fix(onboard): handle Docker Desktop WSL CDI injection failures

[laitingsheng]

Summary

On Docker Desktop WSL the OpenShell gateway issues docker create --device nvidia.com/gpu=all independently of NemoClaw's own GPU patch, so setting NEMOCLAW_DOCKER_GPU_PATCH=0 shifts the failure to a less actionable CDI injection error. Classify the new failure mode, point the recovery hint at --no-gpu / NEMOCLAW_SANDBOX_GPU=0, and refuse the env opt-out on Docker Desktop WSL where the patch is required.

Related Issue

Fixes #5180

Changes

• src/lib/validation.ts: new gpu_cdi_injection_failed failure kind + classifier arm matching CDI device injection failed / unresolvable CDI devices when paired with nvidia.com/gpu. Ordered ahead of the generic Created sandbox: arm so mixed output keeps GPU-specific guidance.
• src/lib/build-context.ts: recovery hint for the new kind explains the gateway issues the injection itself, calls out that NEMOCLAW_DOCKER_GPU_PATCH=0 does not bypass it, and points at --no-gpu / NEMOCLAW_SANDBOX_GPU=0 plus onboard --resume --no-gpu.
• src/lib/onboard/docker-gpu-patch.ts: shouldApplyDockerGpuPatch accepts an optional dockerDesktopWsl flag and refuses the env opt-out on that runtime with a one-line warning; the patch-failure escape-hatch block now lists both NEMOCLAW_DOCKER_GPU_PATCH=0 and NEMOCLAW_SANDBOX_GPU=0 with scope notes.
• src/lib/onboard/docker-gpu-sandbox-create.ts: detects Docker Desktop WSL inside resolveDockerGpuSandboxCreatePlan (cached via isDockerDesktopWslRuntime) so create-plan and post-ready local-inference paths share the same runtime decision without growing src/lib/onboard.ts.
• src/lib/onboard/docker-gpu-local-inference.ts: threads the resolved dockerDesktopWsl (or falls back to the shared cache) into shouldUseDockerGpuPatchHostNetwork and verifyDockerGpuSandboxLocalInference, so the host-network downgrade and post-ready probe still run when the opt-out is ignored.
• src/lib/onboard/command-support.ts: --no-sandbox-gpu description notes the NEMOCLAW_SANDBOX_GPU=0 equivalence and that it is the alternative to --no-gpu on Docker Desktop WSL.
• docs/reference/troubleshooting.mdx: Docker Desktop WSL guidance plus a recovery entry for CDI device injection failed.
• Tests: classifier (5 cases including mixed-output and non-GPU CDI guards), printer (1 case), gate (2 cases in a focused docker-gpu-patch-wsl.test.ts), full-path create-plan + buildSandboxGpuCreateArgs (3 cases).

Follow-up not bundled: #3213 (unify warnings / advisories / fatal exits) — the new recovery hint will fold into that registry when it lands.

Type of Change

• Code change with doc updates
• Code change (feature, bug fix, or refactor)
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Tinson Lai tinsonl@nvidia.com

Summary by CodeRabbit

Release Notes

• Documentation

  • Updated troubleshooting guide with Docker Desktop WSL-specific GPU patch guidance and CDI injection error recovery steps.

• New Features

  • Added Docker Desktop WSL detection and runtime-specific Docker GPU patch handling.
  • Improved GPU CDI injection failure detection with targeted recovery guidance.

• Bug Fixes

  • Fixed Docker GPU patch bypass behavior on Docker Desktop WSL to properly log warnings and suggest alternative workarounds.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c8c7787c-30c4-4e7d-a257-8f79f6a376e5

📥 Commits

Reviewing files that changed from the base of the PR and between 1b0a8d6 and fecdd1e.

📒 Files selected for processing (1)

• src/lib/validation-cdi.test.ts

---

📝 Walkthrough

Walkthrough

This PR addresses GPU CDI injection failures on Docker Desktop WSL by detecting the specific failure pattern, refusing the patch opt-out on Docker Desktop WSL to keep the compatibility path enabled, and emitting targeted recovery guidance pointing to --no-gpu and NEMOCLAW_SANDBOX_GPU=0 escape hatches.

Changes

GPU CDI injection detection and Docker Desktop WSL handling

Layer / File(s)	Summary
GPU CDI injection failure classification and tests src/lib/validation.ts, src/lib/validation-cdi.test.ts	SandboxCreateFailure.kind gains the gpu_cdi_injection_failed category. classifySandboxCreateFailure() matches CDI device injection output patterns (e.g., "unresolvable CDI devices nvidia.com/gpu=all") and classifies them. Tests verify correct detection of GPU-specific CDI failures and regression checks for generic or non-GPU CDI patterns.
Recovery guidance for CDI injection failures src/lib/build-context.ts, src/lib/build-context.test.ts	printSandboxCreateRecoveryHints adds an early-return branch for gpu_cdi_injection_failed that explains the gateway's own docker create --device nvidia.com/gpu=all call is not bypassed by NEMOCLAW_DOCKER_GPU_PATCH=0, then recommends --no-gpu or NEMOCLAW_SANDBOX_GPU=0 with a targeted resume command. Test validates output content.
Docker Desktop WSL–aware patch decision src/lib/onboard/docker-gpu-patch.ts, src/lib/onboard/docker-gpu-patch-wsl.test.ts	shouldApplyDockerGpuPatch accepts dockerDesktopWsl and log callbacks. When NEMOCLAW_DOCKER_GPU_PATCH=0 is set and dockerDesktopWsl is true, it logs why the opt-out is ignored and returns true to keep patching enabled. printDockerGpuPatchFailureAndExit expands escape-hatch output to include both NEMOCLAW_DOCKER_GPU_PATCH=0 (with WSL context) and NEMOCLAW_SANDBOX_GPU=0. Tests verify WSL vs non-WSL behavior under opt-out.
WSL detection and sandbox creation plan wiring src/lib/onboard/docker-gpu-sandbox-create.ts, src/lib/onboard/docker-gpu-sandbox-create.test.ts	Exports isDockerDesktopWslRuntime() detection (cached) and reset helper. shouldUseDockerGpuPatchForCreate and resolveDockerGpuSandboxCreatePlan accept optional dockerDesktopWsl override and detectDockerDesktopWsl callback. When omitted, the detected value is derived from the callback or auto-detected, then passed into patch-eligibility decisions. Tests verify plan useDockerGpuPatch stays true on WSL (with patch opt-out) and becomes false off WSL, and that the resulting --gpu suppression reflects plan decisions.
WSL detection in local inference reachability src/lib/onboard/docker-gpu-local-inference.ts	Imports and uses isDockerDesktopWslRuntime. Introduces resolveDockerDesktopWsl helper on DockerGpuLocalInferenceOptions (optional override, else auto-detect). Passes resolved dockerDesktopWsl into shouldApplyDockerGpuPatch calls from host-network downgrade and local inference reachability gates. Updates comment on skip-path to reflect WSL-aware disable scenarios.
Troubleshooting docs and CLI help docs/reference/troubleshooting.mdx, src/lib/onboard/command-support.ts	Troubleshooting section now clarifies that on Docker Desktop WSL, NEMOCLAW_DOCKER_GPU_PATCH=0 is ignored (with warning) and that CDI injection failures during the gateway's docker create are not bypassed by that opt-out; recommends --no-gpu or NEMOCLAW_SANDBOX_GPU=0 to skip GPU entirely. --no-sandbox-gpu CLI help is updated to reference NEMOCLAW_SANDBOX_GPU=0 equivalence and WSL pairing guidance.

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested labels

area: onboarding, area: cli

Suggested reviewers

• cv
• prekshivyas
• jyaunches

🐰 When Docker's Gateway says "no" to CDI,
Docker Desktop WSL now knows the true reply:
The patch stays applied, the escape hatch is clear,
With --no-gpu guidance, no failure to fear! 🎯

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 18.75% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title clearly and concisely summarizes the main change: handling Docker Desktop WSL CDI injection failures in the onboard process.
Linked Issues check	✅ Passed	The PR comprehensively addresses all coding requirements from issue #5180: detects CDI injection failures, refuses NEMOCLAW_DOCKER_GPU_PATCH=0 on Docker Desktop WSL, provides targeted recovery hints, surfaces NEMOCLAW_SANDBOX_GPU=0, and implements required detection and threading logic.
Out of Scope Changes check	✅ Passed	All changes are within scope of issue #5180: validation classifiers, recovery hints, Docker GPU patch logic, Docker Desktop WSL detection, CLI help text, documentation, and comprehensive test coverage for the changes.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/5180-docker-gpu-patch-wsl-cdi-classifier

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-5198.docs.buildwithfern.com/nemoclaw

[github-actions]

E2E Advisor Recommendation

Required E2E: None
Optional E2E: None

Workflow run

Full advisor summary

E2E Recommendation Advisor

Failed: Could not parse JSON from advisor output; see /home/runner/work/NemoClaw/NemoClaw/artifacts/e2e-advisor/e2e-advisor-raw-output.txt

[github-actions]

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: None
Optional Vitest E2E scenarios: None

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Failed: Could not parse JSON from advisor output; see /home/runner/work/NemoClaw/NemoClaw/artifacts/e2e-advisor/e2e-scenario-advisor-raw-output.txt

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/onboard.ts`:
- Around line 3467-3473: The new docker-desktop detection and wiring
(dockerDesktopWsl = preflightUtils.detectWslDockerDesktopStatus({}) ===
"docker-desktop"; and the call to
dockerGpuSandboxCreate.resolveDockerGpuSandboxCreatePlan(...)) must be moved so
the file stays net-neutral: relocate the detectWslDockerDesktopStatus call and
the dockerDesktopWsl variable into an existing helper boundary (for example
inside the helper that already computes sandbox GPU config or inside
dockerGpuSandboxCreate.resolveDockerGpuSandboxCreatePlan) so the top-level hunk
no longer grows the file; update resolveDockerGpuSandboxCreatePlan invocations
to accept or compute dockerDesktopWsl internally (using
isLinuxDockerDriverGatewayEnabled and effectiveSandboxGpuConfig as before), or
remove an equivalent nearby helper/unused logging line to offset +3 lines if
moving is not feasible. Ensure references to detectWslDockerDesktopStatus,
dockerDesktopWsl, dockerGpuSandboxCreate.resolveDockerGpuSandboxCreatePlan,
effectiveSandboxGpuConfig, and isLinuxDockerDriverGatewayEnabled are updated
accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: bb932bc6-5fa2-4ce9-a5a6-44e14e7b4985

📥 Commits

Reviewing files that changed from the base of the PR and between 7ddebe3 and e8c8493.

📒 Files selected for processing (10)

• docs/reference/troubleshooting.mdx
• src/lib/build-context.test.ts
• src/lib/build-context.ts
• src/lib/onboard.ts
• src/lib/onboard/docker-gpu-patch.test.ts
• src/lib/onboard/docker-gpu-patch.ts
• src/lib/onboard/docker-gpu-sandbox-create.ts
• src/lib/onboard/preflight.ts
• src/lib/validation.test.ts
• src/lib/validation.ts

[github-actions]

PR Review Advisor

Findings: 0 needs attention, 3 worth checking, 0 nice ideas
Since last review: 1 prior item resolved, 3 still apply, 0 new items found

Review findings

🛠️ Needs attention

• None.

🔎 Worth checking

• Source-of-truth review needed: Docker Desktop WSL GPU compatibility path and CDI recovery guidance: The advisor marked localized patch analysis as needs_followup.
  • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Evidence: wsl-docker-desktop-gpu.ts contains WSL_DOCKER_DESKTOP_GPU_COMPATIBILITY_REMOVAL_CONDITION; docs/reference/troubleshooting.mdx adds matching retirement language. The missing regression proof is covered by the test findings for local-inference/network boundaries and runtime compatibility recreate mode.
• Cover the Docker Desktop WSL opt-out decision at post-ready and network boundaries (src/lib/onboard/docker-gpu-local-inference.ts:49): The implementation now threads Docker Desktop WSL awareness into local-inference and host-network helpers, but the changed tests only cover the create-plan/direct-create-args side. The post-ready local-inference probe and host-network downgrade helpers can still regress by treating NEMOCLAW_DOCKER_GPU_PATCH=0 as a real opt-out outside the create path.
  • Recommendation: Add focused behavior tests for verifyDockerGpuSandboxLocalInference, shouldUseDockerGpuPatchHostNetwork, enforceDockerGpuPatchPreserveNetwork, and verifyGpuSandboxAfterReady with dockerDesktopWsl=true plus NEMOCLAW_DOCKER_GPU_PATCH=0. Prefer passing the resolved Docker Desktop WSL decision explicitly through verifyGpuSandboxAfterReady so these unit tests remain host-independent.
  • Evidence: src/lib/onboard/docker-gpu-local-inference.ts adds resolveDockerDesktopWsl() and passes dockerDesktopWsl into shouldApplyDockerGpuPatch. Existing docker-gpu-local-inference.test.ts covers generic patch-active/inactive behavior, but no changed test proves WSL + opt-out runs execInSandbox instead of returning skipped:not-docker-gpu-patch, or proves host-network downgrade still runs.
• Add runtime-path proof for Docker Desktop WSL compatibility GPU recreate mode (src/lib/onboard/docker-gpu-sandbox-create.ts:326): The PR has good unit evidence that Docker Desktop WSL plus NEMOCLAW_DOCKER_GPU_PATCH=0 suppresses OpenShell's direct --gpu path, but the reported working path also depends on the Docker recreate selecting the usable --gpus compatibility mode and reconnecting successfully. That runtime boundary is not directly proven by the changed tests.
  • Recommendation: Add or identify targeted runtime/integration validation on Docker Desktop WSL showing that onboarding omits OpenShell sandbox create --gpu, recreates the sandbox container with --gpus all, reaches supervisor reconnect/GPU proof, and emits the new CDI recovery guidance when the gateway CDI branch is hit. If runtime coverage cannot run in this PR, keep the unit contract explicit and document the validation gap.
  • Evidence: docker-gpu-sandbox-create.test.ts combines resolveDockerGpuSandboxCreatePlan with buildSandboxGpuCreateArgs and proves --gpu is omitted when the WSL opt-out is ignored. No changed test exercises the actual Docker recreate mode selection or the real onboard failure branch end-to-end on Docker Desktop WSL.

🌱 Nice ideas

• None.

Consider writing more tests for

• **Runtime validation** — verifyDockerGpuSandboxLocalInference with dockerDesktopWsl=true and NEMOCLAW_DOCKER_GPU_PATCH=0 runs execInSandbox and returns ok/failed instead of skipped:not-docker-gpu-patch.. The PR improves focused unit coverage for classifier, recovery output, WSL opt-out gate, create-plan, and create-args behavior. The changed behavior still spans Docker Desktop WSL detection, OpenShell sandbox-create args, Docker container recreate mode selection, supervisor reconnect, host-network downgrade, and post-ready inference probes, so runtime/integration validation would materially improve confidence.
• **Runtime validation** — shouldUseDockerGpuPatchHostNetwork returns true for Docker Desktop WSL with NEMOCLAW_DOCKER_GPU_PATCH=0 and NEMOCLAW_DOCKER_GPU_PATCH_NETWORK=host.. The PR improves focused unit coverage for classifier, recovery output, WSL opt-out gate, create-plan, and create-args behavior. The changed behavior still spans Docker Desktop WSL detection, OpenShell sandbox-create args, Docker container recreate mode selection, supervisor reconnect, host-network downgrade, and post-ready inference probes, so runtime/integration validation would materially improve confidence.
• **Runtime validation** — enforceDockerGpuPatchPreserveNetwork changes NEMOCLAW_DOCKER_GPU_PATCH_NETWORK to preserve and reruns bridge reachability for Docker Desktop WSL with the patch opt-out ignored.. The PR improves focused unit coverage for classifier, recovery output, WSL opt-out gate, create-plan, and create-args behavior. The changed behavior still spans Docker Desktop WSL detection, OpenShell sandbox-create args, Docker container recreate mode selection, supervisor reconnect, host-network downgrade, and post-ready inference probes, so runtime/integration validation would materially improve confidence.
• **Runtime validation** — verifyGpuSandboxAfterReady uses the same resolved Docker Desktop WSL decision as create planning, or accepts and passes through an explicit dockerDesktopWsl option.. The PR improves focused unit coverage for classifier, recovery output, WSL opt-out gate, create-plan, and create-args behavior. The changed behavior still spans Docker Desktop WSL detection, OpenShell sandbox-create args, Docker container recreate mode selection, supervisor reconnect, host-network downgrade, and post-ready inference probes, so runtime/integration validation would materially improve confidence.
• **Runtime validation** — The actual onboard sandbox-create failure branch emits CDI guidance, --no-gpu, and NEMOCLAW_SANDBOX_GPU=0 when output contains both Created sandbox: and CDI device injection failed.. The PR improves focused unit coverage for classifier, recovery output, WSL opt-out gate, create-plan, and create-args behavior. The changed behavior still spans Docker Desktop WSL detection, OpenShell sandbox-create args, Docker container recreate mode selection, supervisor reconnect, host-network downgrade, and post-ready inference probes, so runtime/integration validation would materially improve confidence.
• **Cover the Docker Desktop WSL opt-out decision at post-ready and network boundaries** — Add focused behavior tests for verifyDockerGpuSandboxLocalInference, shouldUseDockerGpuPatchHostNetwork, enforceDockerGpuPatchPreserveNetwork, and verifyGpuSandboxAfterReady with dockerDesktopWsl=true plus NEMOCLAW_DOCKER_GPU_PATCH=0. Prefer passing the resolved Docker Desktop WSL decision explicitly through verifyGpuSandboxAfterReady so these unit tests remain host-independent.
• **Add runtime-path proof for Docker Desktop WSL compatibility GPU recreate mode** — Add or identify targeted runtime/integration validation on Docker Desktop WSL showing that onboarding omits OpenShell sandbox create --gpu, recreates the sandbox container with --gpus all, reaches supervisor reconnect/GPU proof, and emits the new CDI recovery guidance when the gateway CDI branch is hit. If runtime coverage cannot run in this PR, keep the unit contract explicit and document the validation gap.
• **Acceptance clause:** Setting `NEMOCLAW_DOCKER_GPU_PATCH=0` on Docker Desktop WSL does not produce the expected result (skipping GPU patching). Instead it shifts the failure one step later to the OpenShell gateway's own CDI injection, which also fails on Docker Desktop WSL — resulting in `Sandbox creation failed (exit 1)` with no useful recovery hint. — add test evidence or identify existing coverage. shouldApplyDockerGpuPatch now returns true and logs guidance when dockerDesktopWsl=true and NEMOCLAW_DOCKER_GPU_PATCH=0 is set; resolveDockerGpuSandboxCreatePlan keeps useDockerGpuPatch=true; buildSandboxGpuCreateArgs is tested to omit --gpu; classifySandboxCreateFailure and printSandboxCreateRecoveryHints add CDI-specific guidance. Runtime Docker Desktop WSL recreate behavior is not directly validated.

Since last review details

Current findings:

• Source-of-truth review needed: Docker Desktop WSL GPU compatibility path and CDI recovery guidance: The advisor marked localized patch analysis as needs_followup.
  • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Evidence: wsl-docker-desktop-gpu.ts contains WSL_DOCKER_DESKTOP_GPU_COMPATIBILITY_REMOVAL_CONDITION; docs/reference/troubleshooting.mdx adds matching retirement language. The missing regression proof is covered by the test findings for local-inference/network boundaries and runtime compatibility recreate mode.
• Cover the Docker Desktop WSL opt-out decision at post-ready and network boundaries (src/lib/onboard/docker-gpu-local-inference.ts:49): The implementation now threads Docker Desktop WSL awareness into local-inference and host-network helpers, but the changed tests only cover the create-plan/direct-create-args side. The post-ready local-inference probe and host-network downgrade helpers can still regress by treating NEMOCLAW_DOCKER_GPU_PATCH=0 as a real opt-out outside the create path.
  • Recommendation: Add focused behavior tests for verifyDockerGpuSandboxLocalInference, shouldUseDockerGpuPatchHostNetwork, enforceDockerGpuPatchPreserveNetwork, and verifyGpuSandboxAfterReady with dockerDesktopWsl=true plus NEMOCLAW_DOCKER_GPU_PATCH=0. Prefer passing the resolved Docker Desktop WSL decision explicitly through verifyGpuSandboxAfterReady so these unit tests remain host-independent.
  • Evidence: src/lib/onboard/docker-gpu-local-inference.ts adds resolveDockerDesktopWsl() and passes dockerDesktopWsl into shouldApplyDockerGpuPatch. Existing docker-gpu-local-inference.test.ts covers generic patch-active/inactive behavior, but no changed test proves WSL + opt-out runs execInSandbox instead of returning skipped:not-docker-gpu-patch, or proves host-network downgrade still runs.
• Add runtime-path proof for Docker Desktop WSL compatibility GPU recreate mode (src/lib/onboard/docker-gpu-sandbox-create.ts:326): The PR has good unit evidence that Docker Desktop WSL plus NEMOCLAW_DOCKER_GPU_PATCH=0 suppresses OpenShell's direct --gpu path, but the reported working path also depends on the Docker recreate selecting the usable --gpus compatibility mode and reconnecting successfully. That runtime boundary is not directly proven by the changed tests.
  • Recommendation: Add or identify targeted runtime/integration validation on Docker Desktop WSL showing that onboarding omits OpenShell sandbox create --gpu, recreates the sandbox container with --gpus all, reaches supervisor reconnect/GPU proof, and emits the new CDI recovery guidance when the gateway CDI branch is hit. If runtime coverage cannot run in this PR, keep the unit contract explicit and document the validation gap.
  • Evidence: docker-gpu-sandbox-create.test.ts combines resolveDockerGpuSandboxCreatePlan with buildSandboxGpuCreateArgs and proves --gpu is omitted when the WSL opt-out is ignored. No changed test exercises the actual Docker recreate mode selection or the real onboard failure branch end-to-end on Docker Desktop WSL.

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

[github-actions]

Selective E2E Results — ❌ Some jobs failed

Run: 27320066526
Target ref: e8c8493385ff89b9ec786e9d8bb6ae2a648dfbcf
Workflow ref: main
Requested jobs: gpu-e2e,cloud-onboard-e2e
Summary: 0 passed, 1 failed, 1 skipped

Job	Result
cloud-onboard-e2e	❌ failure
gpu-e2e	⏭️ skipped

Failed jobs: cloud-onboard-e2e. Check run artifacts for logs.

[github-actions]

Selective E2E Results — ⚠️ No requested jobs ran

Run: 27320937438
Target ref: 58133841fac5d5e4726a232c67a367223dd937e6
Workflow ref: main
Requested jobs: gpu-e2e
Summary: 0 passed, 0 failed, 1 skipped

Job	Result
gpu-e2e	⏭️ skipped

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/onboard/command-support.ts`:
- Around line 69-70: Update the help text for the --no-sandbox-gpu option to
remove the implication that it must be paired with --no-gpu; clarify that
--no-sandbox-gpu is equivalent to setting NEMOCLAW_SANDBOX_GPU=0 and can be used
as an alternative to --no-gpu (not combined), and ensure consistency with the
gpu_cdi_injection_failed guidance which suggests using either --no-gpu or
NEMOCLAW_SANDBOX_GPU=0 (and the recovery command onboard --resume --no-gpu).
Reference the --no-sandbox-gpu option and the NEMOCLAW_SANDBOX_GPU variable in
the description string in command-support.ts and make the wording match the
guidance in build-context.ts.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1084cc0d-232d-441a-9393-437a58b18886

📥 Commits

Reviewing files that changed from the base of the PR and between e8c8493 and 5813384.

📒 Files selected for processing (7)

• src/lib/build-context.ts
• src/lib/onboard/command-support.ts
• src/lib/onboard/docker-gpu-local-inference.ts
• src/lib/onboard/docker-gpu-patch-wsl.test.ts
• src/lib/onboard/docker-gpu-patch.ts
• src/lib/onboard/docker-gpu-sandbox-create.ts
• src/lib/validation.test.ts

🚧 Files skipped from review as they are similar to previous changes (3)

• src/lib/build-context.ts
• src/lib/validation.test.ts
• src/lib/onboard/docker-gpu-patch.ts

[github-actions]

Selective E2E Results — ⚠️ No requested jobs ran

Run: 27321532084
Target ref: ba5a8967ee2f4e51fbfb75c943a360bc7af4c745
Workflow ref: main
Requested jobs: gpu-e2e
Summary: 0 passed, 0 failed, 1 skipped

Job	Result
gpu-e2e	⏭️ skipped