fix(sandbox): preserve buffered rebuild diagnostics

src/lib/actions/sandbox/rebuild-custom-image-preflight.test.ts

@@ -159,6 +159,43 @@ describe("preflightRebuildImage", () => {
     }
   });
 
+  it("surfaces redacted Buffer diagnostics when the replacement image build fails (#7111)", async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-custom-preflight-diagnostic-"));
+    const dockerfile = path.join(dir, "Dockerfile.custom");
+    const credential = ["release", "diagnostic", "credential"].join("-");
+    fs.writeFileSync(dockerfile, "FROM scratch\n");
+    try {
+      const result = await preflightRebuildImage(input(dockerfile), {
+        prepareDockerfilePatch: vi.fn(async () => ({
+          buildId: "1",
+          dashboardRemoteBindPrepared: false,
+          resolvedBaseImage: null,
+        })),
+        buildImage: vi.fn(
+          () =>
+            ({
+              status: 1,
+              stderr: Buffer.from(
+                `failed to solve: build context unavailable at ${os.homedir()}/private-context\n` +
+                  `Authorization: Bearer ${credential}`,
+              ),
+            }) as never,
+        ),
+        removeImage: vi.fn(() => ({ status: 0 }) as never),
+      });
+
+      expect(result).toEqual({
+        ok: false,
+        detail:
+          "failed to solve: build context unavailable at ~/private-context\n" +
+          "Authorization: Bearer <REDACTED>",
+      });
+      expect(JSON.stringify(result)).not.toContain(credential);
+    } finally {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   it("builds and removes the exact staged custom context on success", async () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-custom-preflight-"));
     const dockerfile = path.join(dir, "Dockerfile.custom");

src/lib/actions/sandbox/rebuild-custom-image-preflight.ts

@@ -12,7 +12,11 @@ import { stageCreateSandboxBuildContext } from "../../onboard/build-context-stag
 import { prepareSandboxDockerfilePatch } from "../../onboard/sandbox-dockerfile-patch-flow";
 import type { SandboxGpuConfig } from "../../onboard/sandbox-gpu-mode";
 import { ROOT } from "../../runner";
-import { OPENCLAW_SANDBOX_BASE_IMAGE, SANDBOX_BASE_TAG } from "../../sandbox-base-image";
+import {
+  formatBuildFailureDiagnostics,
+  OPENCLAW_SANDBOX_BASE_IMAGE,
+  SANDBOX_BASE_TAG,
+} from "../../sandbox-base-image";
 import type { ToolDisclosure } from "../../tool-disclosure";
 import {
   createBuildContextVerifier,
@@ -53,11 +57,15 @@ export type RebuildImagePreflightResult =
   | { ok: true; imageTag: string; prepared: PreparedRebuildImage }
   | { ok: false; detail: string };
 
-function resultDetail(result: { stderr?: unknown; stdout?: unknown; status?: unknown }): string {
+function resultDetail(result: {
+  error?: unknown;
+  stderr?: unknown;
+  stdout?: unknown;
+  status?: unknown;
+}): string {
   return (
-    [result.stderr, result.stdout]
-      .filter((value): value is string => typeof value === "string" && value.trim().length > 0)
-      .join("; ") || `docker build exited with status ${String(result.status ?? "unknown")}`
+    formatBuildFailureDiagnostics(result) ||
+    `docker build exited with status ${String(result.status ?? "unknown")}`
   );
 }