feat(onboard): use OpenShell Docker GPU sandboxes

scripts/install-openshell.sh

@@ -42,6 +42,29 @@ MIN_VERSION="0.0.32"
 MAX_VERSION="0.0.36"
 # Pin fresh installs to this version instead of pulling "latest".
 PIN_VERSION="$MAX_VERSION"
+DEV_MIN_VERSION="0.0.37"
+
+CHANNEL="${NEMOCLAW_OPENSHELL_CHANNEL:-auto}"
+case "$CHANNEL" in
+  stable | dev | auto) ;;
+  *) fail "NEMOCLAW_OPENSHELL_CHANNEL must be one of: stable, dev, auto" ;;
+esac
+
+if [ "$CHANNEL" = "auto" ]; then
+  if [ "$OS" = "Linux" ]; then
+    RESOLVED_CHANNEL="dev"
+  else
+    RESOLVED_CHANNEL="stable"
+  fi
+else
+  RESOLVED_CHANNEL="$CHANNEL"
+fi
+
+if [ "$RESOLVED_CHANNEL" = "dev" ]; then
+  RELEASE_TAG="dev"
+else
+  RELEASE_TAG="v${PIN_VERSION}"
+fi
 
 version_gte() {
   # Returns 0 (true) if $1 >= $2 — portable, no sort -V (BSD compat)
@@ -58,19 +81,28 @@ version_gte() {
 }
 
 if command -v openshell >/dev/null 2>&1; then
-  INSTALLED_VERSION="$(openshell --version 2>&1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
+  INSTALLED_VERSION_OUTPUT="$(openshell --version 2>&1 || true)"
+  INSTALLED_VERSION="$(printf '%s\n' "$INSTALLED_VERSION_OUTPUT" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
   [ -n "$INSTALLED_VERSION" ] || INSTALLED_VERSION="0.0.0"
-  if version_gte "$INSTALLED_VERSION" "$MIN_VERSION"; then
-    if ! version_gte "$MAX_VERSION" "$INSTALLED_VERSION"; then
-      fail "openshell $INSTALLED_VERSION is above the maximum ($MAX_VERSION) supported by this NemoClaw release. Upgrade NemoClaw first."
+  if [ "$RESOLVED_CHANNEL" = "dev" ]; then
+    if version_gte "$INSTALLED_VERSION" "$DEV_MIN_VERSION" && printf '%s\n' "$INSTALLED_VERSION_OUTPUT" | grep -qi 'dev'; then
+      info "openshell already installed: $INSTALLED_VERSION_OUTPUT (dev channel)"
+      exit 0
+    fi
+    warn "openshell $INSTALLED_VERSION is not the required dev-channel Docker-driver build — upgrading..."
+  else
+    if version_gte "$INSTALLED_VERSION" "$MIN_VERSION"; then
+      if ! version_gte "$MAX_VERSION" "$INSTALLED_VERSION"; then
+        fail "openshell $INSTALLED_VERSION is above the maximum ($MAX_VERSION) supported by this NemoClaw release. Upgrade NemoClaw first."
+      fi
+      info "openshell already installed: $INSTALLED_VERSION (>= $MIN_VERSION, <= $MAX_VERSION)"
+      exit 0
     fi
-    info "openshell already installed: $INSTALLED_VERSION (>= $MIN_VERSION, <= $MAX_VERSION)"
-    exit 0
+    warn "openshell $INSTALLED_VERSION is below minimum $MIN_VERSION — upgrading..."
   fi
-  warn "openshell $INSTALLED_VERSION is below minimum $MIN_VERSION — upgrading..."
 fi
 
-info "Installing openshell CLI..."
+info "Installing OpenShell from release '$RELEASE_TAG'..."
 
 case "$OS" in
   Darwin)
@@ -87,51 +119,96 @@ case "$OS" in
     ;;
 esac
 
+declare -a ASSETS=("$ASSET")
+declare -a CHECKSUM_FILES=("openshell-checksums-sha256.txt")
+if [ "$OS" = "Linux" ]; then
+  case "$ARCH_LABEL" in
+    x86_64)
+      ASSETS+=("openshell-gateway-x86_64-unknown-linux-gnu.tar.gz")
+      ASSETS+=("openshell-sandbox-x86_64-unknown-linux-gnu.tar.gz")
+      ;;
+    aarch64)
+      ASSETS+=("openshell-gateway-aarch64-unknown-linux-gnu.tar.gz")
+      ASSETS+=("openshell-sandbox-aarch64-unknown-linux-gnu.tar.gz")
+      ;;
+  esac
+  CHECKSUM_FILES+=("openshell-gateway-checksums-sha256.txt")
+  CHECKSUM_FILES+=("openshell-sandbox-checksums-sha256.txt")
+fi
+
 tmpdir="$(mktemp -d)"
 trap 'rm -rf "$tmpdir"' EXIT
 
-CHECKSUM_FILE="openshell-checksums-sha256.txt"
 download_with_curl() {
-  curl -fsSL "https://github.com/NVIDIA/OpenShell/releases/download/v${PIN_VERSION}/$ASSET" \
-    -o "$tmpdir/$ASSET"
-  curl -fsSL "https://github.com/NVIDIA/OpenShell/releases/download/v${PIN_VERSION}/$CHECKSUM_FILE" \
-    -o "$tmpdir/$CHECKSUM_FILE"
+  local name
+  for name in "${ASSETS[@]}" "${CHECKSUM_FILES[@]}"; do
+    curl -fsSL "https://github.com/NVIDIA/OpenShell/releases/download/${RELEASE_TAG}/$name" \
+      -o "$tmpdir/$name"
+  done
 }
 
 if command -v gh >/dev/null 2>&1; then
-  if GH_PROMPT_DISABLED=1 GH_TOKEN="${GH_TOKEN:-${GITHUB_TOKEN:-}}" gh release download "v${PIN_VERSION}" --repo NVIDIA/OpenShell \
-    --pattern "$ASSET" --dir "$tmpdir" 2>/dev/null \
-    && GH_PROMPT_DISABLED=1 GH_TOKEN="${GH_TOKEN:-${GITHUB_TOKEN:-}}" gh release download "v${PIN_VERSION}" --repo NVIDIA/OpenShell \
-      --pattern "$CHECKSUM_FILE" --dir "$tmpdir" 2>/dev/null; then
+  gh_ok=1
+  for name in "${ASSETS[@]}" "${CHECKSUM_FILES[@]}"; do
+    if ! GH_PROMPT_DISABLED=1 GH_TOKEN="${GH_TOKEN:-${GITHUB_TOKEN:-}}" gh release download "$RELEASE_TAG" --repo NVIDIA/OpenShell \
+      --pattern "$name" --dir "$tmpdir" --clobber 2>/dev/null; then
+      gh_ok=0
+      break
+    fi
+  done
+  if [ "$gh_ok" = "1" ]; then
     : # gh succeeded
   else
     warn "gh CLI download failed (auth may not be configured) — falling back to curl"
-    rm -f "$tmpdir/$ASSET" "$tmpdir/$CHECKSUM_FILE"
+    rm -f "$tmpdir"/*
     download_with_curl
   fi
 else
   download_with_curl
 fi
 
 info "Verifying SHA-256 checksum..."
-(cd "$tmpdir" && grep -F "$ASSET" "$CHECKSUM_FILE" | shasum -a 256 -c -) \
-  || fail "SHA-256 checksum verification failed for $ASSET"
+for i in "${!ASSETS[@]}"; do
+  asset_name="${ASSETS[$i]}"
+  checksum_file="${CHECKSUM_FILES[$i]}"
+  (cd "$tmpdir" && grep -F "$asset_name" "$checksum_file" | shasum -a 256 -c -) \
+    || fail "SHA-256 checksum verification failed for $asset_name"
+done
 
-tar xzf "$tmpdir/$ASSET" -C "$tmpdir"
+for asset_name in "${ASSETS[@]}"; do
+  tar xzf "$tmpdir/$asset_name" -C "$tmpdir"
+done
 
 target_dir="/usr/local/bin"
 
+install_bins() {
+  local dir="$1"
+  install -m 755 "$tmpdir/openshell" "$dir/openshell"
+  if [ -x "$tmpdir/openshell-gateway" ]; then
+    install -m 755 "$tmpdir/openshell-gateway" "$dir/openshell-gateway"
+  fi
+  if [ -x "$tmpdir/openshell-sandbox" ]; then
+    install -m 755 "$tmpdir/openshell-sandbox" "$dir/openshell-sandbox"
+  fi
+}
+
 if [ -w "$target_dir" ]; then
-  install -m 755 "$tmpdir/openshell" "$target_dir/openshell"
+  install_bins "$target_dir"
 elif [ "${NEMOCLAW_NON_INTERACTIVE:-}" = "1" ] || [ ! -t 0 ]; then
   target_dir="${XDG_BIN_HOME:-$HOME/.local/bin}"
   mkdir -p "$target_dir"
-  install -m 755 "$tmpdir/openshell" "$target_dir/openshell"
+  install_bins "$target_dir"
   warn "Installed openshell to $target_dir/openshell (user-local path)"
   warn "For future shells, run: export PATH=\"$target_dir:\$PATH\""
   warn "Add that export to your shell profile, or open a new shell before using openshell directly."
 else
   sudo install -m 755 "$tmpdir/openshell" "$target_dir/openshell"
+  if [ -x "$tmpdir/openshell-gateway" ]; then
+    sudo install -m 755 "$tmpdir/openshell-gateway" "$target_dir/openshell-gateway"
+  fi
+  if [ -x "$tmpdir/openshell-sandbox" ]; then
+    sudo install -m 755 "$tmpdir/openshell-sandbox" "$target_dir/openshell-sandbox"
+  fi
 fi
 
 info "$("$target_dir/openshell" --version 2>&1 || echo openshell) installed"

src/lib/inventory-commands.test.ts

@@ -75,6 +75,12 @@ describe("inventory commands", () => {
           model: "configured-alpha",
           provider: "configured-provider",
           gpuEnabled: true,
+          hostGpuDetected: false,
+          sandboxGpuEnabled: true,
+          sandboxGpuMode: null,
+          sandboxGpuDevice: null,
+          openshellDriver: null,
+          openshellVersion: null,
           policies: ["pypi"],
           agent: "openclaw",
           isDefault: true,
@@ -149,7 +155,7 @@ describe("inventory commands", () => {
     expect(lines).toContain("  Recovered 1 sandbox entry from the live OpenShell gateway.");
     expect(lines).toContain("    alpha *");
     expect(lines).toContain(
-      "      agent: openclaw  model: nvidia/nemotron-3-super-120b-a12b  provider: nvidia-prod  GPU  policies: pypi",
+      "      agent: openclaw  model: nvidia/nemotron-3-super-120b-a12b  provider: nvidia-prod  sandbox GPU  policies: pypi",
     );
   });
 
@@ -175,7 +181,7 @@ describe("inventory commands", () => {
     });
 
     expect(lines).toContain(
-      "      agent: hermes  model: nvidia/nemotron-3-super-120b-a12b  provider: nvidia-prod  CPU  policies: none",
+      "      agent: hermes  model: nvidia/nemotron-3-super-120b-a12b  provider: nvidia-prod  CPU sandbox  policies: none",
     );
   });
 
@@ -208,19 +214,19 @@ describe("inventory commands", () => {
 
     // Default sandbox reflects live gateway state, with an onboarded drift note.
     expect(lines).toContain(
-      "      agent: openclaw  model: live-model  provider: live-provider  GPU  policies: none",
+      "      agent: openclaw  model: live-model  provider: live-provider  sandbox GPU  policies: none",
     );
     // Stale stored row for the default sandbox must not leak through.
     expect(lines).not.toContain(
-      "      agent: openclaw  model: configured-alpha  provider: configured-provider  GPU  policies: none",
+      "      agent: openclaw  model: configured-alpha  provider: configured-provider  sandbox GPU  policies: none",
     );
     expect(lines).toContain(
       "      (onboarded: model=configured-alpha, provider=configured-provider)",
     );
     // Non-default sandbox keeps its stored config — the gateway only applies
     // to whichever sandbox is currently connected.
     expect(lines).toContain(
-      "      agent: openclaw  model: configured-beta  provider: beta-provider  CPU  policies: none",
+      "      agent: openclaw  model: configured-beta  provider: beta-provider  CPU sandbox  policies: none",
     );
   });
 
@@ -245,7 +251,7 @@ describe("inventory commands", () => {
     });
 
     expect(lines).toContain(
-      "      agent: openclaw  model: configured-alpha  provider: configured-provider  GPU  policies: none",
+      "      agent: openclaw  model: configured-alpha  provider: configured-provider  sandbox GPU  policies: none",
     );
     expect(lines.some((l) => l.includes("onboarded"))).toBe(false);
   });
@@ -271,7 +277,7 @@ describe("inventory commands", () => {
     });
 
     expect(lines).toContain(
-      "      agent: openclaw  model: configured-alpha  provider: configured-provider  GPU  policies: none",
+      "      agent: openclaw  model: configured-alpha  provider: configured-provider  sandbox GPU  policies: none",
     );
     expect(lines.some((l) => l.includes("onboarded"))).toBe(false);
   });
@@ -298,7 +304,7 @@ describe("inventory commands", () => {
     });
 
     expect(lines).toContain(
-      "      agent: openclaw  model: live-model  provider: configured-provider  GPU  policies: none",
+      "      agent: openclaw  model: live-model  provider: configured-provider  sandbox GPU  policies: none",
     );
     expect(lines).toContain("      (onboarded: model=configured-alpha)");
   });
@@ -325,7 +331,7 @@ describe("inventory commands", () => {
     });
 
     expect(lines).toContain(
-      "      agent: openclaw  model: configured-alpha  provider: live-provider  GPU  policies: none",
+      "      agent: openclaw  model: configured-alpha  provider: live-provider  sandbox GPU  policies: none",
     );
     expect(lines).toContain("      (onboarded: provider=configured-provider)");
   });

src/lib/inventory-commands.ts

@@ -10,6 +10,12 @@ export interface SandboxEntry {
   model?: string | null;
   provider?: string | null;
   gpuEnabled?: boolean;
+  hostGpuDetected?: boolean;
+  sandboxGpuEnabled?: boolean;
+  sandboxGpuMode?: string | null;
+  sandboxGpuDevice?: string | null;
+  openshellDriver?: string | null;
+  openshellVersion?: string | null;
   policies?: string[] | null;
   providerCredentialHashes?: Record<string, string> | null;
   messagingChannels?: string[] | null;
@@ -51,6 +57,12 @@ export interface SandboxInventoryRow {
   model: string | null;
   provider: string | null;
   gpuEnabled: boolean;
+  hostGpuDetected: boolean;
+  sandboxGpuEnabled: boolean;
+  sandboxGpuMode: string | null;
+  sandboxGpuDevice: string | null;
+  openshellDriver: string | null;
+  openshellVersion: string | null;
   policies: string[];
   agent: string | null;
   dashboardPort?: number | null;
@@ -95,6 +107,12 @@ export interface StatusSandboxRow {
   model: string | null;
   provider: string | null;
   gpuEnabled: boolean;
+  hostGpuDetected: boolean;
+  sandboxGpuEnabled: boolean;
+  sandboxGpuMode: string | null;
+  sandboxGpuDevice: string | null;
+  openshellDriver: string | null;
+  openshellVersion: string | null;
   policies: string[];
   agent: string | null;
   dashboardPort?: number | null;
@@ -129,12 +147,22 @@ function buildSandboxInventoryRow(
   getActiveSessionCount?: (sandboxName: string) => number | null,
 ): SandboxInventoryRow {
   const activeSessionCount = getActiveSessionCount ? getActiveSessionCount(sandbox.name) : null;
+  const sandboxGpuEnabled =
+    typeof sandbox.sandboxGpuEnabled === "boolean"
+      ? sandbox.sandboxGpuEnabled
+      : sandbox.gpuEnabled === true;
 
   return {
     name: sandbox.name,
     model: sandbox.model || null,
     provider: sandbox.provider || null,
     gpuEnabled: sandbox.gpuEnabled === true,
+    hostGpuDetected: sandbox.hostGpuDetected === true,
+    sandboxGpuEnabled,
+    sandboxGpuMode: safeStatusString(sandbox.sandboxGpuMode || null),
+    sandboxGpuDevice: safeStatusString(sandbox.sandboxGpuDevice || null),
+    openshellDriver: safeStatusString(sandbox.openshellDriver || null),
+    openshellVersion: safeStatusString(sandbox.openshellVersion || null),
     policies: Array.isArray(sandbox.policies) ? sandbox.policies : [],
     agent: sandbox.agent || null,
     ...(sandbox.dashboardPort != null ? { dashboardPort: sandbox.dashboardPort } : {}),
@@ -225,7 +253,7 @@ export function renderSandboxInventoryText(
     const modelDrifted = !!(useLive && liveInference.model && liveInference.model !== sandbox.model);
     const providerDrifted =
       !!(useLive && liveInference.provider && liveInference.provider !== sandbox.provider);
-    const gpu = sandbox.gpuEnabled ? "GPU" : "CPU";
+    const gpu = sandbox.sandboxGpuEnabled ? "sandbox GPU" : "CPU sandbox";
     const presets = sandbox.policies.length > 0 ? sandbox.policies.join(", ") : "none";
     const connected = sandbox.connected ? " ●" : "";
     const agent = sandbox.agent || "openclaw";
@@ -267,11 +295,21 @@ function buildStatusSandboxRow(
     typeof sandbox.dashboardPort === "number" && Number.isFinite(sandbox.dashboardPort)
       ? sandbox.dashboardPort
       : null;
+  const sandboxGpuEnabled =
+    typeof sandbox.sandboxGpuEnabled === "boolean"
+      ? sandbox.sandboxGpuEnabled
+      : sandbox.gpuEnabled === true;
   return {
     name: safeStatusString(sandbox.name) || sandbox.name,
     model: safeStatusString(liveModel || sandbox.model || null),
     provider: safeStatusString(liveProvider || sandbox.provider || null),
     gpuEnabled: sandbox.gpuEnabled === true,
+    hostGpuDetected: sandbox.hostGpuDetected === true,
+    sandboxGpuEnabled,
+    sandboxGpuMode: safeStatusString(sandbox.sandboxGpuMode || null),
+    sandboxGpuDevice: safeStatusString(sandbox.sandboxGpuDevice || null),
+    openshellDriver: safeStatusString(sandbox.openshellDriver || null),
+    openshellVersion: safeStatusString(sandbox.openshellVersion || null),
     policies: Array.isArray(sandbox.policies)
       ? sandbox.policies
           .filter((policy): policy is string => typeof policy === "string")