Review

Verified the bug on main and audited the fix. LGTM — surgical, correct, single-call-site replacement that reuses an already-proven helper. One suggested improvement below.

Bug verification

Confirmed at src/lib/shields/index.ts:912 — shieldsDown() hardcodes PERMISSIVE_POLICY_PATH for the policyName === "permissive" branch. That constant resolves to nemoclaw-blueprint/policies/openclaw-sandbox-permissive.yaml, which omits /opt/hermes from read_only. The Hermes default policy keeps /opt/hermes in read_only (see agents/hermes/policy-permissive.yaml), so OpenShell rejects the removal on a live sandbox. The reporter's root-cause is exact.

Fix correctness

• Single call site of the bug → fix touches exactly that line.
• resolvePermissivePolicyPath(sandboxName) already exists at src/lib/policy/index.ts:939 and is already used by the sibling applyPermissivePolicy() at line 966 — proven pattern, no new code path introduced.
• Resolver dispatches via registry.getSandbox(sandboxName) → loadAgent(sandbox.agent) → agent.policyPermissivePath, with safe fallback to the global path.
• sandboxName is in scope at line 912 (it's shieldsDown's first parameter).
• Export addition in policy/index.ts is necessary — the helper was module-internal before.

Suggested change — add a regression test

The current test mock returns the same string for resolvePermissivePolicyPath as for PERMISSIVE_POLICY_PATH, which means existing tests would have passed even without the source change. There's no assertion that shieldsDown actually invokes the resolver. A spy via vi.hoisted() closes this in a few lines (vi.mock is hoisted above module-scope consts, so the mock fn has to be declared via vi.hoisted to be referenceable from the factory):

const { resolvePermissiveMock } = vi.hoisted(() => ({
  resolvePermissiveMock: vi.fn(() => "/mock/permissive.yaml"),
}));

vi.mock("../policy", () => ({
  // ...existing mocks...
  PERMISSIVE_POLICY_PATH: "/mock/permissive.yaml",
  resolvePermissivePolicyPath: resolvePermissiveMock,
}));

it("shieldsDown resolves permissive policy via the agent-aware helper", () => {
  shieldsDown("my-hermes-sandbox", { policy: "permissive" });
  expect(resolvePermissiveMock).toHaveBeenCalledWith("my-hermes-sandbox");
});

This guards against silent regression if a future refactor reintroduces the hardcoded constant.

Follow-up (out of scope for this PR)

The catch {} at policy/index.ts:951–953 silently swallows agent-load failures and falls back to the OpenClaw permissive path — which would silently re-reproduce this exact bug if loadAgent("hermes") ever throws. Worth at least a console.warn so the regression would be visible.