fix(sandbox): preserve buffered rebuild diagnostics

[apurvvkumaria]

Summary

Replacement-image rebuild preflight currently drops Docker diagnostics when the process result contains Buffer streams and falls back to a generic exit-status message. This change reuses the existing hardened build-diagnostic formatter so release validation gets actionable, redacted output needed to identify the affected-host failure tracked in #7111; it does not claim to fix that still-unknown host-specific build root cause.

Related Issue

Refs #7111. Builds on the diagnostic hardening from #6623.

Changes

• Route rebuild preflight process errors, stderr, and stdout through formatBuildFailureDiagnostics.
• Preserve credential redaction, home/temp path normalization, terminal-control stripping, and the existing 8 KB diagnostic bound.
• Add a regression covering Buffer stderr with a credential and private host path.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: this corrects an internal formatting path for an existing failure flow without changing commands, flags, defaults, configuration, workflows, or documented support boundaries; the canonical troubleshooting docs already cover failed rebuilds.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: apurvvkumaria reviewed the exact two-file diff. It adds no process execution, filesystem, network, authorization, or policy behavior; the reused formatter applies both credential-redaction layers, strips control characters, normalizes host paths, and caps output at 8 KB.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project cli src/lib/actions/sandbox/rebuild-custom-image-preflight.test.ts src/lib/sandbox-base-image.test.ts (17 passed)
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — not applicable to this narrow two-file diagnostic-path correction.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved custom image rebuild failure messages with clearer build diagnostics.
  • Sensitive authorization tokens embedded in build error output are now automatically redacted.
  • Prevented credentials from appearing in serialized preflight results.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/7111-buffered-... branch remains at 80%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main e7e8b67	codex/7111-buffered-... 55fd633	+/-
src/lib/actions...ge-preflight.ts	91%	90%	-1%
src/lib/agent/s...store-reader.ts	90%	90%	0%
src/lib/onboard...ndbox-create.ts	91%	91%	0%
src/lib/onboard...ndbox-create.ts	100%	100%	0%
src/lib/sandbox-base-image.ts	93%	93%	0%
src/lib/sandbox...rce-identity.ts	91%	91%	0%
src/lib/onboard...-desktop-gpu.ts	83%	89%	+6%

---

_{Updated July 17, 2026 19:42 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 60442c2d-fd4f-4515-aaed-57aafd754d18

📥 Commits

Reviewing files that changed from the base of the PR and between b37e142 and 1cd4bbb.

📒 Files selected for processing (2)

• src/lib/actions/sandbox/rebuild-custom-image-preflight.test.ts
• src/lib/actions/sandbox/rebuild-custom-image-preflight.ts

---

📝 Walkthrough

Walkthrough

Changes

Sandbox preflight diagnostics

Layer / File(s)	Summary
Diagnostic formatting and validation src/lib/actions/sandbox/rebuild-custom-image-preflight.ts, src/lib/actions/sandbox/rebuild-custom-image-preflight.test.ts	Preflight failure details now use formatBuildFailureDiagnostics, with status fallback preserved. Tests verify bearer-token redaction for buffered stderr and absence of the credential from serialized results.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: chengjiew, ericksoa

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: preserving sandbox rebuild diagnostics for buffered process output.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/7111-buffered-build-diagnostics

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / medium confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

Since last review: 0 prior items resolved · 0 still apply · 0 new items found

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: onboard-repair, onboard-resume, state-backup-restore, upgrade-stale-sandbox

2 optional E2E recommendations

• sandbox-rebuild
• rebuild-openclaw

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[jyaunches]

Approved at exact head 55fd633 against base e7e8b67. The two-file change safely reuses the existing bounded diagnostic formatter, preserves credential/path/control-sequence redaction, and adds a focused Buffer regression. Required CI and all four risk-selected live E2E jobs are green; contributor compliance and the security review are clean, and no unresolved automated-review findings remain. This approval covers the diagnostic-enablement change only; #7111 remains open for root-cause repair and end-to-end readiness validation.