@open-everywhere/provider-discord 0.6.0 → 0.8.0

package/agent/channels/discord-gateway.ts

@@ -48,13 +48,14 @@
 //                          expires by itself, so there is nothing to track or clean up across
 //                          turns); set "false"/"0" off.
 
+import { auditErrorDetail } from "@open-everywhere/core/agent/adapter-api.js";
 import { defineChannel, POST, type RouteHandlerArgs } from "eve/channels";
 import { buildDiscordAuth, type OpenEverywhereDiscordAuth } from "./discord-identity.js";
 import { threadParentChannelId } from "./discord-channel-info.js";
 import { splitForDiscord } from "./discord-post.js";
 import { discordFetch, type DiscordFetchDeps } from "./discord-rest.js";
 import { RateLimitExhaustedError, type RetryPolicy } from "@open-everywhere/core/agent/adapter-api.js";
-import { withEndsTurnFinalChannel } from "@open-everywhere/core/agent/adapter-api.js";
+import { TURN_FAILED_TEXT, withEndsTurnFinalChannel } from "@open-everywhere/core/agent/adapter-api.js";
 import {
   finalMessageAction,
   nameDropPattern,
@@ -83,6 +84,7 @@ import {
   type AttachSessionForCancel,
   domainKeyOf,
   resolvePartition,
+  auditSurfaceModeFrom,
   nameDropWakeEnabled,
   seatCatchUp,
   seatCatchUpSinceMs,
@@ -134,6 +136,8 @@ import {
   healPrunedDeploymentStrand,
   engagedFollowUpContract,
   dispatchNativeWakeWithRetry,
+  parseVoiceSync,
+  syncDiscordVoice,
 } from "@open-everywhere/core/agent/adapter-api.js";
 
 // Re-exported so every existing importer (scripts/discord-gateway-test.ts, the completion
@@ -174,7 +178,9 @@ import {
   auditNoReplySentinelObserved,
   getSettings,
   authPrincipalId,
+  coverForWake,
 } from "@open-everywhere/core/agent/adapter-api.js";
+import { discordMemberCanViewChannel } from "../approvals/discord-admin.js";
 import { fetchDiscordBackscrollLines, gradeDiscordContextLines, DISCORD_RAW_FETCH_REACHBACK_HOURS } from "./discord-backscroll.js";
 
 function log(msg: string): void {
@@ -272,6 +278,20 @@ function strOrNum(v: unknown): string | undefined {
   return undefined;
 }
 
+/**
+ * The people a Discord message mentions (OPE-2534, out-of-office cover), by user id, in the order the message names
+ * them: `<@id>` and the legacy nickname form `<@!id>`. A role mention (`<@&id>`), a channel mention (`<#id>`) and the
+ * bot's own mention are no person, so they are left out. Pure.
+ */
+export function discordMentionedUserIds(content: string, botId?: string): string[] {
+  const ids: string[] = [];
+  for (const m of content.matchAll(/<@!?(\d{17,20})>/g)) {
+    const id = m[1]!;
+    if (id !== botId) ids.push(id);
+  }
+  return ids;
+}
+
 /**
  * Defensively parse the relay envelope. Returns null for anything not recognizably a relay
  * MESSAGE_CREATE with the identity facts we MUST have to dispatch + reply — a channel id (for
@@ -1952,7 +1972,7 @@ async function divertDiscordDmToWindow(input: {
     // dominant convention for a wake-shaped audit row (line ~2112/2259/2330 below), not the raw
     // `partition.surface` channel id.
     await auditSupervisorFailure({ org, platform: input.partition.platform, workspace: input.partition.workspace, surface: surfaceKey }, "surface.wake_failed", {
-      message: String(err instanceof Error ? err.message : err).slice(0, 500),
+      message: auditErrorDetail(err).error,
       wakeId,
       addressing: "direct-mention",
     });
@@ -2144,34 +2164,55 @@ export async function divertDiscordWakeToUnifiedWindow(input: {
       // channel's wake stays top-level and the standing seat keeps it.
       ...(isThreadChannelType(msg.channelType) ? { thread: true as const } : {}),
     };
-    const rendered = renderWake(
-      buildDiscordUnifiedWake({
-        guildId: msg.guildId ?? "",
-        channelId: msg.channelId,
-        parentChannelId: str(input.auth.attributes.parent_channel_id),
-        isThread: isThreadChannelType(msg.channelType),
-        addressing: input.addressing,
-        threadEngaged: input.threadEngaged,
-        wakeId,
-        engagementTier: discordEngagementTier(domainKeyOf(input.partition)),
-        tail,
-        // 🔴 THE HYDRATION RIDES THE WAKE, NOT A PRE-RENDERED STRING (OPE-1749). `renderWake` holds
-        // both slots — these lines and `tail` — so core de-duplicates them against each other and
-        // spends the cap below that de-duplication, the same road every other surface takes.
-        contextLines: input.contextLines,
-        contextSource: input.contextSource,
-        botName: msg.botName,
-        catchUpUnavailable,
-        trigger: {
-          id: msg.id || "unknown",
-          author: msg.author.username ?? msg.author.id,
-          authorId: msg.author.id,
-          sentAt: atIso,
-          text: msg.content,
-          trust,
-        },
-      }),
-    );
+    // 🔴 OUT-OF-OFFICE COVER (OPE-2534, the Slack seam of OPE-2513). A message that mentions a person with live cover
+    // gets OE's cover note on THIS wake, and nothing else changes: the binding, the auth bag and the room's memory stay
+    // the room's, so the answer can use only what this room already knows. The reply's label and the recap key on this
+    // wake id (cover/wake.ts). A cover read that fails covers nobody.
+    // No Discord room is public to the recap, because a relay message carries no permission data. Discord's own rule
+    // (approvals/discord-admin.ts `discordMemberCanViewChannel`) confirms, per covered person, that they can read it.
+    const cover = await coverForWake({
+      org,
+      platform: "discord",
+      workspace: input.partition.workspace,
+      surface: input.partition.surface,
+      surfaceKey: input.partition.surfaceKey,
+      channelId: msg.channelId,
+      roomPublic: false,
+      wakeId,
+      mentionedIds: discordMentionedUserIds(msg.content, msg.botId),
+      askerId: msg.author.id,
+      ...(msg.author.username ? { askerName: msg.author.username } : {}),
+      text: msg.content,
+      now: new Date(atIso),
+      ...(msg.guildId ? { confirmInRoom: (id: string) => discordMemberCanViewChannel(msg.guildId!, msg.channelId, id) } : {}),
+    }).catch(() => ({ covered: [] }) as { systemNote?: string });
+    const built = buildDiscordUnifiedWake({
+      guildId: msg.guildId ?? "",
+      channelId: msg.channelId,
+      parentChannelId: str(input.auth.attributes.parent_channel_id),
+      isThread: isThreadChannelType(msg.channelType),
+      addressing: input.addressing,
+      threadEngaged: input.threadEngaged,
+      wakeId,
+      engagementTier: discordEngagementTier(domainKeyOf(input.partition)),
+      tail,
+      // 🔴 THE HYDRATION RIDES THE WAKE, NOT A PRE-RENDERED STRING (OPE-1749). `renderWake` holds
+      // both slots — these lines and `tail` — so core de-duplicates them against each other and
+      // spends the cap below that de-duplication, the same road every other surface takes.
+      contextLines: input.contextLines,
+      contextSource: input.contextSource,
+      botName: msg.botName,
+      catchUpUnavailable,
+      trigger: {
+        id: msg.id || "unknown",
+        author: msg.author.username ?? msg.author.id,
+        authorId: msg.author.id,
+        sentAt: atIso,
+        text: msg.content,
+        trust,
+      },
+    });
+    const rendered = renderWake(cover.systemNote ? { ...built, systemNote: built.systemNote ? `${built.systemNote}\n${cover.systemNote}` : cover.systemNote } : built);
     const domainSurfaceKey = domainKeyOf(input.partition);
     try {
       // THE OWNED-THREAD INGRESS SEAM (§2.6, OPE-1719) — the INBOUND variant, the one Slack's front
@@ -2225,7 +2266,7 @@ export async function divertDiscordWakeToUnifiedWindow(input: {
       await auditSupervisorFailure(
         { org: deploymentOrg(), platform: input.partition.platform, workspace: input.partition.workspace, surface: domainSurfaceKey },
         "surface.wake_failed",
-        { message: String(err instanceof Error ? err.message : err).slice(0, 500), wakeId, addressing: input.addressing },
+        { message: auditErrorDetail(err).error, wakeId, addressing: input.addressing },
       );
       throw err;
     }
@@ -2343,6 +2384,8 @@ export async function dispatchTurn(
     }
   }
   const partition: Partition = resolvePartition(ctxFromAuth(auth));
+  // OPE-1940: the RESOLVED mode of the same surface, spread into every audit row below that names it.
+  const auditMode = auditSurfaceModeFrom(ctxFromAuth(auth));
   const key = engagementKey(msg);
   const isDm = isDmChannel(msg.channelType);
   // A DM or a mention always wakes; only a plain guild message needs the (async) engagement lookup.
@@ -2395,6 +2438,7 @@ export async function dispatchTurn(
       platform: "discord",
       workspace: partition.workspace,
       surface: partition.surfaceKey,
+      ...auditMode,
       principalId: msg.author.id,
       action: "discord.external_policy_suppressed",
       detail: { verdict: externalVerdict, channelId: msg.channelId, ...suppressionRendering(acked) },
@@ -2558,6 +2602,7 @@ export async function dispatchTurn(
       // which is what `partition` already carries — no fabricated guild id.
       workspace: partition.workspace,
       surface: partition.surfaceKey,
+      ...auditMode,
       principalId: msg.author.id,
       action: "discord.dispatched",
       detail: { addressing: "direct-mention", dmWindow: true, channelId: msg.channelId },
@@ -2638,6 +2683,7 @@ export async function dispatchTurn(
         platform: "discord",
         workspace: msg.guildId ?? "unknown",
         surface: partition.surfaceKey,
+        ...auditMode,
         principalId: msg.author.id,
         action: "discord.dispatched",
         detail: { addressing, singleWindow: true, channelId: msg.channelId },
@@ -3007,6 +3053,15 @@ export default withEndsTurnFinalChannel(defineChannel<DiscordGatewayState, Disco
         return new Response("ok", { status: 200 });
       }
 
+      // Discord voice meetings (OPE-2473) — the relay's VOICE_SYNC. Like the heartbeat it mints no session and no
+      // wake. It is answered INLINE, because the answer IS the payload: the voice channels the relay must be in
+      // (core meetings/discord-voice.ts). The relay's report (credentials, members) is stored for the meeting box.
+      const voiceSync = parseVoiceSync(json);
+      if (voiceSync) {
+        const answer = await syncDiscordVoice(deploymentOrg(), voiceSync);
+        return new Response(JSON.stringify(answer), { status: 200, headers: { "content-type": "application/json" } });
+      }
+
       // Inbound reaction — a distinct relay payload shape. Handled before the message parse:
       // ingest async (telemetry always, a durable feedback row on a bot reply), ack immediately.
       // A reaction never starts a turn — but since OPE-418 a ✋ can STOP one, which is why
@@ -3114,10 +3169,8 @@ export default withEndsTurnFinalChannel(defineChannel<DiscordGatewayState, Disco
       openTypingGate(channel.channelId); // turn over — never leak a closed gate into the next
       const detail = (data as { error?: { message?: string } } | undefined)?.error?.message;
       log(`turn failed (channel ${channel.channelId || "?"})${detail ? `: ${detail}` : ""}`);
-      await postDiscordReply(
-        channel.channelId,
-        "⚠️ I hit an error while handling that and couldn't finish. Please try again — and if it keeps failing, check the deployment logs.",
-      );
+      // OPE-2486 — the person reads one plain line; the error detail stays in the log line above.
+      await postDiscordReply(channel.channelId, `⚠️ ${TURN_FAILED_TEXT}`);
     },
     // Deliver the turn's final reply back to Discord AND reconcile the 👀→✅ swap (auto-threaded
     // mentions only). finalMessageAction (the shared, unit-tested decision slack-events.ts owns)

package/agent/channels/discord-invite.ts

@@ -0,0 +1,46 @@
+// The Discord invite lookup for meeting links (OPE-2473): `GET /invites/{code}` with the bot token, registered with
+// core's meeting invite seam (core meetings/invite.ts) from registerDiscordProvider(). A person who uses Discord's
+// "Invite to voice channel" pastes `https://discord.gg/<code>`; this answers which server and channel the code
+// opens and what kind of channel it is. Core then builds the channel's own link and runs every usual check on it.
+//
+// The answer is Discord's data and core treats it as untrusted: core re-parses the ids through the same strict
+// link parse a pasted link meets. The bot token is a SECRET — header only, never logged. No cache: an invite is
+// looked up once per ask, and an expired code must read as expired.
+
+import type { MeetingInviteLookup, MeetingInviteResolver } from "@open-everywhere/core/agent/adapter-api.js";
+
+/** Discord's channel types for a voice room: GUILD_VOICE (2) and GUILD_STAGE_VOICE (13). */
+const GUILD_VOICE = 2;
+const GUILD_STAGE_VOICE = 13;
+/** A Discord id (a snowflake): 17 to 20 digits. */
+const SNOWFLAKE = /^\d{17,20}$/;
+
+export interface DiscordInviteDeps {
+  readonly fetchFn?: typeof fetch;
+  readonly token?: string;
+}
+
+/** Look one invite code up. NEVER throws: every failure is a `found: false` answer core turns into a plain reason. */
+export async function lookUpDiscordInvite(code: string, deps: DiscordInviteDeps = {}): Promise<MeetingInviteLookup> {
+  const token = deps.token ?? process.env.DISCORD_BOT_TOKEN;
+  if (!token) return { found: false, why: "unreachable" };
+  try {
+    const doFetch = deps.fetchFn ?? fetch;
+    const res = await doFetch(`https://discord.com/api/v10/invites/${encodeURIComponent(code)}`, { headers: { authorization: `Bot ${token}` } });
+    // Discord answers an expired, revoked or mistyped code with 404 (Unknown Invite).
+    if (res.status === 404) return { found: false, why: "unknown" };
+    if (!res.ok) return { found: false, why: "unreachable" };
+    const body = (await res.json()) as { guild?: { id?: unknown } | null; channel?: { id?: unknown; type?: unknown } | null };
+    const guildId = body.guild?.id;
+    const channelId = body.channel?.id;
+    if (typeof guildId !== "string" || !SNOWFLAKE.test(guildId) || typeof channelId !== "string" || !SNOWFLAKE.test(channelId)) return { found: false, why: "no-channel" };
+    const type = body.channel?.type;
+    const channelKind = type === GUILD_VOICE ? "voice" : type === GUILD_STAGE_VOICE ? "stage" : "other";
+    return { found: true, guildId, channelId, channelKind };
+  } catch {
+    return { found: false, why: "unreachable" };
+  }
+}
+
+/** The resolver core's seam holds: the live lookup, with the live token and fetch. */
+export const discordInviteResolver: MeetingInviteResolver = (code) => lookUpDiscordInvite(code);

package/agent/channels/discord-origin-codec.ts

@@ -80,6 +80,17 @@ export const discordWakeOriginCodec: WakeOriginCodec<DiscordOrigin> = {
   // which is the fail-closed direction and byte-identical to the behaviour this replaced.
   isThreadScoped: (origin) => !isDmOrigin(origin) && origin.thread === true,
   containerId: (origin) => origin.channelId,
+  // THE THREAD A REPLY OPENS (OPE-2558, core routines/report-thread.ts). A Discord thread started from a
+  // message takes that message's id as its own channel id, so a thread a person opens off a top-level
+  // post is the guild channel `<post id>` with `thread: true` (the shape the gateway mints for a message
+  // in it). A post that is already in a thread answers undefined, because its own `threadRef` is the key.
+  // A DM has no threads. An origin with `autoThreadName` answers undefined: its arm may move the post
+  // into a thread of its own, so the post id does not name the thread a reply opens. A plain Discord
+  // reply (a message reference in the channel) is not a thread, so only a thread off the post counts.
+  replyThreadUnder: (origin, messageId) => {
+    if (isDmOrigin(origin) || origin.thread === true || origin.autoThreadName !== undefined) return undefined;
+    return { platform: "discord", guildId: origin.guildId, channelId: messageId, thread: true };
+  },
   // THE PLACEMENT AXIS (OPE-1826). Discord is the SECOND surface whose post placement sits OUTSIDE
   // its conversation identity, and until this member existed nothing said so: `threadRef` keys on the
   // channel id alone (a Discord thread IS its own channel id), while the post arm hangs the answer on

package/agent/channels/discord-rest.ts

@@ -29,7 +29,38 @@
 // `POST /channels/{id}/messages`) that rides the NAMED `RateLimitExhaustedError`; keep ids out of it,
 // so every field on that error stays safe to log.
 
-import { withRetryAfter, type RetryPolicy } from "@open-everywhere/core/agent/adapter-api.js";
+import { friendlyDiscordBody, withRetryAfter, type RetryPolicy } from "@open-everywhere/core/agent/adapter-api.js";
+
+/**
+ * THE FRIENDLY-NAMES GUARD (OPE-2482). A message write (create, edit, webhook or interaction follow-up)
+ * renders every raw id in its content, embeds and component labels as a mention, a name or plain words
+ * before it leaves. A JSON string body and a multipart `payload_json` are both covered; any other
+ * operation, and a body this cannot parse, goes out unchanged.
+ */
+async function friendlyDiscordInit(operation: string, init: RequestInit): Promise<RequestInit> {
+  if (!/^(?:POST|PATCH) /.test(operation) || !/\/messages\b|\/callback\b|^POST \/webhooks\//.test(operation)) return init;
+  const render = async (json: string): Promise<string | undefined> => {
+    try {
+      return JSON.stringify(await friendlyDiscordBody(JSON.parse(json) as unknown));
+    } catch {
+      return undefined;
+    }
+  };
+  if (typeof init.body === "string") {
+    const body = await render(init.body);
+    return body === undefined ? init : { ...init, body };
+  }
+  if (init.body instanceof FormData) {
+    const payload = init.body.get("payload_json");
+    if (typeof payload !== "string") return init;
+    const body = await render(payload);
+    if (body === undefined) return init;
+    const form = new FormData();
+    for (const [k, v] of init.body.entries()) form.append(k, k === "payload_json" ? body : v);
+    return { ...init, body: form };
+  }
+  return init;
+}
 
 /** The provider surface name on the NAMED rate-limit failure. */
 export const DISCORD_SURFACE = "discord";
@@ -75,7 +106,9 @@ export async function discordBodyRetryAfterMs(res: Response): Promise<number | u
  * applied).
  */
 export function discordFetch(operation: string, url: string, init: RequestInit, deps: DiscordFetchDeps = {}): Promise<Response> {
-  const send = (): Promise<Response> => (deps.fetch ?? (globalThis.fetch as DiscordFetchLike))(url, init);
+  // The guarded body is computed once and re-sent unchanged by every retry.
+  const guarded = friendlyDiscordInit(operation, init);
+  const send = async (): Promise<Response> => (deps.fetch ?? (globalThis.fetch as DiscordFetchLike))(url, await guarded);
   return withRetryAfter(send, {
     surface: DISCORD_SURFACE,
     operation,

package/agent/commands/discord-commands.ts

@@ -26,12 +26,14 @@
 // channels/discord-front.ts's classifyDiscordInteraction.
 
 import {
+  commandFailureText,
   bindFrom,
   MODEL_AB_RATING_MAX,
   MODEL_AB_RATING_MIN,
   agentDisplayName,
   oeCommandName,
   oeSlash,
+  parseOeCommandTokens,
   runOeCommand,
   type AttachSessionForCancel,
   type BindableContext,
@@ -47,9 +49,16 @@ const RESPONSE_CHANNEL_MESSAGE = 4; // CHANNEL_MESSAGE_WITH_SOURCE — a fresh r
 const EPHEMERAL_FLAG = 64; //         only the invoking user sees the reply
 
 function ephemeral(content: string): DiscordInteractionResponse {
-  return { type: RESPONSE_CHANNEL_MESSAGE, data: { content, flags: EPHEMERAL_FLAG } };
+  return { type: RESPONSE_CHANNEL_MESSAGE, data: { content: content.length > 0 ? content : DISCORD_CARD_ACK, flags: EPHEMERAL_FLAG } };
 }
 
+/**
+ * The private acknowledgement for a command whose card IS the answer (OPE-2490, core's
+ * `CARD_IS_THE_ANSWER`). Discord must answer an interaction with content, or it shows "The application
+ * did not respond". So the answer is the smallest one there is: it says nothing the card says.
+ */
+const DISCORD_CARD_ACK = "👍";
+
 // --- defensive wire-JSON probing (untrusted body, post-signature-check) ---------------------
 // Mirrors approvals/discord-flow.ts's parseDiscordComponentClick posture exactly: this is
 // attacker-shaped JSON reaching a public URL (Discord relays whatever a client sends), so
@@ -124,11 +133,25 @@ export function parseDiscordOeCommandOptions(rawOptions: unknown): OeCommand {
     if (score === undefined || !Number.isInteger(score) || score < MODEL_AB_RATING_MIN || score > MODEL_AB_RATING_MAX) {
       return {
         kind: "error",
-        message: `"${oeSlash("rate")}" needs a whole "score" from ${MODEL_AB_RATING_MIN} to ${MODEL_AB_RATING_MAX} (got ${JSON.stringify(scoreOpt?.value)}).`,
+        message: `Rate with a whole number from ${MODEL_AB_RATING_MIN} to ${MODEL_AB_RATING_MAX}, for example \`${oeSlash("rate 4")}\`.`,
       };
     }
     return { kind: "rate", score };
   }
+  if (name === "cover") {
+    // OPE-2534: the out-of-office cover switch. Core's own grammar parses it (commands/cover.ts), so `/oe cover on until
+    // 2026-10-20` means on Discord what it means on Slack and Teams, and the same date check answers.
+    const sub = optArray(first.options)[0];
+    const subName = sub ? str(sub.name) : undefined;
+    const until = str(findOpt(optArray(sub?.options), "until")?.value);
+    return parseOeCommandTokens(["cover", ...(subName ? [subName] : []), ...(subName === "on" && until ? ["until", until] : [])]);
+  }
+  if (name === "suggest") {
+    // OPE-2550: the room's stop for routine suggestions. Core's own grammar parses it (commands/suggest.ts).
+    const sub = optArray(first.options)[0];
+    const subName = sub ? str(sub.name) : undefined;
+    return parseOeCommandTokens(["suggest", ...(subName ? [subName] : [])]);
+  }
   if (name === "budget") {
     const sub = optArray(first.options)[0];
     const subName = sub ? str(sub.name) : undefined;
@@ -140,14 +163,14 @@ export function parseDiscordOeCommandOptions(rawOptions: unknown): OeCommand {
       if (usd === undefined || usd <= 0) {
         return {
           kind: "error",
-          message: `"${oeSlash("budget raise")}" needs a positive "usd" amount (got ${JSON.stringify(usdOpt?.value)}).`,
+          message: `Add an amount in dollars, for example \`${oeSlash("budget raise 25")}\`.`,
         };
       }
       return { kind: "budget-raise", usd };
     }
-    return { kind: "error", message: `Unknown "budget" subcommand "${subName}".` };
+    return { kind: "error", message: `I don't know "${subName}". Try \`${oeSlash("budget")}\`, \`${oeSlash("budget raise 25")}\` or \`${oeSlash("budget clear")}\`.` };
   }
-  return { kind: "error", message: `Unknown "${oeSlash()}" subcommand "${name ?? "?"}" — try "${oeSlash("help")}".` };
+  return { kind: "error", message: `I don't know "${name ?? "that"}". Try \`${oeSlash("help")}\` to see what I can do.` };
 }
 
 interface ParsedOeInvocation {
@@ -174,11 +197,11 @@ export function parseOeCommandInteraction(raw: unknown): ParsedOeInvocation | {
   const userId = (memberUser ? str(memberUser["id"]) : undefined) ?? (user ? str(user["id"]) : undefined);
   const isBot = memberUser?.["bot"] === true || user?.["bot"] === true;
   if (!userId || isBot) {
-    return { error: "Couldn't identify who invoked this — commands can't be run by a bot." };
+    return { error: "Only a person can use this command." };
   }
   const channelId = str(raw["channel_id"]);
   if (!channelId) {
-    return { error: "Couldn't resolve this channel's id — try again from a real channel or DM." };
+    return { error: "I can't do that here. Try it in a channel or a direct message." };
   }
   const guildId = str(raw["guild_id"]);
   const channelType = channelTypeFromRaw(raw);
@@ -212,12 +235,11 @@ export async function handleDiscordOeCommandInteraction(
     const text = await runOeCommand(parsed.command, binding, attachSession ? { attachSession } : {});
     return ephemeral(text);
   } catch (err) {
-    // runOeCommand's budget-raise/clear branches can throw a user-facing validation error
-    // (e.g. "propose from a DM needs an explicit scope") — surface it verbatim; anything else
-    // (a genuinely unexpected store/network failure) gets a generic fail-soft note. Either way,
-    // never throw out of this function.
+    // A PersonFacingError renders as-is; anything else (a store or network failure, a planner's
+    // model-facing refusal) renders the generic line, and its message goes to the log only
+    // (OPE-2486). Either way, never throw out of this function.
     console.error(`[open-everywhere:discord-commands] "${oeSlash()}" command failed softly: ${String(err)}`);
-    return ephemeral(`Couldn't complete that: ${err instanceof Error ? err.message : String(err)}`);
+    return ephemeral(commandFailureText(err));
   }
 }
 
@@ -226,6 +248,7 @@ export async function handleDiscordOeCommandInteraction(
 // note on why this file doesn't import eve's channel module for two integers).
 const SUB_COMMAND = 1;
 const SUB_COMMAND_GROUP = 2;
+const OPTION_STRING = 3;
 const OPTION_INTEGER = 4;
 const OPTION_NUMBER = 10;
 const CHAT_INPUT = 1;
@@ -299,6 +322,35 @@ export function buildOeDiscordCommandDefinition(): Record<string, unknown> {
           },
         ],
       },
+      // OPE-2534: out-of-office cover. A SUB_COMMAND_GROUP, because Discord needs a concrete subcommand: `status` is the
+      // bare `/oe cover` of Slack and Teams, and `on` takes the optional end date core's grammar reads.
+      {
+        name: "cover",
+        description: "While you are away, I answer questions people ask you, marked as cover.",
+        type: SUB_COMMAND_GROUP,
+        options: [
+          {
+            name: "on",
+            description: "Turn cover on (from your DM with me).",
+            type: SUB_COMMAND,
+            options: [{ name: "until", description: "The first day you are back, as YYYY-MM-DD.", type: OPTION_STRING, required: false }],
+          },
+          { name: "off", description: "Turn cover off. Your recap follows in your DM.", type: SUB_COMMAND },
+          { name: "status", description: "Show whether cover is on.", type: SUB_COMMAND },
+        ],
+      },
+      // OPE-2550: the room's stop for the routine suggestions room discovery posts. A SUB_COMMAND_GROUP for the same
+      // reason as `cover`: `status` is the bare `/oe suggest` of Slack and Teams.
+      {
+        name: "suggest",
+        description: "Stop or allow my routine suggestions in this channel or thread.",
+        type: SUB_COMMAND_GROUP,
+        options: [
+          { name: "off", description: "Stop my routine suggestions in this channel or thread.", type: SUB_COMMAND },
+          { name: "on", description: "Allow them again (members only).", type: SUB_COMMAND },
+          { name: "status", description: "Show whether they are on in this channel or thread.", type: SUB_COMMAND },
+        ],
+      },
       { name: "help", description: `List the ${oeSlash()} commands.`, type: SUB_COMMAND },
     ],
   };