fix(policy): allow the resolved claude-code npm launcher in the preset (#7579)

[jason-ma-nv]

Summary

The bundled claude-code network-policy preset allowlisted the npm shim
/tmp/npm-global/bin/claude, but OpenShell enforces on the kernel-trusted
/proc/<pid>/exe. For the global npm install documented by the bundled Claude
Code skill, that resolves to
/tmp/npm-global/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe.
The preset did not list that path, so it denied requests to api.anthropic.com,
including the initial login request.

This PR adds the resolved launcher path without changing the preset's hosts,
methods, paths, or schema. The later request to allow platform.claude.com is a
separate endpoint-expansion decision and is outside this PR.

Related Issue

Fixes #7579

Changes

• Add /tmp/npm-global/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe
  to the claude-code preset's binary allowlist.
• Extend the effective-policy contract to compose the real preset and require
  the resolved launcher path.

Regression Evidence

• Root cause: the preset named the npm shim, while OpenShell authorizes the
  resolved /proc/<pid>/exe path.
• Detection gap: the effective-policy contract checked the preset's host,
  method, and wildcard scope but did not check the resolved npm launcher.
• Prevention: the contract now requires the exact resolved path while retaining
  the existing endpoint and method assertions.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: The change restores the existing documented preset flow and does not change user steps, policy schema, endpoints, methods, or supported scope.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: A nine-category maintainer review at fc690c629 found no remaining security issue. The change adds one exact binary path and does not broaden endpoint, method, path, credential, dependency, or runtime scope.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Reviewed the exact base-to-head policy and contract-test diff. The change adds only the resolved npm-installed Claude Code launcher to the existing binary allowlist; existing network-policy and security documentation already describes the preset’s user-facing behavior. No endpoint, schema, configuration, command, default, or workflow changed. platform.claude.com is not added. Exact-head validation passed: validate:configs 48/48, focused effective-policy/schema/blueprint tests 121/121, CLI and plugin builds, CLI and plugin typechecks, and npm run check:diff.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: scripts/prepare-dgx-station-host.sh is unchanged.
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — At a405c1d95, npm run validate:configs passed all 48 shipped configurations. The focused effective-policy, schema, and blueprint suite passed 3 files / 121 tests. CLI and plugin builds and typechecks passed, and npm run check:diff passed the normal pre-commit, commitlint, and pre-push checks.
• Applicable broad gate passed — Exact-head CI passed at a405c1d95; trusted E2E run 30240660013 passed zero-presets, inference-routing, and live-probes with complete evidence.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

E2E Gate History

• The old 7f60e4f1b gate failed before product tests ran because the controller rejected GitHub's canonical check URL and could not cancel the unauthorized child run. PR fix(e2e): accept canonical controller check URLs #7599 fixed that controller defect.
• The signed main merge at fc690c629 incorporates PR fix(e2e): accept canonical controller check URLs #7599 and creates a new PR SHA and base SHA for fresh controller evidence. The terminal old SHA was not retried.
• At 3a742b8, the hosted runner could not reach Docker Hub or the custom inference endpoint, so live-probes recorded one skipped test and the controller correctly rejected incomplete evidence.
• The signed empty retry commit at a405c1d95 created a new exact head without changing the semantic diff. Trusted E2E then passed all selected jobs; live-probes recorded one passed test and zero skipped tests.

---

Signed-off-by: Jason Ma jama@nvidia.com

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Fixed Claude Code network access when launched through its npm-installed executable path.
  • Prevented valid Claude Code requests from being blocked by policy enforcement.

• Tests

  • Added coverage confirming the npm-installed Claude Code launcher is explicitly allowed.
  • Continued validating restricted binary and endpoint access.

[coderabbitai]

📝 Walkthrough

Walkthrough

The claude_code network policy preset now allows the resolved npm-installed Claude Code executable path. The effective-policy contract test verifies that this path is present while preserving explicit host, method, and binary scope checks.

Changes

Claude Code policy

Layer / File(s)	Summary
Resolved binary allowlist and contract nemoclaw-blueprint/policies/presets/claude-code.yaml, test/effective-policy-contracts.test.ts	The preset adds /tmp/npm-global/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe to its binary allowlist, and the effective-policy test asserts that exact path without allowing broad binary scopes.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: bug-fix, area: policy

Suggested reviewers: cv, apurvvkumaria

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR adds the resolved Claude Code binary to the preset and verifies the effective policy without broadening host or method scopes.
Out of Scope Changes check	✅ Passed	The only code changes are the preset update and matching test coverage, both directly tied to the linked issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: allowing the resolved Claude Code npm launcher in the policy preset.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/7579-claude-code-preset-resolved-binary

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit a405c1d in the fix/7579-claude-code... branch remains at 96%, unchanged from commit 0b18549 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit a405c1d in the fix/7579-claude-code... branch is 81%. The coverage in commit 0b18549 in the main branch is 80%.

Show a code coverage summary of the most impacted files.

File	main 0b18549	fix/7579-claude-code... a405c1d	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/shields/index.ts	71%	72%	+1%
src/lib/onboard...eway-service.ts	81%	82%	+1%
src/lib/actions...dbox/destroy.ts	93%	95%	+2%
src/lib/actions...e-validation.ts	81%	84%	+3%
src/lib/onboard...shboard-port.ts	90%	93%	+3%
src/lib/actions...x/mcp-bridge.ts	35%	41%	+6%
src/lib/actions...lution-probe.ts	88%	95%	+7%
src/lib/actions...-add-restart.ts	10%	19%	+9%
src/lib/actions...time-command.ts	82%	100%	+18%

---

_{Updated July 27, 2026 05:44 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 1 blocker · 1 warning · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported 1 more blocker, 1 more warning, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: inference-routing, network-policy

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[prekshivyas]

Approved at exact head a405c1d against base 0b18549. The change narrowly adds the resolved Claude Code npm launcher path and a contract assertion without broadening hosts, methods, paths, credentials, or supported scope. Focused validation, builds, typechecks, check:diff, all exact-head CI, and trusted E2E run 30240660013 passed; live-probes evidence recorded passed=1, skipped=0. Documentation writer review passed with no docs needed, the primary advisor recommends merge_as_is, all commits are GitHub Verified, and there are no unresolved review threads.