fix(shields): keep registered network routes when shields down swaps policy

src/lib/policy/index.ts

@@ -2092,6 +2092,23 @@ function listCustomPresets(sandboxName: string): PresetInfo[] {
   }));
 }
 
+/**
+ * Return every network-policy key that registered custom content declares for
+ * the sandbox. Registry-only: no live policy read, and unparseable content is
+ * skipped rather than throwing, because callers use this to decide what to
+ * preserve during a transition and must not fail the transition on one bad
+ * registry row.
+ */
+function registeredNetworkPolicyKeys(sandboxName: string): string[] {
+  const keys = new Set<string>();
+  for (const entry of registry.getCustomPolicies(sandboxName)) {
+    for (const key of parsePresetPolicyKeysForOwnership(entry.content) ?? []) {
+      keys.add(key);
+    }
+  }
+  return [...keys];
+}
+
 /** Return whether registered custom content owns an exact live network-policy key. */
 function customPresetOwnsNetworkPolicyKey(sandboxName: string, policyKey: string): boolean {
   let candidates: ReturnType<typeof registry.getCustomPolicies>;
@@ -2340,6 +2357,7 @@ export {
   parseCurrentPolicyOrEmpty as parseCurrentPolicy,
   parsePresetPolicyKeys,
   presetContentMatchesGateway,
+  registeredNetworkPolicyKeys,
   removeBuiltinPresetAttribution,
   removePreset,
   removePresetFromPolicy,

src/lib/shields/flow.test.ts

@@ -8,11 +8,15 @@ import os from "node:os";
 import path from "node:path";
 
 import { afterEach, beforeEach, describe, expect, it, type MockInstance, vi } from "vitest";
+import YAML from "yaml";
 
 const requireDist = createRequire(import.meta.url);
 const shieldsModulePath = "./index.js";
 
 type ShieldsHarness = {
+  // Every document handed to `openshell policy set`, read at call time —
+  // shieldsDown deletes a temp policy file as soon as the run returns.
+  appliedPolicies: string[];
   auditSpy: MockInstance;
   errorSpy: MockInstance;
   logSpy: MockInstance;
@@ -30,9 +34,12 @@ const currentProcessStartIdentity = (
 ).readProcessStartIdentity(process.pid);
 
 type HarnessOptions = {
+  basePermissiveYaml?: string;
   beginContainment?: typeof import("../state/mcp-lifecycle-lock.js").beginCommittedMcpLifecycleContainmentSync;
+  ownedNetworkPolicyKeys?: readonly string[];
   directSandboxUnavailable?: boolean;
   dockerExecFileSync?: (argv: unknown) => string;
+  livePolicyYaml?: string;
   failOpenClawGuardActions?: Array<"lock" | "unlock">;
   invokedAs?: "nemoclaw" | "nemohermes";
   openClawGuardFailure?: {
@@ -52,14 +59,21 @@ type HarnessOptions = {
     send: () => boolean;
     kill: () => boolean;
   };
-  livePolicyYaml?: string;
   run?: (cmd: unknown) => { status: number };
 };
 
 function throwHarnessError(error: Error): never {
   throw error;
 }
 
+function readIfPresent(file: string): string {
+  try {
+    return fs.readFileSync(file, "utf-8");
+  } catch {
+    return "";
+  }
+}
+
 function createHarness(options: HarnessOptions = {}): ShieldsHarness {
   vi.stubEnv("NEMOCLAW_INVOKED_AS", options.invokedAs ?? "nemoclaw");
   delete require.cache[requireDist.resolve(shieldsModulePath)];
@@ -98,12 +112,22 @@ function createHarness(options: HarnessOptions = {}): ShieldsHarness {
   });
   options.fork && vi.spyOn(childProcess, "fork").mockImplementation(options.fork);
   vi.spyOn(policy, "buildPolicyGetCommand").mockReturnValue(["openshell", "policy", "get"]);
-  vi.spyOn(policy, "buildPolicySetCommand").mockReturnValue(["openshell", "policy", "set"]);
+  vi.spyOn(policy, "registeredNetworkPolicyKeys").mockImplementation(
+    () => options.ownedNetworkPolicyKeys ?? [],
+  );
+  const appliedPolicies: string[] = [];
+  vi.spyOn(policy, "buildPolicySetCommand").mockImplementation((policyFile: unknown) => {
+    appliedPolicies.push(readIfPresent(String(policyFile)));
+    return ["openshell", "policy", "set"];
+  });
   vi.spyOn(policy, "parseCurrentPolicy").mockImplementation((raw: unknown) => String(raw));
   vi.spyOn(policy, "resolvePermissivePolicyPath").mockReturnValue(
     path.join(tmpDir, "permissive.yaml"),
   );
-  fs.writeFileSync(path.join(tmpDir, "permissive.yaml"), "version: 1\nnetwork_policies: {}\n");
+  fs.writeFileSync(
+    path.join(tmpDir, "permissive.yaml"),
+    options.basePermissiveYaml ?? "version: 1\nnetwork_policies: {}\n",
+  );
   vi.spyOn(agentConfig, "resolveAgentConfig").mockReturnValue({
     agentName: "openclaw",
     configDir: "/sandbox/.openclaw",
@@ -214,6 +238,7 @@ function createHarness(options: HarnessOptions = {}): ShieldsHarness {
   errorSpy.mockClear();
   auditSpy.mockClear();
   return {
+    appliedPolicies,
     auditSpy,
     errorSpy,
     logSpy,
@@ -334,6 +359,40 @@ describe("shields command flow", () => {
     );
   });
 
+  it("shieldsDown keeps a registered MCP route in the policy it applies (#7952)", {
+    timeout: 15_000,
+  }, () => {
+    const harness = createHarness({
+      // A sandbox with a registered MCP bridge: the generated route exists
+      // only in the live policy, never in the static permissive baseline.
+      livePolicyYaml: [
+        "version: 1",
+        "network_policies:",
+        "  mcp_bridge_fake:",
+        "    name: mcp_bridge_fake",
+        "    endpoints:",
+        "      - host: mcp.example.com",
+        "        port: 443",
+        "        protocol: mcp",
+        "",
+      ].join("\n"),
+      basePermissiveYaml: "version: 1\nnetwork_policies:\n  nvidia: {}\n",
+      // The registry records this route, so shields down must carry it.
+      ownedNetworkPolicyKeys: ["mcp_bridge_fake"],
+    });
+
+    harness.shieldsDown("openclaw", { skipTimer: true, throwOnError: true });
+
+    const applied = YAML.parse(harness.appliedPolicies.at(-1) ?? "");
+    // The live route survives the swap intact, and the baseline's own
+    // routes are still there.
+    expect(applied.network_policies.mcp_bridge_fake).toEqual({
+      name: "mcp_bridge_fake",
+      endpoints: [{ host: "mcp.example.com", port: 443, protocol: "mcp" }],
+    });
+    expect(applied.network_policies.nvidia).toBeDefined();
+  });
+
   it("binds manual shields-up to the active auto-restore timer generation", () => {
     const stateDir = path.join(tmpDir, ".nemoclaw", "state");
     const sandboxName = "openclaw";

src/lib/shields/index.ts

@@ -38,6 +38,7 @@ const {
   buildPolicyGetCommand,
   buildPolicySetCommand,
   parseCurrentPolicy,
+  registeredNetworkPolicyKeys,
   resolvePermissivePolicyPath,
 } = require("../policy");
 const { parseDuration, MAX_SECONDS, DEFAULT_SECONDS } = require("../domain/duration");
@@ -3147,16 +3148,29 @@ function shieldsDownWithoutHostLock(sandboxName: string, opts: ShieldsDownOpts =
   let policyFileIsTemp = false;
   if (policyName === "permissive") {
     const basePath = resolvePermissivePolicyPath(sandboxName);
-    // Union the live sandbox's filesystem_policy.read_only/read_write into
-    // the static permissive baseline. OpenShell rejects removal of those
-    // paths on a live sandbox, and runtime-injected entries (/proc on
-    // GPU, /opt/hermes on Hermes, /home/linuxbrew on post-#3913 OpenClaw,
-    // etc.) are not present in the static YAML. See #3942, #3957, #3168.
+    // Union the live sandbox's filesystem_policy.read_only/read_write and
+    // its registry-owned network_policies into the static permissive
+    // baseline. OpenShell rejects removal of those paths on a live
+    // sandbox, and runtime entries — /proc on GPU, /opt/hermes on Hermes,
+    // /home/linuxbrew on post-#3913 OpenClaw, a generated MCP bridge route
+    // — are not present in the static YAML. See #3942, #3957, #3168, #7952.
     // policyYaml is the pre-parsed body we already captured for the
     // snapshot above — reuse it instead of re-fetching.
     policyFile = buildRuntimePermissivePolicy(basePath, {
       livePolicyYaml: policyYaml,
       readBasePolicy: () => fs.readFileSync(basePath, "utf-8"),
+      ownedNetworkPolicyKeys: registeredNetworkPolicyKeys(sandboxName),
+      onDegraded: (detail: string, lostKeys: readonly string[]) => {
+        console.warn(
+          `  Warning: ${detail}, so these registered network routes were not carried into the applied policy: ${lostKeys.join(", ")}.`,
+        );
+        // A registered route is either a generated MCP bridge policy or a
+        // custom preset the operator added, and they are restored by
+        // different commands.
+        console.warn(
+          `  Re-apply the owning policy: \`${CLI_NAME} ${sandboxName} mcp restart <server>\` for a managed MCP server, or \`${CLI_NAME} ${sandboxName} policy add --from-file <path>\` for a custom preset.`,
+        );
+      },
     });
     policyFileIsTemp = policyFile !== basePath;
   } else if (fs.existsSync(policyName)) {

src/lib/shields/permissive-runtime.ts

@@ -10,14 +10,14 @@ const TEMP_FILE_PREFIX = "nemoclaw-permissive-runtime";
 
 /**
  * Build a permissive policy YAML whose filesystem path lists
- * (`filesystem_policy.read_only` + `filesystem_policy.read_write`) are a
- * superset of the live sandbox's, so OpenShell never has to remove a path
- * on a live transition.
+ * (`filesystem_policy.read_only` + `filesystem_policy.read_write`) and
+ * `network_policies` keys are a superset of the live sandbox's, so a live
+ * transition never has to remove a path or drop a registered route.
  *
- * Only the two path lists are unioned. Other `filesystem_policy` fields
- * (e.g. `include_workdir`) are preserved verbatim from the static base —
- * the bug class this helper exists for is path removal on a live sandbox,
- * not policy shape changes.
+ * Only those three collections are unioned. Other `filesystem_policy`
+ * fields (e.g. `include_workdir`) are preserved verbatim from the static
+ * base — the bug class this helper exists for is losing live entries on a
+ * live sandbox, not policy shape changes.
  *
  * Background (#3942, #3957, #3168): OpenShell refuses to remove a
  * `filesystem_policy.read_only` or `filesystem_policy.read_write` entry
@@ -39,10 +39,23 @@ const TEMP_FILE_PREFIX = "nemoclaw-permissive-runtime";
  * - Live `read_only` is merged into base `read_only` only when the same
  *   path is not already granted `read_write` (either by base or by live).
  *
+ * `network_policies` merges by key, and only for keys the registry records
+ * for this sandbox — an unregistered live route is not NemoClaw's to
+ * preserve. Of those, a live-only route is copied in, a route the base
+ * already declares keeps the base's definition, and provider-composed
+ * `_provider_*` entries are never copied.
+ *
+ * When owned routes exist but the merge cannot be produced — the baseline
+ * is unreadable or unparseable, or the temp file cannot be written — the
+ * static policy is applied and those routes are lost. That degrade is
+ * deliberate: aborting shields-down on an I/O error would strand the
+ * sandbox in a locked posture. It is reported through `onDegraded` so the
+ * loss is visible rather than silent.
+ *
  * Returns the path to a freshly created temp YAML file when the live
- * policy carries a filesystem section that needs merging. Falls back to
- * the static base path when the live policy is empty / has no filesystem
- * lists, when the base YAML cannot be parsed, or when temp-file I/O
+ * policy carries filesystem lists or network routes that need merging.
+ * Falls back to the static base path when the live policy is empty / has
+ * neither, when the base YAML cannot be parsed, or when temp-file I/O
  * fails — degrading to the existing static apply path rather than
  * aborting shields-down with an I/O error.
  */
@@ -60,6 +73,14 @@ export interface PermissiveRuntimeDeps {
   // secureTempFile when omitted. Exposed so tests can drive the
   // write-failure fallback path without monkey-patching node:fs.
   writeTempPolicy?: (yaml: string) => string;
+  // Network-policy keys the registry records for this sandbox. Only these
+  // are carried across; an unregistered live route is not NemoClaw's to
+  // preserve. Empty means carry nothing, which is the pre-#7952 behavior.
+  ownedNetworkPolicyKeys: readonly string[];
+  // Called when owned routes exist but the merge degraded to the static
+  // policy, so the caller can say so instead of dropping them silently.
+  // Receives the route keys that were lost.
+  onDegraded?: (detail: string, lostKeys: readonly string[]) => void;
 }
 
 export function buildRuntimePermissivePolicy(
@@ -69,22 +90,30 @@ export function buildRuntimePermissivePolicy(
   const live = deps.livePolicyYaml ? safeYamlObject(deps.livePolicyYaml) : null;
   const liveRw = readStringList(live, "read_write");
   const liveRo = readStringList(live, "read_only");
+  const liveNetwork = readNetworkPolicies(live, deps.ownedNetworkPolicyKeys);
+  const liveNetworkNames = Object.keys(liveNetwork);
+
+  // Report a degrade only when there was something owned to lose.
+  const degrade = (detail: string): string => {
+    if (liveNetworkNames.length > 0) deps.onDegraded?.(detail, liveNetworkNames);
+    return basePermissivePath;
+  };
 
-  // No live filesystem section to merge — keep the static path so the
-  // caller's apply path is unchanged.
-  if (liveRw.length === 0 && liveRo.length === 0) {
+  // Nothing live to merge — keep the static path so the caller's apply
+  // path is unchanged.
+  if (liveRw.length === 0 && liveRo.length === 0 && liveNetworkNames.length === 0) {
     return basePermissivePath;
   }
 
   let baseYaml: string;
   try {
     baseYaml = deps.readBasePolicy();
   } catch {
-    return basePermissivePath;
+    return degrade("the permissive baseline could not be read");
   }
   const base = safeYamlObject(baseYaml);
   if (!base) {
-    return basePermissivePath;
+    return degrade("the permissive baseline could not be parsed");
   }
   const fsPolicy =
     base.filesystem_policy && typeof base.filesystem_policy === "object"
@@ -108,12 +137,38 @@ export function buildRuntimePermissivePolicy(
   fsPolicy.read_write = [...baseRw];
   fsPolicy.read_only = [...baseRo];
 
+  // Carry live-only network routes across the swap. The static baseline is
+  // a fixed allowlist, so a route registered at runtime — a generated MCP
+  // bridge entry, a sandbox-scoped custom preset — is absent from it and
+  // would be dropped by the whole-document replacement, leaving the
+  // registry owning a route the gateway no longer serves (#7952).
+  //
+  // The static base wins on a shared key, so the applied document is
+  // unchanged for every key the baseline already declares. That relies on
+  // the baseline being the more permissive of the two, which nothing here
+  // enforces — it holds today because the dynamic writers namespace their
+  // keys (`mcp_bridge_*`) and so never collide with a baseline key. A
+  // future dynamic policy preset that reuses a baseline key would be
+  // silently ignored here; give it its own namespace.
+  if (liveNetworkNames.length > 0) {
+    const baseNetwork =
+      base.network_policies &&
+      typeof base.network_policies === "object" &&
+      !Array.isArray(base.network_policies)
+        ? (base.network_policies as Record<string, unknown>)
+        : ((base.network_policies = {} as Record<string, unknown>),
+          base.network_policies as Record<string, unknown>);
+    for (const name of liveNetworkNames) {
+      if (!(name in baseNetwork)) baseNetwork[name] = liveNetwork[name];
+    }
+  }
+
   const yaml = YAML.stringify(base);
   if (deps.writeTempPolicy) {
     try {
       return deps.writeTempPolicy(yaml);
     } catch {
-      return basePermissivePath;
+      return degrade("the merged policy could not be written");
     }
   }
   let tmpPath: string | null = null;
@@ -126,7 +181,7 @@ export function buildRuntimePermissivePolicy(
     // writeFileSync failed. Clean it up so we do not leak a 0700 dir
     // on /tmp every time the write path errors.
     if (tmpPath) cleanupTempDir(tmpPath, TEMP_FILE_PREFIX);
-    return basePermissivePath;
+    return degrade("the merged policy could not be written");
   }
 }
 
@@ -142,6 +197,29 @@ function safeYamlObject(text: string): Record<string, unknown> | null {
   return null;
 }
 
+// `policy get --base` can defensively include provider-composed
+// `_provider_*` entries that `policy set` must never receive. Every other
+// read-modify-write path filters them (see withoutProviderComposedPolicies
+// in nemoclaw/src/shared/openshell-policy-boundary.cts); this one is a
+// write path too, so it filters them as well. Inlined rather than imported
+// because that module is only reachable through a built artifact, and this
+// helper must stay dependency-free.
+const PROVIDER_COMPOSED_PREFIX = "_provider_";
+
+function readNetworkPolicies(
+  root: Record<string, unknown> | null,
+  ownedKeys: readonly string[],
+): Record<string, unknown> {
+  const value = root?.network_policies;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const owned = new Set(ownedKeys);
+  return Object.fromEntries(
+    Object.entries(value as Record<string, unknown>).filter(
+      ([name]) => owned.has(name) && !name.startsWith(PROVIDER_COMPOSED_PREFIX),
+    ),
+  );
+}
+
 function readStringList(
   root: Record<string, unknown> | null,
   key: "read_only" | "read_write",