From 4b4d87b2fd38b1c8cf9627ae32fbb989c6886658 Mon Sep 17 00:00:00 2001
From: Benedikt Schackenberg
 <6381261+BenediktSchackenberg@users.noreply.github.com>
Date: Mon, 6 Apr 2026 19:52:03 +0000
Subject: [PATCH 1/2] fix(policy): update HuggingFace endpoint and restrict
 Discord DELETE method

Two policy preset fixes:

1. HuggingFace (fixes #1453):
   - Replace deprecated api-inference.huggingface.co (returns HTTP 410)
     with router.huggingface.co (current Inference Providers API endpoint)

2. Discord (fixes #1433):
   - Remove overly broad DELETE on '/**' which allows deleting channels,
     roles, webhooks, and other resources an inference agent shouldn't touch
   - Scope DELETE to message/reaction paths only:
     /api/v*/channels/*/messages/* and
     /api/v*/channels/*/messages/*/reactions/*

Signed-off-by: Benedikt Schackenberg <6381261+BenediktSchackenberg@users.noreply.github.com>
---
 nemoclaw-blueprint/policies/presets/discord.yaml     | 4 +++-
 nemoclaw-blueprint/policies/presets/huggingface.yaml | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/nemoclaw-blueprint/policies/presets/discord.yaml b/nemoclaw-blueprint/policies/presets/discord.yaml
index 8ffd1bc63c9..75fa058f11a 100644
--- a/nemoclaw-blueprint/policies/presets/discord.yaml
+++ b/nemoclaw-blueprint/policies/presets/discord.yaml
@@ -19,7 +19,9 @@ network_policies:
           - allow: { method: POST, path: "/**" }
           - allow: { method: PUT, path: "/**" }
           - allow: { method: PATCH, path: "/**" }
-          - allow: { method: DELETE, path: "/**" }
+          # DELETE only on message and reaction endpoints — not all paths
+          - allow: { method: DELETE, path: "/api/v*/channels/*/messages/*" }
+          - allow: { method: DELETE, path: "/api/v*/channels/*/messages/*/reactions/*" }
       # WebSocket gateway — must use access: full (CONNECT tunnel) instead
       # of protocol: rest. The proxy's HTTP idle timeout (~2 min) kills
       # long-lived WebSocket connections; a CONNECT tunnel avoids
diff --git a/nemoclaw-blueprint/policies/presets/huggingface.yaml b/nemoclaw-blueprint/policies/presets/huggingface.yaml
index 6462e238bca..ef9a7b72422 100644
--- a/nemoclaw-blueprint/policies/presets/huggingface.yaml
+++ b/nemoclaw-blueprint/policies/presets/huggingface.yaml
@@ -24,7 +24,7 @@ network_policies:
         tls: terminate
         rules:
           - allow: { method: GET, path: "/**" }
-      - host: api-inference.huggingface.co
+      - host: router.huggingface.co
         port: 443
         protocol: rest
         enforcement: enforce

From 2297a37b21aa25982868ca78378af61f21804726 Mon Sep 17 00:00:00 2001
From: Benedikt Schackenberg
 <6381261+BenediktSchackenberg@users.noreply.github.com>
Date: Mon, 6 Apr 2026 19:57:21 +0000
Subject: [PATCH 2/2] =?UTF-8?q?fix(policy):=20fix=20Discord=20reaction=20D?=
 =?UTF-8?q?ELETE=20path=20=E2=80=94=20requires=20two=20trailing=20segments?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Discord reaction removal endpoints use the form:
  DELETE /api/v*/channels/*/messages/*/reactions/{emoji}/@me
  DELETE /api/v*/channels/*/messages/*/reactions/{emoji}/{user_id}

The previous /reactions/* only matched one segment after /reactions/,
which would block actual reaction DELETE calls. Changed to /reactions/*/*
to cover the emoji + target (self or user_id) segments.

Per Copilot review on #1540.

Signed-off-by: Benedikt Schackenberg <6381261+BenediktSchackenberg@users.noreply.github.com>
---
 nemoclaw-blueprint/policies/presets/discord.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nemoclaw-blueprint/policies/presets/discord.yaml b/nemoclaw-blueprint/policies/presets/discord.yaml
index 75fa058f11a..42a0dd8ddd3 100644
--- a/nemoclaw-blueprint/policies/presets/discord.yaml
+++ b/nemoclaw-blueprint/policies/presets/discord.yaml
@@ -20,8 +20,9 @@ network_policies:
           - allow: { method: PUT, path: "/**" }
           - allow: { method: PATCH, path: "/**" }
           # DELETE only on message and reaction endpoints — not all paths
+          # Reaction DELETE requires an extra path segment: /reactions/{emoji}/@me or /{user_id}
           - allow: { method: DELETE, path: "/api/v*/channels/*/messages/*" }
-          - allow: { method: DELETE, path: "/api/v*/channels/*/messages/*/reactions/*" }
+          - allow: { method: DELETE, path: "/api/v*/channels/*/messages/*/reactions/*/*" }
       # WebSocket gateway — must use access: full (CONNECT tunnel) instead
       # of protocol: rest. The proxy's HTTP idle timeout (~2 min) kills
       # long-lived WebSocket connections; a CONNECT tunnel avoids