@clawscarf/cli 0.1.0-alpha.6 → 0.1.0-alpha.8

package/README.md

@@ -13,7 +13,7 @@ models, connected accounts, and execution protected by NVIDIA OpenShell.
 ## Get started
 
 ```sh
-curl -fsSL https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.5/install.sh | sh
+curl -fsSL https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.7/install.sh | sh
 export PATH="$HOME/.local/bin:$PATH"
 clawscarf configure
 ```
@@ -90,6 +90,11 @@ execution files and browser accounts. Native roles control application permissio
 people allowed to run code share the Gateway’s authority. Use separate installations
 for teams that must be isolated from one another.
 
+The Team server recipe enables public web access for agents and shell tools. Operators
+can turn it off; private destinations remain restricted to explicitly configured services.
+Public web access permits sending team data to public services. See the
+[network boundary](https://github.com/clawscarf/clawscarf/blob/main/deploy/openshell/README.md#public-web-access) for enforcement and limits.
+
 Default login and optional Connections use **ClawScarf Cloud**. You can use your own
 OIDC provider and disable Connections to run without those hosted services. Original
 model-provider keys and Connections management credentials stay outside OpenClaw.

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-alpha.6",
+  "version": "0.1.0-alpha.8",
   "engines": {
     "node": ">=24.16.0 <25 || >=26.1.0"
   },

package/pnpm-lock.yaml

@@ -620,6 +620,12 @@ packages:
         integrity: sha512-3xSjTp3v03X/lSQLkczaN9UIEwJMoMCA1+Nb5HfbJEQWogdeQIyVtTvxPXDQjZ5zws8rFQfVfRdz03ARihPJgw==
       }
 
+  '@types/semver@7.8.0':
+    resolution:
+      {
+        integrity: sha512-1mAINjtQCXXeLkJ9ehXkwOcBpqtLxiVtKhpUf83DdRNdQKV0iXZpaHYqRr7nj+wvxuJzoAmAwXI+sCNMv1CzLQ==
+      }
+
   '@types/ws@8.18.1':
     resolution:
       {
@@ -2776,6 +2782,8 @@ snapshots:
 
   '@types/retry@0.12.5': {}
 
+  '@types/semver@7.8.0': {}
+
   '@types/ws@8.18.1':
     dependencies:
       '@types/node': 24.10.13

package/recipes/README.md

@@ -5,13 +5,15 @@ Recipes are bundled with the CLI. Each folder contains a [recipe.json](team-serv
 
 ```text
 recipes/team-server/recipe.json
-runtime/releases/0.1.0-dev.json
+runtime/current.json
 packs/research-team/pack.json
 ```
 
 Each recipe has an ID and a version. Accepted installations retain that provenance
 alongside their actual settings; a CLI update never reapplies new defaults. Bump the
-recipe version when its defaults, pack selections or runtime pin change.
+recipe version when its defaults, pack selections or explicit runtime reference change.
+The resolved runtime release is retained separately; automatic advancement of the
+[current selection](../release/README.md#published-and-development-use) does not change recipe defaults.
 
 A recipe's `runtime` points to an exact runtime definition, relative to the recipe
 file. Runtime images and tools are fixed; its other fields are defaults that users
@@ -21,7 +23,7 @@ no executable hooks, secrets or user identities.
 
 - `models` selects model ID, provider and reasoning from the bundled
   [model catalog](../deploy/models/catalog.json).
-- `defaults` selects resources, browser and Connections enablement.
+- `defaults` selects resources, public web access, browser and Connections enablement.
 - `packs: [{ id, members }]` selects agents from the bundled [packs](../packs/README.md).
   The installer checks members and collects required credentials after settings review.
 

package/recipes/team-server/recipe.json

@@ -1,7 +1,5 @@
 {
   "id": "team-server",
-  "version": "0.1.1",
-  "runtime": "../../runtime/releases/0.1.0-alpha.6.json",
   "name": "Team server",
   "description": "A protected OpenClaw server for your team, with hosted login, managed models and optional Connections.",
   "maturity": "supported",
@@ -17,12 +15,14 @@
     },
     "connections": {
       "enabled": true
-    }
+    },
+    "publicWeb": true
   },
   "models": {
     "model": "gpt-6-astra",
     "provider": "openai",
     "reasoning": "medium"
   },
-  "packs": []
+  "runtime": "../../runtime/current.json",
+  "version": "0.1.3"
 }

package/release/README.md

@@ -2,11 +2,11 @@
 
 These have separate responsibilities:
 
-| Definition      | Owns                                                                                             | Location                                               |
-| --------------- | ------------------------------------------------------------------------------------------------ | ------------------------------------------------------ |
-| Runtime release | Exact software images, OpenShell executables, checksums and supported platforms                  | [runtime/releases](../runtime/releases/0.1.0-dev.json) |
-| Recipe          | A fixed runtime reference plus editable model, reasoning, resource, capability and pack defaults | [recipes](../recipes/README.md)                        |
-| Pack            | Native agent, skill and workflow files with declared prerequisites                               | [packs](../packs/README.md)                            |
+| Definition      | Owns                                                                                             | Location                                        |
+| --------------- | ------------------------------------------------------------------------------------------------ | ----------------------------------------------- |
+| Runtime release | Exact software images, OpenShell executables, checksums and supported platforms                  | [runtime/current.json](../runtime/current.json) |
+| Recipe          | A fixed runtime reference plus editable model, reasoning, resource, capability and pack defaults | [recipes](../recipes/README.md)                 |
+| Pack            | Native agent, skill and workflow files with declared prerequisites                               | [packs](../packs/README.md)                     |
 
 Several recipes can use the same runtime. A runtime contains no recipes, model
 catalog or pack selections. Changing a recipe does not require rebuilding its runtime.
@@ -20,10 +20,23 @@ Use the [installation guide](../deploy/deployment/installation.md) for published
 CLI installation, platform requirements and runtime downloads. Use the
 [development command](../scripts/README.md#development-command) for this checkout.
 
-The tracked [development runtime](../runtime/releases/0.1.0-dev.json) is an input
-for a prepared development environment, not a clean-machine release. Its exact
-images and executable paths are data in that definition. Packaging resolves those
-inputs to immutable candidate artifacts; runtime startup never selects latest.
+The tracked [current runtime](../runtime/current.json) selects a published release
+by exact image digests and downloadable tool checksums. The development command
+reads it from the checkout; it does not query a remote latest version or build images.
+New installations retain their own copy. Updating this file or the CLI never changes
+an existing installation's saved selection.
+
+After publication, the workflow copies the verified release manifest into this file
+and commits it to `main`. Pulling that commit updates the development command's
+selection. [Promotion](../scripts/release/advance-runtime.ts) requires a newer version
+and the same selection the candidate was built against; an identical repeat is a no-op.
+A changed pin or concurrent Git update fails visibly instead of overwriting another
+selection. The promotion job can be retried independently of publication. Repository
+rules must permit the release workflow's bot to push this commit to `main`.
+
+For experiments with locally built images/tools, create a separate runtime bundle
+and custom recipe using [runtime assembly](#assemble-runtime-artifacts). The bundled
+recipe uses the same published artifact format in development and installed CLIs.
 
 ## Publishing structure
 
@@ -84,9 +97,10 @@ owns source identity and reconstruction. Candidate assembly packages
 [openclaw-source.json and openclaw-patches.tgz](../scripts/release/candidate.ts)
 with checksums; each runtime archive includes both. The runtime definition's `sourceRevision`
 identifies the ClawScarf commit that owns those inputs.
-The source recipe pins the development
-runtime. Packaging resolves that same runtime to the candidate's immutable definition;
-it does not make recipes select latest. Published definitions must not be overwritten.
+Recipes reference the current manifest within their checkout or installed package.
+Candidate packaging replaces that file only in the staged package with the newly
+built manifest. It leaves source files untouched; publication advances the checkout
+as described above. Published packages and release assets remain immutable.
 
 The `release-candidate` Actions artifact is the reviewable output. Download it and test
 a fresh supported installation, administrator login, real inference and stop/start
@@ -99,6 +113,9 @@ build run from `main`. It checks the source commit and artifact checksums, creat
 GitHub Release and publishes the already-built npm tarball. It never rebuilds images
 or packages. Prereleases use npm's `next` tag; stable versions use `latest`. Repeating
 a GitHub upload is allowed only when the existing checksums match exactly.
+A separate dependent job then advances the checkout's current runtime selection;
+a failure there leaves the published release available and can be retried without
+republishing npm or rebuilding artifacts.
 
 Repository setup:
 

package/release/components.json

@@ -1,6 +1,6 @@
 {
   "openclaw": {
-    "sourceTree": "9270b569864b1036a69d3080e628b68f4f4c048a",
+    "sourceTree": "57d9c7394530b0468c0ccc3f163297c6669e0d5a",
     "version": "2026.9.4",
     "sourceRevision": "7bc487d39dc9e059bb9b19ea08152883022f83fe"
   },

package/release/operator.md

@@ -32,6 +32,6 @@ node scripts/clawscarf.js configure --directory /absolute/new-team
 
 Keep installation data outside the extracted package. A development runtime that
 references local image IDs needs those images prepared separately; see
-[development releases](README.md#published-and-development-use).
+[custom runtime assembly](README.md#assemble-runtime-artifacts).
 The optional pack operator also needs its [Python dependencies](../packs/README.md#requirements-and-bindings).
 Required [notices](../THIRD_PARTY_NOTICES.md) and dependency licenses accompany the payload.

package/runtime/{releases/0.1.0-alpha.6.json → current.json}

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "version": "0.1.0-alpha.6",
-  "sourceRevision": "3527b1e4ce8218d5b144f267cafe4115aa160b85",
+  "version": "0.1.0-alpha.8",
+  "sourceRevision": "dc1a8fc480b3a55841e2a1c1aea58bad9811402c",
   "platforms": [
     "darwin-arm64",
     "linux-arm64",
@@ -9,16 +9,16 @@
   ],
   "images": {
     "postgres": "postgres@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193",
-    "gateway": "ghcr.io/clawscarf/clawscarf/runtime@sha256:24a7ef582b70cff88e09aed5d1ef7350e3a2afcfad251590a7740bf7c8b8c28b",
-    "companion": "ghcr.io/clawscarf/clawscarf/companion@sha256:5821b3770d19a19cfdb9faf3ee357a47c790fcc79a43d3ba4cf59f6962dc5428",
-    "openshellClient": "ghcr.io/clawscarf/clawscarf/openshell-client@sha256:69c6fb88be2b14fa0fd5ac8b5c5274195cdb5182b256aeffe8955bbd501db0db",
-    "relay": "ghcr.io/clawscarf/clawscarf/browser-relay@sha256:cf07a39071b22cb362125bc000edef8c4694b9089c075df42fdb4235cd25c12a",
+    "gateway": "ghcr.io/clawscarf/clawscarf/runtime@sha256:a942812602fc1bdf40421d0ddcfda89aa87b9412b0616adba9a3da4e2a8a9a91",
+    "companion": "ghcr.io/clawscarf/clawscarf/companion@sha256:fea91c1beda96cf811cfc952c77fd7ac17df8374704da926984ec65df8de49af",
+    "openshellClient": "ghcr.io/clawscarf/clawscarf/openshell-client@sha256:419510bc89b4beee1763ad4b4a86ec490546e4cc1e645d054ef05a5cf654f27d",
+    "relay": "ghcr.io/clawscarf/clawscarf/browser-relay@sha256:602226e11f463fd811378173caedc0bea017f556d3fe94d17f4a752aaabd7171",
     "models": "ghcr.io/berriai/litellm:v1.100.1@sha256:a3715fa7ad8387941ab697259bd2881d68931657247a41984f90fae6d11c62bf",
     "browser": {
-      "chromium": "ghcr.io/clawscarf/clawscarf/browser@sha256:6289b18228ff6bd56a59fe4a7974299e64726696c8c7a10f42bff35a919bc9bb",
-      "node": "ghcr.io/clawscarf/clawscarf/browser-node@sha256:daf1e454db411836e595c167f924a9c951b4e6cdd40b8891d3fbd0e7a328afbb",
-      "dns": "ghcr.io/clawscarf/clawscarf/browser-dns@sha256:dd543e51e8a1c52e2165bda661c2a866bcffaf198bc961f7a537c7af8b90e244",
-      "egress": "ghcr.io/clawscarf/clawscarf/browser-egress@sha256:cca3d28d58002f91a03a548032a30ae5da726bcaee1ec65062581bbfb03dcbd9"
+      "chromium": "ghcr.io/clawscarf/clawscarf/browser@sha256:ce259d28f078ac5d3ff9afc0a79b0a8935873eda953e6c04dbd8f756c3eb17ac",
+      "node": "ghcr.io/clawscarf/clawscarf/browser-node@sha256:de6b364dad0010ddf17f141888569c75f72364f4c2305d96e012c0c78c34f7c2",
+      "dns": "ghcr.io/clawscarf/clawscarf/browser-dns@sha256:3b8e9364ba8cc6271a53135c2c82944f9a3be423b20ccef3dea930e38d08d8a8",
+      "egress": "ghcr.io/clawscarf/clawscarf/browser-egress@sha256:06a33c3d9a5979359c92179ae936bfc0bb991b057eb5a4dc87dcf9240b513542"
     }
   },
   "tools": {
@@ -28,34 +28,34 @@
         "darwin-arm64": {
           "file": "tools/darwin-arm64/openshell",
           "sha256": "0baeeffe0e4c184b08fde910ac9e8815fb0b8cfb808e49c0e634d7db65fb03bb",
-          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.6/openshell-darwin-arm64"
+          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.8/openshell-darwin-arm64"
         },
         "linux-arm64": {
           "file": "tools/linux-arm64/openshell",
           "sha256": "84df9f059b16b66c83748606cc87d9edcda84b57effea19543f5c368aba7eb18",
-          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.6/openshell-linux-arm64"
+          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.8/openshell-linux-arm64"
         },
         "linux-x64": {
           "file": "tools/linux-x64/openshell",
           "sha256": "24e85062073d512d1951c76cd3890b7bce1ab01cc36a08f88b3b43c067a402da",
-          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.6/openshell-linux-x64"
+          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.8/openshell-linux-x64"
         }
       },
       "gateway": {
         "darwin-arm64": {
           "file": "tools/darwin-arm64/openshell-gateway",
           "sha256": "298706259ef18350f334c222e981e91583558511d50bce22727c689d261203e6",
-          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.6/openshell-gateway-darwin-arm64"
+          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.8/openshell-gateway-darwin-arm64"
         },
         "linux-arm64": {
           "file": "tools/linux-arm64/openshell-gateway",
           "sha256": "0e660428e655e7481f34ba8a4b351554400baf791863d32555c98dddb3f09ae2",
-          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.6/openshell-gateway-linux-arm64"
+          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.8/openshell-gateway-linux-arm64"
         },
         "linux-x64": {
           "file": "tools/linux-x64/openshell-gateway",
           "sha256": "780fc7ad871e2163f3fb866a2d0254ee682fc0d83e6261a84b350c8dcdd9f47b",
-          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.6/openshell-gateway-linux-x64"
+          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.8/openshell-gateway-linux-x64"
         }
       }
     }

package/scripts/deployment/configuration.js

@@ -139,6 +139,7 @@ export const localInput = z
         .optional(),
     cpu,
     memory,
+    publicWeb: z.boolean().default(false),
     relayImage: image.optional(),
     browser: z
         .strictObject({

package/scripts/deployment/connection-settings.js

@@ -5,6 +5,7 @@ import { companionConfiguration } from "./configuration.js";
 import { loadInitialConnections, prepareInitialConnections, readInitialConnectionToken, } from "./connections.js";
 import { configureConnectionsVolume } from "./connections-runtime.js";
 import { writePrivate } from "./state.js";
+import { stageNetworkPolicyChange } from "./network-policy.js";
 import { initialRuntimePolicy } from "./policy.js";
 /** Explicit capability edit, with the installation stopped and its operator lock held. */
 export async function applyConnectionSettings(directory, state, previous, credentialFile) {
@@ -56,5 +57,7 @@ export async function applyConnectionSettings(directory, state, previous, creden
     await writePrivate(file, JSON.stringify(config));
     const rule = initialRuntimePolicy("network_policies: {}", undefined, endpoint)
         .network_policies.connections_broker ?? null;
-    await writePrivate(join(directory, "private/connection-policy-change.json"), JSON.stringify({ ownerId: state.ownerId, rule }));
+    await stageNetworkPolicyChange(directory, state, {
+        connections_broker: rule,
+    });
 }

package/scripts/deployment/launch.js

@@ -1,4 +1,4 @@
-import { applyConnectionPolicy } from "./connection-policy.js";
+import { applyNetworkPolicy } from "./network-policy.js";
 import { verifyRuntimeImage } from "./images.js";
 import { startBrowserNode } from "./browser-node-pairing.js";
 import { verifyBrowserNode } from "./browser-node.js";
@@ -83,7 +83,7 @@ export async function launchLocal(directoryInput, report, control = {}) {
         await waitFor(async () => {
             await run(state.input.openshellCli, ["sandbox", "list", "--gateway", name, "--output", "json"], { env, timeout: 5000 });
         });
-        await applyConnectionPolicy(directory, state, env);
+        await applyNetworkPolicy(directory, state, env);
         if (state.input.modelGateway) {
             report("Starting model gateway…");
             await compose(directory, [
@@ -113,7 +113,7 @@ export async function launchLocal(directoryInput, report, control = {}) {
             await response.body?.cancel();
         });
         await verifyRuntimeBinding(state, runtime);
-        await applyConnectionPolicy(directory, state, env, true);
+        await waitFor(() => applyNetworkPolicy(directory, state, env, true));
         if (state.input.browser) {
             report("Starting native browser node…");
             await startBrowserNode(directory, state, cancellation.signal);

package/scripts/deployment/network-policy.js

@@ -0,0 +1,141 @@
+import { isDeepStrictEqual } from "node:util";
+import { readFile, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { z } from "zod";
+import { run } from "./process.js";
+import { resourceNames, writePrivate } from "./state.js";
+import { composePublicWebRules } from "./public-web.js";
+import { runtimeManager } from "./runtime.js";
+const connectionRuleSchema = z.object({
+    name: z.string(),
+    endpoints: z.array(z.object({
+        host: z.string(),
+        port: z.number(),
+        tls: z.string(),
+        allowed_ips: z.array(z.string()).optional(),
+    })),
+    binaries: z.array(z.object({ path: z.string() })),
+});
+const publicRuleSchema = z.object({
+    name: z.string(),
+    endpoints: z.array(z.object({
+        ports: z.array(z.number()),
+        allowed_ips: z.array(z.string()),
+        tls: z.string(),
+    })),
+    binaries: z.array(z.object({ path: z.string() })),
+});
+const changesSchema = z.strictObject({
+    connections_broker: connectionRuleSchema.nullable().optional(),
+    public_web: publicRuleSchema.nullable().optional(),
+});
+export async function stageNetworkPolicyChange(directory, state, rules) {
+    const file = join(directory, "private/network-policy-change.json");
+    let previous = {};
+    try {
+        previous = z
+            .strictObject({ ownerId: z.literal(state.ownerId), rules: changesSchema })
+            .parse(JSON.parse(await readFile(file, "utf8"))).rules;
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+            throw error;
+    }
+    await writePrivate(file, JSON.stringify({
+        ownerId: state.ownerId,
+        rules: changesSchema.parse({ ...previous, ...rules }),
+    }));
+}
+const policySchema = z.looseObject({
+    network_policies: z.record(z.string(), z.unknown()),
+});
+/** Apply only explicitly selected managed rules; never regenerate an operator's other policies. */
+export async function applyNetworkPolicy(directory, state, env, verify = false, command = run) {
+    const pending = join(directory, "private/network-policy-change.json");
+    let text;
+    try {
+        text = await readFile(pending, "utf8");
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+            return;
+        throw error;
+    }
+    const change = z
+        .strictObject({
+        ownerId: z.literal(state.ownerId),
+        rules: changesSchema,
+    })
+        .parse(JSON.parse(text));
+    const base = join(directory, "private/runtime-policy.json");
+    const update = (policy) => {
+        return {
+            ...policy,
+            network_policies: composePublicWebRules(Object.fromEntries([
+                ...Object.entries(policy.network_policies).filter(([key]) => !Object.hasOwn(change.rules, key)),
+                ...Object.entries(change.rules).filter(([, rule]) => rule !== null),
+            ])),
+        };
+    };
+    const matches = (policy) => {
+        const expected = update(policy).network_policies;
+        return [
+            ...new Set([
+                ...Object.keys(change.rules),
+                "connections_broker",
+                "model_gateway",
+            ]),
+        ].every((key) => {
+            const observed = policy.network_policies[key];
+            if (!Object.hasOwn(change.rules, key))
+                return isDeepStrictEqual(observed, expected[key]);
+            if (expected[key] === undefined)
+                return observed === undefined;
+            const schema = key === "public_web" ? publicRuleSchema : connectionRuleSchema;
+            const actualRule = schema.safeParse(observed);
+            const expectedRule = schema.safeParse(expected[key]);
+            return (actualRule.success &&
+                expectedRule.success &&
+                isDeepStrictEqual(actualRule.data, expectedRule.data));
+        });
+    };
+    const name = resourceNames(state).sandbox;
+    if (!(await runtimeManager(directory, state, env, command).recorded()).receipt) {
+        if (verify)
+            throw Error("The configured runtime has not been recorded.");
+        await writePrivate(base, JSON.stringify(update(policySchema.parse(JSON.parse(await readFile(base, "utf8"))))));
+        return;
+    }
+    const observed = z
+        .object({
+        sandbox: z.literal(name),
+        policy_source: z.literal("sandbox"),
+        version: z.number().int(),
+        active_version: z.number().int(),
+        status: z.string(),
+        policy: policySchema,
+    })
+        .parse(JSON.parse(await command(state.input.openshellCli, [
+        "policy",
+        "get",
+        name,
+        "--gateway",
+        name,
+        "--base",
+        "--output",
+        "json",
+    ], { env })));
+    if (matches(observed.policy)) {
+        if (verify) {
+            if (observed.active_version !== observed.version ||
+                observed.status !== "effective")
+                throw Error("The selected network policy has not become effective in the runtime.");
+            await rm(pending);
+        }
+        return;
+    }
+    if (verify)
+        throw Error("The selected network policy was not confirmed. The installation remains unavailable.");
+    await writePrivate(base, JSON.stringify(update(observed.policy)));
+    await command(state.input.openshellCli, ["policy", "set", name, "--gateway", name, "--policy", base], { env });
+}

package/scripts/deployment/policy.js

@@ -4,7 +4,8 @@ import { parseDocument } from "yaml";
 import { z } from "zod";
 import { LocalSetupError } from "./process.js";
 import { ensurePrivateFile } from "./state.js";
-export function initialRuntimePolicy(source, models, connections) {
+import { publicWebPolicy, publicWebEndpointConstraints } from "./public-web.js";
+export function initialRuntimePolicy(source, models, connections, publicWeb = false) {
     const document = parseDocument(source);
     if (document.errors.length || document.warnings.length)
         throw new LocalSetupError("invalid_runtime_policy", "The shipped runtime policy is invalid.");
@@ -17,6 +18,7 @@ export function initialRuntimePolicy(source, models, connections) {
     return {
         ...parsed.data,
         network_policies: {
+            ...(publicWeb ? { public_web: publicWebPolicy(true) } : {}),
             ...(connections
                 ? {
                     connections_broker: {
@@ -25,6 +27,7 @@ export function initialRuntimePolicy(source, models, connections) {
                             {
                                 host: connections.network.host,
                                 port: connections.network.port,
+                                ...publicWebEndpointConstraints(connections.network.port, publicWeb),
                                 tls: "skip",
                             },
                         ],
@@ -40,6 +43,7 @@ export function initialRuntimePolicy(source, models, connections) {
                             {
                                 host: models.network.host,
                                 port: models.network.port,
+                                ...publicWebEndpointConstraints(models.network.port, publicWeb),
                                 tls: "skip",
                             },
                         ],
@@ -50,7 +54,7 @@ export function initialRuntimePolicy(source, models, connections) {
         },
     };
 }
-export async function prepareRuntimePolicy(directory, models, connections) {
-    const policy = initialRuntimePolicy(await readFile(new URL("../../deploy/openshell/policy.yaml", import.meta.url), "utf8"), models, connections);
+export async function prepareRuntimePolicy(directory, models, connections, publicWeb = false) {
+    const policy = initialRuntimePolicy(await readFile(new URL("../../deploy/openshell/policy.yaml", import.meta.url), "utf8"), models, connections, publicWeb);
     await ensurePrivateFile(join(directory, "private/runtime-policy.json"), JSON.stringify(policy));
 }

package/scripts/deployment/prepare.js

@@ -93,7 +93,7 @@ export async function prepareLocal(directoryInput, inputValue, capabilities) {
         : 0), null, 2));
     await prepareModelCredential(directory, state);
     const models = await prepareInitialModels(directory, input.models);
-    await prepareRuntimePolicy(directory, models, connectionsEndpoint);
+    await prepareRuntimePolicy(directory, models, connectionsEndpoint, state.input.publicWeb);
     await withPreparedDatabase(directory, state, async (pool, runtimeUrl) => {
         const store = new PostgresAccessStore(pool, await readFile(join(privateDirectory, "encryption.key")), {
             issuer: input.team.issuer,

package/scripts/deployment/public-web.js

@@ -0,0 +1,222 @@
+import { isDeepStrictEqual } from "node:util";
+import { z } from "zod";
+import { LocalSetupError } from "./process.js";
+// Public unicast ranges, excluding private and special-use destinations.
+// Keep aligned with the browser egress boundary in deploy/execution/network/squid.conf.
+export const publicWebAddresses = [
+    "1.0.0.0/8",
+    "2.0.0.0/7",
+    "4.0.0.0/6",
+    "8.0.0.0/7",
+    "11.0.0.0/8",
+    "12.0.0.0/6",
+    "16.0.0.0/4",
+    "32.0.0.0/3",
+    "64.0.0.0/3",
+    "96.0.0.0/6",
+    "100.0.0.0/10",
+    "100.128.0.0/9",
+    "101.0.0.0/8",
+    "102.0.0.0/7",
+    "104.0.0.0/5",
+    "112.0.0.0/5",
+    "120.0.0.0/6",
+    "124.0.0.0/7",
+    "126.0.0.0/8",
+    "128.0.0.0/3",
+    "160.0.0.0/5",
+    "168.0.0.0/8",
+    "169.0.0.0/9",
+    "169.128.0.0/10",
+    "169.192.0.0/11",
+    "169.224.0.0/12",
+    "169.240.0.0/13",
+    "169.248.0.0/14",
+    "169.252.0.0/15",
+    "169.255.0.0/16",
+    "170.0.0.0/7",
+    "172.0.0.0/12",
+    "172.32.0.0/11",
+    "172.64.0.0/10",
+    "172.128.0.0/9",
+    "173.0.0.0/8",
+    "174.0.0.0/7",
+    "176.0.0.0/4",
+    "192.0.1.0/24",
+    "192.0.3.0/24",
+    "192.0.4.0/22",
+    "192.0.8.0/21",
+    "192.0.16.0/20",
+    "192.0.32.0/19",
+    "192.0.64.0/18",
+    "192.0.128.0/17",
+    "192.1.0.0/16",
+    "192.2.0.0/15",
+    "192.4.0.0/14",
+    "192.8.0.0/13",
+    "192.16.0.0/12",
+    "192.32.0.0/11",
+    "192.64.0.0/12",
+    "192.80.0.0/13",
+    "192.88.0.0/18",
+    "192.88.64.0/19",
+    "192.88.96.0/23",
+    "192.88.98.0/24",
+    "192.88.100.0/22",
+    "192.88.104.0/21",
+    "192.88.112.0/20",
+    "192.88.128.0/17",
+    "192.89.0.0/16",
+    "192.90.0.0/15",
+    "192.92.0.0/14",
+    "192.96.0.0/11",
+    "192.128.0.0/11",
+    "192.160.0.0/13",
+    "192.169.0.0/16",
+    "192.170.0.0/15",
+    "192.172.0.0/14",
+    "192.176.0.0/12",
+    "192.192.0.0/10",
+    "193.0.0.0/8",
+    "194.0.0.0/7",
+    "196.0.0.0/7",
+    "198.0.0.0/12",
+    "198.16.0.0/15",
+    "198.20.0.0/14",
+    "198.24.0.0/13",
+    "198.32.0.0/12",
+    "198.48.0.0/15",
+    "198.50.0.0/16",
+    "198.51.0.0/18",
+    "198.51.64.0/19",
+    "198.51.96.0/22",
+    "198.51.101.0/24",
+    "198.51.102.0/23",
+    "198.51.104.0/21",
+    "198.51.112.0/20",
+    "198.51.128.0/17",
+    "198.52.0.0/14",
+    "198.56.0.0/13",
+    "198.64.0.0/10",
+    "198.128.0.0/9",
+    "199.0.0.0/8",
+    "200.0.0.0/7",
+    "202.0.0.0/8",
+    "203.0.0.0/18",
+    "203.0.64.0/19",
+    "203.0.96.0/20",
+    "203.0.112.0/24",
+    "203.0.114.0/23",
+    "203.0.116.0/22",
+    "203.0.120.0/21",
+    "203.0.128.0/17",
+    "203.1.0.0/16",
+    "203.2.0.0/15",
+    "203.4.0.0/14",
+    "203.8.0.0/13",
+    "203.16.0.0/12",
+    "203.32.0.0/11",
+    "203.64.0.0/10",
+    "203.128.0.0/9",
+    "204.0.0.0/6",
+    "208.0.0.0/4",
+    "2000::/16",
+    "2001:200::/23",
+    "2001:400::/22",
+    "2001:800::/22",
+    "2001:c00::/24",
+    "2001:d00::/25",
+    "2001:d80::/27",
+    "2001:da0::/28",
+    "2001:db0::/29",
+    "2001:db9::/32",
+    "2001:dba::/31",
+    "2001:dbc::/30",
+    "2001:dc0::/26",
+    "2001:e00::/23",
+    "2001:1000::/20",
+    "2001:2000::/19",
+    "2001:4000::/18",
+    "2001:8000::/17",
+    "2003::/16",
+    "2004::/14",
+    "2008::/13",
+    "2010::/12",
+    "2020::/11",
+    "2040::/10",
+    "2080::/9",
+    "2100::/8",
+    "2200::/7",
+    "2400::/6",
+    "2800::/5",
+    "3000::/5",
+    "3800::/6",
+    "3c00::/7",
+    "3e00::/8",
+    "3f00::/9",
+    "3f80::/10",
+    "3fc0::/11",
+    "3fe0::/12",
+    "3ff0::/13",
+    "3ff8::/14",
+    "3ffc::/15",
+    "3ffe::/16",
+    "3fff:1000::/20",
+    "3fff:2000::/19",
+    "3fff:4000::/18",
+    "3fff:8000::/17",
+];
+export function publicWebPolicy(enabled) {
+    return enabled
+        ? {
+            name: "Public web",
+            endpoints: [
+                { ports: [80, 443], allowed_ips: publicWebAddresses, tls: "skip" },
+            ],
+            binaries: [{ path: "/**" }],
+        }
+        : null;
+}
+/** OpenShell requires overlapping endpoints to have identical IP constraints. */
+export function publicWebEndpointConstraints(port, enabled) {
+    return enabled && (port === 80 || port === 443)
+        ? { allowed_ips: publicWebAddresses }
+        : {};
+}
+const managedRuleSchema = z.looseObject({
+    endpoints: z.array(z.looseObject({
+        port: z.number(),
+        allowed_ips: z.array(z.string()).optional(),
+    })),
+});
+/** Compose managed service rules with public web without broadening private access. */
+export function composePublicWebRules(rules) {
+    const enabled = rules.public_web !== undefined;
+    const result = { ...rules };
+    for (const key of ["connections_broker", "model_gateway"]) {
+        const rule = result[key];
+        if (rule === undefined)
+            continue;
+        const parsed = managedRuleSchema.safeParse(rule);
+        if (!parsed.success)
+            throw new LocalSetupError("invalid_runtime_policy", "A managed service network rule has been edited into an unsupported shape. Review its policy before changing public web access.");
+        result[key] = {
+            ...parsed.data,
+            endpoints: parsed.data.endpoints.map((endpoint) => {
+                if (endpoint.port !== 80 && endpoint.port !== 443)
+                    return endpoint;
+                const managed = isDeepStrictEqual(endpoint.allowed_ips, publicWebAddresses);
+                if (enabled && endpoint.allowed_ips?.length && !managed)
+                    throw new LocalSetupError("invalid_runtime_policy", "Public web overlaps a managed service's custom IP restrictions on port 80 or 443. Keep public web off or reconcile those restrictions explicitly.");
+                if (!enabled && !managed)
+                    return endpoint;
+                const { allowed_ips: _previous, ...rest } = endpoint;
+                return {
+                    ...rest,
+                    ...publicWebEndpointConstraints(endpoint.port, enabled),
+                };
+            }),
+        };
+    }
+    return result;
+}

package/scripts/installation/command.js

@@ -94,7 +94,7 @@ export function installationCommand(observation) {
                 });
                 const directory = await resolveLocation(options);
                 const result = await progress("Deleting installation", (signal) => deleteInstallation(directory, signal), program.opts());
-                output(result, "Installation deleted from Docker. You can now remove its installation folder.");
+                output(result, "Installation deleted from Docker. The local folder still contains configuration and credentials. To install again, move or remove that folder, or configure a new --directory.");
                 return;
             }
             if (options.confirmDelete !== undefined || options.acceptDataLoss)

package/scripts/installation/configuration.js

@@ -65,6 +65,7 @@ export const installationSchema = z
         }),
     ]),
     resources: z.strictObject({ runtime: resources }),
+    publicWeb: z.boolean().default(false),
     browser: z.strictObject({ enabled: z.boolean() }),
     models: z.discriminatedUnion("mode", [
         externalLiteLlmSchema,

package/scripts/installation/configure.js

@@ -117,6 +117,7 @@ export async function configurationChanges(before, after) {
     return {
         models: !isDeepStrictEqual(await models(before), await models(after)),
         connections: !isDeepStrictEqual(before.connections, after.connections),
+        publicWeb: before.publicWeb !== after.publicWeb,
         packs: !isDeepStrictEqual(await packs(before), await packs(after)),
     };
 }

package/scripts/installation/installer/collect.js

@@ -175,6 +175,21 @@ export async function collectInstallation(ui, options, retained) {
                     case "resources":
                         config.resources = await collectResources(ui, config.resources);
                         break;
+                    case "public-web":
+                        config.publicWeb =
+                            (await ui.select("Public web access", [
+                                {
+                                    value: "on",
+                                    label: "On",
+                                    hint: "Public HTTP(S); agents can send team data to public services",
+                                },
+                                {
+                                    value: "off",
+                                    label: "Off",
+                                    hint: "Only configured services and explicit policies",
+                                },
+                            ], config.publicWeb ? "on" : "off")) === "on";
+                        break;
                     case "browser":
                         ui.note("Explicit browser node use works. Ordinary model-selected browsing is not qualified because of an upstream routing issue.", "Experimental browser");
                         config.browser.enabled =

package/scripts/installation/installer/menu.js

@@ -25,6 +25,7 @@ export function installationMenu(config, directory, browserAvailable, packIssues
         row("exposure", "Network", config.exposure.mode === "local"
             ? "This computer"
             : config.exposure.applicationOrigin),
+        row("public-web", "Public web", config.publicWeb ? "On" : "Off", "HTTP(S) for agents and tools; private destinations blocked"),
         row("models", "Models", modelSummary ?? "Choose a model"),
         row("connections", "Connections", config.connections.mode === "disabled" ? "Off" : "On"),
         row("packs", "Packs", packIssues.length
@@ -42,7 +43,7 @@ export function installationMenu(config, directory, browserAvailable, packIssues
     ];
     return existing
         ? [
-            ...choices.filter(({ value }) => ["review", "models", "connections", "packs"].includes(value)),
+            ...choices.filter(({ value }) => ["review", "models", "connections", "packs", "public-web"].includes(value)),
             { value: "model-credentials", label: "Change LLM API keys" },
         ]
         : choices;

package/scripts/installation/installer/prompts.js

@@ -95,7 +95,7 @@ export async function progress(message, work, options = {}) {
     const report = (detail) => {
         if (spinner && detail.includes("\n")) {
             spinner.stop(message);
-            process.stderr.write(detail + "\n");
+            clack.log.info(detail, { output: process.stderr });
             spinner.start(message);
         }
         else if (spinner)

package/scripts/installation/installer/run.js

@@ -193,6 +193,18 @@ export async function runConfiguration(options, observeMode) {
                     throw error;
             }
         }
+        if (existing && state) {
+            try {
+                await access(join(state, "prepared.json"));
+            }
+            catch (error) {
+                if (!(error instanceof Error &&
+                    "code" in error &&
+                    error.code === "ENOENT"))
+                    throw error;
+                throw new InstallationError("invalid_configuration", `This folder retains settings but the installation is no longer prepared. If deletion failed, finish it with clawscarf stop --directory ${quote(options.directory ?? defaultInstallationDirectory)} --delete. After successful deletion, move or remove the installation folder before configuring it again, or choose a new --directory.`);
+            }
+        }
         observeMode?.(existing ? "edit" : "new");
         let result = existing && state
             ? await editInstallationSettings(state, ui, options)
@@ -219,14 +231,17 @@ export async function runConfiguration(options, observeMode) {
                     : undefined;
             if (result.state === "cancelled")
                 clack.cancel("Cancelled.");
-            else
+            else {
+                if ("ready" in result && result.ready)
+                    ui.note(`clawscarf status --directory ${quote(options.directory ?? defaultInstallationDirectory)}\nclawscarf stop --directory ${quote(options.directory ?? defaultInstallationDirectory)}`, "Manage this installation");
                 clack.outro("ready" in result
                     ? result.ready
-                        ? `ClawScarf is ready.${applicationUrl ? ` Visit ${terminalLink(applicationUrl)}` : ""}\n\nManage this installation:\n  clawscarf status --directory ${quote(options.directory ?? defaultInstallationDirectory)}\n  clawscarf stop --directory ${quote(options.directory ?? defaultInstallationDirectory)}`
+                        ? `ClawScarf is ready.${applicationUrl ? ` Visit ${terminalLink(applicationUrl)}` : ""}`
                         : "ClawScarf needs attention. Check status for details."
                     : result.state === "unchanged"
                         ? "No changes. Server left as it was."
                         : "Configuration saved. Server stopped.");
+            }
             if ("ready" in result && result.ready && applicationUrl)
                 await ui.openBrowser(applicationUrl);
         }

package/scripts/installation/installer/settings.js

@@ -21,7 +21,7 @@ import { withInstallationLock, writePrivate } from "../../deployment/state.js";
 export async function editInstallationSettings(directory, ui, options = {}, prerequisites = { host: checkHost, check: checkInstallationPrerequisites }) {
     directory = resolve(directory);
     if (options.recipe || options.cloudUrl)
-        throw new InstallationError("change_unsupported", "Existing installations keep their recipe, software release and login service. Change models, keys, Connections or packs instead.");
+        throw new InstallationError("change_unsupported", "Existing installations keep their recipe, software release and login service. Change models, keys, Connections, public web or packs instead.");
     if (options.nonInteractive && !options.yes)
         throw new InstallationError("invalid_configuration", "Changing an existing installation noninteractively requires --yes. The server may restart and deselected packs may be removed.");
     const task = (message, work) => progress(message, work, options);
@@ -114,6 +114,9 @@ export async function editInstallationSettings(directory, ui, options = {}, prer
                     `Connections: ${plan.changes.connections.to === "disabled" ? "Off" : "On"}`,
                 ]
                 : []),
+            ...(plan.scopes.publicWeb
+                ? [`Public web: ${plan.changes.publicWeb.to ? "On" : "Off"}`]
+                : []),
             ...(plan.scopes.packs
                 ? [`Packs: ${plan.changes.packs.selected.join(", ") || "None"}`]
                 : []),

package/scripts/installation/installer/summary.js

@@ -39,6 +39,7 @@ export async function installationSummary(config, inputs) {
         `Administrator: ${config.access.administratorName} · ${config.access.mode === "hosted" ? "ClawScarf login" : "Custom OIDC"}`,
         `Models: ${model}`,
         `Connections: ${config.connections.mode === "disabled" ? "Off" : "On"}`,
+        `Public web: ${config.publicWeb ? "On" : "Off"} (private destinations blocked)`,
         `Browser: ${config.browser.enabled ? "Experimental" : "Off"} · Packs: ${config.packs.flatMap((pack) => pack.members).join(", ") || "None"}`,
     ].join("\n");
 }

package/scripts/installation/options.js

@@ -36,6 +36,7 @@ export const selectionSchema = z.object({
     connections: z.boolean().optional(),
     connectionsCloudUrl: cloudUrlSchema.optional(),
     browser: z.boolean().optional(),
+    publicWeb: z.boolean().optional(),
     model: text.optional(),
     provider: text.optional(),
     reasoning: z.enum(["low", "medium", "high"]).optional(),
@@ -79,6 +80,8 @@ export function installationOptions(command) {
         .option("--connections-cloud-url <url>", "Use a separate Connections service")
         .option("--browser", "Enable experimental browser capability")
         .option("--no-browser", "Disable browser capability")
+        .option("--public-web", "Allow public HTTP(S) from agents and tools")
+        .option("--no-public-web", "Restrict runtime egress to configured services")
         .option("--model <id>", "Default model from the model catalog")
         .option("--provider <id>", "Model provider, for example openai or openrouter")
         .addOption(new Option("--reasoning <level>", "Model reasoning level").choices([
@@ -116,6 +119,7 @@ export async function selectedDraft(context, recipe, selections, inputs, retaine
             "modelGatewayKeyFile",
             "modelGatewayCaFile",
             "connections",
+            "publicWeb",
             "connectionsCloudUrl",
             "pack",
             "packs",
@@ -123,7 +127,7 @@ export async function selectedDraft(context, recipe, selections, inputs, retaine
             "packPython",
         ]);
         if (Object.entries(o).some(([key, value]) => value !== undefined && !mutable.has(key)))
-            invalid("Existing installations support changes to models, keys, Connections and packs only.");
+            invalid("Existing installations support changes to models, keys, Connections, public web and packs only.");
     }
     const config = structuredClone(retained ?? recipeConfiguration(context, recipe));
     if (o.name !== undefined)
@@ -136,6 +140,8 @@ export async function selectedDraft(context, recipe, selections, inputs, retaine
         config.resources.runtime.memory = o.memory;
     if (o.browser !== undefined)
         config.browser.enabled = o.browser;
+    if (o.publicWeb !== undefined)
+        config.publicWeb = o.publicWeb;
     if (o.connections !== undefined)
         config.connections.mode = o.connections ? "hosted" : "disabled";
     if (o.connectionsCloudUrl)

package/scripts/installation/recipes/definition.js

@@ -11,6 +11,7 @@ export const recipeSchema = z.strictObject({
     defaults: z.strictObject({
         resources: installationSchema.shape.resources,
         browser: installationSchema.shape.browser,
+        publicWeb: z.boolean().default(false),
         connections: z.strictObject({ enabled: z.boolean() }).optional(),
     }),
     models: z.strictObject({

package/scripts/installation/reconfigure.js

@@ -1,3 +1,5 @@
+import { publicWebPolicy } from "../deployment/public-web.js";
+import { stageNetworkPolicyChange } from "../deployment/network-policy.js";
 import { applyConnectionSettings } from "../deployment/connection-settings.js";
 import { readFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
@@ -41,8 +43,8 @@ export async function planSettingsChange(configFile, reapply) {
     const previousPacks = selectionSchema.parse(await readJson(join(directory, "packs.json")));
     if (!desired.packSelection.python && previousPacks.python)
         desired.packSelection.python = previousPacks.python;
-    const { models: _oldModels, modelGateway: oldGateway, connections: oldConnections, ...oldFixed } = old;
-    const { models: _nextModels, modelGateway: nextGateway, connections: nextConnections, ...nextFixed } = next;
+    const { models: _oldModels, modelGateway: oldGateway, connections: oldConnections, publicWeb: oldPublicWeb, ...oldFixed } = old;
+    const { models: _nextModels, modelGateway: nextGateway, connections: nextConnections, publicWeb: nextPublicWeb, ...nextFixed } = next;
     if (!isDeepStrictEqual(oldFixed, nextFixed) ||
         !isDeepStrictEqual(await readJson(join(directory, "release.json")), desired.release))
         unsupported("Settings changes cannot replace the release, identity, addresses, access, resources or execution protection.");
@@ -92,6 +94,7 @@ export async function planSettingsChange(configFile, reapply) {
         scopes,
         reapply,
         changes: {
+            publicWeb: { from: oldPublicWeb, to: nextPublicWeb },
             models: modelConfiguration
                 ? {
                     enabled: modelConfiguration.models
@@ -235,6 +238,11 @@ export async function reconfigureInstallation(configFile, expectedFingerprint, r
             if (scopes.connections &&
                 (state.input.connections || desired.input.connections))
                 await applyConnectionSettings(directory, { ...state, input: desired.input }, checked.previousEndpoint, desired.connectorCredentialFile);
+            stage = "public web policy";
+            if (scopes.publicWeb)
+                await stageNetworkPolicyChange(directory, state, {
+                    public_web: publicWebPolicy(desired.input.publicWeb),
+                });
             stage = "accepted settings";
             if (scopes.models)
                 await writePrivate(join(directory, "private/model-bootstrap.json"), JSON.stringify(models));

package/scripts/installation/resolve.js

@@ -73,6 +73,7 @@ export async function resolveInstallation(configFile, internalPorts) {
         name: config.name,
         administratorName: access.administratorName,
         runtimeImage: release.images.gateway,
+        publicWeb: config.publicWeb,
         companionImage: release.images.companion,
         ...(config.browser.enabled ? { relayImage: release.images.relay } : {}),
         openshellCli: cli,

package/scripts/installation/setup.js

@@ -57,6 +57,7 @@ export function recipeConfiguration(context, recipeId) {
         },
         resources: structuredClone(recipe.defaults.resources),
         browser: structuredClone(recipe.defaults.browser),
+        publicWeb: recipe.defaults.publicWeb,
         connections: {
             mode: recipe.defaults.connections?.enabled ? "hosted" : "disabled",
             cloudUrl: context.cloudUrl,

package/scripts/release/definition.js

@@ -55,6 +55,15 @@ export const releaseSchema = z.strictObject({
         }),
     }),
 });
+/** Published manifests must work without checkout-local images or executables. */
+export function assertPublishedRuntime(runtime) {
+    if (JSON.stringify(runtime.images).includes('"sha256:') ||
+        runtime.platforms.some((platform) => {
+            const tools = releaseTools(runtime, platform);
+            return !tools.cli.url || !tools.gateway.url;
+        }))
+        throw Error("Published runtimes require registry digests and downloadable tools.");
+}
 /** Single-platform development bundles and multi-platform published bundles share resolution. */
 export function releaseTools(release, platform = `${process.platform}-${process.arch}`) {
     const host = hostPlatformSchema.parse(platform);

package/scripts/deployment/connection-policy.js

@@ -1,80 +0,0 @@
-import { isDeepStrictEqual } from "node:util";
-import { readFile, rm } from "node:fs/promises";
-import { join } from "node:path";
-import { z } from "zod";
-import { run } from "./process.js";
-import { resourceNames, writePrivate } from "./state.js";
-import { runtimeManager } from "./runtime.js";
-const ruleSchema = z.object({
-    name: z.string(),
-    endpoints: z.array(z.object({ host: z.string(), port: z.number(), tls: z.string() })),
-    binaries: z.array(z.object({ path: z.string() })),
-});
-const policySchema = z.looseObject({
-    network_policies: z.record(z.string(), z.unknown()),
-});
-/** Apply only the explicitly selected broker rule; never regenerate an operator's other policies. */
-export async function applyConnectionPolicy(directory, state, env, verify = false) {
-    const pending = join(directory, "private/connection-policy-change.json");
-    let text;
-    try {
-        text = await readFile(pending, "utf8");
-    }
-    catch (error) {
-        if (error instanceof Error && "code" in error && error.code === "ENOENT")
-            return;
-        throw error;
-    }
-    const change = z
-        .strictObject({
-        ownerId: z.literal(state.ownerId),
-        rule: ruleSchema.nullable(),
-    })
-        .parse(JSON.parse(text));
-    const base = join(directory, "private/runtime-policy.json");
-    const update = (policy) => {
-        if (change.rule)
-            policy.network_policies.connections_broker = change.rule;
-        else
-            delete policy.network_policies.connections_broker;
-        return policy;
-    };
-    const matches = (rule) => {
-        if (change.rule === null)
-            return rule === undefined;
-        const parsed = ruleSchema.safeParse(rule);
-        return parsed.success && isDeepStrictEqual(parsed.data, change.rule);
-    };
-    const name = resourceNames(state).sandbox;
-    if (!(await runtimeManager(directory, state, env, run).recorded()).receipt) {
-        if (verify)
-            throw Error("The configured runtime has not been recorded.");
-        await writePrivate(base, JSON.stringify(update(policySchema.parse(JSON.parse(await readFile(base, "utf8"))))));
-        return;
-    }
-    const observed = z
-        .object({
-        sandbox: z.literal(name),
-        policy_source: z.literal("sandbox"),
-        policy: policySchema,
-    })
-        .parse(JSON.parse(await run(state.input.openshellCli, [
-        "policy",
-        "get",
-        name,
-        "--gateway",
-        name,
-        "--base",
-        "--output",
-        "json",
-    ], { env })));
-    if (matches(observed.policy.network_policies.connections_broker)) {
-        if (verify)
-            await rm(pending);
-        return;
-    }
-    if (verify)
-        throw Error("The Connections network permission was not confirmed. The installation remains unavailable.");
-    await writePrivate(base, JSON.stringify(update(observed.policy)));
-    await run(state.input.openshellCli, ["policy", "set", name, "--gateway", name, "--policy", base], { env });
-}