@zhin.js/adapter-discord 1.1.26 → 1.1.28

package/lib/webhook.d.ts

@@ -1,9 +1,5 @@
 import { type Endpoint } from 'zhin.js/adapter';
-/**
- * Discord interactions HTTP: signature → parse → admit.
- */
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { HttpHost, HttpRouteRegistration } from '@zhin.js/host-http';
+import { type HttpHost, type HttpRouteRegistration } from '@zhin.js/host-http';
 import { type DiscordInboundMessage, type DiscordButtonInbound, type ResolvedDiscordInteractionsConfig } from './protocol.js';
 export interface DiscordInteractionsHandler extends Endpoint {
     readonly config: ResolvedDiscordInteractionsConfig;
@@ -13,4 +9,4 @@ export interface DiscordInteractionsHandler extends Endpoint {
     admitPlatform(event: Record<string, unknown>): void;
 }
 export declare function registerDiscordInteractionRoutes(http: HttpHost, handler: DiscordInteractionsHandler): HttpRouteRegistration[];
-export declare function handleDiscordInteractionRequest(request: IncomingMessage, response: ServerResponse, handler: DiscordInteractionsHandler): Promise<void>;
+export declare function handleDiscordInteractionRequest(request: Request, handler: DiscordInteractionsHandler): Promise<Response>;

package/lib/webhook.js

@@ -1,5 +1,9 @@
 import { endpointSpec } from 'zhin.js/adapter';
+/**
+ * Discord interactions HTTP: signature → parse → admit.
+ */
 import { createMessages } from 'zhin.js/i18n';
+import { readTextBody } from '@zhin.js/host-http';
 import { getLogger } from '@zhin.js/logger';
 import { interactionToInboundMessage, verifyDiscordInteractionSignature, } from './protocol.js';
 const logger = getLogger('discord');
@@ -15,55 +19,44 @@ const INTERACTION_FLAG_EPHEMERAL = 64;
 export function registerDiscordInteractionRoutes(http, handler) {
     const path = handler.config.interactionsPath;
     return [
-        http.route('POST', path, async (request, response) => {
-            await handleDiscordInteractionRequest(request, response, handler);
-        }, { summary: 'Discord interactions callback', tags: ['discord'] }),
+        http.route('POST', path, (request) => handleDiscordInteractionRequest(request, handler), { summary: 'Discord interactions callback', tags: ['discord'] }),
     ];
 }
-export async function handleDiscordInteractionRequest(request, response, handler) {
+export async function handleDiscordInteractionRequest(request, handler) {
     try {
-        const signature = headerValue(request.headers['x-signature-ed25519']);
-        const timestamp = headerValue(request.headers['x-signature-timestamp']);
-        const rawBody = await readInteractionBody(request);
+        const signature = request.headers.get('x-signature-ed25519') ?? '';
+        const timestamp = request.headers.get('x-signature-timestamp') ?? '';
+        // Oversize bodies (> 1 MiB) fail and answer 500, as before.
+        const rawBody = await readTextBody(request);
         if (!signature || !timestamp) {
-            response.writeHead(401, { 'Content-Type': 'text/plain' });
-            response.end('Unauthorized');
-            return;
+            return new Response('Unauthorized', { status: 401, headers: { 'Content-Type': 'text/plain' } });
         }
         if (!verifyDiscordInteractionSignature(handler.config.publicKey, rawBody, signature, timestamp)) {
-            response.writeHead(401, { 'Content-Type': 'text/plain' });
-            response.end('Unauthorized');
-            return;
+            return new Response('Unauthorized', { status: 401, headers: { 'Content-Type': 'text/plain' } });
         }
         const interaction = JSON.parse(rawBody);
         if (!interaction || interaction.application_id !== handler.config.applicationId) {
-            response.writeHead(401, { 'Content-Type': 'text/plain' });
-            response.end('Unauthorized');
-            return;
+            return new Response('Unauthorized', { status: 401, headers: { 'Content-Type': 'text/plain' } });
         }
         // A verified protocol challenge is not a business message and keeps its immediate ACK.
         if (interaction.type === INTERACTION_TYPE_PING) {
             if (handler.isOpen)
                 void handler[endpointSpec].events.run(() => handler.admitPlatform(interaction))
                     .catch(() => logger.debug('Protocol event dispatch did not complete'));
-            writeJson(response, 200, { type: INTERACTION_RESPONSE_PONG });
-            return;
+            return writeJson(200, { type: INTERACTION_RESPONSE_PONG });
         }
-        await handler[endpointSpec].events.run(async () => {
+        return await handler[endpointSpec].events.run(async () => {
             if (handler.isOpen)
                 handler.admitPlatform(interaction);
             if (interaction.type === 3) {
                 const data = interaction.data;
                 if (data?.component_type === 2 && typeof data.custom_id === 'string') {
                     if (!handler.isOpen) {
-                        response.writeHead(503);
-                        response.end('Unavailable');
-                        return;
+                        return new Response('Unavailable', { status: 503 });
                     }
                     const message = interactionToInboundMessage(interaction);
-                    handler.admitButton({ event: interaction, id: message.id, customId: data.custom_id, channelId: message.channelId, channelKind: message.channelKind, userId: message.authorId, userName: message.authorName, ...(message.guildId ? { guildId: message.guildId } : {}), sourceMessageId: interaction.message?.id });
-                    writeJson(response, 200, { type: 6 });
-                    return;
+                    handler.admitButton({ event: interaction, id: message.id, customId: data.custom_id, channelId: message.channelId, channelKind: message.channelKind, userId: message.authorId, userName: message.authorName, ...(message.guildId ? { guildId: message.guildId } : {}), ...(message.threadParentId ? { threadParentId: message.threadParentId } : {}), sourceMessageId: interaction.message?.id });
+                    return writeJson(200, { type: 6 });
                 }
             }
             if (interaction.type === INTERACTION_TYPE_APPLICATION_COMMAND) {
@@ -74,47 +67,22 @@ export async function handleDiscordInteractionRequest(request, response, handler
                 const locale = await handler[endpointSpec].resolveLocale(message.authorId);
                 // 即时响应（type 4）：defer(type 5) 需要 followup PATCH，未实现会让用户端一直转圈
                 const commandName = String(interaction.data?.name ?? '');
-                writeJson(response, 200, {
+                return writeJson(200, {
                     type: INTERACTION_RESPONSE_CHANNEL_MESSAGE_WITH_SOURCE,
                     data: {
                         content: messages(locale, 'processing', { command: commandName }),
                         flags: INTERACTION_FLAG_EPHEMERAL,
                     },
                 });
-                return;
             }
-            response.writeHead(400, { 'Content-Type': 'text/plain' });
-            response.end('Unsupported interaction type');
+            return new Response('Unsupported interaction type', { status: 400, headers: { 'Content-Type': 'text/plain' } });
         });
     }
     catch (error) {
         logger.error('Discord interactions error:', error);
-        if (!response.headersSent) {
-            response.writeHead(500, { 'Content-Type': 'text/plain' });
-            response.end('Internal Server Error');
-        }
-    }
-}
-function headerValue(value) {
-    if (Array.isArray(value))
-        return value[0] ?? '';
-    return value ?? '';
-}
-async function readInteractionBody(request) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of request) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        size += buffer.length;
-        if (size > 1_048_576) {
-            request.destroy();
-            throw new Error('Request body exceeds 1MB');
-        }
-        chunks.push(buffer);
+        return new Response('Internal Server Error', { status: 500, headers: { 'Content-Type': 'text/plain' } });
     }
-    return Buffer.concat(chunks).toString('utf8');
 }
-function writeJson(response, status, body) {
-    response.writeHead(status, { 'Content-Type': 'application/json' });
-    response.end(JSON.stringify(body));
+function writeJson(status, body) {
+    return new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhin.js/adapter-discord",
-  "version": "1.1.26",
+  "version": "1.1.28",
   "description": "Zhin.js Discord adapter for Plugin Runtime (Gateway WebSocket)",
   "type": "module",
   "main": "./lib/index.js",
@@ -35,25 +35,25 @@
     "@discordjs/ws": "1.2.3",
     "discord.js": "^14.27.0",
     "undici": "6.29.1",
-    "@zhin.js/adapter": "1.1.32",
-    "@zhin.js/agent-feature": "1.1.16",
-    "@zhin.js/console-contract": "1.1.5",
-    "@zhin.js/core": "1.1.60",
-    "@zhin.js/feature-kit": "1.1.15",
-    "@zhin.js/host-http": "1.1.17",
-    "@zhin.js/im-contract": "1.1.13",
-    "@zhin.js/logger": "1.1.2",
-    "@zhin.js/page": "1.1.17",
-    "@zhin.js/permission": "1.1.15",
-    "@zhin.js/skill": "1.1.16",
-    "@zhin.js/tool": "1.1.18"
+    "zod": "^4.6.7",
+    "@zhin.js/adapter": "1.1.33",
+    "@zhin.js/agent-feature": "1.1.17",
+    "@zhin.js/console-contract": "1.1.6",
+    "@zhin.js/core": "1.2.0",
+    "@zhin.js/feature-kit": "1.1.16",
+    "@zhin.js/host-http": "1.2.0",
+    "@zhin.js/im-contract": "1.1.14",
+    "@zhin.js/logger": "1.1.3",
+    "@zhin.js/page": "1.1.18",
+    "@zhin.js/permission": "1.2.0",
+    "@zhin.js/skill": "1.1.17",
+    "@zhin.js/tool": "1.1.19"
   },
   "peerDependencies": {
-    "zod": "^4.0.0",
-    "@zhin.js/adapter": "^1.1.32",
-    "@zhin.js/command": "^1.1.17",
-    "@zhin.js/core": "^1.1.60",
-    "zhin.js": "^1.1.25"
+    "@zhin.js/adapter": "^1.1.33",
+    "@zhin.js/command": "^1.2.0",
+    "@zhin.js/core": "^1.2.0",
+    "zhin.js": "^1.1.26"
   },
   "peerDependenciesMeta": {
     "@zhin.js/command": {
@@ -61,18 +61,16 @@
     },
     "zhin.js": {
       "optional": true
-    },
-    "zod": {
-      "optional": true
     }
   },
   "devDependencies": {
     "@types/node": "^26.1.2",
+    "ajv": "8.18.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "zod": "^4.4.3",
-    "@zhin.js/host-http": "1.1.17",
-    "zhin.js": "1.1.25"
+    "ws": "^8.21.1",
+    "@zhin.js/host-http": "1.2.0",
+    "zhin.js": "1.1.26"
   },
   "files": [
     "adapters",
@@ -131,6 +129,6 @@
   "scripts": {
     "build": "tsc",
     "clean": "rimraf lib",
-    "test": "NODE_OPTIONS=--experimental-strip-types vitest run --root ../../.. plugins/adapters/discord/tests"
+    "test": "vitest run --root ../../.. plugins/adapters/discord/tests"
   }
 }

package/plugin.js

@@ -1,7 +1,5 @@
 // Generated by build-plugin-runtime-entries.mjs. Do not edit.
 import { definePlugin } from 'zhin.js';
-import { permissionHostToken } from '@zhin.js/permission';
-import { checkDiscordPlatformPermit } from "./lib/platform-permit.js";
 import { createDiscordConsoleRpc } from "./lib/console.js";
 export default definePlugin({
     name: 'discord',
@@ -10,12 +8,8 @@ export default definePlugin({
         displayName: 'Discord Gateway Adapter',
     },
     setup(context) {
-        const dispose = context.resources.has(permissionHostToken)
-            ? context.resources.use(permissionHostToken).registerPlatform('discord', checkDiscordPlatformPermit)
-            : undefined;
         return {
             consoleRpc: createDiscordConsoleRpc(() => context.config.get()),
-            ...(dispose ? { dispose } : {}),
         };
     },
 });

package/schema.json

@@ -71,34 +71,6 @@
       "default": "/discord/interactions",
       "description": "POST path on httpHostToken when connection is interactions."
     },
-    "master": {
-      "type": [
-        "string",
-        "number"
-      ],
-      "description": "框架 master（Discord user snowflake；AI/工具权限、endpoint 管理）。endpoints[i].master 可逐项覆盖",
-      "x-i18n": {
-        "en": {
-          "description": "Framework masters (Discord user snowflake; AI/tool permissions and endpoint management). endpoints[i].master can override this value."
-        }
-      }
-    },
-    "trusted": {
-      "type": "array",
-      "items": {
-        "type": [
-          "string",
-          "number"
-        ],
-        "description": "Trusted Discord user snowflake"
-      },
-      "description": "框架 trusted 用户列表（弱于 master）。endpoints[i].trusted 可逐项追加",
-      "x-i18n": {
-        "en": {
-          "description": "Framework trusted users, below master authority. endpoints[i].trusted can add users."
-        }
-      }
-    },
     "endpoints": {
       "type": "array",
       "minItems": 1,
@@ -107,34 +79,6 @@
         "type": "object",
         "additionalProperties": false,
         "properties": {
-          "master": {
-            "type": [
-              "string",
-              "number"
-            ],
-            "description": "本 endpoint 的框架 master（Discord user snowflake）；覆盖顶层 master",
-            "x-i18n": {
-              "en": {
-                "description": "Framework masters for this endpoint (Discord user snowflake), overriding the top-level master list."
-              }
-            }
-          },
-          "trusted": {
-            "type": "array",
-            "items": {
-              "type": [
-                "string",
-                "number"
-              ],
-              "description": "Trusted Discord user snowflake"
-            },
-            "description": "本 endpoint 的 trusted 列表",
-            "x-i18n": {
-              "en": {
-                "description": "Trusted users for this endpoint."
-              }
-            }
-          },
           "token": {
             "type": "string",
             "description": "Discord bot token"

package/src/channel-visibility.ts

@@ -0,0 +1,44 @@
+import { ChannelFlagsBitField } from 'discord.js';
+
+/**
+ * Discord 频道混淆（Channel Obfuscation）判定。
+ *
+ * 自 2026-11-16 起，Gateway 会继续下发机器人缺少 `VIEW_CHANNEL` 的频道，但其元数据被混淆：
+ * `name` 变为 `"___hidden___"`，并在 `flags` 上置 `CHANNEL_OBFUSCATED`；HTTP 的
+ * `GET /guilds/{guild.id}/channels` 则直接不返回这些频道。
+ *
+ * 出处：
+ * - https://docs.discord.com/developers/resources/channel#channel-object-channel-flags
+ *   （Channel Flags 表：`CHANNEL_OBFUSCATED` = `1 << 17`）
+ * - https://docs.discord.com/developers/resources/channel#channel-object-obfuscated-channels
+ * - https://docs.discord.com/developers/change-log （2026-08-12 "Channel Obfuscation for Users and Bots"）
+ * - discord-api-types `ChannelFlags.ChannelObfuscated`（0.38.54 起，值为 `131072`）。
+ *   discord.js 14.27.0 把它声明为 dependencies `^0.38.49`，并通过
+ *   `ChannelFlagsBitField.Flags` 暴露同一枚举。0.38.49–0.38.53 上该枚举是 `undefined`，
+ *   因此这里用 `?? (1 << 17)` 兜底，避免过滤悄悄失效。
+ *
+ * 官方要求以 flag 判定，不要依赖 `name` 等被混淆字段。
+ */
+function obfuscatedFlagBit(): number {
+  return ChannelFlagsBitField.Flags.ChannelObfuscated ?? (1 << 17);
+}
+
+export const DISCORD_CHANNEL_FLAG_OBFUSCATED = obfuscatedFlagBit();
+
+type ChannelFlagsLike = number | bigint | { readonly bitfield?: number | bigint } | null | undefined;
+
+function readFlagBits(flags: ChannelFlagsLike): number {
+  if (flags == null) return 0;
+  if (typeof flags === 'number') return flags;
+  if (typeof flags === 'bigint') return Number(flags & 0xffffffffn);
+  const bitfield = flags.bitfield;
+  if (typeof bitfield === 'number') return bitfield;
+  if (typeof bitfield === 'bigint') return Number(bitfield & 0xffffffffn);
+  return 0;
+}
+
+/** 频道是否被 Discord 混淆（机器人无 `VIEW_CHANNEL`）。兼容 discord.js 的 `ChannelFlagsBitField` 与原始 `flags` 数值。 */
+export function isDiscordChannelObfuscated(channel: { readonly flags?: ChannelFlagsLike } | null | undefined): boolean {
+  if (!channel) return false;
+  return (readFlagBits(channel.flags) & obfuscatedFlagBit()) !== 0;
+}

package/src/endpoint.ts

@@ -1,6 +1,7 @@
 import { createDiscordRestApiAgent } from './rest-api-proxy.js';
 import { createDiscordSelfProfile, createDiscordRestSelfProfile } from './self-profile.js';
 import { DiscordRestRequestError } from './rest-request-error.js';
+import { isDiscordChannelObfuscated } from './channel-visibility.js';
 /**
  * DiscordEndpoint — lifecycle, outbound, admit, gateway / interactions modes, agent tool surface.
  */
@@ -27,8 +28,11 @@ import {
 } from 'zhin.js/adapter';
 import type { HttpHost, HttpRouteRegistration } from '@zhin.js/host-http';
 import {
+  type ConversationRef,
   type ConversationReference,
   type ConversationResolution,
+  type PlatformStanding,
+  type SelfStandingRequest,
 } from '@zhin.js/im-contract';
 import { formatCompact, getAdapterLogger } from '@zhin.js/logger';
 import type { CapabilityId } from 'zhin.js';
@@ -36,11 +40,11 @@ import {
   connectDiscordGatewayClient,
   discordClientOptions,
   DEFAULT_INTENTS,
-  resolveSenderRole,
   toMessageCreateOptions,
   type DiscordClientTransport,
 } from './gateway.js';
 import {
+  discordChannelOf,
   discordInboundConversation,
   formatButtonContent,
   formatButtonSegments,
@@ -56,6 +60,9 @@ import {
 } from './protocol.js';
 import { registerDiscordInteractionRoutes } from './webhook.js';
 import { receiveDiscordGuildMemberSideEvent } from './side-event-dispatch.js';
+import {
+  discordGuildPermissionNamesFromChannelBitfield, discordPermissionNames, discordSenderStanding, discordStandingFromPermissions,
+} from './sender-standing.js';
 
 const DISCORD_API = 'https://discord.com/api/v10';
 /** 出站 HTTP 调用统一 30s 超时。 */
@@ -201,11 +208,11 @@ export class DiscordGatewayEndpoint extends Client implements Endpoint {
 
   async #sendFramework({ conversation, payload, signal }: EndpointSendRequest): Promise<string> {
     const body = formatOutboundBody(payload);
-    const snowflake = await this.#sendBody({ channelId: conversation.id, body, signal });
+    const snowflake = await this.#sendBody({ channelId: discordChannelOf(conversation), body, signal });
     this.#logger.debug(formatCompact({
       op: 'discord_send',
       endpoint: this.#options.config.id,
-      target: conversation.id,
+      target: discordChannelOf(conversation),
       messageId: snowflake,
     }));
     return snowflake;
@@ -214,7 +221,7 @@ export class DiscordGatewayEndpoint extends Client implements Endpoint {
   async #recallMessage({ message, signal }: EndpointRecallRequest): Promise<void> {
     if (!message.id) return;
     const operation = createEndpointOperation({ signal });
-    const channel = await operation.prepare(() => this.#requireClient().channels.fetch(message.conversation.id));
+    const channel = await operation.prepare(() => this.#requireClient().channels.fetch(discordChannelOf(message.conversation)));
     if (!channel?.isTextBased() || !channel.messages) return;
     const msg = await operation.prepare(() => channel.messages.fetch(message.id));
     await operation.run(() => msg.delete());
@@ -225,6 +232,7 @@ export class DiscordGatewayEndpoint extends Client implements Endpoint {
     if (!this.#open) return;
     if (msg.authorBot) return;
     const conversation = discordInboundConversation(String(this.#options.id), msg);
+    const platform = discordSenderStanding(msg);
     void this[endpointSpec].events.emit('message.receive', {
       conversation,
       event: msg.event,
@@ -235,7 +243,7 @@ export class DiscordGatewayEndpoint extends Client implements Endpoint {
       sender: {
         id: msg.authorId,
         name: senderDisplayName(msg) || undefined,
-        ...(resolveSenderRole(msg) ? { roles: [resolveSenderRole(msg)!] } : {}),
+        ...(platform ? { platform } : {}),
       },
       endpointId: this.#options.config.id,
       ...(msg.mentionedBot ? { mentioned: true } : {}),
@@ -245,7 +253,7 @@ export class DiscordGatewayEndpoint extends Client implements Endpoint {
         userId: msg.authorId,
         guildId: msg.guildId,
         permissions: msg.permissionTokens,
-        role: resolveSenderRole(msg),
+        role: platform?.standing,
       }),
     }).catch((err) => {
       this.#logger.warn(formatCompact({
@@ -284,7 +292,7 @@ export class DiscordGatewayEndpoint extends Client implements Endpoint {
   }
 
   async #addReaction({ message, emoji, hint, signal }: EndpointReactionRequest): Promise<string | null> {
-    const channelId = hint?.channelId ?? message.conversation.id;
+    const channelId = hint?.channelId ?? discordChannelOf(message.conversation);
     if (!channelId || !message.id) return null;
     const operation = createEndpointOperation({ signal });
     const channel = await operation.prepare(() => this.#requireClient().channels.fetch(channelId));
@@ -405,6 +413,9 @@ export class DiscordRestClient {
   }
 }
 
+const APP_PERMISSIONS_TTL_MS = 10 * 60_000;
+const APP_PERMISSIONS_MAX = 1_000;
+
 export class DiscordInteractionsEndpoint extends DiscordRestClient implements Endpoint {
   readonly [endpointSpec]: EndpointSpecification;
   readonly #logger!: ReturnType<typeof getAdapterLogger>;
@@ -414,6 +425,8 @@ export class DiscordInteractionsEndpoint extends DiscordRestClient implements En
   #routeReleases: HttpRouteRegistration[] = [];
   #open = false;
   #started = false;
+  /** Latest interaction `app_permissions` per guild (guild-level names), for the Bot's own standing. */
+  readonly #appPermissions = new Map<string, { readonly names: readonly string[]; readonly at: number }>();
   readonly #control: EndpointControl = Object.freeze<EndpointControl>({
     recall: request => this.#recallMessage(request),
   });
@@ -430,6 +443,12 @@ export class DiscordInteractionsEndpoint extends DiscordRestClient implements En
     this[endpointSpec] = createEndpointSpecification(this, {
       start: () => this.#startFramework(), open: () => this.#openFramework(), close: () => this.#closeFramework(),
       stop: () => this.#stopFramework(), send: request => this.#sendFramework(request), name: options.config.id,
+      // Interactions mode has no gateway session to read the bot's guild member: its own standing
+      // comes from the latest interaction's `app_permissions` in that guild (ADR 0056 §1), reduced
+      // to guild-level names like senders; without a recent interaction it stays unknown.
+      management: Object.freeze<EndpointManagement>({
+        inspectSelfStanding: async ({ conversation }) => this.#selfStandingFromInteractions(conversation),
+      }),
       control: this.#control, content: this.#content,
       profile: createDiscordRestSelfProfile(this, id => this[endpointSpec].reportSelfUserId(id)),
     });
@@ -472,18 +491,40 @@ export class DiscordInteractionsEndpoint extends DiscordRestClient implements En
 
   async #sendFramework({ conversation, payload, signal }: EndpointSendRequest): Promise<string> {
     const body = formatOutboundBody(payload);
-    const data = await this.createMessage({ channelId: conversation.id, body, signal });
+    const data = await this.createMessage({ channelId: discordChannelOf(conversation), body, signal });
     return data.id ?? '';
   }
 
   async #recallMessage({ message, signal }: EndpointRecallRequest): Promise<void> {
     if (!message.id) return;
-    await this.deleteMessage({ channelId: message.conversation.id, messageId: message.id, signal });
+    await this.deleteMessage({ channelId: discordChannelOf(message.conversation), messageId: message.id, signal });
+  }
+
+  #selfStandingFromInteractions(conversation: Pick<ConversationRef, 'kind' | 'parent'>): PlatformStanding | undefined {
+    const guildId = conversation.kind === 'channel' && conversation.parent?.kind === 'channel' ? conversation.parent.id : undefined;
+    const entry = guildId ? this.#appPermissions.get(guildId) : undefined;
+    if (!entry || Date.now() - entry.at > APP_PERMISSIONS_TTL_MS) return undefined;
+    // The guild owner is not visible to an interaction; `administrator` still reads as `admin`.
+    return { standing: discordStandingFromPermissions(entry.names), ...(entry.names.length ? { permissions: entry.names } : {}) };
+  }
+
+  #recordAppPermissions(msg: DiscordInboundMessage): void {
+    const appPermissions = (msg.event as { app_permissions?: unknown } | undefined)?.app_permissions;
+    if (!msg.guildId || appPermissions === undefined) return;
+    this.#appPermissions.delete(msg.guildId);
+    this.#appPermissions.set(msg.guildId, { names: discordGuildPermissionNamesFromChannelBitfield(appPermissions), at: Date.now() });
+    while (this.#appPermissions.size > APP_PERMISSIONS_MAX) {
+      const oldest = this.#appPermissions.keys().next().value;
+      if (oldest === undefined) break;
+      this.#appPermissions.delete(oldest);
+    }
   }
 
   admit(msg: DiscordInboundMessage): void {
     if (!this.#open) return;
+    this.#recordAppPermissions(msg);
     const conversation = discordInboundConversation(String(this.#options.id), msg);
+    const platform = discordSenderStanding(msg);
     void this[endpointSpec].events.emit('message.receive', {
       conversation,
       event: msg.event,
@@ -494,7 +535,7 @@ export class DiscordInteractionsEndpoint extends DiscordRestClient implements En
       sender: {
         id: msg.authorId,
         name: senderDisplayName(msg) || undefined,
-        ...(resolveSenderRole(msg) ? { roles: [resolveSenderRole(msg)!] } : {}),
+        ...(platform ? { platform } : {}),
       },
       endpointId: this.#options.config.id,
       metadata: Object.freeze({
@@ -569,7 +610,7 @@ async function resolveDiscordContent(
   try {
     context.signal.throwIfAborted();
     const response = await fetch(
-      `${DISCORD_API}/channels/${reference.message.conversation.id}/messages/${reference.message.id}`,
+      `${DISCORD_API}/channels/${discordChannelOf(reference.message.conversation)}/messages/${reference.message.id}`,
       { headers: { Authorization: `Bot ${token}` }, signal: context.signal },
     );
     if (response.status === 404) return Object.freeze({ status: 'not_found', code: 'discord_message_not_found' });
@@ -606,11 +647,34 @@ async function resolveDiscordContent(
 /**
  * DiscordGatewayEndpoint 的 EndpointManagement 语义端口（参照 qq 的工厂模式）。
  * 数据源为 discord.js SDK 缓存：guilds.cache / guild.channels.cache / guild.members。
+ * listChannels 会过滤带 CHANNEL_OBFUSCATED flag 的混淆频道（见 channel-visibility.ts）。
  */
 export function createDiscordEndpointManagement(
   requireClient: () => DiscordClientTransport,
 ): EndpointManagement {
   return Object.freeze<EndpointManagement>({
+    /**
+     * ADR 0056 §1: the Bot's own guild member in the conversation's guild — guild owner → `owner`;
+     * `administrator` / `moderate_members` → `admin`; roles and **guild-level** permission names
+     * (`GuildMember.permissions`, as for senders) so `bot-permission:*` and `platform-permission:*`
+     * read the same scope. Channel overwrites are left to the platform at execution time.
+     */
+    async inspectSelfStanding({ conversation, signal }: SelfStandingRequest): Promise<PlatformStanding | undefined> {
+      if (conversation.kind === 'private') return undefined;
+      const operation = createEndpointOperation({ signal });
+      const client = requireClient();
+      const channel = await operation.run(() => client.channels.fetch(conversation.threadId ?? conversation.id));
+      if (!channel || !('guild' in channel) || !client.user) return undefined;
+      const guild = channel.guild;
+      const me = guild.members.me ?? await operation.run(() => guild.members.fetchMe());
+      const permissions = me.permissions;
+      const names = permissions ? discordPermissionNames(bit => permissions.has(bit)) : [];
+      const roles = [...me.roles.cache.values()]
+        .filter(role => role.id !== guild.id)
+        .map(role => (role.name ? { id: String(role.id), name: String(role.name) } : { id: String(role.id) }));
+      const standing = discordStandingFromPermissions(names, guild.ownerId === client.user.id);
+      return { standing, ...(roles.length ? { roles } : {}), ...(names.length ? { permissions: names } : {}) };
+    },
     async listGroups(request: EndpointManagementRequest = {}): Promise<readonly EndpointGroup[]> {
       return createEndpointOperation(request).run(() => {
         const groups: EndpointGroup[] = [];
@@ -634,6 +698,8 @@ export function createDiscordEndpointManagement(
           for (const channel of guild.channels?.cache?.values() ?? []) {
             if (!channel?.id) continue;
             if (channel.type !== ChannelType.GuildText) continue;
+            // 机器人无 VIEW_CHANNEL 的频道会被 Gateway 混淆下发（HTTP 列表已不返回），默认过滤以保持两条路径一致。
+            if (isDiscordChannelObfuscated(channel)) continue;
             channels.push({
               id: String(channel.id),
               name: channel.name ? String(channel.name) : undefined,