@openclaw/discord 2026.5.2 → 2026.5.3-beta.2

package/dist/runtime-setter-api.js

@@ -0,0 +1,2 @@
+import { r as setDiscordRuntime } from "./runtime-K9RT6Egn.js";
+export { setDiscordRuntime };

package/dist/secret-config-contract-CoGryS5c.js

@@ -0,0 +1,115 @@
+import { collectNestedChannelFieldAssignments, collectSimpleChannelFieldAssignments, getChannelSurface, isBaseFieldActiveForChannelSurface, isEnabledFlag, isRecord } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+import { collectNestedChannelTtsAssignments } from "openclaw/plugin-sdk/channel-secret-tts-runtime";
+//#region extensions/discord/src/secret-config-contract.ts
+const secretTargetRegistryEntries = [
+	{
+		id: "channels.discord.accounts.*.pluralkit.token",
+		targetType: "channels.discord.accounts.*.pluralkit.token",
+		configFile: "openclaw.json",
+		pathPattern: "channels.discord.accounts.*.pluralkit.token",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.discord.accounts.*.token",
+		targetType: "channels.discord.accounts.*.token",
+		configFile: "openclaw.json",
+		pathPattern: "channels.discord.accounts.*.token",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.discord.accounts.*.voice.tts.providers.*.apiKey",
+		targetType: "channels.discord.accounts.*.voice.tts.providers.*.apiKey",
+		configFile: "openclaw.json",
+		pathPattern: "channels.discord.accounts.*.voice.tts.providers.*.apiKey",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true,
+		providerIdPathSegmentIndex: 6
+	},
+	{
+		id: "channels.discord.pluralkit.token",
+		targetType: "channels.discord.pluralkit.token",
+		configFile: "openclaw.json",
+		pathPattern: "channels.discord.pluralkit.token",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.discord.token",
+		targetType: "channels.discord.token",
+		configFile: "openclaw.json",
+		pathPattern: "channels.discord.token",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true
+	},
+	{
+		id: "channels.discord.voice.tts.providers.*.apiKey",
+		targetType: "channels.discord.voice.tts.providers.*.apiKey",
+		configFile: "openclaw.json",
+		pathPattern: "channels.discord.voice.tts.providers.*.apiKey",
+		secretShape: "secret_input",
+		expectedResolvedValue: "string",
+		includeInPlan: true,
+		includeInConfigure: true,
+		includeInAudit: true,
+		providerIdPathSegmentIndex: 4
+	}
+];
+function collectRuntimeConfigAssignments(params) {
+	const resolved = getChannelSurface(params.config, "discord");
+	if (!resolved) return;
+	const { channel: discord, surface } = resolved;
+	collectSimpleChannelFieldAssignments({
+		channelKey: "discord",
+		field: "token",
+		channel: discord,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topInactiveReason: "no enabled account inherits this top-level Discord token.",
+		accountInactiveReason: "Discord account is disabled."
+	});
+	collectNestedChannelFieldAssignments({
+		channelKey: "discord",
+		nestedKey: "pluralkit",
+		field: "token",
+		channel: discord,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topLevelActive: isBaseFieldActiveForChannelSurface(surface, "pluralkit") && isRecord(discord.pluralkit) && isEnabledFlag(discord.pluralkit),
+		topInactiveReason: "no enabled Discord surface inherits this top-level PluralKit config or PluralKit is disabled.",
+		accountActive: ({ account, enabled }) => enabled && isRecord(account.pluralkit) && isEnabledFlag(account.pluralkit),
+		accountInactiveReason: "Discord account is disabled or PluralKit is disabled for this account."
+	});
+	collectNestedChannelTtsAssignments({
+		channelKey: "discord",
+		nestedKey: "voice",
+		channel: discord,
+		surface,
+		defaults: params.defaults,
+		context: params.context,
+		topLevelActive: isBaseFieldActiveForChannelSurface(surface, "voice") && isRecord(discord.voice) && isEnabledFlag(discord.voice),
+		topInactiveReason: "no enabled Discord surface inherits this top-level voice config or voice is disabled.",
+		accountActive: ({ account, enabled }) => enabled && isRecord(account.voice) && isEnabledFlag(account.voice),
+		accountInactiveReason: "Discord account is disabled or voice is disabled for this account."
+	});
+}
+//#endregion
+export { secretTargetRegistryEntries as n, collectRuntimeConfigAssignments as t };

package/dist/secret-contract-api.js

@@ -0,0 +1,2 @@
+import { n as secretTargetRegistryEntries, t as collectRuntimeConfigAssignments } from "./secret-config-contract-CoGryS5c.js";
+export { collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/dist/security-audit-Cdz2iq3m.js

@@ -0,0 +1,120 @@
+import { t as isDiscordMutableAllowEntry } from "./security-doctor-CzTzpXV8.js";
+import { coerceNativeSetting, normalizeAllowFromList } from "openclaw/plugin-sdk/channel-policy";
+import { readChannelAllowFromStore } from "openclaw/plugin-sdk/conversation-runtime";
+import { isDangerousNameMatchingEnabled } from "openclaw/plugin-sdk/dangerous-name-runtime";
+import { resolveNativeCommandsEnabled, resolveNativeSkillsEnabled } from "openclaw/plugin-sdk/native-command-config-runtime";
+//#region extensions/discord/src/security-audit.ts
+function normalizeOptionalString(value) {
+	const normalized = value?.trim();
+	return normalized ? normalized : void 0;
+}
+function addDiscordNameBasedEntries(params) {
+	if (!Array.isArray(params.values)) return;
+	for (const value of params.values) {
+		if (!isDiscordMutableAllowEntry(String(value))) continue;
+		const text = normalizeOptionalString(String(value)) ?? "";
+		if (!text) continue;
+		params.target.add(`${params.source}:${text}`);
+	}
+}
+async function collectDiscordSecurityAuditFindings(params) {
+	const findings = [];
+	const discordCfg = params.account.config ?? {};
+	const accountId = normalizeOptionalString(params.accountId) ?? params.account.accountId ?? "default";
+	const dangerousNameMatchingEnabled = isDangerousNameMatchingEnabled(discordCfg);
+	const storeAllowFrom = await readChannelAllowFromStore("discord", process.env, accountId).catch(() => []);
+	const discordNameBasedAllowEntries = /* @__PURE__ */ new Set();
+	const discordPathPrefix = params.orderedAccountIds.length > 1 || params.hasExplicitAccountPath ? `channels.discord.accounts.${accountId}` : "channels.discord";
+	addDiscordNameBasedEntries({
+		target: discordNameBasedAllowEntries,
+		values: discordCfg.allowFrom,
+		source: `${discordPathPrefix}.allowFrom`
+	});
+	addDiscordNameBasedEntries({
+		target: discordNameBasedAllowEntries,
+		values: discordCfg.dm?.allowFrom,
+		source: `${discordPathPrefix}.dm.allowFrom`
+	});
+	addDiscordNameBasedEntries({
+		target: discordNameBasedAllowEntries,
+		values: storeAllowFrom,
+		source: "~/.openclaw/credentials/discord-allowFrom.json"
+	});
+	const guildEntries = discordCfg.guilds ?? {};
+	for (const [guildKey, guildValue] of Object.entries(guildEntries)) {
+		if (!guildValue || typeof guildValue !== "object") continue;
+		const guild = guildValue;
+		addDiscordNameBasedEntries({
+			target: discordNameBasedAllowEntries,
+			values: guild.users,
+			source: `${discordPathPrefix}.guilds.${guildKey}.users`
+		});
+		const channels = guild.channels;
+		if (!channels || typeof channels !== "object") continue;
+		for (const [channelKey, channelValue] of Object.entries(channels)) {
+			if (!channelValue || typeof channelValue !== "object") continue;
+			addDiscordNameBasedEntries({
+				target: discordNameBasedAllowEntries,
+				values: channelValue.users,
+				source: `${discordPathPrefix}.guilds.${guildKey}.channels.${channelKey}.users`
+			});
+		}
+	}
+	if (discordNameBasedAllowEntries.size > 0) {
+		const examples = Array.from(discordNameBasedAllowEntries).slice(0, 5);
+		const more = discordNameBasedAllowEntries.size > examples.length ? ` (+${discordNameBasedAllowEntries.size - examples.length} more)` : "";
+		findings.push({
+			checkId: "channels.discord.allowFrom.name_based_entries",
+			severity: dangerousNameMatchingEnabled ? "info" : "warn",
+			title: dangerousNameMatchingEnabled ? "Discord allowlist uses break-glass name/tag matching" : "Discord allowlist contains name or tag entries",
+			detail: dangerousNameMatchingEnabled ? `Discord name/tag allowlist matching is explicitly enabled via dangerouslyAllowNameMatching. This mutable-identity mode is operator-selected break-glass behavior and out-of-scope for vulnerability reports by itself. Found: ${examples.join(", ")}${more}.` : `Discord name/tag allowlist matching uses normalized slugs and can collide across users. Found: ${examples.join(", ")}${more}.`,
+			remediation: dangerousNameMatchingEnabled ? "Prefer stable Discord IDs (or <@id>/user:<id>/pk:<id>), then disable dangerouslyAllowNameMatching." : "Prefer stable Discord IDs (or <@id>/user:<id>/pk:<id>) in channels.discord.allowFrom and channels.discord.guilds.*.users, or explicitly opt in with dangerouslyAllowNameMatching=true if you accept the risk."
+		});
+	}
+	const nativeEnabled = resolveNativeCommandsEnabled({
+		providerId: "discord",
+		providerSetting: coerceNativeSetting(discordCfg.commands?.native),
+		globalSetting: params.cfg.commands?.native
+	});
+	const nativeSkillsEnabled = resolveNativeSkillsEnabled({
+		providerId: "discord",
+		providerSetting: coerceNativeSetting(discordCfg.commands?.nativeSkills),
+		globalSetting: params.cfg.commands?.nativeSkills
+	});
+	if (!nativeEnabled && !nativeSkillsEnabled) return findings;
+	const defaultGroupPolicy = params.cfg.channels?.defaults?.groupPolicy;
+	const groupPolicy = discordCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
+	const guildsConfigured = Object.keys(guildEntries).length > 0;
+	const hasAnyUserAllowlist = Object.values(guildEntries).some((guild) => {
+		if (!guild || typeof guild !== "object") return false;
+		const record = guild;
+		if (Array.isArray(record.users) && record.users.length > 0) return true;
+		const channels = record.channels;
+		if (!channels || typeof channels !== "object") return false;
+		return Object.values(channels).some((channel) => {
+			if (!channel || typeof channel !== "object") return false;
+			const channelRecord = channel;
+			return Array.isArray(channelRecord.users) && channelRecord.users.length > 0;
+		});
+	});
+	const dmAllowFromRaw = discordCfg.dm?.allowFrom;
+	const ownerAllowFromConfigured = normalizeAllowFromList([...Array.isArray(dmAllowFromRaw) ? dmAllowFromRaw : [], ...storeAllowFrom]).length > 0;
+	const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
+	if (!useAccessGroups && groupPolicy !== "disabled" && guildsConfigured && !hasAnyUserAllowlist) findings.push({
+		checkId: "channels.discord.commands.native.unrestricted",
+		severity: "critical",
+		title: "Discord slash commands are unrestricted",
+		detail: "commands.useAccessGroups=false disables sender allowlists for Discord slash commands unless a per-guild/channel users allowlist is configured; with no users allowlist, any user in allowed guild channels can invoke /… commands.",
+		remediation: "Set commands.useAccessGroups=true (recommended), or configure channels.discord.guilds.<id>.users (or channels.discord.guilds.<id>.channels.<channel>.users)."
+	});
+	else if (useAccessGroups && groupPolicy !== "disabled" && guildsConfigured && !ownerAllowFromConfigured && !hasAnyUserAllowlist) findings.push({
+		checkId: "channels.discord.commands.native.no_allowlists",
+		severity: "warn",
+		title: "Discord slash commands have no allowlists",
+		detail: "Discord slash commands are enabled, but neither an owner allowFrom list nor any per-guild/channel users allowlist is configured; /… commands will be rejected for everyone.",
+		remediation: "Add your user id to channels.discord.allowFrom (or approve yourself via pairing), or configure channels.discord.guilds.<id>.users."
+	});
+	return findings;
+}
+//#endregion
+export { collectDiscordSecurityAuditFindings as t };

package/dist/security-audit-contract-api.js

@@ -0,0 +1,2 @@
+import { t as collectDiscordSecurityAuditFindings } from "./security-audit-Cdz2iq3m.js";
+export { collectDiscordSecurityAuditFindings };

package/dist/security-audit.runtime-DBV1T1_N.js

@@ -0,0 +1,2 @@
+import { t as collectDiscordSecurityAuditFindings } from "./security-audit-Cdz2iq3m.js";
+export { collectDiscordSecurityAuditFindings };

package/dist/security-contract-api.js

@@ -0,0 +1,2 @@
+import { n as unsupportedSecretRefSurfacePatterns, t as collectUnsupportedSecretRefConfigCandidates } from "./security-contract-ei3Mz8Sa.js";
+export { collectUnsupportedSecretRefConfigCandidates, unsupportedSecretRefSurfacePatterns };

package/dist/security-contract-ei3Mz8Sa.js

@@ -0,0 +1,26 @@
+import { isRecord } from "openclaw/plugin-sdk/text-runtime";
+//#region extensions/discord/src/security-contract.ts
+const unsupportedSecretRefSurfacePatterns = ["channels.discord.threadBindings.webhookToken", "channels.discord.accounts.*.threadBindings.webhookToken"];
+function collectUnsupportedSecretRefConfigCandidates(raw) {
+	if (!isRecord(raw)) return [];
+	if (!isRecord(raw.channels) || !isRecord(raw.channels.discord)) return [];
+	const candidates = [];
+	const discord = raw.channels.discord;
+	const threadBindings = isRecord(discord.threadBindings) ? discord.threadBindings : null;
+	if (threadBindings) candidates.push({
+		path: "channels.discord.threadBindings.webhookToken",
+		value: threadBindings.webhookToken
+	});
+	const accounts = isRecord(discord.accounts) ? discord.accounts : null;
+	if (!accounts) return candidates;
+	for (const [accountId, account] of Object.entries(accounts)) {
+		if (!isRecord(account) || !isRecord(account.threadBindings)) continue;
+		candidates.push({
+			path: `channels.discord.accounts.${accountId}.threadBindings.webhookToken`,
+			value: account.threadBindings.webhookToken
+		});
+	}
+	return candidates;
+}
+//#endregion
+export { unsupportedSecretRefSurfacePatterns as n, collectUnsupportedSecretRefConfigCandidates as t };

package/dist/security-doctor-CzTzpXV8.js

@@ -0,0 +1,18 @@
+//#region extensions/discord/src/security-doctor.ts
+function isDiscordMutableAllowEntry(raw) {
+	const text = raw.trim();
+	if (!text || text === "*") return false;
+	const maybeMentionId = text.replace(/^<@!?/, "").replace(/>$/, "");
+	if (/^\d+$/.test(maybeMentionId)) return false;
+	for (const prefix of [
+		"discord:",
+		"user:",
+		"pk:"
+	]) {
+		if (!text.startsWith(prefix)) continue;
+		return text.slice(prefix.length).trim().length === 0;
+	}
+	return true;
+}
+//#endregion
+export { isDiscordMutableAllowEntry as t };