From 7f60e4f1bf16686990452fa5691e1a725b11c413 Mon Sep 17 00:00:00 2001 From: Jason Ma Date: Sun, 26 Jul 2026 16:50:59 +0800 Subject: [PATCH 1/2] fix(policy): allow the resolved claude-code npm launcher in the preset (#7579) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The claude-code preset allowlisted the npm shim /tmp/npm-global/bin/claude, but OpenShell enforces on the kernel-trusted /proc//exe. For a global npm install (the bundled Claude Code skill uses `npm install -g --prefix /tmp/npm-global`), that resolves to /tmp/npm-global/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe — a path the preset did not list — so every request to api.anthropic.com was denied, including the initial OAuth login. The shipped preset thus contradicted the shipped skill. Add the resolved launcher path to the preset's binaries. Extend the effective- policy contract test to compose the real claude-code preset through the policy loader and assert the resolved path appears in the effective binaries. Co-Authored-By: Claude Opus 4.8 (1M context) --- nemoclaw-blueprint/policies/presets/claude-code.yaml | 6 ++++++ test/effective-policy-contracts.test.ts | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/nemoclaw-blueprint/policies/presets/claude-code.yaml b/nemoclaw-blueprint/policies/presets/claude-code.yaml index 9f6a95ac5ab..b1a7bae3b25 100644 --- a/nemoclaw-blueprint/policies/presets/claude-code.yaml +++ b/nemoclaw-blueprint/policies/presets/claude-code.yaml @@ -35,6 +35,12 @@ network_policies: - { path: /usr/bin/claude } - { path: /tmp/npm-global/bin/claude } - { path: /home/linuxbrew/.linuxbrew/bin/claude } + # OpenShell enforces on the kernel-trusted /proc//exe, which for a + # global npm install resolves to the package's own launcher rather than + # the `bin/claude` shim above. The bundled Claude Code skill installs with + # `npm install -g --prefix /tmp/npm-global`, so allow that resolved path + # too or egress to api.anthropic.com is denied despite the shim (#7579). + - { path: /tmp/npm-global/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe } # Claude Code is distributed as an npm CLI, so OpenShell may observe # the Node runtime instead of the shim that launched it. - { path: /usr/local/bin/node } diff --git a/test/effective-policy-contracts.test.ts b/test/effective-policy-contracts.test.ts index c6381618309..cbcd58f9243 100644 --- a/test/effective-policy-contracts.test.ts +++ b/test/effective-policy-contracts.test.ts @@ -511,5 +511,11 @@ describe("effective built-in policy contracts", () => { expect(methods(endpoint)).toEqual(["GET", "POST"]); } expect(binaries(claude)).not.toContain("/**"); + // OpenShell enforces on the resolved /proc//exe, so the npm-installed + // launcher (not just the bin/claude shim) must be allowlisted or egress is + // denied for the documented `--prefix /tmp/npm-global` install (#7579). + expect(binaries(claude)).toContain( + "/tmp/npm-global/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe", + ); }); }); From a405c1d95e237a45bcd635cd665ef38be0622ad4 Mon Sep 17 00:00:00 2001 From: Prekshi Vyas Date: Sun, 26 Jul 2026 22:34:27 -0700 Subject: [PATCH 2/2] chore(ci): retry trusted E2E evidence Signed-off-by: Prekshi Vyas