fix: use CONNECT tunnel for WebSocket endpoints in Discord/Slack presets

[BenediktSchackenberg]

Summary

The Discord and Slack network policy presets configure WebSocket endpoints with protocol: rest + tls: terminate, which routes traffic through the egress proxy's HTTP layer. The proxy's hardcoded idle timeout (~2 minutes) kills the WebSocket connection, causing discord.js (and Slack Socket Mode) to enter a reconnect loop with ~50% uptime.

Root Cause

protocol: rest with tls: terminate means the proxy intercepts and inspects HTTP traffic. For WebSocket connections, this means the proxy sees an idle HTTP connection after the upgrade handshake and kills it after the idle timeout.

access: full creates a CONNECT tunnel — the proxy just forwards raw TCP bytes without HTTP-level inspection or timeouts. This is exactly what WebSocket connections need.

Changes

Discord preset:

• gateway.discord.gg: changed from protocol: rest → access: full (WebSocket gateway)
• discord.com: added PUT/PATCH/DELETE methods (message editing, reactions, channel management)
• Added media.discordapp.net endpoint (attachment/media access)

Slack preset:

• Added wss-primary.slack.com and wss-backup.slack.com with access: full (Socket Mode WebSocket endpoints)

Security Considerations

• access: full bypasses HTTP-level inspection for the WebSocket endpoints only
• REST API endpoints (discord.com, api.slack.com) remain under protocol: rest with method/path rules
• This matches the existing pattern used for github.com and registry.npmjs.org in the baseline sandbox policy

What This Doesn't Fix

The hardcoded ~2-minute idle timeout in the openshell-sandbox binary still affects any protocol: rest endpoint with long-lived connections (SSE streams, etc.). That requires an upstream fix in OpenShell. This PR fixes the most common case: WebSocket-based messaging plugins.

Partially addresses #409. Related: #361 (WhatsApp Web, same root cause).

AI-assisted: Built with Claude, reviewed by human.

Summary by CodeRabbit

• New Features

  • Discord endpoint now supports PUT, PATCH, and DELETE in addition to GET/POST.
  • Added Socket Mode WebSocket endpoints for Slack with full WebSocket access.
  • Discord gateway now operates in full-access mode on port 443.

• Updates

  • CDN endpoint restricted to GET-only; media/attachment host switched to media.discordapp.net with TLS/enforcement.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 3428c2f4-b743-430f-9fa1-b3352b10dc38

📥 Commits

Reviewing files that changed from the base of the PR and between 4bf83ea and 8ee9ec0.

📒 Files selected for processing (2)

• nemoclaw-blueprint/policies/presets/discord.yaml
• nemoclaw-blueprint/policies/presets/slack.yaml

✅ Files skipped from review due to trivial changes (1)

• nemoclaw-blueprint/policies/presets/slack.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• nemoclaw-blueprint/policies/presets/discord.yaml

---

📝 Walkthrough

Walkthrough

Updated two network policy presets: Discord broadened REST methods, changed gateway to full access and moved CDN from cdn.discordapp.com to media.discordapp.net; Slack added Socket Mode WebSocket endpoints (wss-primary/wss-backup) while keeping existing REST endpoints.

Changes

Cohort / File(s)	Summary
Discord Network Policy nemoclaw-blueprint/policies/presets/discord.yaml	Expanded discord.com rules for path: "/**" to include PUT, PATCH, DELETE in addition to GET/POST. Updated gateway.discord.gg to include port: 443 and access: full. Removed POST from cdn.discordapp.com (now GET only) and replaced CDN host with media.discordapp.net retaining port: 443, protocol: rest, enforcement: enforce, tls: terminate, GET-only.
Slack Network Policy nemoclaw-blueprint/policies/presets/slack.yaml	Extended description to mention Socket Mode. Added WebSocket endpoints wss-primary.slack.com:443 and wss-backup.slack.com:443 with access: full, alongside existing REST endpoints (slack.com, api.slack.com, hooks.slack.com) permitting GET/POST on /**.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    participant Client
    participant NemoclawPolicy
    participant DiscordGateway as gateway.discord.gg
    participant DiscordAPI as discord.com
    participant MediaCDN as media.discordapp.net

    Client->>NemoclawPolicy: Initiate connection (WebSocket or REST)
    NemoclawPolicy->>DiscordGateway: Grant full access on port 443
    NemoclawPolicy->>DiscordAPI: Allow GET, POST, PUT, PATCH, DELETE on /**
    NemoclawPolicy->>MediaCDN: Allow GET (port 443, TLS terminate)
    DiscordGateway-->>Client: Gateway responses
    DiscordAPI-->>Client: REST responses
    MediaCDN-->>Client: Media GET responses

Loading

sequenceDiagram
    autonumber
    participant AppClient
    participant NemoclawPolicy
    participant SlackWSPrimary as wss-primary.slack.com
    participant SlackWSBackup as wss-backup.slack.com
    participant SlackAPI as api.slack.com

    AppClient->>NemoclawPolicy: Open Socket Mode WebSocket
    NemoclawPolicy->>SlackWSPrimary: Grant full access (port 443)
    NemoclawPolicy->>SlackWSBackup: Grant full access (port 443)
    AppClient->>SlackAPI: REST calls (GET/POST)
    SlackWSPrimary-->>AppClient: Socket Mode messages
    SlackAPI-->>AppClient: REST responses

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 I nibbled YAML lines with care,

Opened gates and changed the air,
Gateways hum on secure four-four-three,
Slack sockets sing and media hops free,
A little rabbit cheers these policy tweaks 🥕

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title describes using CONNECT tunnels for WebSocket endpoints, but the summary shows changes also include adding PUT/PATCH/DELETE methods for discord.com, media.discordapp.net endpoint, and Slack Socket Mode—not solely about CONNECT tunnel configuration.	Clarify whether the title should emphasize CONNECT tunnel usage specifically, or broaden it to capture all policy changes (e.g., 'Allow CONNECT tunnels and additional methods for Discord/Slack presets').

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Updates the Discord and Slack sandbox network policy presets so WebSocket endpoints use a CONNECT-tunnel style egress (access: full) instead of being routed through the HTTP inspection layer, preventing long-lived WebSocket connections from being terminated by the proxy idle timeout.

Changes:

• Slack: add Socket Mode WebSocket endpoints (wss-primary.slack.com, wss-backup.slack.com) with access: full.
• Discord: route the gateway WebSocket endpoint (gateway.discord.gg) through access: full.
• Discord: expand allowed REST methods for discord.com and add a media domain endpoint for attachments.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
nemoclaw-blueprint/policies/presets/slack.yaml	Adds CONNECT-tunneled WebSocket endpoints for Slack Socket Mode; updates preset description.
nemoclaw-blueprint/policies/presets/discord.yaml	Uses CONNECT tunnel for Discord gateway; broadens REST methods on discord.com; adds media domain endpoint.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The comment says "Media/attachment uploads" but this endpoint only allows GET and is named media.discordapp.net (typically used for media/attachment access / proxying). Please either update the comment to match the read-only GET policy, or expand the allowed methods if uploads to this host are actually required.

[BenediktSchackenberg]

Good eye — the comment was misleading. This endpoint is read-only (GET) for fetching media/attachments, not uploading. Updated the comment to say "Media/attachment access (read-only, proxied through Discord CDN)". Uploads go through discord.com REST API.

[Copilot]

Minor consistency nit: the comment mentions access:full, but the actual YAML key is access: full. Consider updating the comment to include the space to avoid confusion when readers search/compare against the config.

Suggested change

	# WebSocket gateway — must use access:full (CONNECT tunnel) instead
	# WebSocket gateway — must use access: full (CONNECT tunnel) instead

[BenediktSchackenberg]

Fair point, added the space for consistency with the actual YAML syntax. Small thing but makes it easier to grep.

[coderabbitai]

🧹 Nitpick comments (2)

nemoclaw-blueprint/policies/presets/discord.yaml (2)

37-44: The inline comment says “uploads”, but the rule is GET-only.

Please reword this so the comment matches the policy; otherwise it reads like a missing write rule on media.discordapp.net.

✏️ Suggested wording

-      # Media/attachment uploads use a separate domain
+      # Media/attachment fetches may use a separate domain

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@nemoclaw-blueprint/policies/presets/discord.yaml` around lines 37 - 44,
Update the inline comment above the media.discordapp.net host block to reflect
that the policy only allows GET requests (reads) rather than uploads/writes:
change the wording referencing "Media/attachment uploads" to something like
"Media/attachment reads (served from a separate domain)" so the comment matches
the rule under host: media.discordapp.net which currently has a GET-only rule in
rules: - allow: { method: GET, path: "/**" }.

---

20-22: Limit the new write verbs to the API prefix for least-privilege access.

Discord's documented PUT/PATCH/DELETE endpoints for bots and webhooks all reside under /api/v{version}/, so these rules can be tightened to /api/** without losing functionality. This reduces the blast radius of inadvertent misconfigurations.

Suggested tightening

-          - allow: { method: PUT, path: "/**" }
-          - allow: { method: PATCH, path: "/**" }
-          - allow: { method: DELETE, path: "/**" }
+          - allow: { method: PUT, path: "/api/**" }
+          - allow: { method: PATCH, path: "/api/**" }
+          - allow: { method: DELETE, path: "/api/**" }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@nemoclaw-blueprint/policies/presets/discord.yaml` around lines 20 - 22, The
three policy rules that currently allow write verbs globally (the entries "-
allow: { method: PUT, path: "/**" }", "- allow: { method: PATCH, path: "/**" }",
and "- allow: { method: DELETE, path: "/**" }") should be tightened to only
allow those methods under the API prefix; change each path from "/**" to
"/api/**" so PUT, PATCH and DELETE are constrained to Discord API endpoints.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@nemoclaw-blueprint/policies/presets/discord.yaml`:
- Around line 37-44: Update the inline comment above the media.discordapp.net
host block to reflect that the policy only allows GET requests (reads) rather
than uploads/writes: change the wording referencing "Media/attachment uploads"
to something like "Media/attachment reads (served from a separate domain)" so
the comment matches the rule under host: media.discordapp.net which currently
has a GET-only rule in rules: - allow: { method: GET, path: "/**" }.
- Around line 20-22: The three policy rules that currently allow write verbs
globally (the entries "- allow: { method: PUT, path: "/**" }", "- allow: {
method: PATCH, path: "/**" }", and "- allow: { method: DELETE, path: "/**" }")
should be tightened to only allow those methods under the API prefix; change
each path from "/**" to "/api/**" so PUT, PATCH and DELETE are constrained to
Discord API endpoints.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: aa59af84-644c-4ad8-9500-b4818e92a388

📥 Commits

Reviewing files that changed from the base of the PR and between 6ca7d37 and b926698.

📒 Files selected for processing (2)

• nemoclaw-blueprint/policies/presets/discord.yaml
• nemoclaw-blueprint/policies/presets/slack.yaml

[coderabbitai]

🧹 Nitpick comments (1)

nemoclaw-blueprint/policies/presets/discord.yaml (1)

20-22: Scope new write methods to narrower API paths when feasible.

On Line 20–Line 22, allowing PUT/PATCH/DELETE with path: "/**" increases destructive API surface. If preset behavior allows it, prefer path-scoped rules for least privilege.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@nemoclaw-blueprint/policies/presets/discord.yaml` around lines 20 - 22, The
current preset grants overly broad write permissions by allowing methods PUT,
PATCH, and DELETE for path "/**"; narrow these rules to least-privilege by
replacing or augmenting the allow entries for methods PUT, PATCH, DELETE with
path-scoped rules that target only the specific API resources that require
destructive actions (e.g., /users/**, /documents/**, /settings/**) rather than
the global "/**"; update the relevant entries (the allow entries with method:
PUT, method: PATCH, method: DELETE) to use the appropriate narrower paths or
remove them if not needed by the preset behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@nemoclaw-blueprint/policies/presets/discord.yaml`:
- Around line 20-22: The current preset grants overly broad write permissions by
allowing methods PUT, PATCH, and DELETE for path "/**"; narrow these rules to
least-privilege by replacing or augmenting the allow entries for methods PUT,
PATCH, DELETE with path-scoped rules that target only the specific API resources
that require destructive actions (e.g., /users/**, /documents/**, /settings/**)
rather than the global "/**"; update the relevant entries (the allow entries
with method: PUT, method: PATCH, method: DELETE) to use the appropriate narrower
paths or remove them if not needed by the preset behavior.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 406f313a-343d-4738-99e6-d4c50c86abe2

📥 Commits

Reviewing files that changed from the base of the PR and between b926698 and 48947d5.

📒 Files selected for processing (1)

• nemoclaw-blueprint/policies/presets/discord.yaml

[BenediktSchackenberg]

Re: CodeRabbit's nitpick about scoping PUT/PATCH/DELETE to narrower paths —

I considered this but intentionally kept /**. Discord's REST API uses these methods across dozens of endpoints:

• PATCH /api/v10/channels/{id}/messages/{id} (edit message)
• DELETE /api/v10/channels/{id}/messages/{id} (delete message)
• PUT /api/v10/channels/{id}/messages/{id}/reactions/{emoji}/@me (add reaction)
• PATCH /api/v10/guilds/{id} (update guild)
• DELETE /api/v10/invites/{code}
• ... and many more

Scoping to specific paths would create a fragile allowlist that breaks whenever Discord adds or restructures API routes. The existing presets in this repo (telegram, slack) also use /** for their allowed methods — this is consistent with the established pattern.

The real security boundary here is the host restriction to discord.com:443 — only traffic to Discord's API server is allowed regardless of method or path.

[BenediktSchackenberg]

@cv any chance this could get a quick look? Small change (2 files), just switches the Discord/Slack WebSocket endpoints from HTTP proxy to CONNECT tunnel so the idle timeout stops killing the connections.