fix(policy): restrict Hermes Discord binary access

src/lib/actions/sandbox/policy-channel-policy.test.ts

@@ -336,7 +336,8 @@ describe("addSandboxPolicy", () => {
     await addSandboxPolicy("test-sandbox", { preset: "discord", yes: true });
 
     expect(printedText()).toContain("curl is not in the preset binary allowlist");
-    expect(printedText()).toContain("Node HTTPS");
+    expect(printedText()).toContain("configured agent runtime");
+    expect(printedText()).not.toContain("Node HTTPS");
     expect(promptMock).not.toHaveBeenCalled();
     expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", "discord", {
       suppressDisclosure: true,

src/lib/messaging/channels/discord/manifest.ts

@@ -82,7 +82,7 @@ export const discordManifest = {
       validationWarningLines: [
         "For Discord preset validation, do not use curl as the success signal:",
         "curl is not in the preset binary allowlist, so curl probes can fail even",
-        "when the policy is working. Use Node HTTPS against",
+        "when the policy is working. Use the configured agent runtime against",
         "https://discord.com/api/v10/gateway or validate the configured",
         'messaging bridge/gateway path. DNS-only checks such as dns.resolve("gateway.discord.gg")',
         "can also be inconclusive behind a proxy.",

src/lib/messaging/channels/discord/policy/hermes.yaml

@@ -58,6 +58,5 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
     binaries:
-      - { path: /usr/local/bin/node }
       - { path: /usr/bin/python3* }
       - { path: /opt/hermes/.venv/bin/python }

test/mcp/mcp-tool-discovery-image-contract.test.ts

@@ -204,7 +204,7 @@ describe("MCP tool discovery image contract", () => {
   // source-shape-contract: security -- Exact reviewed runtime digests reject substituted executable and license artifacts before managed image construction.
   it.each([
     {
-      expectedHash: "d77b6d5465f651bf60eed9d978de14e72ebb0db35bb5a691c3eab84d554e3f9a",
+      expectedHash: "96068e04b3fb8c325a2532a4a108c92200199367a2b6fc712cdb0d122d7a06b9",
       relativePath: "managed-startup-image-runtime.bundle",
     },
     {

test/onboarding/effective-policy-contracts.test.ts

@@ -525,6 +525,16 @@ describe("effective built-in policy contracts", () => {
     });
   });
 
+  it("denies Node.js egress in the Hermes Discord preset (#10655)", () => {
+    const effective = composePresets(["discord"], "hermes");
+    const discord = requireNetworkPolicy(effective, "discord");
+
+    expect(binaries(discord)).toEqual([
+      "/opt/hermes/.venv/bin/python",
+      "/usr/bin/python3*",
+    ]);
+  });
+
   it("composes Hermes-specific messaging mutation and runtime identity rules", () => {
     const effective = composePresets(["discord", "slack", "wechat"], "hermes");
     const discord = requireNetworkPolicy(effective, "discord");

test/runtime/policy/policies.test.ts

@@ -129,12 +129,13 @@ describe("policies", () => {
       expect(policies.getPresetValidationWarning("wechat")).toContain("WeChat");
     });
 
-    it("adds Discord validation guidance for Node probes instead of curl or DNS-only checks", () => {
+    it("adds Discord validation guidance for agent runtime probes instead of curl or DNS-only checks", () => {
       const warning = policies.getPresetValidationWarning("discord");
 
       expect(warning).toContain("curl");
       expect(warning).toContain("preset binary allowlist");
-      expect(warning).toContain("Node HTTPS");
+      expect(warning).toContain("configured agent runtime");
+      expect(warning).not.toContain("Node HTTPS");
       expect(warning).toContain("https://discord.com/api/v10/gateway");
       expect(warning).toContain('dns.resolve("gateway.discord.gg")');
     });