@openclaw/discord 2026.9.3 → 2026.9.5

package/dist/{allow-list-DWEio925.js → .setup/channel-type-DKnjV1XW.mjs}

@@ -1,7 +1,162 @@
+import { ChannelType } from "discord-api-types/v10";
 import { asFiniteNumberInRange, parseDateStringTimestampMs, parseStrictFiniteNumber } from "openclaw/plugin-sdk/number-runtime";
+import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
+import { fetchWithSsrFGuard, isBlockedHostnameOrIp, isLoopbackHost } from "openclaw/plugin-sdk/ssrf-runtime";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildChannelKeyCandidates, resolveChannelEntryMatchWithFallback, resolveChannelMatchConfig } from "openclaw/plugin-sdk/channel-targets";
 import { resolveAllowlistMatchByCandidates } from "openclaw/plugin-sdk/allow-from";
+//#region extensions/discord/src/endpoint-runtime.ts
+const DISCORD_ENDPOINT_RESPONSE_MAX_BYTES = 8388608;
+const DISCORD_API_URL_ENV = "DISCORD_API_URL";
+function parseHttpAnchor(value, label) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error(`${label} must be a valid URL`);
+	}
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHost(url.hostname))) throw new Error(`${label} must use HTTPS or loopback HTTP`);
+	if (url.username || url.password || url.hash) throw new Error(`${label} must not contain credentials or a fragment`);
+	return url;
+}
+function normalizeRestApiBaseUrl(value) {
+	const url = parseHttpAnchor(value, "Discord endpoint REST API base URL");
+	if (url.search) throw new Error("Discord endpoint REST API base URL must not contain a query");
+	url.pathname = url.pathname.replace(/\/+$/u, "") || "/";
+	return url;
+}
+function normalizeGatewayOrigin(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error("Discord endpoint Gateway origin must be a valid URL");
+	}
+	if (url.protocol !== "wss:" && !(url.protocol === "ws:" && isLoopbackHost(url.hostname))) throw new Error("Discord endpoint Gateway origin must use WSS or loopback WS");
+	if (url.protocol === "wss:" && isBlockedHostnameOrIp(url.hostname)) throw new Error("Discord endpoint Gateway origin must not target a private/internal/special-use hostname or IP address");
+	if (url.username || url.password || url.hash || url.pathname !== "/" || url.search) throw new Error("Discord endpoint Gateway origin must be an origin without credentials, path, query, or fragment");
+	return url.origin;
+}
+function resolveDescriptor(apiUrl) {
+	const restApiBaseUrl = normalizeRestApiBaseUrl(apiUrl);
+	const gatewayBotUrl = new URL(`${restApiBaseUrl.pathname.replace(/\/+$/u, "")}/gateway/bot`, restApiBaseUrl.origin);
+	const gatewayOriginUrl = new URL(restApiBaseUrl.origin);
+	gatewayOriginUrl.protocol = gatewayOriginUrl.protocol === "https:" ? "wss:" : "ws:";
+	return Object.freeze({
+		restApiBaseUrl: restApiBaseUrl.toString().replace(/\/$/u, ""),
+		gatewayBotUrl: gatewayBotUrl.toString(),
+		gatewayOrigin: normalizeGatewayOrigin(gatewayOriginUrl.origin)
+	});
+}
+function isWithinRestApiBase(target, restApiBaseUrl) {
+	if (target.origin !== restApiBaseUrl.origin) return false;
+	const basePath = restApiBaseUrl.pathname.replace(/\/+$/u, "");
+	return basePath === "" || target.pathname === basePath || target.pathname.startsWith(`${basePath}/`);
+}
+function assertEndpointHttpTarget(target, descriptor) {
+	const restApiBaseUrl = new URL(descriptor.restApiBaseUrl);
+	const gatewayBotUrl = new URL(descriptor.gatewayBotUrl);
+	if (!isWithinRestApiBase(target, restApiBaseUrl) && target.toString() !== gatewayBotUrl.toString()) throw new Error("Discord endpoint request is outside the configured boundaries");
+}
+function requestInitFromRequest(request, signal) {
+	return {
+		method: request.method,
+		headers: request.headers,
+		...request.body ? {
+			body: request.body,
+			duplex: "half"
+		} : {},
+		signal,
+		cache: request.cache,
+		credentials: request.credentials,
+		integrity: request.integrity,
+		keepalive: request.keepalive,
+		mode: request.mode,
+		referrer: request.referrer,
+		referrerPolicy: request.referrerPolicy
+	};
+}
+function createEndpointFetch(descriptor) {
+	const allowedOrigins = Array.from(/* @__PURE__ */ new Set([new URL(descriptor.restApiBaseUrl).origin, new URL(descriptor.gatewayBotUrl).origin]));
+	return async (input, init, beforeRequest) => {
+		const request = new Request(input, init);
+		const target = new URL(request.url);
+		assertEndpointHttpTarget(target, descriptor);
+		const guarded = await fetchWithSsrFGuard({
+			url: target.toString(),
+			init: requestInitFromRequest(request, request.signal),
+			signal: request.signal,
+			requireHttps: target.protocol === "https:",
+			policy: { allowedOrigins },
+			maxRedirects: 0,
+			capture: false,
+			auditContext: "discord.endpoint-runtime",
+			beforeRequest
+		});
+		try {
+			const body = await readResponseWithLimit(guarded.response, DISCORD_ENDPOINT_RESPONSE_MAX_BYTES, { onOverflow: ({ size, maxBytes }) => /* @__PURE__ */ new Error(`Discord endpoint response too large: ${size} bytes (limit: ${maxBytes} bytes)`) });
+			return new Response(body.byteLength > 0 ? new Uint8Array(body) : null, {
+				status: guarded.response.status,
+				statusText: guarded.response.statusText,
+				headers: guarded.response.headers
+			});
+		} finally {
+			await guarded.release();
+		}
+	};
+}
+/** Resolve the process-wide Discord API override using the same env convention as sibling channels. */
+function getDiscordEndpointRuntime(env = process.env) {
+	const apiUrl = env[DISCORD_API_URL_ENV]?.trim();
+	if (!apiUrl) return;
+	const descriptor = resolveDescriptor(apiUrl);
+	return Object.freeze({
+		descriptor,
+		fetch: createEndpointFetch(descriptor)
+	});
+}
+function resolveDiscordEndpointMediaGuard(url, retainedRuntime) {
+	if (retainedRuntime === null) return;
+	const runtime = retainedRuntime ?? getDiscordEndpointRuntime();
+	if (!runtime) return;
+	const target = parseHttpAnchor(url, "Discord endpoint media URL");
+	const restOrigin = new URL(runtime.descriptor.restApiBaseUrl).origin;
+	if (target.origin !== restOrigin) throw new Error("Discord endpoint media URL is outside the configured REST origin");
+	return {
+		maxRedirects: 0,
+		ssrfPolicy: {
+			allowedOrigins: [restOrigin],
+			hostnameAllowlist: [target.hostname]
+		}
+	};
+}
+function resolveDiscordEndpointAttachmentGuard(url, retainedRuntime) {
+	if (retainedRuntime === null) return;
+	const runtime = retainedRuntime ?? getDiscordEndpointRuntime();
+	if (!runtime) return;
+	const target = parseHttpAnchor(url, "Discord endpoint attachment upload URL");
+	const restOrigin = new URL(runtime.descriptor.restApiBaseUrl).origin;
+	if (target.origin !== restOrigin) throw new Error("Discord endpoint attachment upload URL is outside the configured REST origin");
+	return {
+		maxRedirects: 0,
+		policy: {
+			allowedOrigins: [restOrigin],
+			hostnameAllowlist: [target.hostname]
+		},
+		requireHttps: target.protocol === "https:"
+	};
+}
+function assertDiscordEndpointGatewayUrl(url, gatewayOrigin) {
+	if (!gatewayOrigin) return;
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error("Discord endpoint returned an invalid Gateway WebSocket URL");
+	}
+	if (parsed.origin !== gatewayOrigin || parsed.username || parsed.password || parsed.hash) throw new Error("Discord endpoint Gateway URL is outside the configured WebSocket origin");
+}
+//#endregion
 //#region extensions/discord/src/retry-after.ts
 const RETRY_AFTER_BODY_SECONDS_RE = /^(?:\d+\.?\d*|\.\d+)$/;
 const MAX_SAFE_RETRY_AFTER_SECONDS = Number.MAX_SAFE_INTEGER / 1e3;
@@ -371,4 +526,9 @@ function shouldEmitDiscordReactionNotification(params) {
 	return false;
 }
 //#endregion
-export { parseDiscordRetryAfterBodySeconds as C, resolveTimestampMs as S, resolveGroupDmAllow as _, normalizeDiscordSlug as a, formatDiscordUserTag as b, resolveDiscordChannelConfigWithFallback as c, resolveDiscordGuildEntry as d, resolveDiscordMemberAccessState as f, resolveDiscordShouldRequireMention as g, resolveDiscordOwnerAllowFrom as h, normalizeDiscordDisplaySlug as i, resolveDiscordChannelPolicyCommandAuthorizer as l, resolveDiscordOwnerAccess as m, isDiscordGroupAllowedByPolicy as n, resolveDiscordAllowListMatch as o, resolveDiscordMemberAllowed as p, normalizeDiscordAllowList as r, resolveDiscordChannelConfig as s, allowListMatches as t, resolveDiscordCommandAuthorized as u, shouldEmitDiscordReactionNotification as v, resolveDiscordSystemLocation as x, formatDiscordReactionEmoji as y };
+//#region extensions/discord/src/channel-type.ts
+function isDiscordThreadChannelType(channelType) {
+	return channelType === ChannelType.AnnouncementThread || channelType === ChannelType.PublicThread || channelType === ChannelType.PrivateThread;
+}
+//#endregion
+export { resolveTimestampMs as C, resolveDiscordEndpointAttachmentGuard as D, getDiscordEndpointRuntime as E, resolveDiscordEndpointMediaGuard as O, resolveDiscordSystemLocation as S, assertDiscordEndpointGatewayUrl as T, resolveDiscordShouldRequireMention as _, normalizeDiscordDisplaySlug as a, formatDiscordReactionEmoji as b, resolveDiscordChannelConfig as c, resolveDiscordCommandAuthorized as d, resolveDiscordGuildEntry as f, resolveDiscordOwnerAllowFrom as g, resolveDiscordOwnerAccess as h, normalizeDiscordAllowList as i, resolveDiscordChannelConfigWithFallback as l, resolveDiscordMemberAllowed as m, allowListMatches as n, normalizeDiscordSlug as o, resolveDiscordMemberAccessState as p, isDiscordGroupAllowedByPolicy as r, resolveDiscordAllowListMatch as s, isDiscordThreadChannelType as t, resolveDiscordChannelPolicyCommandAuthorizer as u, resolveGroupDmAllow as v, parseDiscordRetryAfterBodySeconds as w, formatDiscordUserTag as x, shouldEmitDiscordReactionNotification as y };

package/dist/{channel.setup-CpAwAiS0.js → .setup/channel.setup-BlC3-Kzz.mjs}

@@ -1,7 +1,7 @@
-import { _ as inspectDiscordAccountTokenState, h as resolveDiscordToken, l as resolveDiscordAccountAllowFrom, o as mergeDiscordAccountConfig, s as resolveDefaultDiscordAccountId, u as resolveDiscordAccountConfig } from "./accounts-CwJQoLjM.js";
-import { i as discordSetupContract, t as createDiscordPluginBase } from "./shared-CPPR0Xo4.js";
-import { t as resolveDiscordChannelAllowlist } from "./resolve-channels-VbpLmUS8.js";
-import { t as resolveDiscordUserAllowlist } from "./resolve-users-D-wRFsd5.js";
+import { _ as inspectDiscordAccountTokenState, h as resolveDiscordToken, l as resolveDiscordAccountAllowFrom, o as mergeDiscordAccountConfig, s as resolveDefaultDiscordAccountId, u as resolveDiscordAccountConfig } from "./accounts-CwJQoLjM.mjs";
+import { i as discordSetupContract, t as createDiscordPluginBase } from "./shared-CaA3Vv4n.mjs";
+import { t as resolveDiscordChannelAllowlist } from "./resolve-channels-BbvsLQOZ.mjs";
+import { t as resolveDiscordUserAllowlist } from "./resolve-users-ByFlR7LQ.mjs";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { resolveBasicAllowFromEntries } from "openclaw/plugin-sdk/allow-from";

package/dist/{components-kvIwhN7i.js → .setup/components-MqMWUWnE.mjs}

@@ -1,4 +1,4 @@
-import { B as LinkButton, F as TextInput, G as Section, H as MentionableSelectMenu, Ht as __exportAll, I as Button, J as TextDisplay, K as Separator, L as ChannelSelectMenu, M as Label, N as Modal, P as RadioGroup, Q as parseCustomId, R as Container, U as RoleSelectMenu, V as MediaGallery, W as Row, X as UserSelectMenu, Y as Thumbnail, j as CheckboxGroup, q as StringSelectMenu, z as File } from "./discord-CmL3ati-.js";
+import { $ as parseCustomId, B as File, F as RadioGroup, G as Row, H as MediaGallery, I as TextInput, J as StringSelectMenu, K as Section, L as Button, M as CheckboxGroup, N as Label, P as Modal, R as ChannelSelectMenu, U as MentionableSelectMenu, Ut as __exportAll, V as LinkButton, W as RoleSelectMenu, X as Thumbnail, Y as TextDisplay, Z as UserSelectMenu, q as Separator, z as Container } from "./discord-BXpHW-cu.mjs";
 import { ButtonStyle, MessageFlags, TextInputStyle } from "discord-api-types/v10";
 import crypto from "node:crypto";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalString, readNonBlankString } from "openclaw/plugin-sdk/string-coerce-runtime";
@@ -493,6 +493,7 @@ function createButtonComponent(params) {
 				super(..._args6);
 				this.label = params.spec.label;
 				this.url = linkUrl;
+				this.emoji = params.spec.emoji;
 				this.disabled = params.spec.disabled ?? false;
 			}
 		}
@@ -798,7 +799,7 @@ function encodeBoundedDiscordApprovalCustomId(action) {
 	});
 }
 function buildDiscordApprovalCustomId(action) {
-	if (!action.approvalId || action.approvalKind !== "exec" && action.approvalKind !== "plugin" || action.decision !== "allow-once" && action.decision !== "allow-always" && action.decision !== "deny") return;
+	if (!action.approvalId || action.approvalKind !== "exec" && action.approvalKind !== "plugin" && action.approvalKind !== "system-agent" || action.decision !== "allow-once" && action.decision !== "allow-always" && action.decision !== "deny") return;
 	return encodeBoundedDiscordApprovalCustomId(action);
 }
 function buildExecApprovalCustomId(approvalId, approvalKind, decision) {
@@ -822,7 +823,7 @@ function parseExecApprovalData(data) {
 	const rawId = coerce(data.id);
 	const rawKind = coerce(data.kind);
 	const rawAction = coerce(data.action);
-	if (!rawId || rawKind !== "exec" && rawKind !== "plugin" || !rawAction) return null;
+	if (!rawId || rawKind !== "exec" && rawKind !== "plugin" && rawKind !== "system-agent" || !rawAction) return null;
 	if (rawAction !== "allow-once" && rawAction !== "allow-always" && rawAction !== "deny") return null;
 	const approvalId = decodeCustomIdValue(rawId);
 	if (!approvalId) return null;

package/dist/{config-schema-r38UkM_J.js → .setup/config-schema-CiZz-mtA.mjs}

@@ -102,7 +102,7 @@ const discordChannelConfigUiHints = {
 	},
 	"voice.model": {
 		label: "Discord Voice Model",
-		help: "Optional LLM model override for Discord voice channel responses and realtime agent consults (for example openai/gpt-5.6-sol). Leave unset to inherit the routed agent model."
+		help: "Optional LLM model override for Discord voice channel responses and realtime agent consults (for example openai/gpt-6-astra). Leave unset to inherit the routed agent model."
 	},
 	"voice.mode": {
 		label: "Discord Voice Mode",

package/dist/{conversation-binding-route-qfe7oPy5.js → .setup/conversation-binding-route-_rz33QHO.mjs}

@@ -1,4 +1,4 @@
-import { l as shouldIgnoreStaleDiscordRouteBinding } from "./outbound-session-route-DZBYPGTR.js";
+import { m as shouldIgnoreStaleDiscordRouteBinding } from "./outbound-session-route-CqWbuMOm.mjs";
 import { logVerbose } from "openclaw/plugin-sdk/runtime-env";
 import { resolveConfiguredBindingRoute, resolveRuntimeConversationBindingRoute } from "openclaw/plugin-sdk/conversation-binding-runtime";
 //#region extensions/discord/src/monitor/conversation-binding-route.ts

package/dist/{directory-config-D1uDGbWh.js → .setup/directory-config-BytTftz-.mjs}

@@ -1,5 +1,5 @@
-import { Ht as __exportAll } from "./discord-CmL3ati-.js";
-import { l as resolveDiscordAccountAllowFrom, o as mergeDiscordAccountConfig, s as resolveDefaultDiscordAccountId } from "./accounts-CwJQoLjM.js";
+import { Ut as __exportAll } from "./discord-BXpHW-cu.mjs";
+import { l as resolveDiscordAccountAllowFrom, o as mergeDiscordAccountConfig, s as resolveDefaultDiscordAccountId } from "./accounts-CwJQoLjM.mjs";
 import { normalizeAccountId } from "openclaw/plugin-sdk/account-id";
 import { createResolvedDirectoryEntriesLister } from "openclaw/plugin-sdk/directory-config-runtime";
 //#region extensions/discord/src/directory-config.ts

package/dist/{directory-live-C5o1uKlw.js → .setup/directory-live--EGTH0DC.mjs}

@@ -1,7 +1,7 @@
-import { Ht as __exportAll } from "./discord-CmL3ati-.js";
-import { a as normalizeDiscordSlug } from "./allow-list-DWEio925.js";
-import { c as resolveDiscordAccount, m as normalizeDiscordToken } from "./accounts-CwJQoLjM.js";
-import { r as fetchDiscord, t as DISCORD_DIRECTORY_LOOKUP_TIMEOUT_MS } from "./api-LIV--eMq.js";
+import { Ut as __exportAll } from "./discord-BXpHW-cu.mjs";
+import { o as normalizeDiscordSlug } from "./channel-type-DKnjV1XW.mjs";
+import { c as resolveDiscordAccount, m as normalizeDiscordToken } from "./accounts-CwJQoLjM.mjs";
+import { r as fetchDiscord, t as DISCORD_DIRECTORY_LOOKUP_TIMEOUT_MS } from "./api-CBK9zcq5.mjs";
 import { DEFAULT_ACCOUNT_ID, normalizeAccountId } from "openclaw/plugin-sdk/routing";
 import { normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeOptionalStringifiedId } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/discord/src/directory-cache-state.ts

package/dist/{discord-CmL3ati-.js → .setup/discord-BXpHW-cu.mjs}

@@ -1,4 +1,4 @@
-import { C as parseDiscordRetryAfterBodySeconds } from "./allow-list-DWEio925.js";
+import { E as getDiscordEndpointRuntime, w as parseDiscordRetryAfterBodySeconds } from "./channel-type-DKnjV1XW.mjs";
 import "node:module";
 import { redactIdentifier, redactSensitiveFieldValue } from "openclaw/plugin-sdk/logging-core";
 import { ApplicationCommandOptionType, ApplicationCommandType, ButtonStyle, ComponentType, GatewayDispatchEvents, InteractionContextType, InteractionResponseType, InteractionType, MessageFlags, Routes, TextInputStyle } from "discord-api-types/v10";
@@ -9,7 +9,10 @@ import { asDateTimestampMs, clampTimerTimeoutMs, parseStrictNonNegativeInteger,
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { inspect } from "node:util";
 import { gunzipSync } from "node:zlib";
+import { captureChannelReadAuthority } from "openclaw/plugin-sdk/fetch-runtime";
 import { readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { resolveGlobalSingleton } from "openclaw/plugin-sdk/global-singleton";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { parseRetryAfterHeaderSeconds } from "openclaw/plugin-sdk/retry-runtime";
 //#region \0rolldown/runtime.js
@@ -127,24 +130,12 @@ async function createGuildSticker(rest, guildId, data) {
 	return await rest.post(Routes.guildStickers(guildId), data);
 }
 //#endregion
-//#region extensions/discord/src/internal/api.interactions.ts
-async function createInteractionCallback(rest, interactionId, token, body) {
-	return await rest.post(Routes.interactionCallback(interactionId, token), { body });
-}
-async function editWebhookMessage(rest, applicationId, token, messageId, data, query) {
-	return query ? await rest.patch(Routes.webhookMessage(applicationId, token, messageId), data, query) : await rest.patch(Routes.webhookMessage(applicationId, token, messageId), data);
-}
-async function deleteWebhookMessage(rest, applicationId, token, messageId) {
-	return await rest.delete(Routes.webhookMessage(applicationId, token, messageId));
-}
-async function getWebhookMessage(rest, applicationId, token, messageId) {
-	return await rest.get(Routes.webhookMessage(applicationId, token, messageId));
-}
-async function createWebhookMessage(rest, applicationId, token, data, query) {
-	return await rest.post(Routes.webhook(applicationId, token), data, query);
-}
-//#endregion
 //#region extensions/discord/src/internal/api.messages.ts
+function normalizeDiscordMessageId(messageId) {
+	const normalized = messageId.trim();
+	if (!/^[0-9]+$/u.test(normalized)) throw new Error("Invalid Discord message ID. Expected decimal digits.");
+	return normalized;
+}
 async function getChannel(rest, channelId) {
 	return await rest.get(Routes.channel(channelId));
 }
@@ -161,22 +152,22 @@ async function listChannelMessages(rest, channelId, query) {
 	return await rest.get(Routes.channelMessages(channelId), query);
 }
 async function getChannelMessage(rest, channelId, messageId) {
-	return await rest.get(Routes.channelMessage(channelId, messageId));
+	return await rest.get(Routes.channelMessage(channelId, normalizeDiscordMessageId(messageId)));
 }
 async function createChannelMessage(rest, channelId, data) {
 	return await rest.post(Routes.channelMessages(channelId), data);
 }
 async function editChannelMessage(rest, channelId, messageId, data) {
-	return await rest.patch(Routes.channelMessage(channelId, messageId), data);
+	return await rest.patch(Routes.channelMessage(channelId, normalizeDiscordMessageId(messageId)), data);
 }
 async function deleteChannelMessage(rest, channelId, messageId) {
-	await rest.delete(Routes.channelMessage(channelId, messageId));
+	await rest.delete(Routes.channelMessage(channelId, normalizeDiscordMessageId(messageId)));
 }
 async function pinChannelMessage(rest, channelId, messageId) {
-	await rest.put(Routes.channelPin(channelId, messageId));
+	await rest.put(Routes.channelPin(channelId, normalizeDiscordMessageId(messageId)));
 }
 async function unpinChannelMessage(rest, channelId, messageId) {
-	await rest.delete(Routes.channelPin(channelId, messageId));
+	await rest.delete(Routes.channelPin(channelId, normalizeDiscordMessageId(messageId)));
 }
 async function listChannelPins(rest, channelId) {
 	return await rest.get(Routes.channelPins(channelId));
@@ -185,7 +176,7 @@ async function sendChannelTyping(rest, channelId) {
 	await rest.post(Routes.channelTyping(channelId));
 }
 async function createThread(rest, channelId, data, messageId) {
-	const route = messageId ? Routes.threads(channelId, messageId) : Routes.threads(channelId);
+	const route = messageId === void 0 ? Routes.threads(channelId) : Routes.threads(channelId, normalizeDiscordMessageId(messageId));
 	return await rest.post(route, data);
 }
 async function listChannelArchivedThreads(rest, channelId, query) {
@@ -195,15 +186,37 @@ async function searchGuildMessages(rest, guildId, params) {
 	return await rest.get(`/guilds/${guildId}/messages/search?${params.toString()}`);
 }
 //#endregion
+//#region extensions/discord/src/internal/api.interactions.ts
+function normalizeDiscordWebhookMessageId(messageId) {
+	const normalized = messageId.trim();
+	return normalized === "@original" ? normalized : normalizeDiscordMessageId(normalized);
+}
+async function createInteractionCallback(rest, interactionId, token, body) {
+	return await rest.post(Routes.interactionCallback(interactionId, token), { body });
+}
+async function editWebhookMessage(rest, applicationId, token, messageId, data, query) {
+	const route = Routes.webhookMessage(applicationId, token, normalizeDiscordWebhookMessageId(messageId));
+	return query ? await rest.patch(route, data, query) : await rest.patch(route, data);
+}
+async function deleteWebhookMessage(rest, applicationId, token, messageId) {
+	return await rest.delete(Routes.webhookMessage(applicationId, token, normalizeDiscordWebhookMessageId(messageId)));
+}
+async function getWebhookMessage(rest, applicationId, token, messageId) {
+	return await rest.get(Routes.webhookMessage(applicationId, token, normalizeDiscordWebhookMessageId(messageId)));
+}
+async function createWebhookMessage(rest, applicationId, token, data, query) {
+	return await rest.post(Routes.webhook(applicationId, token), data, query);
+}
+//#endregion
 //#region extensions/discord/src/internal/api.reactions.ts
 async function createOwnMessageReaction(rest, channelId, messageId, encodedEmoji) {
-	await rest.put(Routes.channelMessageOwnReaction(channelId, messageId, encodedEmoji));
+	await rest.put(Routes.channelMessageOwnReaction(channelId, normalizeDiscordMessageId(messageId), encodedEmoji));
 }
 async function deleteOwnMessageReaction(rest, channelId, messageId, encodedEmoji) {
-	await rest.delete(Routes.channelMessageOwnReaction(channelId, messageId, encodedEmoji));
+	await rest.delete(Routes.channelMessageOwnReaction(channelId, normalizeDiscordMessageId(messageId), encodedEmoji));
 }
 async function listMessageReactionUsers(rest, channelId, messageId, encodedEmoji, query) {
-	return await rest.get(Routes.channelMessageReaction(channelId, messageId, encodedEmoji), query);
+	return await rest.get(Routes.channelMessageReaction(channelId, normalizeDiscordMessageId(messageId), encodedEmoji), query);
 }
 //#endregion
 //#region extensions/discord/src/internal/api.users.ts
@@ -1976,6 +1989,21 @@ function readMessageChannelId(rawData) {
 	return typeof channelId === "string" ? channelId : void 0;
 }
 //#endregion
+//#region extensions/discord/src/internal/request-authority.ts
+const requestAuthority = resolveGlobalSingleton(Symbol.for("openclaw.discord.requestAuthority"), () => new AsyncLocalStorage());
+/** Carry the host's existing assertion without changing its lifetime or ownership. */
+function withDiscordRequestAuthority(assertCurrent, run) {
+	if (!assertCurrent) return run();
+	const inherited = requestAuthority.getStore();
+	return requestAuthority.run(inherited && inherited !== assertCurrent ? () => {
+		inherited();
+		assertCurrent();
+	} : assertCurrent, run);
+}
+function captureDiscordRequestAuthority() {
+	return requestAuthority.getStore();
+}
+//#endregion
 //#region extensions/discord/src/internal/rest-body.ts
 function serializeRequestBody(data, headers) {
 	if (data?.headers) for (const [key, value] of Object.entries(data.headers)) headers.set(key, value);
@@ -2644,18 +2672,24 @@ function isZlibMaxOutputLengthError(err) {
 var RequestClient = class {
 	constructor(token, options) {
 		this.requestControllers = /* @__PURE__ */ new Set();
+		const endpoint = getDiscordEndpointRuntime();
+		const resolvedOptions = endpoint ? {
+			...options,
+			apiBaseUrl: endpoint.descriptor.restApiBaseUrl,
+			fetch: endpoint.fetch
+		} : options;
 		this.token = token.replace(/^Bot\s+/i, "");
-		this.customFetch = options?.fetch;
-		this.options = normalizeRequestClientOptions(options);
+		this.customFetch = resolvedOptions?.fetch;
+		this.options = normalizeRequestClientOptions(resolvedOptions);
 		this.scheduler = new RestScheduler({
 			lanes: normalizeSchedulerLanes(this.options.maxQueueSize, this.options.scheduler?.lanes),
 			maxConcurrency: resolveIntegerOption(this.options.scheduler?.maxConcurrency, DEFAULT_MAX_CONCURRENT_WORKERS, { min: 1 }),
 			maxQueueSize: this.options.maxQueueSize,
 			maxRateLimitRetries: resolveIntegerOption(this.options.scheduler?.maxRateLimitRetries, 3, { min: 0 })
 		}, async (request) => await this.executeRequest(request.method, request.path, {
-			data: request.data,
+			data: request.data?.data,
 			query: request.query
-		}, request.routeKey));
+		}, request.routeKey, request.data?.assertCurrent));
 	}
 	async get(path, query) {
 		return await this.request("GET", path, { query });
@@ -2686,16 +2720,27 @@ var RequestClient = class {
 	}
 	async request(method, path, params) {
 		const routeKey = createRouteKey(method, path);
-		if (!this.options.queueRequests) return await this.executeRequest(method, path, params, routeKey);
+		const assertActionAuthority = captureDiscordRequestAuthority();
+		const assertReadAuthority = captureChannelReadAuthority();
+		const assertCurrent = assertActionAuthority ? () => {
+			assertActionAuthority();
+			assertReadAuthority?.();
+		} : assertReadAuthority;
+		assertCurrent?.();
+		if (!this.options.queueRequests) return await this.executeRequest(method, path, params, routeKey, assertCurrent);
 		return await this.scheduler.enqueue({
 			method,
 			path,
 			priority: getRequestPriority(method, path),
-			...params
+			query: params.query,
+			data: {
+				data: params.data,
+				assertCurrent
+			}
 		});
 	}
-	async executeRequest(method, path, params, routeKey = createRouteKey(method, path)) {
-		const url = `${this.options.baseUrl}/v${this.options.apiVersion}${appendQuery(path, params.query)}`;
+	async executeRequest(method, path, params, routeKey = createRouteKey(method, path), assertCurrent) {
+		const url = `${this.options.apiBaseUrl}${appendQuery(path, params.query)}`;
 		const headers = new Headers({ "User-Agent": this.options.userAgent ?? defaultOptions.userAgent });
 		if (this.token !== "webhook") headers.set("Authorization", `${this.options.tokenHeader ?? "Bot"} ${this.token}`);
 		const body = serializeRequestBody(params.data, headers);
@@ -2705,12 +2750,14 @@ var RequestClient = class {
 		const signal = this.options.signal ? AbortSignal.any([this.options.signal, controller.signal]) : controller.signal;
 		this.requestControllers.add(controller);
 		try {
-			const response = await (this.customFetch ?? fetch)(url, {
+			assertCurrent?.();
+			const init = {
 				method,
 				headers,
 				body,
 				signal
-			});
+			};
+			const response = this.customFetch && assertCurrent ? await this.customFetch(url, init, assertCurrent) : await (this.customFetch ?? fetch)(url, init);
 			const parsed = coerceResponseBody(await readResponseBodyText(response, this.options.timeout ?? 15e3));
 			this.scheduler.recordResponse(routeKey, path, response, parsed);
 			if (response.status === 204) return;
@@ -2754,9 +2801,11 @@ function normalizeRequestClientOptions(options) {
 		...defaultOptions,
 		...options
 	};
+	const apiVersion = resolveIntegerOption(merged.apiVersion, defaultOptions.apiVersion, { min: 1 });
 	return {
 		...merged,
-		apiVersion: resolveIntegerOption(merged.apiVersion, defaultOptions.apiVersion, { min: 1 }),
+		apiBaseUrl: options?.apiBaseUrl ?? `${options?.baseUrl ?? defaultOptions.baseUrl}/v${apiVersion}`,
+		apiVersion,
 		timeout: clampTimerTimeoutMs(merged.timeout, 1) ?? resolveTimerTimeoutMs(defaultOptions.timeout, 1),
 		maxQueueSize: resolveIntegerOption(merged.maxQueueSize, defaultOptions.maxQueueSize, { min: 1 })
 	};
@@ -3067,6 +3116,7 @@ var discord_exports = /* @__PURE__ */ __exportAll({
 	listGuildScheduledEvents: () => listGuildScheduledEvents,
 	listMessageReactionUsers: () => listMessageReactionUsers,
 	moveGuildChannels: () => moveGuildChannels,
+	normalizeDiscordMessageId: () => normalizeDiscordMessageId,
 	overwriteApplicationCommands: () => overwriteApplicationCommands,
 	overwriteGuildApplicationCommands: () => overwriteGuildApplicationCommands,
 	parseComponentInteractionData: () => parseComponentInteractionData,
@@ -3085,4 +3135,4 @@ var discord_exports = /* @__PURE__ */ __exportAll({
 import * as import_discord_api_types_v10 from "discord-api-types/v10";
 __reExport(discord_exports, import_discord_api_types_v10);
 //#endregion
-export { stripUndefinedFields as $, Embed as A, getGuildMember as At, LinkButton as B, removeGuildMemberRole as Bt, Command as C, createGuildBan as Ct, User as D, createGuildSticker as Dt, Message as E, createGuildScheduledEvent as Et, TextInput as F, listGuildRoles as Ft, Section as G, MentionableSelectMenu as H, __exportAll as Ht, Button as I, listGuildScheduledEvents as It, TextDisplay as J, Separator as K, ChannelSelectMenu as L, moveGuildChannels as Lt, Label as M, listGuildActiveThreads as Mt, Modal as N, listGuildChannels as Nt, hasDiscordV2Components as O, deleteChannelPermission as Ot, RadioGroup as P, listGuildEmojis as Pt, parseCustomId as Q, Container as R, putChannelPermission as Rt, readRetryAfter as S, addGuildMemberRole as St, Guild as T, createGuildEmoji as Tt, RoleSelectMenu as U, MediaGallery as V, timeoutGuildMember as Vt, Row as W, UserSelectMenu as X, Thumbnail as Y, BaseMessageInteractiveComponent as Z, DiscordError as _, listChannelPins as _t, MessageCreateListener as a, listMessageReactionUsers as at, readDiscordCode as b, sendChannelTyping as bt, PresenceUpdateListener as c, deleteChannel as ct, ThreadDeleteListener as d, editChannelMessage as dt, createChannelWebhook as et, ThreadUpdateListener as f, getChannel as ft, RequestClient as g, listChannelMessages as gt, Plugin as h, listChannelArchivedThreads as ht, InteractionCreateListener as i, deleteOwnMessageReaction as it, CheckboxGroup as j, getGuildVoiceState as jt, serializePayload as k, getGuild as kt, ReadyListener as l, deleteChannelMessage as lt, Client as m, getThreadMember as mt, GuildCreateListener as n, getCurrentUser as nt, MessageReactionAddListener as o, createChannelMessage as ot, VoiceStateUpdateListener as p, getChannelMessage as pt, StringSelectMenu as q, GuildDeleteListener as r, createOwnMessageReaction as rt, MessageReactionRemoveListener as s, createThread as st, discord_exports as t, createUserDmChannel as tt, ResumedListener as u, editChannel as ut, RateLimitError as v, pinChannelMessage as vt, CommandWithSubcommands as w, createGuildChannel as wt, readDiscordMessage as x, unpinChannelMessage as xt, isUnknownDiscordVoiceStateError as y, searchGuildMessages as yt, File as z, removeGuildMember as zt };
+export { parseCustomId as $, serializePayload as A, getGuild as At, File as B, removeGuildMember as Bt, withDiscordRequestAuthority as C, addGuildMemberRole as Ct, Message as D, createGuildScheduledEvent as Dt, Guild as E, createGuildEmoji as Et, RadioGroup as F, listGuildEmojis as Ft, Row as G, MediaGallery as H, timeoutGuildMember as Ht, TextInput as I, listGuildRoles as It, StringSelectMenu as J, Section as K, Button as L, listGuildScheduledEvents as Lt, CheckboxGroup as M, getGuildVoiceState as Mt, Label as N, listGuildActiveThreads as Nt, User as O, createGuildSticker as Ot, Modal as P, listGuildChannels as Pt, BaseMessageInteractiveComponent as Q, ChannelSelectMenu as R, moveGuildChannels as Rt, readRetryAfter as S, unpinChannelMessage as St, CommandWithSubcommands as T, createGuildChannel as Tt, MentionableSelectMenu as U, __exportAll as Ut, LinkButton as V, removeGuildMemberRole as Vt, RoleSelectMenu as W, Thumbnail as X, TextDisplay as Y, UserSelectMenu as Z, DiscordError as _, listChannelMessages as _t, MessageCreateListener as a, deleteOwnMessageReaction as at, readDiscordCode as b, searchGuildMessages as bt, PresenceUpdateListener as c, createThread as ct, ThreadDeleteListener as d, editChannel as dt, stripUndefinedFields as et, ThreadUpdateListener as f, editChannelMessage as ft, RequestClient as g, listChannelArchivedThreads as gt, Plugin as h, getThreadMember as ht, InteractionCreateListener as i, createOwnMessageReaction as it, Embed as j, getGuildMember as jt, hasDiscordV2Components as k, deleteChannelPermission as kt, ReadyListener as l, deleteChannel as lt, Client as m, getChannelMessage as mt, GuildCreateListener as n, createUserDmChannel as nt, MessageReactionAddListener as o, listMessageReactionUsers as ot, VoiceStateUpdateListener as p, getChannel as pt, Separator as q, GuildDeleteListener as r, getCurrentUser as rt, MessageReactionRemoveListener as s, createChannelMessage as st, discord_exports as t, createChannelWebhook as tt, ResumedListener as u, deleteChannelMessage as ut, RateLimitError as v, listChannelPins as vt, Command as w, createGuildBan as wt, readDiscordMessage as x, sendChannelTyping as xt, isUnknownDiscordVoiceStateError as y, pinChannelMessage as yt, Container as z, putChannelPermission as zt };

package/dist/{doctor-DgKMH6N7.js → .setup/doctor-DxcdkXzz.mjs}

@@ -1,9 +1,9 @@
-import { s as resolveDefaultDiscordAccountId } from "./accounts-CwJQoLjM.js";
-import { t as discordVoiceTranscriptsSourceProvider } from "./transcripts-source-VkgenQv-.js";
-import { t as inspectDiscordAccount } from "./account-inspect-BY-ve3yH.js";
-import { r as DISCORD_LEGACY_CONFIG_RULES } from "./shared-CPPR0Xo4.js";
-import { n as normalizeCompatibilityConfig } from "./doctor-contract-Co5vRCZ6.js";
-import { t as isDiscordMutableAllowEntry } from "./security-doctor-nGgPm65L.js";
+import { s as resolveDefaultDiscordAccountId } from "./accounts-CwJQoLjM.mjs";
+import { t as discordVoiceTranscriptsSourceProvider } from "./transcripts-source-CuWYgayu.mjs";
+import { t as inspectDiscordAccount } from "./account-inspect-BwQj24ht.mjs";
+import { r as DISCORD_LEGACY_CONFIG_RULES } from "./shared-CaA3Vv4n.mjs";
+import { n as normalizeCompatibilityConfig } from "./doctor-contract-Co5vRCZ6.mjs";
+import { t as isDiscordMutableAllowEntry } from "./security-doctor-nGgPm65L.mjs";
 import { expectDefined } from "openclaw/plugin-sdk/expect-runtime";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { asObjectRecord, collectChannelAccountScopes, collectProviderDangerousNameMatchingScopes } from "openclaw/plugin-sdk/runtime-doctor-migrations";

package/dist/{handle-action.guild-admin-D4XdoA8-.js → .setup/handle-action.guild-admin-DAFyh_yV.mjs}

@@ -1,6 +1,6 @@
-import { c as readDiscordChannelMoveParams, n as isDiscordModerationAction, o as readDiscordChannelCreateParams, r as readDiscordModerationCommand, s as readDiscordChannelEditParams, t as handleDiscordAction } from "./runtime-Cv8GdXSO.js";
-import "./action-runtime-api.js";
-import { m as isTrustedRequesterGuildAdminAction } from "./outbound-session-route-DZBYPGTR.js";
+import { c as readDiscordChannelMoveParams, n as isDiscordModerationAction, o as readDiscordChannelCreateParams, r as readDiscordModerationCommand, s as readDiscordChannelEditParams, t as handleDiscordAction } from "./runtime-SchNfUsQ.mjs";
+import "../action-runtime-api.js";
+import { y as isTrustedRequesterGuildAdminAction } from "./outbound-session-route-CqWbuMOm.mjs";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { readBooleanParam } from "openclaw/plugin-sdk/boolean-param";
 import { readNonNegativeIntegerParam, readPositiveIntegerParam, readStringArrayParam, readStringParam } from "openclaw/plugin-sdk/agent-runtime";
@@ -8,7 +8,12 @@ import { readNonNegativeIntegerParam, readPositiveIntegerParam, readStringArrayP
 function readDiscordRequesterSenderId(ctx) {
 	const currentProvider = normalizeOptionalString(ctx.toolContext?.currentChannelProvider);
 	if (currentProvider?.toLowerCase() === "discord") return normalizeOptionalString(ctx.requesterSenderId);
-	if (isTrustedRequesterGuildAdminAction(ctx.action) && (currentProvider || ctx.senderIsOwner !== true)) throw new Error("Discord guild admin actions require a trusted Discord sender identity.");
+	if (ctx.action === "channel-edit" && !currentProvider && ctx.senderIsOwner === false && ctx.assertDirectAdapterHandoff && ctx.accountId && ctx.requesterAccountId === ctx.accountId) {
+		ctx.assertDirectAdapterHandoff();
+		const requester = normalizeOptionalString(ctx.requesterSenderId);
+		if (requester) return requester;
+	}
+	if (isTrustedRequesterGuildAdminAction(ctx.action) && (currentProvider || ctx.senderIsOwner !== true)) throw new Error("Discord guild admin actions require a trusted Discord sender identity." + (ctx.action === "channel-edit" && !currentProvider ? " Recreate an automation without recorded execution authorization from a fresh authenticated Discord turn that can manage automations." : ""));
 }
 function senderParam(senderUserId) {
 	return senderUserId ? { senderUserId } : {};

package/dist/{live-policy-config-BblutQAq.js → .setup/live-policy-config-eKQ-PLdy.mjs}

@@ -1,4 +1,4 @@
-import { r as normalizeDiscordAllowList } from "./allow-list-DWEio925.js";
+import { i as normalizeDiscordAllowList } from "./channel-type-DKnjV1XW.mjs";
 import { defineStableChannelIngressIdentity } from "openclaw/plugin-sdk/channel-ingress-runtime";
 //#region extensions/discord/src/monitor/ingress-identity.ts
 const DISCORD_ALLOW_LIST_PREFIXES = [