fix(shields): keep shields status truthful when the permissive policy is rejected (#8198)

src/lib/shields/flow.test.ts

@@ -930,6 +930,41 @@ describe("shields command flow", () => {
     expect(permissiveRuntimeDirs()).toEqual(before);
   });
 
+  it("shields down clears state and reports the sandbox as up when the permissive policy is rejected (#8198)", () => {
+    // OpenShell refuses the live policy change — e.g. a Deep Agents sandbox
+    // whose landlock policy is sealed at startup — so the permissive
+    // `policy set` exits non-zero and nothing is actually weakened.
+    const harness = createHarness({
+      run: (cmd) => {
+        const argv = Array.isArray(cmd) ? cmd.map(String) : [];
+        return argv.includes("policy") && argv.includes("set") ? { status: 1 } : { status: 0 };
+      },
+      fork: () => ({
+        pid: 4242,
+        disconnect: vi.fn(),
+        unref: vi.fn(),
+        send: vi.fn(() => true),
+        kill: vi.fn(() => true),
+      }),
+    });
+
+    expect(() =>
+      harness.shieldsDown("openclaw", {
+        timeout: "5m",
+        reason: "verify",
+        throwOnError: true,
+      }),
+    ).toThrow(/Could not apply/);
+
+    // The unlock never took effect, so status must not claim DOWN/permissive.
+    expect(harness.isShieldsDown("openclaw")).toBe(false);
+    const statePath = path.join(tmpDir, ".nemoclaw", "state", "shields-openclaw.json");
+    const stateOnDisk = fs.existsSync(statePath)
+      ? JSON.parse(fs.readFileSync(statePath, "utf-8"))
+      : { shieldsDown: false };
+    expect(stateOnDisk.shieldsDown).toBe(false);
+  });
+
   it("shieldsUp refuses to mark lockdown active when the saved restrictive policy snapshot is missing", () => {
     const harness = createHarness();
     const stateDir = path.join(tmpDir, ".nemoclaw", "state");

src/lib/shields/index.ts

@@ -3025,11 +3025,41 @@ function shieldsDownWithoutHostLock(sandboxName: string, opts: ShieldsDownOpts =
   }
 
   console.log(`  Applying ${policyName} policy...`);
+  let policySetResult: ReturnType<typeof run>;
   try {
-    run(buildPolicySetCommand(policyFile, sandboxName));
+    policySetResult = run(buildPolicySetCommand(policyFile, sandboxName), {
+      ignoreError: true,
+    });
   } finally {
     cleanupRuntimePolicyFile();
   }
+  if (policySetResult.status !== 0) {
+    // The permissive policy was rejected before it applied — e.g. OpenShell
+    // refuses a live landlock change on a sandbox whose policy is sealed at
+    // startup (Deep Agents). Nothing was weakened: config is still locked and
+    // the restrictive policy is unchanged. The shields-down state persisted
+    // above is therefore false, so clear it (and cancel the now-pointless
+    // auto-restore timer/transition) and fail closed. Otherwise `shields
+    // status` would report DOWN/permissive for an unlock that never happened.
+    // See #8198.
+    saveShieldsState(sandboxName, {
+      shieldsDown: false,
+      shieldsDownAt: null,
+      shieldsDownTimeout: null,
+      shieldsDownReason: null,
+      shieldsDownPolicy: null,
+      shieldsPolicySnapshotPath: null,
+    });
+    if (transition) clearShieldsDownTransition(sandboxName, transition.processToken);
+    killTimer(sandboxName);
+    console.error(
+      `  ERROR: Could not apply the ${policyName} policy; the sandbox remains shielded.`,
+    );
+    console.error(
+      "  Shields down did not take effect. `shields status` continues to report the sandbox as up.",
+    );
+    return failShieldsCommand(`Could not apply ${policyName} policy`, opts.throwOnError);
+  }
 
   // 2b. Return config to default mutable state.
   //     OpenClaw uses sandbox:sandbox 0660/2770 here so the gateway UID, which