From 124ea4138589b88aa87a6086ad25ffcfa387cdf3 Mon Sep 17 00:00:00 2001 From: Maxime Grenu Date: Wed, 8 Apr 2026 08:55:17 +0200 Subject: [PATCH 1/2] fix: add local-inference policy preset for Ollama/vLLM host access (#693) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New local-inference.yaml preset allows host.openshell.internal on ports 11434 (Ollama) and 8000 (vLLM) with binaries restriction. Updates preset count and expected names in tests. Rebased on main per review — runner.js redaction dropped (superseded by #1246). Signed-off-by: Maxime Grenu --- .../policies/presets/local-inference.yaml | 28 +++++++++++++++++++ test/policies.test.ts | 5 ++-- 2 files changed, 31 insertions(+), 2 deletions(-) create mode 100644 nemoclaw-blueprint/policies/presets/local-inference.yaml diff --git a/nemoclaw-blueprint/policies/presets/local-inference.yaml b/nemoclaw-blueprint/policies/presets/local-inference.yaml new file mode 100644 index 00000000000..c692cdce252 --- /dev/null +++ b/nemoclaw-blueprint/policies/presets/local-inference.yaml @@ -0,0 +1,28 @@ +# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +preset: + name: local-inference + description: "Local inference access (Ollama, vLLM) via host gateway" + +network_policies: + local_inference: + name: local_inference + endpoints: + - host: host.openshell.internal + port: 11434 + protocol: rest + enforcement: enforce + rules: + - allow: { method: GET, path: "/**" } + - allow: { method: POST, path: "/**" } + - host: host.openshell.internal + port: 8000 + protocol: rest + enforcement: enforce + rules: + - allow: { method: GET, path: "/**" } + - allow: { method: POST, path: "/**" } + binaries: + - { path: /usr/local/bin/openclaw } + - { path: /usr/local/bin/claude } diff --git a/test/policies.test.ts b/test/policies.test.ts index 3dee4b2bb4b..6e4df68f036 100644 --- a/test/policies.test.ts +++ b/test/policies.test.ts @@ -96,9 +96,9 @@ selectFromList(items, options) describe("policies", () => { describe("listPresets", () => { - it("returns all 11 presets", () => { + it("returns all 12 presets", () => { const presets = policies.listPresets(); - expect(presets.length).toBe(11); + expect(presets.length).toBe(12); }); it("each preset has name and description", () => { @@ -120,6 +120,7 @@ describe("policies", () => { "github", "huggingface", "jira", + "local-inference", "npm", "outlook", "pypi", From 28dab7856c9db71b519762e2e5ef2c827fa8d129 Mon Sep 17 00:00:00 2001 From: Maxime Grenu Date: Tue, 14 Apr 2026 11:16:35 +0200 Subject: [PATCH 2/2] feat: auto-suggest local-inference preset for local providers When the user selects ollama-local, vllm-local, or nim-local as their inference provider, the local-inference policy preset is now automatically suggested during the policy selection step. This ensures the sandbox can reach the host gateway on ports 11434 and 8000 without requiring manual preset selection. Signed-off-by: Maxime Grenu --- src/lib/onboard.ts | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts index 5dbb26affc0..05e315ed897 100644 --- a/src/lib/onboard.ts +++ b/src/lib/onboard.ts @@ -3879,8 +3879,14 @@ async function setupMessagingChannels() { return selected; } -function getSuggestedPolicyPresets({ enabledChannels = null, webSearchConfig = null } = {}) { +function getSuggestedPolicyPresets({ enabledChannels = null, webSearchConfig = null, provider = null } = {}) { const suggestions = ["pypi", "npm"]; + + // Auto-suggest local-inference preset when a local provider is selected + const localProviders = ["ollama-local", "vllm-local", "nim-local"]; + if (provider && localProviders.includes(provider)) { + suggestions.push("local-inference"); + } const usesExplicitMessagingSelection = Array.isArray(enabledChannels); const maybeSuggestMessagingPreset = (channel, envKey) => { @@ -4506,6 +4512,7 @@ async function setupPoliciesWithSelection(sandboxName, options = {}) { const onSelection = typeof options.onSelection === "function" ? options.onSelection : null; const webSearchConfig = options.webSearchConfig || null; const enabledChannels = Array.isArray(options.enabledChannels) ? options.enabledChannels : null; + const provider = options.provider || null; step(8, 8, "Policy presets"); @@ -4535,6 +4542,11 @@ async function setupPoliciesWithSelection(sandboxName, options = {}) { const suggestions = tiers.resolveTierPresets(tierName).map((p) => p.name); // Allow credential-based overrides on top of the tier (additive only). if (webSearchConfig && !suggestions.includes("brave")) suggestions.push("brave"); + // Auto-suggest local-inference preset when a local provider is selected + const localProviders = ["ollama-local", "vllm-local", "nim-local"]; + if (provider && localProviders.includes(provider) && !suggestions.includes("local-inference")) { + suggestions.push("local-inference"); + } if (isNonInteractive()) { const policyMode = (process.env.NEMOCLAW_POLICY_MODE || "suggested").trim().toLowerCase(); @@ -5317,6 +5329,7 @@ async function onboard(opts = {}) { : null, enabledChannels: selectedMessagingChannels, webSearchConfig, + provider, onSelection: (policyPresets) => { onboardSession.updateSession((current) => { current.policyPresets = policyPresets;