fix(onboard): preserve user's policy preset selections across sandbox…

[laitingsheng]

… rebuild (Fixes #1980)

Before recreating an existing sandbox, copy its applied policies from the registry into the onboard session. After the new sandbox comes up, the policy setup step reads those recorded presets and reapplies them instead of reverting to the tier defaults.

Summary

Related Issue

Changes

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• make docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

AI Disclosure

• AI-assisted — tool:

---

Signed-off-by: Tinson Lai tinsonl@nvidia.com

Summary by CodeRabbit

Release Notes

• Bug Fixes
  • Fixed an issue where policy preset selections were lost when sandboxes were recreated during credential rotation, provider migration, or forced recreation.
  • Improved onboarding session management to correctly load and apply previously selected policy settings during sandbox recreation, ensuring user preferences are preserved.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 051cc879-20a4-4e84-9e94-af4b7ccb3435

📥 Commits

Reviewing files that changed from the base of the PR and between 2368927 and a4a94fe.

📒 Files selected for processing (2)

• src/lib/onboard.ts
• test/onboard.test.ts

---

📝 Walkthrough

Walkthrough

This change modifies the onboarding flow to preserve user-selected policy presets when a sandbox is recreated. When createSandbox detects an existing sandbox needs deletion, it now reads stored policies from the registry and updates the session before destruction. The onboard function loads the latest session to access preserved policies, and simplified logic ensures those policies are used instead of defaults.

Changes

Cohort / File(s)	Summary
Sandbox Recreation Policy Preservation src/lib/onboard.ts	Modified createSandbox to read existing sandbox policies from registry and restore them to the current session before sandbox destruction. Updated onboard to load the latest onboarding session and retrieve policyPresets from it, and simplified setupPoliciesWithSelection gating logic to depend solely on whether recordedPolicyPresets is non-empty.
Regression Test test/onboard.test.ts	Added new test case verifying that when a sandbox is recreated with NEMOCLAW_RECREATE_SANDBOX=1, the persisted policy preset selections (e.g., ["npm"]) are loaded into the onboard session instead of being reset to tier defaults.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Poem

🐰 Hop hop, the presets survive!
When sandboxes rebuild and come alive,
No more defaults stealing the day—
Your choices persist, hooray hooray! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title clearly and concisely describes the main change: preserving user's policy preset selections during sandbox rebuild, directly addressing the linked issue.
Linked Issues check	✅ Passed	Changes in createSandbox and onboard logic successfully preserve policy presets from registry across sandbox recreation, and tests verify the fix resolves the issue where presets reverted to tier defaults.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing the policy preset preservation issue: modifications to createSandbox and onboard logic, plus a focused test case verifying the fix.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1980-preserve-policy-presets-on-rebuild

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ericksoa]

Looks good — clean, focused fix for a real user-facing bug. Changes #1 (save presets before destroy) and #2 (reload session) are solid, and the test covers the target scenario well.

One minor thing to double-check: the simplified gating logic (removing the resume and status !== "complete" guards) is correct for the recreate path, but make sure setupPoliciesWithSelection handles the case where it receives selectedPresets during a normal resume where policies are already complete — just so it doesn't re-prompt or reapply unnecessarily.

Side note: issue #1980 has an NVBugs reference ([NVB# 6087043]) in the body on public GitHub — might want to ask the filer to edit that out.

[laitingsheng]

One minor thing to double-check: the simplified gating logic (removing the resume and status !== "complete" guards) is correct for the recreate path, but make sure setupPoliciesWithSelection handles the case where it receives selectedPresets during a normal resume where policies are already complete — just so it doesn't re-prompt or reapply unnecessarily.

I think this function will only be executed if no policies have been applied, and I dropped it because I loaded the latest session before any guards. So I think it should contain the latest policy presets, and hence the session?.steps?.policies?.status !== "complete" becomes redundant.