Repository navigation
feat: include runtime policy revisions in sandbox get output #837
Description
Summary
openshell sandbox get <name> returns the immutable baseline policy from sandbox creation time. Network policies added post-creation via openshell policy set are stored in the sandbox_policies runtime table but are not reflected in sandbox get output.
This forces downstream tools (NemoClaw) to call both sandbox get and policy get --full and stitch the output together to show users the actual enforced policy.
Request
Add an option to openshell sandbox get that includes the live runtime policy revisions in the output. For example:
openshell sandbox get <name> --include-runtime-policy
Or always include the latest runtime policy in the output alongside the baseline.
Context
- NemoClaw PR fix(gateway): gate unsafe auth deployment modes #1871 works around this by parsing
sandbox getoutput, finding thePolicy:section, and replacing it withpolicy get --fulloutput. - This works but is fragile — it depends on the exact output format of
sandbox get. - A first-class flag would eliminate the workaround and prevent breakage if the output format changes.
Related
Metadata
Metadata
Assignees
Labels
No labels
Activity
johntmyers commentedon Apr 15, 2026
Since we already have a way to retrieve an arbitrary rev of a policy, we should just make sure
openshell sandbox get ...always returns the currently running effectively policy. We should also update the metadata to signal if the policy is for the specific sandbox or coming from a global policy (which will override a sandbox policy). Additionally, we should explore a flag that delivers only the YAML of the running policy so it's easier to extract vs always having to parse the metadata + policy body.