@openclaw/discord 2026.7.1 → 2026.7.2-beta.2

package/dist/activities-api.js

@@ -0,0 +1,2 @@
+import { t as registerDiscordActivities } from "./activities-api-D0D_87n3.js";
+export { registerDiscordActivities };

package/dist/{allow-list-C-MqM-B_.js → allow-list-B7qOH5xu.js}

@@ -192,6 +192,27 @@ function resolveDiscordOwnerAccess(params) {
 		}, { allowNameMatching: params.allowNameMatching }) : false
 	};
 }
+function resolveDiscordCommandOwnerAllowFrom(cfg) {
+	const raw = cfg.commands?.ownerAllowFrom;
+	if (!Array.isArray(raw) || raw.length === 0) return;
+	const entries = [];
+	for (const entry of raw) {
+		const trimmed = normalizeOptionalString(String(entry ?? "")) ?? "";
+		if (!trimmed) continue;
+		const separatorIndex = trimmed.indexOf(":");
+		if (separatorIndex > 0) {
+			const prefix = trimmed.slice(0, separatorIndex).toLowerCase();
+			if (prefix === "discord") {
+				const remainder = normalizeOptionalString(trimmed.slice(separatorIndex + 1)) ?? "";
+				if (remainder) entries.push(remainder);
+				continue;
+			}
+			if (prefix !== "user" && prefix !== "pk") continue;
+		}
+		entries.push(trimmed);
+	}
+	return entries.length > 0 ? entries : void 0;
+}
 function resolveDiscordCommandAuthorized(params) {
 	if (!params.isDirectMessage) return true;
 	const allowList = normalizeDiscordAllowList(params.allowFrom, [
@@ -351,4 +372,4 @@ function shouldEmitDiscordReactionNotification(params) {
 	return false;
 }
 //#endregion
-export { resolveTimestampMs as S, resolveGroupDmAllow as _, normalizeDiscordSlug as a, formatDiscordUserTag as b, resolveDiscordChannelConfigWithFallback as c, resolveDiscordGuildEntry as d, resolveDiscordMemberAccessState as f, resolveDiscordShouldRequireMention as g, resolveDiscordOwnerAllowFrom as h, normalizeDiscordDisplaySlug as i, resolveDiscordChannelPolicyCommandAuthorizer as l, resolveDiscordOwnerAccess as m, isDiscordGroupAllowedByPolicy as n, resolveDiscordAllowListMatch as o, resolveDiscordMemberAllowed as p, normalizeDiscordAllowList as r, resolveDiscordChannelConfig as s, allowListMatches as t, resolveDiscordCommandAuthorized as u, shouldEmitDiscordReactionNotification as v, resolveDiscordSystemLocation as x, formatDiscordReactionEmoji as y };
+export { resolveTimestampMs as C, resolveDiscordSystemLocation as S, resolveDiscordShouldRequireMention as _, normalizeDiscordSlug as a, formatDiscordReactionEmoji as b, resolveDiscordChannelConfigWithFallback as c, resolveDiscordCommandOwnerAllowFrom as d, resolveDiscordGuildEntry as f, resolveDiscordOwnerAllowFrom as g, resolveDiscordOwnerAccess as h, normalizeDiscordDisplaySlug as i, resolveDiscordChannelPolicyCommandAuthorizer as l, resolveDiscordMemberAllowed as m, isDiscordGroupAllowedByPolicy as n, resolveDiscordAllowListMatch as o, resolveDiscordMemberAccessState as p, normalizeDiscordAllowList as r, resolveDiscordChannelConfig as s, allowListMatches as t, resolveDiscordCommandAuthorized as u, resolveGroupDmAllow as v, formatDiscordUserTag as x, shouldEmitDiscordReactionNotification as y };

package/dist/{api-DPRqYi4Z.js → api-B88T4rFN.js}

@@ -1,9 +1,9 @@
-import { n as parseRetryAfterHeaderSeconds, t as parseDiscordRetryAfterBodySeconds } from "./retry-after-D5_VmM-_.js";
+import { t as parseDiscordRetryAfterBodySeconds } from "./retry-after-DdLPmPoa.js";
 import { resolveTimerTimeoutMs } from "openclaw/plugin-sdk/number-runtime";
 import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
-import { resolveFetch } from "openclaw/plugin-sdk/fetch-runtime";
-import { resolveRetryConfig, retryAsync } from "openclaw/plugin-sdk/retry-runtime";
+import { parseRetryAfterHeaderSeconds, resolveRetryConfig, retryAsync } from "openclaw/plugin-sdk/retry-runtime";
 import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
+import { resolveFetch } from "openclaw/plugin-sdk/fetch-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/discord/src/error-body.ts
 const DISCORD_RESPONSE_BODY_SUMMARY_MAX_CHARS = 240;
@@ -31,6 +31,7 @@ const DISCORD_API_RETRY_DEFAULTS = {
 const DISCORD_API_429_FALLBACK_RETRY_AFTER_SECONDS = 60;
 const DISCORD_API_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
 const DISCORD_API_RESPONSE_BODY_LIMIT_BYTES = 4 * 1024 * 1024;
+const DISCORD_DIRECTORY_LOOKUP_TIMEOUT_MS = 1e4;
 function parseDiscordApiErrorPayload(text) {
 	const trimmed = text.trim();
 	if (!trimmed.startsWith("{") || !trimmed.endsWith("}")) return null;
@@ -87,9 +88,18 @@ function normalizeDiscordRequestBody(body, headers) {
 	headers.set("Content-Type", headers.get("Content-Type") ?? "application/json");
 	return JSON.stringify(body);
 }
-function resolveDiscordRequestSignal(options) {
-	if (options.signal || typeof options.timeoutMs !== "number") return options.signal;
-	return AbortSignal.timeout(resolveTimerTimeoutMs(options.timeoutMs, 1));
+function createDiscordRequestSignal(options) {
+	if (typeof options.timeoutMs !== "number" || options.signal?.aborted) return {
+		signal: options.signal,
+		cleanup: () => void 0
+	};
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), resolveTimerTimeoutMs(options.timeoutMs, 1));
+	timeout.unref?.();
+	return {
+		signal: options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal,
+		cleanup: () => clearTimeout(timeout)
+	};
 }
 async function requestDiscord(path, token, options) {
 	const fetchImpl = resolveFetch(options?.fetcher ?? fetch);
@@ -99,26 +109,31 @@ async function requestDiscord(path, token, options) {
 		const headers = new Headers(options?.headers);
 		headers.set("Authorization", `Bot ${token}`);
 		const body = normalizeDiscordRequestBody(options?.body, headers);
-		const res = await fetchImpl(`${DISCORD_API_BASE}${path}`, {
-			method: options?.method ?? (body === void 0 ? "GET" : "POST"),
-			headers,
-			body,
-			signal: resolveDiscordRequestSignal(options ?? {})
-		});
-		if (!res.ok) {
-			const text = await readResponseTextLimited(res, DISCORD_API_ERROR_BODY_LIMIT_BYTES).catch(() => "");
-			const detail = formatDiscordApiErrorText(text, res);
-			const suffix = detail ? `: ${detail}` : "";
-			const retryAfter = res.status === 429 ? parseRetryAfterSeconds(text, res) ?? DISCORD_API_429_FALLBACK_RETRY_AFTER_SECONDS : void 0;
-			throw new DiscordApiError(`Discord API ${path} failed (${res.status})${suffix}`, res.status, retryAfter);
-		}
-		const responseBody = await readResponseWithLimit(res, DISCORD_API_RESPONSE_BODY_LIMIT_BYTES, { onOverflow: ({ size, maxBytes }) => /* @__PURE__ */ new Error(`Discord API ${path} response body too large: ${size} bytes (limit: ${maxBytes} bytes)`) });
-		const text = new TextDecoder().decode(responseBody);
-		if (!text.trim()) return;
+		const requestSignal = createDiscordRequestSignal(options ?? {});
 		try {
-			return JSON.parse(text);
-		} catch {
-			throw new DiscordApiError(`Discord API ${path} returned malformed JSON`, 0);
+			const res = await fetchImpl(`${DISCORD_API_BASE}${path}`, {
+				method: options?.method ?? (body === void 0 ? "GET" : "POST"),
+				headers,
+				body,
+				signal: requestSignal.signal
+			});
+			if (!res.ok) {
+				const text = await readResponseTextLimited(res, DISCORD_API_ERROR_BODY_LIMIT_BYTES).catch(() => "");
+				const detail = formatDiscordApiErrorText(text, res);
+				const suffix = detail ? `: ${detail}` : "";
+				const retryAfter = res.status === 429 ? parseRetryAfterSeconds(text, res) ?? DISCORD_API_429_FALLBACK_RETRY_AFTER_SECONDS : void 0;
+				throw new DiscordApiError(`Discord API ${path} failed (${res.status})${suffix}`, res.status, retryAfter);
+			}
+			const responseBody = await readResponseWithLimit(res, DISCORD_API_RESPONSE_BODY_LIMIT_BYTES, { onOverflow: ({ size, maxBytes }) => /* @__PURE__ */ new Error(`Discord API ${path} response body too large: ${size} bytes (limit: ${maxBytes} bytes)`) });
+			const text = new TextDecoder().decode(responseBody);
+			if (!text.trim()) return;
+			try {
+				return JSON.parse(text);
+			} catch {
+				throw new DiscordApiError(`Discord API ${path} returned malformed JSON`, 0);
+			}
+		} finally {
+			requestSignal.cleanup();
 		}
 	}, {
 		...retryConfig,
@@ -135,4 +150,4 @@ async function fetchDiscord(path, token, fetcher = fetch, options) {
 	});
 }
 //#endregion
-export { summarizeDiscordResponseBody as a, isDiscordRateLimitResponseBody as i, fetchDiscord as n, requestDiscord as r, DiscordApiError as t };
+export { isDiscordRateLimitResponseBody as a, requestDiscord as i, DiscordApiError as n, summarizeDiscordResponseBody as o, fetchDiscord as r, DISCORD_DIRECTORY_LOOKUP_TIMEOUT_MS as t };

package/dist/api.js

@@ -1,23 +1,23 @@
-import { Kt as parseDiscordTarget, c as normalizeDiscordMessagingTarget, l as normalizeDiscordOutboundTarget, qt as resolveDiscordChannelId, s as looksLikeDiscordTargetId } from "./send.receipt-BpBQED_5.js";
-import { t as inspectDiscordAccount } from "./account-inspect-DDZtT5C8.js";
-import { a as mergeDiscordAccountConfig, f as resolveDiscordMaxLinesPerMessage, i as listEnabledDiscordAccounts, l as resolveDiscordAccountConfig, o as resolveDefaultDiscordAccountId, r as listDiscordAccountIds, s as resolveDiscordAccount, t as createDiscordActionGate } from "./accounts-P19jm1lf.js";
-import { _ as parseDiscordComponentCustomId, b as parseDiscordModalCustomIdForInteraction, c as buildDiscordComponentMessage, d as readDiscordComponentSpec, f as resolveDiscordComponentAttachmentName, g as buildDiscordModalCustomId, h as buildDiscordComponentCustomId, l as buildDiscordComponentMessageFlags, m as DISCORD_MODAL_CUSTOM_ID_KEY, n as formatDiscordComponentEventText, o as DiscordFormModal, p as DISCORD_COMPONENT_CUSTOM_ID_KEY, r as buildDiscordInteractiveComponents, s as createDiscordFormModal, u as DISCORD_COMPONENT_ATTACHMENT_PREFIX, v as parseDiscordComponentCustomIdForInteraction, y as parseDiscordModalCustomId } from "./components-BIBizbtZ.js";
-import { n as fetchDiscord, r as requestDiscord, t as DiscordApiError } from "./api-DPRqYi4Z.js";
-import { i as parseDiscordSendTarget, n as resolveDiscordTarget } from "./target-resolver-CwHaSLt3.js";
-import "./targets-69w7c3vU.js";
-import { a as getDiscordExecApprovalApprovers, c as shouldSuppressLocalDiscordExecApprovalPrompt, o as isDiscordExecApprovalApprover, s as isDiscordExecApprovalClientEnabled } from "./conversation-identity-DWC5d8Sy.js";
-import { i as resolveDiscordGroupToolPolicy, n as collectDiscordStatusIssues, r as resolveDiscordGroupRequireMention, t as discordPlugin } from "./channel-DGWPH5u3.js";
-import { i as DISCORD_DEFAULT_LISTENER_TIMEOUT_MS, n as DISCORD_ATTACHMENT_TOTAL_TIMEOUT_MS, o as mergeAbortSignals, r as DISCORD_DEFAULT_INBOUND_WORKER_TIMEOUT_MS, t as DISCORD_ATTACHMENT_IDLE_TIMEOUT_MS } from "./timeouts-C5TBc_9x.js";
+import { c as looksLikeDiscordTargetId, d as parseDiscordTarget, f as resolveDiscordChannelId, l as normalizeDiscordMessagingTarget, u as normalizeDiscordOutboundTarget } from "./chunk-CHpY_lsO.js";
+import { a as mergeDiscordAccountConfig, f as resolveDiscordMaxLinesPerMessage, i as listEnabledDiscordAccounts, l as resolveDiscordAccountConfig, o as resolveDefaultDiscordAccountId, r as listDiscordAccountIds, s as resolveDiscordAccount, t as createDiscordActionGate } from "./accounts-CMd4nzLB.js";
+import { C as parseDiscordComponentCustomId, E as parseDiscordModalCustomIdForInteraction, T as parseDiscordModalCustomId, _ as DISCORD_MODAL_CUSTOM_ID_KEY, b as buildDiscordModalCustomId, d as buildDiscordComponentMessage, f as buildDiscordComponentMessageFlags, g as DISCORD_COMPONENT_CUSTOM_ID_KEY, h as resolveDiscordComponentAttachmentName, i as buildDiscordInteractiveComponents, l as DiscordFormModal, m as readDiscordComponentSpec, p as DISCORD_COMPONENT_ATTACHMENT_PREFIX, r as formatDiscordComponentEventText, u as createDiscordFormModal, w as parseDiscordComponentCustomIdForInteraction, y as buildDiscordComponentCustomId } from "./outbound-session-route-D4QqePZN.js";
+import { i as requestDiscord, n as DiscordApiError, r as fetchDiscord } from "./api-B88T4rFN.js";
+import { i as parseDiscordSendTarget, n as resolveDiscordTarget } from "./target-resolver-BaEmTxeK.js";
+import { t as inspectDiscordAccount } from "./account-inspect-dFV0JrnR.js";
+import { i as DISCORD_DEFAULT_LISTENER_TIMEOUT_MS, n as DISCORD_ATTACHMENT_TOTAL_TIMEOUT_MS, o as mergeAbortSignals, r as DISCORD_DEFAULT_INBOUND_WORKER_TIMEOUT_MS, t as DISCORD_ATTACHMENT_IDLE_TIMEOUT_MS } from "./timeouts-D5lWili0.js";
+import "./targets-fjJt3PYG.js";
+import { a as isDiscordExecApprovalClientEnabled, i as isDiscordExecApprovalApprover, o as shouldSuppressLocalDiscordExecApprovalPrompt, r as getDiscordExecApprovalApprovers } from "./conversation-identity-BPcbhCAH.js";
+import { i as resolveDiscordGroupToolPolicy, n as collectDiscordStatusIssues, r as resolveDiscordGroupRequireMention, t as discordPlugin } from "./channel-BDfKr14H.js";
 import { t as normalizeExplicitDiscordSessionKey } from "./session-key-normalization-wJgsKPNF.js";
-import { t as discordSetupPlugin } from "./channel.setup-tZcpIn4e.js";
-import { n as handleDiscordSubagentEnded, r as handleDiscordSubagentSpawning, t as handleDiscordSubagentDeliveryTarget } from "./subagent-hooks-B-bJxxGg.js";
-import { t as tryHandleDiscordMessageActionGuildAdmin } from "./handle-action.guild-admin-CgJSNVui.js";
-import { n as listDiscordDirectoryGroupsFromConfig, r as listDiscordDirectoryPeersFromConfig } from "./directory-config-ByaUKL1f.js";
-import { t as fetchPluralKitMessageInfo } from "./pluralkit-DcD-3EcL.js";
-import { a as resolveDiscordPrivilegedIntentsFromFlags, i as probeDiscord, n as fetchDiscordApplicationSummary, r as parseApplicationIdFromToken, t as fetchDiscordApplicationId } from "./probe-D1ImJEo2.js";
-import { t as collectDiscordSecurityAuditFindings } from "./security-audit-Bh_65L5C.js";
+import { t as discordSetupPlugin } from "./channel.setup-BS4gd8sc.js";
+import { n as handleDiscordSubagentEnded, r as handleDiscordSubagentSpawning, t as handleDiscordSubagentDeliveryTarget } from "./subagent-hooks-mSxRv4AE.js";
+import { t as tryHandleDiscordMessageActionGuildAdmin } from "./handle-action.guild-admin-LYY75_Oa.js";
+import { n as listDiscordDirectoryGroupsFromConfig, r as listDiscordDirectoryPeersFromConfig } from "./directory-config-G1QwBIdi.js";
+import { t as fetchPluralKitMessageInfo } from "./pluralkit-r4wiI2yy.js";
+import { a as resolveDiscordPrivilegedIntentsFromFlags, i as probeDiscord, n as fetchDiscordApplicationSummary, r as parseApplicationIdFromToken, t as fetchDiscordApplicationId } from "./probe-WKeTYyJX.js";
+import { t as collectDiscordSecurityAuditFindings } from "./security-audit-aLbWmUjl.js";
 import { resolveOpenProviderRuntimeGroupPolicy as resolveDiscordRuntimeGroupPolicy } from "openclaw/plugin-sdk/runtime-group-policy";
 //#region extensions/discord/api.ts
-const handleDiscordMessageAction = async (...args) => (await import("./channel-actions.runtime-CVHlFqQg.js")).handleDiscordMessageAction(...args);
+const handleDiscordMessageAction = async (...args) => (await import("./channel-actions.runtime-CC4QwYVO.js")).handleDiscordMessageAction(...args);
 //#endregion
 export { DISCORD_ATTACHMENT_IDLE_TIMEOUT_MS, DISCORD_ATTACHMENT_TOTAL_TIMEOUT_MS, DISCORD_COMPONENT_ATTACHMENT_PREFIX, DISCORD_COMPONENT_CUSTOM_ID_KEY, DISCORD_DEFAULT_INBOUND_WORKER_TIMEOUT_MS, DISCORD_DEFAULT_LISTENER_TIMEOUT_MS, DISCORD_MODAL_CUSTOM_ID_KEY, DiscordApiError, DiscordFormModal, buildDiscordComponentCustomId, buildDiscordComponentMessage, buildDiscordComponentMessageFlags, buildDiscordInteractiveComponents, buildDiscordModalCustomId, collectDiscordSecurityAuditFindings, collectDiscordStatusIssues, createDiscordActionGate, createDiscordFormModal, discordPlugin, discordSetupPlugin, fetchDiscord, fetchDiscordApplicationId, fetchDiscordApplicationSummary, fetchPluralKitMessageInfo, formatDiscordComponentEventText, getDiscordExecApprovalApprovers, handleDiscordMessageAction, handleDiscordSubagentDeliveryTarget, handleDiscordSubagentEnded, handleDiscordSubagentSpawning, inspectDiscordAccount, isDiscordExecApprovalApprover, isDiscordExecApprovalClientEnabled, listDiscordAccountIds, listDiscordDirectoryGroupsFromConfig, listDiscordDirectoryPeersFromConfig, listEnabledDiscordAccounts, looksLikeDiscordTargetId, mergeAbortSignals, mergeDiscordAccountConfig, normalizeDiscordMessagingTarget, normalizeDiscordOutboundTarget, normalizeExplicitDiscordSessionKey, parseApplicationIdFromToken, parseDiscordComponentCustomId, parseDiscordComponentCustomIdForInteraction as parseDiscordComponentCustomIdForCarbon, parseDiscordComponentCustomIdForInteraction, parseDiscordModalCustomId, parseDiscordModalCustomIdForInteraction as parseDiscordModalCustomIdForCarbon, parseDiscordModalCustomIdForInteraction, parseDiscordSendTarget, parseDiscordTarget, probeDiscord, readDiscordComponentSpec, requestDiscord, resolveDefaultDiscordAccountId, resolveDiscordAccount, resolveDiscordAccountConfig, resolveDiscordChannelId, resolveDiscordComponentAttachmentName, resolveDiscordGroupRequireMention, resolveDiscordGroupToolPolicy, resolveDiscordMaxLinesPerMessage, resolveDiscordPrivilegedIntentsFromFlags, resolveDiscordRuntimeGroupPolicy, resolveDiscordTarget, shouldSuppressLocalDiscordExecApprovalPrompt, tryHandleDiscordMessageActionGuildAdmin };

package/dist/{approval-handler.runtime-Bw2pZNk1.js → approval-handler.runtime-B7E1-x5q.js}

@@ -1,10 +1,13 @@
-import { F as serializePayload, H as Button, Jt as __exportAll, Q as Separator, W as Container, X as Row, dt as createChannelMessage, et as TextDisplay, gt as editChannelMessage, mt as deleteChannelMessage, ot as createUserDmChannel } from "./send.receipt-BpBQED_5.js";
-import { t as inspectDiscordAccount } from "./account-inspect-DDZtT5C8.js";
-import { F as createDiscordClient, b as stripUndefinedFields } from "./send.shared-wAwMhHDN.js";
-import { i as shouldHandleDiscordApprovalRequest, s as isDiscordExecApprovalClientEnabled } from "./conversation-identity-DWC5d8Sy.js";
+import { J as Container, K as Button, bt as editChannelMessage, et as Row, ht as createChannelMessage, it as TextDisplay, nt as Separator, ut as createUserDmChannel, vt as deleteChannelMessage, z as serializePayload } from "./chunk-CHpY_lsO.js";
+import { s as buildExecApprovalCustomId } from "./outbound-session-route-D4QqePZN.js";
+import { P as createDiscordClient, b as stripUndefinedFields, g as createDiscordMessageNonce } from "./send.shared-XuOTO1dW.js";
+import { t as inspectDiscordAccount } from "./account-inspect-dFV0JrnR.js";
+import { a as isDiscordExecApprovalClientEnabled } from "./conversation-identity-BPcbhCAH.js";
+import { a as shouldHandleDiscordApprovalRequest } from "./channel-BDfKr14H.js";
+import { n as formatDiscordApprovalDisplayValue, t as DISCORD_APPROVAL_ALLOWED_MENTIONS } from "./approval-message-safety-C-8BL6Kv.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { ButtonStyle } from "discord-api-types/v10";
 import { logDebug, logError } from "openclaw/plugin-sdk/logging-core";
+import { ButtonStyle } from "discord-api-types/v10";
 import { createChannelApprovalNativeRuntimeAdapter } from "openclaw/plugin-sdk/approval-handler-runtime";
 //#region extensions/discord/src/ui-colors.ts
 const DEFAULT_DISCORD_ACCENT_COLOR = "#5865F2";
@@ -37,10 +40,6 @@ var DiscordUiContainer = class extends Container {
 };
 //#endregion
 //#region extensions/discord/src/approval-handler.runtime.ts
-var approval_handler_runtime_exports = /* @__PURE__ */ __exportAll({
-	buildExecApprovalCustomId: () => buildExecApprovalCustomId,
-	discordApprovalNativeRuntime: () => discordApprovalNativeRuntime
-});
 function resolveHandlerContext(params) {
 	const context = params.context;
 	const accountId = normalizeOptionalString(params.accountId) ?? "";
@@ -80,7 +79,7 @@ var ExecApprovalContainer = class extends DiscordUiContainer {
 var ExecApprovalActionButton = class extends Button {
 	constructor(params) {
 		super();
-		this.customId = buildExecApprovalCustomId(params.approvalId, params.descriptor.decision);
+		this.customId = buildExecApprovalCustomId(params.approvalId, params.approvalKind, params.descriptor.decision);
 		this.label = params.descriptor.label;
 		this.style = params.descriptor.style === "success" ? ButtonStyle.Success : params.descriptor.style === "primary" ? ButtonStyle.Primary : params.descriptor.style === "danger" ? ButtonStyle.Danger : ButtonStyle.Secondary;
 	}
@@ -89,6 +88,7 @@ var ExecApprovalActionRow = class extends Row {
 	constructor(params) {
 		super(params.actions.map((descriptor) => new ExecApprovalActionButton({
 			approvalId: params.approvalId,
+			approvalKind: params.approvalKind,
 			descriptor
 		})));
 	}
@@ -96,6 +96,7 @@ var ExecApprovalActionRow = class extends Row {
 function createApprovalActionRow(view) {
 	return new ExecApprovalActionRow({
 		approvalId: view.approvalId,
+		approvalKind: view.approvalKind,
 		actions: view.actions
 	});
 }
@@ -103,7 +104,10 @@ function buildApprovalMetadataLines(metadata) {
 	return metadata.map((item) => `- ${item.label}: ${item.value}`);
 }
 function buildExecApprovalPayload(container) {
-	return { components: [container] };
+	return {
+		components: [container],
+		allowed_mentions: DISCORD_APPROVAL_ALLOWED_MENTIONS
+	};
 }
 const commandPreviewSegmenter = typeof Intl !== "undefined" && "Segmenter" in Intl ? new Intl.Segmenter(void 0, { granularity: "grapheme" }) : null;
 function* iterateCommandPreviewSegments(commandText) {
@@ -150,7 +154,7 @@ function createExecApprovalRequestContainer(params) {
 		commandSecondaryPreview,
 		metadataLines: buildApprovalMetadataLines(params.view.metadata),
 		actionRow: params.actionRow,
-		footer: `Expires <t:${expiresAtSeconds}:R> · ID: ${params.view.approvalId}`,
+		footer: `Expires <t:${expiresAtSeconds}:R> · ID: ${formatDiscordApprovalDisplayValue(params.view.approvalId)}`,
 		accentColor: "#FFA500"
 	});
 }
@@ -167,7 +171,7 @@ function createPluginApprovalRequestContainer(params) {
 		commandSecondaryPreview: formatOptionalCommandPreview(params.view.description, 1e3),
 		metadataLines: buildApprovalMetadataLines(params.view.metadata),
 		actionRow: params.actionRow,
-		footer: `Expires <t:${expiresAtSeconds}:R> · ID: ${params.view.approvalId}`,
+		footer: `Expires <t:${expiresAtSeconds}:R> · ID: ${formatDiscordApprovalDisplayValue(params.view.approvalId)}`,
 		accentColor
 	});
 }
@@ -179,11 +183,11 @@ function createExecResolvedContainer(params) {
 		cfg: params.cfg,
 		accountId: params.accountId,
 		title: `Exec Approval: ${decisionLabel}`,
-		description: params.view.resolvedBy ? `Resolved by ${params.view.resolvedBy}` : "Resolved",
+		description: params.view.resolvedBy ? `Resolved by ${formatDiscordApprovalDisplayValue(params.view.resolvedBy)}` : "Resolved",
 		commandPreview,
 		commandSecondaryPreview,
 		metadataLines: buildApprovalMetadataLines(params.view.metadata),
-		footer: `ID: ${params.view.approvalId}`,
+		footer: `ID: ${formatDiscordApprovalDisplayValue(params.view.approvalId)}`,
 		accentColor
 	});
 }
@@ -194,11 +198,11 @@ function createPluginResolvedContainer(params) {
 		cfg: params.cfg,
 		accountId: params.accountId,
 		title: `Plugin Approval: ${decisionLabel}`,
-		description: params.view.resolvedBy ? `Resolved by ${params.view.resolvedBy}` : "Resolved",
+		description: params.view.resolvedBy ? `Resolved by ${formatDiscordApprovalDisplayValue(params.view.resolvedBy)}` : "Resolved",
 		commandPreview: formatCommandPreview(params.view.title, 700),
 		commandSecondaryPreview: formatOptionalCommandPreview(params.view.description, 1e3),
 		metadataLines: buildApprovalMetadataLines(params.view.metadata),
-		footer: `ID: ${params.view.approvalId}`,
+		footer: `ID: ${formatDiscordApprovalDisplayValue(params.view.approvalId)}`,
 		accentColor
 	});
 }
@@ -212,7 +216,7 @@ function createExecExpiredContainer(params) {
 		commandPreview,
 		commandSecondaryPreview,
 		metadataLines: buildApprovalMetadataLines(params.view.metadata),
-		footer: `ID: ${params.view.approvalId}`,
+		footer: `ID: ${formatDiscordApprovalDisplayValue(params.view.approvalId)}`,
 		accentColor: "#99AAB5"
 	});
 }
@@ -225,13 +229,10 @@ function createPluginExpiredContainer(params) {
 		commandPreview: formatCommandPreview(params.view.title, 700),
 		commandSecondaryPreview: formatOptionalCommandPreview(params.view.description, 1e3),
 		metadataLines: buildApprovalMetadataLines(params.view.metadata),
-		footer: `ID: ${params.view.approvalId}`,
+		footer: `ID: ${formatDiscordApprovalDisplayValue(params.view.approvalId)}`,
 		accentColor: "#99AAB5"
 	});
 }
-function buildExecApprovalCustomId(approvalId, action) {
-	return [`execapproval:id=${encodeURIComponent(approvalId)}`, `action=${action}`].join(";");
-}
 async function updateMessage(params) {
 	try {
 		const { rest, request: discordRequest } = createDiscordClient({
@@ -264,7 +265,6 @@ async function finalizeMessage(params) {
 }
 const discordApprovalNativeRuntime = createChannelApprovalNativeRuntimeAdapter({
 	eventKinds: ["exec", "plugin"],
-	resolveApprovalKind: (request) => request.id.startsWith("plugin:") ? "plugin" : "exec",
 	availability: {
 		isConfigured: (params) => {
 			const resolved = resolveHandlerContext(params);
@@ -392,7 +392,12 @@ const discordApprovalNativeRuntime = createChannelApprovalNativeRuntimeAdapter({
 				token: resolved.context.token,
 				accountId: resolved.accountId
 			});
-			const message = await discordRequest(() => createChannelMessage(rest, preparedTarget.discordChannelId, { body: pendingPayload.body }), plannedTarget.surface === "origin" ? "send-approval-channel" : "send-approval");
+			const body = {
+				...pendingPayload.body,
+				nonce: createDiscordMessageNonce(),
+				enforce_nonce: true
+			};
+			const message = await discordRequest(() => createChannelMessage(rest, preparedTarget.discordChannelId, { body }), plannedTarget.surface === "origin" ? "send-approval-channel" : "send-approval", { safety: "nonce-protected-create" });
 			if (!message?.id) {
 				if (plannedTarget.surface === "origin") logError("discord approvals: failed to send to channel");
 				else if (preparedTarget.recipientUserId) logError(`discord approvals: failed to send message to user ${preparedTarget.recipientUserId}`);
@@ -443,4 +448,4 @@ const discordApprovalNativeRuntime = createChannelApprovalNativeRuntimeAdapter({
 	}
 });
 //#endregion
-export { approval_handler_runtime_exports as t };
+export { discordApprovalNativeRuntime };

package/dist/approval-message-safety-C-8BL6Kv.js

@@ -0,0 +1,47 @@
+//#region extensions/discord/src/approval-message-safety.ts
+const DISCORD_APPROVAL_ALLOWED_MENTIONS = { parse: [] };
+const DISCORD_MARKDOWN_META_CHARACTERS = /* @__PURE__ */ new Set([
+	"\\",
+	"`",
+	"*",
+	"_",
+	"{",
+	"}",
+	"[",
+	"]",
+	"(",
+	")",
+	"<",
+	">",
+	"#",
+	"+",
+	"-",
+	".",
+	"!",
+	"|",
+	"~"
+]);
+function escapeDiscordApprovalDisplayCharacter(character) {
+	if (character === "\n") return "\\n";
+	if (character === "\r") return "\\r";
+	if (character === "	") return "\\t";
+	const codePoint = character.codePointAt(0) ?? 0;
+	if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint === 8232 || codePoint === 8233) return `\\u{${codePoint.toString(16).padStart(4, "0")}}`;
+	return DISCORD_MARKDOWN_META_CHARACTERS.has(character) ? `\\${character}` : character;
+}
+/** Keep opaque approval metadata bounded, single-line, and inert in Discord Markdown. */
+function formatDiscordApprovalDisplayValue(value, maxChars = 200) {
+	const limit = Number.isFinite(maxChars) ? Math.max(0, Math.trunc(maxChars)) : 200;
+	const escapedParts = Array.from(value, escapeDiscordApprovalDisplayCharacter);
+	const escaped = escapedParts.join("");
+	if (escaped.length <= limit) return escaped;
+	if (limit <= 3) return ".".repeat(limit);
+	let bounded = "";
+	for (const part of escapedParts) {
+		if (bounded.length + part.length > limit - 3) break;
+		bounded += part;
+	}
+	return `${bounded}...`;
+}
+//#endregion
+export { formatDiscordApprovalDisplayValue as n, DISCORD_APPROVAL_ALLOWED_MENTIONS as t };