policy-permissive.yaml

# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0
#
# Permissive policy for Hermes Agent — applied by `shields down`.
# All known Hermes-relevant endpoints opened with access: full (no L7 filtering).
# Filesystem: include_workdir: true makes the sandbox home directory writable.
#
# WARNING: This policy disables most sandbox security restrictions.
# Do not use in production.

version: 1

filesystem_policy:
  # Filesystem section mirrors the default Hermes policy
  # (policy-additions.yaml). OpenShell rejects include_workdir changes and
  # read_only path removals on live sandboxes.
  include_workdir: true
  read_only:
    - /usr
    - /lib
    - /opt/hermes
    - /proc
    - /dev/urandom
    - /app
    - /etc
    - /run/nemoclaw/managed-startup-ca-bundle.pem
    - /var/log
    - /var/lib/dpkg                  # Allow package-version inspection without package mutation.
  read_write:
    - /sandbox
    - /tmp
    - /dev/null
    - /dev/pts                      # devpts PTY access (TUI / dashboard chat /
                                    # terminal.backend: local). Without it
                                    # landlock denies /dev/ptmx with EACCES
                                    # ("out of pty devices"). Mirrors the default
                                    # Hermes policy and the OpenClaw grant (#4513).
    - /sandbox/.hermes
    - /sandbox/.nemoclaw

landlock:
  compatibility: best_effort

process:
  run_as_user: sandbox
  run_as_group: sandbox

network_policies:

  nvidia:
    name: nvidia
    endpoints:
      - host: integrate.api.nvidia.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  github:
    name: github
    endpoints:
      - host: github.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: api.github.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  nous_research:
    name: nous_research
    endpoints:
      - host: nousresearch.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: hermes-agent.nousresearch.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: inference-api.nousresearch.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: portal.nousresearch.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: browser-use-gateway.nousresearch.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: modal-gateway.nousresearch.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: openai-audio-gateway.nousresearch.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: fal-queue-gateway.nousresearch.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: firecrawl-gateway.nousresearch.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: tool-gateway.nousresearch.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  pypi:
    name: pypi
    endpoints:
      - host: pypi.org
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: files.pythonhosted.org
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  # ── Messaging endpoints ──

  telegram:
    name: telegram
    endpoints:
      - host: api.telegram.org
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  discord:
    name: discord
    endpoints:
      - host: discord.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: gateway.discord.gg
        port: 443
        protocol: websocket
        enforcement: enforce
        websocket_credential_rewrite: true
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
      - host: "*.discord.gg"
        port: 443
        protocol: websocket
        enforcement: enforce
        websocket_credential_rewrite: true
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
      - host: cdn.discordapp.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: media.discordapp.net
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  slack:
    name: slack
    endpoints:
      - host: slack.com
        port: 443
        protocol: rest
        enforcement: enforce
        request_body_credential_rewrite: true
        access: full
      - host: api.slack.com
        port: 443
        protocol: rest
        enforcement: enforce
        request_body_credential_rewrite: true
        access: full
      - host: hooks.slack.com
        port: 443
        protocol: rest
        enforcement: enforce
        request_body_credential_rewrite: true
        access: full
      - host: wss-primary.slack.com
        port: 443
        protocol: websocket
        enforcement: enforce
        websocket_credential_rewrite: true
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
      - host: wss-backup.slack.com
        port: 443
        protocol: websocket
        enforcement: enforce
        websocket_credential_rewrite: true
        rules:
          - allow: { method: GET, path: "/**" }
          - allow: { method: WEBSOCKET_TEXT, path: "/**" }
    binaries:
      - { path: "/**" }

  # ── Third-party services ──

  brew:
    name: brew
    endpoints:
      - host: formulae.brew.sh
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: ghcr.io
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: raw.githubusercontent.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: objects.githubusercontent.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: pkg-containers.githubusercontent.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  jira:
    name: jira
    endpoints:
      - host: "*.atlassian.net"
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: api.atlassian.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: auth.atlassian.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  outlook:
    name: outlook
    endpoints:
      - host: outlook.office365.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: outlook.office.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: graph.microsoft.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: login.microsoftonline.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  huggingface:
    name: huggingface
    endpoints:
      - host: huggingface.co
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: cdn-lfs.huggingface.co
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
      - host: router.huggingface.co
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  brave:
    name: brave
    endpoints:
      - host: api.search.brave.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: full
    binaries:
      - { path: "/**" }

  # Shields-down policies intentionally keep full host and binary scope. The
  # maintained Tavily preset and provider profiles constrain normal access.
  tavily:
    name: tavily
    endpoints:
      - host: api.tavily.com
        port: 443
        protocol: rest
        enforcement: enforce
        request_body_credential_rewrite: true
        access: full
    binaries:
      - { path: "/**" }