agent-messenger 2.25.0 → 2.27.0

package/skills/agent-discord/references/authentication.md

@@ -2,7 +2,40 @@
 
 ## Overview
 
-agent-discord uses Discord's user token extracted from the Discord desktop application, with automatic fallback to Chromium browser profiles (Chrome, Chrome Canary, Edge, Arc, Brave, Vivaldi, Chromium) when the desktop app isn't installed.
+agent-discord supports two ways to authenticate:
+
+- **QR code sign-in (`auth qr`) — recommended.** Scan a QR code with the Discord mobile app to sign in through Discord's own Remote Auth flow. This is the safest and most reliable method: it never reads stored credentials off disk, works without a desktop app or browser, and uses Discord's official login confirmation on your phone.
+- **Token extraction (`auth extract`).** Reads Discord's user token from the desktop application, with automatic fallback to Chromium browser profiles (Chrome, Chrome Canary, Edge, Arc, Brave, Vivaldi, Chromium). Best for automated/headless environments where no phone is available to scan.
+
+> **Recommendation:** Prefer `agent-discord auth qr` whenever you can scan a QR code. Use `auth extract` for headless/CI setups where interactive scanning isn't possible.
+
+## QR Code Sign-In (Recommended)
+
+Sign in by scanning a QR code with the Discord mobile app — no desktop app or browser token extraction required. This runs Discord's official Remote Auth protocol, so you authenticate through Discord's own login confirmation rather than by reading stored credentials.
+
+```bash
+# Generate a QR code and wait for you to scan it
+agent-discord auth qr
+
+# Show protocol details while debugging
+agent-discord auth qr --debug
+
+# Human-readable output
+agent-discord auth qr --pretty
+```
+
+How it works:
+
+1. Opens a WebSocket to Discord's remote-auth gateway and performs an RSA key exchange
+2. Renders a QR code in your terminal (and opens it in the browser as a fallback)
+3. You scan it with the Discord mobile app: **Settings → Scan QR Code**, then confirm on your phone
+4. Discord returns an encrypted ticket, which is exchanged for your user token, validated, and stored like `auth extract` — along with all discovered servers
+
+Notes:
+
+- **Requires the Discord mobile app** (logged in) to scan. Because it's interactive, it cannot run headlessly — use `auth extract` for CI.
+- The QR code expires after about 150 seconds. Re-run `agent-discord auth qr` to generate a fresh one.
+- If Discord presents a captcha challenge during the token exchange, the CLI surfaces a typed error directing you to fall back to `auth extract`.
 
 ## Token Extraction
 
@@ -186,7 +219,10 @@ Discord user tokens can be invalidated when:
 If commands start failing with auth errors:
 
 ```bash
-# Re-extract credentials
+# Recommended: re-authenticate with a QR code
+agent-discord auth qr
+
+# Or re-extract credentials from the desktop app / browser
 agent-discord auth extract
 
 # Verify it worked
@@ -216,8 +252,9 @@ This shows:
 
 **Solution**:
 
-1. Log in to discord.com in a Chromium browser (Chrome, Edge, Arc, Brave) — the CLI will extract from browser automatically
-2. Or install the Discord desktop app, log in, and run `agent-discord auth extract` again
+1. Recommended: run `agent-discord auth qr` and scan the QR code with the Discord mobile app — no desktop app or browser required
+2. Or log in to discord.com in a Chromium browser (Chrome, Edge, Arc, Brave) — the CLI will extract from browser automatically
+3. Or install the Discord desktop app, log in, and run `agent-discord auth extract` again
 
 ### "No Discord token found"
 
@@ -275,10 +312,11 @@ With extracted credentials, agent-discord has the same permissions as you in Dis
 
 ### Best Practices
 
-1. **Protect credentials.json**: Never commit to version control
-2. **Use server switching**: Keep different contexts separate
-3. **Re-extract periodically**: Keep tokens fresh
-4. **Revoke if compromised**: Change your Discord password to invalidate tokens
+1. **Prefer QR sign-in**: Use `auth qr` when possible — it authenticates through Discord's official flow instead of reading credentials off disk
+2. **Protect credentials.json**: Never commit to version control
+3. **Use server switching**: Keep different contexts separate
+4. **Re-authenticate periodically**: Keep tokens fresh
+5. **Revoke if compromised**: Change your Discord password to invalidate tokens
 
 ## Manual Token Management (Advanced)
 

package/skills/agent-discordbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-discordbot
 description: Interact with Discord servers using bot tokens - send messages, read channels, manage reactions
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-discordbot:*)
 metadata:
   openclaw:

package/skills/agent-instagram/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-instagram
 description: Interact with Instagram DMs - send messages, read conversations, manage accounts
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-instagram:*)
 metadata:
   openclaw:

package/skills/agent-kakaotalk/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-kakaotalk
 description: Interact with KakaoTalk - send messages, read chats, manage conversations
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-kakaotalk:*)
 metadata:
   openclaw:

package/skills/agent-line/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-line
 description: Interact with LINE - send messages, read chats, manage conversations
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-line:*)
 metadata:
   openclaw:

package/skills/agent-slack/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-slack
 description: Interact with Slack workspaces - send messages, read channels, manage reactions
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-slack:*)
 metadata:
   openclaw:
@@ -37,11 +37,14 @@ Credentials are extracted automatically from the Slack desktop app (or Chromium
 
 On macOS, the system may prompt for your Keychain password the first time (required to decrypt Slack's stored token). This is a one-time prompt.
 
-**IMPORTANT**: Always use `agent-slack auth extract` to obtain tokens. The CLI extracts from the desktop app first, falling back to Chromium browsers if the app isn't installed.
+**Two ways to obtain tokens:**
 
-### QR Code Sign-In (No Desktop App Required)
+- **`agent-slack auth qr` — recommended.** Sign in with a QR code from Slack's "Sign in on mobile" screen. It's the safest and most reliable method: it authenticates through Slack's own login flow over plain HTTP instead of reading credentials off disk, and needs no desktop app or browser.
+- **`agent-slack auth extract`.** Extracts tokens from the Slack desktop app first, falling back to Chromium browsers if the app isn't installed. Best for automated/headless environments.
 
-If the Slack desktop app isn't installed (or extraction fails), you can sign in with a QR code from any device where you're already logged into Slack — no browser automation, fully over HTTP:
+### QR Code Sign-In (Recommended)
+
+Sign in with a QR code from any device where you're already logged into Slack — no desktop app, no browser automation, fully over HTTP:
 
 ```bash
 # In Slack (desktop or web): your name (top-left) → "Sign in on mobile".

package/skills/agent-slack/references/authentication.md

@@ -2,7 +2,12 @@
 
 ## Overview
 
-agent-slack uses Slack's web client credentials (xoxc token + xoxd cookie) extracted from the Slack desktop application, with automatic fallback to Chromium browser profiles (Chrome, Chrome Canary, Edge, Arc, Brave, Vivaldi, Chromium) when the desktop app isn't installed.
+agent-slack supports two ways to authenticate:
+
+- **QR code sign-in (`auth qr`) — recommended.** Sign in with a QR code from Slack's "Sign in on mobile" screen. This is the safest and most reliable method: it authenticates through Slack's own login flow over plain HTTP instead of reading stored credentials off disk, and works without a desktop app or browser.
+- **Token extraction (`auth extract`).** Reads Slack's web client credentials (xoxc token + xoxd cookie) from the desktop application, with automatic fallback to Chromium browser profiles (Chrome, Chrome Canary, Edge, Arc, Brave, Vivaldi, Chromium). Best for automated/headless environments.
+
+> **Recommendation:** Prefer `agent-slack auth qr`. Use `auth extract` for headless/CI setups or when you'd rather reuse an existing desktop/browser session.
 
 ## Token Extraction
 
@@ -34,9 +39,9 @@ This command:
 
 Use `--browser-profile <path>` for agent-browser profiles, custom Chrome user data dirs, or portable browser profiles. The option can be repeated or given comma-separated paths, and explicit paths are included even when desktop credentials are also present.
 
-### QR Code Sign-In
+### QR Code Sign-In (Recommended)
 
-When the desktop app isn't installed and browser extraction isn't an option, you can sign in with a QR code from a device where you're already logged into Slack. This runs entirely over HTTP — no browser automation:
+The recommended way to authenticate: sign in with a QR code from a device where you're already logged into Slack. This runs entirely over HTTP — no browser automation, and no desktop app required:
 
 ```bash
 # In Slack (desktop or web): your name (top-left) → "Sign in on mobile".

package/skills/agent-slackbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-slackbot
 description: Interact with Slack workspaces using bot tokens - send messages, read channels, manage reactions
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-slackbot:*)
 metadata:
   openclaw:

package/skills/agent-teams/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-teams
 description: Interact with Microsoft Teams - send messages, read channels, manage reactions
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-teams:*)
 metadata:
   openclaw:

package/skills/agent-telegram/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-telegram
 description: Interact with Telegram through TDLib - authenticate, inspect chats, and send messages
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-telegram:*)
 ---
 

package/skills/agent-telegrambot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-telegrambot
 description: Interact with Telegram using bot tokens - send messages, read chats, manage reactions
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-telegrambot:*)
 metadata:
   openclaw:

package/skills/agent-webex/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-webex
 description: Interact with Cisco Webex - send messages, read spaces, manage memberships
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-webex:*)
 metadata:
   openclaw:

package/skills/agent-webexbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-webexbot
 description: Interact with Cisco Webex using bot tokens - send messages, reply in threads, upload and download files, look up people, read spaces, manage memberships, stream real-time events
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-webexbot:*)
 metadata:
   openclaw:

package/skills/agent-wechatbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-wechatbot
 description: Interact with WeChat Official Account using API credentials - send messages, manage templates, list followers
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-wechatbot:*)
 metadata:
   openclaw:

package/skills/agent-whatsapp/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-whatsapp
 description: Interact with WhatsApp - send messages, read chats, manage conversations
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-whatsapp:*)
 metadata:
   openclaw:

package/skills/agent-whatsappbot/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: agent-whatsappbot
 description: Interact with WhatsApp using Cloud API credentials - send messages, manage templates
-version: 2.25.0
+version: 2.27.0
 allowed-tools: Bash(agent-whatsappbot:*)
 metadata:
   openclaw:

package/src/platforms/discord/commands/auth.ts

@@ -3,10 +3,12 @@ import { Command } from 'commander'
 import { collectBrowserProfileOption } from '@/shared/chromium'
 import { handleError } from '@/shared/utils/error-handler'
 import { formatOutput } from '@/shared/utils/output'
-import { debug } from '@/shared/utils/stderr'
+import { displayQR } from '@/shared/utils/qr'
+import { debug, info } from '@/shared/utils/stderr'
 
 import { DiscordClient } from '../client'
 import { DiscordCredentialManager } from '../credential-manager'
+import { loginWithRemoteAuth } from '../remote-auth'
 import { DiscordTokenExtractor } from '../token-extractor'
 
 export async function extractAction(options: {
@@ -137,6 +139,77 @@ export async function extractAction(options: {
   }
 }
 
+async function saveTokenWithServers(
+  token: string,
+  credManager: DiscordCredentialManager,
+): Promise<{ username: string; servers: { id: string; name: string }[]; current: string } | null> {
+  const client = await new DiscordClient().login({ token })
+  const authInfo = await client.testAuth()
+  const servers = await client.listServers()
+  if (servers.length === 0) return null
+
+  const serverMap: Record<string, { server_id: string; server_name: string }> = {}
+  for (const server of servers) {
+    serverMap[server.id] = { server_id: server.id, server_name: server.name }
+  }
+
+  await credManager.save({ token, current_server: servers[0].id, servers: serverMap })
+  return {
+    username: authInfo.username,
+    servers: servers.map((s) => ({ id: s.id, name: s.name })),
+    current: servers[0].id,
+  }
+}
+
+export async function qrAction(options: { pretty?: boolean; debug?: boolean }): Promise<void> {
+  try {
+    const interactive = Boolean(process.stdout.isTTY)
+    const debugLog = options.debug ? (msg: string) => debug(`[debug] ${msg}`) : undefined
+
+    const session = await loginWithRemoteAuth({
+      debug: debugLog,
+      onQrUrl: async (url) => {
+        await displayQR(url, {
+          platform: 'Discord',
+          brandColor: '#5865F2',
+          scanInstruction: 'Scan with the Discord mobile app (Settings → Scan QR Code)',
+          interactive,
+          formatOutput,
+          pretty: options.pretty,
+        })
+      },
+      onPendingLogin: (user) => {
+        if (interactive) info(`\nQR scanned by ${user.username}. Confirm the login on your phone...\n`)
+      },
+    })
+
+    const credManager = new DiscordCredentialManager()
+    const saved = await saveTokenWithServers(session.token, credManager)
+
+    if (!saved) {
+      console.log(
+        formatOutput(
+          {
+            error: 'Logged in, but this account is not a member of any server.',
+            hint: 'Join at least one server, then run this command again.',
+          },
+          options.pretty,
+        ),
+      )
+      process.exit(1)
+    }
+
+    console.log(
+      formatOutput(
+        { user: saved.username, servers: saved.servers.map((s) => `${s.id}/${s.name}`), current: saved.current },
+        options.pretty,
+      ),
+    )
+  } catch (error) {
+    handleError(error as Error)
+  }
+}
+
 export async function logoutAction(options: { pretty?: boolean }): Promise<void> {
   try {
     const credManager = new DiscordCredentialManager()
@@ -208,6 +281,13 @@ export const authCommand = new Command('auth')
       )
       .action(extractAction),
   )
+  .addCommand(
+    new Command('qr')
+      .description('Sign in by scanning a QR code with the Discord mobile app')
+      .option('--pretty', 'Pretty print JSON output')
+      .option('--debug', 'Show debug output for troubleshooting')
+      .action(qrAction),
+  )
   .addCommand(
     new Command('logout')
       .description('Logout from Discord')

package/src/platforms/discord/index.ts

@@ -1,6 +1,8 @@
 export { DiscordClient, DiscordError } from './client'
 export { DiscordCredentialManager } from './credential-manager'
 export { DiscordListener } from './listener'
+export { loginWithRemoteAuth } from './remote-auth'
+export type { RemoteAuthOptions, RemoteAuthSession } from './remote-auth'
 export type {
   DiscordChannel,
   DiscordConfig,

package/src/platforms/discord/listener.test.ts

@@ -171,10 +171,9 @@ describe('DiscordListener', () => {
       expect(identifyMsg.d.token).toBe('fake-token')
     })
 
-    it('sends Identify with custom intents', async () => {
+    it('sends a user-account Identify with the load-bearing default shape', async () => {
       const client = createMockClient()
-      const customIntents = 1 << 9
-      listener = new DiscordListener(client, { intents: customIntents })
+      listener = new DiscordListener(client)
 
       await listener.start()
       mockWsInstance.simulateOpen()
@@ -184,7 +183,16 @@ describe('DiscordListener', () => {
       const identifyMsg = sentMessages.find((m) => m.op === 2)
 
       expect(identifyMsg).toBeDefined()
-      expect(identifyMsg.d.intents).toBe(customIntents)
+      expect(identifyMsg.d.capabilities).toBe(16381)
+      expect(identifyMsg.d.client_state).toEqual({ guild_versions: {} })
+      expect(identifyMsg.d.compress).toBe(false)
+      expect(identifyMsg.d.presence).toEqual({ status: 'online', since: 0, activities: [], afk: false })
+      expect(identifyMsg.d.properties.browser).toBe('Chrome')
+      expect(identifyMsg.d.properties.client_build_number).toBe(648814)
+
+      // All intents incl. MESSAGE_CONTENT (1<<15); user sessions blank other users' content without it
+      expect(identifyMsg.d.intents).toBe(33_554_431)
+      expect(identifyMsg.d.intents & (1 << 15)).toBe(1 << 15)
     })
   })
 

package/src/platforms/discord/listener.ts

@@ -4,7 +4,7 @@ import WebSocket from 'ws'
 
 import type { DiscordClient } from './client'
 import type { DiscordListenerEventMap, DiscordGatewayGenericEvent } from './types'
-import { DiscordGatewayOpcode, DiscordIntent } from './types'
+import { DiscordGatewayOpcode } from './types'
 
 const GATEWAY_URL = 'wss://gateway.discord.gg/?v=10&encoding=json'
 const GATEWAY_QUERY = '?v=10&encoding=json'
@@ -13,20 +13,25 @@ const RECONNECT_MAX_DELAY = 30_000
 const NON_RECOVERABLE_CLOSE_CODES = [4004, 4010, 4011, 4012, 4013, 4014]
 const SESSION_RESET_CLOSE_CODES = [4007, 4009]
 
-const DEFAULT_INTENTS =
-  DiscordIntent.Guilds |
-  DiscordIntent.GuildMessages |
-  DiscordIntent.GuildMessageReactions |
-  DiscordIntent.GuildMessageTyping |
-  DiscordIntent.DirectMessages |
-  DiscordIntent.DirectMessageReactions |
-  DiscordIntent.DirectMessageTyping
+// User (non-bot) gateway capabilities bitmask, mirroring discord.py-self's default set.
+// Capabilities shape the READY payload; bit 10 (client_state_v2) requires client_state.guild_versions.
+const USER_GATEWAY_CAPABILITIES = 16381
+
+// Without MESSAGE_CONTENT (1<<15), Discord blanks `content`/`embeds`/`attachments` on messages
+// from OTHER users (self/DM/mention content still arrives). User sessions get all intents only
+// when `intents` is omitted OR explicitly set, so we send an all-intents value to guarantee content.
+const USER_GATEWAY_INTENTS = 33_554_431
+
+// Discord validates client_build_number against recent web-client builds; a stale value can
+// yield a connected-but-degraded session that fires READY yet delivers no message events.
+// Overridable via env so it can be refreshed without a release when it eventually goes stale.
+const DEFAULT_CLIENT_BUILD_NUMBER = 648814
+const USER_GATEWAY_BUILD_NUMBER = Number(process.env.AGENT_DISCORD_BUILD_NUMBER) || DEFAULT_CLIENT_BUILD_NUMBER
 
 type EventKey = keyof DiscordListenerEventMap
 
 export class DiscordListener {
   private client: DiscordClient
-  private intents: number
   private running = false
   private ws: WebSocket | null = null
   private emitter = new EventEmitter()
@@ -43,9 +48,8 @@ export class DiscordListener {
   private cachedUser: { id: string; username: string } | null = null
   private generation = 0
 
-  constructor(client: DiscordClient, options?: { intents?: number }) {
+  constructor(client: DiscordClient) {
     this.client = client
-    this.intents = options?.intents ?? DEFAULT_INTENTS
   }
 
   async start(): Promise<void> {
@@ -233,12 +237,28 @@ export class DiscordListener {
         op: DiscordGatewayOpcode.Identify,
         d: {
           token: this.token,
-          intents: this.intents,
+          capabilities: USER_GATEWAY_CAPABILITIES,
+          intents: USER_GATEWAY_INTENTS,
           properties: {
-            os: 'linux',
-            browser: 'agent-messenger',
-            device: 'agent-messenger',
+            os: 'Linux',
+            browser: 'Chrome',
+            device: '',
+            system_locale: 'en-US',
+            browser_user_agent:
+              'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
+            browser_version: '131.0.0.0',
+            os_version: '',
+            referrer: '',
+            referring_domain: '',
+            referrer_current: '',
+            referring_domain_current: '',
+            release_channel: 'stable',
+            client_build_number: USER_GATEWAY_BUILD_NUMBER,
+            client_event_source: null,
           },
+          presence: { status: 'online', since: 0, activities: [], afk: false },
+          compress: false,
+          client_state: { guild_versions: {} },
         },
       }),
     )