fix(policy): drop github from Hermes baseline

[laitingsheng]

Summary

The Hermes baseline policy agents/hermes/policy-additions.yaml hardcoded a github network_policies block, so every Hermes sandbox received unscoped access to github.com and api.github.com regardless of which presets the user selected at onboard. The Balanced tier — which lists no github preset — therefore still surfaced ● github (active on gateway, missing from local state) in policy-list, contradicting the documented Hermes baseline. The block is now removed and github ships only via the discoverable opt-in preset that already exists for OpenClaw.

Related Issue

Fixes #5251

Changes

• agents/hermes/policy-additions.yaml — drop the github network policy stanza (hosts + binaries) and replace it with the same NOTE breadcrumb the OpenClaw baseline carries, so the opt-in path becomes the single source of truth.
• test/validate-blueprint.test.ts — add a regression asserting the Hermes baseline never re-declares github and that no other baseline entry references github.com / api.github.com; helper-wrapped to satisfy the source-shape budget.
• test/policies.test.ts — drop the now-obsolete phantom-gh shape assertion (the binary list it pinned no longer exists once the baseline block is gone).
• ci/test-file-size-budget.json — ratchet test/policies.test.ts from 2763 → 2753 after the obsolete test was removed.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Tinson Lai tinsonl@nvidia.com

Summary by CodeRabbit

• Behavior Changes

  • GitHub access is no longer provided by default in the Hermes sandbox. Users can now opt-in to GitHub access through a dedicated preset.

• Chores

  • Updated internal validation and testing frameworks.

[coderabbitai]

📝 Walkthrough

Walkthrough

GitHub access is moved from the base Hermes sandbox policy to an opt-in preset. The base policy removes GitHub endpoints and binary permissions, a regression test verifies this absence, an old GitHub allowlist test is replaced with a deprecation scanner for tls: terminate, and the test budget is adjusted accordingly.

Changes

GitHub policy extraction to preset

Layer / File(s)	Summary
Base policy: remove GitHub access agents/hermes/policy-additions.yaml	GitHub network and binary policy block is removed and replaced with a comment redirecting users to the separate presets/github.yaml for opt-in GitHub access.
Regression test: GitHub access verification test/validate-blueprint.test.ts	New expectGithubBaselineAbsent helper and regression test enforce that the base Hermes policy does not include github.com or api.github.com endpoints, confirming access is only granted via the opt-in preset.
Test suite updates: deprecation check and budget test/policies.test.ts, ci/test-file-size-budget.json	Old GitHub allowlist test is removed; new test scans all policy YAML files for the deprecated tls: terminate directive; test file size budget is updated to reflect the changes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 A GitHub key once lived in the sand,
Now moved to a preset, as planned!
The base stays lean, clean, and pure,
Users choose access—they're in control for sure! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix(policy): drop github from Hermes baseline' accurately and concisely describes the primary change: removing hardcoded GitHub access from the Hermes baseline policy.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/hermes-baseline-drop-github-default

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

PR Review Advisor

Findings: 0 needs attention, 0 worth checking, 0 nice ideas
Top item: No actionable findings

Consider writing more tests for

• **Acceptance clause:** Presets: github is visible but unchecked. — add test evidence or identify existing coverage. The changed tests confirm the preset source exists and the Hermes baseline does not include GitHub by default. The PR does not modify or directly test the onboard UI/listing path, but that surface is outside this small YAML baseline change.
• **Acceptance clause:** git clone → 403 CONNECT tunnel failed. — add test evidence or identify existing coverage. The PR adds deterministic source-shape coverage proving the Hermes baseline no longer grants GitHub egress. It does not add a live sandbox `git clone` denial check, which is reasonable for this unit-sufficient policy-source change.

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

[github-actions]

E2E Advisor Recommendation

Required E2E: hermes-e2e-vitest
Optional E2E: network-policy-vitest

Dispatch hint: hermes-e2e-vitest

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• hermes-e2e-vitest (high; live sandbox install with NVIDIA_API_KEY, timeout 75 minutes): Runs a real Hermes install/onboard flow, verifies the Hermes sandbox is created and healthy, retrieves the full OpenShell policy, and proves inference.local still works. This is the closest existing E2E coverage for changes to agents/hermes/policy-additions.yaml.

Optional E2E

• network-policy-vitest (high; live sandbox/network-policy suite, timeout 90 minutes): Useful adjacent confidence for live network-policy enforcement, policy-add behavior, allow/deny probes, and preset hot-reload. It is OpenClaw-focused rather than Hermes-specific, so it is recommended but not merge-blocking for this Hermes base-policy change.

New E2E recommendations

• Hermes GitHub opt-in egress boundary (high): Existing Hermes E2E validates that a full policy is present but does not appear to assert that github.com/api.github.com are absent by default, nor that selecting the github preset restores only the intended git-based access. This PR changes exactly that security boundary.
  • Suggested test: Add a Hermes live E2E that onboards Hermes without the github preset, asserts openshell policy get --full lacks github.com/api.github.com and sandbox git ls-remote to GitHub is blocked, then applies/selects the github preset and verifies GitHub access is allowed only through the intended git binary policy.

Dispatch hint

• Workflow: .github/workflows/e2e-vitest-scenarios.yaml
• jobs input: hermes-e2e-vitest

[github-actions]

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: None
Optional Vitest E2E scenarios: network-policy-vitest

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required Vitest E2E scenarios

• None.

Optional Vitest E2E scenarios

• network-policy-vitest: Adjacent policy coverage: the network-policy live Vitest job exercises restricted sandbox allow/deny behavior and policy preset application, but the primary changed surface is Hermes-specific policy configuration.
  • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=network-policy-vitest

Relevant changed files

• agents/hermes/policy-additions.yaml