fix(onboard): align policy defaults with web search

[wscurran]

Summary

Fresh interactive onboarding now initializes the policy preset screen from the agent- and web-search-aware suggestions instead of rechecking every policy-tier default. Selecting no web search no longer preselects Brave egress, while Brave and Tavily selections continue to check only their matching preset.

Related Issue

Fixes #7125

Changes

• Treat the policy prompt's supplied initial selection as the exact checked set while retaining tier ordering and access defaults.
• Preserve the existing agent support split: OpenClaw supports Brave and Tavily, while Hermes supports Tavily only.
• Add prompt-level and onboarding regression coverage for no-search, Brave, and Tavily selections across OpenClaw and Hermes.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: Existing OpenClaw, Hermes, and network-policy docs already describe the agent-specific provider choices and matching policy presets; the documentation review found no mismatch.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Focused nine-category review found no security issues. The change adds no inputs, credentials, dependencies, or policy rules; it narrows unintended default egress while preserving explicit operator selections, with agent/provider regression coverage.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run src/lib/onboard/policy-selection-prompts.test.ts test/policy-tiers-onboard.test.ts test/onboard-policy-suggestions.test.ts — 3 files and 104 tests passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Will Curran wcurran@nvidia.com

Summary by CodeRabbit

• New Features

  • Interactive policy onboarding now preselects the correct web-search preset(s) based on the selected agent and search configuration.
  • Onboarding can now honor explicitly provided initial preset selections.

• Bug Fixes

  • Invalid initial preset names are now safely ignored.
  • Preset ordering and computed access remain consistent when starting from preselected options.

• Tests

  • Added coverage for agent-specific search defaults and explicit initial selection behavior (including filtering).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0a08c321-06a9-4239-9735-4a609d27fc47

📥 Commits

Reviewing files that changed from the base of the PR and between eff816d and f6bd2e8.

📒 Files selected for processing (2)

• src/lib/onboard/policy-selection.ts
• test/policy-tiers-onboard.test.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• src/lib/onboard/policy-selection.ts
• test/policy-tiers-onboard.test.ts

---

📝 Walkthrough

Walkthrough

The onboarding preset-selection APIs now accept optional initialSelected values. Valid initial presets are preserved, invalid names are filtered, and interactive onboarding tests verify web-search-specific preselection.

Changes

Preset selection onboarding

Layer / File(s)	Summary
Initial selection contract and filtering src/lib/onboard/policy-selection.ts, src/lib/onboard/policy-selection-prompts.ts	The selection contract now names its optional third argument initialSelected; valid provided presets are used instead of automatically combining tier presets.
Onboarding initial-selection wiring src/lib/onboard.ts, src/lib/onboard/policy-selection.ts, test/policy-tiers-onboard.test.ts	Onboarding adapters forward initialSelected, and the harness supports configurable interactive-mode coverage for matching web-search presets.
Preset-selection validation src/lib/onboard/policy-selection-prompts.test.ts, test/policy-tiers-onboard.test.ts	Tests cover explicit selections, invalid preset filtering, computed access, and tier/non-tier ordering.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• NVIDIA/NemoClaw#6279: Updates onboarding tests to use the same initialSelected semantics.

Suggested labels: bug-fix, area: onboarding, area: policy

Suggested reviewers: senthilr-nv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	[#7125] Policy defaults were updated, but Brave still isn't added to the web-search options or explicit Brave setup flow.	Add Brave to the web-search provider choices and surface any required Brave setup or clarify the Brave network-access distinction.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and matches the main onboarding change: aligning policy defaults with web search.
Out of Scope Changes check	✅ Passed	The changes stay focused on onboarding policy selection and related tests, with no clear unrelated feature work.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-7125-web-search-policy-defaults

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/fix-7125-web-s... branch remains at 80%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main 757e5e2	codex/fix-7125-web-s... f6bd2e8	+/-
src/lib/onboard.ts	31%	31%	0%
src/lib/policy/...t-provenance.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	91%	91%	0%
src/lib/state/m...lock-storage.ts	97%	97%	0%
src/lib/tunnel/services.ts	73%	73%	0%
src/lib/onboard...cy-selection.ts	91%	96%	+5%
src/lib/state/m...-acquisition.ts	84%	89%	+5%
src/lib/domain/.../connect-env.ts	89%	97%	+8%

---

_{Updated July 18, 2026 01:26 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 1 warning · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 1 more warning, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: onboard-repair, onboard-resume, cloud-onboard

1 optional E2E recommendation

• brave-search

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

🧹 Nitpick comments (1)

src/lib/onboard/policy-selection.ts (1)

463-471: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Stale extraSelected names after contract rename to initialSelected. The SetupPolicySelectionDeps.selectTierPresetsAndAccess type renamed its third parameter from extraSelected to initialSelected, but local variable and parameter names in callers were not updated, creating a mismatch between the contract and its consumers.

• src/lib/onboard/policy-selection.ts#L463-L471: rename the local extraSelected variable to initialSelected and update the argument passed to selectTierPresetsAndAccess.
• test/policy-tiers-onboard.test.ts#L166-L168: rename the extraSelected parameter in the test harness selectTierPresetsAndAccess implementation to initialSelected and update the forwarded argument.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard/policy-selection.ts` around lines 463 - 471, Rename the local
extraSelected variable to initialSelected in src/lib/onboard/policy-selection.ts
at lines 463-471 and pass the renamed variable to selectTierPresetsAndAccess. In
test/policy-tiers-onboard.test.ts at lines 166-168, rename the
selectTierPresetsAndAccess harness parameter to initialSelected and update the
forwarded argument accordingly.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/lib/onboard/policy-selection.ts`:
- Around line 463-471: Rename the local extraSelected variable to
initialSelected in src/lib/onboard/policy-selection.ts at lines 463-471 and pass
the renamed variable to selectTierPresetsAndAccess. In
test/policy-tiers-onboard.test.ts at lines 166-168, rename the
selectTierPresetsAndAccess harness parameter to initialSelected and update the
forwarded argument accordingly.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ea7914e7-9644-424a-9362-6e751dd5dbdd

📥 Commits

Reviewing files that changed from the base of the PR and between 757e5e2 and eff816d.

📒 Files selected for processing (5)

• src/lib/onboard.ts
• src/lib/onboard/policy-selection-prompts.test.ts
• src/lib/onboard/policy-selection-prompts.ts
• src/lib/onboard/policy-selection.ts
• test/policy-tiers-onboard.test.ts

[wscurran]

@ericksoa @senthilr-nv summary of flow:

• Custom/interactive install: this PR fixes the preset screen so its initial checkmarks match the selected agent and web-search provider.
• Express/non-interactive install: it already consumes the provider-aware suggestions directly and does not use the interactive checkbox helper, so behavior remains correct and unchanged.

Expected outcomes for both:

• No web search → neither brave nor tavily
• OpenClaw + Brave → brave
• OpenClaw/Hermes + Tavily → tavily
• Hermes never receives Brave support