fix(policy): disclose full messaging-preset egress before channels apply

ci/test-file-size-budget.json

@@ -10,6 +10,6 @@
     "test/nemoclaw-start.test.ts": 4826,
     "test/onboard-messaging.test.ts": 2049,
     "test/onboard-selection.test.ts": 4769,
-    "test/policies.test.ts": 1531
+    "test/policies.test.ts": 1530
   }
 }

docs/reference/commands.mdx

@@ -411,6 +411,7 @@ Three tiers are available:
 After selecting a tier, the wizard shows a combined preset and access-mode screen where you can include or exclude individual presets and toggle each between read and read-write access.
 For details on tiers and the presets each includes, refer to [Network Policies](network-policies#policy-tiers).
 When you finish the policy step, NemoClaw records the finalized built-in preset selection for that sandbox.
+When onboarding creates or recreates a sandbox with presets, NemoClaw prints the exact finalized create-time policy scope before registering providers or creating the sandbox.
 Later re-onboard runs seed from that finalized selection, so presets you intentionally removed stay removed unless you select them again or override the policy mode.
 
 In non-interactive mode, set the tier with `NEMOCLAW_POLICY_TIER` (default: `balanced`):
@@ -1640,6 +1641,8 @@ Do not pass `--raw` output to `openshell policy set` because the metadata header
 Add a policy preset to a sandbox.
 Presets extend the baseline network policy with additional endpoints.
 Before applying, the command shows which endpoints the preset would open and prompts for confirmation.
+The scope comes from the exact preset YAML and includes each endpoint's host, port, access, protocol, TLS, and enforcement settings, allowed methods and paths, and binary allowlist.
+When a lifecycle operation reapplies a preset, NemoClaw compares it with the live policy and reports whether the preset opens new egress, replaces a drifted entry, or is already effective with no new egress.
 
 ```bash
 $$nemoclaw my-assistant policy-add
@@ -1846,6 +1849,9 @@ The operation is idempotent.
 Channel names are trimmed and lowercased before NemoClaw stores credentials, names bridge providers, or prints rebuild messages.
 NemoClaw requires the matching built-in network policy preset YAML to be present.
 A missing or malformed preset YAML (no `network_policies:` section) aborts `channels add` before any token prompt, registry write, or rebuild prompt.
+After validating that preset, NemoClaw discloses its effect before prompting for credentials or changing gateway or registry state.
+It prints the exact effective egress scope when the preset would open or replace access, or reports that no new egress would be opened when the preset is already effective.
+The `--dry-run` path prints the same disclosure without collecting credentials or applying changes.
 With the preset file in place, NemoClaw applies it to the sandbox before the rebuild so the bridge has egress to its upstream API.
 When the apply step itself fails after the registry write on a fresh add, NemoClaw attempts to roll back the bridge providers, the `messagingChannels` entry, and any staged environment credentials, then exits without prompting for a rebuild; if any gateway-side step (provider detach or delete) fails the rollback continues and prints a `Rollback could not fully clean <surfaces>` warning so the operator can clean up manually.
 When the same failure happens on a re-add of an already-enabled channel, NemoClaw restores the prior `messagingChannels` entry, restores staged environment credentials when available, restores registry credential hashes, and attempts to re-upsert the prior bridge providers, but flags `gateway-providers` as residual because the in-flight upsert may have left the gateway with the new token; verify the gateway bridge before relying on the channel.
@@ -1917,6 +1923,7 @@ Use `channels stop` instead of `channels remove` when you want to pause a bridge
 
 Re-enable a channel previously paused with `channels stop`. The channel is removed from the disabled list, the sandbox is rebuilt, and the bridge registers with the gateway again using the stored credentials.
 Before the rebuild, NemoClaw reapplies the matching built-in network policy preset so the restored bridge has egress to its upstream API.
+Before updating the disabled list or applying the policy, NemoClaw prints the exact effective egress scope when the preset would open or replace access, or reports that no new egress would be opened when the preset is already effective.
 If policy restoration fails, NemoClaw rolls the channel back to disabled and exits without rebuilding into a partially active state.
 
 ```bash
@@ -2460,6 +2467,7 @@ Upgrade a sandbox to the current agent version while preserving workspace state.
 The command backs up workspace state, destroys the old sandbox (including its host-side Docker image), recreates it with the current image via `onboard --resume`, and restores workspace state into the new sandbox.
 Credentials are stripped from backups before storage.
 Policy presets applied to the old sandbox are reapplied to the new one so your egress rules survive the rebuild.
+Before creating the replacement sandbox, NemoClaw prints the finalized create-time policy scope whenever presets are included.
 The replacement uses the recorded compatible-endpoint reasoning mode and web search selection instead of ambient shell values.
 Rebuild preserves the recorded sandbox GPU enablement mode and, for an explicitly enabled sandbox, its recorded device selector.
 It re-resolves the Docker-driver GPU route from the current host and current `NEMOCLAW_DOCKER_GPU_PATCH` value, so native-only, explicitly authorized native-with-fallback, and compatibility-only routing may differ from the original onboarding run.

src/lib/actions/sandbox/policy-channel-conflict.test.ts

@@ -234,6 +234,7 @@ let getDisabledChannelsMock: MockInstance;
 let listSandboxesMock: MockInstance;
 let rebuildSandboxMock: MockInstance;
 let ensureMessagingHostForwardAfterRebuildMock: MockInstance;
+let scopeDisclosureMock: MockInstance;
 
 function arrangeRegistry(opts: { current: SandboxEntry; others?: SandboxEntry[] }): void {
   const all = [opts.current, ...(opts.others ?? [])];
@@ -330,6 +331,10 @@ beforeEach(() => {
   vi.spyOn(policy, "loadPreset").mockReturnValue("network_policies:\n  stub: {}\n");
   vi.spyOn(policy, "parsePresetPolicyKeys").mockReturnValue(["stub"]);
   vi.spyOn(policy, "listPresets").mockReturnValue([]);
+  vi.spyOn(policy, "getPresetContentGatewayState").mockReturnValue("absent");
+  scopeDisclosureMock = vi
+    .spyOn(policy, "logPresetScopeForState")
+    .mockImplementation(() => undefined);
   applyPresetMock = vi.spyOn(policy, "applyPreset").mockReturnValue(true);
   vi.spyOn(policy, "getAppliedPresets").mockReturnValue([]);
 
@@ -1061,7 +1066,9 @@ describe("Teams host-forward lifecycle (PRA-2)", () => {
 
     await startSandboxChannel("alpha", { channel: "teams" });
 
-    expect(applyPresetMock).toHaveBeenCalledWith("alpha", "teams");
+    expect(applyPresetMock).toHaveBeenCalledWith("alpha", "teams", {
+      disclosedPresetState: "absent",
+    });
     expect(rebuildSandboxMock).toHaveBeenCalledWith("alpha", ["--yes"]);
     expect(applyPresetMock.mock.invocationCallOrder[0]).toBeLessThan(
       rebuildSandboxMock.mock.invocationCallOrder[0],
@@ -1087,11 +1094,36 @@ describe("Teams host-forward lifecycle (PRA-2)", () => {
 
     await startSandboxChannel("alpha", { channel: "teams" });
 
-    expect(applyPresetMock).toHaveBeenCalledWith("alpha", "teams");
+    expect(applyPresetMock).toHaveBeenCalledWith("alpha", "teams", {
+      disclosedPresetState: "absent",
+    });
     expect(rebuildSandboxMock).not.toHaveBeenCalled();
     expect(loggedText()).toContain("Change queued");
   });
 
+  it("channels start discloses before dry-run return and before persisted-plan mutation (#7179)", async () => {
+    const current = makeTeamsEntry("alpha", { disabled: true });
+    arrangeRegistry({ current });
+    getDisabledChannelsMock.mockReturnValue(["teams"]);
+
+    await startSandboxChannel("alpha", { channel: "teams", dryRun: true });
+
+    expect(scopeDisclosureMock).toHaveBeenCalledOnce();
+    expect(updateSandboxMock).not.toHaveBeenCalled();
+    expect(applyPresetMock).not.toHaveBeenCalled();
+
+    scopeDisclosureMock.mockClear();
+    await startSandboxChannel("alpha", { channel: "teams" });
+
+    expect(scopeDisclosureMock).toHaveBeenCalledOnce();
+    expect(scopeDisclosureMock.mock.invocationCallOrder[0]).toBeLessThan(
+      updateSandboxMock.mock.invocationCallOrder[0],
+    );
+    expect(scopeDisclosureMock.mock.invocationCallOrder[0]).toBeLessThan(
+      applyPresetMock.mock.invocationCallOrder[0],
+    );
+  });
+
   it("channels start restores the disabled plan and skips rebuild when its policy preset fails", async () => {
     const current = makeTeamsEntry("alpha", { disabled: true });
     arrangeRegistry({ current });
@@ -1108,7 +1140,9 @@ describe("Teams host-forward lifecycle (PRA-2)", () => {
       "process.exit(1)",
     );
 
-    expect(applyPresetMock).toHaveBeenCalledWith("alpha", "teams");
+    expect(applyPresetMock).toHaveBeenCalledWith("alpha", "teams", {
+      disclosedPresetState: "absent",
+    });
     expect(registry.getDisabledChannels("alpha")).toContain("teams");
     expect(rebuildSandboxMock).not.toHaveBeenCalled();
     expect(loggedText()).toContain("channels start teams");

src/lib/actions/sandbox/policy-channel-policy.test.ts

@@ -101,13 +101,13 @@ beforeEach(() => {
   selectForRemovalMock = vi.spyOn(policies, "selectForRemoval").mockResolvedValue("pypi");
   vi.spyOn(policies, "loadPreset").mockImplementation((name: unknown) => {
     const presetName = String(name);
-    return `network_policies:\n  ${presetName}:\n    host: ${presetName}.example.com\n`;
+    return `network_policies:\n  ${presetName}:\n    name: ${presetName}\n    endpoints:\n      - host: ${presetName}.example.com\n        port: 443\n        protocol: rest\n        rules:\n          - allow: { method: GET, path: "/**" }\n`;
   });
   loadPresetForSandboxMock = vi
     .spyOn(policies, "loadPresetForSandbox")
     .mockImplementation((_sandboxName: unknown, name: unknown) => {
       const presetName = String(name);
-      return `network_policies:\n  ${presetName}:\n    host: ${presetName}.example.com\n`;
+      return `network_policies:\n  ${presetName}:\n    name: ${presetName}\n    endpoints:\n      - host: ${presetName}.example.com\n        port: 443\n        protocol: rest\n        rules:\n          - allow: { method: GET, path: "/**" }\n`;
     });
   applyPresetMock = vi.spyOn(policies, "applyPreset").mockReturnValue(true);
   removePresetMock = vi.spyOn(policies, "removePreset").mockReturnValue(true);
@@ -123,7 +123,9 @@ describe("addSandboxPolicy", () => {
     await addSandboxPolicy("test-sandbox");
 
     expect(promptMock).toHaveBeenCalledWith("  Apply 'pypi' to sandbox 'test-sandbox'? [Y/n]: ");
-    expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", "pypi");
+    expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", "pypi", {
+      suppressDisclosure: true,
+    });
   });
 
   it("skips applying an interactively selected preset when confirmation is declined", async () => {
@@ -140,15 +142,18 @@ describe("addSandboxPolicy", () => {
 
     expect(promptMock).not.toHaveBeenCalled();
     expect(applyPresetMock).not.toHaveBeenCalled();
-    expect(printedText()).toContain("Endpoints that would be opened: pypi.example.com");
+    expect(printedText()).toContain("Effective egress that would be opened:");
+    expect(printedText()).toContain("- pypi.example.com:443");
     expect(printedText()).toContain("--dry-run: no changes applied.");
   });
 
   it("accepts an explicit preset with --yes for headless use", async () => {
     await addSandboxPolicy("test-sandbox", { preset: "pypi", yes: true });
 
     expect(promptMock).not.toHaveBeenCalled();
-    expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", "pypi");
+    expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", "pypi", {
+      suppressDisclosure: true,
+    });
   });
 
   it("honors non-interactive mode when an explicit preset is provided", async () => {
@@ -157,7 +162,9 @@ describe("addSandboxPolicy", () => {
     await addSandboxPolicy("test-sandbox", { preset: "pypi" });
 
     expect(promptMock).not.toHaveBeenCalled();
-    expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", "pypi");
+    expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", "pypi", {
+      suppressDisclosure: true,
+    });
   });
 
   it("fails fast in non-interactive mode without an explicit preset", async () => {
@@ -242,7 +249,7 @@ describe("addSandboxPolicy", () => {
     expect(output).not.toContain("not supported for agent");
     expect(output).not.toContain("Channels supported by agent");
     expect(output).not.toContain("Preset not found");
-    expect(output).not.toContain("Endpoints that would be opened");
+    expect(output).not.toContain("Effective egress that would be opened");
     expect(promptMock).not.toHaveBeenCalled();
     expect(loadPresetForSandboxMock).not.toHaveBeenCalled();
     expect(applyPresetMock).not.toHaveBeenCalled();
@@ -275,7 +282,9 @@ describe("addSandboxPolicy", () => {
 
     expect(printedText()).toContain(expected);
     expect(printedText()).toContain(detail);
-    expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", preset);
+    expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", preset, {
+      suppressDisclosure: true,
+    });
   });
 
   it("prints Discord validation guidance when the preset name is provided", async () => {
@@ -284,15 +293,19 @@ describe("addSandboxPolicy", () => {
     expect(printedText()).toContain("curl is not in the preset binary allowlist");
     expect(printedText()).toContain("Node HTTPS");
     expect(promptMock).not.toHaveBeenCalled();
-    expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", "discord");
+    expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", "discord", {
+      suppressDisclosure: true,
+    });
   });
 
   it("does not print messaging guidance when a non-messaging preset is selected", async () => {
     await addSandboxPolicy("test-sandbox");
 
     expect(printedText()).not.toContain("only opens network egress to the");
     expect(printedText()).not.toContain("re-run 'nemoclaw onboard' and select");
-    expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", "pypi");
+    expect(applyPresetMock).toHaveBeenCalledWith("test-sandbox", "pypi", {
+      suppressDisclosure: true,
+    });
   });
 });
 

src/lib/actions/sandbox/policy-channel-refresh.test.ts

@@ -121,7 +121,9 @@ describe("addSandboxPolicy refresh contract", () => {
   it("refreshes the in-sandbox POLICY.md after a successful built-in apply", async () => {
     await addSandboxPolicy("alpha", { preset: "pypi", yes: true });
 
-    expect(applyPresetMock).toHaveBeenCalledWith("alpha", "pypi");
+    expect(applyPresetMock).toHaveBeenCalledWith("alpha", "pypi", {
+      suppressDisclosure: true,
+    });
     expect(refreshSpy).toHaveBeenCalledTimes(1);
     expect(refreshSpy).toHaveBeenCalledWith("alpha");
   });
@@ -149,7 +151,9 @@ describe("addSandboxPolicy refresh contract", () => {
       captureExit(() => addSandboxPolicy("alpha", { preset: "pypi", yes: true })),
     ).resolves.toBe(1);
 
-    expect(applyPresetMock).toHaveBeenCalledWith("alpha", "pypi");
+    expect(applyPresetMock).toHaveBeenCalledWith("alpha", "pypi", {
+      suppressDisclosure: true,
+    });
     expect(refreshSpy).not.toHaveBeenCalled();
   });
 

src/lib/actions/sandbox/policy-channel-remove-flow.test.ts

@@ -4,6 +4,7 @@
 import { afterEach, beforeEach, describe, expect, it, type MockInstance, vi } from "vitest";
 
 import * as policies from "../../policy";
+import * as runner from "../../runner";
 import * as registry from "../../state/registry";
 import { removeSandboxChannel, startSandboxChannel, stopSandboxChannel } from "./policy-channel";
 import { policyChannelDependencies } from "./policy-channel-dependencies";
@@ -56,23 +57,66 @@ describe("policy channel remove/enable flows", () => {
     expect(exitSpy).not.toHaveBeenCalled();
   });
 
-  it("supports start dry runs without applying a preset or persisting the enabled plan", async () => {
+  it("supports start dry runs without applying a preset or persisting the enabled plan, and discloses effective egress first (#7179)", async () => {
     vi.spyOn(registry, "getSandbox").mockReturnValue({ name: "alpha" });
     vi.spyOn(registry, "getConfiguredMessagingChannelsFromEntry").mockReturnValue(["telegram"]);
     vi.spyOn(registry, "getDisabledChannels").mockReturnValue(["telegram"]);
     const updateSandboxSpy = vi.spyOn(registry, "updateSandbox");
     const applyPresetSpy = vi.spyOn(policies, "applyPreset");
     const rebuildSpy = vi.spyOn(policyChannelDependencies, "rebuildSandbox");
+    vi.spyOn(runner, "runCapture").mockReturnValue("version: 1\nnetwork_policies: {}\n");
     await expect(
       startSandboxChannel("alpha", { channel: "telegram", dryRun: true }),
     ).resolves.toBeUndefined();
 
-    expect(logSpy.mock.calls.flat().join("\n")).toContain(
-      "--dry-run: would start channel 'telegram' for 'alpha'.",
+    const lines = logSpy.mock.calls.map((call) => call.map(String).join(" "));
+    const joined = lines.join("\n");
+    expect(joined).toContain("Effective egress that would be opened:");
+    expect(joined).toContain("- api.telegram.org:443 (protocol: rest, enforcement: enforce)");
+    const scopeHeader = lines.findIndex((line) =>
+      line.includes("Effective egress that would be opened:"),
     );
+    const wouldStart = lines.findIndex((line) => line.includes("--dry-run: would start channel"));
+    expect(scopeHeader).toBeGreaterThan(-1);
+    expect(wouldStart).toBeGreaterThan(scopeHeader);
     expect(applyPresetSpy).not.toHaveBeenCalled();
     expect(updateSandboxSpy).not.toHaveBeenCalled();
     expect(rebuildSpy).not.toHaveBeenCalled();
     expect(exitSpy).not.toHaveBeenCalled();
   });
+
+  it("does not claim new egress on a start dry run when the preset already matches the live policy (#7179)", async () => {
+    vi.spyOn(registry, "getSandbox").mockReturnValue({ name: "alpha" });
+    vi.spyOn(registry, "getConfiguredMessagingChannelsFromEntry").mockReturnValue(["telegram"]);
+    vi.spyOn(registry, "getDisabledChannels").mockReturnValue(["telegram"]);
+    const liveTelegramPolicy = [
+      "version: 1",
+      "network_policies:",
+      "  telegram_bot:",
+      "    name: telegram_bot",
+      "    endpoints:",
+      "      - host: api.telegram.org",
+      "        port: 443",
+      "        protocol: rest",
+      "        enforcement: enforce",
+      "        rules:",
+      "          - allow: { method: GET, path: '/bot*/**' }",
+      "          - allow: { method: POST, path: '/bot*/**' }",
+      "          - allow: { method: GET, path: '/file/bot*/**' }",
+      "    binaries:",
+      "      - { path: /usr/local/bin/node }",
+      "      - { path: /usr/bin/node }",
+      "",
+    ].join("\n");
+    vi.spyOn(runner, "runCapture").mockReturnValue(liveTelegramPolicy);
+
+    await expect(
+      startSandboxChannel("alpha", { channel: "telegram", dryRun: true }),
+    ).resolves.toBeUndefined();
+
+    const joined = logSpy.mock.calls.map((call) => call.map(String).join(" ")).join("\n");
+    expect(joined).not.toContain("Effective egress that would be opened:");
+    expect(joined).toContain("is already effective; no new egress would be opened.");
+    expect(exitSpy).not.toHaveBeenCalled();
+  });
 });