[codex] Add Discord read tools

[orangebread]

Summary

Adds three read-only Discord tools scoped by explicit allowlists:

• discord_list_channels
• discord_read_history
• discord_search_messages

The implementation uses Discord HTTP API v10, auto-allows the current Discord session target when appropriate, includes active thread discovery and thread-aware name resolution, enforces hard safety bounds on history/search windows, and returns message permalinks when possible.

Why

Hermes could write to Discord through the gateway but had no safe, bounded way to inspect Discord context from tools. This change adds production-scoped read access without pretending to provide unrestricted server-wide search.

Impact

• New discord_read toolset and core-tool registrations
• Config/env support for:
  • DISCORD_READ_ALLOWED_GUILDS
  • DISCORD_READ_ALLOWED_CHANNELS
  • DISCORD_READ_INCLUDE_DMS
• Deterministic Discord channel/thread resolution in the gateway directory
• Docs and tests covering allowlists, current-session access, thread discovery, and result limits
• Branch updated with current main and conflict resolution completed

Validation

Passed:

• python -m pytest tests/tools/test_discord_read_tool.py -q
• python -m pytest tests/gateway/test_channel_directory.py -q
• python -m pytest tests/gateway/test_session.py -q
• python -m pytest tests/gateway/test_config.py -q
• python -m pytest tests/gateway/test_api_server_toolset.py -q
• python -m pytest tests/test_toolsets.py -q
• python -m pytest tests/tools/test_discord_read_tool.py tests/gateway/test_channel_directory.py tests/gateway/test_session.py tests/gateway/test_config.py tests/gateway/test_api_server_toolset.py tests/test_toolsets.py -q
  • Result: 129 passed

Full suite status in this environment after merging current main:

• python -m pytest tests/ -q
  • Branch result: 7 failed, 7801 passed, 188 skipped, 1 xpassed
  • Current origin/main result: 6 failed, 7791 passed, 188 skipped, 1 xpassed

Known baseline failures on current origin/main:

• tests/hermes_cli/test_tools_config.py::test_first_install_nous_auto_configures_managed_defaults
• tests/tools/test_transcription.py::TestGetProvider::test_explicit_local_no_cloud_fallback
• tests/tools/test_transcription.py::TestGetProvider::test_local_nothing_available
• tests/tools/test_file_read_guards.py::TestConfigOverride::test_custom_config_raises_limit
• tests/tools/test_file_read_guards.py::TestCharacterCountGuard::test_content_under_limit_passes
• tests/tools/test_file_read_guards.py::TestCharacterCountGuard::test_oversized_read_rejected

Additional flaky failure observed both on this branch and when run directly on origin/main:

• tests/gateway/test_approve_deny_commands.py::TestBlockingApprovalE2E::test_parallel_mixed_approve_deny

Environment note:

• Validation used the shared venv with the repo installed editable from this branch.

[teknium1]

Thanks for the bounded, read-only design and the coverage around current-session access and thread discovery.

Problems

• Current main already has REST-backed Discord message retrieval and channel listing: tools/discord_tool.py:511-526 implements fetch_messages, and tools/discord_tool.py:382-384 implements list_channels. Current main intentionally keeps discord and discord_admin off _HERMES_CORE_TOOLS (toolsets.py:453-459; tests/tools/test_discord_tool.py:661-676). Adding three parallel schemas to the core bundle in this PR duplicates that surface and expands it to non-Discord platform bundles.
• hermes_cli/config.py:924-944 and website/docs/user-guide/messaging/discord.md:277-280 make read scope a user-facing .env configuration. AGENTS.md:102-106 requires behavioral settings to be documented in config.yaml instead.

Suggested changes

• Re-scope the bounded search/current-session work onto the existing Discord toolsets rather than adding core tools.
• Keep discord.read.* as the documented configuration path and remove the new .env setup surface.

Automated hermes-sweeper review.

[teknium1]

Please do not add these Discord-specific schemas to _HERMES_CORE_TOOLS. Current main deliberately keeps the existing discord and discord_admin REST tools on hermes-discord only (toolsets.py:453-459; tests/tools/test_discord_tool.py:661-676). Re-scope the bounded read behavior onto that established Discord surface instead of exposing parallel tools to every platform bundle.

[teknium1]

These are non-secret behavioral allowlist settings. Please retain discord.read.* in config.yaml as the user-facing interface and remove these entries from .env setup; AGENTS.md requires behavioral settings to be documented in config rather than .env.