Merge pull request #13 from rhdh-parasol/fix/fullsend-claude-exe-policy

fix(fullsend): allow Claude Code Vertex authentication

Author: kadel

.fullsend/rhdh/harness/review.yaml

@@ -1,4 +1,6 @@
 base: https://raw.githubusercontent.com/fullsend-ai/agents/4bbe4f50ed8e33c60539eaa30ddc320edf8bcda0/harness/review.yaml#sha256=08456e534c7d1251b3a3b2bc1236643403809ecab27832c273764769f219a45b
+image: ghcr.io/redhat-developer/rhdh-fullsend-code:latest
+policy: rhdh/policies/review.yaml
 skills:
   - skills/e2e-failure-analysis
   - skills/playwright-trace

.fullsend/rhdh/policies/code.yaml

@@ -47,6 +47,8 @@ network_policies:
         access: read-write
     binaries:
       - path: "**/claude"
+      # Claude Code 2.1+ ships the bun compile as claude.exe; **/claude does not match it.
+      - path: "**/claude.exe"
       - path: "**/node"
 
   github_api:

.fullsend/rhdh/policies/e2e-triage.yaml

@@ -36,6 +36,8 @@ network_policies:
         access: read-write
     binaries:
       - path: "**/claude"
+      # Claude Code 2.1+ ships the bun compile as claude.exe; **/claude does not match it.
+      - path: "**/claude.exe"
       - path: "**/node"
 
   github_api:

.fullsend/rhdh/policies/review.yaml

@@ -0,0 +1,66 @@
+---
+version: 1
+
+# Sandbox policy for the review agent.
+#
+# Forked from fullsend-ai/agents policies/review.yaml so we can allowlist
+# Claude Code's bun binary (claude.exe). **/claude does not match claude.exe,
+# which is what 2.1+ uses to call sts.googleapis.com for Vertex.
+#
+# Read-only agent: needs GitHub API (gh pr view, gh pr diff, gh issue view)
+# and Vertex AI for inference. No write access to GitHub — the post-script
+# handles mutations on the runner with a separate write-scoped token.
+
+filesystem_policy:
+  include_workdir: true
+  read_only: [/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log]
+  read_write: [/sandbox, /tmp, /dev/null]
+landlock:
+  compatibility: best_effort
+process:
+  run_as_user: sandbox
+  run_as_group: sandbox
+
+network_policies:
+  vertex_ai:
+    name: vertex-ai
+    endpoints:
+      - host: "api.anthropic.com"
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        access: read-write
+      - host: "*.googleapis.com"
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        access: read-write
+    binaries:
+      - path: "**/claude"
+      - path: "**/claude.exe"
+      - path: "**/node"
+
+  github_api:
+    name: github-api
+    endpoints:
+      - host: "api.github.com"
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        access: read-only
+      # gh CLI uses POST /graphql for reads; protocol: graphql allows
+      # queries but blocks mutations at the AST level
+      - host: "api.github.com"
+        port: 443
+        protocol: graphql
+        enforcement: enforce
+        access: read-only
+        path: "/graphql"
+      - host: "github.com"
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        access: read-only
+    binaries:
+      - path: "**/gh"
+      - path: "**/node"