fix: add policy preset for brew - #1292

Closed

laitingsheng wants to merge 115 commits into

mainfrom

fix/brew-policy

Commits on Apr 1, 2026

fix: add policy preset for brew
laitingsheng
committed
1646090

Commits on Apr 2, 2026

chore: add cyclomatic complexity lint rule (#875)

authored and
laitingsheng
committed
8066b3c
docs: add host-side config and state file locations to README (#903)

WuKongAI-CMU
authored and
laitingsheng
committed
9925296
chore: add tsconfig.cli.json, root execa, TS coverage ratchet (#913)

authored and
laitingsheng
committed
bdaac07
fix: use CONNECT tunnel for WebSocket endpoints in Discord/Slack presets (#438)

BenediktSchackenberg
authored and
laitingsheng
committed
0c9fb9f
fix: standardize Node.js minimum version to 22.16 (#840)

authored and
laitingsheng
committed
20aef98
fix: harden installer and onboard resiliency (#961)

kjw3
authored and
laitingsheng
committed
35922dd
fix(security): strip credentials from migration snapshots and enforce blueprint digest (#769)

gn00295120
authored and
laitingsheng
committed
8b1bd38
fix(sandbox): export proxy env vars with full NO_PROXY and persist across reconnects (#1025)

authored and
laitingsheng
committed
b4b9ba9
fix(policies): preset application for versionless policies (Fixes #35) (#101)

authored and
laitingsheng
committed
2c22c43
fix: restore routed inference and connect UX (#1037)

kjw3
authored and
laitingsheng
committed
c9b9cea
fix(sandbox): restore sandbox DNS resolution for web tools (fixes #626) (#1062)

senthilr-nv
authored and
laitingsheng
committed
2c42aaa
fix(install): add trap handler to spin() for clean Ctrl+C teardown (#1070)

latenighthackathon
authored and
laitingsheng
committed
736261b
fix(install): upgrade Node.js via nvm when system version is below minimum (#1079)

ericksoa
authored and
laitingsheng
committed
725666f
chore(docs): add debug and uninstall to commands reference (#1082)

ericksoa
authored and
laitingsheng
committed
b07a0ec
fix(onboard): retry gateway start with exponential backoff (#1051)

ericksoa
authored and
laitingsheng
committed
e049a17
ci(hooks): add root-level vitest to pre-push hooks (#1083)

ericksoa
authored and
laitingsheng
committed
8ff4ac7
feat: add Kubernetes testing infrastructure (#227)

authored and
laitingsheng
committed
0f46176
fix(registry): atomic writes and advisory file locking for sandboxes.json (#1033)

authored and
laitingsheng
committed
289629d
fix(onboard): force chat completions API for vLLM and NIM-local providers (#980)

authored and
laitingsheng
committed
3515f1e
fix(cli): show live gateway model/provider in list and status commands (#1041)

authored and
laitingsheng
committed
963d917
fix: improve setup.sh and brev-setup.sh for CI and non-interactive use (#1090)

jyaunches
authored and
laitingsheng
committed
ab6a53d
docs: add architecture diagram and overview (#1095)

jyaunches
authored and
laitingsheng
committed
7156969
docs: add CLAUDE.md and AGENTS.md for AI agent development guidance (#1103)

jyaunches
authored and
laitingsheng
committed
65cf248
fix(onboard): skip OLLAMA_HOST=0.0.0.0 on WSL2 to fix Docker routing (#1104)

jieunl24
authored and
laitingsheng
committed
8bbf438
test(security): add Brev E2E tests for command injection and credential sanitization (#1092)

authored and
laitingsheng
committed
a5918f1
fix: refactor file writing to use fs.writeFileSync (#1052)

vl43den
authored and
laitingsheng
committed
3d2af9c
ci(nightly-e2e): remove misleading environment from cloud-experimental job (#1085)

authored and
laitingsheng
committed
7732562
fix(docker): set nemoclaw-start permissions to 755 for sandbox readability (#635)

authored and
laitingsheng
committed
02b1ef6
fix: prevent command injection in isRepoPrivate() (#973)

authored and
laitingsheng
committed
d859e88
fix(sandbox): add .openclaw/memory dir and symlink to base image (#1061)

authored and
laitingsheng
committed
40b0212
fix(nim): use published Docker port in status checks (#1022)

authored and
laitingsheng
committed
459986b
fix(docker): exclude .venv and dev artifacts from Docker build context (#1075)

authored and
laitingsheng
committed
4bf3dcc
fix(onboard): add timeout to spawnSync calls to prevent hung processes (#1069)

authored and
laitingsheng
committed
e5e99c7
docs(cli): sync command reference with implemented CLI surface (#901)

WuKongAI-CMU
authored and
laitingsheng
committed
5aae519
fix(policy): add node binary to npm_registry policy (#669)

authored and
laitingsheng
committed
2da2a02
fix(security): add rate limiting to Telegram bridge (#865)

authored and
laitingsheng
committed
3946baa
fix(scripts): enforce config integrity check in non-root mode (#1071)

authored and
laitingsheng
committed
4d7d70f
fix(test): stabilize debug and credential prompt tests (#817)

cr7258
authored and
laitingsheng
committed
0d69865
fix: check GPU VRAM against NIM model requirements before setting nimCapable (#836)

authored and
laitingsheng
committed
ce1edcb
fix(policy): use access: full for gateway.discord.gg in default sandbox policy (#1004)

authored and
laitingsheng
committed
88065b2
fix(onboard): replace predictable temp filenames with mkdtempSync (#1094)

authored and
laitingsheng
committed
3ce7326
fix(install): ensure p-retry resolves for npm install -g from source (#1112)

authored and
laitingsheng
committed
6d5c443
fix(onboard): robustify health checks and wait for dashboard readiness (#183)

authored and
laitingsheng
committed
43833bc
fix(preflight): auto-create swap on low-memory VMs to prevent OOM during sandbox build (#419)

authored and
laitingsheng
committed
01828c8
fix(install): configure npm for user-local installs to avoid EACCES on Linux (#821)

authored and
laitingsheng
committed
3c9083f
fix(security): replace method wildcards with explicit GET+POST in baseline policy (#1034)

stikman28
authored and
laitingsheng
committed
8544806
fix(scripts): force IPv4 DNS on WSL2 to prevent bridge ETIMEDOUT (#1066)

authored and
laitingsheng
committed
ac454ed
fix(onboard): add sudo prefix to lsof port-conflict suggestions (#1073)

authored and
laitingsheng
committed
319ccf0
refactor(preflight): simplify swap handling (#1122)

cv
authored and
laitingsheng
committed
92fac48
ci: add DCO sign-off check workflow (#941)

brandonpelfrey
authored and
laitingsheng
committed
49ca947
docs: re-balancing README and docs (#1124)

miyoungc
authored and
laitingsheng
committed
eb0f12d
fix(security): verify SHA-256 checksum on OpenShell binary download (#697)

authored and
laitingsheng
committed
feaf351
fix(security): download installers to file before execution (#696)

authored and
laitingsheng
committed
500aca3
docs: improve vulnerability reporting guide (#1128)

miyoungc
authored and
laitingsheng
committed
20f482b
fix(onboard): pre-select suggested policy presets in visual display (#777)

authored and
laitingsheng
committed
dc77c9d
docs(deploy): add Brev first-run quick start (#927)

authored and
laitingsheng
committed
1706f38
chore(deps): bump docker/setup-buildx-action from 3 to 4 (#932)

dependabot[bot]
authored and
laitingsheng
committed
62cc061
fix(onboard): use sudo lsof fallback to identify root-owned port blockers (fixes #726) (#745)

authored and
laitingsheng
committed
b3f5cec
chore(deps): bump marocchino/sticky-pull-request-comment from 2.9.4 to 3.0.2 (#930)

dependabot[bot]
authored and
laitingsheng
committed
8368607
fix: harden inference onboarding auth and validation recovery (#1136)

kjw3
authored and
laitingsheng
committed
9df9152
fix(blueprint): clawhub.ai and node egress in OpenShell policy (#582)

authored and
laitingsheng
committed
4e85a5e
fix(scripts): redirect all operational log messages to stderr (#1072)

authored and
laitingsheng
committed
04ae7c8
fix(security): stop piping curl output directly to sudo bash (#869)

authored and
laitingsheng
committed
d714c25
fix(security): add verification for downloaded Ollama installer (#1143)

fdzdev
authored and
laitingsheng
committed
e1604f8
fix(security): deny Tailscale socket and binary access in sandbox policy (#1142)

authored and
laitingsheng
committed
0851ac0
Revert "fix(security): deny Tailscale socket and binary access in sandbox policy" (#1169)

jacobtomlinson
authored and
laitingsheng
committed
1e3b5b5
fix(docs): inline quickstart content to fix GitHub rendering (#1186)

ericksoa
authored and
laitingsheng
committed
addef35
fix: pass DCO check on NVIDIA emails (#1190)

brandonpelfrey
authored and
laitingsheng
committed
0d55ed1
feat: add Amazon Bedrock as inference provider (#963)

authored and
laitingsheng
committed
561434c
fix(install): write nemoclaw alias to shell profile after shim creation (#1180)

ericksoa
authored and
laitingsheng
committed
fbaa004
ci: consolidate checks and add main workflow (#1131)

authored and
laitingsheng
committed
2ddce9f
fix(security): reject unsafe HOME fallback in credential storage (#864)

fdzdev
authored and
laitingsheng
committed
1f4d93a
fix(security): make .openclaw symlinks immutable after validation (#1137)

latenighthackathon
authored and
laitingsheng
committed
d8b2807
fix(security): block CGNAT IPs in SSRF validation (#1138)

fdzdev
authored and
laitingsheng
committed
1fba73c
fix(onboard): restore dashboard forward and mac port guidance (#1192)

kjw3
authored and
laitingsheng
committed
00b1987
fix(install): default to `latest` tag instead of `main` branch (#1197)

authored and
laitingsheng
committed
96b46c6
fix: skip vitest pre-push hooks on docs-only changes (#1199)

cv
authored and
laitingsheng
committed
d3935d0
fix(cli): restore logs streaming and reboot recovery ux (#1187)

authored and
laitingsheng
committed
b1a96b7
fix(policies): guard extractPresetEntries against null/undefined input (#1042)

Junior00619
authored and
laitingsheng
committed
9afb007
chore: add Prettier formatting for root-level JS files (#1200)

cv
authored and
laitingsheng
committed
c55646d
fix: unify vitest hooks and standardize pre-commit config (#1201)

cv
authored and
laitingsheng
committed
29c44d2
fix(onboard): skip CoreDNS patching on WSL2 to fix sandbox DNS (#1207)

jieunl24
authored and
laitingsheng
committed
671cde8
refactor(e2e): simplify Brev E2E to use bare CPU instances (#1205)

jyaunches
authored and
laitingsheng
committed
f63f07f
docs: align with current CLI, onboard recommended and setup legacy (Fixes #38) (#103)

authored and
laitingsheng
committed
0c5b505
refactor: remove Amazon Bedrock as first-class provider (#1212)

authored and
laitingsheng
committed
cebfe6a
docs: add security best practices (#1203)

authored and
laitingsheng
committed
35a708f
fix: address core blocker lifecycle regressions (#1208)

kjw3
authored and
laitingsheng
committed
6acf889
fix: re-prompt on invalid sandbox name instead of exiting (#1173)

authored and
laitingsheng
committed
14a3371
docs: change alpha statement into banner, add disclaimer (#1209)

miyoungc
authored and
laitingsheng
committed
cb18c08
fix(onboard): add skipVerify to NVIDIA provider config (#1133)

authored and
laitingsheng
committed
f997b98
test: improve CLI test determinism and remove redundant test logic (#1123)

authored and
laitingsheng
committed
ad2c245
fix: resolve ESLint error and speed up gateway recovery tests (#1223)

cv
authored and
laitingsheng
committed
79c83cb
fix: derive CLI version from git tags instead of hard-coded package.json (#1221)

cv
authored and
laitingsheng
committed
72bdeb0
fix: replace predictable temp filenames with mkdtempSync (#1105)

BenediktSchackenberg
authored and
laitingsheng
committed
a720888
fix: use sudo -n for lsof retry in preflight to avoid password prompt (#1227)

cv
authored and
laitingsheng
committed
28831e6
fix(policies): use structured YAML parsing for policy preset merge (#1055)

authored and
laitingsheng
committed
7d0b221
fix(policy): add protocol/enforcement/tls to statsig and sentry endpoints (#1220)

authored and
laitingsheng
committed
f4eef58
refactor(cli): extract pure functions from onboard.js to typed TypeScript modules (#1240)

authored and
laitingsheng
committed
e6e1bcf
refactor(cli): delete setup.sh, route all setup through nemoclaw onboard (#1235)

authored and
laitingsheng
committed
f4f2da5
fix(security): harden gateway auth defaults and restrict auto-pair (#1217)

jyaunches
authored and
laitingsheng
committed
58ae43b
test: add shouldPatchCoredns WSL2 unit tests (#1274)

authored and
laitingsheng
committed
54bf7ca
fix(install): add build:cli step and harden E2E destroy check (#1277)

ericksoa
authored and
laitingsheng
committed
6623e0f
docs: fix incorrect -f flag in logs examples, should be --follow (#1023)

authored and
laitingsheng
committed
7099e77
refactor(cli): migrate runtime-recovery.js to TypeScript (#1268)

authored and
laitingsheng
committed
3e24766
refactor(cli): migrate local-inference.js to TypeScript (#1270)

authored and
laitingsheng
committed
ac58be7
refactor(cli): migrate nim.js to TypeScript (#1271)

authored and
laitingsheng
committed
3aeed68
fix: align setup-spark.sh with the spark-install.md (#1256)

authored and
laitingsheng
committed
6261b15
refactor(cli): migrate onboard-session.js to TypeScript (#1272)

authored and
laitingsheng
committed
42818b4
refactor(cli): migrate inference-config.js to TypeScript (#1265)

authored and
laitingsheng
committed
f1694de
fix: remove broken qwen endpoint picker entry (#1269)

authored and
laitingsheng
committed
ba6393e
fix: harden spark startup and destroy handling (#1273)

authored and
laitingsheng
committed
dd59326
fix(cli): classifyGatewayStatus no longer misclassifies "Not connected" (#1288)

authored and
laitingsheng
committed
0ef82e3
chore: add cut-release-tag agent skill (#1291)

ericksoa
authored and
laitingsheng
committed
348ebf3
fix: add policy preset for brew
laitingsheng
committed
4591280