test/policies.test.ts (1)

1479-1498: ⚡ Quick win

Strengthen endpoint invariants in the Claude Code preset test.

This test already checks hosts and methods, but it can still pass if endpoint transport semantics drift. Please also assert port, protocol, and enforcement for each endpoint to prevent silent widening.

Suggested patch

       ) as {
         preset?: { name?: string };
         network_policies?: Record<
           string,
           {
-            endpoints?: Array<{ host?: string; access?: string; rules?: unknown[] }>;
+            endpoints?: Array<{
+              host?: string;
+              port?: number;
+              protocol?: string;
+              enforcement?: string;
+              access?: string;
+              rules?: unknown[];
+            }>;
             binaries?: Array<{ path?: string }>;
           }
         >;
       };
@@
       for (const endpoint of claudePolicy?.endpoints ?? []) {
+        expect(endpoint.port).toBe(443);
+        expect(endpoint.protocol).toBe("rest");
+        expect(endpoint.enforcement).toBe("enforce");
         expect(endpoint).not.toHaveProperty("access");
         expect(endpoint.rules).toEqual(
           expect.arrayContaining([
             { allow: { method: "GET", path: "/**" } },
             { allow: { method: "POST", path: "/**" } },

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/policies.test.ts` around lines 1479 - 1498, The test currently verifies
hosts and allowed methods for preset.network_policies?.claude_code but doesn't
lock down transport semantics; update the loop over claudePolicy?.endpoints to
also assert that each endpoint has port === 443, protocol === "https", and
enforcement === "required" (i.e., add expectations on endpoint.port,
endpoint.protocol, and endpoint.enforcement alongside the existing access/rules
checks) so transport/security widening is caught.

docs/security/best-practices.mdx (1)

163-163: ⚡ Quick win

Use one sentence per source line in these table cells.

Both rows place multiple sentences on a single source line; split them so each sentence is on its own line.

As per coding guidelines, "One sentence per line in source (makes diffs readable). Flag paragraphs where multiple sentences appear on the same line."

Also applies to: 517-517

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/security/best-practices.mdx` at line 163, The table cell for the
`claude-code` preset contains multiple sentences on one source line; split that
cell so each sentence is on its own source line (e.g., break "Allows a
separately installed Claude Code CLI to reach Anthropic and telemetry hosts with
its own credentials. Do not use this preset for NemoClaw inference routing."
into two lines). Apply the same one-sentence-per-line fix to the other affected
table row (the row referenced as also applying at 517-517) so every sentence in
each table cell is on its own source line.

docs/security/best-practices.mdx (1)

163-163: ⚡ Quick win

Split sentences to one-per-line in source.

Line 163, Line 446, and Line 517 each contain multiple sentences on the same source line. Please split them so each sentence is on its own line.

As per coding guidelines, "One sentence per line in source (makes diffs readable)."

Also applies to: 446-446, 517-517

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/security/best-practices.mdx` at line 163, The table row containing the
`claude-code` preset currently has multiple sentences on one source line; split
that row so each sentence is on its own line (e.g., break after "telemetry, and
crash-report endpoints." and after "with its own credentials."), and do the same
for the other two occurrences flagged (the other multiline-sentence source
lines) so each sentence occupies its own line in the markdown source; this keeps
the `claude-code` table entry and the two other affected paragraphs
one-sentence-per-line as required.

test/policies.test.ts (1)

1438-1449: 💤 Low value

Consider using parseRepoYaml helper for consistency.

This test section uses direct fs.readFileSync/YAML.parse while nearby refactored code uses the new parseRepoYaml helper. Using the helper would maintain consistency with the rest of the file.

♻️ Suggested refactor

      for (const relativePath of permissivePolicyPaths) {
-       const parsed = YAML.parse(
-         fs.readFileSync(path.join(REPO_ROOT, relativePath), "utf-8"),
-       ) as {
+       const parsed = parseRepoYaml(relativePath) as {
          network_policies?: Record<string, { endpoints?: Array<{ host?: string }> }>;
        };

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/policies.test.ts` around lines 1438 - 1449, The test reads and parses
YAML with fs.readFileSync/YAML.parse; replace that with the existing
parseRepoYaml helper to stay consistent: for each relativePath in
permissivePolicyPaths call parseRepoYaml(relativePath) (or await if it's async)
and assign the result to parsed, then proceed to assert parsed.network_policies,
extract hosts and compare against claudeHosts as before; update references to
REPO_ROOT removal if parseRepoYaml handles repo root resolution and ensure you
use the same parsed shape expected by the subsequent code.