Summary

Discord Gateway WebSocket does not honor HTTP_PROXY/HTTPS_PROXY environment variables, forcing deployments with egress restrictions to allow broad :443 access (security downgrade).

Current Behavior

extensions/discord/src/monitor/gateway-plugin.ts:402 always creates a direct HttpsAgent for WebSocket connections. Environment proxy is only used if channels.discord.proxy is explicitly configured (which requires loopback host).

Expected Behavior

Gateway WebSocket should honor HTTP_PROXY/HTTPS_PROXY env vars as fallback, matching the existing pattern:

• ✅ Discord REST API: extensions/discord/src/monitor/rest-fetch.ts:35
• ✅ WhatsApp WebSocket: extensions/whatsapp/src/session.ts:193

Proposed Fix

In gateway-plugin.ts:402, add env proxy fallback before direct HttpsAgent:

const envProxyAgent = createEnvProxyDiscordGatewayAgent(params.runtime);
if (envProxyAgent) {
  wsAgent = envProxyAgent;
} else {
  wsAgent = new HttpsAgent({ lookup: discordDnsLookup });
}

// Explicit channels.discord.proxy still overrides
if (proxy) { /* existing logic */ }

Mirror the helper pattern from rest-fetch.ts:35.

Impact

Blocks Discord channel deployment in Kubernetes/OpenShift with network policy egress restrictions. Currently requires broad :443 egress as workaround.

Related: #60035