Summary

nemoclaw <sandbox> channels add <channel> registered the messaging bridge with the OpenShell gateway and triggered a rebuild, but never applied the channel's matching network policy preset. After the rebuild, the bridge booted with no allow-list entry for its upstream API host, so outbound traffic to api.telegram.org / slack.com / discord.com was denied by the SSRF engine and the channel silently failed to deliver messages. This wires the preset apply into the channels add flow so it is captured in the rebuild backup manifest and restored by Step 5.5 of rebuild.ts.

Related Issue

Fixes #3437

Changes

• Add applyChannelPresetIfAvailable(sandboxName, channelName) helper in src/lib/actions/sandbox/policy-channel.ts — looks up the channel's matching built-in preset by name (e.g. telegram → telegram.yaml) and applies it idempotently via policies.applyPreset. No-op when the channel has no matching preset.
• Call the helper in addSandboxChannel between applyChannelAddToGatewayAndRegistry and promptAndRebuild, so the preset is in place before the rebuild backup manifest is captured.
• Fail-soft: helper logs a warning and points to manual nemoclaw <sandbox> policy-add <channel> recovery if the preset apply fails, mirroring rebuild Step 5.5's tolerance.
• Covers telegram, slack, discord — all KNOWN_CHANNELS entries that ship a matching preset under nemoclaw-blueprint/policies/presets/.
• Add regression test test/channels-add-preset.test.ts — stub-driven integration test mirroring test/onboard-preset-diff.test.ts, asserts the ordering invariant (apply must precede promptAndRebuild) for all three channels plus a negative no-matching-preset case.

Testing

npx tsc -p tsconfig.src.json && npx vitest run --project cli test/channels-add-preset.test.ts

Expected when the fix is in place (passing)

All 4 cases pass, confirming policies.applyPreset(<sandbox>, <channel>) is invoked exactly once before promptAndRebuild for each affected channel:

✓ applies the 'telegram' preset before triggering rebuild
✓ applies the 'slack' preset before triggering rebuild
✓ applies the 'discord' preset before triggering rebuild
✓ skips applyPreset when no matching built-in preset exists
Tests  4 passed (4)

Expected when the fix is reverted (catching the regression)

Comment out the applyChannelPresetIfAvailable(...) call in addSandboxChannel, rebuild dist, and rerun — the three positive cases fail with expected applyPreset(...) exactly once; got [], proving the test catches the bug. The negative case continues to pass because it does not depend on the fix:

× applies the 'telegram' preset before triggering rebuild
× applies the 'slack' preset before triggering rebuild
× applies the 'discord' preset before triggering rebuild
✓ skips applyPreset when no matching built-in preset exists
Tests  3 failed | 1 passed (4)

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• make docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Hung Le hple@nvidia.com

Summary by CodeRabbit

• New Features

  • Messaging channels (Telegram, Slack, Discord) now attempt to apply matching built-in policy presets immediately during setup, before the sandbox rebuild; manual policy apply still available for non-matching channels.

• Tests

  • Added a regression test ensuring matching presets are applied prior to the rebuild step and that non-matching channels do not trigger preset application.