From 3d5063a48a18013cd9e7607aba6deaef2f287bd4 Mon Sep 17 00:00:00 2001 From: latenighthackathon Date: Thu, 2 Apr 2026 17:11:57 -0500 Subject: [PATCH] fix(policy): allow Telegram file downloads in default sandbox policy The Telegram Bot API serves file downloads at /file/bot/ but the default policy only allows /bot*/**. Add GET /file/bot*/** so the sandbox can download incoming audio, voice, document, photo, and video attachments from users. Apply the same rule to the Telegram preset so users who apply the preset also get file download support. Reported by @after-ephemera in NVIDIA Developer Discord. Closes #1301 Signed-off-by: latenighthackathon --- nemoclaw-blueprint/policies/openclaw-sandbox.yaml | 1 + nemoclaw-blueprint/policies/presets/telegram.yaml | 1 + 2 files changed, 2 insertions(+) diff --git a/nemoclaw-blueprint/policies/openclaw-sandbox.yaml b/nemoclaw-blueprint/policies/openclaw-sandbox.yaml index 06f1b9d4a48..ada1ad2fa90 100644 --- a/nemoclaw-blueprint/policies/openclaw-sandbox.yaml +++ b/nemoclaw-blueprint/policies/openclaw-sandbox.yaml @@ -177,6 +177,7 @@ network_policies: rules: - allow: { method: GET, path: "/bot*/**" } - allow: { method: POST, path: "/bot*/**" } + - allow: { method: GET, path: "/file/bot*/**" } binaries: - { path: /usr/local/bin/node } diff --git a/nemoclaw-blueprint/policies/presets/telegram.yaml b/nemoclaw-blueprint/policies/presets/telegram.yaml index b80d7b959f9..0e733043b4b 100644 --- a/nemoclaw-blueprint/policies/presets/telegram.yaml +++ b/nemoclaw-blueprint/policies/presets/telegram.yaml @@ -17,5 +17,6 @@ network_policies: rules: - allow: { method: GET, path: "/bot*/**" } - allow: { method: POST, path: "/bot*/**" } + - allow: { method: GET, path: "/file/bot*/**" } binaries: - { path: /usr/local/bin/node }