fix: catch permission errors when copying custom Dockerfile build context (#1808)

[zyang-dev]

Summary

When nemoclaw onboard --from Dockerfile is run in a directory with unreadable files (e.g., a user's home directory on WSL with Windows system files), the build context copy crashes with a raw Node.js stack trace. This catches the EACCES error and shows a clear message telling the user to move the Dockerfile to a dedicated directory.

Related Issue

Fixes #1808

Changes

• src/lib/onboard.ts: Wrap the build context fs.cpSync call in a try/catch. On EACCES, print an actionable error message and exit instead of crashing with a stack trace.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• make docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

AI Disclosure

• AI-assisted — tool: Claude Code

---

Signed-off-by: zyang-dev 267119621+zyang-dev@users.noreply.github.com

Summary by CodeRabbit

• Bug Fixes
  • Improved error handling for permission-denied scenarios during the build process. When a permission issue occurs, users now receive a clear error message with actionable guidance on how to resolve the problem.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 84d739b1-0ba5-4c1f-a9cc-afee66e11891

📥 Commits

Reviewing files that changed from the base of the PR and between e885982 and ca53f0e.

📒 Files selected for processing (1)

• src/lib/onboard.ts

---

📝 Walkthrough

Walkthrough

A permission-denied error handler was added to the Docker build context copy operation in createSandbox. When an EACCES error occurs, the code logs a diagnostic message instructing users to relocate their Dockerfile to a dedicated directory, then terminates gracefully. Non-permission errors are rethrown.

Changes

Cohort / File(s)	Summary
Error handling for Docker build context copy src/lib/onboard.ts	Wrapped synchronous directory copy in try/catch to handle EACCES permission errors with a user-friendly message explaining that the --from Dockerfile parent directory is used as build context and recommending relocation of the Dockerfile to a dedicated directory.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~7 minutes

Poem

🐰 A permission denied? No fear, dear friend!
The rabbit ensures the error message'll mend—
Move your Dockerfile, so the copy can flow,
No more cryptic crashes, just graceful "let's go!"

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically identifies the main fix: catching permission errors when copying custom Dockerfile build context, directly addressing the core change in the code.
Linked Issues check	✅ Passed	The PR successfully addresses the core requirement from issue #1808: wrapping the build context copy in try/catch to handle EACCES errors with an actionable error message and graceful exit.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing the permission error handling in the createSandbox function, with no unrelated modifications present.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dockerfile-context-permission-error

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}