@openclaw/discord 2026.7.2-beta.2 → 2026.7.2-beta.4

package/dist/{account-inspect-dFV0JrnR.js → account-inspect-Dztmn4J4.js}

@@ -1,4 +1,4 @@
-import { a as mergeDiscordAccountConfig, l as resolveDiscordAccountConfig, o as resolveDefaultDiscordAccountId } from "./accounts-CMd4nzLB.js";
+import { a as mergeDiscordAccountConfig, l as resolveDiscordAccountConfig, o as resolveDefaultDiscordAccountId } from "./accounts-D2LKPukU.js";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { hasConfiguredSecretInput, normalizeSecretInputString } from "openclaw/plugin-sdk/secret-input";

package/dist/account-inspect-api.js

@@ -1,4 +1,4 @@
-import { t as inspectDiscordAccount } from "./account-inspect-dFV0JrnR.js";
+import { t as inspectDiscordAccount } from "./account-inspect-Dztmn4J4.js";
 //#region extensions/discord/account-inspect-api.ts
 function inspectDiscordReadOnlyAccount(cfg, accountId) {
 	return inspectDiscordAccount({

package/dist/{accounts-CMd4nzLB.js → accounts-D2LKPukU.js}

@@ -1,6 +1,6 @@
 import { createAccountActionGate, createAccountListHelpers, resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-helpers";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
-import { mapAllowFromEntries, normalizeChannelDmPolicy, resolveChannelDmAllowFrom, resolveChannelDmPolicy } from "openclaw/plugin-sdk/channel-config-helpers";
+import { mapAllowFromEntries, normalizeChannelDmPolicy } from "openclaw/plugin-sdk/channel-config-helpers";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, normalizeAccountId as normalizeAccountId$1, resolveAccountEntry } from "openclaw/plugin-sdk/routing";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { getRuntimeConfigSnapshot, getRuntimeConfigSourceSnapshot, selectApplicableRuntimeConfig } from "openclaw/plugin-sdk/runtime-config-snapshot";
@@ -120,21 +120,14 @@ function resolveDiscordAccountAllowFrom(params) {
 	const accountId = normalizeAccountId(params.accountId ?? resolveDefaultDiscordAccountId(params.cfg));
 	const accountConfig = resolveDiscordAccountConfig(params.cfg, accountId);
 	const rootConfig = params.cfg.channels?.discord;
-	const allowFrom = resolveChannelDmAllowFrom({
-		account: accountConfig,
-		parent: rootConfig
-	});
+	const allowFrom = accountConfig?.allowFrom ?? rootConfig?.allowFrom;
 	return allowFrom ? mapAllowFromEntries(allowFrom) : void 0;
 }
 function resolveDiscordAccountDmPolicy(params) {
 	const accountId = normalizeAccountId(params.accountId ?? resolveDefaultDiscordAccountId(params.cfg));
 	const accountConfig = resolveDiscordAccountConfig(params.cfg, accountId);
 	const rootConfig = params.cfg.channels?.discord;
-	return normalizeChannelDmPolicy(resolveChannelDmPolicy({
-		account: accountConfig,
-		parent: rootConfig,
-		defaultPolicy: "pairing"
-	}));
+	return normalizeChannelDmPolicy(accountConfig?.dmPolicy ?? rootConfig?.dmPolicy ?? "pairing");
 }
 function createDiscordActionGate(params) {
 	const accountId = normalizeAccountId(params.accountId ?? resolveDefaultDiscordAccountId(params.cfg));

package/dist/action-runtime-api.js

@@ -1,2 +1,2 @@
-import { t as handleDiscordAction } from "./runtime-BsefAQ9q.js";
+import { t as handleDiscordAction } from "./runtime-D-6AugWA.js";
 export { handleDiscordAction };

package/dist/{activities-api-D0D_87n3.js → activities-api-8TMGXUH4.js}

@@ -1,38 +1,19 @@
-import { f as resolveDiscordChannelId$1 } from "./chunk-CHpY_lsO.js";
-import { n as isDiscordAccountEnabledForRuntime, r as listDiscordAccountIds, s as resolveDiscordAccount } from "./accounts-CMd4nzLB.js";
-import { i as resolveDiscordActivitiesConfig, r as setDiscordActivitiesRuntime, t as DiscordActivitiesRuntime } from "./runtime-CCf5nkV3.js";
-import { a as buildDiscordPresentationComponents, x as parseDiscordActivityCustomId } from "./outbound-session-route-D4QqePZN.js";
-import { r as normalizeDiscordAllowList, t as allowListMatches } from "./allow-list-B7qOH5xu.js";
-import { r as sendDiscordComponentMessage } from "./send.components-CCRW54gK.js";
+import { u as resolveDiscordChannelId$1 } from "./chunk-BrZocpfs.js";
+import { n as isDiscordAccountEnabledForRuntime, r as listDiscordAccountIds, s as resolveDiscordAccount } from "./accounts-D2LKPukU.js";
+import { i as resolveDiscordActivitiesConfig, r as setDiscordActivitiesRuntime, t as DiscordActivitiesRuntime } from "./runtime-TwM8IrZU.js";
+import { S as parseDiscordActivityCustomId, a as buildDiscordPresentationComponents } from "./outbound-session-route-D_nc_Ayk.js";
+import { r as sendDiscordComponentMessage } from "./send.components-V7cyCKbH.js";
 import fs from "node:fs/promises";
 import { logError } from "openclaw/plugin-sdk/logging-core";
 import { resolveRequestClientIp } from "openclaw/plugin-sdk/webhook-ingress";
+import { WEBHOOK_BODY_READ_DEFAULTS, readJsonBodyWithLimit } from "openclaw/plugin-sdk/webhook-request-guards";
 import { randomBytes } from "node:crypto";
 import { Type } from "typebox";
-import { isDangerousNameMatchingEnabled } from "openclaw/plugin-sdk/dangerous-name-runtime";
 import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
 import { fetchWithSsrFGuard as fetchWithSsrFGuard$1 } from "openclaw/plugin-sdk/ssrf-runtime";
 import { jsonResult, readStringParam } from "openclaw/plugin-sdk/channel-actions";
 import { escapeHtml } from "openclaw/plugin-sdk/text-utility-runtime";
 import { WidgetHtmlInputError, assertWidgetHtmlSize, isCompleteHtmlDocument } from "openclaw/plugin-sdk/widget-html";
-//#region extensions/discord/src/activities/allowlist.ts
-const ACTIVITY_ALLOWLIST_PREFIXES = [
-	"discord:",
-	"user:",
-	"pk:"
-];
-function resolveActivityUserAuthorized(account, user) {
-	const allowList = normalizeDiscordAllowList([...account.allowFrom ?? [], ...account.dm?.allowFrom ?? []], ACTIVITY_ALLOWLIST_PREFIXES);
-	if (!allowList) return (account.dmPolicy ?? account.dm?.policy) === "open";
-	const discriminator = user.discriminator?.trim();
-	const tag = user.username && discriminator && discriminator !== "0" ? `${user.username}#${discriminator}` : user.username;
-	return allowListMatches(allowList, {
-		id: user.id,
-		name: user.username,
-		tag
-	}, { allowNameMatching: isDangerousNameMatchingEnabled(account) });
-}
-//#endregion
 //#region extensions/discord/src/activities/discord-api.ts
 const DISCORD_TOKEN_URL = "https://discord.com/api/oauth2/token";
 const DISCORD_USER_URL = "https://discord.com/api/v10/users/@me";
@@ -62,10 +43,13 @@ async function fetchDiscordJson(params) {
 		timeoutMs: 15e3
 	});
 	try {
-		if (!response.ok) return {
-			ok: false,
-			status: response.status
-		};
+		if (!response.ok) {
+			await response.body?.cancel().catch(() => void 0);
+			return {
+				ok: false,
+				status: response.status
+			};
+		}
 		return {
 			ok: true,
 			status: response.status,
@@ -137,6 +121,8 @@ var TokenRateLimiter = class {
 //#endregion
 //#region extensions/discord/src/activities/shell.ts
 const DISCORD_ACTIVITY_ROUTE_PREFIX = "/discord/activity";
+const DISCORD_ACTIVITY_TOKEN_REQUEST_TIMEOUT_MS = 35e3;
+const DISCORD_ACTIVITY_WIDGET_REQUEST_TIMEOUT_MS = 2e4;
 const DISCORD_ACTIVITY_SHELL_CSP = "default-src 'none'; script-src 'self'; style-src 'unsafe-inline'; connect-src 'self'; frame-src 'self'; img-src data:; base-uri 'none'; frame-ancestors *";
 const DISCORD_ACTIVITY_SHELL_HTML = `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
@@ -149,6 +135,8 @@ h1{font-size:18px;margin:0 0 8px;color:#f2f3f5}p{margin:0;color:#b5bac1;line-hei
 <script type="module" src="./shell.js"><\/script></body></html>`;
 const DISCORD_ACTIVITY_SHELL_JS = `import { DiscordSDK } from "./vendor/embedded-app-sdk.mjs";
 
+const tokenRequestTimeoutMs = ${DISCORD_ACTIVITY_TOKEN_REQUEST_TIMEOUT_MS};
+const widgetRequestTimeoutMs = ${DISCORD_ACTIVITY_WIDGET_REQUEST_TIMEOUT_MS};
 const app = document.querySelector("#app");
 function show(message, detail) {
   app.className = "";
@@ -174,7 +162,15 @@ function proxiedDocUrl(value) {
   return url.pathname + url.search;
 }
 async function readJson(response) {
-  const body = await response.json().catch(() => ({}));
+  let body;
+  try {
+    body = await response.json();
+  } catch (error) {
+    // Error responses may legitimately omit JSON details; successful responses must not
+    // turn an aborted or malformed body into an apparently valid empty payload.
+    if (response.ok) throw error;
+    body = {};
+  }
   if (!response.ok) {
     const error = new Error(typeof body.error === "string" ? body.error : "request failed");
     error.status = response.status;
@@ -182,6 +178,17 @@ async function readJson(response) {
   }
   return body;
 }
+async function fetchJsonWithDeadline(input, init, timeoutMs) {
+  // Activities also run in mobile webviews; avoid requiring the newer
+  // AbortSignal.timeout() static API just to enforce this request boundary.
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await readJson(await fetch(input, { ...init, signal: controller.signal }));
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 async function run() {
   const match = window.location.hostname.match(/^(\\d+)\\.discordsays\\.com$/i);
   if (!match) {
@@ -198,19 +205,25 @@ async function run() {
     prompt: "none",
     scope: ["identify"],
   });
-  const auth = await readJson(await fetch("./api/token", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ code }),
-  }));
+  const auth = await fetchJsonWithDeadline(
+    "./api/token",
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ code }),
+    },
+    tokenRequestTimeoutMs,
+  );
   await sdk.commands.authenticate({ access_token: auth.access_token });
   const query = new URLSearchParams({
     custom_id: sdk.customId ?? "",
     instance_id: sdk.instanceId,
   });
-  const widget = await readJson(await fetch("./api/widget?" + query, {
-    headers: { Authorization: "Bearer " + auth.session_token },
-  }));
+  const widget = await fetchJsonWithDeadline(
+    "./api/widget?" + query,
+    { headers: { Authorization: "Bearer " + auth.session_token } },
+    widgetRequestTimeoutMs,
+  );
   app.className = "widget";
   app.innerHTML = "";
   const bar = document.createElement("div");
@@ -225,9 +238,7 @@ async function run() {
   app.append(bar, frame);
 }
 run().catch((error) => {
-  if (error?.status === 403) {
-    show("Not authorized", "This Discord account is not allowed to open this widget.");
-  } else if (error?.status === 404) {
+  if (error?.status === 404) {
     show("Widget unavailable", "No widget could be resolved for this channel.");
   } else {
     show("Gateway offline", "The OpenClaw gateway could not load this widget. Try again shortly.");
@@ -259,22 +270,6 @@ function respondJson(res, statusCode, body) {
 function notFound(res, widgetDocument = false) {
 	return respond(res, 404, "not found", "text/plain; charset=utf-8", widgetDocument ? { "Content-Security-Policy": DISCORD_ACTIVITY_WIDGET_CSP } : void 0);
 }
-async function readJsonBody(req) {
-	const chunks = [];
-	let total = 0;
-	for await (const chunk of req) {
-		const data = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-		total += data.byteLength;
-		if (total > BODY_MAX_BYTES) return null;
-		chunks.push(data);
-	}
-	try {
-		const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
-}
 function readHeader(req, name) {
 	const value = req.headers[name];
 	return Array.isArray(value) ? value[0] : value;
@@ -300,6 +295,7 @@ function createDiscordActivityHttpHandler(deps) {
 	const limiter = new TokenRateLimiter(deps.now ?? Date.now);
 	const readVendorAsset = deps.readVendorAsset ?? ((assetPath) => fs.readFile(assetPath));
 	const reportError = deps.logError ?? logError;
+	const bodyTimeoutMs = deps.bodyTimeoutMs ?? WEBHOOK_BODY_READ_DEFAULTS.preAuth.timeoutMs;
 	let vendorAsset;
 	let pendingLaunchFailureLogged = false;
 	function logPendingLaunchFailure(error) {
@@ -314,7 +310,13 @@ function createDiscordActivityHttpHandler(deps) {
 		const applicationId = extractApplicationId(req);
 		const account = deps.runtime.resolveHttpAccount(applicationId);
 		if (!account) return respondJson(res, 503, { error: "Discord Activities is not fully configured" });
-		const body = await readJsonBody(req);
+		const bodyResult = await readJsonBodyWithLimit(req, {
+			maxBytes: BODY_MAX_BYTES,
+			timeoutMs: bodyTimeoutMs,
+			emptyObjectOnEmpty: true
+		});
+		if (!bodyResult.ok && bodyResult.code === "REQUEST_BODY_TIMEOUT") return respondJson(res, 408, { error: "request body timeout" });
+		const body = bodyResult.ok && bodyResult.value && typeof bodyResult.value === "object" && !Array.isArray(bodyResult.value) ? bodyResult.value : null;
 		const code = typeof body?.code === "string" ? body.code.trim() : "";
 		if (!code) return respondJson(res, 401, { error: "invalid authorization code" });
 		const reservation = limiter.reserveGlobal();
@@ -356,18 +358,10 @@ function createDiscordActivityHttpHandler(deps) {
 			} catch {
 				return respondJson(res, 503, { error: "Discord user lookup unavailable" });
 			}
-			const user = {
-				id: typeof userResponse.body?.id === "string" ? userResponse.body.id : void 0,
-				username: typeof userResponse.body?.username === "string" ? userResponse.body.username : void 0,
-				discriminator: typeof userResponse.body?.discriminator === "string" ? userResponse.body.discriminator : void 0
-			};
-			if (!userResponse.ok || !user.id) return respondJson(res, 401, { error: "Discord user lookup failed" });
-			if (!resolveActivityUserAuthorized(account.config, {
-				...user,
-				id: user.id
-			})) return respondJson(res, 403, { error: "Discord user is not allowlisted" });
+			const discordUserId = typeof userResponse.body?.id === "string" ? userResponse.body.id : void 0;
+			if (!userResponse.ok || !discordUserId) return respondJson(res, 401, { error: "Discord user lookup failed" });
 			const minted = await deps.runtime.store.createSession({
-				discordUserId: user.id,
+				discordUserId,
 				accountId: account.accountId
 			});
 			completed = true;

package/dist/activities-api.js

@@ -1,2 +1,2 @@
-import { t as registerDiscordActivities } from "./activities-api-D0D_87n3.js";
+import { t as registerDiscordActivities } from "./activities-api-8TMGXUH4.js";
 export { registerDiscordActivities };

package/dist/{allow-list-B7qOH5xu.js → allow-list-DzKrtfah.js}

@@ -1,5 +1,6 @@
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildChannelKeyCandidates, resolveChannelEntryMatchWithFallback, resolveChannelMatchConfig } from "openclaw/plugin-sdk/channel-targets";
+import { resolveAllowlistMatchByCandidates } from "openclaw/plugin-sdk/allow-from";
 //#region extensions/discord/src/monitor/format.ts
 function resolveDiscordSystemLocation(params) {
 	const { isDirectMessage, isGroupDm, guild, channelName } = params;
@@ -342,13 +343,23 @@ function resolveDiscordChannelPolicyCommandAuthorizer(params) {
 function resolveGroupDmAllow(params) {
 	const { channels, channelId, channelName, channelSlug } = params;
 	if (!channels || channels.length === 0) return true;
-	const allowList = new Set(channels.map((entry) => normalizeDiscordSlug(entry)));
-	const candidates = [
-		normalizeDiscordSlug(channelId),
-		channelSlug,
-		channelName ? normalizeDiscordSlug(channelName) : ""
-	].filter(Boolean);
-	return allowList.has("*") || candidates.some((candidate) => allowList.has(candidate));
+	return resolveAllowlistMatchByCandidates({
+		allowList: channels.map((entry) => normalizeDiscordSlug(entry)),
+		candidates: [
+			{
+				value: normalizeDiscordSlug(channelId),
+				source: "id"
+			},
+			{
+				value: channelSlug,
+				source: "slug"
+			},
+			{
+				value: channelName ? normalizeDiscordSlug(channelName) : void 0,
+				source: "name"
+			}
+		]
+	}).allowed;
 }
 function shouldEmitDiscordReactionNotification(params) {
 	const mode = params.mode ?? "own";

package/dist/{api-B88T4rFN.js → api-C43z8vUm.js}

@@ -4,6 +4,7 @@ import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtim
 import { parseRetryAfterHeaderSeconds, resolveRetryConfig, retryAsync } from "openclaw/plugin-sdk/retry-runtime";
 import { readResponseTextLimited } from "openclaw/plugin-sdk/provider-http";
 import { resolveFetch } from "openclaw/plugin-sdk/fetch-runtime";
+import { sleepWithAbort } from "openclaw/plugin-sdk/runtime-env";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/discord/src/error-body.ts
 const DISCORD_RESPONSE_BODY_SUMMARY_MAX_CHARS = 240;
@@ -139,7 +140,8 @@ async function requestDiscord(path, token, options) {
 		...retryConfig,
 		label: options?.label ?? path,
 		shouldRetry: (err) => err instanceof DiscordApiError && err.status === 429,
-		retryAfterMs: (err) => getDiscordApiRetryAfterMs(err, retryConfig)
+		retryAfterMs: (err) => getDiscordApiRetryAfterMs(err, retryConfig),
+		sleep: (ms) => sleepWithAbort(ms, options?.signal)
 	});
 }
 async function fetchDiscord(path, token, fetcher = fetch, options) {

package/dist/api.js

@@ -1,23 +1,32 @@
-import { c as looksLikeDiscordTargetId, d as parseDiscordTarget, f as resolveDiscordChannelId, l as normalizeDiscordMessagingTarget, u as normalizeDiscordOutboundTarget } from "./chunk-CHpY_lsO.js";
-import { a as mergeDiscordAccountConfig, f as resolveDiscordMaxLinesPerMessage, i as listEnabledDiscordAccounts, l as resolveDiscordAccountConfig, o as resolveDefaultDiscordAccountId, r as listDiscordAccountIds, s as resolveDiscordAccount, t as createDiscordActionGate } from "./accounts-CMd4nzLB.js";
-import { C as parseDiscordComponentCustomId, E as parseDiscordModalCustomIdForInteraction, T as parseDiscordModalCustomId, _ as DISCORD_MODAL_CUSTOM_ID_KEY, b as buildDiscordModalCustomId, d as buildDiscordComponentMessage, f as buildDiscordComponentMessageFlags, g as DISCORD_COMPONENT_CUSTOM_ID_KEY, h as resolveDiscordComponentAttachmentName, i as buildDiscordInteractiveComponents, l as DiscordFormModal, m as readDiscordComponentSpec, p as DISCORD_COMPONENT_ATTACHMENT_PREFIX, r as formatDiscordComponentEventText, u as createDiscordFormModal, w as parseDiscordComponentCustomIdForInteraction, y as buildDiscordComponentCustomId } from "./outbound-session-route-D4QqePZN.js";
-import { i as requestDiscord, n as DiscordApiError, r as fetchDiscord } from "./api-B88T4rFN.js";
-import { i as parseDiscordSendTarget, n as resolveDiscordTarget } from "./target-resolver-BaEmTxeK.js";
-import { t as inspectDiscordAccount } from "./account-inspect-dFV0JrnR.js";
-import { i as DISCORD_DEFAULT_LISTENER_TIMEOUT_MS, n as DISCORD_ATTACHMENT_TOTAL_TIMEOUT_MS, o as mergeAbortSignals, r as DISCORD_DEFAULT_INBOUND_WORKER_TIMEOUT_MS, t as DISCORD_ATTACHMENT_IDLE_TIMEOUT_MS } from "./timeouts-D5lWili0.js";
-import "./targets-fjJt3PYG.js";
-import { a as isDiscordExecApprovalClientEnabled, i as isDiscordExecApprovalApprover, o as shouldSuppressLocalDiscordExecApprovalPrompt, r as getDiscordExecApprovalApprovers } from "./conversation-identity-BPcbhCAH.js";
-import { i as resolveDiscordGroupToolPolicy, n as collectDiscordStatusIssues, r as resolveDiscordGroupRequireMention, t as discordPlugin } from "./channel-BDfKr14H.js";
+import { c as normalizeDiscordOutboundTarget, l as parseDiscordTarget, o as looksLikeDiscordTargetId, s as normalizeDiscordMessagingTarget, u as resolveDiscordChannelId } from "./chunk-BrZocpfs.js";
+import { a as mergeDiscordAccountConfig, f as resolveDiscordMaxLinesPerMessage, i as listEnabledDiscordAccounts, l as resolveDiscordAccountConfig, o as resolveDefaultDiscordAccountId, r as listDiscordAccountIds, s as resolveDiscordAccount, t as createDiscordActionGate } from "./accounts-D2LKPukU.js";
+import { D as parseDiscordModalCustomIdForInteraction, E as parseDiscordModalCustomId, T as parseDiscordComponentCustomIdForInteraction, _ as DISCORD_COMPONENT_CUSTOM_ID_KEY, b as buildDiscordComponentCustomId, d as createDiscordFormModal, f as buildDiscordComponentMessage, g as resolveDiscordComponentAttachmentName, h as readDiscordComponentSpec, i as buildDiscordInteractiveComponents, m as DISCORD_COMPONENT_ATTACHMENT_PREFIX, p as buildDiscordComponentMessageFlags, r as formatDiscordComponentEventText, u as DiscordFormModal, v as DISCORD_MODAL_CUSTOM_ID_KEY, w as parseDiscordComponentCustomId, x as buildDiscordModalCustomId } from "./outbound-session-route-D_nc_Ayk.js";
+import { i as requestDiscord, n as DiscordApiError, r as fetchDiscord } from "./api-C43z8vUm.js";
+import { i as parseDiscordSendTarget, n as resolveDiscordTarget } from "./target-resolver-Bo1oWLPO.js";
+import { t as inspectDiscordAccount } from "./account-inspect-Dztmn4J4.js";
+import { i as DISCORD_DEFAULT_LISTENER_TIMEOUT_MS, n as DISCORD_ATTACHMENT_TOTAL_TIMEOUT_MS, r as DISCORD_DEFAULT_INBOUND_WORKER_TIMEOUT_MS, t as DISCORD_ATTACHMENT_IDLE_TIMEOUT_MS } from "./timeouts-B9cy6RvQ.js";
+import "./targets-CB8ahjZk.js";
+import { a as getDiscordExecApprovalApprovers, c as shouldSuppressLocalDiscordExecApprovalPrompt, o as isDiscordExecApprovalApprover, s as isDiscordExecApprovalClientEnabled } from "./approval-message-safety-LyND6GR3.js";
+import { i as resolveDiscordGroupToolPolicy, n as collectDiscordStatusIssues, r as resolveDiscordGroupRequireMention, t as discordPlugin } from "./channel-yq-so4jJ.js";
 import { t as normalizeExplicitDiscordSessionKey } from "./session-key-normalization-wJgsKPNF.js";
-import { t as discordSetupPlugin } from "./channel.setup-BS4gd8sc.js";
-import { n as handleDiscordSubagentEnded, r as handleDiscordSubagentSpawning, t as handleDiscordSubagentDeliveryTarget } from "./subagent-hooks-mSxRv4AE.js";
-import { t as tryHandleDiscordMessageActionGuildAdmin } from "./handle-action.guild-admin-LYY75_Oa.js";
-import { n as listDiscordDirectoryGroupsFromConfig, r as listDiscordDirectoryPeersFromConfig } from "./directory-config-G1QwBIdi.js";
-import { t as fetchPluralKitMessageInfo } from "./pluralkit-r4wiI2yy.js";
-import { a as resolveDiscordPrivilegedIntentsFromFlags, i as probeDiscord, n as fetchDiscordApplicationSummary, r as parseApplicationIdFromToken, t as fetchDiscordApplicationId } from "./probe-WKeTYyJX.js";
-import { t as collectDiscordSecurityAuditFindings } from "./security-audit-aLbWmUjl.js";
+import { t as discordSetupPlugin } from "./channel.setup-Tn_O2B7F.js";
+import { n as handleDiscordSubagentEnded, r as handleDiscordSubagentSpawning, t as handleDiscordSubagentDeliveryTarget } from "./subagent-hooks-kFyJQ-MK.js";
+import { t as tryHandleDiscordMessageActionGuildAdmin } from "./handle-action.guild-admin-DikBWer5.js";
+import { n as listDiscordDirectoryGroupsFromConfig, r as listDiscordDirectoryPeersFromConfig } from "./directory-config-DF85-bUY.js";
+import { t as fetchPluralKitMessageInfo } from "./pluralkit-CCovPs9s.js";
+import { a as resolveDiscordPrivilegedIntentsFromFlags, i as probeDiscord, n as fetchDiscordApplicationSummary, r as parseApplicationIdFromToken, t as fetchDiscordApplicationId } from "./probe-Bci2pS8M.js";
+import { t as collectDiscordSecurityAuditFindings } from "./security-audit-njzOejQp.js";
 import { resolveOpenProviderRuntimeGroupPolicy as resolveDiscordRuntimeGroupPolicy } from "openclaw/plugin-sdk/runtime-group-policy";
 //#region extensions/discord/api.ts
-const handleDiscordMessageAction = async (...args) => (await import("./channel-actions.runtime-CC4QwYVO.js")).handleDiscordMessageAction(...args);
+const handleDiscordMessageAction = async (...args) => (await import("./channel-actions.runtime-CgJy35O0.js")).handleDiscordMessageAction(...args);
+/**
+* @deprecated Shipped `@openclaw/discord/api` compatibility only. Use native
+* `AbortSignal.any` after filtering optional signals. Removal with the next
+* plugin-SDK major.
+*/
+function mergeAbortSignals(signals) {
+	const activeSignals = signals.filter((signal) => Boolean(signal));
+	return activeSignals.length > 1 ? AbortSignal.any(activeSignals) : activeSignals[0];
+}
 //#endregion
 export { DISCORD_ATTACHMENT_IDLE_TIMEOUT_MS, DISCORD_ATTACHMENT_TOTAL_TIMEOUT_MS, DISCORD_COMPONENT_ATTACHMENT_PREFIX, DISCORD_COMPONENT_CUSTOM_ID_KEY, DISCORD_DEFAULT_INBOUND_WORKER_TIMEOUT_MS, DISCORD_DEFAULT_LISTENER_TIMEOUT_MS, DISCORD_MODAL_CUSTOM_ID_KEY, DiscordApiError, DiscordFormModal, buildDiscordComponentCustomId, buildDiscordComponentMessage, buildDiscordComponentMessageFlags, buildDiscordInteractiveComponents, buildDiscordModalCustomId, collectDiscordSecurityAuditFindings, collectDiscordStatusIssues, createDiscordActionGate, createDiscordFormModal, discordPlugin, discordSetupPlugin, fetchDiscord, fetchDiscordApplicationId, fetchDiscordApplicationSummary, fetchPluralKitMessageInfo, formatDiscordComponentEventText, getDiscordExecApprovalApprovers, handleDiscordMessageAction, handleDiscordSubagentDeliveryTarget, handleDiscordSubagentEnded, handleDiscordSubagentSpawning, inspectDiscordAccount, isDiscordExecApprovalApprover, isDiscordExecApprovalClientEnabled, listDiscordAccountIds, listDiscordDirectoryGroupsFromConfig, listDiscordDirectoryPeersFromConfig, listEnabledDiscordAccounts, looksLikeDiscordTargetId, mergeAbortSignals, mergeDiscordAccountConfig, normalizeDiscordMessagingTarget, normalizeDiscordOutboundTarget, normalizeExplicitDiscordSessionKey, parseApplicationIdFromToken, parseDiscordComponentCustomId, parseDiscordComponentCustomIdForInteraction as parseDiscordComponentCustomIdForCarbon, parseDiscordComponentCustomIdForInteraction, parseDiscordModalCustomId, parseDiscordModalCustomIdForInteraction as parseDiscordModalCustomIdForCarbon, parseDiscordModalCustomIdForInteraction, parseDiscordSendTarget, parseDiscordTarget, probeDiscord, readDiscordComponentSpec, requestDiscord, resolveDefaultDiscordAccountId, resolveDiscordAccount, resolveDiscordAccountConfig, resolveDiscordChannelId, resolveDiscordComponentAttachmentName, resolveDiscordGroupRequireMention, resolveDiscordGroupToolPolicy, resolveDiscordMaxLinesPerMessage, resolveDiscordPrivilegedIntentsFromFlags, resolveDiscordRuntimeGroupPolicy, resolveDiscordTarget, shouldSuppressLocalDiscordExecApprovalPrompt, tryHandleDiscordMessageActionGuildAdmin };

package/dist/{approval-handler.runtime-B7E1-x5q.js → approval-handler.runtime-ClZpan85.js}

@@ -1,10 +1,8 @@
-import { J as Container, K as Button, bt as editChannelMessage, et as Row, ht as createChannelMessage, it as TextDisplay, nt as Separator, ut as createUserDmChannel, vt as deleteChannelMessage, z as serializePayload } from "./chunk-CHpY_lsO.js";
-import { s as buildExecApprovalCustomId } from "./outbound-session-route-D4QqePZN.js";
-import { P as createDiscordClient, b as stripUndefinedFields, g as createDiscordMessageNonce } from "./send.shared-XuOTO1dW.js";
-import { t as inspectDiscordAccount } from "./account-inspect-dFV0JrnR.js";
-import { a as isDiscordExecApprovalClientEnabled } from "./conversation-identity-BPcbhCAH.js";
-import { a as shouldHandleDiscordApprovalRequest } from "./channel-BDfKr14H.js";
-import { n as formatDiscordApprovalDisplayValue, t as DISCORD_APPROVAL_ALLOWED_MENTIONS } from "./approval-message-safety-C-8BL6Kv.js";
+import { K as Container, L as serializePayload, Q as Row, W as Button, ct as createUserDmChannel, et as Separator, gt as deleteChannelMessage, nt as TextDisplay, pt as createChannelMessage, vt as editChannelMessage } from "./chunk-BrZocpfs.js";
+import { c as buildExecApprovalCustomId } from "./outbound-session-route-D_nc_Ayk.js";
+import { P as createDiscordClient, b as stripUndefinedFields, g as createDiscordMessageNonce } from "./send.shared-Dfacnk-E.js";
+import { n as formatDiscordApprovalDisplayValue, s as isDiscordExecApprovalClientEnabled, t as DISCORD_APPROVAL_ALLOWED_MENTIONS } from "./approval-message-safety-LyND6GR3.js";
+import { a as shouldHandleDiscordApprovalRequest } from "./channel-yq-so4jJ.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { logDebug, logError } from "openclaw/plugin-sdk/logging-core";
 import { ButtonStyle } from "discord-api-types/v10";
@@ -18,11 +16,8 @@ function normalizeDiscordAccentColor(raw) {
 	if (!/^#[0-9a-fA-F]{6}$/.test(normalized)) return null;
 	return normalized.toUpperCase();
 }
-function resolveDiscordAccentColor(params) {
-	return normalizeDiscordAccentColor(inspectDiscordAccount({
-		cfg: params.cfg,
-		accountId: params.accountId
-	}).config.ui?.components?.accentColor) ?? DEFAULT_DISCORD_ACCENT_COLOR;
+function resolveDiscordAccentColor(_params) {
+	return DEFAULT_DISCORD_ACCENT_COLOR;
 }
 //#endregion
 //#region extensions/discord/src/ui.ts

package/dist/{conversation-identity-BPcbhCAH.js → approval-message-safety-LyND6GR3.js}

@@ -1,5 +1,5 @@
-import { d as parseDiscordTarget } from "./chunk-CHpY_lsO.js";
-import { s as resolveDiscordAccount } from "./accounts-CMd4nzLB.js";
+import { l as parseDiscordTarget } from "./chunk-BrZocpfs.js";
+import { s as resolveDiscordAccount } from "./accounts-D2LKPukU.js";
 import { normalizeOptionalLowercaseString, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createChannelApproverDmTargetResolver, createChannelNativeOriginTargetResolver } from "openclaw/plugin-sdk/approval-native-runtime";
 import { getExecApprovalReplyMetadata, isChannelExecApprovalClientEnabledFromConfig, matchesApprovalRequestFilters } from "openclaw/plugin-sdk/approval-client-runtime";
@@ -91,4 +91,50 @@ function resolveDiscordCurrentConversationIdentity(params) {
 	}
 }
 //#endregion
-export { isDiscordExecApprovalClientEnabled as a, createChannelApproverDmTargetResolver as c, matchesApprovalRequestFilters as d, isDiscordExecApprovalApprover as i, createChannelNativeOriginTargetResolver as l, resolveDiscordCurrentConversationIdentity as n, shouldSuppressLocalDiscordExecApprovalPrompt as o, getDiscordExecApprovalApprovers as r, createApproverRestrictedNativeApprovalCapability as s, resolveDiscordConversationIdentity as t, isChannelExecApprovalClientEnabledFromConfig as u };
+//#region extensions/discord/src/approval-message-safety.ts
+const DISCORD_APPROVAL_ALLOWED_MENTIONS = { parse: [] };
+const DISCORD_MARKDOWN_META_CHARACTERS = /* @__PURE__ */ new Set([
+	"\\",
+	"`",
+	"*",
+	"_",
+	"{",
+	"}",
+	"[",
+	"]",
+	"(",
+	")",
+	"<",
+	">",
+	"#",
+	"+",
+	"-",
+	".",
+	"!",
+	"|",
+	"~"
+]);
+function escapeDiscordApprovalDisplayCharacter(character) {
+	if (character === "\n") return "\\n";
+	if (character === "\r") return "\\r";
+	if (character === "	") return "\\t";
+	const codePoint = character.codePointAt(0) ?? 0;
+	if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint === 8232 || codePoint === 8233) return `\\u{${codePoint.toString(16).padStart(4, "0")}}`;
+	return DISCORD_MARKDOWN_META_CHARACTERS.has(character) ? `\\${character}` : character;
+}
+/** Keep opaque approval metadata bounded, single-line, and inert in Discord Markdown. */
+function formatDiscordApprovalDisplayValue(value, maxChars = 200) {
+	const limit = Number.isFinite(maxChars) ? Math.max(0, Math.trunc(maxChars)) : 200;
+	const escapedParts = Array.from(value, escapeDiscordApprovalDisplayCharacter);
+	const escaped = escapedParts.join("");
+	if (escaped.length <= limit) return escaped;
+	if (limit <= 3) return ".".repeat(limit);
+	let bounded = "";
+	for (const part of escapedParts) {
+		if (bounded.length + part.length > limit - 3) break;
+		bounded += part;
+	}
+	return `${bounded}...`;
+}
+//#endregion
+export { getDiscordExecApprovalApprovers as a, shouldSuppressLocalDiscordExecApprovalPrompt as c, createChannelNativeOriginTargetResolver as d, isChannelExecApprovalClientEnabledFromConfig as f, resolveDiscordCurrentConversationIdentity as i, createApproverRestrictedNativeApprovalCapability as l, formatDiscordApprovalDisplayValue as n, isDiscordExecApprovalApprover as o, matchesApprovalRequestFilters as p, resolveDiscordConversationIdentity as r, isDiscordExecApprovalClientEnabled as s, DISCORD_APPROVAL_ALLOWED_MENTIONS as t, createChannelApproverDmTargetResolver as u };

package/dist/{audit-CjpnY1yb.js → audit-CFfounXC.js}

@@ -1,7 +1,7 @@
-import { Zt as __exportAll } from "./chunk-CHpY_lsO.js";
-import { O as fetchChannelPermissionsDiscord } from "./send.shared-XuOTO1dW.js";
-import { t as inspectDiscordAccount } from "./account-inspect-dFV0JrnR.js";
-import "./send-JJzVo_sK.js";
+import { Yt as __exportAll } from "./chunk-BrZocpfs.js";
+import { O as fetchChannelPermissionsDiscord } from "./send.shared-Dfacnk-E.js";
+import { t as inspectDiscordAccount } from "./account-inspect-Dztmn4J4.js";
+import "./send-CfnXLUXq.js";
 import { n as collectDiscordAuditChannelIdsForAccount, t as auditDiscordChannelPermissionsWithFetcher } from "./audit-core-xwjIczO0.js";
 //#region extensions/discord/src/audit.ts
 var audit_exports = /* @__PURE__ */ __exportAll({

package/dist/{channel-actions-BQct-o4T.js → channel-actions-C8n1zWZ-.js}

@@ -1,6 +1,6 @@
-import { r as listDiscordAccountIds, t as createDiscordActionGate } from "./accounts-CMd4nzLB.js";
-import { m as readDiscordComponentSpec } from "./outbound-session-route-D4QqePZN.js";
-import { t as inspectDiscordAccount } from "./account-inspect-dFV0JrnR.js";
+import { r as listDiscordAccountIds, t as createDiscordActionGate } from "./accounts-D2LKPukU.js";
+import { h as readDiscordComponentSpec } from "./outbound-session-route-D_nc_Ayk.js";
+import { t as inspectDiscordAccount } from "./account-inspect-Dztmn4J4.js";
 import { i as withDiscordInboundEventDeliveryMetadata } from "./inbound-event-delivery-CEPlt2uz.js";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { createUnionActionGate } from "openclaw/plugin-sdk/channel-actions";
@@ -41,7 +41,7 @@ const localExecutionActions = /* @__PURE__ */ new Set([
 function resolveDiscordActionExecutionMode({ action }) {
 	return localExecutionActions.has(action) ? "local" : "gateway";
 }
-const loadDiscordChannelActionsRuntime = createLazyRuntimeModule(() => import("./channel-actions.runtime-CC4QwYVO.js"));
+const loadDiscordChannelActionsRuntime = createLazyRuntimeModule(() => import("./channel-actions.runtime-CgJy35O0.js"));
 function listDiscoverableDiscordAccounts(cfg) {
 	return listDiscordAccountIds(cfg).map((accountId) => inspectDiscordAccount({
 		cfg,

package/dist/{channel-actions.runtime-CC4QwYVO.js → channel-actions.runtime-CgJy35O0.js}

@@ -1,14 +1,14 @@
-import { f as resolveDiscordChannelId } from "./chunk-CHpY_lsO.js";
-import { a as buildDiscordPresentationComponents, i as buildDiscordInteractiveComponents } from "./outbound-session-route-D4QqePZN.js";
-import { a as readDiscordAutoArchiveDurationParam, t as handleDiscordAction } from "./runtime-BsefAQ9q.js";
-import "./targets-fjJt3PYG.js";
+import { u as resolveDiscordChannelId } from "./chunk-BrZocpfs.js";
+import { a as buildDiscordPresentationComponents, i as buildDiscordInteractiveComponents } from "./outbound-session-route-D_nc_Ayk.js";
+import { a as readDiscordAutoArchiveDurationParam, t as handleDiscordAction } from "./runtime-D-6AugWA.js";
+import "./targets-CB8ahjZk.js";
 import "./action-runtime-api.js";
 import { r as notifyDiscordInboundEventOutboundSuccess } from "./inbound-event-delivery-CEPlt2uz.js";
-import { r as isDiscordComponentSpecWithinMessageLimit, t as DISCORD_PRESENTATION_CAPABILITIES } from "./outbound-components-7wAolLuS.js";
-import { t as tryHandleDiscordMessageActionGuildAdmin } from "./handle-action.guild-admin-LYY75_Oa.js";
+import { r as isDiscordComponentSpecWithinMessageLimit, t as DISCORD_PRESENTATION_CAPABILITIES } from "./outbound-components-CTFDDcq5.js";
+import { t as tryHandleDiscordMessageActionGuildAdmin } from "./handle-action.guild-admin-DikBWer5.js";
 import { normalizeOptionalStringifiedId } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { resolveReactionMessageId } from "openclaw/plugin-sdk/channel-actions";
-import { adaptMessagePresentationForChannel, normalizeInteractiveReply, normalizeMessagePresentation, renderMessagePresentationFallbackText } from "openclaw/plugin-sdk/interactive-runtime";
+import { adaptMessagePresentationForChannel, normalizeLegacyInteractiveReply, normalizeMessagePresentation, renderMessagePresentationFallbackText } from "openclaw/plugin-sdk/interactive-runtime";
 import { readBooleanParam } from "openclaw/plugin-sdk/boolean-param";
 import { readPositiveIntegerParam, readStringArrayParam, readStringParam as readStringParam$1 } from "openclaw/plugin-sdk/agent-runtime";
 //#region extensions/discord/src/actions/handle-action.ts
@@ -70,7 +70,7 @@ async function handleDiscordMessageAction(ctx) {
 			includesMedia: Boolean(mediaUrl)
 		}) ? generatedPresentationComponents : void 0;
 		const presentationFellBack = Boolean(generatedPresentationComponents && !presentationComponents);
-		const rawComponents = presentationFellBack ? void 0 : params.components ?? presentationComponents ?? buildDiscordInteractiveComponents(normalizeInteractiveReply(params.interactive));
+		const rawComponents = presentationFellBack ? void 0 : params.components ?? presentationComponents ?? buildDiscordInteractiveComponents(normalizeLegacyInteractiveReply(params.interactive));
 		const hasComponents = Boolean(rawComponents) && (typeof rawComponents === "function" || typeof rawComponents === "object");
 		const components = hasComponents ? rawComponents : void 0;
 		const content = readStringParam$1(params, "message", {

package/dist/channel-config-api.js

@@ -1,2 +1,2 @@
-import { t as DiscordChannelConfigSchema } from "./config-schema-CoDck1GW.js";
+import { t as DiscordChannelConfigSchema } from "./config-schema-D-YrV-5E.js";
 export { DiscordChannelConfigSchema };

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as discordPlugin } from "./channel-BDfKr14H.js";
+import { t as discordPlugin } from "./channel-yq-so4jJ.js";
 export { discordPlugin };