Skip to content

feat(plugin): add provider-first access tools #3749

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
cheese-head wants to merge 7 commits into from
Closed

feat(plugin): add provider-first access tools #3749

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
631b063
feat(policy): synthesize presets from openshell provider profiles
cheese-head May 13, 2026
e2f6ffc
feat(onboard): import nemoclaw provider profiles
cheese-head May 14, 2026
af71588
feat(plugin): request access through openshell policy local
cheese-head May 13, 2026
cdb8cfd
test(plugin): verify openshell policy local flow
cheese-head May 14, 2026
faa6e8f
feat(sandbox): install provider access tools
cheese-head May 18, 2026
5516fbb
feat(hermes): request access through openshell policy local
cheese-head May 14, 2026
8eeeb3e
feat(plugin): add provider-first access tools
cheese-head May 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@ RUN npm ci && npm run build
# hadolint ignore=DL3006
FROM ${BASE_IMAGE}

COPY scripts/install-provider-tools.sh /usr/local/lib/nemoclaw/install-provider-tools.sh

# Harden: remove unnecessary build tools and network probes from base image (#830)
# Protect runtime tools before autoremove — the GHCR base may predate the
# procps/e2fsprogs additions, leaving ps/chattr absent or auto-marked. The
Expand Down Expand Up @@ -57,6 +59,11 @@ RUN set -eu; \
ps --version; \
command -v chattr >/dev/null

# Provider tools are installed in the base image, but this derived-image replay
# keeps local and CI builds usable while GHCR sandbox-base catches up. OpenShell
# provider approval still controls network and credential use at runtime.
RUN chmod 755 /usr/local/lib/nemoclaw/install-provider-tools.sh \
&& /usr/local/lib/nemoclaw/install-provider-tools.sh

# Copy built plugin and blueprint into the sandbox
COPY --from=builder /opt/nemoclaw/dist/ /opt/nemoclaw/dist/
Expand Down Expand Up @@ -244,6 +251,8 @@ RUN chmod 755 /usr/local/bin/nemoclaw-start /usr/local/bin/nemoclaw-codex-acp \
/usr/local/lib/nemoclaw/generate-openclaw-config.py \
/usr/local/lib/nemoclaw/seed-wechat-accounts.py \
&& if [ -d /usr/local/lib/nemoclaw/preloads ]; then find /usr/local/lib/nemoclaw/preloads -type f -name '*.js' -exec chmod 644 {} +; fi \
&& mkdir -p /usr/local/share/nemoclaw/openclaw-plugins/nemoclaw \
&& cp -a /opt/nemoclaw/. /usr/local/share/nemoclaw/openclaw-plugins/nemoclaw/ \
&& chmod 755 /usr/local/share/nemoclaw \
/usr/local/share/nemoclaw/openclaw-plugins \
&& find /usr/local/share/nemoclaw/openclaw-plugins -type d -exec chmod 755 {} + \
Expand Down Expand Up @@ -621,7 +630,7 @@ RUN chown root:root /sandbox/.nemoclaw \
&& chmod -R 755 /sandbox/.nemoclaw/blueprints \
&& mkdir -p /sandbox/.nemoclaw/state /sandbox/.nemoclaw/migration /sandbox/.nemoclaw/snapshots /sandbox/.nemoclaw/staging \
&& chown sandbox:sandbox /sandbox/.nemoclaw/state /sandbox/.nemoclaw/migration /sandbox/.nemoclaw/snapshots /sandbox/.nemoclaw/staging \
&& touch /sandbox/.nemoclaw/config.json \
&& printf '{}\n' > /sandbox/.nemoclaw/config.json \
&& chown sandbox:sandbox /sandbox/.nemoclaw/config.json

# OpenShell 0.0.37's macOS VM backend currently remaps rootfs ownership to the
Expand Down
6 changes: 6 additions & 0 deletions Dockerfile.base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,11 +65,17 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
procps=2:4.0.4-9 \
e2fsprogs=1.47.2-3+b11 \
"dos2unix=7.5.2-1*" \
gh=2.46.0-3 \
glab=1.53.0-1+b3 \
jq=1.7.1-6+deb13u2 \
vim-tiny=2:9.1.1230-2 \
openssh-sftp-server=1:10.0p1-7+deb13u4 \
&& rm -rf /var/lib/apt/lists/*

COPY scripts/install-provider-tools.sh /usr/local/lib/nemoclaw/install-provider-tools.sh
RUN chmod 755 /usr/local/lib/nemoclaw/install-provider-tools.sh \
&& /usr/local/lib/nemoclaw/install-provider-tools.sh

# gosu for privilege separation (gateway vs sandbox user).
# Install from GitHub release with checksum verification instead of
# Debian's packaged gosu can lag upstream. Pinned to 1.19 (2025-09).
Expand Down
Loading
Loading