fix(rebuild): name the sandbox in the printed resume recovery command (#5801)

[Hokonoken]

Summary

When a rebuild's recreate step hits a transient fault after the old sandbox was deleted but before create recorded its name, the printed manual-recovery step 2 (nemoclaw onboard --resume) fails verbatim with no sandbox name was recorded. Re-run with --name, even though the next printed line asserts the command "will recreate sandbox ''". This carries --name <sandbox> on the resume retry form so the documented recovery runs as printed.

Related Issue

Addresses the residual-recovery gap discussed in #5801 (the non-atomic rebuild window from #2273 / #5787). This does not close #5801 — the atomic build-verify-swap it asks for still needs upstream work — it makes the existing preserved-backup mitigation actually followable.

Changes

• src/lib/actions/sandbox/rebuild-mcp-phase.ts: the no-MCP onboard --resume fallback in printMcpRebuildRetryCommand now emits --name <sandbox>. The MCP-bearing form already carried the name via the <name> rebuild subcommand; only this fallback dropped it.
• Tests updated/added in rebuild-mcp-phase.test.ts and the shared test/helpers/rebuild-flow-recovery-cases.ts to lock the sandbox name into the printed resume command.

No new abstraction, config, or fallback path — a one-argument fix to an existing printed command.

Type of Change

• Code change (feature, bug fix, or refactor)

Quality Gates

• Tests added or updated for changed behavior
• Docs not applicable — justification: no user-facing docs describe this internal recovery print; the change makes an existing printed command runnable.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: requesting maintainer review; change is limited to recovery-guidance text plus its tests, no lifecycle/side-effect behavior.

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable — npm run check:diff exit 0
• Targeted behavior tests pass for the current change set — npx vitest run src/lib/actions/sandbox/rebuild-mcp-phase.test.ts (9 passed) and every rebuild-flow / recovery-helper file consuming the shared assertion passes in isolation (rebuild-flow.test.ts plus the 8 rebuild-* files that use rebuild-flow-recovery-cases.ts). Note for honesty: running all of those files together under full parallel load intermittently trips pre-existing 5000 ms-timeout flakiness in unrelated DCode/provider tests (rebuild-dcode-*, rebuild-local-provider-recreate); those pass individually, live in files this change does not modify (it only edits a print function and its two test files), and fail with variable membership run-to-run — the signature of a load/timeout flake rather than a regression.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed

Reproduction / evidence

Verified by execution on main (3de1de6b1), docker driver, with a shim that fails only openshell sandbox create (a post-delete transient fault):

• Before: rebuild prints 2. Run: nemoclaw onboard --resume --tool-disclosure progressive; running it verbatim fails with Cannot resume non-interactive onboard: ... no sandbox name was recorded. Re-run with --name <sandbox>.
• After: the compiled printer emits nemoclaw onboard --resume --name rebuild-probe --tool-disclosure progressive; that exact command completed recovery live (sandbox returned Ready/healthy), followed by snapshot restore of the preserved backup (14 directories, 1 file).

---

Signed-off-by: Hokonoken 41166525+Hokonoken@users.noreply.github.com

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

The MCP rebuild retry command now passes the sandbox name to onboard --resume. Unit and recovery tests were updated to verify the new command format while preserving existing disclosure and observability options.

Changes

Sandbox rebuild retry

Layer / File(s)	Summary
Include sandbox name in resume retry command src/lib/actions/sandbox/rebuild-mcp-phase.ts, src/lib/actions/sandbox/rebuild-mcp-phase.test.ts, test/helpers/rebuild-flow-recovery-cases.ts	The printed resume command includes --name ${sandboxName}, and tests validate the sandbox name alongside existing retry options.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: bug-fix, area: sandbox

Suggested reviewers: ericksoa, cv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR only fixes the printed recovery command; it does not implement the atomic build-verify-swap health-before-delete flow requested in #5801.	Implement the atomic build-verify-swap flow requested in #5801, or relink the issue if this PR is only a mitigation.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The changes stay focused on the recovery command and its tests, with no unrelated code paths or broad refactors.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding the sandbox name to the printed resume recovery command.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: onboard-repair, onboard-resume, state-backup-restore, upgrade-stale-sandbox

1 optional E2E recommendation

• sandbox-rebuild

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[wscurran]

✨ Thanks for the fix, @Hokonoken. Adding the sandbox name to the recovery command makes the documented recovery path actually work. Ready for maintainer review.

---

Related open PRs:

• #5787 fix(rebuild): isolate ambient onboard env from sandbox recreate (#5735)

Related open issues:

• #5801 rebuild/upgrade: atomic build-verify-swap before deleting old sandbox (health-before-delete)
• #2273 [Ubuntu]nemoclaw rebuild is not atomic — sandbox destroyed before recreate step can fail, leaving user without a working sandbox (only backup remains)

---

Related open PRs:

• #5787 fix(rebuild): isolate ambient onboard env from sandbox recreate (#5735)

---

Related open issues:

• #5801 rebuild/upgrade: atomic build-verify-swap before deleting old sandbox (health-before-delete)
• #2273 [Ubuntu]nemoclaw rebuild is not atomic — sandbox destroyed before recreate step can fail, leaving user without a working sandbox (only backup remains)

[prekshivyas]

Reviewed exact head 91a1c72a1bc44c7227653227cc15b33195b7fed1.

No findings. The recovery command now carries the validated sandbox name into the incomplete-create resume path, where the session cannot supply it, and the added assertions cover the resulting command. The broader atomic-rebuild work in #5801 remains correctly out of scope.

Validation:

• GitHub CI, security scans, both PR Advisors, CodeRabbit, macOS E2E, and WSL E2E are green.
• The credentialed E2E gate is green via the protected fork-skip approval from @cv; credentialed targets did not execute. The PR includes live Linux recreate/resume/restore evidence.
• Local build:cli, typecheck:cli, check:diff, and 115 focused rebuild/onboard tests passed.

Approved as merge-ready.