feat(sandbox): add agent passthrough subcommand for non-interactive openclaw access - #5397
Merged
Conversation
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (4)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughWalkthroughAdds a non-interactive ChangesSandbox Agent Feature
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-5397.docs.buildwithfern.com/nemoclaw |
laitingsheng
added
integration: openclaw
Contributor
PR Review AdvisorFindings: 0 needs attention, 1 worth checking, 0 nice ideas Review findings🛠️ Needs attention
🔎 Worth checking
🌱 Nice ideas
Consider writing more tests for
Since last review detailsCurrent findings:
This is an automated advisory review. A human maintainer must make the final merge decision. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
docs/reference/commands-nemohermes.mdx (1)
437-437: ⚡ Quick winFormat
stdoutas inline code.Wrap
stdoutin backticks to match the docs formatting rule for literal values.As per coding guidelines, "CLI commands, file paths, flags, parameter names, and values must use inline
codeformatting."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/commands-nemohermes.mdx` at line 437, The docs sentence contains the literal stdout value that needs inline code formatting; wrap stdout in backticks (change "stdout" to "`stdout`") so the line reads: Send a single prompt to the agent running inside a sandbox and stream the response to `stdout` to comply with the inline code formatting rule for CLI-related literals.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@docs/reference/commands-nemohermes.mdx`:
- Line 437: The docs sentence contains the literal stdout value that needs
inline code formatting; wrap stdout in backticks (change "stdout" to "`stdout`")
so the line reads: Send a single prompt to the agent running inside a sandbox
and stream the response to `stdout` to comply with the inline code formatting
rule for CLI-related literals.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: cf41063f-e660-4f16-93b6-62dffacffc4c
📒 Files selected for processing (7)
docs/reference/commands-nemohermes.mdxdocs/reference/commands.mdxsrc/commands/sandbox/prompt.test.tssrc/commands/sandbox/prompt.tssrc/lib/actions/sandbox/prompt.test.tssrc/lib/actions/sandbox/prompt.tssrc/lib/cli/public-display-defaults.ts
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27475579458
|
…ough Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
laitingsheng
changed the title
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (4)
docs/reference/commands.mdx (3)
550-550: 💤 Low valuePassive voice violation.
"The exit code is the remote command's exit code" uses passive voice. As per coding guidelines, use active voice.
Consider: "The command inherits the remote command's exit code" or "The remote command's exit code becomes the wrapper's exit code".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/commands.mdx` at line 550, Replace the passive sentence "The exit code is the remote command's exit code" with an active-voice phrasing; for example, change it to "The command inherits the remote command's exit code" or "The remote command's exit code becomes the wrapper's exit code" so the statement uses active voice and matches style guidelines.Source: Coding guidelines
536-536: 💤 Low valuePassive voice violation.
"The command is a thin pass-through to..." uses passive voice. As per coding guidelines, use active voice.
Consider: "The command passes through to
openclaw agent ...inside the sandbox" or "This command forwards arguments toopenclaw agent ...".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/commands.mdx` at line 536, The sentence uses passive voice ("The command is a thin pass-through to `openclaw agent ...`"); rewrite it in active voice — e.g. "This command forwards arguments to `openclaw agent ...` inside the sandbox via `openshell sandbox exec`, with `HOME=/sandbox` so the addressed agent profile resolves the same way as `connect`" — and replace the original line in docs/reference/commands.mdx accordingly.Source: Coding guidelines
557-557: 💤 Low valuePassive voice violation.
"
agentis currently supported only on OpenClaw sandboxes" uses passive voice. As per coding guidelines, use active voice.Consider: "OpenClaw sandboxes support the
agentcommand; Hermes sandboxes do not" or "NemoClaw supportsagentonly on OpenClaw sandboxes".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/commands.mdx` at line 557, The sentence uses passive voice; replace it with an active-voice sentence that clearly states who supports the feature. For example, change "`agent` is currently supported only on OpenClaw sandboxes. Hermes already exposes an OpenAI-compatible HTTP API on port `8642` inside the sandbox, so non-interactive use does not need a wrapper command." to an active form such as "OpenClaw sandboxes support the `agent` command; Hermes sandboxes do not — Hermes already exposes an OpenAI-compatible HTTP API on port `8642` inside the sandbox, so non-interactive use does not need a wrapper command." Make the change to the sentence containing `agent`, `OpenClaw`, `Hermes`, and `8642` to ensure active voice and the same factual content.Source: Coding guidelines
src/lib/actions/sandbox/agent/passthrough.ts (1)
44-45: 💤 Low valueConsider clarifying "agent" in the error message.
Line 45 says "agent is currently supported only on OpenClaw sandboxes" which could be ambiguous since Hermes is also an agent type. Consider "the
agentcommand is currently supported" or "sandbox agentis currently supported" to make it clear you're referring to the CLI subcommand, not the agent type.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/actions/sandbox/agent/passthrough.ts` around lines 44 - 45, The error string written by proc.stderr.write is ambiguous about "agent" — update the message in passthrough.ts where proc.stderr.write is called so it explicitly names the CLI subcommand (e.g., "the 'sandbox agent' command is currently supported only on OpenClaw sandboxes") rather than the generic word "agent"; adjust the quoted example (got '${agent}') if needed to preserve the variable but keep the clarified prefix so users know you mean the CLI subcommand.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/cli/public-display-defaults.ts`:
- Around line 253-259: The public-display entry for "sandbox:agent" duplicates
the display order 4.6 used by "sandbox:download", causing unpredictable
ordering; update the order value for "sandbox:agent" (the object with group
"Sandbox Management" and flags "[openclaw-agent-flags...]") to a unique number
such as 4.55 to place it between "sandbox:exec" (4.5) and "sandbox:download"
(4.6) (or 4.65 if you prefer it after download), ensuring no other entries share
that order.
---
Nitpick comments:
In `@docs/reference/commands.mdx`:
- Line 550: Replace the passive sentence "The exit code is the remote command's
exit code" with an active-voice phrasing; for example, change it to "The command
inherits the remote command's exit code" or "The remote command's exit code
becomes the wrapper's exit code" so the statement uses active voice and matches
style guidelines.
- Line 536: The sentence uses passive voice ("The command is a thin pass-through
to `openclaw agent ...`"); rewrite it in active voice — e.g. "This command
forwards arguments to `openclaw agent ...` inside the sandbox via `openshell
sandbox exec`, with `HOME=/sandbox` so the addressed agent profile resolves the
same way as `connect`" — and replace the original line in
docs/reference/commands.mdx accordingly.
- Line 557: The sentence uses passive voice; replace it with an active-voice
sentence that clearly states who supports the feature. For example, change
"`agent` is currently supported only on OpenClaw sandboxes. Hermes already
exposes an OpenAI-compatible HTTP API on port `8642` inside the sandbox, so
non-interactive use does not need a wrapper command." to an active form such as
"OpenClaw sandboxes support the `agent` command; Hermes sandboxes do not —
Hermes already exposes an OpenAI-compatible HTTP API on port `8642` inside the
sandbox, so non-interactive use does not need a wrapper command." Make the
change to the sentence containing `agent`, `OpenClaw`, `Hermes`, and `8642` to
ensure active voice and the same factual content.
In `@src/lib/actions/sandbox/agent/passthrough.ts`:
- Around line 44-45: The error string written by proc.stderr.write is ambiguous
about "agent" — update the message in passthrough.ts where proc.stderr.write is
called so it explicitly names the CLI subcommand (e.g., "the 'sandbox agent'
command is currently supported only on OpenClaw sandboxes") rather than the
generic word "agent"; adjust the quoted example (got '${agent}') if needed to
preserve the variable but keep the clarified prefix so users know you mean the
CLI subcommand.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 654c9e4f-34c6-4db4-b952-7fca8cb0f9c1
📒 Files selected for processing (9)
docs/reference/commands-nemohermes.mdxdocs/reference/commands.mdxsrc/commands/sandbox/agent.test.tssrc/commands/sandbox/agent.tssrc/lib/actions/sandbox/agent/passthrough-help.test.tssrc/lib/actions/sandbox/agent/passthrough-help.tssrc/lib/actions/sandbox/agent/passthrough.test.tssrc/lib/actions/sandbox/agent/passthrough.tssrc/lib/cli/public-display-defaults.ts
✅ Files skipped from review due to trivial changes (2)
- src/lib/actions/sandbox/agent/passthrough-help.test.ts
- docs/reference/commands-nemohermes.mdx
…or agent passthrough Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
…law reject Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
cv
approved these changes
Jun 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
nemoclaw <name> agentsubcommand that runs one OpenClaw agent turn non-interactively inside a sandbox by passing through toopenclaw agent ...over the existingopenshell sandbox exectransport. Mirrors the shape of the already-shippednemoclaw <name> sessionsandnemoclaw <name> agentspassthroughs so the upstream OpenClaw CLI flag surface stays the single source of truth.Related Issue
Resolves #2643
Changes
src/commands/sandbox/agent.tsoclif command;strict = falseso all OpenClaw flags pass through verbatim.src/lib/actions/sandbox/agent/passthrough.tsaction that reads the local sandbox registry, rejects Hermes with a redirect to the OpenAI-compatible API on port8642inside the sandbox, fails closed on registry-read errors, callsensureLiveSandboxOrExit, then forwards["openclaw", "agent", ...extraArgs]throughexecSandboxwithtty: falseso the wrapper never silently allocates a PTY.passthrough-help.tsso unit tests can import the pure helpers without pulling the runtime side of the chain.passthrough.tsdocumenting invalid state, source boundary, source-fix constraint, regression-test coverage, and the removal condition for the registry-read fallback.sandbox:agentpublic-display entry registered with order4.55(betweensandbox:execat4.5andsandbox:downloadat4.6).docs/reference/commands.mdxwith per-agent<AgentOnly>blocks;commands-nemohermes.mdxregenerated viadocs:sync-agent-variants.--no-ttyenforced), a clean registry miss falling back to OpenClaw, registry-read error failing closed without spawning OpenShell, and the empty-extra-args case.command-registry.test.tscounts for the addedsandbox:agententry (sandboxCommands47 → 48,sandboxActionTokens28 → 29) and added"agent"to the expected token set.Type of Change
Verification
npx prek run --all-filespassesnpm testpassesnpm run docsbuilds without warnings (doc changes only)Signed-off-by: Tinson Lai tinsonl@nvidia.com
Summary by CodeRabbit
sandbox:agentcommand to run a single non-interactiveopenclaw agentturn inside OpenClaw sandboxes, streaming output and forwarding flags verbatim.sandbox:agentunder Sandbox Management.8642using the OpenAI-compatible streaming endpoint.