@vellumai/assistant 0.11.2-dev.202608070534.d55eaf1 → 0.11.2-dev.202608070630.7754d48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.11.2-dev.202608070534.d55eaf1",
+  "version": "0.11.2-dev.202608070630.7754d48",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/manual-token-reconciliation.test.ts

@@ -139,6 +139,51 @@ describe("syncManualTokenConnection", () => {
     warnings.length = 0;
   });
 
+  // ---- Discord server bot: one required field ----
+
+  test("connects discord_channel once the bot token is stored", async () => {
+    // Seeding the provider without this reconciliation leaves it listed and
+    // permanently disconnected, which is worse than not listing it: the
+    // setup skill stores the token and nothing ever reflects that.
+    setCredentialResult("discord_channel", "bot_token", {
+      value: "bot-token-value",
+      unreachable: false,
+    });
+
+    await syncManualTokenConnection("discord_channel");
+
+    expect(createdConnections.map((c) => c.provider)).toContain(
+      "discord_channel",
+    );
+  });
+
+  test("removes the discord_channel connection when the bot token is gone", async () => {
+    seedConnection("discord_channel");
+    setCredentialResult("discord_channel", "bot_token", {
+      value: undefined,
+      unreachable: false,
+    });
+
+    await syncManualTokenConnection("discord_channel");
+
+    expect(deletedConnectionIds).toContain("conn-discord_channel");
+  });
+
+  test("leaves the discord_channel row alone when the backend is unreachable", async () => {
+    // An unreachable credential store is not evidence the token is gone, so
+    // reconciliation must not read it as a disconnection.
+    seedConnection("discord_channel");
+    setCredentialResult("discord_channel", "bot_token", {
+      value: undefined,
+      unreachable: true,
+    });
+
+    await syncManualTokenConnection("discord_channel");
+
+    expect(deletedConnectionIds).not.toContain("conn-discord_channel");
+    expect(connectionStore["discord_channel"]).toBeDefined();
+  });
+
   // ---- Slack: reachable backend, missing tokens -> removes row ----
 
   test("removes slack_channel connection when bot token is missing and backend is reachable", async () => {

package/src/oauth/byo-connection.ts

@@ -47,6 +47,11 @@ export class BYOOAuthConnection implements OAuthConnection {
       async (token) => {
         const effectiveBaseUrl = req.baseUrl ?? this.baseUrl;
         const isTelegram = this.provider === "telegram";
+        // Discord bot tokens authenticate with the `Bot ` scheme, not
+        // `Bearer`. Sending Bearer here reaches Discord as an unusable
+        // credential and comes back 401, which reads as a revoked token.
+        const authScheme =
+          this.provider === "discord_channel" ? "Bot" : "Bearer";
         const requestPath = isTelegram
           ? buildTelegramBotApiPath(req.path, token)
           : req.path;
@@ -87,7 +92,7 @@ export class BYOOAuthConnection implements OAuthConnection {
           }
         }
         if (!isTelegram) {
-          headers.set("Authorization", `Bearer ${token}`);
+          headers.set("Authorization", `${authScheme} ${token}`);
         }
 
         const resp = await fetch(fullUrl, {

package/src/oauth/credential-token-resolver.ts

@@ -49,6 +49,8 @@ function manualTokenAccessCredentialKey(provider: string): string | null {
       return credentialKey("slack_channel", "bot_token");
     case "telegram":
       return credentialKey("telegram", "bot_token");
+    case "discord_channel":
+      return credentialKey("discord_channel", "bot_token");
     case "sanity":
       return credentialKey("sanity", "api_token");
     default:

package/src/oauth/manual-token-connection.ts

@@ -178,6 +178,24 @@ export async function syncManualTokenConnection(
       return;
     }
 
+    case "discord_channel": {
+      const botTokenResult = await getSecureKeyResultAsync(
+        credentialKey("discord_channel", "bot_token"),
+      );
+      if (botTokenResult.unreachable) {
+        log.warn(
+          "Skipping discord_channel manual-token reconciliation — credential backend unreachable",
+        );
+        return;
+      }
+      if (botTokenResult.value) {
+        await ensureManualTokenConnection(provider, accountInfoToStore);
+      } else {
+        removeManualTokenConnection(provider);
+      }
+      return;
+    }
+
     case "sanity": {
       const tokenResult = await getSecureKeyResultAsync(
         credentialKey("sanity", "api_token"),
@@ -216,5 +234,6 @@ export async function syncManualTokenConnection(
 export async function backfillManualTokenConnections(): Promise<void> {
   await syncManualTokenConnection("telegram");
   await syncManualTokenConnection("slack_channel");
+  await syncManualTokenConnection("discord_channel");
   await syncManualTokenConnection("sanity");
 }

package/src/oauth/seed-providers.ts

@@ -454,16 +454,15 @@ export const PROVIDER_SEED_DATA: Record<
     pingUrl: "https://discord.com/api/v10/users/@me",
     baseUrl: "https://discord.com/api/v10",
     displayLabel: "Discord",
-    description: "Servers and messages",
+    // Your servers, not their contents. These scopes reach the guild list and
+    // your membership in one; reading messages is not among them. Discord
+    // documents `messages.read` as local RPC only, so requesting it would put
+    // a permission on the consent screen that grants nothing here.
+    description: "Your servers and profile",
     dashboardUrl: "https://discord.com/developers/applications",
     clientIdPlaceholder: null,
     logoUrl: "https://cdn.simpleicons.org/discord",
-    defaultScopes: [
-      "identify",
-      "guilds",
-      "guilds.members.read",
-      "messages.read",
-    ],
+    defaultScopes: ["identify", "guilds", "guilds.members.read"],
     availableScopes:
       "https://discord.com/developers/docs/topics/oauth2#shared-resources-oauth2-scopes",
     loopbackPort: 17326,
@@ -777,6 +776,35 @@ export const PROVIDER_SEED_DATA: Record<
     ],
   },
 
+  // The bot that sits in a server and talks to people there, which is a
+  // different thing from the `discord` integration above and starts at the
+  // same Discord authorize URL. Both are reasonably called "connecting
+  // Discord", so each has to be nameable on its own. The bot token is already
+  // stored under this key by `skills/discord-app-setup`; seeding the provider
+  // is what lets the product tell the two apart.
+  discord_channel: {
+    provider: "discord_channel",
+    authorizeUrl: "urn:manual-token",
+    tokenExchangeUrl: "urn:manual-token",
+    pingUrl: "https://discord.com/api/v10/users/@me",
+    baseUrl: "https://discord.com/api/v10",
+    displayLabel: "Discord Server",
+    description: "A bot in your server",
+    dashboardUrl: "https://discord.com/developers/applications",
+    clientIdPlaceholder: null,
+    requiresClientSecret: false,
+    logoUrl: "https://cdn.simpleicons.org/discord",
+    defaultScopes: [],
+    injectionTemplates: [
+      {
+        hostPattern: "discord.com",
+        injectionType: "header",
+        headerName: "Authorization",
+        valuePrefix: "Bot ",
+      },
+    ],
+  },
+
   telegram: {
     provider: "telegram",
     authorizeUrl: "urn:manual-token",