fix(policy): split Claude Code from permissive policies#4075
Conversation
📝 WalkthroughWalkthroughClaude Code endpoints were removed from permissive sandbox policies and placed into a new explicit ChangesClaude Code Network Isolation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint skipped: no ESLint configuration detected in root package.json. To enable, add Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/policies.test.ts (1)
1479-1498: ⚡ Quick winStrengthen endpoint invariants in the Claude Code preset test.
This test already checks hosts and methods, but it can still pass if endpoint transport semantics drift. Please also assert
port,protocol, andenforcementfor each endpoint to prevent silent widening.Suggested patch
) as { preset?: { name?: string }; network_policies?: Record< string, { - endpoints?: Array<{ host?: string; access?: string; rules?: unknown[] }>; + endpoints?: Array<{ + host?: string; + port?: number; + protocol?: string; + enforcement?: string; + access?: string; + rules?: unknown[]; + }>; binaries?: Array<{ path?: string }>; } >; }; @@ for (const endpoint of claudePolicy?.endpoints ?? []) { + expect(endpoint.port).toBe(443); + expect(endpoint.protocol).toBe("rest"); + expect(endpoint.enforcement).toBe("enforce"); expect(endpoint).not.toHaveProperty("access"); expect(endpoint.rules).toEqual( expect.arrayContaining([ { allow: { method: "GET", path: "/**" } }, { allow: { method: "POST", path: "/**" } },🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/policies.test.ts` around lines 1479 - 1498, The test currently verifies hosts and allowed methods for preset.network_policies?.claude_code but doesn't lock down transport semantics; update the loop over claudePolicy?.endpoints to also assert that each endpoint has port === 443, protocol === "https", and enforcement === "required" (i.e., add expectations on endpoint.port, endpoint.protocol, and endpoint.enforcement alongside the existing access/rules checks) so transport/security widening is caught.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/policies.test.ts`:
- Around line 1479-1498: The test currently verifies hosts and allowed methods
for preset.network_policies?.claude_code but doesn't lock down transport
semantics; update the loop over claudePolicy?.endpoints to also assert that each
endpoint has port === 443, protocol === "https", and enforcement === "required"
(i.e., add expectations on endpoint.port, endpoint.protocol, and
endpoint.enforcement alongside the existing access/rules checks) so
transport/security widening is caught.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 65f1575a-aa80-41f6-b813-fd2f4dfc1790
📒 Files selected for processing (6)
agents/hermes/policy-permissive.yamlagents/openclaw/policy-permissive.yamldocs/reference/network-policies.mdxnemoclaw-blueprint/policies/openclaw-sandbox-permissive.yamlnemoclaw-blueprint/policies/presets/claude-code.yamltest/policies.test.ts
💤 Files with no reviewable changes (3)
- agents/hermes/policy-permissive.yaml
- agents/openclaw/policy-permissive.yaml
- nemoclaw-blueprint/policies/openclaw-sandbox-permissive.yaml
There was a problem hiding this comment.
Pull request overview
This PR tightens NemoClaw’s permissive (“shields down”) sandbox network policies by removing Claude Code–specific egress and reintroducing it only via an explicit claude-code policy preset, so Claude Code endpoints aren’t granted unless a user opts in.
Changes:
- Removed
claude_codeendpoint blocks from the global and agent-specific permissive policy YAMLs. - Added a new built-in preset
claude-codethat scopes allowed endpoints and binaries for Claude Code. - Updated policy preset tests and docs to reflect the new opt-in behavior and prevent regressions.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| test/policies.test.ts | Updates preset counts/names and adds regression coverage ensuring Claude Code hosts don’t appear in permissive policies and exist only in the new preset. |
| nemoclaw-blueprint/policies/presets/claude-code.yaml | Introduces the new claude-code preset with explicit REST rules and a scoped binary allowlist. |
| nemoclaw-blueprint/policies/openclaw-sandbox-permissive.yaml | Removes the Claude Code network policy block from the global permissive policy. |
| agents/openclaw/policy-permissive.yaml | Removes the duplicated Claude Code block from OpenClaw’s permissive policy. |
| agents/hermes/policy-permissive.yaml | Removes the duplicated Claude Code block from Hermes’s permissive policy. |
| docs/reference/network-policies.mdx | Documents that Claude Code direct egress is opt-in via claude-code and separate from inference routing. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
🧹 Nitpick comments (1)
docs/security/best-practices.mdx (1)
163-163: ⚡ Quick winUse one sentence per source line in these table cells.
Both rows place multiple sentences on a single source line; split them so each sentence is on its own line.
As per coding guidelines, "One sentence per line in source (makes diffs readable). Flag paragraphs where multiple sentences appear on the same line."
Also applies to: 517-517
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/security/best-practices.mdx` at line 163, The table cell for the `claude-code` preset contains multiple sentences on one source line; split that cell so each sentence is on its own source line (e.g., break "Allows a separately installed Claude Code CLI to reach Anthropic and telemetry hosts with its own credentials. Do not use this preset for NemoClaw inference routing." into two lines). Apply the same one-sentence-per-line fix to the other affected table row (the row referenced as also applying at 517-517) so every sentence in each table cell is on its own source line.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/security/best-practices.mdx`:
- Line 163: The table cell for the `claude-code` preset contains multiple
sentences on one source line; split that cell so each sentence is on its own
source line (e.g., break "Allows a separately installed Claude Code CLI to reach
Anthropic and telemetry hosts with its own credentials. Do not use this preset
for NemoClaw inference routing." into two lines). Apply the same
one-sentence-per-line fix to the other affected table row (the row referenced as
also applying at 517-517) so every sentence in each table cell is on its own
source line.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1d323874-4538-419a-82f2-44450c2fac87
📒 Files selected for processing (3)
docs/reference/network-policies.mdxdocs/security/best-practices.mdxtest/policies.test.ts
✅ Files skipped from review due to trivial changes (1)
- docs/reference/network-policies.mdx
1PoPTRoN
force-pushed
the
fix/claude-code-permissive-policy
branch
from
59d6122 to
19baf90
Compare
Signed-off-by: 1PoPTRoN <vrxn.arp1traj@gmail.com>
1PoPTRoN
force-pushed
the
fix/claude-code-permissive-policy
branch
from
19baf90 to
16ed019
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
docs/security/best-practices.mdx (1)
163-163: ⚡ Quick winSplit sentences to one-per-line in source.
Line 163, Line 446, and Line 517 each contain multiple sentences on the same source line. Please split them so each sentence is on its own line.
As per coding guidelines, "One sentence per line in source (makes diffs readable)."
Also applies to: 446-446, 517-517
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/security/best-practices.mdx` at line 163, The table row containing the `claude-code` preset currently has multiple sentences on one source line; split that row so each sentence is on its own line (e.g., break after "telemetry, and crash-report endpoints." and after "with its own credentials."), and do the same for the other two occurrences flagged (the other multiline-sentence source lines) so each sentence occupies its own line in the markdown source; this keeps the `claude-code` table entry and the two other affected paragraphs one-sentence-per-line as required.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/security/best-practices.mdx`:
- Line 163: The table row containing the `claude-code` preset currently has
multiple sentences on one source line; split that row so each sentence is on its
own line (e.g., break after "telemetry, and crash-report endpoints." and after
"with its own credentials."), and do the same for the other two occurrences
flagged (the other multiline-sentence source lines) so each sentence occupies
its own line in the markdown source; this keeps the `claude-code` table entry
and the two other affected paragraphs one-sentence-per-line as required.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c392c355-1f77-42af-840b-ee394117468a
📒 Files selected for processing (7)
agents/hermes/policy-permissive.yamlagents/openclaw/policy-permissive.yamldocs/reference/network-policies.mdxdocs/security/best-practices.mdxnemoclaw-blueprint/policies/openclaw-sandbox-permissive.yamlnemoclaw-blueprint/policies/presets/claude-code.yamltest/policies.test.ts
💤 Files with no reviewable changes (3)
- nemoclaw-blueprint/policies/openclaw-sandbox-permissive.yaml
- agents/hermes/policy-permissive.yaml
- agents/openclaw/policy-permissive.yaml
Summary
Removes Claude Code-specific egress from the permissive sandbox policies and moves it behind an explicit
claude-codepreset. This keepsshields downfrom granting Anthropic/telemetry endpoints unless users intentionally opt into Claude Code access.Related Issue
Fixes #4073
Changes
claude_codeblock from the global permissive policy.claude_codeblocks from OpenClaw and Hermes agent-specific permissive policies.claude-codepolicy preset with explicit REST rules and scoped binary allowlist.Type of Change
Verification
npx prek run --all-filespassesnpm testpassesmake docsbuilds without warnings (doc changes only)Additional verification run:
npm run validate:configspassesnpm run build:clipassesnpx vitest run test/policies.test.tspassesnpx vitest run test/validate-blueprint.test.ts test/security-binaries-restriction.test.tspassesgit diff --checkpassesSigned-off-by: 1PoPTRoN vrxn.arp1traj@gmail.com
Summary by CodeRabbit
New Features
Changes
Documentation
Tests