fix(policy): disclose full messaging-preset egress before channels apply

ci/test-file-size-budget.json

@@ -10,6 +10,6 @@
     "test/nemoclaw-start.test.ts": 4826,
     "test/onboard-messaging.test.ts": 2049,
     "test/onboard-selection.test.ts": 4769,
-    "test/policies.test.ts": 1531
+    "test/policies.test.ts": 1530
   }
 }

src/lib/actions/sandbox/policy-channel-policy.test.ts

@@ -101,13 +101,13 @@ beforeEach(() => {
   selectForRemovalMock = vi.spyOn(policies, "selectForRemoval").mockResolvedValue("pypi");
   vi.spyOn(policies, "loadPreset").mockImplementation((name: unknown) => {
     const presetName = String(name);
-    return `network_policies:\n  ${presetName}:\n    host: ${presetName}.example.com\n`;
+    return `network_policies:\n  ${presetName}:\n    name: ${presetName}\n    endpoints:\n      - host: ${presetName}.example.com\n        port: 443\n        protocol: rest\n        rules:\n          - allow: { method: GET, path: "/**" }\n`;
   });
   loadPresetForSandboxMock = vi
     .spyOn(policies, "loadPresetForSandbox")
     .mockImplementation((_sandboxName: unknown, name: unknown) => {
       const presetName = String(name);
-      return `network_policies:\n  ${presetName}:\n    host: ${presetName}.example.com\n`;
+      return `network_policies:\n  ${presetName}:\n    name: ${presetName}\n    endpoints:\n      - host: ${presetName}.example.com\n        port: 443\n        protocol: rest\n        rules:\n          - allow: { method: GET, path: "/**" }\n`;
     });
   applyPresetMock = vi.spyOn(policies, "applyPreset").mockReturnValue(true);
   removePresetMock = vi.spyOn(policies, "removePreset").mockReturnValue(true);
@@ -140,7 +140,8 @@ describe("addSandboxPolicy", () => {
 
     expect(promptMock).not.toHaveBeenCalled();
     expect(applyPresetMock).not.toHaveBeenCalled();
-    expect(printedText()).toContain("Endpoints that would be opened: pypi.example.com");
+    expect(printedText()).toContain("Effective egress that would be opened:");
+    expect(printedText()).toContain("- pypi.example.com:443");
     expect(printedText()).toContain("--dry-run: no changes applied.");
   });
 
@@ -242,7 +243,7 @@ describe("addSandboxPolicy", () => {
     expect(output).not.toContain("not supported for agent");
     expect(output).not.toContain("Channels supported by agent");
     expect(output).not.toContain("Preset not found");
-    expect(output).not.toContain("Endpoints that would be opened");
+    expect(output).not.toContain("Effective egress that would be opened");
     expect(promptMock).not.toHaveBeenCalled();
     expect(loadPresetForSandboxMock).not.toHaveBeenCalled();
     expect(applyPresetMock).not.toHaveBeenCalled();

src/lib/actions/sandbox/policy-channel-scope-disclosure.test.ts

@@ -0,0 +1,104 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { afterEach, beforeEach, describe, expect, it, type MockInstance, vi } from "vitest";
+
+import * as defs from "../../agent/defs";
+import * as policy from "../../policy";
+import * as registry from "../../state/registry";
+import { addSandboxChannel } from "./policy-channel";
+
+const WHATSAPP_PRESET = `preset:
+  name: whatsapp
+  description: "WhatsApp Web WebSocket and media"
+network_policies:
+  whatsapp:
+    name: whatsapp
+    endpoints:
+      - host: web.whatsapp.com
+        port: 443
+        access: full
+        tls: skip
+      - host: raw.githubusercontent.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: GET
+              path: "/WhiskeySockets/Baileys/master/src/Defaults/index.ts"
+    binaries:
+      - { path: /usr/local/bin/node }
+`;
+
+let exitMock: MockInstance;
+let logSpy: MockInstance;
+
+function agentFixture(name: string): defs.AgentDefinition {
+  return { name } as defs.AgentDefinition;
+}
+
+beforeEach(() => {
+  delete process.env.NEMOCLAW_NON_INTERACTIVE;
+  logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
+  vi.spyOn(console, "error").mockImplementation(() => undefined);
+  exitMock = vi.spyOn(process, "exit").mockImplementation(((code?: number) => {
+    throw new Error(`process.exit(${code})`);
+  }) as never);
+
+  vi.spyOn(registry, "getSandbox").mockReturnValue({ name: "sb-scope" });
+  vi.spyOn(defs, "loadAgent").mockReturnValue(agentFixture("openclaw"));
+  vi.spyOn(policy, "loadPresetForSandbox").mockReturnValue(WHATSAPP_PRESET);
+  vi.spyOn(policy, "parsePresetPolicyKeys").mockReturnValue(["whatsapp"]);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+function collectLogOutput(): string {
+  return (logSpy.mock.calls as unknown[][]).map((call) => call.map(String).join(" ")).join("\n");
+}
+
+describe("channels add --dry-run discloses effective preset egress before mutation (#7179)", () => {
+  it("prints every declared endpoint host with its port and mode", async () => {
+    await addSandboxChannel("sb-scope", { channel: "whatsapp", dryRun: true });
+
+    const output = collectLogOutput();
+    expect(output).toContain("Effective egress that would be opened:");
+    expect(output).toContain("- web.whatsapp.com:443 (access: full, tls: skip)");
+    expect(output).toContain(
+      "- raw.githubusercontent.com:443 (protocol: rest, enforcement: enforce)",
+    );
+  });
+
+  it("names the narrowly scoped Baileys version-fetch method and path, not just the host", async () => {
+    await addSandboxChannel("sb-scope", { channel: "whatsapp", dryRun: true });
+
+    const output = collectLogOutput();
+    expect(output).toMatch(
+      /allow:\s+GET\s+\/WhiskeySockets\/Baileys\/master\/src\/Defaults\/index\.ts/,
+    );
+  });
+
+  it("lists declared binaries alongside the endpoints", async () => {
+    await addSandboxChannel("sb-scope", { channel: "whatsapp", dryRun: true });
+
+    const output = collectLogOutput();
+    expect(output).toContain("binaries:");
+    expect(output).toContain("- /usr/local/bin/node");
+  });
+
+  it("emits the scope block before the 'would enable channel' summary", async () => {
+    await addSandboxChannel("sb-scope", { channel: "whatsapp", dryRun: true });
+
+    const lines = (logSpy.mock.calls as unknown[][]).map((call) => call.map(String).join(" "));
+    const scopeHeader = lines.findIndex((line) =>
+      line.includes("Effective egress that would be opened:"),
+    );
+    const wouldEnable = lines.findIndex((line) => line.includes("--dry-run: would enable channel"));
+    expect(scopeHeader).toBeGreaterThan(-1);
+    expect(wouldEnable).toBeGreaterThan(scopeHeader);
+    void exitMock;
+  });
+});

src/lib/actions/sandbox/policy-channel.ts

@@ -177,10 +177,7 @@ async function addSandboxPolicyUnlocked(
   const presetContent = policies.loadPresetForSandbox(sandboxName, answer);
   if (!presetContent) return;
 
-  const endpoints = policies.getPresetEndpoints(presetContent);
-  if (endpoints.length > 0) {
-    console.log(`  Endpoints that would be opened: ${endpoints.join(", ")}`);
-  }
+  policies.logPresetScope(presetContent);
 
   const presetWarning = policies.getPresetValidationWarning(answer);
   if (presetWarning) {
@@ -229,9 +226,10 @@ async function applyExternalPreset(
   }
   if (!loaded) return false;
 
-  const endpoints = policies.getPresetEndpoints(loaded.content);
-  if (endpoints.length > 0) {
-    console.log(`  [${loaded.presetName}] Endpoints that would be opened: ${endpoints.join(", ")}`);
+  const scopeLines = policies.renderPresetScope(loaded.content);
+  if (scopeLines.length > 0) {
+    console.log(`  [${loaded.presetName}]`);
+    for (const line of scopeLines) console.log(line);
     console.log(
       `  ${YW}Warning: custom preset targets are not vetted. Review hosts before applying.${R}`,
     );
@@ -974,6 +972,7 @@ async function addSandboxChannelUnlocked(
   }
 
   if (dryRun) {
+    policies.logPresetScope(presetContent);
     console.log(`  --dry-run: would enable channel '${canonical}' for '${sandboxName}'.`);
     return;
   }

src/lib/messaging/channels/whatsapp/policy/hermes.yaml

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 preset:
   name: whatsapp
-  description: "WhatsApp Web WebSocket and media access"
+  description: "WhatsApp Web WebSocket, media access, and a narrowly scoped Baileys protocol-version fetch from raw.githubusercontent.com"
 network_policies:
   whatsapp:
     name: whatsapp

src/lib/messaging/channels/whatsapp/policy/openclaw.yaml

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 preset:
   name: whatsapp
-  description: "WhatsApp Web WebSocket and media access"
+  description: "WhatsApp Web WebSocket, media access, and a narrowly scoped Baileys protocol-version fetch from raw.githubusercontent.com"
 network_policies:
   whatsapp:
     name: whatsapp

src/lib/policy/index.ts

@@ -44,6 +44,7 @@ import {
   type PolicyValue,
   parseNetworkPolicies,
 } from "./preset-parsing";
+import { logPresetScope, renderPresetScope } from "./preset-scope-render";
 import { splitSemanticFindings, validatePolicySemantics } from "./semantic-validation";
 
 const PRESETS_DIR = path.join(ROOT, "nemoclaw-blueprint", "policies", "presets");
@@ -935,10 +936,7 @@ function applyPresetContent(
   }
   const merged = mergePresetIntoPolicy(currentPolicy, presetEntries);
 
-  const endpoints = getPresetEndpoints(presetContent);
-  if (endpoints.length > 0) {
-    console.log(`  Widening sandbox egress — adding: ${endpoints.join(", ")}`);
-  }
+  logPresetScope(presetContent);
 
   // Run before creating temp resources so a missing-binary exit doesn't
   // orphan files in $TMPDIR (the finally cleanup doesn't run on process.exit).
@@ -1061,7 +1059,7 @@ function applyPresets(sandboxName: string, presetNames: string[]): boolean {
     );
     return false;
   }
-  const endpointLogs: string[][] = [];
+  const presetContents: string[] = [];
 
   for (const presetName of uniquePresetNames) {
     const presetContent = loadPresetForSandbox(sandboxName, presetName);
@@ -1076,15 +1074,12 @@ function applyPresets(sandboxName: string, presetNames: string[]): boolean {
       return false;
     }
 
-    const endpoints = getPresetEndpoints(presetContent);
-    endpointLogs.push(endpoints);
+    presetContents.push(presetContent);
     merged = mergePresetIntoPolicy(merged, presetEntries);
   }
 
-  for (const endpoints of endpointLogs) {
-    if (endpoints.length > 0) {
-      console.log(`  Widening sandbox egress — adding: ${endpoints.join(", ")}`);
-    }
+  for (const presetContent of presetContents) {
+    logPresetScope(presetContent);
   }
 
   // Run before creating temp resources so a missing-binary exit doesn't
@@ -1538,6 +1533,7 @@ export {
   loadPreset,
   loadPresetForSandbox,
   loadPresetFromFile,
+  logPresetScope,
   mergePresetIntoPolicy,
   mergePresetNamesIntoPolicy,
   networkPoliciesHasAllowedIps,
@@ -1549,6 +1545,7 @@ export {
   removeBuiltinPresetAttribution,
   removePreset,
   removePresetFromPolicy,
+  renderPresetScope,
   resolvePermissivePolicyPath,
   selectForRemoval,
   selectFromList,

src/lib/policy/preset-scope-render.test.ts

@@ -0,0 +1,131 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, expect, it } from "vitest";
+
+import { renderPresetScope } from "./preset-scope-render";
+
+const WHATSAPP_LIKE_PRESET = `preset:
+  name: whatsapp
+  description: "WhatsApp Web WebSocket and media"
+network_policies:
+  whatsapp:
+    name: whatsapp
+    endpoints:
+      - host: web.whatsapp.com
+        port: 443
+        access: full
+        tls: skip
+      - host: "*.whatsapp.net"
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow: { method: GET, path: "/**" }
+          - allow: { method: POST, path: "/**" }
+      - host: raw.githubusercontent.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: GET
+              path: "/WhiskeySockets/Baileys/master/src/Defaults/index.ts"
+    binaries:
+      - { path: /usr/local/bin/node }
+      - { path: /usr/bin/node }
+`;
+
+describe("renderPresetScope", () => {
+  it("returns an empty list for content with no network_policies", () => {
+    expect(renderPresetScope("preset:\n  name: x\n  description: 'y'\n")).toEqual([]);
+    expect(renderPresetScope("")).toEqual([]);
+  });
+
+  it("returns an empty list for malformed YAML instead of throwing", () => {
+    expect(renderPresetScope("::: not yaml :::")).toEqual([]);
+  });
+
+  it("renders full L4 tunnel endpoints with access + tls but no rule lines", () => {
+    const lines = renderPresetScope(WHATSAPP_LIKE_PRESET);
+    const joined = lines.join("\n");
+    expect(joined).toContain("- web.whatsapp.com:443 (access: full, tls: skip)");
+    const idx = lines.findIndex((line) => line.includes("web.whatsapp.com:443"));
+    expect(idx).toBeGreaterThan(-1);
+    expect(lines[idx + 1] ?? "").not.toMatch(/^\s+allow:/);
+  });
+
+  it("renders REST endpoints with per-rule methods and paths", () => {
+    const lines = renderPresetScope(WHATSAPP_LIKE_PRESET);
+    const joined = lines.join("\n");
+    expect(joined).toContain("- *.whatsapp.net:443 (protocol: rest, enforcement: enforce)");
+    expect(joined).toMatch(/allow:\s+GET\s+\/\*\*/);
+    expect(joined).toMatch(/allow:\s+POST\s+\/\*\*/);
+  });
+
+  it("surfaces the narrowly scoped Baileys version-fetch path, not just the host", () => {
+    const joined = renderPresetScope(WHATSAPP_LIKE_PRESET).join("\n");
+    expect(joined).toContain("raw.githubusercontent.com:443");
+    expect(joined).toContain("/WhiskeySockets/Baileys/master/src/Defaults/index.ts");
+  });
+
+  it("lists declared binaries", () => {
+    const joined = renderPresetScope(WHATSAPP_LIKE_PRESET).join("\n");
+    expect(joined).toContain("binaries:");
+    expect(joined).toContain("- /usr/local/bin/node");
+    expect(joined).toContain("- /usr/bin/node");
+  });
+
+  it("prints one policy block per preset network policy", () => {
+    const multi = `network_policies:
+  policy_a:
+    name: policy_a
+    endpoints:
+      - host: a.example
+        port: 443
+        protocol: rest
+        rules:
+          - allow: { method: GET, path: "/a" }
+  policy_b:
+    name: policy_b
+    endpoints:
+      - host: b.example
+        port: 443
+        access: full
+`;
+    const joined = renderPresetScope(multi).join("\n");
+    expect(joined).toContain("policy 'policy_a':");
+    expect(joined).toContain("policy 'policy_b':");
+    expect(joined).toContain("- a.example:443");
+    expect(joined).toContain("- b.example:443");
+  });
+
+  it("skips malformed endpoint entries without dropping the surrounding scope", () => {
+    const partial = `network_policies:
+  mixed:
+    name: mixed
+    endpoints:
+      - host: 42
+      - foo: bar
+      - host: good.example
+        port: 443
+        protocol: rest
+        rules:
+          - allow: { method: GET, path: "/**" }
+`;
+    const joined = renderPresetScope(partial).join("\n");
+    expect(joined).toContain("- good.example:443");
+    expect(joined).not.toMatch(/^\s+- 42/m);
+  });
+
+  it("emits (no endpoints declared) rather than skipping an empty policy", () => {
+    const empty = `network_policies:
+  bare:
+    name: bare
+    endpoints: []
+`;
+    const joined = renderPresetScope(empty).join("\n");
+    expect(joined).toContain("policy 'bare':");
+    expect(joined).toContain("(no endpoints declared)");
+  });
+});