Description

The permissive sandbox policies currently include a claude_code network policy block that grants direct access to Claude Code-related hosts:

• api.anthropic.com
• statsig.anthropic.com
• sentry.io

The rule uses access: full and binaries: [{ path: "/**" }], so any binary inside a sandbox using the permissive policy can reach those endpoints.

The broad access: full behavior is expected for shields down / permissive mode and is documented as unsafe for production. However, Claude Code is a separate optional tool, and these endpoints are included even when the user did not opt into Claude Code usage.

This appears in more than the global policy. src/lib/policy/index.ts resolves agent-specific permissive policies first, so the duplicated blocks in agents/openclaw/policy-permissive.yaml and agents/hermes/policy-permissive.yaml are also affected.

Expected behavior:

Claude Code-specific hosts should not be included in permissive policies by default. They should live in an explicit claude-code preset that users apply only when they intentionally install/run Claude Code inside the sandbox.

Reproduction Steps

1. Inspect nemoclaw-blueprint/policies/openclaw-sandbox-permissive.yaml.
2. Locate network_policies.claude_code.
3. Observe that it allows:
   • api.anthropic.com
   • statsig.anthropic.com
   • sentry.io
4. Observe that the policy uses:
   • access: full
   • binaries: [{ path: "/**" }]
5. Repeat the same inspection for:
   • agents/openclaw/policy-permissive.yaml
   • agents/hermes/policy-permissive.yaml
6. Confirm that src/lib/policy/index.ts resolves agent-specific permissive policies before falling back to the global permissive policy.

Environment

• OS: Not runtime-specific
• Node.js: Not runtime-specific
• Docker: Not runtime-specific
• NemoClaw: current main branch / source checkout

Debug Output

Not applicable. This is a static policy configuration issue.

Logs

Relevant paths:

- `nemoclaw-blueprint/policies/openclaw-sandbox-permissive.yaml`
- `agents/openclaw/policy-permissive.yaml`
- `agents/hermes/policy-permissive.yaml`
- `src/lib/policy/index.ts`

Checklist

• I confirmed this bug is reproducible
• I searched existing issues and this is not a duplicate