroupAllowFrom = normalizeStringEntries(params.effectiveGroupAllowFrom);