feat(onboard): extend web search onboarding to Gemini and Tavily

[jyaunches]

Summary

Extend the web search onboarding flow from Brave-only to support Brave, Gemini, and Tavily as selectable providers during nemoclaw onboard.

Linked Issues

• Closes feat(onboard): extend web search onboarding to Gemini and Tavily providers #2718
• Prior art: PR feat(onboard): extend web search onboarding to Gemini and Tavily #1497 (closed — reworked fresh on current main)

Changes

Provider Model (src/lib/web-search.ts)

• WebSearchProvider type: "brave" | "gemini" | "tavily"
• Provider metadata registry with label, helpUrl, credentialEnv, pluginEntry, policyPreset
• buildWebSearchConfigFragment() — generates provider-appropriate OpenClaw config
• normalizePersistedWebSearchConfig() — handles backward compat (missing provider defaults to brave)
• 36 new unit tests

Config Generation (scripts/generate-openclaw-config.py, Dockerfile)

• New NEMOCLAW_WEB_SEARCH_PROVIDER build-arg + env (default: brave)
• Provider-aware config generation (correct plugin entry, credential env, Gemini model)

Onboarding Flow (src/lib/onboard.ts)

• Interactive: numbered provider selection prompt (Brave / Gemini / Tavily / Skip)
• Non-interactive: reads NEMOCLAW_WEB_SEARCH_PROVIDER env var
• Provider-specific API key validation (Brave: live validation; Gemini/Tavily: format check)
• Provider-aware credential injection into sandbox
• Config summary shows provider name

Session & Resume (src/lib/onboard-session.ts)

• webSearchConfig now persists provider field
• Resume revalidates the correct provider credential
• Backward compat: sessions without provider field default to brave

Policy Presets

• New nemoclaw-blueprint/policies/presets/gemini.yaml
• New nemoclaw-blueprint/policies/presets/tavily.yaml
• Suggested automatically during onboarding when the corresponding provider is selected

Validation

npm run typecheck:cli        # ✓ clean
npm run build:cli            # ✓ clean
npx vitest run src/lib/web-search.test.ts src/lib/onboard-session.test.ts test/policies.test.ts test/onboard.test.ts test/onboard-brave-validation.test.ts
# 5 files, 339 tests passed

Type of Change

• Code change for a new feature
• Code change with test updates

Risks / Notes

• Gemini and Tavily API key validation is format-only (non-empty check) — live validation would require making an actual search request. Brave retains its existing live validation endpoint.
• The ensureValidatedBraveSearchCredential function is preserved (exported) for backward compat but is no longer in the main onboard flow.
• Depends on feat: support OPENCLAW_CONFIG_PATH to persist openclaw.json on PVC #1174 / openclaw.json created as root with read-only permissions, making all config writes impossible from sandbox #719 for config writes to persist post-onboard (without those, the config is still baked at build time which works fine for the onboard path).

Summary by CodeRabbit

• New Features

  • Support for multiple web search providers (Brave, Gemini, Tavily) with provider selection preserved, validated, and shown during onboarding; users can skip.
  • Provider selection exported to deployments via a configurable environment setting so runtimes receive provider-specific wiring.
  • Provider-specific policy presets added and suggested (Gemini, Tavily).

• Bug Fixes / Improvements

  • Generated configuration and runtime wiring now include provider-specific integration, credential handling, and Gemini’s default model.

• Tests

  • Expanded coverage for provider parsing, normalization, config generation, and deployment encoding.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds provider-aware web-search support (Brave, Gemini, Tavily): provider model/metadata, onboarding/provider selection and validation, session persistence of provider choice, provider-specific OpenClaw/Docker config generation, two policy presets, and corresponding tests and Docker ARG/ENV export.

Changes

Cohort / File(s)	Summary
Docker & Build Configuration Dockerfile	Adds ARG NEMOCLAW_WEB_SEARCH_PROVIDER and exports NEMOCLAW_WEB_SEARCH_PROVIDER as an ENV so chosen provider is available at build/runtime.
Policy Presets nemoclaw-blueprint/policies/presets/gemini.yaml, nemoclaw-blueprint/policies/presets/tavily.yaml	Adds new presets for Gemini and Tavily network access (host/port/protocol/TLS, GET/POST rules, allowed Node.js binaries).
Web Search Provider Model & Helpers src/lib/web-search.ts, src/lib/web-search.test.ts	New provider types/metadata for `brave
Config Generation Script scripts/generate-openclaw-config.py	Reads/validates NEMOCLAW_WEB_SEARCH_PROVIDER, maps provider → credential env and plugin entry, and emits provider-appropriate OpenClaw config (includes Gemini model handling).
Onboarding Flow src/lib/onboard.ts	Provider-aware onboarding (interactive picker + non-interactive env handling), provider-agnostic API-key prompting/validation/retries, persists { provider, fetchEnabled }, injects build-arg, updates policy preset suggestion and sandbox env wiring.
Session & Persistence src/lib/onboard-session.ts, src/lib/onboard-session.test.ts	Persisted webSearchConfig now uses PersistedWebSearchConfig shape including provider; normalization helper used for parsing and safe updates; tests updated to assert provider persistence.
Tests & Misc Adjustments test/onboard-brave-validation.test.ts, test/policies.test.ts, test/onboard.test.ts, src/lib/onboard-session.test.ts, src/lib/onboard-session.ts	Tests updated to expect provider in payloads, include new presets in expected lists, and adjust Dockerfile-patching tests to include provider field.
Small/Supporting Edits scripts/..., Dockerfile patching logic referenced in src/lib/onboard.ts	Minor changes to Docker patch guard logic to require ARG for non-Brave selections and ensure provider is propagated.

Sequence Diagram

sequenceDiagram
    actor User
    participant Onboard as Onboard
    participant Provider as ProviderValidator
    participant Config as ConfigGenerator
    participant Docker as DockerBuild
    participant Session as SessionStore

    User->>Onboard: run "nemoclaw onboard" (or set NEMOCLAW_WEB_SEARCH_PROVIDER)
    Onboard->>User: prompt provider / read env
    User->>Onboard: select provider + provide API key (or skip)
    Onboard->>Provider: validate API key for provider
    Provider-->>Onboard: validation result
    Onboard->>Config: build OpenClaw fragment (plugin entry, cred env ref, model)
    Config-->>Onboard: config fragment
    Onboard->>Docker: pass NEMOCLAW_WEB_SEARCH_PROVIDER arg + encoded config
    Docker-->>Onboard: image with ENV injected
    Onboard->>Session: persist webSearchConfig { provider, fetchEnabled }
    Session-->>Onboard: saved
    Onboard-->>User: onboarding complete

Loading

Estimated Code Review Effort

🎯 4 (Complex) | ⏱️ ~75 minutes

Possibly related PRs

• feat(onboard): add Brave Search onboarding via BRAVE_API_KEY #1464 — prior Brave web-search onboarding work and provider-registry patterns reused/extended here.

Suggested labels

Getting Started, security, NemoClaw CLI

Poem

🐰 A hop, three choices in a row,
Brave, Gemini, Tavily — pick where to go.
Plugins stitched and presets sown,
Sessions keep the path you've known.
Build-arg set — the rabbit's flown 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 70.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title directly summarizes the main feature: extending web search onboarding from Brave-only to include Gemini and Tavily providers.
Linked Issues check	✅ Passed	The PR implementation comprehensively addresses all coding requirements from issue #2718: provider model, config generation, onboarding flow, session persistence, policy presets, and extensive test coverage.
Out of Scope Changes check	✅ Passed	All changes align with the PR objectives: Dockerfile, policy presets, config generation, session handling, onboarding flow, and tests are all directly required for multi-provider web search support.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Review rate limit: 8/10 reviews remaining, refill in 7 minutes and 55 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/lib/onboard.ts (1)

7833-7835: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Resume output still says “Brave Search” for every provider.

Gemini/Tavily rebuilds will log the wrong provider here, which makes resume/debug output misleading.

Suggested fix

       if (webSearchConfig) {
-        note("  [resume] Reusing Brave Search configuration already baked into the sandbox.");
+        const meta = webSearch.getWebSearchProvider(webSearchConfig.provider);
+        note(`  [resume] Reusing ${meta.label} configuration already baked into the sandbox.`);
       }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lib/onboard.ts` around lines 7833 - 7835, The resume message currently
hardcodes "Brave Search" which mislabels other providers; update the note call
to derive the provider name from the webSearchConfig object (e.g.,
webSearchConfig.provider or webSearchConfig.name) instead of the literal string,
and fall back to a generic label like "web search" if that field is missing;
modify the note invocation where webSearchConfig is checked so it logs the
actual provider value.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/lib/onboard.ts`:
- Around line 1571-1584: The validateWebSearchApiKey function currently only
checks for emptiness for non-Brave providers; update the non-Brave branch
(inside validateWebSearchApiKey) to perform format-only validation for "gemini"
and "tavily" instead of accepting any non-empty string: add provider-specific
simple regex/format checks (e.g., a known prefix/character set or length
constraints) for "gemini" and "tavily", return { ok: false, message: "<clear
format error>" } on mismatch, and fall back to { ok: true } only when the key
matches the expected format; keep validateBraveSearchApiKey usage for provider
=== "brave".
- Around line 5893-5896: computeSetupPresetSuggestions() still hardcodes
add("brave"), causing the Brave policy preset to be applied even when a
different web-search provider is chosen; update computeSetupPresetSuggestions()
to be provider-aware by reading the selected web-search provider (use
webSearch.getWebSearchProvider(...) / wsMeta.policyPreset or the same source
used where you push wsMeta.policyPreset) and push that provider's policy preset
instead of add("brave"), so the suggestions array consistently uses
wsMeta.policyPreset when a webSearchConfig exists.

---

Outside diff comments:
In `@src/lib/onboard.ts`:
- Around line 7833-7835: The resume message currently hardcodes "Brave Search"
which mislabels other providers; update the note call to derive the provider
name from the webSearchConfig object (e.g., webSearchConfig.provider or
webSearchConfig.name) instead of the literal string, and fall back to a generic
label like "web search" if that field is missing; modify the note invocation
where webSearchConfig is checked so it logs the actual provider value.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4924c413-3c97-45fb-9eee-8e8fd7a765b9

📥 Commits

Reviewing files that changed from the base of the PR and between 8591a2f and 92b84b0.

📒 Files selected for processing (11)

• Dockerfile
• nemoclaw-blueprint/policies/presets/gemini.yaml
• nemoclaw-blueprint/policies/presets/tavily.yaml
• scripts/generate-openclaw-config.py
• src/lib/onboard-session.test.ts
• src/lib/onboard-session.ts
• src/lib/onboard.ts
• src/lib/web-search.test.ts
• src/lib/web-search.ts
• test/onboard-brave-validation.test.ts
• test/policies.test.ts

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (1)

src/lib/onboard.ts (1)

1659-1711: Please run the onboarding E2E matrix for this path.

These changes touch provider selection, credential handling, sandbox creation, and policy suggestion inside src/lib/onboard.ts, so cloud-e2e, sandbox-operations-e2e, and rebuild-openclaw-e2e are the best regression check before merge.

As per coding guidelines, src/lib/onboard.ts: "This file contains core onboarding logic. Changes here affect the full sandbox creation and configuration flow."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lib/onboard.ts` around lines 1659 - 1711, Run the onboarding end-to-end
regression matrix covering cloud-e2e, sandbox-operations-e2e, and
rebuild-openclaw-e2e because this diff changes web search provider selection,
credential handling, sandbox creation, and policy suggestion in
src/lib/onboard.ts; specifically exercise both non-interactive and interactive
flows that touch agentSupportsWebSearch,
resolveNonInteractiveWebSearchProvider(), webSearch.getWebSearchProvider(),
getCredential/normalizeCredentialValue/saveCredential,
validateWebSearchApiKey/ensureValidatedWebSearchCredential, and
promptWebSearchProviderSelection to confirm API key validation, environment
variable propagation (process.env[meta.credentialEnv]), credential persistence,
and that sandbox creation and policy suggestion behave correctly after
enabling/disabling web-search.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/lib/onboard.ts`:
- Around line 1647-1652: The recovery prompt currently calls
promptBraveSearchRecovery(...) which hardcodes "Brave Search" in the interactive
retry flow; replace that call with a provider-agnostic recovery prompt (e.g.,
promptProviderRecovery or promptGenericRecovery) that accepts the validation and
the provider label (use meta.label or a providerIdentifier passed into this
scope) and update the implementation of promptBraveSearchRecovery (or create a
new promptProviderRecovery) to use the provided label instead of "Brave Search"
so Gemini/Tavily failures display the correct provider name; ensure you update
the call site here (where action is assigned) to pass the provider label and
keep the same return semantics ("skip" handling).
- Around line 1934-1939: The staged Dockerfile replacement for
NEMOCLAW_WEB_SEARCH_PROVIDER can be a silent no-op if the Dockerfile lacks that
ARG, causing a mismatch between the selected provider and the built image;
update the onboarding logic in src/lib/onboard.ts so that when webSearchConfig
is set you verify the Dockerfile contains the provider ARG (match /^ARG
NEMOCLAW_WEB_SEARCH_PROVIDER=.*$/m) and throw a clear error if it is missing (or
alternatively tighten agentSupportsWebSearch() to require the provider ARG),
ensuring the code path that performs the replace on the dockerfile variable
fails fast when the ARG is absent.
- Around line 1520-1530: resolveNonInteractiveWebSearchProvider currently warns
then silently falls back to "brave" when webSearch.parseWebSearchProvider
returns falsy; instead fail fast to avoid accidentally using BRAVE_API_KEY.
Update resolveNonInteractiveWebSearchProvider (and keep use of
webSearch.WEB_SEARCH_PROVIDER_ENV and webSearch.parseWebSearchProvider) to throw
a clear Error when envValue is present but parseWebSearchProvider(envValue)
returns falsy — include the invalid value and acceptable provider names in the
message — OR, if you prefer disabling over throwing, return an explicit
"disabled" sentinel instead of "brave" so callers won't construct a Brave
backend silently.

---

Nitpick comments:
In `@src/lib/onboard.ts`:
- Around line 1659-1711: Run the onboarding end-to-end regression matrix
covering cloud-e2e, sandbox-operations-e2e, and rebuild-openclaw-e2e because
this diff changes web search provider selection, credential handling, sandbox
creation, and policy suggestion in src/lib/onboard.ts; specifically exercise
both non-interactive and interactive flows that touch agentSupportsWebSearch,
resolveNonInteractiveWebSearchProvider(), webSearch.getWebSearchProvider(),
getCredential/normalizeCredentialValue/saveCredential,
validateWebSearchApiKey/ensureValidatedWebSearchCredential, and
promptWebSearchProviderSelection to confirm API key validation, environment
variable propagation (process.env[meta.credentialEnv]), credential persistence,
and that sandbox creation and policy suggestion behave correctly after
enabling/disabling web-search.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d75d3c95-89a0-471a-a6d6-9a3b7af343c2

📥 Commits

Reviewing files that changed from the base of the PR and between 92b84b0 and ebff645.

📒 Files selected for processing (1)

• src/lib/onboard.ts

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

Dockerfile (1)

283-309: Run the Dockerfile E2E matrix before merge to validate container-layer behavior.

Given this is a Dockerfile config-path change, I recommend running cloud-e2e, sandbox-survival-e2e, hermes-e2e, and rebuild-openclaw-e2e on this branch.

As per coding guidelines, "This file affects the sandbox container image. Layer ordering, permissions, and baked config changes are only testable with a real container build."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@Dockerfile` around lines 283 - 309, This change touches the Dockerfile ENV
block (e.g., NEMOCLAW_WEB_SEARCH_PROVIDER and the promoted ENV variables) which
affects the sandbox image and must be validated by container builds; run the
full Dockerfile E2E matrix on this branch—at minimum execute cloud-e2e,
sandbox-survival-e2e, hermes-e2e, and rebuild-openclaw-e2e—to confirm layer
ordering, permissions, and baked config behavior before merging.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/lib/onboard.ts`:
- Around line 7722-7725: When resuming, the code currently unconditionally
restores session.webSearchConfig into webSearchConfig, which causes an explicit
web-search provider override (e.g., NEMOCLAW_WEB_SEARCH_PROVIDER or the
CLI/webSearchProvider param) to be ignored; modify the resume logic around
webSearchConfig and the later revalidation to detect an explicit override and
treat mismatches as a resume conflict: if an override value exists and
session.webSearchConfig?.provider is present and differs, throw/return the same
conflict error used for model/provider mismatches (mirror the existing
resume-check behavior), otherwise proceed to use the override or session value
as appropriate; update both places where webSearchConfig is restored/revalidated
(the webSearchConfig initialization and the later revalidation block) to apply
this same check.
- Around line 1958-1972: The code only rewrites ARG NEMOCLAW_WEB_SEARCH_PROVIDER
for non-Brave providers; change it to always patch the ARG whenever
webSearchConfig is present so a Dockerfile that defaults to a non-Brave provider
doesn't remain stale when Brave is selected. In the block referencing
webSearchConfig and dockerfile, remove the provider !== "brave" guard, ensure
you check that the Dockerfile declares ARG NEMOCLAW_WEB_SEARCH_PROVIDER with
/^\s*ARG\s+NEMOCLAW_WEB_SEARCH_PROVIDER=/m, throw the same error if missing, and
replace the line with `ARG
NEMOCLAW_WEB_SEARCH_PROVIDER=${webSearchConfig.provider ?? "brave"}` (use
webSearchConfig.provider or "brave" as fallback) so the ARG is always updated
when webSearchConfig is set.

---

Nitpick comments:
In `@Dockerfile`:
- Around line 283-309: This change touches the Dockerfile ENV block (e.g.,
NEMOCLAW_WEB_SEARCH_PROVIDER and the promoted ENV variables) which affects the
sandbox image and must be validated by container builds; run the full Dockerfile
E2E matrix on this branch—at minimum execute cloud-e2e, sandbox-survival-e2e,
hermes-e2e, and rebuild-openclaw-e2e—to confirm layer ordering, permissions, and
baked config behavior before merging.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 49c26ffc-b9ca-4b7a-9296-778a4fd6a64e

📥 Commits

Reviewing files that changed from the base of the PR and between ebff645 and 9324355.

📒 Files selected for processing (12)

• Dockerfile
• nemoclaw-blueprint/policies/presets/gemini.yaml
• nemoclaw-blueprint/policies/presets/tavily.yaml
• scripts/generate-openclaw-config.py
• src/lib/onboard-session.test.ts
• src/lib/onboard-session.ts
• src/lib/onboard.ts
• src/lib/web-search.test.ts
• src/lib/web-search.ts
• test/onboard-brave-validation.test.ts
• test/onboard.test.ts
• test/policies.test.ts

✅ Files skipped from review due to trivial changes (4)

• test/onboard-brave-validation.test.ts
• nemoclaw-blueprint/policies/presets/gemini.yaml
• test/policies.test.ts
• test/onboard.test.ts

🚧 Files skipped from review as they are similar to previous changes (4)

• src/lib/onboard-session.test.ts
• nemoclaw-blueprint/policies/presets/tavily.yaml
• scripts/generate-openclaw-config.py
• src/lib/onboard-session.ts

[coderabbitai]

🧹 Nitpick comments (1)

src/lib/onboard.ts (1)

7886-8591: Please run the onboarding E2Es for this path before merge.

These changes touch provider selection, sandbox recreate/reuse, and policy application in the core onboarding flow, so I’d run the recommended cloud-e2e, sandbox-operations-e2e, and rebuild-openclaw-e2e jobs on this branch before landing it.

As per coding guidelines src/lib/onboard.ts: "This file contains core onboarding logic. Changes here affect the full sandbox creation and configuration flow. E2E test recommendation: cloud-e2e — full onboard + cloud inference; sandbox-operations-e2e — multi-sandbox lifecycle; rebuild-openclaw-e2e — workspace state survives rebuild."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lib/onboard.ts` around lines 7886 - 8591, The change touches core
onboarding flow (function onboard) affecting provider selection
(setupNim/setupInference), sandbox recreate/reuse logic
(getSandboxReuseState/createSandbox/registry.updateSandbox), and policy
application (setupPoliciesWithSelection/arePolicyPresetsApplied), so before
merging run the E2E suites: cloud-e2e, sandbox-operations-e2e, and
rebuild-openclaw-e2e on this branch; verify resume vs fresh flows, --from
Dockerfile + non-interactive name guards, gateway reuse/recreate paths,
webSearchConfig changes, messaging channel selection, migration of staged legacy
credentials, and that policy presets are applied/recorded and survive sandbox
rebuilds.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@src/lib/onboard.ts`:
- Around line 7886-8591: The change touches core onboarding flow (function
onboard) affecting provider selection (setupNim/setupInference), sandbox
recreate/reuse logic
(getSandboxReuseState/createSandbox/registry.updateSandbox), and policy
application (setupPoliciesWithSelection/arePolicyPresetsApplied), so before
merging run the E2E suites: cloud-e2e, sandbox-operations-e2e, and
rebuild-openclaw-e2e on this branch; verify resume vs fresh flows, --from
Dockerfile + non-interactive name guards, gateway reuse/recreate paths,
webSearchConfig changes, messaging channel selection, migration of staged legacy
credentials, and that policy presets are applied/recorded and survive sandbox
rebuilds.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2197f8d6-b037-4ca3-9b4c-f3d922c260ed

📥 Commits

Reviewing files that changed from the base of the PR and between 9324355 and 85680b4.

📒 Files selected for processing (12)

• Dockerfile
• nemoclaw-blueprint/policies/presets/gemini.yaml
• nemoclaw-blueprint/policies/presets/tavily.yaml
• scripts/generate-openclaw-config.py
• src/lib/onboard-session.test.ts
• src/lib/onboard-session.ts
• src/lib/onboard.ts
• src/lib/web-search.test.ts
• src/lib/web-search.ts
• test/onboard-brave-validation.test.ts
• test/onboard.test.ts
• test/policies.test.ts

✅ Files skipped from review due to trivial changes (4)

• test/policies.test.ts
• nemoclaw-blueprint/policies/presets/gemini.yaml
• src/lib/onboard-session.test.ts
• nemoclaw-blueprint/policies/presets/tavily.yaml

🚧 Files skipped from review as they are similar to previous changes (2)

• test/onboard-brave-validation.test.ts
• scripts/generate-openclaw-config.py