fix(status): show gateway active policy version, not the schema constant (NVIDIA#3185)

## Summary
`nemoclaw <sandbox> status` rendered the merged policy YAML's schema
`version: 1` even after onboarding had advanced the gateway active
version to 6, leaving users uncertain whether their preset selections
actually took effect.

## Related Issue
Closes NVIDIA#1961

## Changes
- `src/lib/actions/sandbox/gateway-state.ts`: capture the `Active: N`
line emitted by `openshell policy get --full` (the metadata block above
`---`) and rewrite the leading `version:` in the YAML payload to that
value before display.
- `test/gateway-state.test.ts`: cover the rewrite, the no-`Active:`
fallback (YAML left untouched), and the error-output case (original
output preserved).

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Verification
- [x] `npx prek run --all-files` passes
- [x] `npm test` passes
- [x] Tests added or updated for new or changed behavior
- [x] No secrets, API keys, or credentials committed
- [ ] Docs updated for user-facing behavior changes
- [ ] `make docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Sandbox output now synchronizes its YAML "version" with the live
policy "Active" value when present; handles and strips ANSI escape
sequences and preserves prior behavior for missing, error-like, or
non-YAML live policy content.

* **Tests**
* Added tests for version sync, ANSI-wrapped metadata handling,
absent/unusable metadata, and error-string live policy cases.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Tinson Lai <tinsonl@nvidia.com>

Author: laitingsheng

src/lib/actions/sandbox/gateway-state.ts

@@ -55,18 +55,26 @@ export function mergeLivePolicyIntoSandboxOutput(
   if (policyLineIdx === -1) return output;
 
   const before = rawLines.slice(0, policyLineIdx + 1).join("\n");
-  const delimIdx = livePolicyOutput.search(/^---\s*$/m);
+  const cleanLivePolicy = stripAnsi(String(livePolicyOutput));
+  const delimIdx = cleanLivePolicy.search(/^---\s*$/m);
+  const metadataPart = delimIdx !== -1 ? cleanLivePolicy.slice(0, delimIdx) : "";
   const yamlPart =
     delimIdx !== -1
-      ? livePolicyOutput.slice(delimIdx).replace(/^---\s*[\r\n]+/, "")
-      : livePolicyOutput;
+      ? cleanLivePolicy.slice(delimIdx).replace(/^---\s*[\r\n]+/, "")
+      : cleanLivePolicy;
   const trimmedYaml = yamlPart.trim();
   const looksLikeError = /^(error|failed|invalid|warning|status)\b/i.test(trimmedYaml);
   if (!trimmedYaml || looksLikeError || !/^[a-z_][a-z0-9_]*\s*:/m.test(trimmedYaml)) {
     return output;
   }
 
-  const indented = trimmedYaml
+  const activeMatch = metadataPart.match(/^Active:\s*(\d+)\s*$/m);
+  const rewrittenYaml =
+    activeMatch && /^version:\s*\d+/m.test(trimmedYaml)
+      ? trimmedYaml.replace(/^version:\s*\d+/m, `version: ${activeMatch[1]}`)
+      : trimmedYaml;
+
+  const indented = rewrittenYaml
     .split("\n")
     .map((line: string) => (line ? `  ${line}` : line))
     .join("\n");

test/gateway-state.test.ts

@@ -16,6 +16,7 @@ import {
   shouldSelectNamedGatewayForReuse,
   parseSandboxPhase,
 } from "../src/lib/state/gateway.js";
+import { mergeLivePolicyIntoSandboxOutput } from "../dist/lib/actions/sandbox/gateway-state.js";
 
 // Realistic CLI outputs
 const STATUS_CONNECTED = `
@@ -287,3 +288,54 @@ describe("shouldSelectNamedGatewayForReuse", () => {
     );
   });
 });
+
+describe("mergeLivePolicyIntoSandboxOutput (#1961)", () => {
+  const sandboxOutput = "Sandbox:\n  Id: abc\n  Phase: Ready\n\nPolicy:\n  schema-stub";
+
+  it("rewrites the YAML version line to the gateway active version", () => {
+    const livePolicy = [
+      "Version:      5",
+      "Hash:         738a54c8520a",
+      "Status:       Loaded",
+      "Active:       6",
+      "---",
+      "version: 1",
+      "filesystem_policy:",
+      "  include_workdir: false",
+    ].join("\n");
+
+    const merged = mergeLivePolicyIntoSandboxOutput(sandboxOutput, livePolicy);
+    expect(merged).toContain("  version: 6");
+    expect(merged).not.toContain("  version: 1");
+    expect(merged).not.toContain("  version: 5");
+  });
+
+  it("leaves the YAML untouched when no Active metadata is provided", () => {
+    const livePolicy = ["---", "version: 1", "filesystem_policy:", "  include_workdir: false"].join(
+      "\n",
+    );
+
+    const merged = mergeLivePolicyIntoSandboxOutput(sandboxOutput, livePolicy);
+    expect(merged).toContain("  version: 1");
+  });
+
+  it("returns the original output when livePolicy is an error string", () => {
+    const merged = mergeLivePolicyIntoSandboxOutput(sandboxOutput, "Error: not found");
+    expect(merged).toBe(sandboxOutput);
+  });
+
+  it("rewrites version when metadata and separator are ANSI-wrapped", () => {
+    const livePolicy = [
+      "\x1b[1mVersion:\x1b[0m      5",
+      "\x1b[1mActive:\x1b[0m       6",
+      "\x1b[2m---\x1b[0m",
+      "version: 1",
+      "filesystem_policy:",
+      "  include_workdir: false",
+    ].join("\n");
+
+    const merged = mergeLivePolicyIntoSandboxOutput(sandboxOutput, livePolicy);
+    expect(merged).toContain("  version: 6");
+    expect(merged).not.toContain("  version: 1");
+  });
+});