fix(channels): preserve external policy authority

src/lib/actions/sandbox/messaging-host-forward-lifecycle.ts

@@ -45,6 +45,7 @@ export function ensureMessagingHostForwardAfterRebuild(
   sandboxName: string,
   plan: SandboxMessagingPlan | null | undefined,
   note: (message: string) => void = console.log,
+  revalidatePolicyAuthority?: (operation: string) => void,
 ): boolean {
   const forward = resolveMessagingHostForward(plan);
   if (!forward) return true;
@@ -67,6 +68,7 @@ export function ensureMessagingHostForwardAfterRebuild(
         name,
         port,
         label,
+        revalidatePolicyAuthority,
       ),
     note,
   });

src/lib/actions/sandbox/policy-channel-agent-gate.test.ts

@@ -16,6 +16,7 @@ import * as policy from "../../policy";
 import * as registry from "../../state/registry";
 import { addSandboxChannel, startSandboxChannel, stopSandboxChannel } from "./policy-channel";
 import { policyChannelDependencies } from "./policy-channel-dependencies";
+import * as policyAuthorityPreflight from "./policy-authority/preflight";
 
 function agentFixture(name: string): defs.AgentDefinition {
   return { name } as defs.AgentDefinition;
@@ -76,6 +77,9 @@ beforeEach(() => {
   saveCredentialMock = vi.spyOn(store, "saveCredential").mockImplementation(() => undefined);
   promptMock = vi.spyOn(store, "prompt").mockResolvedValue("");
   rebuildMock = vi.spyOn(policyChannelDependencies, "rebuildSandbox").mockResolvedValue(undefined);
+  vi.spyOn(policyAuthorityPreflight, "preflightSandboxPolicyAuthority").mockReturnValue(
+    "nemoclaw-managed",
+  );
 });
 
 afterEach(() => {
@@ -155,39 +159,42 @@ describe("channel lifecycle agent gate", () => {
   it.each([
     ["start", ["googlechat"], () => startSandboxChannel("da-test", { channel: "googlechat" })],
     ["stop", [], () => stopSandboxChannel("da-test", { channel: "googlechat" })],
-  ])("rejects a stale channel during %s before reading channel state or mutating the sandbox", async (_verb, disabledChannels, run) => {
-    // googlechat now supports openclaw + hermes, so exercise the unsupported-pair
-    // lifecycle gate with a non-messaging custom agent (supported by no channel).
-    getSandboxMock.mockReturnValue({ name: "da-test", agent: "custom-agent" });
-    vi.spyOn(defs, "loadAgent").mockReturnValue(agentFixture("custom-agent"));
-    const configuredChannelsMock = vi
-      .spyOn(registry, "getConfiguredMessagingChannelsFromEntry")
-      .mockReturnValue(["googlechat"]);
-    const disabledChannelsMock = vi
-      .spyOn(registry, "getDisabledChannels")
-      .mockReturnValue(disabledChannels);
-
-    let caught: unknown;
-    try {
-      await run();
-    } catch (err) {
-      caught = err;
-    }
-
-    expect(exitCodeFromError(caught)).toBe(1);
-    const errorText = (errSpy.mock.calls as unknown[][])
-      .map((call) => call.map(String).join(" "))
-      .join("\n");
-    expect(errorText).toMatch(/Channel 'googlechat' does not support agent 'custom-agent'/);
-    expect(errorText).toMatch(/Channel-supported agents: openclaw, hermes/);
-    expect(errorText).toMatch(/Channels supported by agent 'custom-agent': \(none\)/);
-
-    expect(configuredChannelsMock).not.toHaveBeenCalled();
-    expect(disabledChannelsMock).not.toHaveBeenCalled();
-    expect(loadPresetForSandboxMock).not.toHaveBeenCalled();
-    expect(applyPresetMock).not.toHaveBeenCalled();
-    expect(updateSandboxMock).not.toHaveBeenCalled();
-    expect(rebuildMock).not.toHaveBeenCalled();
-    expect(runOpenshellMock).not.toHaveBeenCalled();
-  });
+  ])(
+    "rejects a stale channel during %s before reading channel state or mutating the sandbox",
+    async (_verb, disabledChannels, run) => {
+      // googlechat now supports openclaw + hermes, so exercise the unsupported-pair
+      // lifecycle gate with a non-messaging custom agent (supported by no channel).
+      getSandboxMock.mockReturnValue({ name: "da-test", agent: "custom-agent" });
+      vi.spyOn(defs, "loadAgent").mockReturnValue(agentFixture("custom-agent"));
+      const configuredChannelsMock = vi
+        .spyOn(registry, "getConfiguredMessagingChannelsFromEntry")
+        .mockReturnValue(["googlechat"]);
+      const disabledChannelsMock = vi
+        .spyOn(registry, "getDisabledChannels")
+        .mockReturnValue(disabledChannels);
+
+      let caught: unknown;
+      try {
+        await run();
+      } catch (err) {
+        caught = err;
+      }
+
+      expect(exitCodeFromError(caught)).toBe(1);
+      const errorText = (errSpy.mock.calls as unknown[][])
+        .map((call) => call.map(String).join(" "))
+        .join("\n");
+      expect(errorText).toMatch(/Channel 'googlechat' does not support agent 'custom-agent'/);
+      expect(errorText).toMatch(/Channel-supported agents: openclaw, hermes/);
+      expect(errorText).toMatch(/Channels supported by agent 'custom-agent': \(none\)/);
+
+      expect(configuredChannelsMock).not.toHaveBeenCalled();
+      expect(disabledChannelsMock).not.toHaveBeenCalled();
+      expect(loadPresetForSandboxMock).not.toHaveBeenCalled();
+      expect(applyPresetMock).not.toHaveBeenCalled();
+      expect(updateSandboxMock).not.toHaveBeenCalled();
+      expect(rebuildMock).not.toHaveBeenCalled();
+      expect(runOpenshellMock).not.toHaveBeenCalled();
+    },
+  );
 });

src/lib/actions/sandbox/policy-channel-cleanup.test.ts

@@ -4,7 +4,7 @@
 // Cleanup-path regression: with the new strict `toMessagingAgentId` semantics,
 // stale messaging state on a non-messaging agent must still be cleanable
 // without raising MessagingAgentNotSupportedError. `channels remove` should
-// strip the stored messaging plan from the registry, `channels pause/resume`
+// strip the stored messaging plan from the registry, `channels stop/start`
 // should fail closed (no throw, no plan mutation).
 
 import { afterEach, beforeEach, describe, expect, it, type MockInstance, vi } from "vitest";