fix(policy): restrict npm and PyPI presets to GET-only REST rules

[Dongni-Yang]

Summary

• Replace access: full (raw CONNECT tunnel) with protocol: rest + read-only rules in presets/npm.yaml and presets/pypi.yaml
• Prevents package publishing (npm publish, pip upload) and data exfiltration through registry endpoints
• npm: GET-only (sufficient for npm install)
• PyPI: GET + HEAD (pip/uv use HEAD for lazy-wheel metadata checks)
• Updates test assertions to match new expected policy shape

Closes #1439

Affected files

• nemoclaw-blueprint/policies/presets/npm.yaml — registry.npmjs.org, registry.yarnpkg.com
• nemoclaw-blueprint/policies/presets/pypi.yaml — pypi.org, files.pythonhosted.org
• test/policies.test.js — updated assertions + new test for pypi HEAD

Issue checklist

Issue item	Status	Notes
presets/npm.yaml uses access: full	Fixed	Replaced with protocol: rest + GET-only
presets/pypi.yaml uses access: full	Fixed	Replaced with protocol: rest + GET + HEAD
openclaw-sandbox.yaml lines 131-137	N/A	GitHub policies — access: full is intentional for git push/clone
openclaw-sandbox.yaml lines 163-166	N/A	binaries: entries for clawhub — not related to npm/pypi
openclaw-sandbox.yaml npm entry (lines 194-209)	Already fixed	Uses protocol: rest + GET-only in main
Explicit deny rules (recommended fix)	Not needed	With protocol: rest + allow-list, everything not allowed is implicitly denied — matches huggingface.yaml pattern

Why PyPI needs HEAD

pip install and uv pip install use HEAD requests for lazy-wheel downloads and range-request support (checking Accept-Ranges: bytes before partial downloads). GET-only would degrade pip to full-file downloads. HEAD is read-only and poses no security risk.

Reproduction verification

# access: full is gone from both presets
$ grep 'access: full' presets/npm.yaml presets/pypi.yaml
(no matches)

# protocol: rest present on all 4 endpoints
$ grep -c 'protocol: rest' presets/npm.yaml → 2
$ grep -c 'protocol: rest' presets/pypi.yaml → 2

# Only safe read methods allowed
$ grep -cE 'method: (PUT|POST|DELETE)' presets/npm.yaml → 0
$ grep -cE 'method: (PUT|POST|DELETE)' presets/pypi.yaml → 0

Test plan

• npx vitest run test/policies.test.js — all 60 tests pass
• Verify npm install works inside sandbox with updated npm preset
• Verify pip install works inside sandbox with updated pypi preset
• Verify npm publish / pip upload is blocked inside sandbox

Signed-off-by: Dongni Yang dongniy@nvidia.com

🤖 Generated with Claude Code

[coderabbitai]

📝 Walkthrough

Walkthrough

Replaced permissive access: full for npm and PyPI presets with explicit REST policies enforcing TLS termination and allowing only safe HTTP methods (GET, and HEAD for PyPI). Tests updated to validate the new protocol- and method-specific rules.

Changes

Cohort / File(s)	Summary
Package Registry Presets nemoclaw-blueprint/policies/presets/npm.yaml, nemoclaw-blueprint/policies/presets/pypi.yaml	Replaced access: full with protocol: rest, enforcement: enforce, tls: terminate. Added allow rules restricting methods to GET (and HEAD for PyPI) for all paths (path: "/**"). binaries lists unchanged.
Policy Tests test/policies.test.js	Updated assertions: ensure access: full is absent; require protocol: rest; assert method: GET present for npm/pypi presets and method: HEAD present for pypi; added negative checks that PUT/POST/DELETE are not allowed.

Sequence Diagram(s)

sequenceDiagram
  participant Client as Client
  participant Proxy as OpenShell Proxy\n(Policy Engine)
  participant Registry as Registry\n(npm / PyPI)

  Client->>Proxy: HTTPS request (method: GET/HEAD/POST/PUT/DELETE)
  Proxy->>Proxy: TLS terminate\nInspect HTTP method & path
  alt method is GET or (HEAD for PyPI)
    Proxy->>Registry: Forward request over HTTPS
    Registry-->>Proxy: Response
    Proxy-->>Client: Forward response
  else disallowed method (POST/PUT/DELETE/etc.)
    Proxy-->>Client: Deny / Reset connection
  end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 I hopped through config, sharp and spry,
Swapped tunnels wide for careful sky.
GETs and HEADs now pass the gate,
No secret posts to complicate.
Carrots safe — the policy's right! 🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately describes the main change: replacing access:full with GET-only REST rules for npm and PyPI presets.
Linked Issues check	✅ Passed	The PR fully addresses issue #1439 by replacing access:full with protocol:rest and GET-only rules for all affected npm/PyPI endpoints and updating corresponding tests.
Out of Scope Changes check	✅ Passed	All changes are scoped to the stated objectives: npm.yaml, pypi.yaml presets, and policies.test.js assertions directly supporting issue #1439 resolution.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}