fix(policy): convert npm_registry from access: full to REST GET-only by latenighthackathon · Pull Request #1358 · NVIDIA/NemoClaw

latenighthackathon · 2026-04-02T17:27:56Z

Summary

Replace L4 pass-through (access: full) on npm_registry endpoint with L7-enforced REST policy restricted to GET /**
Agents only fetch packages from the npm registry and never publish, so write methods are not needed
Enables per-request rule evaluation, per-request logging, and SecretResolver credential injection

Motivation

Issue GitHub network policy should use protocol: rest to enable scoped method/path controls #1111 called out converting npm_registry alongside the GitHub endpoints
Discussed and agreed upon during review of PR fix(policy): add protocol/enforcement/tls to GitHub endpoints #1225 but deferred to keep that PR scoped
CodeRabbit filed fix(policy): convert npm_registry endpoint from access: full to protocol: rest (GET-only) #1355 to track this follow-up

Test plan

Verify openclaw plugins install succeeds with GET-only policy
Verify npm install inside sandbox completes normally
Confirm write attempts (e.g. npm publish) are blocked by the policy

Closes #1355

Signed-off-by: latenighthackathon latenighthackathon@users.noreply.github.com

Summary by CodeRabbit

Security
- Registry access is now read-only (HTTP GET only) and TLS termination is enforced for registry connections, tightening network access and transport security for package registry interactions.

coderabbitai · 2026-04-02T17:28:09Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6f728247-9de3-498c-9045-4c3726762b97

📥 Commits

Reviewing files that changed from the base of the PR and between 0115c01 and adef897.

📒 Files selected for processing (1)

nemoclaw-blueprint/policies/openclaw-sandbox.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

nemoclaw-blueprint/policies/openclaw-sandbox.yaml

📝 Walkthrough

Walkthrough

The npm_registry endpoint in nemoclaw-blueprint/policies/openclaw-sandbox.yaml was changed from L4 access: full to REST enforcement: protocol: rest, enforcement: enforce, tls: terminate, with a rule allowing only HTTP GET to "/**" for registry.npmjs.org:443.

Changes

Cohort / File(s)	Summary
npm Registry Endpoint Security Policy `nemoclaw-blueprint/policies/openclaw-sandbox.yaml`	Replaced `access: full` with `protocol: rest`, `enforcement: enforce`, and `tls: terminate` for the `registry.npmjs.org:443` endpoint. Added a rule permitting only `GET` requests to `"/**"`, converting npm access to read-only REST with per-request enforcement.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant Proxy as "Sandbox Proxy\n(protocol: rest\nenforcement: enforce\ntls: terminate)"
    participant NPM as "registry.npmjs.org:443"

    Client->>Proxy: TLS handshake (terminated at Proxy)
    Client->>Proxy: HTTP GET /package (only allowed method)
    Proxy->>NPM: Forward GET over TLS
    NPM-->>Proxy: 200 OK (package data)
    Proxy-->>Client: 200 OK (response)

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I hop to the registry, careful and spry,
GET-only paths beneath the sky,
TLS wrapped snug, rules set just right,
I fetch the packages, quiet as night.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: converting npm_registry policy from unrestricted access to GET-only REST enforcement.
Linked Issues check	✅ Passed	Code changes fully implement issue `#1355` requirements: protocol changed to REST, enforcement enabled, TLS termination configured, and GET-only rules applied.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to the npm_registry endpoint policy update; no extraneous modifications are present in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

prekshivyas

Thanks @latenighthackathon — this is a good security tightening.

The change itself looks correct:

protocol: rest / enforcement: enforce / tls: terminate matches the established pattern from the GitHub endpoints in #1225 ✓
GET /** is appropriate — agents only fetch packages, never publish ✓
Blocks write operations (npm publish, PUT, DELETE) from the sandbox ✓
Enables per-request logging and SecretResolver credential injection ✓

One concern before merging: the manual test plan items are all unchecked:

Verify openclaw plugins install succeeds with GET-only policy
Verify npm install inside sandbox completes normally
Confirm write attempts (e.g. npm publish) are blocked by the policy

The tls: terminate means the proxy terminates TLS and re-establishes it to registry.npmjs.org:443. If npm does any form of certificate pinning or integrity checking on the TLS session, this could break installs silently. Could you confirm the manual tests pass and check the boxes before we merge?

latenighthackathon · 2026-04-02T20:31:39Z

@prekshivyas Thanks for the review and the valid concern about tls: terminate.

Test results:

Unit tests: All 46 policy and security-method-wildcard tests pass (vitest, Node 22.16).

E2E validation on live NemoClaw sandbox (WSL2 + Docker Desktop):

Deployed sandbox test-npm-policy via nemoclaw onboard --non-interactive
Applied updated policy (npm_registry: protocol: rest, tls: terminate, GET-only) via openshell policy set
npm install lodash — PASS (added 1 package in 959ms)
npm install axios — PASS (added 23 packages in 3s)
openclaw plugins list — PASS (38 plugins enumerated)
curl -X PUT https://registry.npmjs.org/... — BLOCKED (proxy returned 403 Forbidden as expected)

All three test plan items verified:

openclaw plugins install succeeds with GET-only policy
npm install inside sandbox completes normally
Write attempts (PUT) are blocked by the policy

On the TLS concern: tls: terminate is already the established pattern for every other REST-enforced endpoint in this file (GitHub, Anthropic, statsig, sentry). npm registry client does not do certificate pinning — it uses the system trust store and respects NODE_EXTRA_CA_CERTS. Confirmed working end-to-end.

ericksoa

Thanks for this contribution — clean change and consistent with the existing REST endpoint pattern. Could you please rebase onto current main? Once that's done we'll likely accept this.

latenighthackathon · 2026-04-06T00:48:44Z

Rebased onto current main. Thanks for the feedback @ericksoa!

Replace L4 pass-through (access: full) with L7-enforced REST policy restricted to GET. Agents only fetch packages from the npm registry and never publish, so write methods are not needed. Enables per-request rule evaluation, per-request logging, and SecretResolver credential injection on this endpoint. Closes NVIDIA#1355 Signed-off-by: latenighthackathon <latenighthackathon@users.noreply.github.com>

latenighthackathon · 2026-04-06T23:04:38Z

@ericksoa Thanks for the review! Rebased onto current main — clean linear history, ready for review.

latenighthackathon · 2026-04-07T02:38:14Z

@ericksoa Friendly ping — rebased onto current main yesterday with clean linear history. Ready for your approving review whenever you have a moment, thanks!

ericksoa

Reviewed: clean security hardening — converts npm_registry from L4 pass-through to L7 REST GET-only, consistent with all other REST endpoints in the policy. npm audit POSTs will be blocked but fail gracefully (confirmed by e2e). LGTM.

…VIDIA#1358) ## Summary - Replace L4 pass-through (`access: full`) on `npm_registry` endpoint with L7-enforced REST policy restricted to `GET /**` - Agents only fetch packages from the npm registry and never publish, so write methods are not needed - Enables per-request rule evaluation, per-request logging, and SecretResolver credential injection ## Motivation - Issue NVIDIA#1111 called out converting `npm_registry` alongside the GitHub endpoints - Discussed and agreed upon during review of PR NVIDIA#1225 but deferred to keep that PR scoped - CodeRabbit filed NVIDIA#1355 to track this follow-up ## Test plan - [ ] Verify `openclaw plugins install` succeeds with GET-only policy - [ ] Verify `npm install` inside sandbox completes normally - [ ] Confirm write attempts (e.g. `npm publish`) are blocked by the policy Closes NVIDIA#1355 Signed-off-by: latenighthackathon <latenighthackathon@users.noreply.github.com>  ## Summary by CodeRabbit * **Security** * Registry access is now read-only (HTTP GET only) and TLS termination is enforced for registry connections, tightening network access and transport security for package registry interactions.  Signed-off-by: latenighthackathon <latenighthackathon@users.noreply.github.com> Co-authored-by: latenighthackathon <latenighthackathon@users.noreply.github.com>

prekshivyas reviewed Apr 2, 2026

View reviewed changes

This was referenced Apr 3, 2026

[Linux] Policy edge case: npm install blocked (403) - registry.npmjs.org not GET-allowed in sandbox #993

Closed

Inference and telemetry policies allow all HTTP methods — wildcard rules permit destructive API operations #1113

Closed

wscurran added security Potential vulnerability, unsafe behavior, or access risk priority: medium labels Apr 3, 2026

latenighthackathon mentioned this pull request Apr 3, 2026

npm Registry and PyPI Policies Use access:full — Bypass HTTP Inspection - IssueFinder - SN 15 #1439

Closed

2 tasks

ericksoa reviewed Apr 5, 2026

View reviewed changes

latenighthackathon force-pushed the fix/npm-registry-rest-get-only branch from 8a45bbd to adef897 Compare April 5, 2026 23:09

latenighthackathon force-pushed the fix/npm-registry-rest-get-only branch from a36d8f2 to 73c8ea7 Compare April 6, 2026 23:01

ericksoa approved these changes Apr 7, 2026

View reviewed changes

ericksoa merged commit f7a95cf into NVIDIA:main Apr 7, 2026
7 checks passed

ericksoa mentioned this pull request Apr 20, 2026

test(cli): regression test for non-string gatewayName normalization #2112

Merged

1 task

latenighthackathon deleted the fix/npm-registry-rest-get-only branch May 18, 2026 05:10

wscurran added area: cli Command line interface, flags, terminal UX, or output feature PR adds or expands user-visible functionality and removed priority: medium labels Jun 3, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(policy): convert npm_registry from access: full to REST GET-only#1358

fix(policy): convert npm_registry from access: full to REST GET-only#1358
ericksoa merged 1 commit into
NVIDIA:mainfrom
latenighthackathon:fix/npm-registry-rest-get-only

latenighthackathon commented Apr 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 2, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Poem

Uh oh!

prekshivyas left a comment

Uh oh!

latenighthackathon commented Apr 2, 2026 •

edited

Loading

Uh oh!

ericksoa left a comment

Uh oh!

latenighthackathon commented Apr 6, 2026

Uh oh!

latenighthackathon commented Apr 6, 2026

Uh oh!

latenighthackathon commented Apr 7, 2026

Uh oh!

ericksoa left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

latenighthackathon commented Apr 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Poem

Uh oh!

prekshivyas left a comment

Choose a reason for hiding this comment

Uh oh!

latenighthackathon commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ericksoa left a comment

Choose a reason for hiding this comment

Uh oh!

latenighthackathon commented Apr 6, 2026

Uh oh!

latenighthackathon commented Apr 6, 2026

Uh oh!

latenighthackathon commented Apr 7, 2026

Uh oh!

ericksoa left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

latenighthackathon commented Apr 2, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 2, 2026 •

edited

Loading

latenighthackathon commented Apr 2, 2026 •

edited

Loading