feat(onboard): add review summary + Y/n gate before destructive sandbox build

src/lib/onboard.ts

@@ -3303,6 +3303,37 @@ async function promptValidatedSandboxName() {
 
 // ── Step 5: Sandbox ──────────────────────────────────────────────
 
+/**
+ * Render the configuration summary shown before the destructive sandbox build.
+ * Extracted from confirmOnboardConfiguration() for direct unit testing — see #2165.
+ */
+function formatOnboardConfigSummary({
+  provider,
+  model,
+  webSearchConfig,
+  enabledChannels,
+  sandboxName,
+}) {
+  const bar = `  ${"─".repeat(50)}`;
+  const messaging =
+    Array.isArray(enabledChannels) && enabledChannels.length > 0
+      ? enabledChannels.join(", ")
+      : "none";
+  const webSearch = webSearchConfig && webSearchConfig.fetchEnabled === true ? "enabled" : "disabled";
+  return [
+    "",
+    bar,
+    "  Review configuration",
+    bar,
+    `  Provider:      ${provider ?? "(unset)"}`,
+    `  Model:         ${model ?? "(unset)"}`,
+    `  Web search:    ${webSearch}`,
+    `  Messaging:     ${messaging}`,
+    `  Sandbox name:  ${sandboxName}`,
+    bar,
+  ].join("\n");
+}
+
 // eslint-disable-next-line complexity
 async function createSandbox(
   gpu,
@@ -3322,6 +3353,35 @@ async function createSandbox(
     sandboxNameOverride ?? (await promptValidatedSandboxName()),
     "sandbox name",
   );
+
+  // Show a review summary and a Y/n gate before the ~6-minute sandbox build.
+  // Scope note: credentials entered in earlier steps (Brave API key, messaging
+  // tokens, provider API keys) have already been persisted to
+  // ~/.nemoclaw/credentials.json by setupInference/setupMessagingChannels.
+  // The gate prevents the long destructive operations (docker build, provider
+  // creation on the gateway, sandbox registration) that the reporter of #2165
+  // wanted to guard. Users can clear persisted credentials with
+  // `nemoclaw credentials reset <KEY>` if they abort. Non-interactive runs
+  // opt out of the gate but still see the summary for log clarity.
+  console.log(formatOnboardConfigSummary({
+    provider, model, webSearchConfig, enabledChannels, sandboxName,
+  }));
+  if (!isNonInteractive() && !dangerouslySkipPermissions) {
+    const answer = (await promptOrDefault("  Apply this configuration? [Y/n]: ", null, "y"))
+      .trim()
+      .toLowerCase();
+    if (answer === "n" || answer === "no") {
+      console.log("  Aborted. Re-run `nemoclaw onboard` to start over.");
+      console.log(
+        "  Credentials entered so far are stored in ~/.nemoclaw/credentials.json —",
+      );
+      console.log(
+        "  clear them with `nemoclaw credentials reset <KEY>` if you no longer want them.",
+      );
+      process.exit(0);
+    }
+  }
+
   const effectivePort = agent ? agent.forwardPort : CONTROL_UI_PORT;
   const chatUiUrl = process.env.CHAT_UI_URL || `http://127.0.0.1:${effectivePort}`;
 
@@ -6834,6 +6894,7 @@ module.exports = {
   setupInference,
   setupMessagingChannels,
   setupNim,
+  formatOnboardConfigSummary,
   isInferenceRouteReady,
   isNonInteractive,
   isOpenclawReady,

test/onboard.test.ts

@@ -5364,4 +5364,51 @@ const { createSandbox } = require(${onboardPath});
       "pullAndResolveBaseImageDigest must be called BEFORE patchStagedDockerfile — regression #1904",
     );
   });
+
+  it("formatOnboardConfigSummary renders all collected fields (#2165)", () => {
+    const repoRoot = path.join(import.meta.dirname, "..");
+    const onboardPath = path.join(repoRoot, "dist", "lib", "onboard.js");
+    delete require.cache[onboardPath];
+    const { formatOnboardConfigSummary } = require(onboardPath);
+
+    const summary = formatOnboardConfigSummary({
+      provider: "gemini-api",
+      model: "gemini-2.5-flash",
+      webSearchConfig: { fetchEnabled: true },
+      enabledChannels: ["telegram", "slack"],
+      sandboxName: "my-assistant",
+    });
+
+    assert.ok(summary.includes("Review configuration"), "summary has review heading");
+    assert.ok(summary.includes("gemini-api"), "summary includes provider");
+    assert.ok(summary.includes("gemini-2.5-flash"), "summary includes model");
+    assert.ok(summary.includes("enabled"), "summary includes web-search enabled");
+    assert.ok(summary.includes("telegram, slack"), "summary lists enabled channels");
+    assert.ok(summary.includes("my-assistant"), "summary shows sandbox name");
+
+    // No messaging, no web search → "none" / "disabled"
+    const bareSummary = formatOnboardConfigSummary({
+      provider: "nvidia-prod",
+      model: "nvidia/nemotron-3-super-120b-a12b",
+      webSearchConfig: null,
+      enabledChannels: [],
+      sandboxName: "test",
+    });
+    assert.ok(bareSummary.includes("Messaging:     none"), "empty channels renders as 'none'");
+    assert.ok(
+      bareSummary.includes("Web search:    disabled"),
+      "null webSearch renders as 'disabled'",
+    );
+
+    // Missing provider/model → "(unset)" placeholder, not "undefined"
+    const orphanSummary = formatOnboardConfigSummary({
+      provider: null,
+      model: null,
+      webSearchConfig: null,
+      enabledChannels: null,
+      sandboxName: "orphan",
+    });
+    assert.ok(!orphanSummary.includes("undefined"), "null fields never render as 'undefined'");
+    assert.ok(orphanSummary.includes("(unset)"), "null fields fall back to '(unset)'");
+  });
 });