Files
tab-bot/docs/guide/enable-discord.md
T
2026-09-08 13:24:49 -04:00

34 lines
1.8 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# Enable Discord pack + allowlist
The extension can be installed while Discord is still **off**. TabBots header then reads `DISCORD · OFF` or `ORIGIN · BLOCKED`. Login will fail until both switches are right.
## Steps
1. Open **BridgeSwarm Settings** (extension menu).
2. Turn on **Enable Discord**. `surface` / `status` still work while this is off; `construct` and `login` do not.
3. Under **Capability origins**, add the origin you actually use:
- Official site: `https://tab-bot.rest`
- Vite dev: `http://127.0.0.1:5173`
- `npm start` (Express): `http://127.0.0.1:2589`
- Defaults in BridgeSwarm often only include the examples server on port **4173**. That is not TabBot.
4. Under **Agent always-approve**, add the **same origin** if you want the Studio / `/agent` harness to skip host-tool permission prompts (shell, writes). `always-approve` is only honored for origins on that list. TabBot still auto-permits individual prompts as a fallback; stdio MCP still requires a trusted origin.
5. Refresh TabBot. The header should read **HOST · DISCORD · OK**.
There is no “allow all origins” mode. If you self-host TabBot on another origin (HTTPS on a LAN name, a preview port), that origin must be listed too.
## What the header colors mean
| Badge | Meaning |
| --- | --- |
| HOST · DISCORD · OK | Probe succeeded. You can launch a runner. |
| HOST · MISSING | Extension not in this tab. |
| DISCORD · OFF | Pack disabled in Settings. |
| ORIGIN · BLOCKED | This origin is not on the allowlist. |
| HOST · DOWN | Native host is not running. |
The install gate on Studio copies the exact origin string to paste. Use that, not a guess.
## Security note
Any origin on the allowlist can talk to Discord **as you**, for clients the host will construct. Treat allowlisting like handing over a privileged API. Do not allowlist random websites.