fix(policy): suppress agent-required preset additions on restricted tier#5798
Open
laitingsheng wants to merge 28 commits into
Open
fix(policy): suppress agent-required preset additions on restricted tier#5798laitingsheng wants to merge 28 commits into
laitingsheng wants to merge 28 commits into
Conversation
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughRestricted-tier policy descriptions were updated to state that agent-required presets are suppressed and must be re-applied later. Onboarding selection now computes, reports, and filters those suppressed presets for OpenClaw restricted mode, and tests cover the new behavior. ChangesRestricted tier preset suppression
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
laitingsheng
added
area: onboarding
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the branch is 96%. Coverage data for the branch is not yet available. Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the branch is 47%. Coverage data for the branch is not yet available. Show a code coverage summary of the most covered files.
Updated |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-5798.docs.buildwithfern.com/nemoclaw |
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 3 items to resolve/justify, 1 in-scope improvement
|
Contributor
E2E Advisor RecommendationRequired E2E: Auto-dispatched E2E: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
docs/reference/network-policies.mdx (1)
71-71: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valuePassive voice in tier description.
"Agent-required preset additions ... are suppressed" is passive. Consider rephrasing actively, e.g. "Restricted mode suppresses agent-required preset additions, such as OpenClaw pricing fetches; reapply them later with
policy-add...".As per path instructions: "Active voice required. Flag passive constructions."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/network-policies.mdx` at line 71, The Restricted tier description uses passive voice in the sentence about agent-required preset additions, so rewrite it in active voice. Update the wording in the network-policies documentation so the Restricted mode is the actor that suppresses those additions, while preserving the meaning about OpenClaw pricing fetches and reapplying them later with policy-add if needed.Source: Path instructions
src/lib/onboard/policy-selection.ts (1)
146-154: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueOptional: reuse the helper to avoid divergence.
suppressedAgentRequiredPresets(Line 153) and the inline append incomputeSetupPresetSuggestions(Lines 191-194) compute the sameopenclaw-pricing+ required-OTEL list under the same restricted/Openclaw conditions. Consider deriving one from the other so the suppression list and the gated additions cannot drift apart.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/policy-selection.ts` around lines 146 - 154, The restricted/Openclaw preset logic is duplicated between suppressedAgentRequiredPresets and the inline append in computeSetupPresetSuggestions, which risks the two lists drifting apart. Refactor computeSetupPresetSuggestions to derive its gated additions from suppressedAgentRequiredPresets, or extract a shared helper used by both. Keep the existing RESTRICTED_TIER_NAME and isOpenclawAgent checks in one place, and ensure the returned preset list remains the same in both paths.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/onboard-policy-suggestions.test.ts`:
- Around line 494-506: The test around suppressedAgentRequiredPresets is only
isolating NEMOCLAW_OPENCLAW_OTEL, so it can accidentally inherit
NEMOCLAW_OPENCLAW_OTEL_ENDPOINT from the runner and change whether
openclaw-diagnostics-otel-local is included. Update this test to save, clear,
and restore NEMOCLAW_OPENCLAW_OTEL_ENDPOINT alongside the existing env var
handling in the suppressedAgentRequiredPresets assertion block so the
expectation stays deterministic.
---
Nitpick comments:
In `@docs/reference/network-policies.mdx`:
- Line 71: The Restricted tier description uses passive voice in the sentence
about agent-required preset additions, so rewrite it in active voice. Update the
wording in the network-policies documentation so the Restricted mode is the
actor that suppresses those additions, while preserving the meaning about
OpenClaw pricing fetches and reapplying them later with policy-add if needed.
In `@src/lib/onboard/policy-selection.ts`:
- Around line 146-154: The restricted/Openclaw preset logic is duplicated
between suppressedAgentRequiredPresets and the inline append in
computeSetupPresetSuggestions, which risks the two lists drifting apart.
Refactor computeSetupPresetSuggestions to derive its gated additions from
suppressedAgentRequiredPresets, or extract a shared helper used by both. Keep
the existing RESTRICTED_TIER_NAME and isOpenclawAgent checks in one place, and
ensure the returned preset list remains the same in both paths.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ebd267a5-4321-4b59-bde2-f9d1d2632167
📒 Files selected for processing (5)
docs/reference/network-policies.mdxnemoclaw-blueprint/policies/tiers.yamlsrc/lib/onboard.tssrc/lib/onboard/policy-selection.tstest/onboard-policy-suggestions.test.ts
cv
approved these changes
Jun 26, 2026
cv
left a comment
cv
left a comment
Collaborator
There was a problem hiding this comment.
LGTM after addressing feedback
…dary Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
…wth guardrail Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28227482209
|
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28228069681
|
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28230568188
|
Contributor
Vitest E2E Scenario Results — ❌ Some jobs failedRun: 28230500053
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28231278562
|
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28233348761
|
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28235814381
|
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28236237588
|
…ive on restricted resume Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28287032435
|
… guardrail green Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28287505528
|
…teractive filter test Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28288050710
|
…atting helper Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28288728405
|
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28288971975
|
…+ escape-hatch tests Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…d by CodeQL Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28291522650
|
…tier Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
…board.ts Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 28292425428
|
…o keep onboard.ts net-neutral Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 28293019672
|
… keep test isolation Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 28293572844
|
…restricted tier Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 28293835725
|
…reate-time path Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 28294148783
|
21 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nemoclaw onboard --policy-tier=restricted(and the interactive equivalent) used to applyopenclaw-pricingto OpenClaw sandboxes regardless of the chosen tier, because the suggestion pipeline added it as an OpenClaw-required preset before the tier filter ran. The Restricted tier description promises "no third-party network access beyond inference and core agent tooling", so the pricing fetch — which reaches LiteLLM and OpenRouter — directly contradicts the tier intent. This change suppresses the OpenClaw agent-required additions (openclaw-pricing, and the local OTEL preset when OTEL is enabled) on the Restricted tier at both the suggestion helper and the final application boundary, prints a one-line onboard notice listing what was suppressed and how to reapply it, and documents the stricter Restricted behaviour in the tier definition and reference page.Related Issue
Fixes #5793
Changes
src/lib/onboard/policy-selection.ts: extract a sharedagentRequiredPresetAdditions(agent, env)helper socomputeSetupPresetSuggestionsandsuppressedAgentRequiredPresetscannot drift apart. Gate the OpenClaw agent-required adds (openclaw-pricingandrequiredOpenclawOtelPolicyPresets) ontierName !== "restricted"insidecomputeSetupPresetSuggestions, and filter the same set out ofchosenandinteractiveChoiceaftermergeRequiredSetupPolicyPresetsso the later merge step cannot reintroduce the OTEL preset for restricted + OpenClaw.src/lib/onboard/policy-selection.ts: new exportedsuppressedAgentRequiredPresets(tierName, agent, env)helper and a follow-updeps.note(...)insetupPoliciesWithSelectionInnerthat printsRestricted tier suppresses agent-required preset(s): ... Apply later with 'nemoclaw <name> policy-add <preset>' if needed.whenever the helper returns anything.nemoclaw-blueprint/policies/tiers.yaml: extend the Restricted tier description (active voice) to call out that Restricted mode suppresses agent-required preset additions and to point operators atpolicy-add.docs/reference/network-policies.mdx: mirror the new Restricted description in the tier table (active voice).test/onboard-policy-suggestions.test.ts: ten new tests undercomputeSetupPresetSuggestions > restricted tier suppresses agent-required preset additionsand a newsuppressedAgentRequiredPresetsblock. The OTEL env-var tests save, clear, and restore bothNEMOCLAW_OPENCLAW_OTELandNEMOCLAW_OPENCLAW_OTEL_ENDPOINTso runner-inherited values cannot affect the expectation.test/policy-tiers-onboard.test.ts: three new application-path tests that exercisesetupPoliciesWithSelectionend-to-end — restricted + OpenClaw applies zero presets in non-interactive suggested mode, restricted + OpenClaw withNEMOCLAW_OPENCLAW_OTEL=1does not re-addopenclaw-diagnostics-otel-localafter the required-preset merge, and the suppression note matches the final applied set.Type of Change
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Signed-off-by: Tinson Lai tinsonl@nvidia.com
Summary by CodeRabbit
Documentation
policy-add.New Features
Bug Fixes
Tests