tls: terminate policy field emits repeated deprecation warnings on every sandbox start instead of erroring or auto-migrating
Open
@lunarwhite is already working on this.
Since Sep 15, 2026.
state:accepted
- Dominant language
- Rust
- Stars
- 8.7k
- Forks
- 1.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 253
Description
Summary
The default/generated sandbox policy for network_policies (claude_code, github, github_rest_api) uses tls: terminate, which is now deprecated in favor of automatic TLS termination ("TLS termination is now automatic. Use 'tls: skip' to disable."). This produces 3 MED-severity warnings on every single sandbox start.
Expected
Either the policy generator/template should be updated to stop emitting tls: terminate by default, or openshell policy should offer a migration command to rewrite existing policies.
Logs
[sandbox] [OCSF] CONFIG:VALIDATION warning: claude_code.endpoints[0]: 'tls: terminate' is deprecated...
(repeated for github.endpoints[0], github_rest_api.endpoints[0])
openshell version: 0.0.116
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.