feat(policy): support persistent baseline network policy exclusions

ci/platform-matrix.json

@@ -193,7 +193,7 @@
     {
       "name": "Declarative network policy",
       "status": "tested",
-      "notes": "YAML-defined egress with policy presets. Presets include `slack`, `discord`, `telegram`, `weather`, `openclaw-pricing`, `huggingface`, `npm`, `pypi`, `brew`, and others. Hot-reloadable at runtime with `$$nemoclaw <name> policy-add`."
+      "notes": "YAML-defined egress with policy presets. Presets include `slack`, `discord`, `telegram`, `weather`, `openclaw-pricing`, `huggingface`, `npm`, `pypi`, `brew`, and others. Hot-reloadable at runtime with `$$nemoclaw <name> policy add`."
     },
     {
       "name": "Snapshot and restore",

docs/deployment/deploy-to-headless-server.mdx

@@ -348,9 +348,9 @@ Scope the host, port, method, path, and executable to the smallest required set.
 Save a reviewed preset as `./presets/internal-status.yaml`, preview it, then apply it without a prompt:
 
 ```bash
-$$nemoclaw headless-agent policy-add --from-file ./presets/internal-status.yaml --dry-run
-$$nemoclaw headless-agent policy-add --from-file ./presets/internal-status.yaml --yes
-$$nemoclaw headless-agent policy-list
+$$nemoclaw headless-agent policy add --from-file ./presets/internal-status.yaml --dry-run
+$$nemoclaw headless-agent policy add --from-file ./presets/internal-status.yaml --yes
+$$nemoclaw headless-agent policy list
 ```
 
 `--yes` skips the confirmation prompt but does not skip schema, destination, or SSRF validation.
@@ -383,7 +383,7 @@ Use `$$nemoclaw headless-agent rebuild` when you need the current agent image wh
 | Item | Same-container restart | Snapshot and restore | Rebuild or sandbox upgrade |
 |---|---|---|---|
 | Provider configuration | Preserved | Provider names are recorded, but raw credentials are not in the snapshot | Regenerated from registry and OpenShell provider state |
-| Custom preset YAML applied with `policy-add` | Preserved in registry | Stored content is included in snapshot metadata | Replayed from stored content |
+| Custom preset YAML applied with `policy add` | Preserved in registry | Stored content is included in snapshot metadata | Replayed from stored content |
 | Manifest-defined user and agent state | Preserved | Preserved | Preserved when backup and restore succeed |
 | Arbitrary files outside manifest state | Usually remain in the same writable layer | Not preserved | Not preserved |
 | Manually installed system or global packages | Usually remain in the same writable layer | Not preserved | Not preserved |

docs/get-started/quickstart-langchain-deepagents-code.mdx

@@ -288,9 +288,9 @@ The policy preset is a per-sandbox managed-Python opt-in, but provider registrat
 
 ```bash
 # Preview the endpoints the preset opens:
-nemo-deepagents <sandbox-name> policy-add tavily --dry-run
+nemo-deepagents <sandbox-name> policy add tavily --dry-run
 # Apply it:
-nemo-deepagents <sandbox-name> policy-add tavily --yes
+nemo-deepagents <sandbox-name> policy add tavily --yes
 # Export the key on the host (NemoClaw reads it from the current shell):
 export TAVILY_API_KEY=tvly-...
 # Register the provider with the gateway:
@@ -310,7 +310,7 @@ Because OpenShell attributes the harness's calls to the sandbox `python3` interp
 Remove the target sandbox's managed-Python opt-in when it is no longer needed.
 
 ```bash
-nemo-deepagents <sandbox-name> policy-remove tavily --yes
+nemo-deepagents <sandbox-name> policy remove tavily --yes
 ```
 
 This does not unregister the gateway-wide `tavily-search` provider; its credential and Node/curl routes remain available to sandboxes that attach it.

docs/get-started/quickstart.mdx

@@ -358,7 +358,7 @@ Use these details when your first-run path needs more control.
       Status:      nemoclaw my-gpt-claw status
       Logs:        nemoclaw my-gpt-claw logs --follow
       Model:       nemoclaw inference set --model <model> --provider <provider> --sandbox my-gpt-claw
-      Policies:    nemoclaw my-gpt-claw policy-add
+      Policies:    nemoclaw my-gpt-claw policy add
       Credentials: nemoclaw credentials reset <KEY> && nemoclaw onboard
     ──────────────────────────────────────────────────
     ```

docs/manage-sandboxes/backup-restore.mdx

@@ -55,8 +55,8 @@ NemoClaw refuses to create a snapshot when it detects an active `dcode` task or
 Wait for active `dcode` work to finish before running `$$nemoclaw <name> snapshot create`.
 </AgentOnly>
 
-Snapshots preserve sandbox registry metadata that affects rebuild behavior, including custom policy presets applied with `policy-add --from-file` or `policy-add --from-dir`.
-When you restore a snapshot, NemoClaw replays those recorded custom presets with their stored YAML content, so you do not need the original preset files on disk.
+Snapshots preserve sandbox registry metadata that affects rebuild behavior, including custom policy presets applied with `policy add --from-file` or `policy add --from-dir` and baseline network policy entries excluded with `policy exclude`.
+When you restore a snapshot, NemoClaw replays those recorded custom presets with their stored YAML content, so you do not need the original preset files on disk, and rebuild continues to apply the recorded baseline exclusions.
 
 The target sandbox's current agent manifest remains authoritative for state-file restore behavior.
 NemoClaw rejects the restore when the snapshot's agent, config directory, state-file path, or state-file strategy conflicts with that manifest.

docs/manage-sandboxes/runtime-controls.mdx

@@ -23,7 +23,7 @@ NemoClaw applies its security posture in three layers: what onboarding writes in
 | Inference provider | Runtime route and config update while shields are down; rebuild only if you need to recreate the image | Run `$$nemoclaw <name> shields down`, then `$$nemoclaw inference set`, then restore shields |
 | Inference model on the current provider | Runtime route and config update while shields are down | Run `$$nemoclaw <name> shields down`, then `$$nemoclaw inference set`, then restore shields |
 | Sub-agent | Re-onboard required because the sub-agent and workspace are baked at onboard | `$$nemoclaw onboard --recreate-sandbox` |
-| Network policy preset | Runtime on the next request; rebuild only if the preset adds bind-mounted secrets | `$$nemoclaw <name> policy-add <preset>` or `policy-remove <preset>` |
+| Network policy preset | Runtime on the next request; rebuild only if the preset adds bind-mounted secrets | `$$nemoclaw <name> policy add <preset>` or `policy remove <preset>` |
 | Network allowlist | Runtime on the next request | `openshell policy set` or the interactive approval prompt at the gateway |
 | Channel tokens | Rebuild required because the channel configuration and credential attachment are created during onboarding or rebuild | `$$nemoclaw <name> channels add <channel>`, then accept the rebuild prompt |
 | Channel enable or disable | Rebuild required because `openclaw.json` is the runtime source of truth | `$$nemoclaw <name> channels stop <channel>`, then rebuild |
@@ -68,7 +68,7 @@ If preflight detects an unsafe path, invalid config, invalid ownership posture,
 | Inference provider | Runtime route changes apply immediately; rebuild if you need to rebake model metadata into the image | `$$nemoclaw inference set` for route changes, or `$$nemoclaw <name> rebuild` after changing build-time settings |
 | Inference model on the current provider | Hot-reloadable through the Hermes config sync path | `$$nemoclaw inference set` |
 | Agent runtime | Re-onboard required because the agent and state layout are baked at onboard | `$$nemoclaw onboard --recreate-sandbox` or `nemoclaw onboard --agent openclaw --recreate-sandbox` |
-| Network policy preset | Runtime on the next request; rebuild only if the preset adds bind-mounted secrets | `$$nemoclaw <name> policy-add <preset>` or `policy-remove <preset>` |
+| Network policy preset | Runtime on the next request; rebuild only if the preset adds bind-mounted secrets | `$$nemoclaw <name> policy add <preset>` or `policy remove <preset>` |
 | Network allowlist | Runtime on the next request | `openshell policy set` or the interactive approval prompt at the gateway |
 | Channel tokens | Rebuild required because the channel configuration and credential attachment are created during onboarding or rebuild | `$$nemoclaw <name> channels add <channel>`, then accept the rebuild prompt |
 | Channel enable or disable | Rebuild required because `/sandbox/.hermes/.env` and Hermes config are baked at image build time | `$$nemoclaw <name> channels stop <channel>`, then rebuild |

docs/manage-sandboxes/set-up-slack.mdx

@@ -20,7 +20,7 @@ NemoClaw validates both tokens before it saves Slack credentials or enables the
 This validation calls the live Slack APIs `auth.test` and `apps.connections.open`, so the tokens must belong to a real Slack app.
 
 If Slack rejects the tokens, NemoClaw skips the Slack channel and does not apply the `slack` network policy preset.
-When Slack is skipped, the preset does not appear as applied in `$$nemoclaw <name> policy-list`.
+When Slack is skipped, the preset does not appear as applied in `$$nemoclaw <name> policy list`.
 
 To exercise channel setup with placeholder tokens in a restricted network or hermetic test environment, set `NEMOCLAW_SKIP_SLACK_AUTH_VALIDATION=1`.
 Slack token format checks still apply.

docs/monitoring/manage-deepagents-trace-export.mdx

@@ -36,7 +36,7 @@ While the collector is stopped, trace delivery fails open and Deep Agents Code c
 Remove the policy preset to revoke collector reachability immediately:
 
 ```bash
-nemo-deepagents "$SANDBOX_NAME" policy-remove observability-otlp-local --yes
+nemo-deepagents "$SANDBOX_NAME" policy remove observability-otlp-local --yes
 ```
 
 Removing the preset does not clear the recorded observability choice.

docs/monitoring/set-up-deepagents-trace-export.mdx

@@ -54,14 +54,14 @@ On an existing sandbox, skip mode leaves the live policy unchanged.
 Inspect the effective policy:
 
 ```bash
-nemo-deepagents "$SANDBOX_NAME" policy-list
+nemo-deepagents "$SANDBOX_NAME" policy list
 ```
 
 If `observability-otlp-local` is not active, preview and apply it:
 
 ```bash
-nemo-deepagents "$SANDBOX_NAME" policy-add observability-otlp-local --dry-run
-nemo-deepagents "$SANDBOX_NAME" policy-add observability-otlp-local --yes
+nemo-deepagents "$SANDBOX_NAME" policy add observability-otlp-local --dry-run
+nemo-deepagents "$SANDBOX_NAME" policy add observability-otlp-local --yes
 ```
 
 The preset permits only `POST /v1/traces` to `host.openshell.internal:4318` from `/opt/venv/bin/python3*`.

docs/monitoring/verify-deepagents-trace-export.mdx

@@ -53,7 +53,7 @@ For additional collector diagnostics, refer to [Troubleshooting the OpenTelemetr
 | --- | --- |
 | Collector exits at startup | Run the validation command again, then inspect `docker logs nemoclaw-otel-langsmith`. Confirm that the image is the Contrib `0.155.0` image and that all four `LANGSMITH_*` variables were set when the container was created. |
 | Port `4318` is already allocated | Run `ss -ltnp 'sport = :4318'` and stop the conflicting listener. The managed sandbox endpoint is fixed, so changing the collector port does not work. |
-| Collector is healthy but logs no trace count | Run `policy-list` and add `observability-otlp-local` if it is absent. Confirm that `docker port` shows the current `$OTLP_BIND_IP`. Run `nemo-deepagents <sandbox> rebuild --observability --yes` if the sandbox was started without the opt-in. |
+| Collector is healthy but logs no trace count | Run `policy list` and add `observability-otlp-local` if it is absent. Confirm that `docker port` shows the current `$OTLP_BIND_IP`. Run `nemo-deepagents <sandbox> rebuild --observability --yes` if the sandbox was started without the opt-in. |
 | Collector logs `401` | Replace an invalid or expired LangSmith API key, then recreate the collector. |
 | Collector logs `403` | Confirm that the service key can write to the target workspace and that `LANGSMITH_WORKSPACE_ID` matches that workspace. Organization-scoped service keys require `X-Tenant-Id`. |
 | Collector logs `404` | Confirm that `LANGSMITH_OTLP_TRACES_ENDPOINT` uses the correct US, EU, GCP-hosted APAC, AWS-hosted US, or self-hosted API base and ends in `/otel/v1/traces`. |

docs/network-policy/apply-policy-presets.mdx

@@ -5,7 +5,7 @@ title: "Apply Policy Presets"
 sidebar-title: "Apply Policy Presets"
 description: "Add, reapply, list, or remove policy presets for a running NemoClaw sandbox."
 description-agent: "Applies and manages policy presets for a running sandbox. Use when adding maintained integration access, previewing preset scope, reapplying an edited preset, or removing access."
-keywords: ["nemoclaw policy presets", "policy-add", "policy-remove"]
+keywords: ["nemoclaw policy presets", "policy add", "policy remove"]
 content:
   type: "how_to"
 skill:
@@ -15,7 +15,7 @@ Use policy presets to add reviewed network access to one running sandbox without
 NemoClaw records applied presets so rebuild and restore operations can replay them.
 
 <Warning>
-Use `$$nemoclaw <name> policy-add` to merge a preset into the running policy.
+Use `$$nemoclaw <name> policy add` to merge a preset into the running policy.
 The OpenShell `policy set` command replaces the live policy instead of merging it.
 Follow [Replace the Live Network Policy](replace-live-network-policy) only when you need full-policy replacement.
 </Warning>
@@ -29,7 +29,7 @@ Messaging channel choices are scoped to the active agent, so unsupported channel
 List the presets available to the sandbox:
 
 ```bash
-$$nemoclaw <name> policy-list
+$$nemoclaw <name> policy list
 ```
 
 For the maintained preset catalog and guided service workflows, refer to [Common Integration Policy Examples](../integration-policy-examples).
@@ -39,22 +39,22 @@ For the maintained preset catalog and guided service workflows, refer to [Common
 Use `--dry-run` to review the endpoints, rules, and binaries before applying the preset:
 
 ```bash
-$$nemoclaw my-assistant policy-add pypi --dry-run
-$$nemoclaw my-assistant policy-add pypi --yes
+$$nemoclaw my-assistant policy add pypi --dry-run
+$$nemoclaw my-assistant policy add pypi --yes
 ```
 
 Omit the preset name to use the interactive picker:
 
 ```bash
-$$nemoclaw my-assistant policy-add
+$$nemoclaw my-assistant policy add
 ```
 
 Pass a preset name with `--yes` for scripted workflows.
 Set `NEMOCLAW_NON_INTERACTIVE=1` instead of `--yes` to use the same non-interactive flow through an environment variable.
 
 ## Reapply an Edited Preset
 
-Run the same `policy-add` command after you edit a maintained or recorded custom preset.
+Run the same `policy add` command after you edit a maintained or recorded custom preset.
 NemoClaw compares the preset with the live policy.
 If the content differs, it applies the changed content.
 You do not need to remove the preset first.
@@ -68,16 +68,16 @@ Existing presets and baseline entries remain in place.
 List every preset recorded for the sandbox:
 
 ```bash
-$$nemoclaw <name> policy-list
+$$nemoclaw <name> policy list
 ```
 
 Remove a preset when the sandbox no longer needs its access:
 
 ```bash
-$$nemoclaw my-assistant policy-remove pypi --yes
+$$nemoclaw my-assistant policy remove pypi --yes
 ```
 
-`policy-remove` accepts maintained and custom preset names.
+`policy remove` accepts maintained and custom preset names.
 
 ## Understand Persistence
 

docs/network-policy/change-baseline-network-policy.mdx

@@ -81,7 +81,7 @@ Check that the sandbox is running with the updated policy:
 $$nemoclaw <name> status
 ```
 
-Use `$$nemoclaw <name> policy-list` to inspect the tracked preset state.
+Use `$$nemoclaw <name> policy list` to inspect the tracked preset state.
 Use `openshell policy get <name>` when you need to inspect the effective OpenShell policy.
 
 ## Related Topics

docs/network-policy/configure-raw-tls-passthrough.mdx

@@ -50,7 +50,7 @@ The filename without `.yaml` must match `preset.name`.
 Apply the catalog preset:
 
 ```bash
-$$nemoclaw my-assistant policy-add cf-fronted-api
+$$nemoclaw my-assistant policy add cf-fronted-api
 ```
 
 Run the same command after editing the file.

docs/network-policy/create-custom-policy-presets.mdx

@@ -5,7 +5,7 @@ title: "Create Custom Policy Presets"
 sidebar-title: "Create Custom Presets"
 description: "Author and apply a scoped network policy preset for an endpoint that NemoClaw does not include."
 description-agent: "Creates and applies custom policy presets. Use when adding a reviewed endpoint, applying preset files, or allowing a URL-based MCP server."
-keywords: ["nemoclaw custom policy preset", "policy-add from-file", "url mcp network policy"]
+keywords: ["nemoclaw custom policy preset", "policy add from-file", "url mcp network policy"]
 content:
   type: "how_to"
 skill:
@@ -68,8 +68,8 @@ The only exception is the `host.openshell.internal` bridge endpoint for explicit
 Preview the file before you apply it:
 
 ```bash
-$$nemoclaw my-assistant policy-add --from-file ./presets/my-service-api.yaml --dry-run
-$$nemoclaw my-assistant policy-add --from-file ./presets/my-service-api.yaml --yes
+$$nemoclaw my-assistant policy add --from-file ./presets/my-service-api.yaml --dry-run
+$$nemoclaw my-assistant policy add --from-file ./presets/my-service-api.yaml --yes
 ```
 
 NemoClaw records the complete YAML content with the sandbox.
@@ -80,7 +80,7 @@ You can remove the preset later without keeping the original file.
 Apply preset files in lexicographic order:
 
 ```bash
-$$nemoclaw my-assistant policy-add --from-dir ./presets/ --yes
+$$nemoclaw my-assistant policy add --from-dir ./presets/ --yes
 ```
 
 Processing stops at the first failure.
@@ -91,13 +91,13 @@ Fix the failing file and run the command again to continue.
 
 Save a maintained local preset under `nemoclaw-blueprint/policies/presets/`.
 The filename without `.yaml` must match `preset.name`.
-The preset catalog reads `preset.name`, while `policy-add <name>` loads `presets/<name>.yaml`.
+The preset catalog reads `preset.name`, while `policy add <name>` loads `presets/<name>.yaml`.
 A mismatch can list a preset that the named command cannot load.
 
 Apply the catalog preset by name:
 
 ```bash
-$$nemoclaw my-assistant policy-add my-service-api
+$$nemoclaw my-assistant policy add my-service-api
 ```
 
 Run the same command after editing the file.
@@ -108,10 +108,10 @@ NemoClaw compares the preset with the live policy and applies changed content.
 Remove the preset by its recorded name:
 
 ```bash
-$$nemoclaw my-assistant policy-remove my-service-api --yes
+$$nemoclaw my-assistant policy remove my-service-api --yes
 ```
 
-Run `$$nemoclaw <name> policy-list` to see every maintained and custom preset recorded for the sandbox.
+Run `$$nemoclaw <name> policy list` to see every maintained and custom preset recorded for the sandbox.
 
 ## Configure a URL-Based MCP Server
 
@@ -160,7 +160,7 @@ Save the file as `nemoclaw-blueprint/policies/presets/my-mcp.yaml`.
 Apply it by name:
 
 ```bash
-$$nemoclaw my-assistant policy-add my-mcp
+$$nemoclaw my-assistant policy add my-mcp
 ```
 
 NemoClaw previews the effective egress scope and prompts for confirmation before applying it.

docs/network-policy/customize-network-policy.mdx

@@ -26,7 +26,7 @@ NemoClaw declares sandbox policy in YAML, and [NVIDIA OpenShell](https://github.
 
 <Note>
 If a sandbox needs an HTTP service on the host, expose the service on a host IP that the OpenShell gateway can reach.
-Apply a custom preset with `$$nemoclaw <sandbox> policy-add --from-file`.
+Apply a custom preset with `$$nemoclaw <sandbox> policy add --from-file`.
 Do not rely on `host.docker.internal` as a general host-service path because it bypasses the OpenShell policy path and may not be reachable.
 Refer to [Agent cannot reach a host-side HTTP service](../reference/troubleshooting#agent-cannot-reach-a-host-side-http-service).
 </Note>