@gaodefa/daocore 2026.5.29 → 2026.5.30

package/dist/runtime-api-BojB3MUw.js

@@ -0,0 +1,21 @@
+import "./file-lock-pKruwmjP.js";
+import { t as createPluginRuntimeStore } from "./runtime-store-BSkCngaf.js";
+import "./channel-policy-Be-Ujzjr.js";
+import "./inbound-reply-dispatch-kgSDM8ax.js";
+import "./outbound-media-CaqyBwi1.js";
+import "./ssrf-runtime-Gwgbj2qf.js";
+import "./media-runtime-CPXTkSQr.js";
+import "./text-chunking-ObhJDe8L.js";
+import "./channel-status-1yY-1IXP.js";
+import "./channel-lifecycle-DDnbT5P-.js";
+import "./channel-message-YAmKOwAT.js";
+import "./channel-pairing-BQeyBt0a.js";
+import "./channel-targets-QOYkAy7S.js";
+import "./webhook-ingress-CG1vdjMj.js";
+//#region extensions/msteams/src/runtime.ts
+const { setRuntime: setMSTeamsRuntime, getRuntime: getMSTeamsRuntime, tryGetRuntime: getOptionalMSTeamsRuntime } = createPluginRuntimeStore({
+	pluginId: "msteams",
+	errorMessage: "MSTeams runtime not initialized"
+});
+//#endregion
+export { getOptionalMSTeamsRuntime as n, setMSTeamsRuntime as r, getMSTeamsRuntime as t };

package/dist/runtime-api-C92MlAwp.js

@@ -0,0 +1,13 @@
+import "./core-D0Y2H55f.js";
+import "./secret-input-s8BgZnEq.js";
+import "./runtime-B2tX9Up3.js";
+import "./setup-Bk8ieh5V.js";
+import "./text-chunking-ObhJDe8L.js";
+import "./status-helpers-nyf_mfYa.js";
+import "./channel-status-1yY-1IXP.js";
+import "./channel-feedback-66g2TOgS.js";
+import "./channel-message-YAmKOwAT.js";
+import "./channel-pairing-BQeyBt0a.js";
+import "./webhook-ingress-CG1vdjMj.js";
+import "./runtime-BpdgHV8s.js";
+export {};

package/dist/runtime-api-CFNZE9Xt.js

@@ -0,0 +1,13 @@
+import "./json-store-GaAZLixM.js";
+import "./core-D0Y2H55f.js";
+import "./routing-AC-P99jg.js";
+import "./agent-media-payload-CMMnUmpJ.js";
+import "./text-chunking-ObhJDe8L.js";
+import "./channel-status-1yY-1IXP.js";
+import "./channel-message-YAmKOwAT.js";
+import "./channel-pairing-BQeyBt0a.js";
+import "./session-store-runtime-BZIAo9w7.js";
+import "./persistent-dedupe-Dz4p2d8x.js";
+import "./webhook-ingress-CG1vdjMj.js";
+import "./runtime-hPfxMoFX.js";
+export {};

package/dist/runtime-api-Cimpgm5_.js

@@ -0,0 +1,3 @@
+import "./acp-runtime-backend-Cxo7eBHf.js";
+import "./provider-env-vars-D1wjBvRq.js";
+export {};

package/dist/runtime-api-D8qG_lUm.js

@@ -0,0 +1,17 @@
+import "./json-store-GaAZLixM.js";
+import "./routing-AC-P99jg.js";
+import "./setup-Bk8ieh5V.js";
+import "./inbound-reply-dispatch-kgSDM8ax.js";
+import "./outbound-media-CaqyBwi1.js";
+import "./ssrf-runtime-Gwgbj2qf.js";
+import "./conversation-runtime-BxOHxuin.js";
+import "./text-chunking-ObhJDe8L.js";
+import "./acp-binding-runtime-NAVSZxRf.js";
+import "./channel-status-1yY-1IXP.js";
+import "./channel-config-primitives-iidLm0ld.js";
+import "./channel-actions-BEsMIO8Q.js";
+import "./channel-feedback-66g2TOgS.js";
+import "./channel-message-YAmKOwAT.js";
+import "./channel-targets-QOYkAy7S.js";
+import "./timeout-abort-signal-CyWSm_xb.js";
+export {};

package/dist/runtime-api-DMDMnQEG.js

@@ -0,0 +1,4 @@
+import "./core-D0Y2H55f.js";
+import "./runtime-B2tX9Up3.js";
+import "./ssrf-runtime-Gwgbj2qf.js";
+export {};

package/dist/runtime-api-DupQdIlE.js

@@ -0,0 +1,24 @@
+import { t as createPluginRuntimeStore } from "./runtime-store-BSkCngaf.js";
+import "./outbound-media-CaqyBwi1.js";
+import "./ssrf-runtime-Gwgbj2qf.js";
+import "./media-runtime-CPXTkSQr.js";
+import "./text-chunking-ObhJDe8L.js";
+import "./channel-status-1yY-1IXP.js";
+import "./bundled-channel-config-schema-C65cOOX-.js";
+import "./channel-config-primitives-iidLm0ld.js";
+import "./channel-actions-BEsMIO8Q.js";
+import "./channel-feedback-66g2TOgS.js";
+import "./channel-inbound-COGoV_aS.js";
+import "./channel-lifecycle-DDnbT5P-.js";
+import "./channel-message-YAmKOwAT.js";
+import "./channel-pairing-BQeyBt0a.js";
+import "./webhook-ingress-CG1vdjMj.js";
+import "./webhook-request-guards-QGKMuCtI.js";
+import "./webhook-targets-CFzM75PS.js";
+//#region extensions/googlechat/src/runtime.ts
+const { setRuntime: setGoogleChatRuntime, getRuntime: getGoogleChatRuntime } = createPluginRuntimeStore({
+	pluginId: "googlechat",
+	errorMessage: "Google Chat runtime not initialized"
+});
+//#endregion
+export { setGoogleChatRuntime as n, getGoogleChatRuntime as t };

package/dist/runtime-api.actions-B8i3elqu.js

@@ -0,0 +1,3 @@
+import "./runtime-BktLQ75j.js";
+import "./channel-actions-UDeVjgGz.js";
+export {};

package/dist/runtime-api.monitor-BntFzf_M.js

@@ -0,0 +1,6 @@
+import "./allow-list-BcPKAZym.js";
+import "./provider-_v910H8y.js";
+import "./message-utils-BG2BCBdr.js";
+import "./threading-CfCR-cPo.js";
+import "./message-handler-BhHb1FHI.js";
+export {};

package/dist/runtime-api.send-CPlmi1jc.js

@@ -0,0 +1,4 @@
+import "./outbound-session-route-DneMsGNx.js";
+import "./send.components-rLjDlfYU.js";
+import "./send-BZbyJL0A.js";
+export {};

package/dist/runtime-api.threads-D-H_r_Nl.js

@@ -0,0 +1,2 @@
+import "./thread-bindings-BD3eE0kK.js";
+export {};

package/dist/runtime-channel-BGhTxnXZ.js

@@ -0,0 +1,150 @@
+import { u as resolveStorePath } from "./paths-8MFrTNIB.js";
+import { a as readSessionUpdatedAt, l as updateLastRoute, o as recordSessionMetaFromInbound } from "./store-C4uyNaPD.js";
+import "./sessions-4ZNlAnYc.js";
+import { a as settleReplyDispatcher, i as dispatchReplyFromConfig, o as withReplyDispatcher } from "./dispatch-3Ru_eGq1.js";
+import { n as resolveChannelGroupRequireMention, t as resolveChannelGroupPolicy } from "./group-policy-CRl_OjIo.js";
+import { i as resolveAgentRoute, t as buildAgentSessionKey } from "./resolve-route-C0-Q-Gjg.js";
+import { t as resolveCommandAuthorizedFromAuthorizers } from "./command-gating-BZR3snoF.js";
+import { a as readChannelAllowFromStore, d as upsertChannelPairingRequest } from "./pairing-store-D6kKcRDP.js";
+import { n as resolveInboundMentionDecision, t as implicitMentionKindWhen } from "./mention-gating-3P8aSD7o.js";
+import { u as saveMediaBuffer } from "./store-53qCOCD8.js";
+import { a as saveRemoteMedia, i as readRemoteMediaBuffer, o as saveResponseMedia, r as fetchRemoteMedia } from "./fetch-CThiKx3T.js";
+import { i as resolveHumanDelayConfig, r as resolveEffectiveMessagesConfig } from "./identity-ZuObO2Tn.js";
+import { a as chunkText, c as resolveTextChunkLimit, i as chunkMarkdownTextWithMode, o as chunkTextWithMode, r as chunkMarkdownText, s as resolveChunkMode, t as chunkByNewline } from "./chunk-DeZRGIEM.js";
+import { t as loadChannelOutboundAdapter } from "./load-ftGhHqtw.js";
+import { n as shouldHandleTextCommands } from "./commands-text-routing-BEyXBSW7.js";
+import "./commands-registry-be38KiNc.js";
+import { i as matchesMentionWithExplicit, n as buildMentionRegexes, r as matchesMentionPatterns } from "./mentions-CMXP1js-.js";
+import { n as createReplyDispatcherWithTyping } from "./reply-dispatcher-84jjdXt5.js";
+import { t as finalizeInboundContext } from "./inbound-context-Cg0uCtqQ.js";
+import { t as dispatchReplyWithBufferedBlockDispatcher } from "./provider-dispatcher-C3kmmIEC.js";
+import { i as shouldComputeCommandAuthorized, r as isControlCommandMessage, t as hasControlCommand } from "./command-detection-caGZdgm3.js";
+import { a as resolveEnvelopeFormatOptions, r as formatInboundEnvelope, t as formatAgentEnvelope } from "./envelope-DUI2KFD9.js";
+import { n as resolveInboundDebounceMs, t as createInboundDebouncer } from "./inbound-debounce-DQpLvByk.js";
+import { i as shouldAckReaction, n as removeAckReactionAfterReply, r as removeAckReactionHandleAfterReply, t as createAckReactionHandle } from "./ack-reactions-BceP3SaE.js";
+import { n as setChannelConversationBindingMaxAgeBySessionKey, t as setChannelConversationBindingIdleTimeoutBySessionKey } from "./conversation-bindings-bTV9etcN.js";
+import { t as recordInboundSession } from "./session-DDNzwYpl.js";
+import { a as runPreparedChannelTurn, i as runChannelTurn, n as dispatchAssembledChannelTurn, o as runResolvedChannelTurn, s as buildChannelInboundEventContext } from "./kernel-DJoytLM8.js";
+import { t as resolveMarkdownTableMode } from "./markdown-tables-BEjHxS3n.js";
+import { n as recordChannelActivity, t as getChannelActivity } from "./channel-activity-eMQlJ3BE.js";
+import { t as convertMarkdownTables } from "./tables-BROr40GK.js";
+import { t as buildPairingReply } from "./pairing-messages-pWPTNHYH.js";
+import { t as createChannelRuntimeContextRegistry } from "./channel-runtime-contexts-CgJ4peET.js";
+//#region src/plugins/runtime/runtime-channel.ts
+function createRuntimeChannel() {
+	return {
+		text: {
+			chunkByNewline,
+			chunkMarkdownText,
+			chunkMarkdownTextWithMode,
+			chunkText,
+			chunkTextWithMode,
+			resolveChunkMode,
+			resolveTextChunkLimit,
+			hasControlCommand,
+			resolveMarkdownTableMode,
+			convertMarkdownTables
+		},
+		reply: {
+			dispatchReplyWithBufferedBlockDispatcher,
+			createReplyDispatcherWithTyping,
+			resolveEffectiveMessagesConfig,
+			resolveHumanDelayConfig,
+			dispatchReplyFromConfig,
+			withReplyDispatcher,
+			settleReplyDispatcher,
+			finalizeInboundContext,
+			formatAgentEnvelope,
+			/** @deprecated Prefer `BodyForAgent` + structured user-context blocks (do not build plaintext envelopes for prompts). */
+			formatInboundEnvelope,
+			resolveEnvelopeFormatOptions
+		},
+		routing: {
+			buildAgentSessionKey,
+			resolveAgentRoute
+		},
+		pairing: {
+			buildPairingReply,
+			readAllowFromStore: ({ channel, accountId, env }) => readChannelAllowFromStore(channel, env, accountId),
+			upsertPairingRequest: ({ channel, id, accountId, meta, env, pairingAdapter }) => upsertChannelPairingRequest({
+				channel,
+				id,
+				accountId,
+				meta,
+				env,
+				pairingAdapter
+			})
+		},
+		media: {
+			readRemoteMediaBuffer,
+			fetchRemoteMedia,
+			saveRemoteMedia,
+			saveResponseMedia,
+			saveMediaBuffer
+		},
+		activity: {
+			record: recordChannelActivity,
+			get: getChannelActivity
+		},
+		session: {
+			resolveStorePath,
+			readSessionUpdatedAt,
+			recordSessionMetaFromInbound,
+			recordInboundSession,
+			updateLastRoute
+		},
+		mentions: {
+			buildMentionRegexes,
+			matchesMentionPatterns,
+			matchesMentionWithExplicit,
+			implicitMentionKindWhen,
+			resolveInboundMentionDecision
+		},
+		reactions: {
+			createAckReactionHandle,
+			shouldAckReaction,
+			removeAckReactionAfterReply,
+			removeAckReactionHandleAfterReply
+		},
+		groups: {
+			resolveGroupPolicy: resolveChannelGroupPolicy,
+			resolveRequireMention: resolveChannelGroupRequireMention
+		},
+		debounce: {
+			createInboundDebouncer,
+			resolveInboundDebounceMs
+		},
+		commands: {
+			resolveCommandAuthorizedFromAuthorizers,
+			isControlCommandMessage,
+			shouldComputeCommandAuthorized,
+			shouldHandleTextCommands
+		},
+		outbound: { loadAdapter: loadChannelOutboundAdapter },
+		turn: {
+			run: runChannelTurn,
+			runAssembled: dispatchAssembledChannelTurn,
+			runResolved: runResolvedChannelTurn,
+			buildContext: buildChannelInboundEventContext,
+			runPrepared: runPreparedChannelTurn,
+			dispatchAssembled: dispatchAssembledChannelTurn
+		},
+		threadBindings: {
+			setIdleTimeoutBySessionKey: ({ channelId, targetSessionKey, accountId, idleTimeoutMs }) => setChannelConversationBindingIdleTimeoutBySessionKey({
+				channelId,
+				targetSessionKey,
+				accountId,
+				idleTimeoutMs
+			}),
+			setMaxAgeBySessionKey: ({ channelId, targetSessionKey, accountId, maxAgeMs }) => setChannelConversationBindingMaxAgeBySessionKey({
+				channelId,
+				targetSessionKey,
+				accountId,
+				maxAgeMs
+			})
+		},
+		runtimeContexts: createChannelRuntimeContextRegistry()
+	};
+}
+//#endregion
+export { createRuntimeChannel as t };

package/dist/runtime-channel-CPFxNapZ.js

@@ -0,0 +1,2 @@
+import { t as createRuntimeChannel } from "./runtime-channel-BGhTxnXZ.js";
+export { createRuntimeChannel };

package/dist/runtime-embedded-pi.runtime-BjnMTurB.js

@@ -0,0 +1,2 @@
+import { t as runEmbeddedPiAgent } from "./pi-embedded-1-rsueO_.js";
+export { runEmbeddedPiAgent as runEmbeddedAgent, runEmbeddedPiAgent };

package/dist/runtime-embedded-pi.runtime.js

@@ -1 +1 @@
-export * from "./runtime-embedded-pi.runtime-BPB9NlTS.js";
+export * from "./runtime-embedded-pi.runtime-BjnMTurB.js";

package/dist/sanitize-outbound-BMUv1NeS.js

@@ -0,0 +1,127 @@
+import { a as normalizeLowercaseStringOrEmpty, c as normalizeOptionalString } from "./string-coerce-DyL154ka.js";
+import { l as normalizeE164 } from "./utils-CNnMhEDp.js";
+import { i as stripAssistantInternalScaffolding } from "./assistant-visible-text-BoF6Ixue.js";
+import "./string-coerce-runtime-DcopKqDR.js";
+import "./core-D0Y2H55f.js";
+import "./media-runtime-CPXTkSQr.js";
+import "./text-chunking-ObhJDe8L.js";
+import "./account-resolution-DvO8jOO3.js";
+import "./status-helpers-nyf_mfYa.js";
+import "./channel-status-1yY-1IXP.js";
+import { c as parseIMessageTarget, o as normalizeIMessageHandle$1 } from "./targets-ByhFAk_l.js";
+//#region extensions/imessage/src/normalize.ts
+const SERVICE_PREFIXES = [
+	"imessage:",
+	"sms:",
+	"auto:"
+];
+const CHAT_TARGET_PREFIX_RE = /^(chat_id:|chatid:|chat:|chat_guid:|chatguid:|guid:|chat_identifier:|chatidentifier:|chatident:)/i;
+function looksLikeHandleOrPhoneTarget(params) {
+	const trimmed = params.raw.trim();
+	if (!trimmed) return false;
+	if (params.prefixPattern.test(trimmed)) return true;
+	if (trimmed.includes("@")) return true;
+	return (params.phonePattern ?? /^\+?\d{3,}$/).test(trimmed);
+}
+function normalizeIMessageHandle(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return "";
+	const lowered = normalizeLowercaseStringOrEmpty(trimmed);
+	if (lowered.startsWith("imessage:")) return normalizeIMessageHandle(trimmed.slice(9));
+	if (lowered.startsWith("sms:")) return normalizeIMessageHandle(trimmed.slice(4));
+	if (lowered.startsWith("auto:")) return normalizeIMessageHandle(trimmed.slice(5));
+	if (CHAT_TARGET_PREFIX_RE.test(trimmed)) {
+		const prefix = trimmed.match(CHAT_TARGET_PREFIX_RE)?.[0];
+		if (!prefix) return "";
+		const value = trimmed.slice(prefix.length).trim();
+		return `${normalizeLowercaseStringOrEmpty(prefix)}${value}`;
+	}
+	if (trimmed.includes("@")) return normalizeLowercaseStringOrEmpty(trimmed);
+	const normalized = normalizeE164(trimmed);
+	if (normalized) return normalized;
+	return trimmed.replace(/\s+/g, "");
+}
+function normalizeIMessageMessagingTarget(raw) {
+	const trimmed = normalizeOptionalString(raw);
+	if (!trimmed) return;
+	const lower = normalizeLowercaseStringOrEmpty(trimmed);
+	for (const prefix of SERVICE_PREFIXES) if (lower.startsWith(prefix)) {
+		const normalizedHandle = normalizeIMessageHandle(trimmed.slice(prefix.length).trim());
+		if (!normalizedHandle) return;
+		if (CHAT_TARGET_PREFIX_RE.test(normalizedHandle)) return normalizedHandle;
+		return `${prefix}${normalizedHandle}`;
+	}
+	return normalizeIMessageHandle(trimmed) || void 0;
+}
+function looksLikeIMessageTargetId(raw) {
+	const trimmed = normalizeOptionalString(raw);
+	if (!trimmed) return false;
+	if (CHAT_TARGET_PREFIX_RE.test(trimmed)) return true;
+	return looksLikeHandleOrPhoneTarget({
+		raw: trimmed,
+		prefixPattern: /^(imessage:|sms:|auto:)/i
+	});
+}
+//#endregion
+//#region extensions/imessage/src/conversation-id-core.ts
+function normalizeIMessageAcpConversationId(conversationId) {
+	const trimmed = conversationId.trim();
+	if (!trimmed) return null;
+	try {
+		const parsed = parseIMessageTarget(trimmed);
+		if (parsed.kind === "handle") {
+			const handle = normalizeIMessageHandle$1(parsed.to);
+			return handle ? { conversationId: handle } : null;
+		}
+		if (parsed.kind === "chat_id") return { conversationId: String(parsed.chatId) };
+		if (parsed.kind === "chat_guid") return { conversationId: parsed.chatGuid };
+		return { conversationId: parsed.chatIdentifier };
+	} catch {
+		const handle = normalizeIMessageHandle$1(trimmed);
+		return handle ? { conversationId: handle } : null;
+	}
+}
+function matchIMessageAcpConversation(params) {
+	const binding = normalizeIMessageAcpConversationId(params.bindingConversationId);
+	const conversation = normalizeIMessageAcpConversationId(params.conversationId);
+	if (!binding || !conversation) return null;
+	if (binding.conversationId !== conversation.conversationId) return null;
+	return {
+		conversationId: conversation.conversationId,
+		matchPriority: 2
+	};
+}
+function resolveIMessageConversationIdFromTarget(target) {
+	return normalizeIMessageAcpConversationId(target)?.conversationId;
+}
+//#endregion
+//#region extensions/imessage/src/conversation-id.ts
+function resolveIMessageInboundConversationId(params) {
+	if (params.isGroup) return params.chatId != null && Number.isFinite(params.chatId) ? String(params.chatId) : void 0;
+	return normalizeIMessageHandle$1(params.sender) || void 0;
+}
+//#endregion
+//#region extensions/imessage/src/monitor/sanitize-outbound.ts
+/**
+* Patterns that indicate assistant-internal metadata leaked into text.
+* These must never reach a user-facing channel.
+*/
+const INTERNAL_SEPARATOR_RE = /(?:#\+){2,}#?/g;
+const ASSISTANT_ROLE_MARKER_RE = /\bassistant\s+to\s*=\s*\w+/gi;
+const ROLE_TURN_MARKER_RE = /\b(?:user|system|assistant)\s*:\s*$/gm;
+/**
+* Strip all assistant-internal scaffolding from outbound text before delivery.
+* Applies reasoning/thinking tag removal, memory tag removal, and
+* model-specific internal separator stripping.
+*/
+function sanitizeOutboundText(text) {
+	if (!text) return text;
+	let cleaned = stripAssistantInternalScaffolding(text);
+	cleaned = cleaned.replace(INTERNAL_SEPARATOR_RE, "");
+	cleaned = cleaned.replace(ASSISTANT_ROLE_MARKER_RE, "");
+	cleaned = cleaned.replace(ROLE_TURN_MARKER_RE, "");
+	cleaned = cleaned.replace(/\n{3,}/g, "\n\n").trim();
+	return cleaned;
+}
+//#endregion
+export { resolveIMessageConversationIdFromTarget as a, normalizeIMessageAcpConversationId as i, resolveIMessageInboundConversationId as n, looksLikeIMessageTargetId as o, matchIMessageAcpConversation as r, normalizeIMessageMessagingTarget as s, sanitizeOutboundText as t };

package/dist/sdk-setup-tools-Do3DkQi_.js

@@ -0,0 +1,8 @@
+import "./runtime-env-BSECk1Nm.js";
+import "./setup-tools-BOGdbXzZ.js";
+import "./media-runtime-CPXTkSQr.js";
+import "./media-mime-j2Nhr7Df.js";
+import "./cli-runtime-DzLh8RWR.js";
+import "./agent-harness-runtime-Dq1fCBOM.js";
+import "./channel-actions-BEsMIO8Q.js";
+export {};

package/dist/secrets-B8YVPHhk.js

@@ -0,0 +1,113 @@
+import { l as loadAuthProfileStoreWithoutExternalProfiles, p as updateAuthProfileStoreWithLock } from "./store-Bo7D4Hg4.js";
+import "./provider-auth-B-d9TlzW.js";
+import "./agent-runtime-BgIT5Ytc.js";
+import { o as parseEnv, u as readText } from "./helpers-w2CyK9G6.js";
+import { c as HERMES_REASON_SECRET_NO_LONGER_PRESENT, d as hermesItemConflict, f as hermesItemError, h as readHermesSecretDetails, n as HERMES_REASON_AUTH_PROFILE_EXISTS, p as hermesItemSkipped, r as HERMES_REASON_AUTH_PROFILE_WRITE_FAILED, s as HERMES_REASON_MISSING_SECRET_METADATA, u as createHermesSecretItem } from "./items-EdIOLB5m.js";
+//#region extensions/migrate-hermes/secrets.ts
+const SECRET_MAPPINGS = [
+	{
+		envVar: "OPENAI_API_KEY",
+		provider: "openai",
+		profileId: "openai:hermes-import"
+	},
+	{
+		envVar: "ANTHROPIC_API_KEY",
+		provider: "anthropic",
+		profileId: "anthropic:hermes-import"
+	},
+	{
+		envVar: "OPENROUTER_API_KEY",
+		provider: "openrouter",
+		profileId: "openrouter:hermes-import"
+	},
+	{
+		envVar: "GOOGLE_API_KEY",
+		provider: "google",
+		profileId: "google:hermes-import"
+	},
+	{
+		envVar: "GEMINI_API_KEY",
+		provider: "google",
+		profileId: "google:hermes-import"
+	},
+	{
+		envVar: "GROQ_API_KEY",
+		provider: "groq",
+		profileId: "groq:hermes-import"
+	},
+	{
+		envVar: "XAI_API_KEY",
+		provider: "xai",
+		profileId: "xai:hermes-import"
+	},
+	{
+		envVar: "MISTRAL_API_KEY",
+		provider: "mistral",
+		profileId: "mistral:hermes-import"
+	},
+	{
+		envVar: "DEEPSEEK_API_KEY",
+		provider: "deepseek",
+		profileId: "deepseek:hermes-import"
+	}
+];
+async function buildSecretItems(params) {
+	const env = parseEnv(await readText(params.source.envPath));
+	const store = loadAuthProfileStoreWithoutExternalProfiles(params.targets.agentDir);
+	const seenProfiles = /* @__PURE__ */ new Set();
+	const items = [];
+	for (const mapping of SECRET_MAPPINGS) {
+		if (!env[mapping.envVar]?.trim() || seenProfiles.has(mapping.profileId)) continue;
+		seenProfiles.add(mapping.profileId);
+		const existsAlready = Boolean(store.profiles[mapping.profileId]);
+		items.push(createHermesSecretItem({
+			id: `secret:${mapping.provider}`,
+			source: params.source.envPath,
+			target: `${params.targets.agentDir}/auth-profiles.json#${mapping.profileId}`,
+			includeSecrets: params.ctx.includeSecrets,
+			existsAlready: existsAlready && !params.ctx.overwrite,
+			details: {
+				envVar: mapping.envVar,
+				provider: mapping.provider,
+				profileId: mapping.profileId
+			}
+		}));
+	}
+	return items;
+}
+async function applySecretItem(ctx, item, targets) {
+	if (item.status !== "planned") return item;
+	const details = readHermesSecretDetails(item);
+	const source = item.source;
+	if (!details || !source) return hermesItemError(item, HERMES_REASON_MISSING_SECRET_METADATA);
+	const key = parseEnv(await readText(source))[details.envVar]?.trim();
+	if (!key) return hermesItemSkipped(item, HERMES_REASON_SECRET_NO_LONGER_PRESENT);
+	let conflicted = false;
+	let wrote = false;
+	const store = await updateAuthProfileStoreWithLock({
+		agentDir: targets.agentDir,
+		updater: (freshStore) => {
+			if (!ctx.overwrite && freshStore.profiles[details.profileId]) {
+				conflicted = true;
+				return false;
+			}
+			freshStore.profiles[details.profileId] = {
+				type: "api_key",
+				provider: details.provider,
+				key,
+				displayName: "Hermes import"
+			};
+			wrote = true;
+			return true;
+		}
+	});
+	if (conflicted) return hermesItemConflict(item, HERMES_REASON_AUTH_PROFILE_EXISTS);
+	if (!store?.profiles[details.profileId]) return hermesItemError(item, HERMES_REASON_AUTH_PROFILE_WRITE_FAILED);
+	if (!wrote && !ctx.overwrite) return hermesItemConflict(item, HERMES_REASON_AUTH_PROFILE_EXISTS);
+	return {
+		...item,
+		status: "migrated"
+	};
+}
+//#endregion
+export { buildSecretItems as n, applySecretItem as t };

package/dist/security-audit-7Gg_nL4o.js

@@ -0,0 +1,122 @@
+import { a as readChannelAllowFromStore } from "./pairing-store-D6kKcRDP.js";
+import { i as normalizeAllowFromList, t as coerceNativeSetting } from "./channel-policy-Be-Ujzjr.js";
+import { n as isDangerousNameMatchingEnabled } from "./dangerous-name-matching-jjAiM0PK.js";
+import { n as resolveNativeCommandsEnabled, r as resolveNativeSkillsEnabled } from "./commands-CJmR93qR.js";
+import "./conversation-runtime-BxOHxuin.js";
+import "./native-command-config-runtime-cXDA9h2f.js";
+import { t as isDiscordMutableAllowEntry } from "./security-doctor-uUo8hTD5.js";
+//#region extensions/discord/src/security-audit.ts
+function normalizeOptionalString(value) {
+	const normalized = value?.trim();
+	return normalized ? normalized : void 0;
+}
+function addDiscordNameBasedEntries(params) {
+	if (!Array.isArray(params.values)) return;
+	for (const value of params.values) {
+		if (!isDiscordMutableAllowEntry(String(value))) continue;
+		const text = normalizeOptionalString(String(value)) ?? "";
+		if (!text) continue;
+		params.target.add(`${params.source}:${text}`);
+	}
+}
+async function collectDiscordSecurityAuditFindings(params) {
+	const findings = [];
+	const discordCfg = params.account.config ?? {};
+	const accountId = normalizeOptionalString(params.accountId) ?? params.account.accountId ?? "default";
+	const dangerousNameMatchingEnabled = isDangerousNameMatchingEnabled(discordCfg);
+	const storeAllowFrom = await readChannelAllowFromStore("discord", process.env, accountId).catch(() => []);
+	const discordNameBasedAllowEntries = /* @__PURE__ */ new Set();
+	const discordPathPrefix = params.orderedAccountIds.length > 1 || params.hasExplicitAccountPath ? `channels.discord.accounts.${accountId}` : "channels.discord";
+	addDiscordNameBasedEntries({
+		target: discordNameBasedAllowEntries,
+		values: discordCfg.allowFrom,
+		source: `${discordPathPrefix}.allowFrom`
+	});
+	addDiscordNameBasedEntries({
+		target: discordNameBasedAllowEntries,
+		values: discordCfg.dm?.allowFrom,
+		source: `${discordPathPrefix}.dm.allowFrom`
+	});
+	addDiscordNameBasedEntries({
+		target: discordNameBasedAllowEntries,
+		values: storeAllowFrom,
+		source: "~/.daocore/credentials/discord-allowFrom.json"
+	});
+	const guildEntries = discordCfg.guilds ?? {};
+	for (const [guildKey, guildValue] of Object.entries(guildEntries)) {
+		if (!guildValue || typeof guildValue !== "object") continue;
+		const guild = guildValue;
+		addDiscordNameBasedEntries({
+			target: discordNameBasedAllowEntries,
+			values: guild.users,
+			source: `${discordPathPrefix}.guilds.${guildKey}.users`
+		});
+		const channels = guild.channels;
+		if (!channels || typeof channels !== "object") continue;
+		for (const [channelKey, channelValue] of Object.entries(channels)) {
+			if (!channelValue || typeof channelValue !== "object") continue;
+			addDiscordNameBasedEntries({
+				target: discordNameBasedAllowEntries,
+				values: channelValue.users,
+				source: `${discordPathPrefix}.guilds.${guildKey}.channels.${channelKey}.users`
+			});
+		}
+	}
+	if (discordNameBasedAllowEntries.size > 0) {
+		const examples = Array.from(discordNameBasedAllowEntries).slice(0, 5);
+		const more = discordNameBasedAllowEntries.size > examples.length ? ` (+${discordNameBasedAllowEntries.size - examples.length} more)` : "";
+		findings.push({
+			checkId: "channels.discord.allowFrom.name_based_entries",
+			severity: dangerousNameMatchingEnabled ? "info" : "warn",
+			title: dangerousNameMatchingEnabled ? "Discord allowlist uses break-glass name/tag matching" : "Discord allowlist contains name or tag entries",
+			detail: dangerousNameMatchingEnabled ? `Discord name/tag allowlist matching is explicitly enabled via dangerouslyAllowNameMatching. This mutable-identity mode is operator-selected break-glass behavior and out-of-scope for vulnerability reports by itself. Found: ${examples.join(", ")}${more}.` : `Discord name/tag allowlist matching uses normalized slugs and can collide across users. Found: ${examples.join(", ")}${more}.`,
+			remediation: dangerousNameMatchingEnabled ? "Prefer stable Discord IDs (or <@id>/user:<id>/pk:<id>), then disable dangerouslyAllowNameMatching." : "Prefer stable Discord IDs (or <@id>/user:<id>/pk:<id>) in channels.discord.allowFrom and channels.discord.guilds.*.users, or explicitly opt in with dangerouslyAllowNameMatching=true if you accept the risk."
+		});
+	}
+	const nativeEnabled = resolveNativeCommandsEnabled({
+		providerId: "discord",
+		providerSetting: coerceNativeSetting(discordCfg.commands?.native),
+		globalSetting: params.cfg.commands?.native
+	});
+	const nativeSkillsEnabled = resolveNativeSkillsEnabled({
+		providerId: "discord",
+		providerSetting: coerceNativeSetting(discordCfg.commands?.nativeSkills),
+		globalSetting: params.cfg.commands?.nativeSkills
+	});
+	if (!nativeEnabled && !nativeSkillsEnabled) return findings;
+	const defaultGroupPolicy = params.cfg.channels?.defaults?.groupPolicy;
+	const groupPolicy = discordCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
+	const guildsConfigured = Object.keys(guildEntries).length > 0;
+	const hasAnyUserAllowlist = Object.values(guildEntries).some((guild) => {
+		if (!guild || typeof guild !== "object") return false;
+		const record = guild;
+		if (Array.isArray(record.users) && record.users.length > 0) return true;
+		const channels = record.channels;
+		if (!channels || typeof channels !== "object") return false;
+		return Object.values(channels).some((channel) => {
+			if (!channel || typeof channel !== "object") return false;
+			const channelRecord = channel;
+			return Array.isArray(channelRecord.users) && channelRecord.users.length > 0;
+		});
+	});
+	const dmAllowFromRaw = discordCfg.dm?.allowFrom;
+	const ownerAllowFromConfigured = normalizeAllowFromList([...Array.isArray(dmAllowFromRaw) ? dmAllowFromRaw : [], ...storeAllowFrom]).length > 0;
+	const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
+	if (!useAccessGroups && groupPolicy !== "disabled" && guildsConfigured && !hasAnyUserAllowlist) findings.push({
+		checkId: "channels.discord.commands.native.unrestricted",
+		severity: "critical",
+		title: "Discord slash commands are unrestricted",
+		detail: "commands.useAccessGroups=false disables sender allowlists for Discord slash commands unless a per-guild/channel users allowlist is configured; with no users allowlist, any user in allowed guild channels can invoke /… commands.",
+		remediation: "Set commands.useAccessGroups=true (recommended), or configure channels.discord.guilds.<id>.users (or channels.discord.guilds.<id>.channels.<channel>.users)."
+	});
+	else if (useAccessGroups && groupPolicy !== "disabled" && guildsConfigured && !ownerAllowFromConfigured && !hasAnyUserAllowlist) findings.push({
+		checkId: "channels.discord.commands.native.no_allowlists",
+		severity: "warn",
+		title: "Discord slash commands have no allowlists",
+		detail: "Discord slash commands are enabled, but neither an owner allowFrom list nor any per-guild/channel users allowlist is configured; /… commands will be rejected for everyone.",
+		remediation: "Add your user id to channels.discord.allowFrom (or approve yourself via pairing), or configure channels.discord.guilds.<id>.users."
+	});
+	return findings;
+}
+//#endregion
+export { collectDiscordSecurityAuditFindings as t };