perf(onboard): build sandbox image with BuildKit + no-silent-progress heartbeats (#6002)

src/lib/onboard.ts

@@ -40,6 +40,7 @@ const {
 const { stopStaleDashboardListenersForSandbox } = require("./onboard/stale-gateway-cleanup");
 const extraPlaceholderKeysModule: typeof import("./onboard/extra-placeholder-keys") = require("./onboard/extra-placeholder-keys");
 const buildContextStage: typeof import("./onboard/build-context-stage") = require("./onboard/build-context-stage");
+const sandboxPrebuild: typeof import("./onboard/sandbox-prebuild") = require("./onboard/sandbox-prebuild");
 const sandboxBuildPatchConfig: typeof import("./onboard/sandbox-build-patch-config") = require("./onboard/sandbox-build-patch-config");
 const sandboxDockerfilePatchFlow: typeof import("./onboard/sandbox-dockerfile-patch-flow") = require("./onboard/sandbox-dockerfile-patch-flow");
 const sandboxMessagingPreflight: typeof import("./onboard/sandbox-messaging-preflight") = require("./onboard/sandbox-messaging-preflight");
@@ -3020,11 +3021,19 @@ async function createSandbox(
     warn: console.warn,
   });
   const sandboxReadyTimeoutSecs = getSandboxReadyTimeoutSecs(effectiveSandboxGpuConfig);
+  // Pre-build the image locally with BuildKit so openshell skips its slower
+  // classic build; falls back to the openshell build if ineligible/fails (#6002).
+  const { createArgs: launchCreateArgs } = await sandboxPrebuild.prebuildSandboxImageIfEligible({
+    buildCtx,
+    createArgs,
+    sandboxName,
+    dockerDriverGateway: isLinuxDockerDriverGatewayEnabled(),
+  });
   const { createCommand, effectiveDashboardPort, sandboxEnv, sandboxStartupCommand } =
     sandboxCreateLaunch.prepareSandboxCreateLaunch({
       agent,
       chatUiUrl,
-      createArgs,
+      createArgs: launchCreateArgs,
       env: process.env,
       extraPlaceholderKeys,
       getDashboardForwardPort,
@@ -3068,27 +3077,14 @@ async function createSandbox(
   dockerGpuCreatePatch.exitOnPatchError();
 
   if (createResult.status !== 0) {
-    const failure = classifySandboxCreateFailure(createResult.output);
-    if (failure.kind === "sandbox_create_incomplete") {
-      // The sandbox was created in the gateway but the create stream exited
-      // with a non-zero code (e.g. SSH 255).  Fall through to the ready-wait
-      // loop — the sandbox may still reach Ready on its own.
-      console.warn("");
-      console.warn(
-        `  Create stream exited with code ${createResult.status} after sandbox was created.`,
-      );
-      console.warn("  Checking whether the sandbox reaches Ready state...");
-    } else {
-      console.error("");
-      console.error(`  Sandbox creation failed (exit ${createResult.status}).`);
-      if (createResult.output) {
-        console.error("");
-        console.error(createResult.output);
-      }
-      console.error("  Try:  openshell sandbox list        # check gateway state");
-      printSandboxCreateRecoveryHints(createResult.output, { createArgs });
-      process.exit(createResult.status || 1);
-    }
+    sandboxCreateFailureDiagnostics.handleSandboxCreateResultFailure(createResult, {
+      classifyFailure: classifySandboxCreateFailure,
+      printRecoveryHints: printSandboxCreateRecoveryHints,
+      // Recovery hints must reflect the args actually used to create (which the
+      // BuildKit prebuild may have rewritten to `--from <image-ref>`).
+      createArgs: launchCreateArgs,
+      exit: (code) => process.exit(code),
+    });
   }
 
   dockerGpuCreatePatch.ensureApplied();
@@ -4655,6 +4651,10 @@ function skippedStepMessage(
 async function onboard(opts: OnboardOptions = {}): Promise<void> {
   setOnboardBrandingAgent(opts.agent || process.env.NEMOCLAW_AGENT || null);
   NON_INTERACTIVE = opts.nonInteractive || process.env.NEMOCLAW_NON_INTERACTIVE === "1";
+  // Propagate the --non-interactive flag to the env so env-based consumers
+  // (phase-progress heartbeats, sandbox-create-plan, policy presets, …) honor
+  // the flag, not just the env var (#6002 review).
+  if (NON_INTERACTIVE) process.env.NEMOCLAW_NON_INTERACTIVE = "1";
   RECREATE_SANDBOX = opts.recreateSandbox || process.env.NEMOCLAW_RECREATE_SANDBOX === "1";
   AUTO_YES = opts.autoYes === true || process.env.NEMOCLAW_YES === "1";
   _preflightDashboardPort =

src/lib/onboard/machine/flow-slices.test.ts

@@ -1,7 +1,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { describe, expect, it } from "vitest";
+import { beforeEach, describe, expect, it } from "vitest";
 
 import {
   createSession,
@@ -11,6 +11,7 @@ import {
   type Session,
   type SessionUpdates,
 } from "../../state/onboard-session";
+import { getPhaseTimings, recordPhaseTiming, resetPhaseTimings } from "../phase-timings";
 import type { OnboardFlowContext } from "./flow-context";
 import {
   coreOnboardFlowPhases,
@@ -269,3 +270,74 @@ describe("onboard flow slices", () => {
     });
   });
 });
+
+describe("onboard flow slices phase-timing summary (#6002)", () => {
+  beforeEach(() => {
+    resetPhaseTimings();
+  });
+
+  it("emits the accumulated timing summary and clears the registry after the final slice", async () => {
+    // Timings recorded by earlier slices are still in the shared registry.
+    recordPhaseTiming({
+      phase: "sandbox",
+      label: "Sandbox creation",
+      durationMs: 250_000,
+      status: "completed",
+    });
+    const summaries: string[] = [];
+
+    await runFinalOnboardFlowSequence({
+      context: context(),
+      runtime: runtime(
+        createSession({
+          machine: {
+            version: MACHINE_SNAPSHOT_VERSION,
+            state: "finalizing",
+            stateEnteredAt: "2026-05-29T00:00:00.000Z",
+            revision: 0,
+          },
+        }),
+      ),
+      phases: [
+        phase("finalizing", "post_verify"),
+        {
+          state: "post_verify",
+          run: (ctx) => ({ context: ctx, result: completeOnboardMachine({}) }),
+        },
+      ],
+      emitSummary: (summary) => summaries.push(summary),
+    });
+
+    // Summary emitted once at the terminal seam (after finalizing AND
+    // post_verify complete), then the registry is cleared so nothing leaks into
+    // a later run in the same process.
+    expect(summaries).toHaveLength(1);
+    expect(summaries[0]).toContain("Sandbox creation");
+    expect(getPhaseTimings()).toHaveLength(0);
+  });
+
+  it("resets stale timings at the start of a new onboard run", async () => {
+    // A prior run that failed before finalization can leave timings behind.
+    recordPhaseTiming({
+      phase: "gateway",
+      label: "Gateway startup",
+      durationMs: 4_000,
+      status: "completed",
+    });
+    expect(getPhaseTimings()).toHaveLength(1);
+
+    await runInitialOnboardFlowSequence({
+      context: context(),
+      runtime: runtime(),
+      phases: [
+        phase("preflight", "gateway"),
+        phase("gateway", "provider_selection"),
+        phase("provider_selection", "inference"),
+      ],
+    });
+
+    // The start-of-run reset cleared the stale entry; the fresh run records
+    // nothing here (the reporter is inert under Vitest), so the registry is empty.
+    expect(getPhaseTimings()).toHaveLength(0);
+  });
+});

src/lib/onboard/machine/flow-slices.ts

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import { formatPhaseTimingsSummary, resetPhaseTimings } from "../phase-timings";
 import type { OnboardFlowContext } from "./flow-context";
 import { onboardFlowPhaseResult } from "./flow-context";
 import { advanceTo } from "./result";
@@ -41,6 +42,10 @@ export async function runInitialOnboardFlowSequence<Context extends OnboardFlowC
   runtime: OnboardMachineRunnerRuntime;
   phases: readonly OnboardSequencePhase<Context>[];
 }) {
+  // Clear any per-phase timings left over from an earlier onboard run in the
+  // same process (e.g. a prior run that failed before finalization reset the
+  // registry) so this run's timing summary only reflects this run (#6002).
+  resetPhaseTimings();
   return runOnboardSequenceWithRunner({
     ...options,
     phases: initialOnboardFlowPhases(options.phases),
@@ -64,9 +69,22 @@ export async function runFinalOnboardFlowSequence<Context extends OnboardFlowCon
   context: Context;
   runtime: OnboardMachineRunnerRuntime;
   phases: readonly OnboardSequencePhase<Context>[];
+  emitSummary?: (summary: string) => void;
 }) {
-  return runOnboardSequenceWithRunner({
-    ...options,
+  const { emitSummary = (line: string) => console.log(line), ...runnerOptions } = options;
+  const result = await runOnboardSequenceWithRunner({
+    ...runnerOptions,
     phases: finalOnboardFlowPhases(options.phases),
   });
+  // Emit the accumulated per-phase timing summary from the terminal seam —
+  // after every wrapped phase in the final slice (finalization, and any
+  // post_verify) has recorded — then clear the registry. This is the true
+  // "all phases complete" boundary, so the summary can't miss the last phase
+  // or leave a stray entry behind, regardless of which phase runs last (#6002).
+  const summary = formatPhaseTimingsSummary();
+  if (summary) {
+    emitSummary(summary);
+    resetPhaseTimings();
+  }
+  return result;
 }

src/lib/onboard/machine/live-flow-slice.ts

@@ -99,6 +99,13 @@ export async function runLiveOnboardFlowSlice<Context>({
   assertUniquePhases(phases);
   let nextContext = context;
   for (const phase of phases) {
+    // This resume-repair compatibility branch runs the raw phases directly and
+    // is intentionally NOT wrapped by the phase-progress reporter: heartbeats
+    // and per-phase timing are scoped to fresh onboarding (the reporter runs on
+    // the strict runOnboardSequenceWithRunner path). Because this branch never
+    // records timings, and the registry is per-process and cleared at the start
+    // of each fresh run, a resume can neither surface a partial "Phase timings"
+    // summary nor leak stale timing state into a later run (#6002 review PRA-7).
     const phaseResult = await phase.run(nextContext);
     for (const result of asResultArray(phaseResult.result, phase.state)) {
       await applyCompatibleResult(result);