Repository navigation
[Linux] nemoclaw policy-add fails: missing version field in generated policy YAML #991
Description
Description
Description
1. Issue summary
nemoclaw policy-add fails with failed to parse sandbox policy YAML — missing field 'version' because bin/lib/policies.js generates a policy YAML without the required version field that openshell policy set expects.
2. Detailed description
What were you trying to do?
Apply the outlook policy preset to sandbox my-assistant using nemoclaw my-assistant policy-add.
What happened instead?
Command failed with:
Error: × failed to parse sandbox policy YAML ╰─▶ missing field `version` Command failed (exit 1): openshell policy set --policy "/tmp/nemoclaw-policy-1773628802112.yaml" --wait my-assistant
Steps to reproduce:
-
Install nemoclaw from repo root: npm install -g .
-
Have a sandbox registered (e.g. my-assistant).
-
Run nemoclaw my-assistant policy-add.
-
Type outlook at the preset prompt.
-
Type Y at the confirmation prompt.
-
Expected: Outlook preset is applied — graph.microsoft.com, login.microsoftonline.com, outlook.office365.com, outlook.office.com endpoints added. No schema errors.
-
Actual: openshell policy set rejects the YAML with missing field 'version'.
network_policies:
outlook_graph:
...But openshell policy set requires:
version: "1.0"
network_policies:
outlook_graph:
...
Log :
Available presets:
○ discord — Discord API, gateway, and CDN access
○ docker — Docker Hub and NVIDIA container registry access
○ huggingface — Hugging Face Hub, LFS, and Inference API access
○ jira — Jira and Atlassian Cloud access
○ npm — npm and Yarn registry access
○ outlook — Microsoft Outlook and Graph API access
○ pypi — Python Package Index (PyPI) access
○ slack — Slack API and webhooks access
○ telegram — Telegram Bot API access
Preset to apply: outlook
Apply 'outlook' to sandbox 'my-assistant'? [Y/n]: Y
Error: × failed to parse sandbox policy YAML
╰─▶ missing field `version`
Command failed (exit 1): openshell policy set --policy "/tmp/nemoclaw-policy-1773628802112.yaml" --wait m
pruprakash@700d01b-lcedt:~/Documents/pruprakash/openshell-openclaw-plugin/nemoclaw$
Steps to reproduce
No steps provided.
[NVB# 5982764]
[NVB#5982764]
Activity
WuKongAI-CMU commentedon Mar 27, 2026
Quick check against current
main: this looks already covered inbin/lib/policies.js. The current merge path now injectsversion: 1both when there is no current policy and when an existing policy blob is missing a top-levelversion:field before appendingnetwork_policies:.That means this report likely needs a re-test on current
mainbefore we open another PR for it.senthilr-nv commentedon Mar 27, 2026
The bug is still present on current
main(c051cbb). Theversion:check at lines 170–172 only covers the path where the current policy exists but has nonetwork_policies:section. The third path (lines 133–166) — where the policy does havenetwork_policies:but noversion:— never adds the version field.Reproduced on DGX Spark: writing a versionless policy with
network_policies:through the merge path and callingopenshell policy setfails withmissing field 'version'.PR #101 fixes this correctly.
fix: address core blocker lifecycle regressions (#1208)
fix: address core blocker lifecycle regressions (#1208)
fix: address core blocker lifecycle regressions (NVIDIA#1208)
fix: address core blocker lifecycle regressions (NVIDIA#1208)
[-][NeMoClaw][Linux] nemoclaw policy-add fails: missing version field in generated policy YAML[/-][+][Linux] nemoclaw policy-add fails: missing version field in generated policy YAML[/+]5 remaining items
docs: publish enterprise readiness and admin capability guidance (#5372)
latenighthackathon commentedon Jun 24, 2026
Hi @zNeill, thanks for raising this. The missing
versionfield in generated policy YAML looks like it was fixed in #101 (v0.0.23), which injectsversion: 1when merging a preset into a versionless policy. Could you check whether it is resolved on the latest NemoClaw (v0.0.67)? Cheers!sandl99 commentedon Jun 25, 2026
Retested this flow and it is fixed now.
Command run:
Result:
The Outlook preset now applies successfully and OpenShell accepts the generated policy, so the missing
versionfield failure no longer reproduces. Closing as fixed.