refactor(cli): migrate skill install command to oclif

[cv]

Summary

Migrates nemoclaw <name> skill install <path> to oclif while retaining the existing skill validation and upload implementation. The legacy dispatcher continues to preserve public help and plugin-hint behavior.

This continues the stacked CLI migration after #2796. Next: #2798.

Changes

• Add src/lib/skill-install-cli-command.ts for the internal sandbox:skill:install oclif command.
• Route <name> skill install ... through runOclif() while leaving top-level skill help and unknown subcommand handling compatible.
• Reuse the existing sandboxSkillInstall() implementation so SKILL.md validation, plugin-shaped directory hints, SSH upload, and post-install refresh behavior remain unchanged.
• Add unit coverage for the skill-install oclif wrapper and ensure public help does not expose the internal command ID.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• make docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

AI Disclosure

• AI-assisted — tool: OpenAI Codex

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Stack position

Note

This PR is part of a stacked refactor. Please review/merge in stack order.
The current PR is highlighted below.

This is PR #2797 in the stacked CLI oclif refactor series.

• Merge after: refactor(cli): migrate sandbox logs command to oclif #2796
• Next PR: refactor(cli): migrate snapshot list and create to oclif #2798
• Stack position: 7 / 37

Full stack

Merge from top to bottom.

Order	PR	Merge after	Title
1	#2775	main	refactor(cli): migrate status and tunnel commands to oclif
2	#2776	#2775	refactor(cli): migrate debug uninstall and gateway-token to oclif
3	#2786	#2776	refactor(cli): migrate credentials commands to oclif
4	#2787	#2786	refactor(cli): migrate sandbox inspection commands to oclif
5	#2788	#2787	refactor(cli): migrate maintenance commands to oclif
6	#2796	#2788	refactor(cli): migrate sandbox logs command to oclif
7	#2797	#2796	refactor(cli): migrate skill install command to oclif
8	#2798	#2797	refactor(cli): migrate snapshot list and create to oclif
9	#2802	#2798	refactor(cli): migrate shields commands to oclif
10	#2803	#2802	refactor(cli): migrate channels mutation commands to oclif
11	#2804	#2803	refactor(cli): migrate policy mutation commands to oclif
12	#2805	#2804	refactor(cli): migrate snapshot restore command to oclif
13	#2806	#2805	refactor(cli): migrate destroy command to oclif
14	#2807	#2806	refactor(cli): migrate rebuild command to oclif
15	#2808	#2807	refactor(cli): migrate connect command to oclif
16	#2809	#2808	refactor(cli): migrate deploy command to oclif
17	#2810	#2809	refactor(cli): migrate onboard aliases to oclif
18	#2811	#2810	refactor(cli): migrate help and version commands to oclif
19	#2814	#2811	refactor(cli): centralize legacy oclif dispatch
20	#2815	#2814	refactor(cli): drop trivial oclif wrapper helpers
21	#2816	#2815	refactor(cli): centralize sandbox runtime bridge
22	#2817	#2816	refactor(cli): centralize policy and channels runtime bridge
23	#2818	#2817	refactor(cli): centralize global runtime bridge
24	#2819	#2818	refactor(cli): collapse runtime bridge exports
25	#2826	#2819	refactor(cli): introduce sandbox runtime action facade
26	#2827	#2826	refactor(cli): introduce policy and channels action facade
27	#2828	#2827	refactor(cli): introduce global command action facade
28	#2830	#2828	refactor(cli): extract root help action
29	#2831	#2830	refactor(cli): extract deploy action
30	#2832	#2831	refactor(cli): extract onboard actions
31	#2835	#2832	refactor(cli): extract openshell runtime helpers
32	#2836	#2835	refactor(cli): extract sandbox logs action
33	#2837	#2836	refactor(cli): extract maintenance actions
34	#2838	#2837	refactor(cli): extract snapshot actions
35	#2839	#2838	refactor(cli): extract policy and channels actions
36	#2840	#2839	refactor(cli): extract credentials and list runtime bits
37	#2841	#2840	refactor(cli): shrink runtime bridge

Summary by CodeRabbit

• New Features

  • Added sandbox CLI commands: sandbox:gateway-token, sandbox:logs (with --follow), sandbox:skill:install, sandbox:config:get, sandbox:status, sandbox:policy-list, sandbox:channels:list
  • Added maintenance commands: backup-all, upgrade-sandboxes, gc

• Bug Fixes

  • Improved CLI help output to hide internal command paths
  • Increased test reliability for gateway log monitoring and CI workspace stability

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 57f5851c-a123-4790-8b98-9727ff676ae0

📥 Commits

Reviewing files that changed from the base of the PR and between e615567 and 54263d4.

📒 Files selected for processing (1)

• .github/workflows/wsl-e2e.yaml

---

📝 Walkthrough

Walkthrough

Adds several oclif CLI commands for sandbox operations (logs, skill install, gateway token, inspection, maintenance), registers them in the command registry, refactors nemoclaw routing to delegate to oclif where appropriate, exposes sandbox helper exports, and annotates thin oclif adapters with V8 coverage-ignore comments. Tests and CI workflow adjustments included.

Changes

CLI commands, registry, and routing

Layer / File(s)	Summary
Data Shape & Exports src/nemoclaw.ts	Exported additional helpers: sandboxLogs, sandboxSkillInstall.
Runtime Bridge & Factory src/lib/sandbox-logs-cli-command.ts, src/lib/skill-install-cli-command.ts, src/lib/sandbox-inspection-cli-command.ts, src/lib/maintenance-cli-commands.ts	Introduce RuntimeBridge types and injectable runtime-bridge factory/getter helpers (with test override setters) to decouple commands from require("../nemoclaw").
Command Implementations src/lib/sandbox-logs-cli-command.ts, src/lib/skill-install-cli-command.ts, src/lib/gateway-token-cli-command.ts, src/lib/sandbox-inspection-cli-command.ts, src/lib/maintenance-cli-commands.ts	Add oclif Command classes: sandbox:logs (follow flag), sandbox:skill:install (optional path), sandbox:gateway-token (quiet flag), sandbox inspection commands (sandbox:status, sandbox:policy-list, sandbox:channels:list, sandbox:config:get with format validation), and maintenance commands (backup-all, upgrade-sandboxes, gc).
Registry Wiring src/lib/oclif-commands.ts	Expand default oclif command registry to include new command modules (sandbox logs, skill install, gateway token, sandbox inspection, maintenance, etc.).
Nemoclaw Dispatch Changes src/nemoclaw.ts	Refactor sandbox-scoped dispatch: status, logs, and skill now check help flags and delegate to runOclif(...) for the corresponding oclif commands when appropriate; skill implements subcommand-aware routing and falls back to sandboxSkillInstall(...) for legacy/no-subcommand cases.
Coverage Annotations src/lib/credentials-cli-command.ts, src/lib/debug-cli-command.ts, src/lib/list-command.ts, src/lib/status-command.ts, src/lib/tunnel-commands.ts, src/lib/uninstall-cli-command.ts	Add /* v8 ignore start ... */ comments to mark thin oclif adapter regions as excluded from V8 coverage instrumentation.
Tests & Test Helpers src/lib/sandbox-logs-cli-command.test.ts, src/lib/skill-install-cli-command.test.ts, test/cli.test.ts, test/nemoclaw-start.test.ts, test/repro-2681-group-writable.test.ts	Add unit tests for new commands using runtime-bridge factory overrides; update CLI help assertions to ensure public usage (hide internal oclif paths); replace a fixed sleep with polling in a persistent log test; stub stat in a permission test.
CI Workspace Copy .github/workflows/wsl-e2e.yaml	Copy repository into an ext4-backed WSL workdir via rsync and update env vars so E2E/test steps run inside the ext4 workspace.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    Client->>CLI (oclif): user invokes public sandbox command
    CLI (oclif)->>Runtime Bridge Factory: getRuntimeBridge()
    Runtime Bridge Factory->>nemoclaw module: require("../nemoclaw")
    CLI (oclif)->>nemoclaw module: invoke exported helper (e.g., sandboxLogs / sandboxSkillInstall) or runOclif delegation
    nemoclaw module->>External Systems: perform sandbox operation (gateway, logs, install, status)
    External Systems-->>nemoclaw module: results/stream
    nemoclaw module-->>CLI (oclif): return / stream output
    CLI (oclif)-->>Client: stdout / exit code

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• feat(cli): add nemohermes alias for Hermes agent #2462: Related CLI-branding and command-surface changes touching src/nemoclaw.ts and oclif command modules.

Poem

🐰 I twitch my whiskers at the build,
New commands hop out, sleek and thrilled,
Logs stream, skills install with grace,
Gateway tokens print to place,
Registry grows — a tidy lair,
Coverage notes tucked with care.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately describes the main change: migrating the skill install command to oclif. It is specific, clear, and directly reflects the primary objective.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/oclif-skill-install

---

_{Review rate limit: 9/10 reviews remaining, refill in 6 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}