Edit from OC maintainers: The below information is entirely AI hallucinations and should not be used as reference in any way.

Problem

After investigation into Discord API implementation practices, the current approach using @buape/carbon is not professional.

Root Issues

1. Architectural Flaw: @buape/carbon uses HTTP REST calls for gateway operations, which is unprofessional and non-standard. The discord.js library (official, industry-standard) uses pure WebSocket for gateway communication.

2. Security Vulnerability: @buape/carbon depends on old @hono/node-server (<1.19.10), blocking the critical security update for GHSA-wc8c-qw6v-h7f6 (Hono authorization bypass vulnerability).

3. Hybrid Protocol Issues: The HTTP + WebSocket hybrid architecture causes race conditions and integration bugs.

4. Dependency Lock: Maintainers have been skipping Carbon in dependency updates ("except carbon" pattern in recent commits), indicating awareness of the problem.

Solution

Replace @buape/carbon entirely with discord.js (v14+), which:

• Uses industry-standard WebSocket gateway
• Is actively maintained by Discord
• Resolves GHSA-wc8c-qw6v-h7f6 security vulnerability
• Fixes 15+ recurring Discord bugs caused by the hybrid protocol architecture
• Requires only internal code changes (no breaking changes to OpenClaw's external API)

Scope

Internal refactor of src/discord/* and related integration points. No changes to OpenClaw's public API.

Related Work

A migration branch feat/discord-library-migration has been created with the initial refactoring complete:

• Replaced @buape/carbon with discord.js in package.json
• Migrated src/discord/monitor/gateway-plugin.ts to use discord.js Client
• Removed hybrid HTTP + WebSocket architecture