fix(security): add binaries restrictions to all messaging and preset policies

nemoclaw-blueprint/policies/openclaw-sandbox.yaml

@@ -157,9 +157,9 @@ network_policies:
       - { path: /usr/local/bin/openclaw }
       - { path: /usr/local/bin/npm }
 
-  # ── Messaging — pre-allowed for agent notifications ────────────
-  # Telegram and Discord are open by default so the agent can send
-  # notifications and respond to chats without triggering approval.
+  # ── Messaging — pre-allowed for OpenClaw agent notifications ────
+  # Restricted to node processes to prevent arbitrary data exfiltration
+  # via curl, wget, python, etc. (See: #272)
   telegram:
     name: telegram
     endpoints:
@@ -171,6 +171,8 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/bot*/**" }
           - allow: { method: POST, path: "/bot*/**" }
+    binaries:
+      - { path: /usr/local/bin/node }
 
   discord:
     name: discord
@@ -198,3 +200,5 @@ network_policies:
         tls: terminate
         rules:
           - allow: { method: GET, path: "/**" }
+    binaries:
+      - { path: /usr/local/bin/node }

nemoclaw-blueprint/policies/presets/discord.yaml

@@ -32,3 +32,5 @@ network_policies:
         tls: terminate
         rules:
           - allow: { method: GET, path: "/**" }
+    binaries:
+      - { path: /usr/local/bin/node }

nemoclaw-blueprint/policies/presets/docker.yaml

@@ -41,3 +41,5 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
           - allow: { method: POST, path: "/**" }
+    binaries:
+      - { path: /usr/bin/docker }

nemoclaw-blueprint/policies/presets/huggingface.yaml

@@ -32,3 +32,6 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
           - allow: { method: POST, path: "/**" }
+    binaries:
+      - { path: /usr/local/bin/python3 }
+      - { path: /usr/local/bin/node }

nemoclaw-blueprint/policies/presets/jira.yaml

@@ -33,3 +33,5 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
           - allow: { method: POST, path: "/**" }
+    binaries:
+      - { path: /usr/local/bin/node }

nemoclaw-blueprint/policies/presets/outlook.yaml

@@ -41,3 +41,5 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
           - allow: { method: POST, path: "/**" }
+    binaries:
+      - { path: /usr/local/bin/node }

nemoclaw-blueprint/policies/presets/slack.yaml

@@ -33,3 +33,5 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/**" }
           - allow: { method: POST, path: "/**" }
+    binaries:
+      - { path: /usr/local/bin/node }

nemoclaw-blueprint/policies/presets/telegram.yaml

@@ -17,3 +17,5 @@ network_policies:
         rules:
           - allow: { method: GET, path: "/bot*/**" }
           - allow: { method: POST, path: "/bot*/**" }
+    binaries:
+      - { path: /usr/local/bin/node }

test/security-binaries-restriction.test.js

@@ -0,0 +1,64 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, it, expect } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+
+const BASELINE = path.join(import.meta.dirname, "..", "nemoclaw-blueprint", "policies", "openclaw-sandbox.yaml");
+const PRESETS_DIR = path.join(import.meta.dirname, "..", "nemoclaw-blueprint", "policies", "presets");
+
+describe("binaries restriction: baseline policy", () => {
+  it("every network_policies entry has a binaries section", () => {
+    // Parse YAML manually (no yaml dependency) — find all top-level keys under network_policies
+    // and verify each has a "binaries:" line within its block
+    const yaml = fs.readFileSync(BASELINE, "utf-8");
+    const lines = yaml.split("\n");
+    let inNetworkPolicies = false;
+    let currentBlock = null;
+    const blocks = [];
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      if (/^network_policies:/.test(line)) { inNetworkPolicies = true; continue; }
+      if (inNetworkPolicies && /^\S/.test(line) && line.trim() !== "") {
+        if (currentBlock) blocks.push(currentBlock);
+        currentBlock = null;
+        inNetworkPolicies = false;
+        continue;
+      }
+      if (!inNetworkPolicies) continue;
+      // Top-level entry under network_policies (2-space indent, not a comment)
+      if (/^  (?!#)\S.*:\s*$/.test(line)) {
+        if (currentBlock) blocks.push(currentBlock);
+        currentBlock = { name: line.trim().replace(/:$/, ""), startLine: i + 1, lines: [line] };
+        continue;
+      }
+      if (currentBlock) currentBlock.lines.push(line);
+    }
+    if (currentBlock) blocks.push(currentBlock);
+
+    expect(blocks.length).toBeGreaterThan(0);
+
+    const violators = blocks.filter(b => !b.lines.some(l => /^\s+binaries:/.test(l)));
+
+    expect(violators.map(b => b.name)).toEqual([]);
+  });
+});
+
+describe("binaries restriction: policy presets", () => {
+  it("every preset YAML has a binaries section", () => {
+    const presets = fs.readdirSync(PRESETS_DIR).filter(f => f.endsWith(".yaml"));
+    expect(presets.length).toBeGreaterThan(0);
+
+    const missing = [];
+    for (const file of presets) {
+      const content = fs.readFileSync(path.join(PRESETS_DIR, file), "utf-8");
+      if (!/^\s+binaries:\s*$/m.test(content)) {
+        missing.push(file);
+      }
+    }
+
+    expect(missing).toEqual([]);
+  });
+});