From 73c8ea78baa9e199b53f9dc300aa57bab48c2c3e Mon Sep 17 00:00:00 2001 From: latenighthackathon Date: Thu, 2 Apr 2026 12:27:41 -0500 Subject: [PATCH] fix(policy): convert npm_registry from access: full to REST GET-only Replace L4 pass-through (access: full) with L7-enforced REST policy restricted to GET. Agents only fetch packages from the npm registry and never publish, so write methods are not needed. Enables per-request rule evaluation, per-request logging, and SecretResolver credential injection on this endpoint. Closes #1355 Signed-off-by: latenighthackathon --- nemoclaw-blueprint/policies/openclaw-sandbox.yaml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/nemoclaw-blueprint/policies/openclaw-sandbox.yaml b/nemoclaw-blueprint/policies/openclaw-sandbox.yaml index b29eaa2dd1d..6552b4d8fa5 100644 --- a/nemoclaw-blueprint/policies/openclaw-sandbox.yaml +++ b/nemoclaw-blueprint/policies/openclaw-sandbox.yaml @@ -159,13 +159,18 @@ network_policies: binaries: - { path: /usr/local/bin/openclaw } - # npm registry — needed for `openclaw plugins install` and `npm install` + # npm registry — needed for `openclaw plugins install` and `npm install`. + # Read-only: agents only fetch packages, never publish. npm_registry: name: npm_registry endpoints: - host: registry.npmjs.org port: 443 - access: full + protocol: rest + enforcement: enforce + tls: terminate + rules: + - allow: { method: GET, path: "/**" } binaries: - { path: /usr/local/bin/openclaw } - { path: /usr/local/bin/npm }