@stage-labs/metro 0.1.0-beta.20 → 0.1.0-beta.201

package/runtime/node_modules/@metro-labs/daemon/src/vault/store.ts

@@ -0,0 +1,130 @@
+import { existsSync, rmSync } from 'node:fs';
+import { ApiError } from '@metro-labs/http/api-error';
+import { isRecord } from '@metro-labs/core/is-record';
+import { newId } from '@metro-labs/core/ids';
+import { ensureSecureDir, readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { stateFile, valueFile, valuesDir, vaultDir } from './paths.js';
+
+export interface VaultSecret {
+  id: string;
+  name: string;
+  env: string;
+  hosts: string[];
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface VaultState {
+  version: 1;
+  enabled: boolean;
+  secrets: VaultSecret[];
+}
+
+export interface SecretInput {
+  name?: unknown;
+  env?: unknown;
+  hosts?: unknown;
+  value?: unknown;
+}
+
+const ENV_RE = /^[A-Z][A-Z0-9_]{2,63}$/;
+const HOST_RE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
+const RESERVED_ENV = new Set(['HOME', 'PATH', 'USER', 'SHELL', 'LANG', 'TERM', 'LOGNAME', 'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'ALL_PROXY']);
+const MAX_SECRETS = 100;
+const MAX_HOSTS = 20;
+const MAX_VALUE = 16 * 1024;
+
+const str = (v: unknown): string => (typeof v === 'string' ? v : '');
+
+function secretOf(raw: unknown): VaultSecret | null {
+  if (!isRecord(raw) || typeof raw.id !== 'string' || !ENV_RE.test(str(raw.env))) return null;
+  const hosts = Array.isArray(raw.hosts) ? raw.hosts.filter((h): h is string => typeof h === 'string' && HOST_RE.test(h)) : [];
+  return { id: raw.id, name: str(raw.name) || str(raw.env), env: str(raw.env), hosts, createdAt: str(raw.createdAt), updatedAt: str(raw.updatedAt) };
+}
+
+export function readVault(dir = vaultDir()): VaultState {
+  const raw = readJson<unknown>(stateFile(dir), null);
+  if (!isRecord(raw)) return { version: 1, enabled: false, secrets: [] };
+  const secrets = Array.isArray(raw.secrets) ? raw.secrets.map(secretOf).filter((s): s is VaultSecret => s !== null) : [];
+  return { version: 1, enabled: raw.enabled === true, secrets };
+}
+
+export function writeVault(state: VaultState, dir = vaultDir()): void {
+  ensureSecureDir(dir);
+  writeSecure(stateFile(dir), `${JSON.stringify(state, null, 2)}\n`);
+}
+
+export function normalizeName(raw: unknown): string {
+  const name = str(raw).trim();
+  if (name === '' || name.length > 80) throw new ApiError('a name of 1 to 80 characters is required', 400);
+  return name;
+}
+
+export function normalizeEnv(raw: unknown): string {
+  const env = str(raw).trim();
+  if (!ENV_RE.test(env) || RESERVED_ENV.has(env))
+    throw new ApiError('the variable name must be capital letters, digits and _, 3 to 64 long, like OPENAI_API_KEY', 400);
+  return env;
+}
+
+export function normalizeHosts(raw: unknown): string[] {
+  if (!Array.isArray(raw)) throw new ApiError('hosts must be a list of websites, like api.openai.com', 400);
+  const hosts = [...new Set(raw.map((h) => str(h).trim().toLowerCase().replace(/^https?:\/\//, '').replace(/\/.*$/, '')).filter((h) => h !== ''))];
+  if (hosts.length === 0 || hosts.length > MAX_HOSTS) throw new ApiError(`a secret needs 1 to ${String(MAX_HOSTS)} websites`, 400);
+  const bad = hosts.find((h) => !HOST_RE.test(h));
+  if (bad !== undefined) throw new ApiError(`'${bad}' is not a website name; write it as api.example.com or *.example.com`, 400);
+  return hosts;
+}
+
+export function normalizeValue(raw: unknown): string {
+  const value = str(raw).trim();
+  if (value === '' || value.length > MAX_VALUE) throw new ApiError('a value of 1 to 16384 characters is required', 400);
+  return value;
+}
+
+function saveValue(id: string, value: string, dir: string): void {
+  ensureSecureDir(valuesDir(dir));
+  writeSecure(valueFile(id, dir), value);
+}
+
+export function addSecret(input: SecretInput, dir = vaultDir(), now = new Date()): VaultSecret {
+  const state = readVault(dir);
+  if (state.secrets.length >= MAX_SECRETS) throw new ApiError(`at most ${String(MAX_SECRETS)} secrets`, 400);
+  const env = normalizeEnv(input.env);
+  if (state.secrets.some((s) => s.env === env)) throw new ApiError(`${env} is already a secret`, 409);
+  const at = now.toISOString();
+  const secret: VaultSecret = { id: newId(), name: normalizeName(input.name ?? env), env, hosts: normalizeHosts(input.hosts), createdAt: at, updatedAt: at };
+  saveValue(secret.id, normalizeValue(input.value), dir);
+  writeVault({ ...state, secrets: [...state.secrets, secret] }, dir);
+  return secret;
+}
+
+export function updateSecret(id: string, input: SecretInput, dir = vaultDir(), now = new Date()): VaultSecret {
+  const state = readVault(dir);
+  const found = state.secrets.find((s) => s.id === id);
+  if (found === undefined) throw new ApiError('no such secret', 404);
+  const next: VaultSecret = {
+    ...found,
+    ...(input.name === undefined ? {} : { name: normalizeName(input.name) }),
+    ...(input.hosts === undefined ? {} : { hosts: normalizeHosts(input.hosts) }),
+    updatedAt: now.toISOString(),
+  };
+  if (input.value !== undefined) saveValue(id, normalizeValue(input.value), dir);
+  writeVault({ ...state, secrets: state.secrets.map((s) => (s.id === id ? next : s)) }, dir);
+  return next;
+}
+
+export function removeSecret(id: string, dir = vaultDir()): void {
+  const state = readVault(dir);
+  if (!state.secrets.some((s) => s.id === id)) throw new ApiError('no such secret', 404);
+  writeVault({ ...state, secrets: state.secrets.filter((s) => s.id !== id) }, dir);
+  rmSync(valueFile(id, dir), { force: true });
+}
+
+export function setVaultEnabled(enabled: boolean, dir = vaultDir()): VaultState {
+  const next = { ...readVault(dir), enabled };
+  writeVault(next, dir);
+  return next;
+}
+
+export const hasValue = (id: string, dir = vaultDir()): boolean => existsSync(valueFile(id, dir));

package/runtime/node_modules/@metro-labs/daemon/src/vault/trust.ts

@@ -0,0 +1,61 @@
+import { spawnSync } from 'node:child_process';
+import { copyFileSync, chmodSync, existsSync, readFileSync, rmSync } from 'node:fs';
+import { errMsg, log } from '@metro-labs/core/log';
+import { asUser, type AgentUser } from '../agent-user/user.js';
+import { TRUSTED_CA } from './paths.js';
+import { mustHelper, rootHelper, runningAsMetro } from '../metro-user/privilege.js';
+
+const has = (bin: string): boolean => spawnSync('sh', ['-c', `command -v ${bin}`], { stdio: 'ignore' }).status === 0;
+
+export function trustSystem(caFile: string): void {
+  const same = existsSync(TRUSTED_CA) && readFileSync(TRUSTED_CA, 'utf8') === readFileSync(caFile, 'utf8');
+  if (same) return;
+  if (runningAsMetro()) {
+    mustHelper(['trust-ca']);
+    return;
+  }
+  copyFileSync(caFile, TRUSTED_CA);
+  chmodSync(TRUSTED_CA, 0o644);
+  const run = spawnSync('update-ca-certificates', [], { encoding: 'utf8' });
+  if (run.status !== 0) throw new Error(`update-ca-certificates failed: ${run.stderr.trim()}`);
+}
+
+export function untrustSystem(): void {
+  if (!existsSync(TRUSTED_CA)) return;
+  if (runningAsMetro()) {
+    mustHelper(['untrust-ca']);
+    return;
+  }
+  rmSync(TRUSTED_CA, { force: true });
+  spawnSync('update-ca-certificates', ['--fresh'], { stdio: 'ignore' });
+}
+
+const NSS_SCRIPT = [
+  'set -e',
+  'db="$HOME/.pki/nssdb"',
+  'mkdir -p "$db"',
+  '[ -f "$db/cert9.db" ] || certutil -d "sql:$db" -N --empty-password',
+  'certutil -d "sql:$db" -D -n "Metro vault" >/dev/null 2>&1 || true',
+  'certutil -d "sql:$db" -A -t "C,," -n "Metro vault" -i "$1"',
+].join('\n');
+
+function ensureCertutil(): boolean {
+  if (has('certutil')) return true;
+  if (runningAsMetro()) return rootHelper(['install-nss-tools']).status === 0 && has('certutil');
+  if (!has('apt-get')) return false;
+  const run = spawnSync('apt-get', ['install', '-y', '-q', 'libnss3-tools'], { stdio: 'ignore', timeout: 180_000, env: { ...process.env, DEBIAN_FRONTEND: 'noninteractive' } });
+  return run.status === 0 && has('certutil');
+}
+
+export function trustBrowsers(user: AgentUser): string | null {
+  try {
+    if (!ensureCertutil()) return 'certutil is missing, so browsers the agent starts will not trust the vault (apt-get install libnss3-tools)';
+    const [file, argv] = asUser(user, 'sh', ['-c', NSS_SCRIPT, 'metro', TRUSTED_CA]);
+    const run = spawnSync(file, argv, { encoding: 'utf8', timeout: 30_000 });
+    if (run.status !== 0) return `browsers will not trust the vault: ${run.stderr.trim()}`;
+    return null;
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'vault: could not add the certificate for browsers');
+    return errMsg(err);
+  }
+}

package/runtime/node_modules/@metro-labs/{discord → discord-bot}/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "@metro-labs/discord",
+  "name": "@metro-labs/discord-bot",
   "version": "0.1.0",
   "private": true,
   "type": "module",
@@ -13,10 +13,8 @@
     "test": "tsc --noEmit && bun test test/"
   },
   "dependencies": {
-    "@metro-labs/mcp": "workspace:*",
-    "@discordjs/voice": "^0.19.2",
-    "discord.js": "^14.26.4",
-    "prism-media": "^1.3.5"
+    "@metro-labs/core": "workspace:*",
+    "discord.js": "^14.26.4"
   },
   "devDependencies": {
     "@stage-labs/config": "0.1.0-beta.2",

package/runtime/node_modules/@metro-labs/{discord → discord-bot}/src/accounts.ts

@@ -4,25 +4,23 @@ import { join } from 'node:path';
 import {
   makeAccountStore,
   resolveAccountId,
-} from '@metro-labs/mcp/stations/account-store';
-import { Line } from '@metro-labs/mcp/lines';
+} from '@metro-labs/core/stations/account-store';
+import { Line } from '@metro-labs/core/lines';
 import { emit } from './wire.js';
 import { API } from './api-base.js';
 
 const ACCOUNTS_FILE =
-  process.env.DISCORD_ACCOUNTS_FILE ??
-  join(homedir(), '.metro', 'discord-accounts.json');
+  process.env.DISCORD_BOT_ACCOUNTS_FILE ??
+  join(homedir(), '.metro', 'discord-bot-accounts.json');
 
 export interface AccountConfig {
   id: string;
   token: string;
-  owner?: string;
 }
 
 export const { loadAccounts } = makeAccountStore<AccountConfig>({
-  prefix: 'discord',
+  prefix: 'discord-bot',
   file: ACCOUNTS_FILE,
-  allowlistEnv: ['DISCORD_ONLY_ACCOUNTS', 'DISCORD_ACCOUNTS'],
   validate(raw, die) {
     const seen = new Set<string>();
     for (const a of raw) {
@@ -67,11 +65,11 @@ export async function rest<T = unknown>(
   if (!acct) throw new Error(`unknown account '${accountId}'`);
   const headers: Record<string, string> = {
     Authorization: `Bot ${acct.cfg.token}`,
-    'User-Agent': 'metro-discord-train (https://github.com/bonustrack/stage)',
+    'User-Agent': 'metro-discord-bot-train (https://github.com/bonustrack/stage)',
   };
   if (body !== undefined && !isForm)
     headers['Content-Type'] = 'application/json';
-  emit({ op: 'log', text: `discord[${accountId}] api ${method} ${path}` });
+  emit({ op: 'log', text: `discord-bot[${accountId}] api ${method} ${path}` });
   const res = await fetch(`${API}${path}`, {
     method,
     headers,
@@ -80,17 +78,17 @@ export async function rest<T = unknown>(
   });
   emit({
     op: 'log',
-    text: `discord[${accountId}] api ${method} ${path} -> ${res.status}`,
+    text: `discord-bot[${accountId}] api ${method} ${path} -> ${res.status}`,
   });
   if (!res.ok) {
     const text = await res.text().catch(() => '');
-    throw new Error(`discord ${method} ${path}: ${res.status} ${text}`);
+    throw new Error(`discord-bot ${method} ${path}: ${res.status} ${text}`);
   }
   return restResult<T>(res);
 }
 
 export function lineOf(accountId: string, channelId: string): string {
-  return `metro://discord/${accountId}/${channelId}`;
+  return `metro://discord-bot/${accountId}/${channelId}`;
 }
 
 export function parseLine(
@@ -109,7 +107,7 @@ export function routeOf(
   account?: string,
 ): { accountId: string; channelId: string } {
   const parsed = parseLine(line);
-  if (!parsed) throw new Error(`bad discord line: ${line}`);
+  if (!parsed) throw new Error(`bad discord-bot line: ${line}`);
   const accountId = account ?? parsed.accountId;
   if (!accounts.has(accountId))
     throw new Error(`unknown account '${accountId}' in line ${line}`);

package/runtime/node_modules/@metro-labs/{discord → discord-bot}/src/actions.ts

@@ -1,20 +1,13 @@
+import type { Message } from 'discord.js';
 import {
-  ActivityType,
-  type Message,
-  type PresenceStatusData,
-} from 'discord.js';
-import {
-  accountFor,
   accounts,
   encodeEmoji,
-  lineOf,
   rest,
   routeOf,
 } from './accounts.js';
 import { emitOutbound, emitOutboundEdit, emitOutboundReact } from './format.js';
 import { respond } from './wire.js';
-import { normalizeDiscord } from '@metro-labs/mcp/stations/messaging-normalize';
-import { assertContentLength } from '@metro-labs/mcp/stations/attachments';
+import { normalizeDiscord } from '@metro-labs/core/stations/messaging-normalize';
 import {
   appendFiles,
   outgoingFiles,
@@ -24,9 +17,8 @@ import {
   makeStation,
   type CallMsg,
   type StationHandler,
-} from '@metro-labs/mcp/stations/station-runtime';
-import { joinVoice, leaveVoice, voiceDebug, voiceTranscribe } from './voice.js';
-import { speak } from './voice-speak.js';
+} from '@metro-labs/core/stations/station-runtime';
+import { readProfile, setProfile } from './profile.js';
 import { discordMembers } from './members.js';
 import {
   groupAddHandler,
@@ -110,38 +102,6 @@ async function send(id: string, args: Record<string, unknown>): Promise<void> {
   });
 }
 
-function presence(id: string, args: Record<string, unknown>): void {
-  const {
-    text,
-    status = 'online',
-    account,
-  } = args as {
-    text?: string;
-    status?: PresenceStatusData;
-    account?: string;
-  };
-  const accountId = accountFor({ account });
-  const acct = accounts.get(accountId);
-  if (!acct) {
-    respond(id, { error: `unknown account '${accountId}'` });
-    return;
-  }
-  const client = acct.client;
-  if (!client.user) {
-    respond(id, { error: `gateway not ready for account '${accountId}'` });
-    return;
-  }
-  client.user.setPresence({
-    status,
-    activities: text
-      ? [{ name: 'Custom Status', type: ActivityType.Custom, state: text }]
-      : [],
-  });
-  respond(id, {
-    result: { ok: true, text: text ?? null, status, account: accountId },
-  });
-}
-
 const profileUrl = (userId?: string): string | null =>
   userId === undefined ? null : `https://discord.com/users/${userId}`;
 
@@ -154,7 +114,6 @@ function listAccounts(id: string): void {
         url: profileUrl(a.client.user?.id),
         userId: a.client.user?.id ?? null,
         username: a.client.user?.username ?? null,
-        owner: a.cfg.owner ?? null,
         ready: a.client.isReady(),
       })),
     },
@@ -244,104 +203,6 @@ async function fetchMessages(
   respond(id, { result: { messages: msgs, account: accountId } });
 }
 
-async function download(
-  id: string,
-  args: Record<string, unknown>,
-): Promise<void> {
-  const {
-    line,
-    messageId,
-    outDir = '/tmp',
-    account,
-  } = args as {
-    line: string;
-    messageId: string;
-    outDir?: string;
-    account?: string;
-  };
-  const { accountId, channelId } = routeOf(line, account);
-  const msg = await rest<{
-    attachments: { url: string; content_type?: string; filename: string }[];
-  }>(accountId, 'GET', `/channels/${channelId}/messages/${messageId}`);
-  const files: { path: string; mediaType: string }[] = [];
-  for (const att of msg.attachments) {
-    const res = await fetch(att.url, { signal: AbortSignal.timeout(60_000) });
-    if (!res.ok)
-      throw new Error(`discord download ${res.status} for ${att.url}`);
-    assertContentLength(res.headers.get('content-length'));
-    const buf = await res.arrayBuffer();
-    const path = `${outDir}/${messageId}-${att.filename}`;
-    await Bun.write(path, buf);
-    files.push({
-      path,
-      mediaType: att.content_type ?? 'application/octet-stream',
-    });
-  }
-  respond(id, { result: { files, account: accountId } });
-}
-
-async function threadCreate(
-  id: string,
-  args: Record<string, unknown>,
-): Promise<void> {
-  const {
-    line,
-    messageId,
-    name,
-    autoArchiveDuration = 1440,
-    account,
-  } = args as {
-    line: string;
-    messageId?: string;
-    name: string;
-    autoArchiveDuration?: number;
-    account?: string;
-  };
-  const { accountId, channelId } = routeOf(line, account);
-  const path = messageId
-    ? `/channels/${channelId}/messages/${messageId}/threads`
-    : `/channels/${channelId}/threads`;
-  const res = await rest<{ id: string }>(accountId, 'POST', path, {
-    name,
-    auto_archive_duration: autoArchiveDuration,
-  });
-  respond(id, {
-    result: {
-      threadId: res.id,
-      line: lineOf(accountId, res.id),
-      account: accountId,
-    },
-  });
-}
-
-async function pin(id: string, args: Record<string, unknown>): Promise<void> {
-  const { line, messageId, account } = args as {
-    line: string;
-    messageId: string;
-    account?: string;
-  };
-  const { accountId, channelId } = routeOf(line, account);
-  await rest(accountId, 'PUT', `/channels/${channelId}/pins/${messageId}`);
-  respond(id, { result: { ok: true, account: accountId } });
-}
-
-async function typing(id: string, args: Record<string, unknown>): Promise<void> {
-  const { line, account } = args as { line: string; account?: string };
-  const { accountId, channelId } = routeOf(line, account);
-  await rest(accountId, 'POST', `/channels/${channelId}/typing`);
-  respond(id, { result: { ok: true, account: accountId } });
-}
-
-async function channel(
-  id: string,
-  args: Record<string, unknown>,
-): Promise<void> {
-  const { line, account } = args as { line: string; account?: string };
-  const { accountId, channelId } = routeOf(line, account);
-  const res = await rest(accountId, 'GET', `/channels/${channelId}`);
-  respond(id, { result: res });
-}
-
 async function listMembers(
   id: string,
   args: Record<string, unknown>,
@@ -368,18 +229,9 @@ const HANDLERS: Record<string, StationHandler> = {
   edit,
   delete: remove,
   fetch: fetchMessages,
-  download,
-  thread_create: threadCreate,
-  pin,
-  typing,
-  channel,
   listMembers,
-  set_presence: presence,
-  joinVoice,
-  leaveVoice,
-  speak,
-  voiceDebug,
-  voiceTranscribe,
+  set_profile: setProfile,
+  profile: readProfile,
 };
 
 export const handleCall = makeStation({

package/runtime/node_modules/@metro-labs/{discord → discord-bot}/src/attachments.ts

@@ -1,8 +1,8 @@
 import {
   saveBufferToCache,
   assertContentLength,
-} from '@metro-labs/mcp/stations/attachments';
-import type { SavedAttachment } from '@metro-labs/mcp/stations/attachments';
+} from '@metro-labs/core/stations/attachments';
+import type { SavedAttachment } from '@metro-labs/core/stations/attachments';
 
 export type { SavedAttachment };
 
@@ -19,7 +19,7 @@ export async function saveDiscordAttachment(
 ): Promise<SavedAttachment> {
   const res = await fetch(a.url, { signal: AbortSignal.timeout(60_000) });
   if (!res.ok)
-    throw new Error(`discord attachment fetch ${res.status} for ${a.url}`);
+    throw new Error(`discord-bot attachment fetch ${res.status} for ${a.url}`);
   assertContentLength(res.headers.get('content-length'));
   const data = new Uint8Array(await res.arrayBuffer());
   return saveBufferToCache(data, messageId, index, {

package/runtime/node_modules/@metro-labs/{discord → discord-bot}/src/format.ts

@@ -1,56 +1,9 @@
 import { MessageFlags, type Message, type MessageReaction, type User } from 'discord.js';
+import { reportAttachment, selfUri } from '@metro-labs/core/stations/train-events';
 import { accounts, lineOf } from './accounts.js';
-import { emit, mintId, SELF_URI } from './wire.js';
+import { emit, mintId } from './wire.js';
 import { saveDiscordAttachment } from './attachments.js';
 
-export function emitInbound(
-  accountId: string,
-  e: Record<string, unknown>,
-): void {
-  const owner = accounts.get(accountId)?.cfg.owner;
-  const payload = {
-    ...(e.payload as Record<string, unknown> | undefined),
-    account: accountId,
-  };
-  emit({ ...e, ...(owner ? { to: owner } : {}), account: accountId, payload });
-}
-
-function emitAttachmentSaved(
-  accountId: string,
-  line: string,
-  sourceMsgId: string,
-  index: number,
-  ref: { url: string; name?: string | null; contentType?: string | null },
-  messageId: string,
-): void {
-  void saveDiscordAttachment(ref, messageId, index)
-    .then((saved) => {
-      emitInbound(accountId, {
-        kind: 'inbound',
-        id: mintId(),
-        ts: new Date().toISOString(),
-        station: 'discord',
-        line,
-        from: SELF_URI,
-        text: `📎 saved: ${saved.path}`,
-        payload: {
-          contentType: 'attachmentSaved',
-          attachmentFor: sourceMsgId,
-          index,
-          attachmentPath: saved.path,
-          localPath: saved.path,
-          mime: saved.mime,
-          name: saved.name,
-        },
-      });
-    })
-    .catch((err: unknown) =>
-      process.stderr.write(
-        `discord attachment save failed: ${err instanceof Error ? err.message : String(err)}\n`,
-      ),
-    );
-}
-
 const AV_TAG: Record<string, string> = { audio: 'audio', video: 'video' };
 
 function tagFor(att: {
@@ -65,6 +18,20 @@ function tagFor(att: {
   return `[${kind}: ${att.name ?? kind}]`;
 }
 
+function addressing(accountId: string, m: Message): { mentions_self: boolean; reply_to_self: boolean } {
+  const me = accounts.get(accountId)?.client.user ?? null;
+  if (me === null) return { mentions_self: false, reply_to_self: false };
+  return {
+    mentions_self: m.mentions.has(me, { ignoreRepliedUser: true, ignoreEveryone: true }),
+    reply_to_self: m.mentions.repliedUser?.id === me.id,
+  };
+}
+
+const senderOf = (m: Message): Record<string, string | undefined> => ({
+  from_name: m.author.username,
+  from_display_name: m.member?.displayName ?? m.author.globalName ?? undefined,
+});
+
 export function messageEnvelope(
   accountId: string,
   m: Message,
@@ -89,29 +56,26 @@ export function messageEnvelope(
     size: a.size,
   }));
   attachments.forEach((a, i) => {
-    emitAttachmentSaved(
-      accountId,
-      line,
-      envId,
-      i,
-      { url: a.url, name: a.name, contentType: a.contentType },
-      m.id,
+    reportAttachment(
+      saveDiscordAttachment({ url: a.url, name: a.name, contentType: a.contentType }, m.id, i),
+      { station: 'discord-bot', account: accountId, line, forId: envId, index: i },
+      { failed: { name: a.name, mime: a.contentType ?? undefined } },
     );
   });
   return {
     kind: 'inbound',
     id: envId,
     ts: new Date(m.createdTimestamp).toISOString(),
-    station: 'discord',
+    station: 'discord-bot',
     line,
     line_name: 'name' in m.channel ? m.channel.name : undefined,
-    from: `metro://discord/${accountId}/user/${m.author.id}`,
-    from_name: m.author.username,
-    from_display_name: m.author.globalName ?? undefined,
+    from: `metro://discord-bot/${accountId}/user/${m.author.id}`,
+    ...senderOf(m),
     message_id: m.id,
     text,
     is_private: m.guildId == null,
     reply_to: m.reference?.messageId ?? undefined,
+    ...addressing(accountId, m),
     ...(m.reference?.messageId
       ? { event: { type: 'reply', replyTo: m.reference.messageId } }
       : {}),
@@ -129,9 +93,9 @@ export function reactionEnvelope(
     kind: 'react',
     id: mintId(),
     ts: new Date().toISOString(),
-    station: 'discord',
+    station: 'discord-bot',
     line: lineOf(accountId, r.message.channelId),
-    from: `metro://discord/${accountId}/user/${u.id}`,
+    from: `metro://discord-bot/${accountId}/user/${u.id}`,
     from_name: u.username,
     from_display_name: u.globalName ?? undefined,
     message_id: r.message.id,
@@ -162,9 +126,9 @@ function outbound(
     kind,
     id: mintId(),
     ts: new Date().toISOString(),
-    station: 'discord',
+    station: 'discord-bot',
     line,
-    from: SELF_URI,
+    from: selfUri('discord-bot', accountId),
     to: line,
     message_id: messageId,
     ...extra,

package/runtime/node_modules/@metro-labs/{discord → discord-bot}/src/group-actions.ts

@@ -17,7 +17,7 @@ export async function groupCreateHandler(
         capability: {
           supported: false,
           reason:
-            'discord create_group requires `parent` (the metro:// line of the channel to open the thread under)',
+            'discord-bot create_group requires `parent` (the metro:// line of the channel to open the thread under)',
         },
       },
     });

package/runtime/node_modules/@metro-labs/{discord → discord-bot}/src/group.ts

@@ -1,8 +1,8 @@
-import { errMsg } from '@metro-labs/mcp/log';
+import { errMsg } from '@metro-labs/core/log';
 import type {
   GroupResult,
   MemberOutcome,
-} from '@metro-labs/mcp/stations/types';
+} from '@metro-labs/core/stations/types';
 import { lineOf } from './accounts.js';
 
 export type RestFn = <T = unknown>(