@openclaw/discord 2026.10.2 → 2026.10.5-beta.2

package/dist/.setup/{runtime-DPcmPST9.mjs → runtime-DPm3gZXk.mjs}

@@ -1,5 +1,5 @@
-import { c as resolveDiscordAccount, g as selectDiscordActivitiesRuntimeConfig, n as isDiscordAccountEnabledForRuntime, r as listDiscordAccountIds } from "./accounts-HE9-mj1L.mjs";
-import { z as resolveDiscordProxyFetchForAccount } from "./send.shared-C4CN24D9.mjs";
+import { _ as selectDiscordActivitiesRuntimeConfig, i as listDiscordAccountIds, l as resolveDiscordAccount, r as isDiscordAccountEnabledForRuntime } from "./accounts-ljrzXBJi.mjs";
+import { z as resolveDiscordProxyFetchForAccount } from "./send.shared-CjQ4jbMA.mjs";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/discord/src/activities/config.ts
 function resolveDiscordActivitiesConfig(account, env = process.env) {

package/dist/.setup/{secret-config-contract-uOE2J7yM.mjs → secret-config-contract-CIsH7R3B.mjs}

@@ -32,24 +32,23 @@ function collectRuntimeConfigAssignments(params) {
 		account: {},
 		enabled: surface.channelEnabled
 	});
-	collectSimpleChannelFieldAssignments({
+	const assignmentContext = {
 		channelKey: "discord",
-		field: "token",
 		channel: discord,
 		surface,
 		defaults: params.defaults,
-		context: params.context,
+		context: params.context
+	};
+	collectSimpleChannelFieldAssignments({
+		...assignmentContext,
+		field: "token",
 		topInactiveReason: "no enabled account inherits this top-level Discord token.",
 		accountInactiveReason: "Discord account is disabled."
 	});
 	collectNestedChannelFieldAssignments({
-		channelKey: "discord",
+		...assignmentContext,
 		nestedKey: "pluralkit",
 		field: "token",
-		channel: discord,
-		surface,
-		defaults: params.defaults,
-		context: params.context,
 		topLevelActive: isBaseFieldActiveForChannelSurface(surface, "pluralkit") && isRecord(discord.pluralkit) && isEnabledFlag(discord.pluralkit),
 		topLevelInheritedAccountActive: ({ account, enabled }) => enabled && !Object.hasOwn(account, "pluralkit") && isEnabledFlag(discord.pluralkit),
 		topInactiveReason: "no enabled Discord surface inherits this top-level PluralKit config or PluralKit is disabled.",
@@ -57,26 +56,18 @@ function collectRuntimeConfigAssignments(params) {
 		accountInactiveReason: "Discord account is disabled or PluralKit is disabled for this account."
 	});
 	collectNestedChannelTtsAssignments({
-		channelKey: "discord",
+		...assignmentContext,
 		nestedKey: "voice",
-		channel: discord,
-		surface,
-		defaults: params.defaults,
-		context: params.context,
 		topLevelActive: isBaseFieldActiveForChannelSurface(surface, "voice") && isRecord(discord.voice) && isEnabledFlag(discord.voice),
 		topInactiveReason: "no enabled Discord surface inherits this top-level voice config or voice is disabled.",
 		accountActive: ({ account, enabled }) => enabled && isRecord(account.voice) && isEnabledFlag(account.voice),
 		accountInactiveReason: "Discord account is disabled or voice is disabled for this account."
 	});
 	collectNestedChannelTtsAssignments({
-		channelKey: "discord",
+		...assignmentContext,
 		nestedKey: "voice",
 		providerBlockKey: "realtime",
 		ownerId: ({ accountId, providerId }) => discordRealtimeVoiceSecretOwnerId(accountId, providerId),
-		channel: discord,
-		surface,
-		defaults: params.defaults,
-		context: params.context,
 		topLevelActive: isBaseFieldActiveForChannelSurface(surface, "voice") && isRealtimeVoiceActive(discord.voice),
 		topInactiveReason: "no enabled Discord surface uses this top-level realtime voice config, voice is disabled, or voice mode is stt-tts.",
 		accountActive: ({ account, enabled }) => enabled && isRealtimeVoiceActive(account.voice),

package/dist/.setup/{security-audit-D42cp5N7.mjs → security-audit-BFT84Uny.mjs}

@@ -13,8 +13,7 @@ function isWildcardEntry(value) {
 function hasNarrowMemberRestriction(guild, channel) {
 	const users = channel?.users ?? guild.users ?? [];
 	const roles = channel?.roles ?? guild.roles ?? [];
-	if ([...users, ...roles].some((entry) => isWildcardEntry(entry))) return false;
-	return users.length > 0 || roles.length > 0;
+	return ![...users, ...roles].some(isWildcardEntry) && (users.length > 0 || roles.length > 0);
 }
 function listBroadMemberTargetPaths(params) {
 	const paths = [];

package/dist/.setup/security-contract-DNyyjTZZ.mjs

@@ -0,0 +1,19 @@
+import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+//#region extensions/discord/src/security-contract.ts
+const unsupportedSecretRefSurfacePatterns = ["channels.discord.threadBindings.webhookToken", "channels.discord.accounts.*.threadBindings.webhookToken"];
+function collectUnsupportedSecretRefConfigCandidates(raw) {
+	if (!isRecord(raw) || !isRecord(raw.channels) || !isRecord(raw.channels.discord)) return [];
+	const candidates = [];
+	const discord = raw.channels.discord;
+	const addCandidate = (account, path) => {
+		if (isRecord(account) && isRecord(account.threadBindings)) candidates.push({
+			path: `${path}.threadBindings.webhookToken`,
+			value: account.threadBindings.webhookToken
+		});
+	};
+	addCandidate(discord, "channels.discord");
+	for (const [accountId, account] of Object.entries(isRecord(discord.accounts) ? discord.accounts : {})) addCandidate(account, `channels.discord.accounts.${accountId}`);
+	return candidates;
+}
+//#endregion
+export { unsupportedSecretRefSurfacePatterns as n, collectUnsupportedSecretRefConfigCandidates as t };