fix(messaging): use native WebSocket credential rewrite

.github/workflows/nightly-e2e.yaml

@@ -6,8 +6,7 @@
 #   cloud-e2e                Cloud inference (NVIDIA Endpoint API) on ubuntu-latest.
 #   messaging-providers-e2e  Validates messaging credential provider/placeholder/L7-proxy chain
 #                            for Telegram + Discord + Slack. Uses fake tokens. Slack additionally
-#                            exercises the slack-token-rewriter Bolt-shape → canonical placeholder
-#                            translation (#2085). See PR #1081.
+#                            exercises OpenShell provider-shaped alias resolution (#2085 follow-up).
 #   messaging-compatible-endpoint-e2e
 #                            Validates Telegram + OpenAI-compatible endpoint inference routing
 #                            through inference.local with a hermetic local mock (#2766).
@@ -21,7 +20,7 @@
 #                            gateway stop/start, verify sandbox + workspace + inference).
 #   openshell-gateway-upgrade-e2e
 #                            Validates real v0.0.36 curl install upgrade into
-#                            OpenShell 0.0.37 with pre-upgrade backup, restored
+#                            the current supported OpenShell with pre-upgrade backup, restored
 #                            agent state, and the same agent type running.
 #   gateway-health-honest-e2e
 #                            Coverage guard for #3111: onboard must not log
@@ -36,7 +35,7 @@
 #   hermes-discord-e2e       Hermes Discord onboarding — validates the top-level Hermes
 #                            Discord schema plus OpenShell placeholder/token isolation.
 #   hermes-slack-e2e         Hermes Slack onboarding — validates the Hermes Slack policy,
-#                            Slack providers, and Python placeholder egress path.
+#                            Slack providers, and OpenShell credential rewrite path.
 #   openclaw-inference-switch-e2e
 #                            Switches a running OpenClaw sandbox with `nemoclaw inference set`
 #                            and verifies route, openclaw.json, hashes, and live requests.
@@ -1430,19 +1429,18 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+
       - name: Install NemoClaw
         env:
           NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
           NEMOCLAW_NON_INTERACTIVE: "1"
           NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
-          NEMOCLAW_SANDBOX_NAME: "e2e-double-install"
         run: bash install.sh --non-interactive --yes-i-accept-third-party-software
       - name: Run double onboard E2E test
         env:
           NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
           NEMOCLAW_NON_INTERACTIVE: "1"
           NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
-          NEMOCLAW_E2E_INSTALL_SANDBOX_NAME: "e2e-double-install"
         run: |
           [ -f "$HOME/.bashrc" ] && source "$HOME/.bashrc" 2>/dev/null || true
           export NVM_DIR="${NVM_DIR:-$HOME/.nvm}"
@@ -1469,19 +1467,18 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+
       - name: Install NemoClaw
         env:
           NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
           NEMOCLAW_NON_INTERACTIVE: "1"
           NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
-          NEMOCLAW_SANDBOX_NAME: "e2e-repair-install"
         run: bash install.sh --non-interactive --yes-i-accept-third-party-software
       - name: Run onboard repair E2E test
         env:
           NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
           NEMOCLAW_NON_INTERACTIVE: "1"
           NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
-          NEMOCLAW_E2E_INSTALL_SANDBOX_NAME: "e2e-repair-install"
         run: |
           [ -f "$HOME/.bashrc" ] && source "$HOME/.bashrc" 2>/dev/null || true
           export NVM_DIR="${NVM_DIR:-$HOME/.nvm}"
@@ -1508,6 +1505,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+
       - name: Install NemoClaw
         env:
           NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
@@ -1545,6 +1543,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+
       - name: Install NemoClaw
         env:
           NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
@@ -1583,6 +1582,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+
       - name: Install NemoClaw and onboard sandbox
         env:
           NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
@@ -1624,6 +1624,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+
       - name: Install NemoClaw and onboard sandbox
         env:
           NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}

.github/workflows/sandbox-images-and-e2e.yaml

@@ -80,7 +80,7 @@ jobs:
           docker run --rm --user sandbox nemoclaw-hermes-production \
             test -r /opt/nemoclaw-blueprint/blueprint.yaml
           docker run --rm --user sandbox nemoclaw-hermes-production \
-            test -x /usr/local/bin/nemoclaw-decode-proxy
+            test ! -e /usr/local/bin/nemoclaw-decode-proxy
           docker run --rm --user sandbox nemoclaw-hermes-production \
             test -x /usr/local/bin/nemoclaw-start
 

Dockerfile

@@ -245,7 +245,6 @@ RUN chmod 755 /usr/local/bin/nemoclaw-start /usr/local/bin/nemoclaw-codex-acp \
         /usr/local/lib/nemoclaw/sandbox-init.sh \
         /usr/local/lib/nemoclaw/generate-openclaw-config.py \
     && if [ -d /usr/local/lib/nemoclaw/preloads ]; then find /usr/local/lib/nemoclaw/preloads -type f -name '*.js' -exec chmod 644 {} +; fi \
-    && if [ -f /usr/local/lib/nemoclaw/ws-proxy-fix.js ]; then chmod 644 /usr/local/lib/nemoclaw/ws-proxy-fix.js; fi \
     && chmod 755 /usr/local/share/nemoclaw \
         /usr/local/share/nemoclaw/openclaw-plugins \
     && find /usr/local/share/nemoclaw/openclaw-plugins -type d -exec chmod 755 {} + \

agents/hermes/Dockerfile

@@ -29,28 +29,20 @@ RUN (apt-get remove --purge -y gcc gcc-12 g++ g++-12 cpp cpp-12 make \
     && rm -rf /var/lib/apt/lists/*
 
 # Hermes v2026.4.13+ auto-detects HTTPS_PROXY and skips fallback-IP
-# transport when a proxy is present. The sandbox proxy chain
-# (decode-proxy -> OpenShell L7 proxy) handles REST credential placeholder
-# rewriting and hostname-based policy enforcement. A Hermes-only local Discord
-# facade handles discord.py's Gateway session inside the sandbox and forwards
-# REST through the same placeholder-substitution path.
+# transport when a proxy is present. OpenShell handles REST credential
+# placeholder rewriting, hostname-based policy enforcement, and native
+# WebSocket credential rewrite at the egress boundary.
 ENV HERMES_TELEGRAM_DISABLE_FALLBACK_IPS=1
 
 # Copy NemoClaw plugin for Hermes (Python-based)
 COPY agents/hermes/plugin/ /opt/nemoclaw-hermes-plugin/
 RUN chmod -R a+rX /opt/nemoclaw-hermes-plugin/
 
-# Copy config generator, Discord facade, and URL-decode proxy
+# Copy config generator
 COPY agents/hermes/generate-config.ts /opt/nemoclaw-hermes-config/generate-config.ts
 COPY agents/hermes/config/ /opt/nemoclaw-hermes-config/config/
 RUN find /opt/nemoclaw-hermes-config -type d -exec chmod 755 {} + \
     && find /opt/nemoclaw-hermes-config -type f -exec chmod 444 {} +
-COPY agents/hermes/decode-proxy.py /usr/local/bin/nemoclaw-decode-proxy
-COPY agents/hermes/discord-facade.py /usr/local/bin/nemoclaw-discord-facade
-COPY agents/hermes/discord-preload/ /opt/nemoclaw-hermes-discord-preload/
-RUN chmod 755 /usr/local/bin/nemoclaw-decode-proxy /usr/local/bin/nemoclaw-discord-facade \
-    && find /opt/nemoclaw-hermes-discord-preload -type d -exec chmod 755 {} + \
-    && find /opt/nemoclaw-hermes-discord-preload -type f -exec chmod 444 {} +
 
 # Copy blueprint (shared infrastructure)
 COPY nemoclaw-blueprint/ /opt/nemoclaw-blueprint/

agents/hermes/config/messaging-config.ts

@@ -9,9 +9,6 @@ const CHANNEL_TOKEN_ENVS: Record<string, string[]> = {
   slack: ["SLACK_BOT_TOKEN", "SLACK_APP_TOKEN"],
 };
 
-const HERMES_DISCORD_PROXY = "http://127.0.0.1:3129";
-const HERMES_DISCORD_FACADE = "http://127.0.0.1:3130";
-
 export function buildMessagingEnvLines(
   enabledChannels: Set<string>,
   allowedIds: MessagingAllowedIds,
@@ -25,8 +22,6 @@ export function buildMessagingEnvLines(
       envLines.push(`${envKey}=${buildTokenPlaceholder(channel, envKey)}`);
     }
     if (channel === "discord") {
-      envLines.push(`DISCORD_PROXY=${HERMES_DISCORD_PROXY}`);
-      envLines.push(`NEMOCLAW_DISCORD_FACADE_URL=${HERMES_DISCORD_FACADE}`);
       const guildIds = Object.keys(discordGuilds).filter(Boolean);
       if (guildIds.length > 0) {
         envLines.push(`NEMOCLAW_DISCORD_GUILD_IDS=${guildIds.join(",")}`);