fix(policy): update HuggingFace endpoint and restrict Discord DELETE method

[BenediktSchackenberg]

Two policy preset fixes in one PR.

1. HuggingFace endpoint update (fixes #1453)

The api-inference.huggingface.co endpoint referenced in huggingface.yaml now returns HTTP 410 Gone — HuggingFace has migrated their Inference Providers API to router.huggingface.co.

Updated the preset to use the current endpoint.

2. Discord DELETE method restriction (fixes #1433)

The Discord preset allowed DELETE on /**, which is broader than needed for an inference agent. This permits deleting channels, roles, webhooks, guild members, and other resources an agent should never touch.

Scoped DELETE to message and reaction paths only:

• DELETE /api/v*/channels/*/messages/* — delete own messages
• DELETE /api/v*/channels/*/messages/*/reactions/* — remove reactions

Signed-off-by: Benedikt Schackenberg 6381261+BenediktSchackenberg@users.noreply.github.com

Summary by CodeRabbit

• Chores
  • Restricted DELETE requests in the Discord network preset to only specific message and reaction deletion endpoints, removing a prior broad DELETE allowance.
  • Updated the HuggingFace network preset to route traffic to a different external hostname for secure REST connections on port 443 while keeping existing GET/POST allowances intact.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 80642d32-df2f-49e3-aa59-327aa768be68

📥 Commits

Reviewing files that changed from the base of the PR and between 4b4d87b and 2297a37.

📒 Files selected for processing (1)

• nemoclaw-blueprint/policies/presets/discord.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• nemoclaw-blueprint/policies/presets/discord.yaml

---

📝 Walkthrough

Walkthrough

Discord preset now restricts DELETE to message- and reaction-specific endpoints; HuggingFace preset switches inference hostname from api-inference.huggingface.co to router.huggingface.co.

Changes

Cohort / File(s)	Summary
Security Policy Restrictions nemoclaw-blueprint/policies/presets/discord.yaml	Replaced broad DELETE /** rule with two specific DELETE patterns: DELETE /api/v*/channels/*/messages/* and DELETE /api/v*/channels/*/messages/*/reactions/*/*, removing unconditional DELETE allowance.
Endpoint Configuration Update nemoclaw-blueprint/policies/presets/huggingface.yaml	Repointed HuggingFace inference endpoint hostname from api-inference.huggingface.co to router.huggingface.co (TLS terminate, port 443); allowed methods remain GET and POST.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 I nibble on rules with careful paws,
Trim DELETE to where it rightly belongs,
I hop the router to HuggingFace's cause,
A tidy patch, a chorus of tiny songs,
Hoppity-hop — secure and strong!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately summarizes both main changes: updating the HuggingFace endpoint from api-inference.huggingface.co to router.huggingface.co, and restricting Discord DELETE method to specific paths.
Linked Issues check	✅ Passed	The PR fully addresses both linked issues: HuggingFace endpoint updated to router.huggingface.co (#1453), and Discord DELETE method restricted to message and reaction deletion paths (#1433).
Out of Scope Changes check	✅ Passed	All changes are directly scoped to the linked issues: two YAML policy preset updates in discord.yaml and huggingface.yaml with no extraneous modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Updates two network policy presets to reflect upstream API changes and tighten default permissions.

Changes:

• Update Hugging Face inference endpoint from api-inference.huggingface.co to router.huggingface.co.
• Restrict Discord preset DELETE permissions from all paths to message/reaction-specific paths.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
nemoclaw-blueprint/policies/presets/huggingface.yaml	Switches Hugging Face inference host to the current router endpoint.
nemoclaw-blueprint/policies/presets/discord.yaml	Narrows Discord DELETE permissions to message/reaction routes instead of /**.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The reaction DELETE path pattern looks too narrow for Discord's reaction removal endpoints, which include an additional path segment (e.g., /reactions/{emoji}/@me or /reactions/{emoji}/{user_id}). With the current /reactions/* pattern, DELETE requests to remove a reaction will likely be blocked. Consider expanding the allowed path to include that trailing segment(s) while still keeping it scoped under the message reaction subtree.

Suggested change

	- allow: { method: DELETE, path: "/api/v*/channels/*/messages/*/reactions/*" }
	- allow: { method: DELETE, path: "/api/v*/channels/*/messages/*/reactions/*/*" }

[BenediktSchackenberg]

Fixed — changed /reactions/* to /reactions/*/* to cover the emoji + target segment (@me or {user_id}). Discord reaction DELETE has the form /reactions/{emoji}/@me or /reactions/{emoji}/{user_id}, so two segments are needed after /reactions/.

[wscurran]

✨ Thanks for submitting this fix, which proposes a way to update the HuggingFace endpoint and tighten Discord DELETE permissions in the network policy presets.

---

Possibly related open issues:

• #1433 Discord Preset Allows DELETE Method on All Paths — Overly Permissive Default - IssueFinder - SN 11
• #1453 fix(policy): HuggingFace preset references deprecated api-inference.huggingface.co endpoint