@poolzin/pool-bot 2026.2.24 → 2026.2.26

package/dist/plugins/update.js

@@ -18,14 +18,17 @@ function resolveBundledPluginSources(params) {
     const discovery = discoverPoolBotPlugins({ workspaceDir: params.workspaceDir });
     const bundled = new Map();
     for (const candidate of discovery.candidates) {
-        if (candidate.origin !== "bundled")
+        if (candidate.origin !== "bundled") {
             continue;
+        }
         const manifest = loadPluginManifest(candidate.rootDir);
-        if (!manifest.ok)
+        if (!manifest.ok) {
             continue;
+        }
         const pluginId = manifest.manifest.id;
-        if (bundled.has(pluginId))
+        if (bundled.has(pluginId)) {
             continue;
+        }
         const npmSpec = candidate.packagePoolbot?.install?.npmSpec?.trim() ||
             candidate.packageName?.trim() ||
             undefined;
@@ -38,8 +41,9 @@ function resolveBundledPluginSources(params) {
     return bundled;
 }
 function pathsEqual(left, right) {
-    if (!left || !right)
+    if (!left || !right) {
         return false;
+    }
     return resolveUserPath(left) === resolveUserPath(right);
 }
 function buildLoadPathHelpers(existing) {
@@ -49,16 +53,18 @@ function buildLoadPathHelpers(existing) {
     let changed = false;
     const addPath = (value) => {
         const normalized = resolveUserPath(value);
-        if (resolved.has(normalized))
+        if (resolved.has(normalized)) {
             return;
+        }
         paths.push(value);
         resolved.add(normalized);
         changed = true;
     };
     const removePath = (value) => {
         const normalized = resolveUserPath(value);
-        if (!resolved.has(normalized))
+        if (!resolved.has(normalized)) {
             return;
+        }
         paths = paths.filter((entry) => resolveUserPath(entry) !== normalized);
         resolved = resolveSet();
         changed = true;
@@ -74,6 +80,24 @@ function buildLoadPathHelpers(existing) {
         },
     };
 }
+function createPluginUpdateIntegrityDriftHandler(params) {
+    return async (drift) => {
+        const payload = {
+            pluginId: params.pluginId,
+            spec: drift.spec,
+            expectedIntegrity: drift.expectedIntegrity,
+            actualIntegrity: drift.actualIntegrity,
+            resolvedSpec: drift.resolution.resolvedSpec,
+            resolvedVersion: drift.resolution.version,
+            dryRun: params.dryRun,
+        };
+        if (params.onIntegrityDrift) {
+            return await params.onIntegrityDrift(payload);
+        }
+        params.logger.warn?.(`Integrity drift for "${params.pluginId}" (${payload.resolvedSpec ?? payload.spec}): expected ${payload.expectedIntegrity}, got ${payload.actualIntegrity}`);
+        return true;
+    };
+}
 export async function updateNpmInstalledPlugins(params) {
     const logger = params.logger ?? {};
     const installs = params.config.plugins?.installs ?? {};
@@ -115,7 +139,18 @@ export async function updateNpmInstalledPlugins(params) {
             });
             continue;
         }
-        const installPath = record.installPath ?? resolvePluginInstallDir(pluginId);
+        let installPath;
+        try {
+            installPath = record.installPath ?? resolvePluginInstallDir(pluginId);
+        }
+        catch (err) {
+            outcomes.push({
+                pluginId,
+                status: "error",
+                message: `Invalid install path for "${pluginId}": ${String(err)}`,
+            });
+            continue;
+        }
         const currentVersion = await readInstalledPackageVersion(installPath);
         if (params.dryRun) {
             let probe;
@@ -125,6 +160,13 @@ export async function updateNpmInstalledPlugins(params) {
                     mode: "update",
                     dryRun: true,
                     expectedPluginId: pluginId,
+                    expectedIntegrity: record.integrity,
+                    onIntegrityDrift: createPluginUpdateIntegrityDriftHandler({
+                        pluginId,
+                        dryRun: true,
+                        logger,
+                        onIntegrityDrift: params.onIntegrityDrift,
+                    }),
                     logger,
                 });
             }
@@ -172,6 +214,13 @@ export async function updateNpmInstalledPlugins(params) {
                 spec: record.spec,
                 mode: "update",
                 expectedPluginId: pluginId,
+                expectedIntegrity: record.integrity,
+                onIntegrityDrift: createPluginUpdateIntegrityDriftHandler({
+                    pluginId,
+                    dryRun: false,
+                    logger,
+                    onIntegrityDrift: params.onIntegrityDrift,
+                }),
                 logger,
             });
         }
@@ -198,6 +247,12 @@ export async function updateNpmInstalledPlugins(params) {
             spec: record.spec,
             installPath: result.targetDir,
             version: nextVersion,
+            resolvedName: result.npmResolution?.name,
+            resolvedVersion: result.npmResolution?.version,
+            resolvedSpec: result.npmResolution?.resolvedSpec,
+            integrity: result.npmResolution?.integrity,
+            shasum: result.npmResolution?.shasum,
+            resolvedAt: result.npmResolution?.resolvedAt,
         });
         changed = true;
         const currentLabel = currentVersion ?? "unknown";
@@ -241,12 +296,14 @@ export async function syncPluginsForUpdateChannel(params) {
     if (params.channel === "dev") {
         for (const [pluginId, record] of Object.entries(installs)) {
             const bundledInfo = bundled.get(pluginId);
-            if (!bundledInfo)
+            if (!bundledInfo) {
                 continue;
+            }
             loadHelpers.addPath(bundledInfo.localPath);
             const alreadyBundled = record.source === "path" && pathsEqual(record.sourcePath, bundledInfo.localPath);
-            if (alreadyBundled)
+            if (alreadyBundled) {
                 continue;
+            }
             next = recordPluginInstall(next, {
                 pluginId,
                 source: "path",
@@ -262,16 +319,19 @@ export async function syncPluginsForUpdateChannel(params) {
     else {
         for (const [pluginId, record] of Object.entries(installs)) {
             const bundledInfo = bundled.get(pluginId);
-            if (!bundledInfo)
+            if (!bundledInfo) {
                 continue;
+            }
             if (record.source === "npm") {
                 loadHelpers.removePath(bundledInfo.localPath);
                 continue;
             }
-            if (record.source !== "path")
+            if (record.source !== "path") {
                 continue;
-            if (!pathsEqual(record.sourcePath, bundledInfo.localPath))
+            }
+            if (!pathsEqual(record.sourcePath, bundledInfo.localPath)) {
                 continue;
+            }
             const spec = record.spec ?? bundledInfo.npmSpec;
             if (!spec) {
                 summary.warnings.push(`Missing npm spec for ${pluginId}; keeping local path.`);
@@ -300,6 +360,12 @@ export async function syncPluginsForUpdateChannel(params) {
                 spec,
                 installPath: result.targetDir,
                 version: result.version,
+                resolvedName: result.npmResolution?.name,
+                resolvedVersion: result.npmResolution?.version,
+                resolvedSpec: result.npmResolution?.resolvedSpec,
+                integrity: result.npmResolution?.integrity,
+                shasum: result.npmResolution?.shasum,
+                resolvedAt: result.npmResolution?.resolvedAt,
                 sourcePath: undefined,
             });
             summary.switchedToNpm.push(pluginId);

package/dist/process/spawn-utils.js

@@ -5,19 +5,24 @@ export function resolveCommandStdio(params) {
     return [stdin, "pipe", "pipe"];
 }
 export function formatSpawnError(err) {
-    if (!(err instanceof Error))
+    if (!(err instanceof Error)) {
         return String(err);
+    }
     const details = err;
     const parts = [];
     const message = err.message?.trim();
-    if (message)
+    if (message) {
         parts.push(message);
-    if (details.code && !message?.includes(details.code))
+    }
+    if (details.code && !message?.includes(details.code)) {
         parts.push(details.code);
-    if (details.syscall)
+    }
+    if (details.syscall) {
         parts.push(`syscall=${details.syscall}`);
-    if (typeof details.errno === "number")
+    }
+    if (typeof details.errno === "number") {
         parts.push(`errno=${details.errno}`);
+    }
     return parts.join(" ");
 }
 function shouldRetry(err, codes) {
@@ -33,15 +38,17 @@ async function spawnAndWaitForSpawn(spawnImpl, argv, options) {
             child.removeListener("spawn", onSpawn);
         };
         const finishResolve = () => {
-            if (settled)
+            if (settled) {
                 return;
+            }
             settled = true;
             cleanup();
             resolve(child);
         };
         const onError = (err) => {
-            if (settled)
+            if (settled) {
                 return;
+            }
             settled = true;
             cleanup();
             reject(err);

package/dist/providers/github-copilot-models.js

@@ -4,6 +4,8 @@ const DEFAULT_MAX_TOKENS = 8192;
 // We keep this list intentionally broad; if a model isn't available Copilot will
 // return an error and users can remove it from their config.
 const DEFAULT_MODEL_IDS = [
+    "claude-sonnet-4.6",
+    "claude-sonnet-4.5",
     "gpt-4o",
     "gpt-4.1",
     "gpt-4.1-mini",
@@ -17,8 +19,9 @@ export function getDefaultCopilotModelIds() {
 }
 export function buildCopilotModelDefinition(modelId) {
     const id = modelId.trim();
-    if (!id)
+    if (!id) {
         throw new Error("Model id required");
+    }
     return {
         id,
         name: id,

package/dist/providers/github-copilot-token.js

@@ -39,25 +39,30 @@ function parseCopilotTokenResponse(value) {
 export const DEFAULT_COPILOT_API_BASE_URL = "https://api.individual.githubcopilot.com";
 export function deriveCopilotApiBaseUrlFromToken(token) {
     const trimmed = token.trim();
-    if (!trimmed)
+    if (!trimmed) {
         return null;
+    }
     // The token returned from the Copilot token endpoint is a semicolon-delimited
     // set of key/value pairs. One of them is `proxy-ep=...`.
     const match = trimmed.match(/(?:^|;)\s*proxy-ep=([^;\s]+)/i);
     const proxyEp = match?.[1]?.trim();
-    if (!proxyEp)
+    if (!proxyEp) {
         return null;
+    }
     // pi-ai expects converting proxy.* -> api.*
     // (see upstream getGitHubCopilotBaseUrl).
     const host = proxyEp.replace(/^https?:\/\//, "").replace(/^proxy\./i, "api.");
-    if (!host)
+    if (!host) {
         return null;
+    }
     return `https://${host}`;
 }
 export async function resolveCopilotApiToken(params) {
     const env = params.env ?? process.env;
-    const cachePath = resolveCopilotTokenCachePath(env);
-    const cached = loadJsonFile(cachePath);
+    const cachePath = params.cachePath?.trim() || resolveCopilotTokenCachePath(env);
+    const loadJsonFileFn = params.loadJsonFileImpl ?? loadJsonFile;
+    const saveJsonFileFn = params.saveJsonFileImpl ?? saveJsonFile;
+    const cached = loadJsonFileFn(cachePath);
     if (cached && typeof cached.token === "string" && typeof cached.expiresAt === "number") {
         if (isTokenUsable(cached)) {
             return {
@@ -85,7 +90,7 @@ export async function resolveCopilotApiToken(params) {
         expiresAt: json.expiresAt,
         updatedAt: Date.now(),
     };
-    saveJsonFile(cachePath, payload);
+    saveJsonFileFn(cachePath, payload);
     return {
         token: payload.token,
         expiresAt: payload.expiresAt,

package/dist/providers/qwen-portal-oauth.js

@@ -3,7 +3,8 @@ const QWEN_OAUTH_BASE_URL = "https://chat.qwen.ai";
 const QWEN_OAUTH_TOKEN_ENDPOINT = `${QWEN_OAUTH_BASE_URL}/api/v1/oauth2/token`;
 const QWEN_OAUTH_CLIENT_ID = "f0304373b74a44d2b584a3fb70ca9e56";
 export async function refreshQwenPortalCredentials(credentials) {
-    if (!credentials.refresh?.trim()) {
+    const refreshToken = credentials.refresh?.trim();
+    if (!refreshToken) {
         throw new Error("Qwen OAuth refresh token missing; re-authenticate.");
     }
     const response = await fetch(QWEN_OAUTH_TOKEN_ENDPOINT, {
@@ -14,7 +15,7 @@ export async function refreshQwenPortalCredentials(credentials) {
         },
         body: new URLSearchParams({
             grant_type: "refresh_token",
-            refresh_token: credentials.refresh,
+            refresh_token: refreshToken,
             client_id: QWEN_OAUTH_CLIENT_ID,
         }),
     });
@@ -26,13 +27,20 @@ export async function refreshQwenPortalCredentials(credentials) {
         throw new Error(`Qwen OAuth refresh failed: ${text || response.statusText}`);
     }
     const payload = (await response.json());
-    if (!payload.access_token || !payload.expires_in) {
+    const accessToken = payload.access_token?.trim();
+    const newRefreshToken = payload.refresh_token?.trim();
+    const expiresIn = payload.expires_in;
+    if (!accessToken) {
         throw new Error("Qwen OAuth refresh response missing access token.");
     }
+    if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+        throw new Error("Qwen OAuth refresh response missing or invalid expires_in.");
+    }
     return {
         ...credentials,
-        access: payload.access_token,
-        refresh: payload.refresh_token || credentials.refresh,
-        expires: Date.now() + payload.expires_in * 1000,
+        access: accessToken,
+        // RFC 6749 section 6: new refresh token is optional; if present, replace old.
+        refresh: newRefreshToken || refreshToken,
+        expires: Date.now() + expiresIn * 1000,
     };
 }

package/dist/routing/account-id.js

@@ -0,0 +1,30 @@
+export const DEFAULT_ACCOUNT_ID = "default";
+const VALID_ID_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+const INVALID_CHARS_RE = /[^a-z0-9_-]+/g;
+const LEADING_DASH_RE = /^-+/;
+const TRAILING_DASH_RE = /-+$/;
+function canonicalizeAccountId(value) {
+    if (VALID_ID_RE.test(value)) {
+        return value.toLowerCase();
+    }
+    return value
+        .toLowerCase()
+        .replace(INVALID_CHARS_RE, "-")
+        .replace(LEADING_DASH_RE, "")
+        .replace(TRAILING_DASH_RE, "")
+        .slice(0, 64);
+}
+export function normalizeAccountId(value) {
+    const trimmed = (value ?? "").trim();
+    if (!trimmed) {
+        return DEFAULT_ACCOUNT_ID;
+    }
+    return canonicalizeAccountId(trimmed) || DEFAULT_ACCOUNT_ID;
+}
+export function normalizeOptionalAccountId(value) {
+    const trimmed = (value ?? "").trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    return canonicalizeAccountId(trimmed) || undefined;
+}

package/dist/routing/resolve-route.js

@@ -3,7 +3,7 @@ import { normalizeChatType } from "../channels/chat-type.js";
 import { shouldLogVerbose } from "../globals.js";
 import { logDebug } from "../logger.js";
 import { listBindings } from "./bindings.js";
-import { buildAgentMainSessionKey, buildAgentPeerSessionKey, DEFAULT_ACCOUNT_ID, DEFAULT_MAIN_KEY, normalizeAgentId, sanitizeAgentId, } from "./session-key.js";
+import { buildAgentMainSessionKey, buildAgentPeerSessionKey, DEFAULT_ACCOUNT_ID, DEFAULT_MAIN_KEY, normalizeAccountId as normalizeAccountIdShared, normalizeAgentId, sanitizeAgentId, } from "./session-key.js";
 export { DEFAULT_ACCOUNT_ID, DEFAULT_AGENT_ID } from "./session-key.js";
 function normalizeToken(value) {
     return (value ?? "").trim().toLowerCase();
@@ -17,10 +17,6 @@ function normalizeId(value) {
     }
     return "";
 }
-function normalizeAccountId(value) {
-    const trimmed = (value ?? "").trim();
-    return trimmed ? trimmed : DEFAULT_ACCOUNT_ID;
-}
 function matchesAccountId(match, actual) {
     const trimmed = (match ?? "").trim();
     if (!trimmed) {
@@ -29,7 +25,7 @@ function matchesAccountId(match, actual) {
     if (trimmed === "*") {
         return true;
     }
-    return trimmed === actual;
+    return normalizeAccountIdShared(trimmed) === actual;
 }
 export function buildAgentSessionKey(params) {
     const channel = normalizeToken(params.channel) || "unknown";
@@ -164,7 +160,7 @@ function matchesBindingScope(match, scope) {
 }
 export function resolveAgentRoute(input) {
     const channel = normalizeToken(input.channel);
-    const accountId = normalizeAccountId(input.accountId);
+    const accountId = normalizeAccountIdShared(input.accountId);
     const peer = input.peer ? { kind: input.peer.kind, id: normalizeId(input.peer.id) } : null;
     const guildId = normalizeId(input.guildId);
     const teamId = normalizeId(input.teamId);

package/dist/routing/session-key.js

@@ -1,8 +1,9 @@
 import { parseAgentSessionKey } from "../sessions/session-key-utils.js";
+import { normalizeAccountId } from "./account-id.js";
 export { getSubagentDepth, isCronSessionKey, isAcpSessionKey, isSubagentSessionKey, parseAgentSessionKey, } from "../sessions/session-key-utils.js";
+export { DEFAULT_ACCOUNT_ID, normalizeAccountId, normalizeOptionalAccountId, } from "./account-id.js";
 export const DEFAULT_AGENT_ID = "main";
 export const DEFAULT_MAIN_KEY = "main";
-export const DEFAULT_ACCOUNT_ID = "default";
 // Pre-compiled regex
 const VALID_ID_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
 const INVALID_CHARS_RE = /[^a-z0-9_-]+/g;
@@ -82,21 +83,6 @@ export function sanitizeAgentId(value) {
         .replace(TRAILING_DASH_RE, "")
         .slice(0, 64) || DEFAULT_AGENT_ID);
 }
-export function normalizeAccountId(value) {
-    const trimmed = (value ?? "").trim();
-    if (!trimmed) {
-        return DEFAULT_ACCOUNT_ID;
-    }
-    if (VALID_ID_RE.test(trimmed)) {
-        return trimmed.toLowerCase();
-    }
-    return (trimmed
-        .toLowerCase()
-        .replace(INVALID_CHARS_RE, "-")
-        .replace(LEADING_DASH_RE, "")
-        .replace(TRAILING_DASH_RE, "")
-        .slice(0, 64) || DEFAULT_ACCOUNT_ID);
-}
 export function buildAgentMainSessionKey(params) {
     const agentId = normalizeAgentId(params.agentId);
     const mainKey = normalizeMainKey(params.mainKey);

package/dist/security/audit-channel.js

@@ -3,11 +3,44 @@ import { isNumericTelegramUserId, normalizeTelegramAllowFromEntry, } from "../ch
 import { formatCliCommand } from "../cli/command-format.js";
 import { resolveNativeCommandsEnabled, resolveNativeSkillsEnabled } from "../config/commands.js";
 import { readChannelAllowFromStore } from "../pairing/pairing-store.js";
+import { normalizeStringEntries } from "../shared/string-normalization.js";
+import { resolveDmAllowState } from "./dm-policy-shared.js";
 function normalizeAllowFromList(list) {
-    if (!Array.isArray(list)) {
-        return [];
+    return normalizeStringEntries(Array.isArray(list) ? list : undefined);
+}
+const DISCORD_ALLOWLIST_ID_PREFIXES = ["discord:", "user:", "pk:"];
+function isDiscordNameBasedAllowEntry(raw) {
+    const text = String(raw).trim();
+    if (!text || text === "*") {
+        return false;
+    }
+    const maybeId = text.replace(/^<@!?/, "").replace(/>$/, "");
+    if (/^\d+$/.test(maybeId)) {
+        return false;
+    }
+    const prefixed = DISCORD_ALLOWLIST_ID_PREFIXES.find((prefix) => text.startsWith(prefix));
+    if (prefixed) {
+        const candidate = text.slice(prefixed.length);
+        if (candidate) {
+            return false;
+        }
+    }
+    return true;
+}
+function addDiscordNameBasedEntries(params) {
+    if (!Array.isArray(params.values)) {
+        return;
+    }
+    for (const value of params.values) {
+        if (!isDiscordNameBasedAllowEntry(value)) {
+            continue;
+        }
+        const text = String(value).trim();
+        if (!text) {
+            continue;
+        }
+        params.target.add(`${params.source}:${text}`);
     }
-    return list.map((v) => String(v).trim()).filter(Boolean);
 }
 function classifyChannelWarningSeverity(message) {
     const s = message.toLowerCase();
@@ -40,22 +73,12 @@ export async function collectChannelSecurityFindings(params) {
     };
     const warnDmPolicy = async (input) => {
         const policyPath = input.policyPath ?? `${input.allowFromPath}policy`;
-        const configAllowFrom = normalizeAllowFromList(input.allowFrom);
-        const hasWildcard = configAllowFrom.includes("*");
+        const { hasWildcard, isMultiUserDm } = await resolveDmAllowState({
+            provider: input.provider,
+            allowFrom: input.allowFrom,
+            normalizeEntry: input.normalizeEntry,
+        });
         const dmScope = params.cfg.session?.dmScope ?? "main";
-        const storeAllowFrom = await readChannelAllowFromStore(input.provider).catch(() => []);
-        const normalizeEntry = input.normalizeEntry ?? ((value) => value);
-        const normalizedCfg = configAllowFrom
-            .filter((value) => value !== "*")
-            .map((value) => normalizeEntry(value))
-            .map((value) => value.trim())
-            .filter(Boolean);
-        const normalizedStore = storeAllowFrom
-            .map((value) => normalizeEntry(value))
-            .map((value) => value.trim())
-            .filter(Boolean);
-        const allowCount = Array.from(new Set([...normalizedCfg, ...normalizedStore])).length;
-        const isMultiUserDm = hasWildcard || allowCount > 1;
         if (input.dmPolicy === "open") {
             const allowFromKey = `${input.allowFromPath}allowFrom`;
             findings.push({
@@ -119,6 +142,64 @@ export async function collectChannelSecurityFindings(params) {
         if (plugin.id === "discord") {
             const discordCfg = account?.config ??
                 {};
+            const storeAllowFrom = await readChannelAllowFromStore("discord").catch(() => []);
+            const discordNameBasedAllowEntries = new Set();
+            addDiscordNameBasedEntries({
+                target: discordNameBasedAllowEntries,
+                values: discordCfg.allowFrom,
+                source: "channels.discord.allowFrom",
+            });
+            addDiscordNameBasedEntries({
+                target: discordNameBasedAllowEntries,
+                values: discordCfg.dm?.allowFrom,
+                source: "channels.discord.dm.allowFrom",
+            });
+            addDiscordNameBasedEntries({
+                target: discordNameBasedAllowEntries,
+                values: storeAllowFrom,
+                source: "~/.poolbot/credentials/discord-allowFrom.json",
+            });
+            const discordGuildEntries = discordCfg.guilds ?? {};
+            for (const [guildKey, guildValue] of Object.entries(discordGuildEntries)) {
+                if (!guildValue || typeof guildValue !== "object") {
+                    continue;
+                }
+                const guild = guildValue;
+                addDiscordNameBasedEntries({
+                    target: discordNameBasedAllowEntries,
+                    values: guild.users,
+                    source: `channels.discord.guilds.${guildKey}.users`,
+                });
+                const channels = guild.channels;
+                if (!channels || typeof channels !== "object") {
+                    continue;
+                }
+                for (const [channelKey, channelValue] of Object.entries(channels)) {
+                    if (!channelValue || typeof channelValue !== "object") {
+                        continue;
+                    }
+                    const channel = channelValue;
+                    addDiscordNameBasedEntries({
+                        target: discordNameBasedAllowEntries,
+                        values: channel.users,
+                        source: `channels.discord.guilds.${guildKey}.channels.${channelKey}.users`,
+                    });
+                }
+            }
+            if (discordNameBasedAllowEntries.size > 0) {
+                const examples = Array.from(discordNameBasedAllowEntries).slice(0, 5);
+                const more = discordNameBasedAllowEntries.size > examples.length
+                    ? ` (+${discordNameBasedAllowEntries.size - examples.length} more)`
+                    : "";
+                findings.push({
+                    checkId: "channels.discord.allowFrom.name_based_entries",
+                    severity: "warn",
+                    title: "Discord allowlist contains name or tag entries",
+                    detail: "Discord name/tag allowlist matching uses normalized slugs and can collide across users. " +
+                        `Found: ${examples.join(", ")}${more}.`,
+                    remediation: "Prefer stable Discord IDs (or <@id>/user:<id>/pk:<id>) in channels.discord.allowFrom and channels.discord.guilds.*.users.",
+                });
+            }
             const nativeEnabled = resolveNativeCommandsEnabled({
                 providerId: "discord",
                 providerSetting: coerceNativeSetting(discordCfg.commands?.native),
@@ -133,7 +214,7 @@ export async function collectChannelSecurityFindings(params) {
             if (slashEnabled) {
                 const defaultGroupPolicy = params.cfg.channels?.defaults?.groupPolicy;
                 const groupPolicy = discordCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
-                const guildEntries = discordCfg.guilds ?? {};
+                const guildEntries = discordGuildEntries;
                 const guildsConfigured = Object.keys(guildEntries).length > 0;
                 const hasAnyUserAllowlist = Object.values(guildEntries).some((guild) => {
                     if (!guild || typeof guild !== "object") {
@@ -157,7 +238,6 @@ export async function collectChannelSecurityFindings(params) {
                 });
                 const dmAllowFromRaw = discordCfg.dm?.allowFrom;
                 const dmAllowFrom = Array.isArray(dmAllowFromRaw) ? dmAllowFromRaw : [];
-                const storeAllowFrom = await readChannelAllowFromStore("discord").catch(() => []);
                 const ownerAllowFromConfigured = normalizeAllowFromList([...dmAllowFrom, ...storeAllowFrom]).length > 0;
                 const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
                 if (!useAccessGroups &&