feat: migrate sandbox operations to OpenShell gRPC

.github/workflows/e2e-script.yaml

@@ -139,6 +139,12 @@ jobs:
             print("::error::env_json must be a JSON object", file=sys.stderr)
             sys.exit(1)
 
+          # Nightly runners commonly lack CAP_SETPCAP inside OpenShell sandboxes.
+          # The sandbox image remains fail-closed by default; E2E jobs opt in so
+          # they can validate product behavior while gateway-isolation covers the
+          # fail-closed residual-capability posture.
+          values.setdefault("NEMOCLAW_ALLOW_RESIDUAL_CAPS", "1")
+
           name_pattern = re.compile(r"^[A-Z_][A-Z0-9_]*$")
           reserved_prefixes = ("ACTIONS_", "GITHUB_", "INPUT_", "RUNNER_")
           reserved_names = {"CI", "HOME", "PATH", "PWD", "SHELL"}

ci/env-var-doc-allowlist.json

@@ -31,6 +31,14 @@
     "name": "NEMOCLAW_RESTORE_LATEST_BACKUP_ON_RECREATE",
     "reason": "Internal installer sentinel exported only during OpenShell gateway replacement so onboard restores the pre-upgrade sandbox backup. Not user-facing."
   },
+  {
+    "name": "NEMOCLAW_SDK_TEST_FAKE_EXEC_BIN",
+    "reason": "Vitest-only helper used by the OpenShell SDK sync runner to drive hermetic fake OpenShell fixtures without loading the native SDK binding. Never user-set in production."
+  },
+  {
+    "name": "NEMOCLAW_SDK_TEST_TRANSPORT",
+    "reason": "Vitest-only sentinel that prevents hermetic CLI tests from loading real OpenShell gateway metadata and routes sandbox exec calls through test fixtures. Never user-set in production."
+  },
   {
     "name": "NEMOCLAW_TEST_NO_SLEEP",
     "reason": "Test sentinel that bypasses real-time sleep() calls in onboard inference probes. Set to '1' only by Vitest tests; never user-set."

package.json

@@ -29,7 +29,7 @@
     "format:ts": "cd nemoclaw && npm run lint:fix && npm run format",
     "check:installer-hash": "bash scripts/check-installer-hash.sh",
     "typecheck": "tsc -p jsconfig.json",
-    "build:cli": "tsc -p tsconfig.src.json && node dist/lib/cli/generate-oclif-metadata-manifest.js && if find nemoclaw-blueprint/scripts -name '*.ts' -print -quit | grep -q .; then tsc -p nemoclaw-blueprint/tsconfig.json; fi",
+    "build:cli": "tsc -p tsconfig.src.json && node scripts/copy-openshell-protos.mjs && node dist/lib/cli/generate-oclif-metadata-manifest.js && if find nemoclaw-blueprint/scripts -name '*.ts' -print -quit | grep -q .; then tsc -p nemoclaw-blueprint/tsconfig.json; fi",
     "typecheck:cli": "tsc -p tsconfig.cli.json",
     "validate:configs": "tsx scripts/validate-configs.ts",
     "type-safety:hotspots": "tsx scripts/type-safety-hotspots.ts",
@@ -47,7 +47,10 @@
   },
   "dependencies": {
     "@aws-sdk/client-bedrock-runtime": "3.1046.0",
+    "@grpc/grpc-js": "^1.14.4",
+    "@grpc/proto-loader": "^0.8.1",
     "@oclif/core": "^4.10.5",
+    "@openshell/sdk": "file:vendor/openshell-sdk-placeholder",
     "js-yaml": "^4.1.1",
     "p-retry": "^4.6.2",
     "qrcode-terminal": "^0.12.0",

scripts/copy-openshell-protos.mjs

@@ -0,0 +1,15 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import fs from "node:fs";
+import path from "node:path";
+
+const root = process.cwd();
+const source = path.join(root, "src", "lib", "adapters", "openshell", "proto");
+const dest = path.join(root, "dist", "lib", "adapters", "openshell", "proto");
+
+fs.mkdirSync(dest, { recursive: true });
+for (const entry of fs.readdirSync(source, { withFileTypes: true })) {
+  if (!entry.isFile() || !entry.name.endsWith(".proto")) continue;
+  fs.copyFileSync(path.join(source, entry.name), path.join(dest, entry.name));
+}