docs(policy): clarify brew preset requires pre-installed Homebrew (#3757)

docs/network-policy/customize-network-policy.mdx

@@ -172,7 +172,7 @@ Available presets:
 | Preset | Endpoints |
 |--------|-----------|
 | `brave` | Brave Search API |
-| `brew` | Homebrew (Linuxbrew) package manager |
+| `brew` | Homebrew (Linuxbrew) package manager. Requires Homebrew to be installed inside the sandbox; see [Homebrew bootstrap](/network-policy/integration-policy-examples#homebrew-bootstrap). |
 | `discord` | Discord API, gateway, and CDN access |
 | `github` | GitHub and GitHub REST API |
 | `huggingface` | Hugging Face Hub (download-only) and inference router |

docs/network-policy/integration-policy-examples.mdx

@@ -227,6 +227,22 @@ $ nemoclaw my-assistant policy-remove brew --yes
 $ nemoclaw my-assistant policy-remove huggingface --yes
 ```
 
+<a id="homebrew-bootstrap"></a>
+### Homebrew Bootstrap
+
+The `brew` preset whitelists network egress to the Homebrew registry and the binary paths under `/home/linuxbrew/.linuxbrew/`, but the sandbox base image does not ship the `brew` CLI itself. Apply the preset first, then install Homebrew inside the sandbox once before any `brew install <package>` workflow:
+
+```console
+$ nemoclaw my-assistant policy-add brew --yes
+$ nemoclaw my-assistant connect
+sandbox@...:~$ /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+sandbox@...:~$ eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+sandbox@...:~$ brew install hello
+```
+
+After the first install, `brew` is on the sandbox `PATH` and subsequent `brew install <package>` calls work directly.
+The bootstrap is per-sandbox; recreating the sandbox requires re-running the install.
+
 ## Local Inference
 
 Use `local-inference` when the sandbox needs access to host-side local inference services such as Ollama or vLLM through the OpenShell host gateway.

nemoclaw-blueprint/policies/presets/brew.yaml

@@ -1,9 +1,14 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
+# Homebrew is not preinstalled in the sandbox image. The /home/linuxbrew/...
+# binary paths below are whitelisted so brew can run AFTER the user installs
+# it inside the sandbox. The bootstrap binaries (curl, git) cover the install
+# script itself. See NemoClaw issues #1767 and #3757.
+
 preset:
   name: brew
-  description: "Homebrew (Linuxbrew) package manager access"
+  description: "Homebrew (Linuxbrew) package manager access (requires Homebrew to be installed inside the sandbox first)"
 
 network_policies:
   brew:
@@ -34,8 +39,13 @@ network_policies:
         access: full
         tls: skip
     binaries:
+      # Bootstrap binaries: present in the sandbox image, used to fetch and
+      # run the Homebrew install script.
       - { path: /usr/bin/curl }
       - { path: /usr/bin/git }
+      # Linuxbrew paths: present only after the user installs Homebrew inside
+      # the sandbox. Whitelisting them up front avoids a second policy
+      # round-trip after install.
       - { path: /home/linuxbrew/.linuxbrew/bin/brew }
       - { path: /home/linuxbrew/.linuxbrew/bin/* }
       - { path: /home/linuxbrew/.linuxbrew/Homebrew/bin/* }