From ca53f0e1f4447ee59d5b7ce69f4fdc488189c5e6 Mon Sep 17 00:00:00 2001
From: zyang-dev <267119621+zyang-dev@users.noreply.github.com>
Date: Wed, 15 Apr 2026 14:55:00 -0700
Subject: [PATCH] fix: catch permission errors when copying custom Dockerfile
 build context (#1808)

Signed-off-by: zyang-dev <267119621+zyang-dev@users.noreply.github.com>
---
 src/lib/onboard.ts | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts
index a0616e43736..f63114b7524 100644
--- a/src/lib/onboard.ts
+++ b/src/lib/onboard.ts
@@ -2558,13 +2558,23 @@ async function createSandbox(
     buildCtx = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-build-"));
     stagedDockerfile = path.join(buildCtx, "Dockerfile");
     // Copy the entire parent directory as build context.
-    fs.cpSync(path.dirname(fromResolved), buildCtx, {
-      recursive: true,
-      filter: (src) => {
-        const base = path.basename(src);
-        return !["node_modules", ".git", ".venv", "__pycache__"].includes(base);
-      },
-    });
+    try {
+      fs.cpSync(path.dirname(fromResolved), buildCtx, {
+        recursive: true,
+        filter: (src) => {
+          const base = path.basename(src);
+          return !["node_modules", ".git", ".venv", "__pycache__"].includes(base);
+        },
+      });
+    } catch (err) {
+      if (err.code === "EACCES") {
+        console.error(`  Permission denied while copying build context from: ${path.dirname(fromResolved)}`);
+        console.error("  The --from flag uses the Dockerfile's parent directory as the Docker build context.");
+        console.error("  Move your Dockerfile to a dedicated directory and retry.");
+        process.exit(1);
+      }
+      throw err;
+    }
     // If the caller pointed at a file not named "Dockerfile", copy it to the
     // location openshell expects (buildCtx/Dockerfile).
     if (path.basename(fromResolved) !== "Dockerfile") {