policy-additions.yaml

# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Sandbox policy for the Hermes Agent.
# Based on the OpenClaw policy with agent-specific adjustments:
#   - .hermes instead of .openclaw (single config/state directory)
#   - Nous Research phone-home endpoints instead of OpenClaw/ClawHub
#   - PyPI instead of npm registry
#   - /usr/local/bin/hermes and python3 binary restrictions
#
# Principle: deny by default, allow only what's needed for core functionality.

version: 1

filesystem_policy:
  include_workdir: true
  read_only:
    - /usr
    - /lib
    - /opt/hermes
    - /proc
    - /dev/urandom
    - /app
    - /etc
    - /run/nemoclaw/managed-startup-ca-bundle.pem
    - /var/log
    - /var/lib/dpkg                  # Allow package-version inspection without package mutation.
  read_write:
    - /sandbox
    - /tmp
    - /dev/null
    - /dev/pts                      # PTY multiplexer + slave devices (devpts).
                                    # The Hermes TUI (prompt_toolkit), the web
                                    # dashboard's interactive chat pty bridge,
                                    # and terminal.backend: local all allocate a
                                    # PTY via openpty()/forkpty(), opening
                                    # /dev/ptmx (-> /dev/pts/ptmx) and a
                                    # /dev/pts/<n> slave. Without this grant
                                    # landlock denies the open with EACCES, which
                                    # the dashboard surfaces as "Chat failed to
                                    # start: out of pty devices" and which breaks
                                    # any interactive shell tool. Grant the
                                    # directory, not /dev/ptmx itself — it is a
                                    # symlink the supervisor refuses to chown.
                                    # Mirrors the OpenClaw policy grant (#4513).
    # Agent config/state root. Shields-up locks config.yaml/.env and the
    # parent directory, but intentionally leaves /sandbox/.hermes/.hermes_history
    # as sandbox:sandbox 0660 because prompt_toolkit FileHistory appends there
    # on every Hermes TUI keypress. Remove that exception if upstream supports
    # redirecting or disabling file history.
    - /sandbox/.hermes

landlock:
  compatibility: best_effort

process:
  run_as_user: sandbox
  run_as_group: sandbox

network_policies:
  managed_inference:
    name: managed_inference
    endpoints:
      - host: inference.local
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: POST, path: "/v1/chat/completions" }
          - allow: { method: POST, path: "/v1/messages" }
          - allow: { method: POST, path: "/v1/responses" }
          - allow: { method: POST, path: "/v1/completions" }
          - allow: { method: POST, path: "/v1/embeddings" }
          - allow: { method: GET, path: "/v1/models" }
          - allow: { method: GET, path: "/v1/models/**" }
    binaries:
      - { path: /usr/local/bin/hermes }
      - { path: /usr/bin/python3.11 }
      - { path: /opt/hermes/.venv/bin/python }

  nvidia:
    name: nvidia
    endpoints:
      - host: integrate.api.nvidia.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: POST, path: "/v1/chat/completions" }
          - allow: { method: POST, path: "/v1/completions" }
          - allow: { method: POST, path: "/v1/embeddings" }
          - allow: { method: GET, path: "/v1/models" }
          - allow: { method: GET, path: "/v1/models/**" }
    binaries:
      - { path: /usr/local/bin/hermes }
      - { path: /usr/bin/python3* }
      - { path: /opt/hermes/.venv/bin/python }

  # NOTE: github.com / api.github.com and the git binary used to
  # live in this base policy and were therefore granted to every
  # Hermes sandbox regardless of user opt-in. They have been moved
  # into a discoverable preset (`presets/github.yaml`) so a sandbox
  # only gets GitHub access when the user explicitly selects the
  # `github` preset during onboard.

  # ── Nous Research — public metadata and agent updates ─────────
  # Nous Portal OAuth, managed inference, and managed tool gateway auth are
  # host-managed by NemoClaw/OpenShell. The sandbox should not reach the Portal
  # or Nous vendor gateway hosts directly.
  nous_research:
    name: nous_research
    endpoints:
      - host: nousresearch.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: POST, path: "/**" }
      - host: hermes-agent.nousresearch.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: POST, path: "/**" }
    binaries:
      - { path: /usr/local/bin/hermes }
      - { path: /usr/bin/python3* }
      - { path: /opt/hermes/.venv/bin/python }

  # ── PyPI — needed for pip install (skill/plugin deps) ─────────
  pypi:
    name: pypi
    endpoints:
      - host: pypi.org
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/**" }
      - host: files.pythonhosted.org
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/**" }
    binaries:
      - { path: /usr/bin/curl }
      - { path: /usr/local/bin/pip3 }
      - { path: /usr/local/bin/curl }
      - { path: /usr/bin/python3* }
      - { path: /opt/hermes/.venv/bin/python }