@open-everywhere/provider-discord 0.7.0 → 0.8.0

package/agent/approvals/discord-admin.ts

@@ -225,3 +225,124 @@ export async function discordAuthorRoles(guildId: string, userId: string, deps:
 export function _resetDiscordAuthorRolesCache(): void {
   roleEvidenceCache.clear();
 }
+
+// --- CAN THIS PERSON READ THIS CHANNEL? (OPE-2534, out-of-office cover) --------------------------------------------
+//
+// The cover recap shows a question only where the covered person could already read it. A relay message carries no
+// permission data, so the answer is Discord's own permission rule over three REST reads: the channel (its overwrites,
+// and its parent for a thread), the guild (its owner and role table) and the member (their roles). FAIL-CLOSED like
+// every check in this file: any failure is "cannot read", so the recap counts the question and shows nothing of it.
+
+/** Discord's `VIEW_CHANNEL` and `ADMINISTRATOR` permission bits. */
+const VIEW_CHANNEL = 1n << 10n;
+const ADMINISTRATOR = 1n << 3n;
+/** A public thread (10 announcement, 11 public) reads as its parent channel. A private thread (12) does not. */
+const PUBLIC_THREAD_TYPES: ReadonlySet<number> = new Set([10, 11]);
+const PRIVATE_THREAD_TYPE = 12;
+
+/** One permission overwrite on a channel. `type` 0 is a role (the @everyone role's id is the guild id), 1 a member. */
+export interface DiscordOverwrite {
+  readonly id: string;
+  readonly type: number;
+  readonly allow: string;
+  readonly deny: string;
+}
+
+/** The facts Discord's permission rule reads. */
+export interface DiscordViewFacts {
+  readonly guildId: string;
+  readonly ownerId?: string;
+  /** Role id → permission bits, as the guild's role table spells them (a decimal string). */
+  readonly rolePermissions: ReadonlyMap<string, string>;
+  readonly userId: string;
+  readonly memberRoleIds: readonly string[];
+  readonly overwrites: readonly DiscordOverwrite[];
+}
+
+function permissionBits(v: string | undefined): bigint {
+  return v !== undefined && /^\d+$/.test(v) ? BigInt(v) : 0n;
+}
+
+/**
+ * Discord's documented permission rule for VIEW_CHANNEL (developer docs, "Permissions" → "Permission Overwrites"),
+ * in its order. The owner and ADMINISTRATOR see everything. Else the base is the @everyone role's bits OR the
+ * member's roles' bits. Then the @everyone overwrite, then the member's role overwrites together, then the member's
+ * own overwrite, each as "deny, then allow". Pure.
+ */
+export function discordCanView(f: DiscordViewFacts): boolean {
+  if (f.ownerId !== undefined && f.ownerId === f.userId) return true;
+  let base = permissionBits(f.rolePermissions.get(f.guildId));
+  for (const r of f.memberRoleIds) base |= permissionBits(f.rolePermissions.get(r));
+  if ((base & ADMINISTRATOR) !== 0n) return true;
+  const everyone = f.overwrites.find((o) => o.type === 0 && o.id === f.guildId);
+  if (everyone) base = (base & ~permissionBits(everyone.deny)) | permissionBits(everyone.allow);
+  let allow = 0n;
+  let deny = 0n;
+  for (const o of f.overwrites) {
+    if (o.type === 0 && o.id !== f.guildId && f.memberRoleIds.includes(o.id)) {
+      allow |= permissionBits(o.allow);
+      deny |= permissionBits(o.deny);
+    }
+  }
+  base = (base & ~deny) | allow;
+  const own = f.overwrites.find((o) => o.type === 1 && o.id === f.userId);
+  if (own) base = (base & ~permissionBits(own.deny)) | permissionBits(own.allow);
+  return (base & VIEW_CHANNEL) !== 0n;
+}
+
+function overwritesOf(channel: Record<string, unknown>): DiscordOverwrite[] {
+  const raw = Array.isArray(channel["permission_overwrites"]) ? (channel["permission_overwrites"] as unknown[]) : [];
+  return raw.flatMap((o) =>
+    isObject(o) && typeof o["id"] === "string" && typeof o["type"] === "number"
+      ? [{ id: o["id"], type: o["type"], allow: String(o["allow"] ?? "0"), deny: String(o["deny"] ?? "0") }]
+      : [],
+  );
+}
+
+/**
+ * Can `userId` read `channelId` in `guildId`, per Discord's own rule ({@link discordCanView})? A public thread reads
+ * as its parent channel. Each of these answers FALSE: a private thread, a channel in another guild, a person who is
+ * not a member (404), a bot account (cover is for people), and every failure. NEVER throws. Not cached: cover asks
+ * only about a person with live cover.
+ */
+export async function discordMemberCanViewChannel(guildId: string, channelId: string, userId: string, deps: DiscordAdminDeps = {}): Promise<boolean> {
+  const token = deps.token ?? process.env.DISCORD_BOT_TOKEN;
+  if (!token || !guildId || !channelId || !userId) return false;
+  const doFetch = deps.fetchFn ?? fetch;
+  const headers = { authorization: `Bot ${token}` };
+  const read = async (path: string): Promise<Record<string, unknown> | undefined> => {
+    const res = await doFetch(`https://discord.com/api/v10/${path}`, { headers });
+    if (!res.ok) return undefined;
+    const body = (await res.json()) as unknown;
+    return isObject(body) ? body : undefined;
+  };
+  try {
+    let channel = await read(`channels/${encodeURIComponent(channelId)}`);
+    if (!channel || channel["guild_id"] !== guildId || channel["type"] === PRIVATE_THREAD_TYPE) return false;
+    if (typeof channel["type"] === "number" && PUBLIC_THREAD_TYPES.has(channel["type"])) {
+      const parentId = channel["parent_id"];
+      channel = typeof parentId === "string" ? await read(`channels/${encodeURIComponent(parentId)}`) : undefined;
+      if (!channel || channel["guild_id"] !== guildId) return false;
+    }
+    const guild = await read(`guilds/${encodeURIComponent(guildId)}`);
+    if (!guild) return false;
+    const member = await read(`guilds/${encodeURIComponent(guildId)}/members/${encodeURIComponent(userId)}`);
+    const user = member?.["user"];
+    if (!member || !isObject(user) || user["id"] !== userId || user["bot"] === true) return false;
+    const rolePermissions = new Map<string, string>();
+    for (const r of Array.isArray(guild["roles"]) ? (guild["roles"] as unknown[]) : []) {
+      if (isObject(r) && typeof r["id"] === "string") rolePermissions.set(r["id"], String(r["permissions"] ?? "0"));
+    }
+    return discordCanView({
+      guildId,
+      ...(typeof guild["owner_id"] === "string" ? { ownerId: guild["owner_id"] } : {}),
+      rolePermissions,
+      userId,
+      memberRoleIds: Array.isArray(member["roles"]) ? (member["roles"] as unknown[]).filter((r): r is string => typeof r === "string") : [],
+      overwrites: overwritesOf(channel),
+    });
+  } catch (err) {
+    log(`view check error for guild ${guildId}: ${(err as Error)?.message ?? String(err)}`);
+    return false;
+  }
+}

package/agent/approvals/discord-flow.ts

@@ -66,6 +66,7 @@ import {
   type DecisionWakeDeps,
   type ApprovalOutcome,
   type PendingActionRow,
+  CLICK_NOTICE,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import {
   OE_DISCORD_APPROVAL_PREFIX,
@@ -277,7 +278,7 @@ export interface DiscordApprovalDeps {
 export function discordResponseFor(res: ApprovalClickResolution): DiscordInteractionResponse {
   switch (res.outcome) {
     case "unknown":
-      return ephemeral("This approval request is no longer known (it may have already been decided or has aged out).");
+      return ephemeral(CLICK_NOTICE.unknown);
     case "not-pending":
     case "expired-race":
     case "unregistered-kind":
@@ -288,7 +289,7 @@ export function discordResponseFor(res: ApprovalClickResolution): DiscordInterac
       return { type: RESPONSE_UPDATE_MESSAGE, data: { content: card.content, components: card.components } };
     }
     case "denied":
-      return ephemeral("Only a domain/org admin — or a server administrator, for this server's own scopes — can decide this request.");
+      return ephemeral(CLICK_NOTICE.deniedDiscord);
     case "clicker-denied":
       // The clicker gate (OPE-185, core approvals/clicker-floor.ts) — same UX as `denied`: an
       // ephemeral to the clicker alone, card untouched, row still pending.
@@ -357,7 +358,7 @@ export async function handleDiscordApprovalInteraction(raw: unknown, deps: Disco
     if (!click.clickerId) {
       // It WAS ours; fail soft on the click rather than forward a half-understood payload.
       console.error(`[open-everywhere:discord-approvals] component click "${click.customId}" carries no user id — ignoring the click`);
-      return ephemeral("Couldn't read who clicked — this decision was not applied.");
+      return ephemeral(CLICK_NOTICE.noClicker);
     }
     const clickerId = click.clickerId;
 
@@ -395,8 +396,11 @@ export async function handleDiscordApprovalInteraction(raw: unknown, deps: Disco
         return rowGuild ? isGuildAdminViaRest(rowGuild, clickerId) : false;
       },
     });
-    // Decision FEEDBACK (task #106 — Slack click-path parity): a fresh notice beside the card (the
-    // UPDATE_MESSAGE response is an EDIT, invisible to backscroll) + the cross-thread window wake.
+    // Decision FEEDBACK (task #106 — Slack click-path parity): the cross-thread window wake, and a
+    // fresh notice beside the card that states the outcome only when no seat took the wake or a thread
+    // seat or a worker owns the card's channel (the UPDATE_MESSAGE response is an EDIT, invisible to
+    // backscroll; the room never reads the decided line twice, OPE-2473). Otherwise only an asker whom
+    // somebody else answered, or whose request expired, gets one short line (OPE-2490).
     // The wake's guild id comes from the SIGNED interaction (Slack's team.id analogue — the frozen
     // scopeKey can name a different workspace under an explicit-scope override). A DM-context
     // interaction has none, so the core takes the card's mint-frozen DM `postedTo` as the DM seat's
@@ -419,6 +423,10 @@ export async function handleDiscordApprovalInteraction(raw: unknown, deps: Disco
             outcomeLine: "expired",
             executed: "none",
             target: discordDecisionWakeTarget(res.row, click.guildId),
+            // The interaction answer (UPDATE_MESSAGE) edits the card to its decided line.
+            cardShowsOutcome: true,
+            // The notice posts into the card's own channel; a Discord thread IS its channel id.
+            noticeThread: discordDecisionWakeTarget(res.row, click.guildId)?.origin ?? null,
             postNotice: (text) => (deps.postNotice ?? postDiscordDecisionNotice)(res.row, text),
           },
           deps.decisionWake,
@@ -434,6 +442,10 @@ export async function handleDiscordApprovalInteraction(raw: unknown, deps: Disco
             executed: res.executed,
             clickerId,
             target: discordDecisionWakeTarget(res.row, click.guildId),
+            // The interaction answer (UPDATE_MESSAGE) edits the card to its decided line.
+            cardShowsOutcome: true,
+            // The notice posts into the card's own channel; a Discord thread IS its channel id.
+            noticeThread: discordDecisionWakeTarget(res.row, click.guildId)?.origin ?? null,
             postNotice: (text) => (deps.postNotice ?? postDiscordDecisionNotice)(res.row, text),
           },
           deps.decisionWake,
@@ -465,6 +477,6 @@ export async function handleDiscordApprovalInteraction(raw: unknown, deps: Disco
     // Genuinely unexpected (store outage, …) after we'd established this WAS our click —
     // fail soft with an honest ephemeral note; never throw out of the interactions path.
     console.error(`[open-everywhere:discord-approvals] click handling failed softly for "${click.customId}": ${String(err)}`);
-    return ephemeral("Something went wrong handling this click — the decision was not applied.");
+    return ephemeral(CLICK_NOTICE.failed);
   }
 }

package/agent/channels/discord-dispatch-target.ts

@@ -12,13 +12,14 @@
 import type {
   Routine,
   DispatchTarget,
+  RoutineTestRunArm,
   DeclaredTargetResolution,
   DeclaredTargetSpec,
   SessionMode,
   UnifiedWakeOrigin,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import discord from "./discord.js";
-import { discordOpenDmChannel } from "./discord-post.js";
+import { discordOpenDmChannel, discordPostMessage } from "./discord-post.js";
 import { fetchDiscordInfo } from "./discord-channel-info.js";
 
 /** One stored-target field as a non-empty string, or undefined (never a coerced non-string — the
@@ -162,3 +163,37 @@ export async function resolveDiscordDeclaredTarget(
   }
   return { ok: true, facts: { surfaceKey: `discord/${spec.principalId}/${channelId}`, target: { channelId, channelType: "1" } } };
 }
+
+/** The channel a resolved Discord target posts into, or undefined. */
+function targetChannelId(dest: DispatchTarget): string | undefined {
+  const v = (dest.target as { channelId?: unknown }).channelId;
+  return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+
+/**
+ * THE DISCORD TEST-RUN ARM (OPE-2540, core routines/test-run.ts). A test needs a session of its own,
+ * and Discord has no thread ts to key one on. eve's Discord channel keys a session on
+ * `(channelId, conversationId)` (`discordContinuationToken`), and a proactive fire with no
+ * `conversationId` keys on the channel alone, which is the room's own session. So the arm posts the
+ * test's opening message and fires with that message's id as the `conversationId`: a session of its
+ * own, in the routine's own channel.
+ *
+ * The opening post, the run's answer and the summary all land in the routine's channel. The summary is
+ * a Discord REPLY to the opening post (`message_reference`), so it shows which test it closes.
+ * The fire's bag is unchanged, so the test binds to the routine's own channel and guild.
+ *
+ * Not a Discord thread: a thread is its own channel id, and bindDiscord would then bind the test to a
+ * different surface than the routine's.
+ */
+export const discordTestRunArm: RoutineTestRunArm = {
+  post: async (dest, text, anchor) => {
+    const channelId = targetChannelId(dest);
+    if (channelId === undefined) return undefined;
+    try {
+      return await discordPostMessage(channelId, text, anchor !== undefined ? { replyToMessageId: anchor } : undefined);
+    } catch {
+      return undefined;
+    }
+  },
+  target: (dest, anchor) => ({ channelId: targetChannelId(dest) ?? "", conversationId: anchor }),
+};

package/agent/channels/discord-events.ts

@@ -30,6 +30,7 @@
 import { POST, type Channel, type RouteHandlerArgs } from "eve/channels";
 import { verifyDiscordInteraction } from "./discord-front.js";
 import { appendAudit, deploymentOrg } from "@open-everywhere/core/agent/adapter-api.js";
+import type { AuditDetail } from "@open-everywhere/core/agent/adapter-api.js";
 
 /** The public URL to paste into the app's developer-portal **Webhooks** page (NOT the
  *  Interactions Endpoint URL, which stays {@link PUBLIC_DISCORD_ROUTE}). */
@@ -48,7 +49,7 @@ function elog(msg: string): void {
  *  all of which still get Discord's required 204. */
 export type DiscordEventDecision =
   | { readonly kind: "ack"; readonly reason: string }
-  | { readonly kind: "audit"; readonly action: string; readonly workspace: string; readonly principalId?: string; readonly detail: Record<string, unknown> };
+  | { readonly kind: "audit"; readonly action: string; readonly workspace: string; readonly principalId?: string; readonly detail: AuditDetail };
 
 function str(v: unknown): string | undefined {
   return typeof v === "string" && v.length > 0 ? v : undefined;
@@ -118,7 +119,7 @@ export interface DiscordEventsOptions {
   readonly publicKey?: string;
   readonly now?: () => number;
   /** Audit writer (defaults to the real appendAudit under the deployment org). */
-  readonly audit?: (row: { action: string; workspace: string; principalId?: string; detail: Record<string, unknown> }) => Promise<void>;
+  readonly audit?: (row: { action: string; workspace: string; principalId?: string; detail: AuditDetail }) => Promise<void>;
 }
 
 /** Discord requires an EMPTY 204 body for both the PING and every event, within 3 seconds. */

package/agent/channels/discord-gateway.ts

@@ -48,6 +48,7 @@
 //                          expires by itself, so there is nothing to track or clean up across
 //                          turns); set "false"/"0" off.
 
+import { auditErrorDetail } from "@open-everywhere/core/agent/adapter-api.js";
 import { defineChannel, POST, type RouteHandlerArgs } from "eve/channels";
 import { buildDiscordAuth, type OpenEverywhereDiscordAuth } from "./discord-identity.js";
 import { threadParentChannelId } from "./discord-channel-info.js";
@@ -83,6 +84,7 @@ import {
   type AttachSessionForCancel,
   domainKeyOf,
   resolvePartition,
+  auditSurfaceModeFrom,
   nameDropWakeEnabled,
   seatCatchUp,
   seatCatchUpSinceMs,
@@ -134,6 +136,8 @@ import {
   healPrunedDeploymentStrand,
   engagedFollowUpContract,
   dispatchNativeWakeWithRetry,
+  parseVoiceSync,
+  syncDiscordVoice,
 } from "@open-everywhere/core/agent/adapter-api.js";
 
 // Re-exported so every existing importer (scripts/discord-gateway-test.ts, the completion
@@ -174,7 +178,9 @@ import {
   auditNoReplySentinelObserved,
   getSettings,
   authPrincipalId,
+  coverForWake,
 } from "@open-everywhere/core/agent/adapter-api.js";
+import { discordMemberCanViewChannel } from "../approvals/discord-admin.js";
 import { fetchDiscordBackscrollLines, gradeDiscordContextLines, DISCORD_RAW_FETCH_REACHBACK_HOURS } from "./discord-backscroll.js";
 
 function log(msg: string): void {
@@ -272,6 +278,20 @@ function strOrNum(v: unknown): string | undefined {
   return undefined;
 }
 
+/**
+ * The people a Discord message mentions (OPE-2534, out-of-office cover), by user id, in the order the message names
+ * them: `<@id>` and the legacy nickname form `<@!id>`. A role mention (`<@&id>`), a channel mention (`<#id>`) and the
+ * bot's own mention are no person, so they are left out. Pure.
+ */
+export function discordMentionedUserIds(content: string, botId?: string): string[] {
+  const ids: string[] = [];
+  for (const m of content.matchAll(/<@!?(\d{17,20})>/g)) {
+    const id = m[1]!;
+    if (id !== botId) ids.push(id);
+  }
+  return ids;
+}
+
 /**
  * Defensively parse the relay envelope. Returns null for anything not recognizably a relay
  * MESSAGE_CREATE with the identity facts we MUST have to dispatch + reply — a channel id (for
@@ -1952,7 +1972,7 @@ async function divertDiscordDmToWindow(input: {
     // dominant convention for a wake-shaped audit row (line ~2112/2259/2330 below), not the raw
     // `partition.surface` channel id.
     await auditSupervisorFailure({ org, platform: input.partition.platform, workspace: input.partition.workspace, surface: surfaceKey }, "surface.wake_failed", {
-      message: String(err instanceof Error ? err.message : err).slice(0, 500),
+      message: auditErrorDetail(err).error,
       wakeId,
       addressing: "direct-mention",
     });
@@ -2144,34 +2164,55 @@ export async function divertDiscordWakeToUnifiedWindow(input: {
       // channel's wake stays top-level and the standing seat keeps it.
       ...(isThreadChannelType(msg.channelType) ? { thread: true as const } : {}),
     };
-    const rendered = renderWake(
-      buildDiscordUnifiedWake({
-        guildId: msg.guildId ?? "",
-        channelId: msg.channelId,
-        parentChannelId: str(input.auth.attributes.parent_channel_id),
-        isThread: isThreadChannelType(msg.channelType),
-        addressing: input.addressing,
-        threadEngaged: input.threadEngaged,
-        wakeId,
-        engagementTier: discordEngagementTier(domainKeyOf(input.partition)),
-        tail,
-        // 🔴 THE HYDRATION RIDES THE WAKE, NOT A PRE-RENDERED STRING (OPE-1749). `renderWake` holds
-        // both slots — these lines and `tail` — so core de-duplicates them against each other and
-        // spends the cap below that de-duplication, the same road every other surface takes.
-        contextLines: input.contextLines,
-        contextSource: input.contextSource,
-        botName: msg.botName,
-        catchUpUnavailable,
-        trigger: {
-          id: msg.id || "unknown",
-          author: msg.author.username ?? msg.author.id,
-          authorId: msg.author.id,
-          sentAt: atIso,
-          text: msg.content,
-          trust,
-        },
-      }),
-    );
+    // 🔴 OUT-OF-OFFICE COVER (OPE-2534, the Slack seam of OPE-2513). A message that mentions a person with live cover
+    // gets OE's cover note on THIS wake, and nothing else changes: the binding, the auth bag and the room's memory stay
+    // the room's, so the answer can use only what this room already knows. The reply's label and the recap key on this
+    // wake id (cover/wake.ts). A cover read that fails covers nobody.
+    // No Discord room is public to the recap, because a relay message carries no permission data. Discord's own rule
+    // (approvals/discord-admin.ts `discordMemberCanViewChannel`) confirms, per covered person, that they can read it.
+    const cover = await coverForWake({
+      org,
+      platform: "discord",
+      workspace: input.partition.workspace,
+      surface: input.partition.surface,
+      surfaceKey: input.partition.surfaceKey,
+      channelId: msg.channelId,
+      roomPublic: false,
+      wakeId,
+      mentionedIds: discordMentionedUserIds(msg.content, msg.botId),
+      askerId: msg.author.id,
+      ...(msg.author.username ? { askerName: msg.author.username } : {}),
+      text: msg.content,
+      now: new Date(atIso),
+      ...(msg.guildId ? { confirmInRoom: (id: string) => discordMemberCanViewChannel(msg.guildId!, msg.channelId, id) } : {}),
+    }).catch(() => ({ covered: [] }) as { systemNote?: string });
+    const built = buildDiscordUnifiedWake({
+      guildId: msg.guildId ?? "",
+      channelId: msg.channelId,
+      parentChannelId: str(input.auth.attributes.parent_channel_id),
+      isThread: isThreadChannelType(msg.channelType),
+      addressing: input.addressing,
+      threadEngaged: input.threadEngaged,
+      wakeId,
+      engagementTier: discordEngagementTier(domainKeyOf(input.partition)),
+      tail,
+      // 🔴 THE HYDRATION RIDES THE WAKE, NOT A PRE-RENDERED STRING (OPE-1749). `renderWake` holds
+      // both slots — these lines and `tail` — so core de-duplicates them against each other and
+      // spends the cap below that de-duplication, the same road every other surface takes.
+      contextLines: input.contextLines,
+      contextSource: input.contextSource,
+      botName: msg.botName,
+      catchUpUnavailable,
+      trigger: {
+        id: msg.id || "unknown",
+        author: msg.author.username ?? msg.author.id,
+        authorId: msg.author.id,
+        sentAt: atIso,
+        text: msg.content,
+        trust,
+      },
+    });
+    const rendered = renderWake(cover.systemNote ? { ...built, systemNote: built.systemNote ? `${built.systemNote}\n${cover.systemNote}` : cover.systemNote } : built);
     const domainSurfaceKey = domainKeyOf(input.partition);
     try {
       // THE OWNED-THREAD INGRESS SEAM (§2.6, OPE-1719) — the INBOUND variant, the one Slack's front
@@ -2225,7 +2266,7 @@ export async function divertDiscordWakeToUnifiedWindow(input: {
       await auditSupervisorFailure(
         { org: deploymentOrg(), platform: input.partition.platform, workspace: input.partition.workspace, surface: domainSurfaceKey },
         "surface.wake_failed",
-        { message: String(err instanceof Error ? err.message : err).slice(0, 500), wakeId, addressing: input.addressing },
+        { message: auditErrorDetail(err).error, wakeId, addressing: input.addressing },
       );
       throw err;
     }
@@ -2343,6 +2384,8 @@ export async function dispatchTurn(
     }
   }
   const partition: Partition = resolvePartition(ctxFromAuth(auth));
+  // OPE-1940: the RESOLVED mode of the same surface, spread into every audit row below that names it.
+  const auditMode = auditSurfaceModeFrom(ctxFromAuth(auth));
   const key = engagementKey(msg);
   const isDm = isDmChannel(msg.channelType);
   // A DM or a mention always wakes; only a plain guild message needs the (async) engagement lookup.
@@ -2395,6 +2438,7 @@ export async function dispatchTurn(
       platform: "discord",
       workspace: partition.workspace,
       surface: partition.surfaceKey,
+      ...auditMode,
       principalId: msg.author.id,
       action: "discord.external_policy_suppressed",
       detail: { verdict: externalVerdict, channelId: msg.channelId, ...suppressionRendering(acked) },
@@ -2558,6 +2602,7 @@ export async function dispatchTurn(
       // which is what `partition` already carries — no fabricated guild id.
       workspace: partition.workspace,
       surface: partition.surfaceKey,
+      ...auditMode,
       principalId: msg.author.id,
       action: "discord.dispatched",
       detail: { addressing: "direct-mention", dmWindow: true, channelId: msg.channelId },
@@ -2638,6 +2683,7 @@ export async function dispatchTurn(
         platform: "discord",
         workspace: msg.guildId ?? "unknown",
         surface: partition.surfaceKey,
+        ...auditMode,
         principalId: msg.author.id,
         action: "discord.dispatched",
         detail: { addressing, singleWindow: true, channelId: msg.channelId },
@@ -3007,6 +3053,15 @@ export default withEndsTurnFinalChannel(defineChannel<DiscordGatewayState, Disco
         return new Response("ok", { status: 200 });
       }
 
+      // Discord voice meetings (OPE-2473) — the relay's VOICE_SYNC. Like the heartbeat it mints no session and no
+      // wake. It is answered INLINE, because the answer IS the payload: the voice channels the relay must be in
+      // (core meetings/discord-voice.ts). The relay's report (credentials, members) is stored for the meeting box.
+      const voiceSync = parseVoiceSync(json);
+      if (voiceSync) {
+        const answer = await syncDiscordVoice(deploymentOrg(), voiceSync);
+        return new Response(JSON.stringify(answer), { status: 200, headers: { "content-type": "application/json" } });
+      }
+
       // Inbound reaction — a distinct relay payload shape. Handled before the message parse:
       // ingest async (telemetry always, a durable feedback row on a bot reply), ack immediately.
       // A reaction never starts a turn — but since OPE-418 a ✋ can STOP one, which is why

package/agent/channels/discord-invite.ts

@@ -0,0 +1,46 @@
+// The Discord invite lookup for meeting links (OPE-2473): `GET /invites/{code}` with the bot token, registered with
+// core's meeting invite seam (core meetings/invite.ts) from registerDiscordProvider(). A person who uses Discord's
+// "Invite to voice channel" pastes `https://discord.gg/<code>`; this answers which server and channel the code
+// opens and what kind of channel it is. Core then builds the channel's own link and runs every usual check on it.
+//
+// The answer is Discord's data and core treats it as untrusted: core re-parses the ids through the same strict
+// link parse a pasted link meets. The bot token is a SECRET — header only, never logged. No cache: an invite is
+// looked up once per ask, and an expired code must read as expired.
+
+import type { MeetingInviteLookup, MeetingInviteResolver } from "@open-everywhere/core/agent/adapter-api.js";
+
+/** Discord's channel types for a voice room: GUILD_VOICE (2) and GUILD_STAGE_VOICE (13). */
+const GUILD_VOICE = 2;
+const GUILD_STAGE_VOICE = 13;
+/** A Discord id (a snowflake): 17 to 20 digits. */
+const SNOWFLAKE = /^\d{17,20}$/;
+
+export interface DiscordInviteDeps {
+  readonly fetchFn?: typeof fetch;
+  readonly token?: string;
+}
+
+/** Look one invite code up. NEVER throws: every failure is a `found: false` answer core turns into a plain reason. */
+export async function lookUpDiscordInvite(code: string, deps: DiscordInviteDeps = {}): Promise<MeetingInviteLookup> {
+  const token = deps.token ?? process.env.DISCORD_BOT_TOKEN;
+  if (!token) return { found: false, why: "unreachable" };
+  try {
+    const doFetch = deps.fetchFn ?? fetch;
+    const res = await doFetch(`https://discord.com/api/v10/invites/${encodeURIComponent(code)}`, { headers: { authorization: `Bot ${token}` } });
+    // Discord answers an expired, revoked or mistyped code with 404 (Unknown Invite).
+    if (res.status === 404) return { found: false, why: "unknown" };
+    if (!res.ok) return { found: false, why: "unreachable" };
+    const body = (await res.json()) as { guild?: { id?: unknown } | null; channel?: { id?: unknown; type?: unknown } | null };
+    const guildId = body.guild?.id;
+    const channelId = body.channel?.id;
+    if (typeof guildId !== "string" || !SNOWFLAKE.test(guildId) || typeof channelId !== "string" || !SNOWFLAKE.test(channelId)) return { found: false, why: "no-channel" };
+    const type = body.channel?.type;
+    const channelKind = type === GUILD_VOICE ? "voice" : type === GUILD_STAGE_VOICE ? "stage" : "other";
+    return { found: true, guildId, channelId, channelKind };
+  } catch {
+    return { found: false, why: "unreachable" };
+  }
+}
+
+/** The resolver core's seam holds: the live lookup, with the live token and fetch. */
+export const discordInviteResolver: MeetingInviteResolver = (code) => lookUpDiscordInvite(code);

package/agent/channels/discord-origin-codec.ts

@@ -80,6 +80,17 @@ export const discordWakeOriginCodec: WakeOriginCodec<DiscordOrigin> = {
   // which is the fail-closed direction and byte-identical to the behaviour this replaced.
   isThreadScoped: (origin) => !isDmOrigin(origin) && origin.thread === true,
   containerId: (origin) => origin.channelId,
+  // THE THREAD A REPLY OPENS (OPE-2558, core routines/report-thread.ts). A Discord thread started from a
+  // message takes that message's id as its own channel id, so a thread a person opens off a top-level
+  // post is the guild channel `<post id>` with `thread: true` (the shape the gateway mints for a message
+  // in it). A post that is already in a thread answers undefined, because its own `threadRef` is the key.
+  // A DM has no threads. An origin with `autoThreadName` answers undefined: its arm may move the post
+  // into a thread of its own, so the post id does not name the thread a reply opens. A plain Discord
+  // reply (a message reference in the channel) is not a thread, so only a thread off the post counts.
+  replyThreadUnder: (origin, messageId) => {
+    if (isDmOrigin(origin) || origin.thread === true || origin.autoThreadName !== undefined) return undefined;
+    return { platform: "discord", guildId: origin.guildId, channelId: messageId, thread: true };
+  },
   // THE PLACEMENT AXIS (OPE-1826). Discord is the SECOND surface whose post placement sits OUTSIDE
   // its conversation identity, and until this member existed nothing said so: `threadRef` keys on the
   // channel id alone (a Discord thread IS its own channel id), while the post arm hangs the answer on

package/agent/commands/discord-commands.ts

@@ -33,6 +33,7 @@ import {
   agentDisplayName,
   oeCommandName,
   oeSlash,
+  parseOeCommandTokens,
   runOeCommand,
   type AttachSessionForCancel,
   type BindableContext,
@@ -48,9 +49,16 @@ const RESPONSE_CHANNEL_MESSAGE = 4; // CHANNEL_MESSAGE_WITH_SOURCE — a fresh r
 const EPHEMERAL_FLAG = 64; //         only the invoking user sees the reply
 
 function ephemeral(content: string): DiscordInteractionResponse {
-  return { type: RESPONSE_CHANNEL_MESSAGE, data: { content, flags: EPHEMERAL_FLAG } };
+  return { type: RESPONSE_CHANNEL_MESSAGE, data: { content: content.length > 0 ? content : DISCORD_CARD_ACK, flags: EPHEMERAL_FLAG } };
 }
 
+/**
+ * The private acknowledgement for a command whose card IS the answer (OPE-2490, core's
+ * `CARD_IS_THE_ANSWER`). Discord must answer an interaction with content, or it shows "The application
+ * did not respond". So the answer is the smallest one there is: it says nothing the card says.
+ */
+const DISCORD_CARD_ACK = "👍";
+
 // --- defensive wire-JSON probing (untrusted body, post-signature-check) ---------------------
 // Mirrors approvals/discord-flow.ts's parseDiscordComponentClick posture exactly: this is
 // attacker-shaped JSON reaching a public URL (Discord relays whatever a client sends), so
@@ -130,6 +138,20 @@ export function parseDiscordOeCommandOptions(rawOptions: unknown): OeCommand {
     }
     return { kind: "rate", score };
   }
+  if (name === "cover") {
+    // OPE-2534: the out-of-office cover switch. Core's own grammar parses it (commands/cover.ts), so `/oe cover on until
+    // 2026-10-20` means on Discord what it means on Slack and Teams, and the same date check answers.
+    const sub = optArray(first.options)[0];
+    const subName = sub ? str(sub.name) : undefined;
+    const until = str(findOpt(optArray(sub?.options), "until")?.value);
+    return parseOeCommandTokens(["cover", ...(subName ? [subName] : []), ...(subName === "on" && until ? ["until", until] : [])]);
+  }
+  if (name === "suggest") {
+    // OPE-2550: the room's stop for routine suggestions. Core's own grammar parses it (commands/suggest.ts).
+    const sub = optArray(first.options)[0];
+    const subName = sub ? str(sub.name) : undefined;
+    return parseOeCommandTokens(["suggest", ...(subName ? [subName] : [])]);
+  }
   if (name === "budget") {
     const sub = optArray(first.options)[0];
     const subName = sub ? str(sub.name) : undefined;
@@ -226,6 +248,7 @@ export async function handleDiscordOeCommandInteraction(
 // note on why this file doesn't import eve's channel module for two integers).
 const SUB_COMMAND = 1;
 const SUB_COMMAND_GROUP = 2;
+const OPTION_STRING = 3;
 const OPTION_INTEGER = 4;
 const OPTION_NUMBER = 10;
 const CHAT_INPUT = 1;
@@ -299,6 +322,35 @@ export function buildOeDiscordCommandDefinition(): Record<string, unknown> {
           },
         ],
       },
+      // OPE-2534: out-of-office cover. A SUB_COMMAND_GROUP, because Discord needs a concrete subcommand: `status` is the
+      // bare `/oe cover` of Slack and Teams, and `on` takes the optional end date core's grammar reads.
+      {
+        name: "cover",
+        description: "While you are away, I answer questions people ask you, marked as cover.",
+        type: SUB_COMMAND_GROUP,
+        options: [
+          {
+            name: "on",
+            description: "Turn cover on (from your DM with me).",
+            type: SUB_COMMAND,
+            options: [{ name: "until", description: "The first day you are back, as YYYY-MM-DD.", type: OPTION_STRING, required: false }],
+          },
+          { name: "off", description: "Turn cover off. Your recap follows in your DM.", type: SUB_COMMAND },
+          { name: "status", description: "Show whether cover is on.", type: SUB_COMMAND },
+        ],
+      },
+      // OPE-2550: the room's stop for the routine suggestions room discovery posts. A SUB_COMMAND_GROUP for the same
+      // reason as `cover`: `status` is the bare `/oe suggest` of Slack and Teams.
+      {
+        name: "suggest",
+        description: "Stop or allow my routine suggestions in this channel or thread.",
+        type: SUB_COMMAND_GROUP,
+        options: [
+          { name: "off", description: "Stop my routine suggestions in this channel or thread.", type: SUB_COMMAND },
+          { name: "on", description: "Allow them again (members only).", type: SUB_COMMAND },
+          { name: "status", description: "Show whether they are on in this channel or thread.", type: SUB_COMMAND },
+        ],
+      },
       { name: "help", description: `List the ${oeSlash()} commands.`, type: SUB_COMMAND },
     ],
   };