Guild application commands

Keep guild application-command mutation behind capabilities.applicationCommandChanges, a nonempty exact scopes.applicationCommandGuildIds allowlist contained by ordinary guild read scope, pinned application and bot identities, and the independent application-commands toolset. Never infer write authority from command exposure audit, native Interaction management, global command authority, guild membership, another administrative feature, a command name, or another application's command object. Do not add bulk-overwrite, raw REST, name-targeted, partial-update, type-change, or immediate-call paths.

Accept only strict complete canonical chat-input, user, or message definitions. Require explicit default member permissions or null, explicit NSFW state, complete localization arrays, and the exact type-specific option tree. Enforce every known Discord name, description, localization, aggregate text, choice, autocomplete, required-order, depth, numeric, string, channel-type, and attachment-file-type constraint before contact. Reject unknown fields, raw numeric type codes or permission bitfields, omitted complete-state fields, future evidence that cannot be understood, and any incompatible option combination.

Planning must re-verify the pinned identities and exact non-pending connector membership, fetch the complete full-localization guild command inventory and every guild command-permission entry, and bind their canonical digests plus every command ID, version, type, transient name and definition digest, separate type capacities, total capacity, exact target permission overwrites, collision and no-op decisions, privacy claims, risks, warnings, operation-key hash, and verification contract into the process-keyed plan. A same-name and same-type collision must block creation because Discord POST otherwise upserts. Require exact-ID targeting for update and deletion, immutable type for update, and explicit deletion acknowledgement. Surface Discord's permanent target permission reset before every rename or deletion. Do not add command-permission writes because that route requires a user-authorized Bearer credential outside the bot-token boundary.

Preserve every reviewed-write gate: fresh complete evidence, process-keyed plan binding, destructive MCP annotation, write-aware host approval, signed request state, interactive confirmation, a final fresh matching plan, durable guild application-command collection coordination, atomic one-shot key reservation, pending content-free activity, one non-retried mutation, strict route-specific response validation, and exact complete command and permission survivor readback. Creation must accept only 201 and one exact new command, never Discord's 200 upsert response. Update must send one exact-ID complete replacement. Delete must send one exact-ID request. A no-op must bypass confirmation, coordination, reservation, activity, and mutation.

Permit a deterministic Discord client refusal other than timeout or rate limiting to settle as failed. Treat rate limiting, transport ambiguity, server failure, malformed success, response mismatch, complete-readback failure, survivor drift, or completion-record failure as uncertain and potentially completed. Spend every reserved key, quarantine the affected guild command collection, and never retry, reconcile, compensate, restore permissions, or roll back automatically. Persist only exact application, bot, guild, and command IDs; command type; definition, inventory, permission, plan, and operation-key digests; timestamps; fixed status and verification values; activity ID; and sanitized error category. Never persist command, option, choice, or localization text, permission target IDs, Discord names, raw requests or responses, raw keys, transport causes, or audit reasons.

Canonical source: SECURITY.md