[TLT-5991][Bugfix] NVBug 6682592: resolve the NemoClaw sandbox container by label

[helenzhou0523]

Problem

setup-tao-nemoclaw.sh aborts at step 0 on a healthy, onboarded sandbox:

$ ./setup-tao-nemoclaw.sh taotesting ~/workspace --restart-server
[tao-nemoclaw] ERROR: no running container for sandbox 'taotesting' (nemoclaw list?)

Both scripts located the sandbox container by matching an anchored name prefix,
openshell-<sandbox>-. That was correct when this integration was written
(2026-07-09): OpenShell's docker driver named sandbox containers
openshell-<name>-<id>.

NVIDIA/OpenShell#2243 (5952a5a2)
introduced the workspace resource model and changed container_name_for_sandbox:

-    format!("{CONTAINER_NAME_PREFIX}{truncated_name}-{id_suffix}")
+    format!("{CONTAINER_NAME_PREFIX}{workspace}--{truncated_name}-{id_suffix}")

It first shipped in OpenShell v0.0.88 (v0.0.87 still emits the old form). The
anchored prefix cannot match openshell-<workspace>--<name>-<id>, so on any host
whose gateway has been redeployed onto v0.0.88+:

• setup aborts in step 0, which runs ahead of every branch — so even the
  narrow --restart-server path cannot run. Nothing downstream is reachable:
  no MCP server, no skills in the sandbox, no openclaw.json entry, no egress
  policy, so the agent never gets tao_ls / tao_run.
• uninstall (not in the bug report) hits the same line but fails soft —
  it warns and skips, so it silently leaves the skills, the openclaw.json
  entry and the egress policy in place while reporting success.

Fix

Resolve by label, not by name. OpenShell stamps openshell.ai/sandbox-name on
every sandbox container and has since well before this integration existed —
present in v0.0.71 through main — so it is exact, version-portable across the
rename, and not an internal convention we have to keep chasing.

_sandbox_cid() {
  docker ps -q --filter "label=openshell.ai/sandbox-name=$1" | head -1
}

A lookup miss now prints the sandbox containers docker ps did return, so the
next mismatch diagnoses itself instead of sending the operator back to re-check
onboarding.

openshell.ai/managed-by is deliberately not part of the filter: the docker
driver only began applying it after v0.0.71, so requiring it would break the
older gateways this change is meant to keep working.

Validation

Run on a NemoClaw host (openshell 0.0.71, real Docker) against containers
carrying the exact names and labels the driver emits on each side of the rename:

post-v0.0.88 name, old pattern	finds nothing — reproduces the reported abort
post-v0.0.88 name, new lookup	resolves the correct container
post-v0.0.88 name + an openshell-<sb>-local neighbour, old pattern	resolves the wrong container — a latent mis-resolution the abort was masking
same, new lookup	still resolves the correct container
pre-v0.0.88 name, new lookup	resolves — no regression on older gateways
prefix bleed (taotest vs taotesting)	no match, as intended
unknown sandbox	resolves to nothing, diagnostic lists real candidates

Both scripts also run end to end past step 0 on that host:

[tao-nemoclaw] sandbox=taotesting container=00fe5f00b589 bridge-gateway=172.17.0.1 workspace=/home/ubuntu/tao-workspace

setup then proceeds to the credentials check and uninstall to the confirmation
prompt — both unrelated to this change and expected on a bare host. With an
unknown sandbox:

[tao-nemoclaw] ERROR: no running container for sandbox 'nosuchsb' (nemoclaw list?)
  running sandbox containers: openshell-default--taotesting-8d3c1f92-...

Notes

• NVBug 6682592 (P0-Stopper), Jira TLT-5991.
• This is a re-file of soft-deleted bug ed5913e0, which reported the same
  defect against a different sandbox on a different host. Consistent with the
  root cause: hosts break one at a time, as each gateway gets redeployed onto
  a v0.0.88+ cluster image.

[tao-pr-bot]

For security reasons, CI does not run automatically on NVIDIA's runners — it must be triggered per commit.

• Comment /build to run CI on your latest commit, and make sure blossom-ci is green before merging.
• Re-run /build after each new push — CI is pinned to the head commit, so a stale run won't count.

Tip

Should this fix also ship in a release? Add a release/X.Y.Z label (matching the target release branch) and tao-cherry-pick-bot will backport it after merge.

Important

Before merging: every file needs a license header and every commit must be DCO signed-off — see the 📖 Contribution guide for details.

[vpraveen-nv]

LGTM

[helenzhou0523]

/build

[tao-cherry-pick-bot]

🍒 Cherry-pick summary

• release/7.2.0: ✅ cherry-picked cleanly (c3d5ff2)