fix(policy): restore L4 tunnel for WebSocket hosts via tls: skip

[laitingsheng]

OpenShell v0.0.15+ auto-terminates TLS unconditionally on every detected TLS stream, which also applies to WSS. Without an explicit opt-out, messaging WebSocket endpoints (previously shipping as pure L4 CONNECT tunnels via access: full) are now MITMed, and the Discord client consistently loses its gateway connection with close code 1006.

Add tls: skip to the affected endpoints to restore the pre-v0.0.15 pass-through behaviour:

• discord preset: gateway.discord.gg
• slack preset: wss-primary.slack.com, wss-backup.slack.com
• baseline openclaw-sandbox.yaml: gateway.discord.gg

Extend the policy schemas to accept skip in the tls enum.

Fixes #2092.
Fixes #1738.

Related to #2085.

Summary

Related Issue

Changes

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• make docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

AI Disclosure

• AI-assisted — tool: Claude Code

---

Signed-off-by: Tinson Lai tinsonl@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved TLS handling for Discord and Slack WebSocket connections to prevent timeout issues and restore proper pass-through behavior for long-lived secure connections.

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes introduce a new tls: skip configuration option for network endpoints in policy definitions and update corresponding JSON schemas to permit this value. The addition targets Discord and Slack WebSocket endpoints to enable TLS passthrough behavior for long-lived connections.

Changes

Cohort / File(s)	Summary
Discord and Slack Policies nemoclaw-blueprint/policies/openclaw-sandbox.yaml, nemoclaw-blueprint/policies/presets/discord.yaml, nemoclaw-blueprint/policies/presets/slack.yaml	Added tls: skip field to gateway WebSocket endpoint definitions for Discord (gateway.discord.gg:443) and Slack (wss-primary.slack.com, wss-backup.slack.com). Updated comments to clarify that tls: skip enables pre-v0.0.15 TLS passthrough behavior for WSS connections, replacing prior guidance on CONNECT tunnels and idle timeout avoidance.
Schema Definitions schemas/blueprint.schema.json, schemas/policy-preset.schema.json, schemas/sandbox-policy.schema.json	Extended the tls property enum for endpoint objects from ["terminate", "passthrough"] to ["terminate", "passthrough", "skip"], enabling schema validation of the new TLS skip mode across all policy types.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 A tunnel pure, at L4 we stay,
Where TLS dances, then skips away,
Discord's gateway now whispers through,
WebSocket wounds fade to skies of blue!
Skip ahead, friend—no more 1006 woes! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding tls: skip to WebSocket endpoints to restore L4 tunnel behavior for Discord/Slack hosts.
Linked Issues check	✅ Passed	The PR fully addresses both linked issues [#2092, #1738]: adds tls: skip to Discord gateway and Slack WebSocket endpoints, extends schemas to support the new enum value, and resolves the 1006 WebSocket close failures.
Out of Scope Changes check	✅ Passed	All changes are scoped to the stated objectives: policy endpoint updates and schema extensions for tls: skip; no unrelated refactoring, dependencies, or features introduced.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/2092-websocket-tls-skip

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[wscurran]

✨
Possibly Fixes:

• #2092 Discord bot never appears online: gateway WebSocket loop-closes with code 1006 through egress proxy
• #1738 [NemoClaw][all platform]Discord channel repeatedly fails to reach READY (WebSocket 1006 + AggregateError) even when REST/auth succeeds
• #2085 Slack Socket Mode crashes on boot with invalid_auth — appToken missing from baked openclaw.json; placeholder resolution also broken

---

Possibly related open issues:

• #2092 Discord bot never appears online: gateway WebSocket loop-closes with code 1006 through egress proxy
• #1738 [NemoClaw][all platform]Discord channel repeatedly fails to reach READY (WebSocket 1006 + AggregateError) even when REST/auth succeeds
• #2085 Slack Socket Mode crashes on boot with invalid_auth — appToken missing from baked openclaw.json; placeholder resolution also broken

[ericksoa]

LGTM. Straightforward fix — adds tls: skip to the WebSocket endpoints that need pure L4 pass-through now that OpenShell v0.0.15+ auto-terminates TLS.

• Correct endpoints targeted (Discord gateway, Slack Socket Mode primary + backup)
• Schemas updated consistently across all three files
• Comments accurately explain the change motivation (NVIDIA/OpenShell#544)
• Discord preset stays in sync with baseline openclaw-sandbox.yaml
• CI all green