# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Default policy for the OpenClaw sandbox.
# Principle: deny by default, allow only what's needed for core functionality.
# Dynamic updates (network_policies, inference) can be applied post-creation
# via `openshell policy set`. Static fields are effectively creation-locked.
#
# Policy tiers (future):
#   default — this file. Minimum for onboard + basic agent operation.
#   relaxed — adds third-party model providers, broader web access.
#
# To add endpoints: update this file and re-run `nemoclaw onboard`
# or apply dynamically via `openshell policy set`.

version: 1

filesystem_policy:
  include_workdir: true
  read_only:
    - /usr
    - /lib
    - /proc
    - /dev/urandom
    - /app
    - /etc
    - /var/log
    - /sandbox/.openclaw            # Immutable gateway config — prevents agent
                                    # from tampering with auth tokens or CORS.
                                    # Writable state (agents, plugins) lives in
                                    # /sandbox/.openclaw-data via symlinks.
                                    # Ref: https://github.com/NVIDIA/NemoClaw/issues/514
  read_write:
    - /sandbox
    - /tmp
    - /dev/null
    - /sandbox/.openclaw-data       # Writable agent/plugin state (symlinked from .openclaw)

landlock:
  compatibility: best_effort

process:
  run_as_user: sandbox
  run_as_group: sandbox

network_policies:
  claude_code:
    name: claude_code
    endpoints:
      - host: api.anthropic.com
        port: 443
        protocol: rest
        enforcement: enforce
        tls: terminate
        rules:
          - allow: { method: "*", path: "/**" }
      - host: statsig.anthropic.com
        port: 443
        rules:
          - allow: { method: "*", path: "/**" }
      - host: sentry.io
        port: 443
        rules:
          - allow: { method: "*", path: "/**" }
    binaries:
      - { path: /usr/local/bin/claude }

  nvidia:
    name: nvidia
    endpoints:
      - host: integrate.api.nvidia.com
        port: 443
        protocol: rest
        enforcement: enforce
        tls: terminate
        rules:
          - allow: { method: "*", path: "/**" }
      - host: inference-api.nvidia.com
        port: 443
        protocol: rest
        enforcement: enforce
        tls: terminate
        rules:
          - allow: { method: "*", path: "/**" }
    binaries:
      - { path: /usr/local/bin/claude }
      - { path: /usr/local/bin/openclaw }

  github:
    name: github
    endpoints:
      - host: github.com
        port: 443
        access: full
      - host: api.github.com
        port: 443
        access: full
    binaries:
      - { path: /usr/bin/gh }
      - { path: /usr/bin/git }

  # ── OpenClaw "phone home" ────────────────────────────────────────────
  # Minimum viable set for OpenClaw to authenticate, discover plugins,
  # and reach ClawHub. Binary-restricted to openclaw only.
  # Docs access is read-only (GET). ClawHub and openclaw.ai are
  # restricted to GET+POST (auth flows, plugin discovery).

  clawhub:
    name: clawhub
    endpoints:
      - host: clawhub.com
        port: 443
        protocol: rest
        enforcement: enforce
        tls: terminate
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: POST, path: "/**" }
    binaries:
      - { path: /usr/local/bin/openclaw }

  openclaw_api:
    name: openclaw_api
    endpoints:
      - host: openclaw.ai
        port: 443
        protocol: rest
        enforcement: enforce
        tls: terminate
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: POST, path: "/**" }
    binaries:
      - { path: /usr/local/bin/openclaw }

  openclaw_docs:
    name: openclaw_docs
    endpoints:
      - host: docs.openclaw.ai
        port: 443
        protocol: rest
        enforcement: enforce
        tls: terminate
        rules:
          - allow: { method: GET, path: "/**" }
    binaries:
      - { path: /usr/local/bin/openclaw }

  # npm registry — needed for `openclaw plugins install` and `npm install`
  npm_registry:
    name: npm_registry
    endpoints:
      - host: registry.npmjs.org
        port: 443
        access: full
    binaries:
      - { path: /usr/local/bin/openclaw }
      - { path: /usr/local/bin/npm }

  # ── Messaging — pre-allowed for agent notifications ────────────
  # Telegram and Discord are open by default so the agent can send
  # notifications and respond to chats without triggering approval.
  telegram:
    name: telegram
    endpoints:
      - host: api.telegram.org
        port: 443
        protocol: rest
        enforcement: enforce
        tls: terminate
        rules:
          - allow: { method: GET, path: "/bot*/**" }
          - allow: { method: POST, path: "/bot*/**" }

  discord:
    name: discord
    endpoints:
      - host: discord.com
        port: 443
        protocol: rest
        enforcement: enforce
        tls: terminate
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: POST, path: "/**" }
      - host: gateway.discord.gg
        port: 443
        protocol: rest
        enforcement: enforce
        tls: terminate
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: POST, path: "/**" }
      - host: cdn.discordapp.com
        port: 443
        protocol: rest
        enforcement: enforce
        tls: terminate
        rules:
          - allow: { method: GET, path: "/**" }
