fix(macos): restore VM inference and Hermes Discord paths

agents/hermes/config/messaging-config.ts

@@ -32,6 +32,11 @@ export function buildMessagingEnvLines(
   const discordAllowedUsers = collectDiscordAllowedUsers(allowedIds, discordGuilds);
   if (discordAllowedUsers.length > 0) {
     envLines.push(`DISCORD_ALLOWED_USERS=${discordAllowedUsers.join(",")}`);
+  } else if (
+    enabledChannels.has("discord") &&
+    Object.keys(discordGuilds).filter((guildId) => guildId.trim()).length > 0
+  ) {
+    envLines.push("DISCORD_ALLOW_ALL_USERS=true");
   }
   if (allowedIds.telegram?.length) {
     envLines.push(`TELEGRAM_ALLOWED_USERS=${allowedIds.telegram.map(String).join(",")}`);

agents/hermes/policy-additions.yaml

@@ -229,6 +229,14 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
           - allow: { method: WEBSOCKET_TEXT, path: "/**" }
+      - host: "*.discord.gg"
+        port: 443
+        protocol: websocket
+        enforcement: enforce
+        websocket_credential_rewrite: true
+        rules:
+          - allow: { method: GET, path: "/**" }
+          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
       - host: cdn.discordapp.com
         port: 443
         protocol: rest

agents/hermes/policy-permissive.yaml

@@ -194,6 +194,14 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
           - allow: { method: WEBSOCKET_TEXT, path: "/**" }
+      - host: "*.discord.gg"
+        port: 443
+        protocol: websocket
+        enforcement: enforce
+        websocket_credential_rewrite: true
+        rules:
+          - allow: { method: GET, path: "/**" }
+          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
       - host: cdn.discordapp.com
         port: 443
         protocol: rest

agents/hermes/start.sh

@@ -585,7 +585,12 @@ if [ "$(id -u)" -ne 0 ]; then
   export HOME=/sandbox
   export HERMES_HOME="${HERMES_DIR}"
 
-  if ! verify_config_integrity "${HERMES_DIR}" "${HERMES_HASH_FILE}"; then
+  # macOS VM startup currently runs this entrypoint as the sandbox user and
+  # remaps rootfs ownership to the host uid. In that mode the strict /etc hash
+  # cannot remain a root-owned trust anchor, so use the same locked-aware
+  # mutable-default verifier as OpenClaw. The root path below keeps strict
+  # verification against /etc/nemoclaw/hermes.config-hash.
+  if ! verify_config_integrity_if_locked "${HERMES_DIR}"; then
     echo "[SECURITY] Config integrity check failed — refusing to start (non-root mode)" >&2
     exit 1
   fi

agents/openclaw/policy-permissive.yaml

@@ -160,9 +160,20 @@ network_policies:
         access: full
       - host: gateway.discord.gg
         port: 443
-        protocol: rest
+        protocol: websocket
         enforcement: enforce
-        access: full
+        websocket_credential_rewrite: true
+        rules:
+          - allow: { method: GET, path: "/**" }
+          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
+      - host: "*.discord.gg"
+        port: 443
+        protocol: websocket
+        enforcement: enforce
+        websocket_credential_rewrite: true
+        rules:
+          - allow: { method: GET, path: "/**" }
+          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
       - host: cdn.discordapp.com
         port: 443
         protocol: rest

nemoclaw-blueprint/policies/openclaw-sandbox-permissive.yaml

@@ -195,6 +195,14 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
           - allow: { method: WEBSOCKET_TEXT, path: "/**" }
+      - host: "*.discord.gg"
+        port: 443
+        protocol: websocket
+        enforcement: enforce
+        websocket_credential_rewrite: true
+        rules:
+          - allow: { method: GET, path: "/**" }
+          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
       - host: cdn.discordapp.com
         port: 443
         protocol: rest

nemoclaw-blueprint/policies/presets/discord.yaml

@@ -34,6 +34,14 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
           - allow: { method: WEBSOCKET_TEXT, path: "/**" }
+      - host: "*.discord.gg"
+        port: 443
+        protocol: websocket
+        enforcement: enforce
+        websocket_credential_rewrite: true
+        rules:
+          - allow: { method: GET, path: "/**" }
+          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
       - host: cdn.discordapp.com
         port: 443
         protocol: rest

src/lib/actions/sandbox/connect.ts

@@ -22,6 +22,10 @@ import type { SandboxEntry } from "../../state/registry";
 import { ROOT } from "../../runner";
 import { runSetupDnsProxy } from "../dns";
 import { ensureLiveSandboxOrExit } from "./gateway-state";
+import {
+  applyOpenShellVmDnsMonkeypatch,
+  shouldApplyVmDnsMonkeypatch,
+} from "./vm-dns-monkeypatch";
 import {
   createSystemDeps as createSessionDeps,
   getActiveSandboxSessions,
@@ -155,13 +159,72 @@ function isSandboxInferenceRouteHealthy(sandboxName: string): boolean {
   return probe.status === 0 && /^OK\s+[0-9]{3}\b/.test(probe.output.trim());
 }
 
+function shouldUseLegacyDnsProxyRepair(sb: SandboxEntry | null): boolean {
+  return sb?.openshellDriver !== "vm";
+}
+
+function reapplyVmInferenceRoute(sandboxName: string, sb: SandboxEntry | null): boolean {
+  if (!sb?.provider || !sb.model) return false;
+  runOpenshell(
+    ["inference", "set", "--provider", sb.provider, "--model", sb.model, "--no-verify"],
+    { ignoreError: true },
+  );
+  return isSandboxInferenceRouteHealthy(sandboxName);
+}
+
 function repairSandboxInferenceRouteIfNeeded(
   sandboxName: string,
+  sb: SandboxEntry | null,
   { quiet = false }: { quiet?: boolean } = {},
 ): boolean {
   if (process.env.NEMOCLAW_DISABLE_INFERENCE_ROUTE_REPAIR === "1") return false;
   if (isSandboxInferenceRouteHealthy(sandboxName)) return false;
 
+  if (!shouldUseLegacyDnsProxyRepair(sb)) {
+    if (shouldApplyVmDnsMonkeypatch(sb)) {
+      if (!quiet) {
+        console.log("");
+        console.log(
+          `  inference.local is unavailable inside '${sandboxName}'. Applying OpenShell VM DNS monkeypatch...`,
+        );
+      }
+      const patch = applyOpenShellVmDnsMonkeypatch(sandboxName, sb);
+      if (patch.ok && isSandboxInferenceRouteHealthy(sandboxName)) {
+        if (!quiet) {
+          console.log("  inference.local route repaired.");
+        }
+        return true;
+      }
+      if (!quiet) {
+        if (!patch.ok && patch.reason) {
+          console.error(
+            `  Warning: OpenShell VM DNS monkeypatch did not apply: ${patch.reason}`,
+          );
+        } else if (patch.ok) {
+          console.error(
+            "  Warning: OpenShell VM DNS monkeypatch completed but inference.local is still unavailable.",
+          );
+        }
+      }
+    }
+
+    if (!quiet) {
+      console.log("");
+      console.log(`  inference.local is unavailable inside '${sandboxName}'. Reapplying OpenShell inference route...`);
+    }
+    const healthy = reapplyVmInferenceRoute(sandboxName, sb);
+    if (!quiet) {
+      if (healthy) {
+        console.log("  inference.local route repaired.");
+      } else {
+        console.error(
+          `  Warning: inference.local is still unavailable through the OpenShell ${sb?.openshellDriver || "non-legacy"} gateway path.`,
+        );
+      }
+    }
+    return healthy;
+  }
+
   if (!quiet) {
     console.log("");
     console.log(`  inference.local is unavailable inside '${sandboxName}'. Repairing sandbox DNS proxy...`);
@@ -219,7 +282,7 @@ function ensureSandboxInferenceRoute(
           );
         }
       }
-      repairSandboxInferenceRouteIfNeeded(sandboxName, { quiet });
+      repairSandboxInferenceRouteIfNeeded(sandboxName, sb, { quiet });
     }
   } catch {
     /* non-fatal — don't block connect on inference route repair */