@open-everywhere/provider-discord 0.8.1 → 0.9.0

package/agent/approvals/discord-admin.ts

@@ -24,6 +24,7 @@
 // a SECRET — header only, never logged.
 
 import { isGuildAdministrator } from "./discord-card.js";
+import { discordBotToken } from "../channels/discord-credentials.js";
 
 function log(msg: string): void {
   console.log(`[open-everywhere:discord-admin] ${msg}`);
@@ -71,7 +72,7 @@ const memberVerdictCache = new Map<string, { verdict: boolean; at: number }>();
  * (the user's role ids). NEVER throws; every failure is `false` (see the file header).
  */
 export async function isGuildAdminViaRest(guildId: string, userId: string, deps: DiscordAdminDeps = {}): Promise<boolean> {
-  const token = deps.token ?? process.env.DISCORD_BOT_TOKEN;
+  const token = deps.token ?? (await discordBotToken());
   if (!token || !guildId || !userId) return false;
   const cacheKey = `${guildId}:${userId}`;
   const now = deps.nowMs ?? Date.now();
@@ -130,7 +131,7 @@ export async function isGuildAdminViaRest(guildId: string, userId: string, deps:
  * error, a malformed body — all "not a member", never a guess. NEVER throws.
  */
 export async function isGuildMemberViaRest(guildId: string, userId: string, deps: DiscordAdminDeps = {}): Promise<boolean> {
-  const token = deps.token ?? process.env.DISCORD_BOT_TOKEN;
+  const token = deps.token ?? (await discordBotToken());
   if (!token || !guildId || !userId) return false;
   const cacheKey = `${guildId}:${userId}`;
   const now = deps.nowMs ?? Date.now();
@@ -189,7 +190,7 @@ const roleEvidenceCache = new Map<string, { roles: readonly string[]; at: number
  * NEVER throws.
  */
 export async function discordAuthorRoles(guildId: string, userId: string, deps: DiscordAdminDeps = {}): Promise<readonly string[] | undefined> {
-  const token = deps.token ?? process.env.DISCORD_BOT_TOKEN;
+  const token = deps.token ?? (await discordBotToken());
   if (!token || !guildId || !userId) return undefined; // cannot check — never a guess
   const cacheKey = `${guildId}:${userId}`;
   const now = deps.nowMs ?? Date.now();
@@ -306,7 +307,7 @@ function overwritesOf(channel: Record<string, unknown>): DiscordOverwrite[] {
  * only about a person with live cover.
  */
 export async function discordMemberCanViewChannel(guildId: string, channelId: string, userId: string, deps: DiscordAdminDeps = {}): Promise<boolean> {
-  const token = deps.token ?? process.env.DISCORD_BOT_TOKEN;
+  const token = deps.token ?? (await discordBotToken());
   if (!token || !guildId || !channelId || !userId) return false;
   const doFetch = deps.fetchFn ?? fetch;
   const headers = { authorization: `Bot ${token}` };

package/agent/approvals/discord-flow.ts

@@ -79,6 +79,7 @@ import {
   type DiscordCardMessage,
 } from "./discord-card.js";
 import { guildIdFromScopeKey, isGuildAdminViaRest } from "./discord-admin.js";
+import { discordBotToken } from "../channels/discord-credentials.js";
 
 function log(msg: string): void {
   console.log(`[open-everywhere:discord-approvals] ${msg}`);
@@ -160,7 +161,7 @@ async function postDiscordCardMessage(
   what: string,
   render: () => DiscordCardMessage,
 ): Promise<string | undefined> {
-  const token = deps.token ?? process.env.DISCORD_BOT_TOKEN;
+  const token = deps.token ?? (await discordBotToken());
   if (!token) {
     log(`DISCORD_BOT_TOKEN is not set — cannot post the ${what} to channel ${row.channelId}`);
     return undefined;

package/agent/channels/discord-backscroll.ts

@@ -79,6 +79,7 @@ import {
   SUPERVISOR_BACKSCROLL_REACHBACK_HOURS,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { discordAuthorRoles } from "../approvals/discord-admin.js";
+import { discordBotToken } from "./discord-credentials.js";
 
 /** The triggering wake, narrowed to what the backscroll needs. */
 export interface DiscordBackscrollInput {
@@ -109,7 +110,7 @@ export interface DiscordBackscrollDeps {
 // any throw → undefined. Kept local rather than imported from discord-gateway.ts so the module
 // graph stays a DAG (discord-gateway → here; importing back up would cycle).
 const liveRequest: DiscordRequester = async (channelId, query) => {
-  const token = process.env.DISCORD_BOT_TOKEN;
+  const token = await discordBotToken();
   if (!token || !channelId) return undefined;
   try {
     const qs = new URLSearchParams(query).toString();

package/agent/channels/discord-bot-name.ts

@@ -34,6 +34,7 @@
 // deployment missing the token does not re-probe Discord on every turn.
 
 import type { BotDisplayNameArm } from "@open-everywhere/core/agent/adapter-api.js";
+import { discordBotToken } from "./discord-credentials.js";
 
 const DISCORD_API_BASE = "https://discord.com/api/v10";
 
@@ -43,7 +44,7 @@ const DISCORD_API_BASE = "https://discord.com/api/v10";
 export type DiscordSelfRequester = () => Promise<unknown>;
 
 const liveDiscordSelfRequest: DiscordSelfRequester = async () => {
-  const token = process.env.DISCORD_BOT_TOKEN;
+  const token = await discordBotToken();
   if (!token) throw new Error("bot-display-name: DISCORD_BOT_TOKEN is not set.");
   const res = await fetch(`${DISCORD_API_BASE}/users/@me`, {
     headers: { authorization: `Bot ${token}` },

package/agent/channels/discord-channel-info.ts

@@ -14,6 +14,8 @@
 // SECRET — header only, never logged. Definitive verdicts are cached in-process (see the
 // cache note); a transient failure is asked again.
 
+import { discordBotToken } from "./discord-credentials.js";
+
 /** The channel facts both consumers read. `parentId` is set ONLY for threads. */
 export interface DiscordChannelInfo {
   readonly name?: string;
@@ -62,7 +64,7 @@ export function fetchDiscordInfo(
     // 404, no token — is kept.
     let transient = false;
     p = (async () => {
-      const token = deps.token ?? process.env.DISCORD_BOT_TOKEN;
+      const token = deps.token ?? (await discordBotToken());
       if (!token) return undefined;
       try {
         const doFetch = deps.fetchFn ?? fetch;

package/agent/channels/discord-credentials.ts

@@ -0,0 +1,41 @@
+// WHERE THE DISCORD BUNDLE'S TWO SECRETS COME FROM (OPE-2650) — the bot token every Discord REST call
+// authenticates with, and the shared secret the gateway relay signs its deliveries with.
+//
+// Both are OPERATOR SECRETS: `oe secret set DISCORD_BOT_TOKEN`. Core's `operatorSecretOrUnset` reads
+// them: the db credential store first, the env var of the same name as its warned on-ramp, each store
+// lookup remembered for thirty seconds. So a deployment that still holds the env vars works unchanged,
+// and one that stored them works with no env var at all.
+//
+// 🔴 A FAULT READS AS "NO TOKEN", AND IT IS LOGGED. Most Discord call sites promise "NEVER throws"
+// (an admin check answers false, a post answers null). A stored row this process cannot decrypt (no
+// armed `OE_CREDENTIAL_ENCRYPTION_KEY`) is therefore reported once per process and answered as
+// `undefined`. Every caller already fails closed on `undefined`: no token means no call.
+
+import { operatorSecretOrUnset } from "@open-everywhere/core/agent/adapter-api.js";
+
+/** The operator secret holding the bot token. */
+export const DISCORD_BOT_TOKEN_NAME = "DISCORD_BOT_TOKEN";
+/** The operator secret holding the gateway relay's shared secret (the app side; the relay process
+ *  keeps its own env). */
+const OE_RELAY_SECRET_NAME = "OE_RELAY_SECRET";
+
+/** The bot token, or `undefined` when this deployment holds none. */
+export async function discordBotToken(): Promise<string | undefined> {
+  return await operatorSecretOrUnset(DISCORD_BOT_TOKEN_NAME);
+}
+
+/**
+ * eve's outbound bot-token provider (`discordChannel({ credentials: { botToken } })`). Throws eve's OWN
+ * message when none resolves, byte for byte. Without it eve reads the DISCORD_BOT_TOKEN env var
+ * itself and never sees a stored value.
+ */
+export async function discordBotTokenForEve(): Promise<string> {
+  const token = await discordBotToken();
+  if (!token) throw new Error("DISCORD_BOT_TOKEN is required.");
+  return token;
+}
+
+/** The gateway relay's shared secret, or `undefined` when this deployment holds none. */
+export async function discordRelaySecret(): Promise<string | undefined> {
+  return await operatorSecretOrUnset(OE_RELAY_SECRET_NAME);
+}

package/agent/channels/discord-directory.ts

@@ -49,6 +49,7 @@
 // can never answer.
 
 import { admittedTenantsFromConfig, type DirectoryCandidate } from "@open-everywhere/core/agent/adapter-api.js";
+import { discordBotToken } from "./discord-credentials.js";
 
 const API = "https://discord.com/api/v10";
 
@@ -88,7 +89,7 @@ interface DiscordGuildMember {
  * The guild set comes from this deployment's own config instead — see the header.
  */
 export async function fetchGuildDirectory(query: string): Promise<readonly DirectoryCandidate[]> {
-  const token = process.env.DISCORD_BOT_TOKEN;
+  const token = await discordBotToken();
   if (!token) return [];
   // The same normalization core's matcher applies (`@tommy` and `tommy` are one query to a person),
   // done here too because Discord's search would take the `@` literally and match nothing.

package/agent/channels/discord-events.ts

@@ -28,7 +28,7 @@
 // verification path — one key, one verifier.
 
 import { POST, type Channel, type RouteHandlerArgs } from "eve/channels";
-import { verifyDiscordInteraction } from "./discord-front.js";
+import { discordPublicKey, verifyDiscordInteraction } from "./discord-front.js";
 import { appendAudit, deploymentOrg } from "@open-everywhere/core/agent/adapter-api.js";
 import type { AuditDetail } from "@open-everywhere/core/agent/adapter-api.js";
 
@@ -115,7 +115,7 @@ export function classifyDiscordEvent(rawBody: string): DiscordEventDecision {
 
 /** Injectable seams so the route is testable without live crypto env or the real store. */
 export interface DiscordEventsOptions {
-  /** The app public key; defaults to DISCORD_PUBLIC_KEY (the same env the interactions path reads). */
+  /** The app public key; defaults to the `discord.publicKey` setting (the same key the interactions path reads). */
   readonly publicKey?: string;
   readonly now?: () => number;
   /** Audit writer (defaults to the real appendAudit under the deployment org). */
@@ -136,7 +136,7 @@ const ACK = () => new Response(null, { status: 204 });
  */
 export function buildDiscordEventsHandler(opts: DiscordEventsOptions = {}): (req: Request, args: RouteHandlerArgs) => Promise<Response> {
   const now = opts.now ?? (() => Date.now());
-  const publicKey = () => opts.publicKey ?? process.env.DISCORD_PUBLIC_KEY;
+  const publicKey = () => opts.publicKey ?? discordPublicKey();
   const audit =
     opts.audit ??
     (async (row) => {

package/agent/channels/discord-front.ts

@@ -33,7 +33,7 @@ import { POST, type Channel, type HttpRouteDefinition, type RouteHandlerArgs } f
 import { verifyDiscordSignature } from "eve/channels/discord";
 import { OE_DISCORD_APPROVAL_PREFIX } from "../approvals/discord-card.js";
 import { handleDiscordApprovalInteraction, type DiscordInteractionResponse } from "../approvals/discord-flow.js";
-import { LINK_CONSENT_CLICK_PREFIX, OE_GRANT_ACTION_PREFIX, friendlyDiscordBody } from "@open-everywhere/core/agent/adapter-api.js";
+import { LINK_CONSENT_CLICK_PREFIX, OE_GRANT_ACTION_PREFIX, friendlyDiscordBody, getSettings } from "@open-everywhere/core/agent/adapter-api.js";
 import { handleDiscordLinkConsentInteraction } from "../identity/discord-link-consent.js";
 import { handleDiscordGrantCardInteraction } from "../access/discord-grant-click.js";
 import { oeCommandName, type AttachSessionForCancel } from "@open-everywhere/core/agent/adapter-api.js";
@@ -175,9 +175,43 @@ export function classifyDiscordInteraction(rawBody: string): DiscordFrontDecisio
   return { kind: "forward", reason: "component click — eve's HITL owns it" };
 }
 
+// WHICH DISCORD APP THIS DEPLOYMENT IS (OPE-2650). The application id and its interaction public key
+// are the `discord.applicationId` and `discord.publicKey` settings, no longer env. Both are public. Each
+// is read per call, so a settings override reaches the next delivery. `undefined` means unset.
+
+/** The `discord.publicKey` setting, or `undefined` when it is unset. */
+export function discordPublicKey(): string | undefined {
+  return getSettings().discord.publicKey || undefined;
+}
+
+/** The `discord.applicationId` setting, or `undefined` when it is unset. */
+export function discordApplicationId(): string | undefined {
+  return getSettings().discord.applicationId || undefined;
+}
+
+/**
+ * The two settings as eve's lazy credential fields, for `discordChannel({ credentials })`.
+ *
+ * 🔴 A FIELD LEFT UNDEFINED FALLS BACK TO ENV INSIDE EVE (`DISCORD_APPLICATION_ID`,
+ * `DISCORD_PUBLIC_KEY`), so the channel must always pass both. Each resolver throws when its setting
+ * is unset, which is eve's own "is required" refusal. An unset `discord.publicKey` refuses every
+ * delivery. eve resolves `discord.applicationId` only when an interaction carries no application id
+ * of its own, so an unset id skips the command sync and does not refuse a delivery.
+ */
+export function discordAppCredentials(): { readonly applicationId: () => string; readonly publicKey: () => string } {
+  const required = (value: string | undefined, path: string): string => {
+    if (value === undefined) throw new Error(`${path} is required: set it in agent/settings/settings.ts.`);
+    return value;
+  };
+  return {
+    applicationId: () => required(discordApplicationId(), "discord.applicationId"),
+    publicKey: () => required(discordPublicKey(), "discord.publicKey"),
+  };
+}
+
 /** Injectable seams so the front route is testable without live crypto env / the real store. */
 export interface DiscordFrontOptions {
-  /** The app public key; defaults to DISCORD_PUBLIC_KEY (same env eve's channel reads). */
+  /** The app public key; defaults to the `discord.publicKey` setting (the key eve's channel verifies with). */
   readonly publicKey?: string;
   readonly now?: () => number;
   /** Approval-click handler (defaults to the real approvals/discord-flow.ts). Injectable so
@@ -222,7 +256,7 @@ async function interactionJson(body: DiscordInteractionResponse): Promise<Respon
  */
 export function buildDiscordFrontHandler(innerHandler: RouteHandler, opts: DiscordFrontOptions = {}): RouteHandler {
   const now = opts.now ?? (() => Date.now());
-  const publicKey = () => opts.publicKey ?? process.env.DISCORD_PUBLIC_KEY;
+  const publicKey = () => opts.publicKey ?? discordPublicKey();
   const handleClick = opts.handleApprovalInteraction ?? handleDiscordApprovalInteraction;
   const handleLinkConsent = opts.handleLinkConsentInteraction ?? handleDiscordLinkConsentInteraction;
   const handleGrantCard = opts.handleGrantCardInteraction ?? handleDiscordGrantCardInteraction;

package/agent/channels/discord-gateway.ts

@@ -182,6 +182,7 @@ import {
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { discordMemberCanViewChannel } from "../approvals/discord-admin.js";
 import { fetchDiscordBackscrollLines, gradeDiscordContextLines, DISCORD_RAW_FETCH_REACHBACK_HOURS } from "./discord-backscroll.js";
+import { discordBotToken, discordRelaySecret } from "./discord-credentials.js";
 
 function log(msg: string): void {
   console.log(`[open-everywhere:discord-gateway] ${msg}`);
@@ -543,14 +544,14 @@ export interface RelayRejection {
 
 /**
  * Gate one relay delivery. Returns null when it may proceed, else the {@link RelayRejection}.
- * `secret` defaults to the live env read but is injectable so the gate is unit-tested without
- * touching process.env. Fail-closed: unset/empty secret → 401; missing/malformed/mismatched
+ * `secret` is the caller's resolved `OE_RELAY_SECRET` operator secret ({@link discordRelaySecret}),
+ * passed in so the gate stays pure and unit-tested with no store. Fail-closed: unset/empty secret → 401; missing/malformed/mismatched
  * signature → 401 (verifyWebhookSignature returns false for a null or non-`sha256=` header).
  */
 export function relayGate(
   signatureHeader: string | null,
   rawBody: string,
-  secret: string | undefined = process.env.OE_RELAY_SECRET,
+  secret: string | undefined,
 ): RelayRejection | null {
   if (!secret) {
     return { status: 401, reason: "OE_RELAY_SECRET is not set — rejecting unverified relay delivery" };
@@ -868,7 +869,7 @@ const AFFORDANCE_RETRY: RetryPolicy = { maxAttempts: 2, capMs: 2_000, totalBudge
  * lives in one place (the bot token is a SECRET — never logged).
  */
 export async function discordCreateMessage(channelId: string, content: string, deps: DiscordFetchDeps = {}): Promise<string | null> {
-  const token = process.env.DISCORD_BOT_TOKEN;
+  const token = await discordBotToken();
   if (!token) {
     log(`DISCORD_BOT_TOKEN is not set — cannot post to channel ${channelId}`);
     return null;
@@ -923,7 +924,7 @@ export async function discordCreateMessage(channelId: string, content: string, d
  * must stay silent rather than fall back to the channel.
  */
 export async function openDiscordDm(userId: string, deps: DiscordFetchDeps = {}): Promise<string | null> {
-  const token = process.env.DISCORD_BOT_TOKEN;
+  const token = await discordBotToken();
   if (!token) return null;
   try {
     const res = await discordFetch(
@@ -1101,7 +1102,7 @@ export function typingGateFeed(
 }
 
 export async function triggerDiscordTyping(channelId: string, deps: DiscordFetchDeps = {}): Promise<void> {
-  const token = process.env.DISCORD_BOT_TOKEN;
+  const token = await discordBotToken();
   if (!token || !channelId) return;
   try {
     const res = await discordFetch(
@@ -1144,7 +1145,7 @@ export async function setDiscordReaction(
   action: "PUT" | "DELETE",
   deps: DiscordFetchDeps = {},
 ): Promise<void> {
-  const token = process.env.DISCORD_BOT_TOKEN;
+  const token = await discordBotToken();
   if (!token) return; // no token → silently skip the affordance (degrades to no reaction)
   if (!channelId || !messageId) return;
   const encoded = encodeURIComponent(emoji);
@@ -1253,7 +1254,7 @@ export async function createDiscordThread(
   name: string,
   deps: DiscordFetchDeps = {},
 ): Promise<string | null> {
-  const token = process.env.DISCORD_BOT_TOKEN;
+  const token = await discordBotToken();
   if (!token) {
     log(`DISCORD_BOT_TOKEN is not set — cannot create thread on channel ${channelId}`);
     return null;
@@ -3030,7 +3031,7 @@ export default withEndsTurnFinalChannel(defineChannel<DiscordGatewayState, Disco
 
       // 1) Verify the relay HMAC over the RAW body, fail-closed. Reject BEFORE parsing so we
       //    never act on (or even JSON.parse) an unauthenticated payload.
-      const rejection = relayGate(req.headers.get("x-oe-relay-signature"), rawBody);
+      const rejection = relayGate(req.headers.get("x-oe-relay-signature"), rawBody, await discordRelaySecret());
       if (rejection) {
         log(`rejected (${rejection.status}): ${rejection.reason}`);
         return new Response(rejection.reason, { status: rejection.status });

package/agent/channels/discord-invite.ts

@@ -8,6 +8,7 @@
 // looked up once per ask, and an expired code must read as expired.
 
 import type { MeetingInviteLookup, MeetingInviteResolver } from "@open-everywhere/core/agent/adapter-api.js";
+import { discordBotToken } from "./discord-credentials.js";
 
 /** Discord's channel types for a voice room: GUILD_VOICE (2) and GUILD_STAGE_VOICE (13). */
 const GUILD_VOICE = 2;
@@ -22,7 +23,7 @@ export interface DiscordInviteDeps {
 
 /** Look one invite code up. NEVER throws: every failure is a `found: false` answer core turns into a plain reason. */
 export async function lookUpDiscordInvite(code: string, deps: DiscordInviteDeps = {}): Promise<MeetingInviteLookup> {
-  const token = deps.token ?? process.env.DISCORD_BOT_TOKEN;
+  const token = deps.token ?? (await discordBotToken());
   if (!token) return { found: false, why: "unreachable" };
   try {
     const doFetch = deps.fetchFn ?? fetch;

package/agent/channels/discord-message-ops.ts

@@ -14,12 +14,13 @@
 
 import type { SurfaceMessageOps, OutboundFile } from "@open-everywhere/core/agent/adapter-api.js";
 import { discordPostMessage } from "./discord-post.js";
+import { discordBotToken } from "./discord-credentials.js";
 import { discordFetch } from "./discord-rest.js";
 
 const API = "https://discord.com/api/v10";
 
-function botToken(): string {
-  const token = process.env.DISCORD_BOT_TOKEN;
+async function botToken(): Promise<string> {
+  const token = await discordBotToken();
   if (!token) throw new Error("DISCORD_BOT_TOKEN is not set — the bot token is required to post to Discord.");
   return token;
 }
@@ -32,7 +33,7 @@ export const discordMessageOps: SurfaceMessageOps = {
   async editMessage(channelId, messageId, text) {
     const res = await discordFetch("PATCH /channels/{id}/messages/{id}", `${API}/channels/${channelId}/messages/${messageId}`, {
       method: "PATCH",
-      headers: { authorization: `Bot ${botToken()}`, "content-type": "application/json" },
+      headers: { authorization: `Bot ${await botToken()}`, "content-type": "application/json" },
       // 🔴 `components: []` STRIPS THE BUTTONS, AND IT IS LOAD-BEARING (OPE-1260). Discord leaves a
       // message's components untouched when a PATCH omits them, so without this line a card rewritten
       // to a closed state kept four live buttons over copy saying the request was already over.
@@ -91,7 +92,7 @@ export const discordMessageOps: SurfaceMessageOps = {
       const res = await discordFetch(
         on ? "PUT /channels/{id}/messages/{id}/reactions/{emoji}/@me" : "DELETE /channels/{id}/messages/{id}/reactions/{emoji}/@me",
         `${API}/channels/${channelId}/messages/${messageId}/reactions/${encoded}/@me`,
-        { method: on ? "PUT" : "DELETE", headers: { authorization: `Bot ${botToken()}` } },
+        { method: on ? "PUT" : "DELETE", headers: { authorization: `Bot ${await botToken()}` } },
       );
       if (!res.ok && !(!on && res.status === 404)) {
         console.warn(`[open-everywhere:discord] reaction ${on ? "add" : "remove"} failed (${res.status}) for message ${messageId}`);
@@ -112,7 +113,7 @@ export const discordMessageOps: SurfaceMessageOps = {
     // No explicit content-type header — fetch derives the multipart boundary from the FormData.
     const res = await discordFetch("POST /channels/{id}/messages", `${API}/channels/${channelId}/messages`, {
       method: "POST",
-      headers: { authorization: `Bot ${botToken()}` },
+      headers: { authorization: `Bot ${await botToken()}` },
       body: form,
     });
     if (!res.ok) throw new Error(`Discord create-message (files) failed (HTTP ${res.status}) for channel ${channelId}`);

package/agent/channels/discord-post.ts

@@ -12,6 +12,7 @@
 // post-back, a tool must report whether the post actually landed).
 
 import { markNotApplied } from "@open-everywhere/core/agent/adapter-api.js";
+import { discordBotToken } from "./discord-credentials.js";
 import { discordFetch } from "./discord-rest.js";
 
 const API = "https://discord.com/api/v10";
@@ -24,8 +25,8 @@ function botHeaders(token: string): Record<string, string> {
   return { authorization: `Bot ${token}`, "content-type": "application/json" };
 }
 
-function botToken(): string {
-  const token = process.env.DISCORD_BOT_TOKEN;
+async function botToken(): Promise<string> {
+  const token = await discordBotToken();
   if (!token) {
     throw new Error("DISCORD_BOT_TOKEN is not set — the reply tool needs the bot token to post to Discord.");
   }
@@ -174,7 +175,7 @@ export async function discordPostMessage(channelId: string, content: string, opt
 export async function discordOpenDmChannel(userId: string): Promise<string> {
   const res = await discordFetch("POST /users/@me/channels", `${API}/users/@me/channels`, {
     method: "POST",
-    headers: botHeaders(botToken()),
+    headers: botHeaders(await botToken()),
     body: JSON.stringify({ recipient_id: userId }),
   });
   if (!res.ok) {
@@ -229,7 +230,7 @@ export async function discordPostMessageWithButtons(
   }
   const res = await discordFetch("POST /channels/{id}/messages", `${API}/channels/${channelId}/messages`, {
     method: "POST",
-    headers: botHeaders(botToken()),
+    headers: botHeaders(await botToken()),
     body: JSON.stringify({
       content,
       components: [
@@ -262,7 +263,7 @@ export async function discordPostMessageWithButtons(
 async function discordPostOne(channelId: string, content: string, replyToMessageId?: string): Promise<string> {
   const res = await discordFetch("POST /channels/{id}/messages", `${API}/channels/${channelId}/messages`, {
     method: "POST",
-    headers: botHeaders(botToken()),
+    headers: botHeaders(await botToken()),
     body: JSON.stringify({
       content,
       ...(replyToMessageId ? { message_reference: { message_id: replyToMessageId, fail_if_not_exists: false } } : {}),
@@ -310,7 +311,7 @@ export async function discordEditMessage(channelId: string, messageId: string, c
   }
   const res = await discordFetch("PATCH /channels/{id}/messages/{id}", `${API}/channels/${channelId}/messages/${messageId}`, {
     method: "PATCH",
-    headers: botHeaders(botToken()),
+    headers: botHeaders(await botToken()),
     body: JSON.stringify({ content }),
   });
   if (!res.ok) {
@@ -390,7 +391,7 @@ export async function discordAddReaction(channelId: string, messageId: string, e
   const res = await discordFetch(
     "PUT /channels/{id}/messages/{id}/reactions/{emoji}/@me",
     `${API}/channels/${channelId}/messages/${messageId}/reactions/${encodeURIComponent(unicode)}/@me`,
-    { method: "PUT", headers: botHeaders(botToken()) },
+    { method: "PUT", headers: botHeaders(await botToken()) },
   );
   if (!res.ok) {
     throw Object.assign(new Error(`react couldn't post to Discord — ${res.status} on channel ${channelId}`), { status: res.status });
@@ -412,7 +413,7 @@ export async function discordAddReaction(channelId: string, messageId: string, e
 export async function discordExistingThreadForMessage(channelId: string, messageId: string): Promise<string | null> {
   try {
     const msgRes = await discordFetch("GET /channels/{id}/messages/{id}", `${API}/channels/${channelId}/messages/${messageId}`, {
-      headers: botHeaders(botToken()),
+      headers: botHeaders(await botToken()),
     });
     if (!msgRes.ok) return null;
     const msg = (await msgRes.json()) as { thread?: { id?: unknown } };
@@ -438,7 +439,7 @@ export async function discordThreadForMessage(channelId: string, messageId: stri
       `${API}/channels/${channelId}/messages/${messageId}/threads`,
       {
         method: "POST",
-        headers: botHeaders(botToken()),
+        headers: botHeaders(await botToken()),
         body: JSON.stringify({ name: name.slice(0, 100) || "thread", auto_archive_duration: 1440 }),
       },
     );

package/agent/channels/discord-read.ts

@@ -20,6 +20,7 @@ import {
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { linesFromDiscordMessages, type DiscordRoleProbe } from "./discord-backscroll.js";
 import { discordAuthorRoles } from "../approvals/discord-admin.js";
+import { discordBotToken } from "./discord-credentials.js";
 
 const DISCORD_CHANNEL_DEFAULT_LIMIT = 50;
 const DISCORD_THREAD_DEFAULT_LIMIT = 100;
@@ -29,7 +30,7 @@ const DISCORD_MAX_PAGE = 100;
 export type DiscordReadRequester = (channelId: string, limit: number) => Promise<unknown>;
 
 const liveDiscordRead: DiscordReadRequester = async (channelId, limit) => {
-  const token = process.env.DISCORD_BOT_TOKEN;
+  const token = await discordBotToken();
   if (!token) throw new Error("read: DISCORD_BOT_TOKEN is not set — the Discord read tools need the bot token.");
   const qs = new URLSearchParams({ limit: String(Math.min(limit, DISCORD_MAX_PAGE)) }).toString();
   const res = await fetch(`https://discord.com/api/v10/channels/${channelId}/messages?${qs}`, {

package/agent/channels/discord.ts

@@ -17,9 +17,10 @@
 // derives a thinner, guild-scoped auth). Kept MINIMAL for launch — identity binding +
 // dispatch only; no status-UX / onboarding extras (cf. slack.ts).
 //
-// Credentials: omitted here, so eve falls back to DISCORD_PUBLIC_KEY /
-// DISCORD_APPLICATION_ID / DISCORD_BOT_TOKEN (see .env.example). Swap the credential
-// broker later without touching identity. Capturing the channel type / guild presence is a
+// Credentials: the application id and the public key come from the `discord.applicationId` and
+// `discord.publicKey` settings, and the bot token from `discordBotTokenForEve` (the DISCORD_BOT_TOKEN
+// operator secret, ./discord-credentials.ts) — all OPE-2650, all passed below so eve never falls back
+// to its own env names for them. Capturing the channel type / guild presence is a
 // RAW-fact job; the security-critical interpretation (fail-closed to private) lives in
 // the binding (discordVisibility).
 //
@@ -51,8 +52,9 @@ import {
   type ChatAuditPartition,
 } from "@open-everywhere/core/agent/adapter-api.js";
 import { withEndsTurnFinalChannel } from "@open-everywhere/core/agent/adapter-api.js";
-import { frontDiscordChannel, INTERNAL_DISCORD_ROUTE } from "./discord-front.js";
+import { discordAppCredentials, frontDiscordChannel, INTERNAL_DISCORD_ROUTE } from "./discord-front.js";
 import { withDiscordEventsRoute } from "./discord-events.js";
+import { discordBotTokenForEve } from "./discord-credentials.js";
 
 // The audit partition for a terminal event, rebuilt from the LIVE session state the same
 // way slack.ts rebuilds its own (the completion handler has no auth context): guild →
@@ -109,6 +111,11 @@ function authFromInteraction(interaction: DiscordCommandInteraction): OpenEveryw
 const discordInteractionChannel = discordChannel({
   // Internal mount — the public URL is the approval-click front (frontDiscordChannel below).
   route: INTERNAL_DISCORD_ROUTE,
+  // 🔴 EVE MUST BE HANDED EVERY FIELD (OPE-2650). With a field missing, eve's `mergeCredentials` falls
+  // back to its own env read (DISCORD_APPLICATION_ID, DISCORD_PUBLIC_KEY, DISCORD_BOT_TOKEN) and never
+  // sees a setting or a value `oe secret set` stored. Functions, not values: a value read at module
+  // load would pin whatever was true at boot.
+  credentials: { ...discordAppCredentials(), botToken: discordBotTokenForEve },
   // 🔴 QUEUE, NEVER STEER (OPE-412) — eve's default `steer` cancels the turn in flight when a
   // message arrives. Same reasoning as the Slack channel; see slack.ts for the full note.
   turnPolicy: "queue",

package/agent/commands/discord-command-sync.ts

@@ -35,6 +35,8 @@
 import type { RetryPolicy, SurfaceCommandOutcome, SurfaceCommandScope } from "@open-everywhere/core/agent/adapter-api.js";
 import { discordFetch, type DiscordFetchLike } from "../channels/discord-rest.js";
 import { buildOeDiscordCommandDefinition } from "./discord-commands.js";
+import { discordApplicationId } from "../channels/discord-front.js";
+import { discordBotToken } from "../channels/discord-credentials.js";
 
 /**
  * 🔴 NO 429 BACKOFF AT ALL — the reconcile sits on the FIRST REQUEST's latency path.
@@ -251,22 +253,23 @@ async function reconcileOneGuild(
 /**
  * THE RECONCILER the discord bundle registers with core's command plane.
  *
- * Runs at boot, so it is gated on BOTH deployment credentials being present: `DISCORD_APPLICATION_ID`
- * says which app this is and `DISCORD_BOT_TOKEN` authenticates the call. Either missing ⇒ `skipped`,
- * which is the correct reading of a deployment that carries the bundle but no Discord app — and it is
- * also what keeps every offline test tier network-free, since no test publishes an application id.
+ * Runs at boot, so it is gated on BOTH halves being present: the `discord.applicationId` setting says
+ * which app this is and `DISCORD_BOT_TOKEN` authenticates the call. Either missing ⇒ `skipped`, which
+ * is the correct reading of a deployment that carries the bundle but no Discord app — and it is also
+ * what keeps every offline test tier network-free, since no test sets the bot token.
  *
- * 🔴 THESE TWO STAY ENV. They are the credential pair this deployment speaks as, which is exactly the
- * `secret`/`identity` half of the config-as-code line. The GUILD ids do not: they are tracked literals
- * in `agent/commands/discord-commands.ts` and arrive here as the declared scope.
+ * The application id is a setting since OPE-2650: which app this deployment is, is a tracked fact.
+ * The bot token is an operator secret (OPE-2650): `oe secret set DISCORD_BOT_TOKEN`, with the env var
+ * as its on-ramp. The GUILD ids are tracked literals in `agent/commands/discord-commands.ts` and
+ * arrive here as the declared scope.
  */
 export async function reconcileDiscordCommands(scope: SurfaceCommandScope, deps: DiscordCommandSyncDeps = {}): Promise<SurfaceCommandOutcome> {
-  const applicationId = deps.applicationId ?? process.env.DISCORD_APPLICATION_ID;
-  const botToken = deps.botToken ?? process.env.DISCORD_BOT_TOKEN;
+  const applicationId = deps.applicationId ?? discordApplicationId();
+  const botToken = deps.botToken ?? (await discordBotToken());
   if (!applicationId || !botToken) {
     return {
       status: "skipped",
-      detail: "DISCORD_APPLICATION_ID and DISCORD_BOT_TOKEN must both be set for this deployment to register its own commands.",
+      detail: "the discord.applicationId setting and DISCORD_BOT_TOKEN must both be set for this deployment to register its own commands.",
     };
   }