Skip to content

fix(policy): clarify jira curl validation#4185

Merged
cv merged 3 commits into
mainfrom
fix/3758_jira-curl-binary-policy
May 25, 2026
Merged

fix(policy): clarify jira curl validation#4185
cv merged 3 commits into
mainfrom
fix/3758_jira-curl-binary-policy

Conversation

@chengjiew
Copy link
Copy Markdown
Contributor

@chengjiew chengjiew commented May 25, 2026

Summary

  • keep the Jira preset Node-only while allowing both common Node binary paths
  • add Jira policy-add guidance so curl validation distinguishes blocked 000 from Atlassian empty redirects
  • document the manual Node and curl status probes for Jira policy validation

Repro / Root Cause

  • auth.atlassian.com can return an empty-body 301, so curl -s --max-time 10 https://auth.atlassian.com prints nothing even when the request succeeds
  • the preset should still enforce binary scoping: Node is allowed for Atlassian API traffic; curl is not part of the preset and should only work after explicit OpenShell approval

Tests

  • npm run build:cli
  • npx vitest run test/policies.test.ts test/validate-blueprint.test.ts test/validate-config-schemas.test.ts
  • node dist/nemoclaw.js test-sb policy-add jira --dry-run
  • git diff --check

Fixes #3758

Signed-off-by: Chengjie Wang chengjiew@nvidia.com

Summary by CodeRabbit

  • Documentation

    • Enhanced Jira integration guidance with explicit manual-validation steps and probe examples showing Node.js HTTPS checks and curl-based pre/post-approval behavior.
  • Improvements

    • Adjusted Jira preset to recognize an additional Node.js executable path for sandboxed access while keeping curl excluded by default.
  • Tests

    • Added unit and end-to-end tests covering Jira preset validation warnings and per-binary enforcement (Node.js allowed, curl blocked until approved).

Review Change Stack

Signed-off-by: Chengjie Wang <chengjiew@nvidia.com>
@copy-pr-bot
Copy link
Copy Markdown

copy-pr-bot Bot commented May 25, 2026

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 25, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1138ecfb-80a2-488e-9dff-4b44b797b868

📥 Commits

Reviewing files that changed from the base of the PR and between 5491e16 and 6e54b97.

📒 Files selected for processing (6)
  • docs/network-policy/integration-policy-examples.mdx
  • src/lib/actions/sandbox/policy-channel.ts
  • src/lib/policy/index.ts
  • test/e2e/test-network-policy.sh
  • test/policies.test.ts
  • test/policy-add-remove-session-sync.test.ts
✅ Files skipped from review due to trivial changes (1)
  • docs/network-policy/integration-policy-examples.mdx

📝 Walkthrough

Walkthrough

Fixes the Jira policy preset Node binary path, adds a Jira-specific preset validation warning and documentation with manual-validation commands, updates callers and unit tests to use the new warning helper, and adds an e2e test verifying per-binary enforcement for Node vs curl.

Changes

Jira Preset Fix

Layer / File(s) Summary
Jira preset binary allowlist correction
nemoclaw-blueprint/policies/presets/jira.yaml, test/validate-blueprint.test.ts
The atlassian preset binaries entry is corrected to include /usr/bin/node (previously /usr/local/bin/node) and a regression test verifies the allowlist contains Node paths and excludes curl paths.
Preset validation warning helper and callers
src/lib/policy/index.ts, src/lib/actions/sandbox/policy-channel.ts, test/policies.test.ts, test/policy-add-remove-session-sync.test.ts
Introduce getPresetValidationWarning with a jira branch producing multi-line Atlassian probing guidance; replace the previous exported name and update callers/tests to use the new helper and assert jira-specific and null-case behaviors.
Documentation: manual validation guidance
docs/network-policy/integration-policy-examples.mdx
Adds explicit guidance under “GitHub and Jira” describing that the jira preset allows Node.js but not curl, with example Node HTTPS probe and curl pre-/post-approval command snippets and expected status outcomes.
E2E: Jira per-binary policy enforcement
test/e2e/test-network-policy.sh
Adds TC-NET-08 which applies the jira preset, asserts Node HTTPS reachability to api.atlassian.com, shows curl is blocked until an explicit openshell approval, then grants curl and verifies subsequent success; the test is added into the execution order.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

  • NVIDIA/NemoClaw#4013: Overlaps changes in src/lib/actions/sandbox/policy-channel.ts affecting preset application and session policy sync.

Suggested labels

fix, enhancement: policy, OpenShell, Sandbox

Suggested reviewers

  • ericksoa

Poem

"A rabbit hops through policies with care,
Node finds its path through Atlassian air,
curl waits kindly at the guarded gate,
Tests and docs confirm the proper state,
Hooray — small fixes stitched up just right!" 🐰

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'fix(policy): clarify jira curl validation' directly relates to the main change: improving clarity around Jira's per-binary policy enforcement and curl validation behavior.
Linked Issues check ✅ Passed The PR addresses all key requirements from issue #3758: enforces per-binary network behavior (Node allowed, curl blocked by default), adds guidance for distinguishing blocked curl behavior via validation probes, documents Node/curl status probes, and ensures binary-scoped enforcement.
Out of Scope Changes check ✅ Passed All changes are directly scoped to addressing issue #3758: documentation updates clarify Jira validation, preset path updates align with Node paths, policy exports rename warning helpers, tests verify per-binary enforcement and curl blocking behavior, and E2E testing validates the fix.
Docstring Coverage ✅ Passed Docstring coverage is 83.33% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/3758_jira-curl-binary-policy

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint skipped: no ESLint configuration detected in root package.json. To enable, add eslint to devDependencies.


Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions
Copy link
Copy Markdown
Contributor

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 25, 2026

E2E Advisor Recommendation

Required E2E: network-policy-e2e
Optional E2E: None

Dispatch hint: network-policy-e2e

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • network-policy-e2e (medium-high; live OpenShell sandbox, timeout 45 minutes, requires NVIDIA_API_KEY): Required because the PR changes a built-in network policy preset, policy-add CLI behavior, and the network-policy E2E itself. This job directly exercises deny-by-default behavior, live policy-add, dry-run behavior, hot reload, inference exemption, permissive mode, SSRF validation, and the newly added Jira per-binary enforcement path.

Optional E2E

  • None.

New E2E recommendations

  • None.

Dispatch hint

  • Workflow: nightly-e2e.yaml
  • jobs input: network-policy-e2e

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 25, 2026

E2E Scenario Advisor Recommendation

Required scenario E2E: None
Optional scenario E2E: None

Workflow run

Full scenario advisor summary

E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required scenario E2E

  • None. No scenario workflow, scenario metadata, scenario runtime, or validation-suite files changed.

Optional scenario E2E

  • None.

Relevant changed files

  • None.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 25, 2026

PR Review Advisor

Findings: 0 needs attention, 0 worth checking, 0 nice ideas
Since last review: 2 prior items resolved, 0 still apply, 0 new items found

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
docs/network-policy/integration-policy-examples.mdx (1)

181-184: ⚡ Quick win

Split this paragraph to one sentence per source line and avoid clause colons.

This block currently places multiple sentences on one line and uses a colon between clauses (...auth.atlassian.com: ...), which conflicts with the docs style rules.

As per coding guidelines: "One sentence per line in source (makes diffs readable)." and "Colons should only introduce a list. Flag colons used as general punctuation between clauses."

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/network-policy/integration-policy-examples.mdx` around lines 181 - 184,
Split the paragraph so each sentence is on its own source line and remove the
colon between clauses: break "The `jira` preset intentionally allows Node.js
access to Atlassian Cloud and does not allow `curl`." and "When validating it
manually, avoid plain `curl -s` against `auth.atlassian.com`." and "Atlassian
can return an empty redirect body even when the request succeeds; use an
explicit status probe instead." instead of using a colon after
`auth.atlassian.com`; ensure no sentence contains multiple sentences on one line
and replace the colon with a period or semicolon as appropriate.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@docs/network-policy/integration-policy-examples.mdx`:
- Around line 181-184: Split the paragraph so each sentence is on its own source
line and remove the colon between clauses: break "The `jira` preset
intentionally allows Node.js access to Atlassian Cloud and does not allow
`curl`." and "When validating it manually, avoid plain `curl -s` against
`auth.atlassian.com`." and "Atlassian can return an empty redirect body even
when the request succeeds; use an explicit status probe instead." instead of
using a colon after `auth.atlassian.com`; ensure no sentence contains multiple
sentences on one line and replace the colon with a period or semicolon as
appropriate.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ac5b9665-7ed5-480a-b5eb-3ac24de3dcf7

📥 Commits

Reviewing files that changed from the base of the PR and between 50c208b and 5491e16.

📒 Files selected for processing (5)
  • docs/network-policy/integration-policy-examples.mdx
  • nemoclaw-blueprint/policies/presets/jira.yaml
  • src/lib/policy/index.ts
  • test/policies.test.ts
  • test/validate-blueprint.test.ts

@github-actions
Copy link
Copy Markdown
Contributor

Selective E2E Results — ✅ All requested jobs passed

Run: 26395751534
Target ref: fix/3758_jira-curl-binary-policy
Workflow ref: main
Requested jobs: network-policy-e2e
Summary: 1 passed, 0 failed, 0 skipped

Job Result
network-policy-e2e ✅ success

@cv cv added the v0.0.51 Release target label May 25, 2026
@cv cv merged commit 8159ef8 into main May 25, 2026
23 checks passed
@miyoungc miyoungc mentioned this pull request May 26, 2026
12 tasks
miyoungc added a commit that referenced this pull request May 26, 2026
## Summary
Refresh NemoClaw documentation and generated user skills for the v0.0.50
and v0.0.51 release-prep window.
Remove obsolete legacy docs version metadata now that Fern docs no
longer use `docs/project.json`, `docs/versions1.json`, or the legacy
Sphinx config.

## Source summary
- #1757 -> `docs/manage-sandboxes/messaging-channels.mdx`,
`docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Document
Slack channel allowlisting with `SLACK_ALLOWED_CHANNELS`.
- #4134 -> `docs/manage-sandboxes/messaging-channels.mdx`,
`docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Document
Cloudflare named tunnel support through `CLOUDFLARE_TUNNEL_TOKEN`.
- #4186 and #4135 -> `docs/inference/use-local-inference.mdx`,
`docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Document
Ollama upgrade and user-local install behavior.
- #4185 -> `docs/network-policy/integration-policy-examples.mdx`,
`docs/about/release-notes.mdx`: Clarify Jira policy validation probes.
- Release cleanup ->
`.claude/skills/nemoclaw-contributor-update-docs/SKILL.md`,
`docs/CONTRIBUTING.md`, `.github/PULL_REQUEST_TEMPLATE.md`,
`scripts/bump-version.ts`: Stop using legacy docs version JSON files and
align docs verification on `npm run docs`.

## Changes
- Add v0.0.50 and v0.0.51 release notes.
- Regenerate NemoClaw user skills from the current Fern docs.
- Remove obsolete `docs/conf.py`, `docs/project.json`, and
`docs/versions1.json`.
- Update docs workflow guidance and PR templates to use `npm run docs`
instead of `make docs`.
- Remove release-version JSON handling from `scripts/bump-version.ts`.

## Type of Change
- [ ] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [x] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Verification
- [ ] `npx prek run --all-files` passes
- [ ] `npm test` passes
- [ ] Tests added or updated for new or changed behavior
- [x] No secrets, API keys, or credentials committed
- [x] Docs updated for user-facing behavior changes
- [ ] `npm run docs` builds without warnings (doc changes only)
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

Additional verification:
- `python3 scripts/docs-to-skills.py docs/ .agents/skills/ --prefix
nemoclaw-user --doc-platform fern-mdx`
- `npm run build:cli`
- `npx tsc --noEmit --allowSyntheticDefaultImports --module NodeNext
--moduleResolution NodeNext --target ES2022 --types node
scripts/bump-version.ts`
- `ReadLints` on touched docs, skills, template, and script files
- Searched for stale `versions1.json`, `project.json`, and `make docs`
references

Known gaps:
- `npm run docs` was not rerun after cleanup because the earlier Fern
CLI fetch failed with npm registry `403 Forbidden` in this environment.
- A broad `npm run typecheck -- --noEmit` hit an unrelated existing
`scripts/dev-tier-selector.js` type error.

---
Signed-off-by: Miyoung Cho <miyoungc@nvidia.com>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added resource profiling with CPU/RAM configuration controls for
sandboxes
* Enhanced local Ollama inference with automatic GPU memory-aware model
fallback
* Added `nemoclaw resources` command to display host hardware inventory
* Enabled Cloudflare named tunnel support via environment configuration

* **Documentation**
* Improved setup guides for local inference, sandbox hardening, and
policy validation
* Enhanced troubleshooting for messaging delivery and host service
routing
  * Added release notes for v0.0.50 and v0.0.51

* **Chores**
* Updated build documentation commands from `make docs` to `npm run
docs`

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/NVIDIA/NemoClaw/pull/4262?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

v0.0.51 Release target

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[NemoClaw][Linux] Jira policy preset does not enforce expected per‑binary network behavior for curl vs Node

3 participants