refactor(policy): move messaging policies into channels - #6129
Merged
Conversation
sandl99
added
area: docs
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughMessaging policy presets move from the central Hermes additions file into per-channel YAML files. The loader, sandbox flows, onboarding, discovery, packaging, docs, and tests now resolve those presets with channel and sandbox context. ChangesChannel-owned policy migration
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant policy_channel_ts as src/lib/actions/sandbox/policy-channel.ts
participant policy_index_ts as src/lib/policy/index.ts
participant channels_policy_ts as src/lib/messaging/channels/policy.ts
policy_channel_ts->>policy_index_ts: loadPresetForSandbox(sandboxName, presetName)
policy_index_ts->>policy_index_ts: resolve sandbox agent
policy_index_ts->>channels_policy_ts: loadMessagingChannelPolicyPreset(presetName, agent)
alt channel preset exists
channels_policy_ts-->>policy_index_ts: preset YAML content
else no channel preset
policy_index_ts->>policy_index_ts: loadCentralPreset(presetName)
policy_index_ts-->>policy_channel_ts: preset YAML content or null
end
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-6129.docs.buildwithfern.com/nemoclaw |
Contributor
PR Review Advisor (Nemotron Ultra) — BlockedMerge posture: Do not merge until addressed Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Contributor
PR Review Advisor — BlockedMerge posture: Do not merge until addressed Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (3)
scripts/validate-configs.ts (1)
61-150: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRepeated try/catch ENOENT + directory-walker pattern could be consolidated.
The ENOENT/ENOTDIR try/catch guard is now duplicated four times, and
walkModelSetup/walkChannelPoliciesare near-identical recursive walkers differing only by file predicate. Consider extracting a sharedsafeWalk(dir, predicate)helper to reduce duplication as more discovery targets are added.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/validate-configs.ts` around lines 61 - 150, The directory discovery logic in validate-configs is duplicating the same ENOENT/ENOTDIR guard and recursive walk pattern in multiple places. Extract a shared helper around the existing walkModelSetup and walkChannelPolicies behavior, such as a reusable safeWalk(dir, predicate) or safeReaddir wrapper, and use it for agentsDir, modelSetupDir, presetsDir, and channelPoliciesDir discovery so the file predicate and target-specific push logic remain separate while the traversal/error handling is centralized.package.json (1)
82-82: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueGlob only covers
.yaml, not.yml.
scripts/validate-configs.tsdiscovers channel policy files with/\.ya?ml$/(both extensions), but this packaging glob only matches*.yaml. Any future.ymlchannel policy preset would pass validation but be silently excluded from the published package.Proposed glob widening
- "src/lib/messaging/channels/**/policy/*.yaml", + "src/lib/messaging/channels/**/policy/*.{yaml,yml}",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 82, The packaging glob for channel policy presets only matches .yaml and misses .yml, so widen the pattern in package.json to cover both extensions consistently with scripts/validate-configs.ts. Update the existing src/lib/messaging/channels/**/policy/*.yaml entry so the publish package includes any .yml policy files as well, keeping the packaging glob aligned with the validator’s /\.ya?ml$/ discovery in the same preset area.tools/pr-review-advisor/analyze.mts (1)
706-720: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚖️ Poor tradeoffDuplicated declarative-config path inventory risks drift.
This
e2eSignalsfilter andlooksLikeDeclarativeConfigPathinscripts/find-source-shape-tests.tsboth hardcode overlapping path patterns for policy/config files (nemoclaw-blueprint/policies/,src/lib/messaging/channels/.../policy/...yaml,agents/*/policy-*.yaml). Adding a new channel or config location requires remembering to update both independently maintained lists.Consider extracting a shared canonical list/predicate (e.g., a small shared module) that both the shape-test scanner and this advisor import, so the two purposes can't silently diverge.
As per path instructions, "Derive inventories and limits from a canonical source where possible; flag duplicated lists that can silently drift."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tools/pr-review-advisor/analyze.mts` around lines 706 - 720, The e2eSignals filter in analyze.mts duplicates declarative-config path rules that also exist in looksLikeDeclarativeConfigPath, which can drift over time. Refactor the shared policy/config path matching into a single canonical helper or small shared module, then have both e2eSignals and scripts/find-source-shape-tests.ts import and use it so new policy locations only need to be updated once.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/messaging/channels/policy.test.ts`:
- Around line 48-59: The policy test now adds a new conditional via the
null-check around resolveMessagingChannelPolicyPresetPath in policy.test.ts,
which trips the test-conditionals guardrail. Refactor the loop in the
manifest/agent/preset coverage test to avoid an explicit if statement while
still collecting unresolved preset paths, keeping the logic inside
listBuiltInMessagingChannelManifests, listMessagingPolicyPresetMetadata, and
resolveMessagingChannelPolicyPresetPath functionally equivalent.
In `@src/lib/messaging/channels/policy.ts`:
- Around line 26-28: The normalizeAgent resolver currently coerces every
non-hermes agent to openclaw, which can incorrectly apply channel policy YAMLs
for unsupported agents. Update normalizeAgent in policy.ts to only return a
valid MessagingAgentId for explicitly supported agents and otherwise signal an
unsupported value so callers can skip or hard-gate before any policy mutation.
Then ensure the preset-loading flow that uses this resolver checks the
manifest/channel support path before calling policy/provider/credential/registry
rebuild logic, including the add-channel paths referenced by the related blocks.
In `@test/channels-add-preset.test.ts`:
- Line 184: Keep the sandbox-aware stub observable by changing the test harness
stub for policies.loadPresetForSandbox() so it does not simply delegate to
loadPreset(). Update the stub in channels-add-preset.test.ts to exercise
sandbox-scoped behavior directly, using the same policies object and the
loadPresetForSandbox symbol, so Hermes-specific fixtures validate the new
resolution path instead of bypassing it.
In `@test/policy-channel-yaml-contract.test.ts`:
- Around line 57-81: The test in policy-channel-yaml-contract is currently
vacuous because it can pass when the expected Slack REST endpoints or policy
keys disappear, so add explicit assertions that the filtered endpoint list is
non-empty before the loop in the Slack request-body rewrite case, and likewise
assert the result from rulesFor("nous_research", "nousresearch.com") is
non-empty before comparing to an empty array. Use the existing helpers
allEndpoints, channelPolicy, and rulesFor to locate and guard these checks so
the test fails loudly if the underlying YAML data changes or is renamed.
---
Nitpick comments:
In `@package.json`:
- Line 82: The packaging glob for channel policy presets only matches .yaml and
misses .yml, so widen the pattern in package.json to cover both extensions
consistently with scripts/validate-configs.ts. Update the existing
src/lib/messaging/channels/**/policy/*.yaml entry so the publish package
includes any .yml policy files as well, keeping the packaging glob aligned with
the validator’s /\.ya?ml$/ discovery in the same preset area.
In `@scripts/validate-configs.ts`:
- Around line 61-150: The directory discovery logic in validate-configs is
duplicating the same ENOENT/ENOTDIR guard and recursive walk pattern in multiple
places. Extract a shared helper around the existing walkModelSetup and
walkChannelPolicies behavior, such as a reusable safeWalk(dir, predicate) or
safeReaddir wrapper, and use it for agentsDir, modelSetupDir, presetsDir, and
channelPoliciesDir discovery so the file predicate and target-specific push
logic remain separate while the traversal/error handling is centralized.
In `@tools/pr-review-advisor/analyze.mts`:
- Around line 706-720: The e2eSignals filter in analyze.mts duplicates
declarative-config path rules that also exist in looksLikeDeclarativeConfigPath,
which can drift over time. Refactor the shared policy/config path matching into
a single canonical helper or small shared module, then have both e2eSignals and
scripts/find-source-shape-tests.ts import and use it so new policy locations
only need to be updated once.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 5db6ad61-6adf-4903-a6af-83e734050178
📒 Files selected for processing (47)
agents/hermes/policy-additions.yamlci/platform-matrix.jsonci/test-file-size-budget.jsondocs/reference/platform-support.mdxpackage.jsonschemas/policy-preset.schema.jsonscripts/find-source-shape-tests.tsscripts/validate-configs.tssrc/lib/actions/sandbox/policy-channel-agent-gate.test.tssrc/lib/actions/sandbox/policy-channel-policy.test.tssrc/lib/actions/sandbox/policy-channel-refresh.test.tssrc/lib/actions/sandbox/policy-channel.tssrc/lib/messaging/AGENTS.mdsrc/lib/messaging/README.mdsrc/lib/messaging/channels/discord/policy/hermes.yamlsrc/lib/messaging/channels/discord/policy/openclaw.yamlsrc/lib/messaging/channels/index.tssrc/lib/messaging/channels/policy.test.tssrc/lib/messaging/channels/policy.tssrc/lib/messaging/channels/slack/policy/hermes.yamlsrc/lib/messaging/channels/slack/policy/openclaw.yamlsrc/lib/messaging/channels/teams/policy/hermes.yamlsrc/lib/messaging/channels/teams/policy/openclaw.yamlsrc/lib/messaging/channels/telegram/policy/hermes.yamlsrc/lib/messaging/channels/telegram/policy/openclaw.yamlsrc/lib/messaging/channels/wechat/policy/hermes.yamlsrc/lib/messaging/channels/wechat/policy/openclaw.yamlsrc/lib/messaging/channels/whatsapp/policy/hermes.yamlsrc/lib/messaging/channels/whatsapp/policy/openclaw.yamlsrc/lib/messaging/messaging-network-policy-flow.mdsrc/lib/onboard/initial-policy.test.tssrc/lib/onboard/initial-policy.tssrc/lib/policy/context.test.tssrc/lib/policy/context.tssrc/lib/policy/failure-classifier.test.tssrc/lib/policy/index.tstest/channels-add-deepagents-rejection.test.tstest/channels-add-preset.test.tstest/onboard-messaging.test.tstest/package-contract/cli/policy-dispatch.test.tstest/policies.test.tstest/policy-add-remove-session-sync.test.tstest/policy-channel-yaml-contract.test.tstest/pr-review-advisor.test.tstest/validate-blueprint.test.tstest/validate-config-schemas.test.tstools/pr-review-advisor/analyze.mts
💤 Files with no reviewable changes (1)
- agents/hermes/policy-additions.yaml
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/package-contract/cli/policy-dispatch.test.ts (1)
30-56: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider cleaning up the temp directory after the test.
Unlike the sibling test in
test/policy-channel-agent-resolution.test.ts(which callsfs.rmSync(tmpDir, { recursive: true, force: true })afterspawnSync), this test never removestmpDir. Over many CI runs this leaves stray temp directories behind.♻️ Suggested cleanup
expect(result.status).toBe(0); const payload = JSON.parse(result.stdout.split("__RESULT__")[1].trim()); expect(payload.openclawKeys).toEqual(["telegram_bot"]); expect(payload.hermesKeys).toEqual(["telegram"]); + fs.rmSync(tmpDir, { recursive: true, force: true }); });The static analysis warning about
fs.writeFileSync(scriptPath, script)(path traversal) is a false positive —scriptPathis derived entirely fromfs.mkdtempSyncand a fixed filename, not external input.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/package-contract/cli/policy-dispatch.test.ts` around lines 30 - 56, The test in policy-dispatch.test.ts leaves behind the temporary directory created with fs.mkdtempSync after spawnSync completes. Add cleanup after the assertions by removing tmpDir with fs.rmSync using recursive and force options, matching the cleanup pattern used in the sibling temp-dir test, and keep the rest of the packaged-channel policy check logic unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/package-contract/cli/policy-dispatch.test.ts`:
- Around line 30-56: The test in policy-dispatch.test.ts leaves behind the
temporary directory created with fs.mkdtempSync after spawnSync completes. Add
cleanup after the assertions by removing tmpDir with fs.rmSync using recursive
and force options, matching the cleanup pattern used in the sibling temp-dir
test, and keep the rest of the packaged-channel policy check logic unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 8f3be0eb-e3f3-475b-8d81-5e3af2db3ae5
📒 Files selected for processing (7)
package.jsonsrc/lib/messaging/channels/policy.test.tssrc/lib/messaging/channels/policy.tstest/channels-add-preset.test.tstest/package-contract/cli/policy-dispatch.test.tstest/policy-channel-agent-resolution.test.tstest/policy-channel-yaml-contract.test.ts
✅ Files skipped from review due to trivial changes (1)
- package.json
🚧 Files skipped from review as they are similar to previous changes (3)
- test/channels-add-preset.test.ts
- src/lib/messaging/channels/policy.ts
- test/policy-channel-yaml-contract.test.ts
Collaborator
Author
|
Replying to #6129 (comment). Current head: We are not taking further code action on the remaining required PRA items from that advisor pass. Rationale:
All PR checks are green on the current head, including |
sandl99
added
area: messaging
Contributor
Vitest E2E Target Results — ✅ All selected jobs passedRun: 28526235736
|
10 tasks
…l-policies # Conflicts: # src/lib/messaging/channels/index.ts
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
Contributor
Vitest E2E Target Results — ✅ All selected jobs passedRun: 28608432026
|
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
cv
approved these changes
Jul 2, 2026
Contributor
Vitest E2E Target Results — ✅ All selected jobs passedRun: 28611227084
|
Collaborator
Author
|
@cv Ready to merge |
Contributor
Vitest E2E Target Results — ✅ All selected jobs passedRun: 28639654676
|
21 tasks
ericksoa
added a commit
that referenced
this pull request
Jul 4, 2026
<!-- markdownlint-disable MD041 --> ## Summary This PR prepares the user-facing documentation for v0.0.74 before the release plan is frozen. It expands the release notes across the 56-commit train and closes durable documentation gaps found during the pre-tag commit scan. ## Changes - Expand the `v0.0.74` release notes to cover OpenShell 0.0.72, managed MCP, progressive tool disclosure, LangChain Deep Agents Code, onboarding, local inference, messaging, recovery, and contributor workflows. - Correct the `destroy` contract for retained per-name volumes, gateway-unreachable `--force` cleanup, managed MCP ownership, and same-name recovery. - Document separate remediation for an unreachable container DNS resolver versus one that answers with `NXDOMAIN` or `REFUSED`. - Document the Windows on Arm N1X automatic Ollama safeguard and its remaining large-model limitations. - State that messaging conflicts abort rebuild before backup or deletion, leaving the original sandbox intact. - Link the agent-runnable value benchmark from the contributor task index. - Synchronize generated agent command variants. - Validate with `npm run docs:sync-agent-variants` and `npm run docs`; Fern completed with 0 errors and 2 existing warnings. - Source summary: - [#6020](#6020) and [#5876](#5876) -> `docs/about/release-notes.mdx`: Consolidate the OpenShell 0.0.72 policy boundary and managed MCP lifecycle. - [#6251](#6251) and [#5989](#5989) -> `docs/about/release-notes.mdx`: Summarize progressive tool disclosure and sandbox-first inference controls. - [#6232](#6232), [#6082](#6082), [#6219](#6219), [#6214](#6214), [#6215](#6215), [#6230](#6230), and [#6260](#6260) -> `docs/about/release-notes.mdx`: Summarize the experimental LangChain Deep Agents Code status, secret, version, rebuild, snapshot, and MCP boundaries. - [#6166](#6166), [#6254](#6254), [#6265](#6265), [#6164](#6164), and [#6017](#6017) -> `docs/about/release-notes.mdx`: Summarize BuildKit prebuild, validated image reuse, bounded readiness, and preflight improvements. - [#6150](#6150) -> `docs/about/release-notes.mdx` and `docs/reference/troubleshooting.mdx`: Separate unreachable-resolver remediation from reachable-but-rejected DNS responses. - [#6234](#6234) -> `docs/about/release-notes.mdx`, `docs/inference/use-local-inference.mdx`, and `docs/get-started/windows-preparation.mdx`: Document N1X automatic 9B selection and the remaining explicit-large-model boundary. - [#6129](#6129), [#5987](#5987), [#5955](#5955), and [#6220](#6220) -> `docs/about/release-notes.mdx`, `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/commands.mdx`, and `docs/reference/commands-nemohermes.mdx`: Document messaging policy persistence, status, and the pre-destructive conflict check. - [#5963](#5963), [#6050](#6050), [#6094](#6094), [#6238](#6238), [#5988](#5988), [#6235](#6235), [#6181](#6181), and [#5986](#5986) -> `docs/about/release-notes.mdx`, `docs/reference/commands.mdx`, and `docs/reference/commands-nemohermes.mdx`: Summarize day-two recovery and clarify retained-volume and local-only destroy semantics. - [#6200](#6200), [#6248](#6248), [#6168](#6168), [#6270](#6270), and [#5649](#5649) -> `docs/about/release-notes.mdx` and `CONTRIBUTING.md`: Summarize contributor setup and verification improvements and expose the advisory value benchmark. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates <!-- Check exactly one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: documentation-only release preparation; generated-variant synchronization and the Fern docs build validate the changed pages and routes. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: tests are not applicable to this documentation-only change; `npm run docs` validates the source and generated routes. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Expanded setup guidance for Windows on Arm devices with safer default local model selection. * Clarified local inference and sandbox messaging behavior, including conflict checks before rebuilds and safer recovery steps. * Updated destroy/rebuild/reference docs with more detailed warnings, failure handling, and volume-retention guidance. * Improved troubleshooting instructions for Docker DNS issues with clearer paths for unreachable vs. blocked resolvers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary This PR moves messaging-channel network policy data for OpenClaw and Hermes into the channel package tree under `src/lib/messaging/channels`. It keeps policy resolution manifest-driven while removing messaging endpoint data from central blueprint presets and Hermes baseline policy additions. ## Related issues Fixes NVIDIA#6185 ## Changes - Added channel-owned `openclaw.yaml` and `hermes.yaml` policy presets for Telegram, Discord, Slack, Teams, WeChat, and WhatsApp. - Added a messaging channel policy resolver and wired sandbox-aware preset loading through onboarding, `policy-add`/`policy-remove`, and `channels add` flows. - Updated package/schema/config validation, platform matrix docs sync, internal messaging guidance, and focused tests for the new policy source layout. - Split channel YAML contract coverage into `test/policy-channel-yaml-contract.test.ts` and ratcheted the oversized `test/policies.test.ts` file budget down. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-reviewed policy/onboarding/channel lifecycle changes; focused tests and CI requested. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: no CI waiver requested; local `test-cli` failure was reproduced on clean `main` in this environment. ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes — commit/push hooks passed with local `test-cli` skipped; full `test-cli` also fails on clean `main` locally. - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — `npm run docs` passed; Fern reported 2 warnings. - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification evidence: - `npm run typecheck:cli` - `npx tsx scripts/validate-configs.ts` - `npm run build:cli` - `npx vitest run --project cli src/lib/messaging/channels/policy.test.ts src/lib/actions/sandbox/policy-channel-agent-gate.test.ts src/lib/shields/timer.test.ts src/lib/onboard/initial-policy.test.ts` - `npx vitest run --project integration test/onboard-messaging.test.ts test/policies.test.ts` - `npx vitest run --project integration test/policy-channel-yaml-contract.test.ts test/policies.test.ts test/channels-add-preset.test.ts test/validate-blueprint.test.ts` - `npm run source-shape:check` - `npm run test-size:check` - `npm run docs` - `npx prek run --files ...` passed all non-`test-cli` hooks; `test-cli` failed with the same local platform/runtime fixture failures reproduced on clean `main`. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: San Dang <sdang@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added/expanded built-in messaging channel policy presets for Discord, Slack, Teams, Telegram, WeChat, and WhatsApp with agent-specific Hermes/OpenClaw variants. * Channel policy presets are now packaged and discovered from per-channel policy locations. * **Bug Fixes** * Sandbox add/remove/refresh now uses sandbox-scoped preset resolution to avoid incorrect preset selection. * Removed messaging-channel network policy templates from the Hermes sandbox policy file to prevent unintended template egress. * **Documentation** * Updated messaging integration notes and setup instructions, including WebSocket/Noise/h1-ALPN caveats. * **Tests** * Expanded coverage for sandbox-aware preset loading and messaging YAML policy contracts. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: San Dang <sdang@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary This PR prepares the user-facing documentation for v0.0.74 before the release plan is frozen. It expands the release notes across the 56-commit train and closes durable documentation gaps found during the pre-tag commit scan. ## Changes - Expand the `v0.0.74` release notes to cover OpenShell 0.0.72, managed MCP, progressive tool disclosure, LangChain Deep Agents Code, onboarding, local inference, messaging, recovery, and contributor workflows. - Correct the `destroy` contract for retained per-name volumes, gateway-unreachable `--force` cleanup, managed MCP ownership, and same-name recovery. - Document separate remediation for an unreachable container DNS resolver versus one that answers with `NXDOMAIN` or `REFUSED`. - Document the Windows on Arm N1X automatic Ollama safeguard and its remaining large-model limitations. - State that messaging conflicts abort rebuild before backup or deletion, leaving the original sandbox intact. - Link the agent-runnable value benchmark from the contributor task index. - Synchronize generated agent command variants. - Validate with `npm run docs:sync-agent-variants` and `npm run docs`; Fern completed with 0 errors and 2 existing warnings. - Source summary: - [NVIDIA#6020](NVIDIA#6020) and [NVIDIA#5876](NVIDIA#5876) -> `docs/about/release-notes.mdx`: Consolidate the OpenShell 0.0.72 policy boundary and managed MCP lifecycle. - [NVIDIA#6251](NVIDIA#6251) and [NVIDIA#5989](NVIDIA#5989) -> `docs/about/release-notes.mdx`: Summarize progressive tool disclosure and sandbox-first inference controls. - [NVIDIA#6232](NVIDIA#6232), [NVIDIA#6082](NVIDIA#6082), [NVIDIA#6219](NVIDIA#6219), [NVIDIA#6214](NVIDIA#6214), [NVIDIA#6215](NVIDIA#6215), [NVIDIA#6230](NVIDIA#6230), and [NVIDIA#6260](NVIDIA#6260) -> `docs/about/release-notes.mdx`: Summarize the experimental LangChain Deep Agents Code status, secret, version, rebuild, snapshot, and MCP boundaries. - [NVIDIA#6166](NVIDIA#6166), [NVIDIA#6254](NVIDIA#6254), [NVIDIA#6265](NVIDIA#6265), [NVIDIA#6164](NVIDIA#6164), and [NVIDIA#6017](NVIDIA#6017) -> `docs/about/release-notes.mdx`: Summarize BuildKit prebuild, validated image reuse, bounded readiness, and preflight improvements. - [NVIDIA#6150](NVIDIA#6150) -> `docs/about/release-notes.mdx` and `docs/reference/troubleshooting.mdx`: Separate unreachable-resolver remediation from reachable-but-rejected DNS responses. - [NVIDIA#6234](NVIDIA#6234) -> `docs/about/release-notes.mdx`, `docs/inference/use-local-inference.mdx`, and `docs/get-started/windows-preparation.mdx`: Document N1X automatic 9B selection and the remaining explicit-large-model boundary. - [NVIDIA#6129](NVIDIA#6129), [NVIDIA#5987](NVIDIA#5987), [NVIDIA#5955](NVIDIA#5955), and [NVIDIA#6220](NVIDIA#6220) -> `docs/about/release-notes.mdx`, `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/commands.mdx`, and `docs/reference/commands-nemohermes.mdx`: Document messaging policy persistence, status, and the pre-destructive conflict check. - [NVIDIA#5963](NVIDIA#5963), [NVIDIA#6050](NVIDIA#6050), [NVIDIA#6094](NVIDIA#6094), [NVIDIA#6238](NVIDIA#6238), [NVIDIA#5988](NVIDIA#5988), [NVIDIA#6235](NVIDIA#6235), [NVIDIA#6181](NVIDIA#6181), and [NVIDIA#5986](NVIDIA#5986) -> `docs/about/release-notes.mdx`, `docs/reference/commands.mdx`, and `docs/reference/commands-nemohermes.mdx`: Summarize day-two recovery and clarify retained-volume and local-only destroy semantics. - [NVIDIA#6200](NVIDIA#6200), [NVIDIA#6248](NVIDIA#6248), [NVIDIA#6168](NVIDIA#6168), [NVIDIA#6270](NVIDIA#6270), and [NVIDIA#5649](NVIDIA#5649) -> `docs/about/release-notes.mdx` and `CONTRIBUTING.md`: Summarize contributor setup and verification improvements and expose the advisory value benchmark. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates <!-- Check exactly one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: documentation-only release preparation; generated-variant synchronization and the Fern docs build validate the changed pages and routes. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: tests are not applicable to this documentation-only change; `npm run docs` validates the source and generated routes. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Expanded setup guidance for Windows on Arm devices with safer default local model selection. * Clarified local inference and sandbox messaging behavior, including conflict checks before rebuilds and safer recovery steps. * Updated destroy/rebuild/reference docs with more detailed warnings, failure handling, and volume-retention guidance. * Improved troubleshooting instructions for Docker DNS issues with clearer paths for unreachable vs. blocked resolvers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
21 tasks
19 tasks
jyaunches
added a commit
that referenced
this pull request
Aug 19, 2026
## Summary `AGENTS.md` tells a contributor to follow the structure of `slack.yaml` and `discord.yaml` when adding a network policy preset. PR #6129 moved both files to `src/lib/messaging/channels/<channel>/policy/<agent>.yaml`, so neither name resolves under `nemoclaw-blueprint/policies/presets/`. This change names two presets that exist in that directory today. ## Related Issue Fixes #9542 ## Changes - `AGENTS.md:307` — replace the `slack.yaml` and `discord.yaml` examples with `github.yaml` and `brave.yaml`. One line in, one line out. No abstraction, configuration, fallback, migration, or compatibility path is added. **The diff touches one file, not two.** `CLAUDE.md` is a tracked symlink to `AGENTS.md` (mode `120000`, blob content `AGENTS.md`), so `git diff --stat` reports `1 file changed, 1 insertion(+), 1 deletion(-)` even though both `AGENTS.md` and `CLAUDE.md` serve the corrected text. The symlink blob is unchanged. ### Why the examples are stale `git log --oneline --diff-filter=D --all` on both paths returns one commit: ``` d13ef62 refactor(policy): move messaging policies into channels (#6129) ``` `git show --name-status d13ef62` records both as renames: ``` R100 nemoclaw-blueprint/policies/presets/discord.yaml -> src/lib/messaging/channels/discord/policy/openclaw.yaml R100 nemoclaw-blueprint/policies/presets/slack.yaml -> src/lib/messaging/channels/slack/policy/openclaw.yaml ``` `git ls-files nemoclaw-blueprint/policies/presets/ | grep -i 'slack\|discord'` returns nothing on `main`. The stale examples do more than fail to resolve. They direct a contributor adding a messaging-channel policy back into the directory that #6129 emptied of messaging policies. `CLAUDE.md` resolves to this file, so every agent session in this repository reads the guidance. ### Why `github.yaml` and `brave.yaml` Both exist in the directory that the preceding line names. `brave.yaml` uses the `protocol: rest` endpoint form with a `rules` list, which matches the structure the removed `slack.yaml` had. `github.yaml` uses the `access: full` form with a `binaries` list. The pair shows both endpoint shapes the preset schema accepts. ### Why no line was added for messaging-channel policies `src/lib/messaging/AGENTS.md:76` already instructs a contributor to add or update `src/lib/messaging/channels/<channel>/policy/<agent>.yaml`, and `AGENTS.md:48` already links that file. `src/lib/policy/index.ts:112-115` and `schemas/policy-preset.schema.json:5` state the same split in code. A second bullet here would repeat guidance the repository already owns elsewhere. `AGENTS.md:306` (`nemoclaw-blueprint/policies/presets/`) remains correct. `scripts/validate-configs.mts:127` reads that directory. ### Scope I checked the rest of `AGENTS.md` for the same class of drift: every backticked path-like token, every `npm run` script against both `package.json` files, the Vitest project names, the commitlint type list, the `engines.node` range, and the language column of the architecture table. Line 307 was the only stale reference, so this PR changes only that line. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: the change edits two filenames in a contributor-guidance sentence. It changes no executable code, no build input, and no behavior-affecting configuration. The claim it makes is checked directly by `git ls-files nemoclaw-blueprint/policies/presets/`. - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable — `npm run validate:pr` exits 0. Every hook reports `Passed`, including `Codebase growth guardrails`, `Repository checks`, `markdownlint-cli2`, `Source-shape test budget`, and `TypeScript (CLI)`. I also ran `NEMOCLAW_GROWTH_BASE_REF=upstream/main npx prek run --from-ref upstream/main --to-ref HEAD` for both the `pre-commit` and `pre-push` stages (exit 0; the TypeScript hooks report `no files to check`, which matches a one-line Markdown diff), and `npx commitlint --from upstream/main --to HEAD` (exit 0). - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — marked not applicable above. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: not applicable; this PR changes no runtime, test-harness, validation, or coverage input. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [x] `npm run docs` builds without warnings (doc changes only) — `npm run docs` exits 0 and reports `check-docs-published-routes: OK — 68 guarded page(s), native changelog links, and direct legacy redirects` and `Found 0 errors and 2 warnings`. Both warnings are pre-existing and unrelated to this change: `Missing redirects check skipped: not authenticated` (local run without `FERN_TOKEN`) and the light-mode accent contrast ratio in the Fern theme. `AGENTS.md` is not an input to the docs build, and `docs/_build/` is gitignored, so this change produces no generated-file churn. - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) — not applicable; `AGENTS.md` is repository guidance, not a page under `docs/`. - [ ] New doc pages include SPDX header and frontmatter (new pages only) Net line change: `git diff --numstat` reports `1 1 AGENTS.md`. Net zero lines. --- Signed-off-by: Udaya Tejas <udayatejas2004@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated network policy preset guidance to reference the current GitHub and Brave presets. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Udaya Tejas <udayatejas2004@gmail.com> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> Co-authored-by: Julie Yaunches <jyaunches@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR moves messaging-channel network policy data for OpenClaw and Hermes into the channel package tree under
src/lib/messaging/channels. It keeps policy resolution manifest-driven while removing messaging endpoint data from central blueprint presets and Hermes baseline policy additions.Related issues
Fixes #6185
Changes
openclaw.yamlandhermes.yamlpolicy presets for Telegram, Discord, Slack, Teams, WeChat, and WhatsApp.policy-add/policy-remove, andchannels addflows.test/policy-channel-yaml-contract.test.tsand ratcheted the oversizedtest/policies.test.tsfile budget down.Type of Change
Quality Gates
test-clifailure was reproduced on cleanmainin this environment.Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpasses — commit/push hooks passed with localtest-cliskipped; fulltest-clialso fails on cleanmainlocally.npm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only) —npm run docspassed; Fern reported 2 warnings.Verification evidence:
npm run typecheck:clinpx tsx scripts/validate-configs.tsnpm run build:clinpx vitest run --project cli src/lib/messaging/channels/policy.test.ts src/lib/actions/sandbox/policy-channel-agent-gate.test.ts src/lib/shields/timer.test.ts src/lib/onboard/initial-policy.test.tsnpx vitest run --project integration test/onboard-messaging.test.ts test/policies.test.tsnpx vitest run --project integration test/policy-channel-yaml-contract.test.ts test/policies.test.ts test/channels-add-preset.test.ts test/validate-blueprint.test.tsnpm run source-shape:checknpm run test-size:checknpm run docsnpx prek run --files ...passed all non-test-clihooks;test-clifailed with the same local platform/runtime fixture failures reproduced on cleanmain.Signed-off-by: San Dang sdang@nvidia.com
Summary by CodeRabbit