fix(hermes): split small messaging fixes

nemoclaw-blueprint/policies/presets/discord.yaml

@@ -44,5 +44,11 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
     binaries:
+      - { path: /usr/local/bin/hermes }
+      - { path: /usr/bin/python3 }
+      - { path: /usr/bin/python3.11 }
+      - { path: /opt/hermes/.venv/bin/python }
+      - { path: /usr/local/bin/python3 }
+      - { path: /usr/local/bin/python3.11 }
       - { path: /usr/local/bin/node }
       - { path: /usr/bin/node }

nemoclaw-blueprint/policies/presets/slack.yaml

@@ -43,5 +43,11 @@ network_policies:
         access: full
         tls: skip
     binaries:
+      - { path: /usr/local/bin/hermes }
+      - { path: /usr/bin/python3 }
+      - { path: /usr/bin/python3.11 }
+      - { path: /opt/hermes/.venv/bin/python }
+      - { path: /usr/local/bin/python3 }
+      - { path: /usr/local/bin/python3.11 }
       - { path: /usr/local/bin/node }
       - { path: /usr/bin/node }

nemoclaw-blueprint/policies/presets/telegram.yaml

@@ -18,5 +18,11 @@ network_policies:
           - allow: { method: POST, path: "/bot*/**" }
           - allow: { method: GET, path: "/file/bot*/**" }
     binaries:
+      - { path: /usr/local/bin/hermes }
+      - { path: /usr/bin/python3 }
+      - { path: /usr/bin/python3.11 }
+      - { path: /opt/hermes/.venv/bin/python }
+      - { path: /usr/local/bin/python3 }
+      - { path: /usr/local/bin/python3.11 }
       - { path: /usr/local/bin/node }
       - { path: /usr/bin/node }

src/lib/messaging-channel-config.test.ts

@@ -18,6 +18,7 @@ describe("messaging channel config", () => {
       "DISCORD_SERVER_ID",
       "DISCORD_USER_ID",
       "DISCORD_REQUIRE_MENTION",
+      "SLACK_ALLOWED_USERS",
     ]);
   });
 
@@ -28,12 +29,14 @@ describe("messaging channel config", () => {
         TELEGRAM_REQUIRE_MENTION: "yes",
         DISCORD_SERVER_ID: "1491590992753590594",
         DISCORD_REQUIRE_MENTION: "0",
+        SLACK_ALLOWED_USERS: "  U01ABC2DEF3, U04GHI5JKL6  ",
         NVIDIA_API_KEY: "not-channel-config",
       }),
     ).toEqual({
       TELEGRAM_ALLOWED_IDS: "123,456",
       DISCORD_SERVER_ID: "1491590992753590594",
       DISCORD_REQUIRE_MENTION: "0",
+      SLACK_ALLOWED_USERS: "U01ABC2DEF3, U04GHI5JKL6",
     });
   });
 

src/lib/sandbox-channels.test.ts

@@ -28,6 +28,15 @@ describe("sandbox-channels KNOWN_CHANNELS", () => {
     expect(getChannelDef("slack")?.appTokenEnvKey).toBe("SLACK_APP_TOKEN");
   });
 
+  it("asks for Slack human member IDs as a comma-separated allowlist", () => {
+    const slack = getChannelDef("slack");
+    expect(slack?.userIdEnvKey).toBe("SLACK_ALLOWED_USERS");
+    expect(slack?.userIdLabel).toBe("Slack Member IDs (comma-separated allowlist)");
+    expect(slack?.userIdHelp).toContain("comma-separated member IDs");
+    expect(slack?.userIdHelp).toContain("not the app or bot user ID");
+    expect(slack?.allowIdsMode).toBe("dm");
+  });
+
   it("normalises case and whitespace when resolving a channel name", () => {
     expect(getChannelDef("  Telegram  ")).toBe(KNOWN_CHANNELS.telegram);
     expect(getChannelDef("DISCORD")).toBe(KNOWN_CHANNELS.discord);

src/lib/sandbox-channels.ts

@@ -70,6 +70,11 @@ export const KNOWN_CHANNELS: Record<string, ChannelDef> = {
     appTokenLabel: "Slack App Token (Socket Mode)",
     appTokenFormat: /^xapp-[A-Za-z0-9_-]+$/,
     appTokenFormatHint: "Slack app tokens start with 'xapp-' (e.g. xapp-1-A0000-12345-abcdef).",
+    userIdEnvKey: "SLACK_ALLOWED_USERS",
+    userIdHelp:
+      "In Slack, open each allowed human user's profile -> More -> Copy member ID. Enter one or more comma-separated member IDs, not the app or bot user ID. Member IDs look like U01ABC2DEF3.",
+    userIdLabel: "Slack Member IDs (comma-separated allowlist)",
+    allowIdsMode: "dm",
   },
 };
 

test/policies.test.ts

@@ -183,6 +183,10 @@ describe("policies", () => {
     it("includes /usr/bin/node in communication presets", () => {
       for (const preset of ["discord", "slack", "telegram"]) {
         const content = requirePresetContent(policies.loadPreset(preset));
+        expect(content).toContain("/usr/local/bin/hermes");
+        expect(content).toContain("/usr/bin/python3");
+        expect(content).toContain("/usr/bin/python3.11");
+        expect(content).toContain("/opt/hermes/.venv/bin/python");
         expect(content).toContain("/usr/local/bin/node");
         expect(content).toContain("/usr/bin/node");
       }