fix(security): bundle Telegram allowlist and update hardening - #1500
Closed
13ernkastel wants to merge 5 commits into
Closed
fix(security): bundle Telegram allowlist and update hardening#150013ernkastel wants to merge 5 commits into
13ernkastel wants to merge 5 commits into
Conversation
This was referenced Apr 5, 2026
Contributor
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughThis PR introduces sandbox name validation with reserved-name collision detection, extends the CLI with a Changes
Sequence DiagramssequenceDiagram
participant User
participant CLI as nemoclaw CLI
participant Dispatch
participant Sandbox as Sandbox Actions
participant TgBridge as Telegram Bridge
User->>CLI: nemoclaw start --discover-chat-id
CLI->>Dispatch: Parse --discover-chat-id flag
Dispatch->>Dispatch: Set NEMOCLAW_TELEGRAM_DISCOVERY=1
Dispatch->>Sandbox: start-services.sh with discovery flag
Sandbox->>TgBridge: Launch telegram-bridge.js (DISCOVERY_ONLY=true)
TgBridge->>TgBridge: Receive Telegram message
TgBridge->>User: Reply with chat ID (discovery mode)
TgBridge->>TgBridge: Skip OpenClaw forwarding
sequenceDiagram
participant User
participant CLI as nemoclaw CLI
participant Dispatch
participant Registry as Sandbox Registry
participant GlobalCmds as Reserved Names
User->>CLI: nemoclaw telegram start
CLI->>Dispatch: Dispatch sandbox action
Dispatch->>GlobalCmds: Check if "telegram" is global/reserved
GlobalCmds-->>Dispatch: "telegram" is reserved
Dispatch->>User: Error: collision detected
User->>CLI: nemoclaw -- telegram start
CLI->>Dispatch: Parse -- escape sequence
Dispatch->>Registry: Lookup sandbox "telegram"
Dispatch->>Dispatch: Invoke "start" action on sandbox "telegram"
Estimated code review effort🎯 4 (Complex) | ⏱️ ~65 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Author
Contributor
Author
cv
added a commit
that referenced
this pull request
Apr 17, 2026
…names (#1416) ## Summary Bundles the remaining sandbox command-hardening work with the Telegram fail-closed cleanup and the unsupported self-update-hint fix. This now includes the original `#1416` scope plus the changes that had temporarily been split into `#1500`. `#1499` remains separate on purpose. ## Linked Issues - Fixes #1029 ## Related PRs / Issues - follow-up to `#1392` - folds in `#1218` - folds in `#1215` - replaces `#1500` - keeps `#1499` separate - addresses `#896` ## Changes - re-validates sandbox names at the `createSandbox()` boundary and removes the remaining shell-string dependency from follow-on sandbox command paths - adds `runFile()` and uses argv-style execution for `setup-dns-proxy.sh` - replaces the dashboard readiness probe with the structured OpenShell helper path - requires an explicit Telegram chat allowlist before the bridge forwards prompts - adds `nemoclaw telegram` subcommands and `nemoclaw start --discover-chat-id` - preserves the reserved-sandbox-name guard added during the Telegram review follow-up - disables unsupported OpenClaw self-update hints in the generated sandbox config - propagates saved Telegram allowlists into the remote deploy env so deployed bridges stay fail-closed too - updates focused CLI/deploy tests to match the current services-based startup path on `main` ## Why These changes all tighten the default security posture around operator-managed sandboxes: - sandbox creation and follow-on helper execution rely less on shell-string construction - Telegram bridge access now fails closed unless the operator explicitly allowlists chat IDs - sandbox images stop advertising an unsupported in-container self-update path Keeping them together in `#1416` makes the remaining security review surface smaller while still leaving the separate immutable-hardening follow-up in `#1499` alone. ## Validation - `npm run build:cli` - `npx vitest run src/lib/deploy.test.ts src/lib/onboard-session.test.ts test/onboard.test.js test/cli.test.js test/runner.test.js test/service-env.test.js test/registry.test.js test/shellquote-sandbox.test.js` ## Risks / Notes - `npm run typecheck:cli` still hits the repo's existing `src/lib/*.test.ts -> ../../dist/lib/*` type-resolution issue in this environment, so validation here relies on the targeted build plus Vitest coverage above - `#1499` remains separate on purpose Signed-off-by: Chia Min Jun Lennon <LennonCMJ@live.com> --------- Signed-off-by: latenighthackathon <latenighthackathon@users.noreply.github.com> Signed-off-by: 13ernkastel <LennonCMJ@live.com> Co-authored-by: latenighthackathon <latenighthackathon@users.noreply.github.com> Co-authored-by: Test User <test@example.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
#1218with the sandbox self-update-hint fix from#1215#1416and#1499separate on purposemainRelated PRs / Issues
#1218#1215#1416separate#1499separate#896#1029Why
These two changes both tighten the default runtime posture for operator-managed deployments:
#1218makes Telegram bridge access fail closed unless a chat allowlist is configured, with a safe discovery mode for retrieving chat IDs#1215removes misleading in-sandbox self-update hints so the supported upgrade path stays image-based instead of mutable in-container updatesGrouping them into one cleanup PR reduces review fragmentation for the remaining security work without collapsing unrelated security follow-ups like
#1416or#1499.Changes
nemoclaw telegramsubcommands andnemoclaw start --discover-chat-idmainFollow-up Improvement
src/lib/deploy.tsso a locally saved allowlist is not lost when operators use the remotedeployflowValidation
npm run build:clinpx vitest run src/lib/deploy.test.ts test/onboard.test.js test/cli.test.js test/runner.test.js test/service-env.test.jsRisks / Notes
npm run typecheck:clistill hits the repo’s existingsrc/lib/*.test.ts -> ../../dist/lib/*type-resolution issue in this environment, so validation here relies on the targeted build plus Vitest coverage above#1416and#1499are intentionally left out of this bundleSummary by CodeRabbit
New Features
nemoclaw start --discover-chat-idto retrieve chat IDs without forwarding messages to the agent.nemoclaw telegrammanagement commands (allow,show,clear,discover) for Telegram allowlist configuration.nemoclaw -- <name> <action>to invoke sandboxes with names matching global commands.Improvements
Documentation