test(cli): cover policy mutation public route

[cv]

Summary

This PR adds focused public CLI smokes for the sandbox-first built-in policy mutation routes after #4920 moved most confirmation coverage into same-process action tests. The tests keep coverage for dispatching policy-add / policy-remove through the user-facing route without restoring the old subprocess-heavy matrix.

Related Issue

Part of #4892

Changes

• Add a hermetic fake OpenShell policy helper for test/cli/sandbox-mutations.test.ts.
• Verify nemoclaw <sandbox> policy-add github --yes and nemoclaw <sandbox> policy-remove github -y mutate the temp registry through the public sandbox-first route.
• Verify NEMOCLAW_NON_INTERACTIVE=1 nemoclaw <sandbox> policy-add fails before selecting or applying a preset.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

[coderabbitai]

Warning

Review limit reached

@cv, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 41 minutes and 2 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e2768a4b-fd21-4cff-8eb7-17f99636e9ca

📥 Commits

Reviewing files that changed from the base of the PR and between 4307f43 and fafe46c.

📒 Files selected for processing (1)

• test/cli/sandbox-mutations.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/policy-cli-mutation-smokes

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

E2E Advisor Recommendation

Required E2E: None
Optional E2E: None

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• None. No E2E is recommended because this is a tests-only change that adds/updates unit/CLI coverage without modifying runtime behavior or user-facing flows.

Optional E2E

• None.

New E2E recommendations

• None.

[github-actions]

E2E Scenario Advisor Recommendation

Required scenario E2E: None
Optional scenario E2E: None

Workflow run

Full scenario advisor summary

E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required scenario E2E

• None. Changed file is a CLI unit/integration test outside test/e2e-scenario/ and does not modify scenario workflows, scenario metadata, expected-state contracts, suite definitions, runtime code, or scenario-relevant helpers.

Optional scenario E2E

• None.

Relevant changed files

• None.

[github-actions]

PR Review Advisor

Findings: 0 needs attention, 0 worth checking, 0 nice ideas
Top item: No actionable findings

Consider writing more tests for

• **Acceptance clause:** Part of ci: safely split slow CLI coverage suites #4892 — add test evidence or identify existing coverage. The deterministic context did not include linked issue ci: safely split slow CLI coverage suites #4892 body or comments, so no literal issue acceptance clauses could be verified beyond the PR body.

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.