refactor(cli): extract sandbox skill install action

[cv]

Summary

Extract the sandbox skill install command implementation from src/nemoclaw.ts into a dedicated action module. This removes sandboxSkillInstall from the transitional runtime bridge while preserving the existing oclif wrapper and legacy fallback behavior.

Stack Navigation

• Position: 2 of 60
• Previous PR: #2886 — refactor(cli): extract sandbox live state helpers
• Next PR: #2891 — refactor(cli): extract sandbox connect action

Changes

• Added src/lib/sandbox-skill-install-action.ts for skill install usage, plugin-shape detection, validation, upload, post-install, and verification flow.
• Updated src/lib/sandbox-runtime-actions.ts and the legacy skill fallback to call the extracted action.
• Removed sandboxSkillInstall from src/nemoclaw.ts and NemoClawRuntimeBridge.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• make docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Refactor
  • Reorganized internal skill installation implementation for improved code structure and maintainability. The skill installation feature continues to work as before with no changes to user-facing functionality or command-line interface.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

Skill installation functionality is refactored from the NemoClawRuntimeBridge interface to a standalone CLI action module. The sandboxSkillInstall bridge method is removed, and a new sandbox-skill-install-action.ts module implements the full installation flow with SKILL.md parsing, file validation, and SSH-based uploads.

Changes

Skill Installation Refactoring

Layer / File(s)	Summary
Interface Update src/lib/nemoclaw-runtime-bridge.ts	NemoClawRuntimeBridge interface no longer exports sandboxSkillInstall method.
New CLI Action Implementation src/lib/sandbox-skill-install-action.ts	New module adds installSandboxSkill, printSkillInstallUsage, looksLikeOpenClawPlugin, and printPluginInstallHint. Implements full skill install flow: parses/validates SKILL.md, checks for unsafe files, verifies sandbox is live, uploads via SSH, runs post-install hooks, verifies success, and cleans up temp SSH config.
Integration Updates src/lib/sandbox-runtime-actions.ts, src/nemoclaw.ts	installSandboxSkill in sandbox-runtime-actions.ts now dynamically requires and calls the new action module. nemoclaw.ts removes old skill-install import, removes sandboxSkillInstall from exported bridge, and updates legacy skill subcommand dispatch to invoke the new action implementation.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 Skill install takes flight,
From bridge to action pure and right,
With SSH and frontmatter's glow,
New paths for sandboxes to grow! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 22.22% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title accurately describes the main change: extracting the sandbox skill install action from the runtime bridge into a dedicated module.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/oclif-extract-skill-install-action

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

_{Review rate limit: 9/10 reviews remaining, refill in 6 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

src/nemoclaw.ts (1)

2534-2540: Run the recommended sandbox recovery E2Es before merge.

Since this touches src/nemoclaw.ts dispatch, run the two selective nightly jobs to guard against unintended regressions in sandbox recovery flows.

As per coding guidelines, "E2E test recommendation: sandbox-survival-e2e — gateway restart recovery; sandbox-operations-e2e — process recovery after gateway kill."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/nemoclaw.ts` around lines 2534 - 2540, This touches the sandbox dispatch
branch in src/nemoclaw.ts (case "skill" calling installSandboxSkill(sandboxName,
actionArgs)), so before merging run the two recommended sandbox recovery E2E
jobs: execute the nightly "sandbox-survival-e2e" (gateway restart recovery) and
"sandbox-operations-e2e" (process recovery after gateway kill) against the
current branch to verify no regressions in sandbox recovery flows; if either
test fails, capture failures, fix the dispatch/installation flow around
installSandboxSkill and re-run until both pass.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@src/nemoclaw.ts`:
- Around line 2534-2540: This touches the sandbox dispatch branch in
src/nemoclaw.ts (case "skill" calling installSandboxSkill(sandboxName,
actionArgs)), so before merging run the two recommended sandbox recovery E2E
jobs: execute the nightly "sandbox-survival-e2e" (gateway restart recovery) and
"sandbox-operations-e2e" (process recovery after gateway kill) against the
current branch to verify no regressions in sandbox recovery flows; if either
test fails, capture failures, fix the dispatch/installation flow around
installSandboxSkill and re-run until both pass.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 286b7e2a-2be7-4762-a46f-19ec2f4efc71

📥 Commits

Reviewing files that changed from the base of the PR and between 73c6a91 and ac56565.

📒 Files selected for processing (4)

• src/lib/nemoclaw-runtime-bridge.ts
• src/lib/sandbox-runtime-actions.ts
• src/lib/sandbox-skill-install-action.ts
• src/nemoclaw.ts

💤 Files with no reviewable changes (1)

• src/lib/nemoclaw-runtime-bridge.ts

[prekshivyas]

LGTM. Clean lift-and-shift — verified the four extracted symbols are byte-identical to the on-main originals (only export keywords, the sandboxSkillInstall → installSandboxSkill rename, and an inconsequential template-literal-to-string tweak). Argument shape preserved end-to-end through both the oclif wrapper and the legacy case "skill" dispatch. No zombies — block edits to migrated legacy paths check confirms.

Scope is tight: the work commit touches exactly the 4 expected files, no test churn, no Dockerfile drift. Notably cleaner than #2886.

One non-blocking note: the new action consumes D, G, R, YW from terminal-style.ts, making it the second module to depend on the extracted color constants. That's the start of the migration #2886 deferred — worth mentioning in the description, but not blocking.

Auto-merge will land this once build-sandbox-images (x86) finishes — arm64 and everything else are already green.