fix(sandbox): name the sandbox in in-sandbox host-side hints - #7802
Closed
yanyunl1991 wants to merge 3 commits into
Closed
fix(sandbox): name the sandbox in in-sandbox host-side hints#7802yanyunl1991 wants to merge 3 commits into
yanyunl1991 wants to merge 3 commits into
Conversation
The in-sandbox hints that print a copyable host-side `nemoclaw <name> …` command resolved the sandbox name from OPENSHELL_SANDBOX at render time. OpenShell records the name on the container but exports the variable as the boolean "1" to every process it spawns inside the sandbox — the entrypoint and the `connect` shell included — keeping the real value only in its own root-owned PID 1 environment, which the unprivileged entrypoint cannot read. The name was therefore unavailable in-sandbox and both hints always rendered the literal `<name>` placeholder, so the copyable command could not be used or scripted. Inject the host's already-validated sandbox name as NEMOCLAW_SANDBOX_NAME for every sandbox at create time — it was previously injected for the deepagents image only — and have the entrypoint bake it into the generated connect-shell env for the renderer to fall back to. OPENSHELL_SANDBOX is still preferred when it carries a usable name, so the documented OpenShell >= 0.0.44 contract is unchanged. The baked value is allowlisted at both the bake and the render site, so only an RFC-1123 sandbox name can reach the command, and the operation/channel token allowlists are untouched. This also repairs the policy-denial logs breadcrumb, which shares the same renderer and was equally affected in connect shells. Fixes #7795 Signed-off-by: Yanyun Liao <yanyunl@nvidia.com>
Contributor
📝 WalkthroughWalkthroughSandbox names are injected for all sandbox agents, safely baked into connect-shell environment output, and used by policy-denial hints with runtime-name precedence and validated fallbacks. Regression tests cover propagation, precedence, invalid input, command-injection protection, and validator consistency. ChangesSandbox label flow
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant SandboxRuntime
participant write_runtime_shell_env
participant ConnectShell
participant PolicyHint
SandboxRuntime->>write_runtime_shell_env: Provide NEMOCLAW_SANDBOX_NAME
write_runtime_shell_env->>ConnectShell: Write validated _NEMOCLAW_SANDBOX_LABEL
ConnectShell->>PolicyHint: Render denial hint
PolicyHint->>PolicyHint: Prefer valid OPENSHELL_SANDBOX, then baked label
PolicyHint-->>ConnectShell: Return concrete sandbox label or <name>
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 04b962a in the TypeScript / code-coverage/cliThe overall coverage in commit 04b962a in the Show a code coverage summary of the most impacted files.
Updated |
Contributor
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 1 optional E2E recommendation
This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/repro-7795-connect-shell-sandbox-label.test.ts`:
- Around line 83-88: Replace the conditional assignment to
env.NEMOCLAW_SANDBOX_NAME in the test setup with a spread-based expression that
only adds the property when injectedName is defined, preserving the current
environment behavior without introducing an IfStatement. Verify the
growth-guardrails check counts IfStatement nodes so the rewrite remains
compliant.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: dcffa63d-95c2-4c89-99ab-e108ba91678d
📒 Files selected for processing (4)
scripts/nemoclaw-start.shsrc/lib/onboard/sandbox-create-launch.test.tssrc/lib/onboard/sandbox-create-launch.tstest/repro-7795-connect-shell-sandbox-label.test.ts
The codebase-growth-guardrails job requires changed test files not to add if statements. Build the generator environment with a spread instead, which keeps the "host injected no name" case explicit without branching. Signed-off-by: Yanyun Liao <yanyunl@nvidia.com>
wscurran
added
area: cli
prekshivyas
requested changes
Jul 29, 2026
prekshivyas
left a comment
prekshivyas
left a comment
Collaborator
There was a problem hiding this comment.
Blocking findings on exact head fbcdd5d:
-
The new behavioral test is not portable to macOS Bash 3.2. Running npx vitest run --project cli --project integration src/lib/onboard/sandbox-create-launch.test.ts test/repro-7795-connect-shell-sandbox-label.test.ts yields 25/25 failures in the new test. Bash 3.2 misparses the case pattern inside the command substitution added in write_runtime_shell_env (syntax error at the boolean pattern). Please move that validation case into a helper function and command-substitute the helper, or otherwise keep the real generator testable under the repository contributor environment.
-
The maintainer gate reports both commits (0608c3f and fbcdd5d) as GitHub unverified/unsigned. The PR cannot be approved until its commit history satisfies the repository Verified-commit requirement.
The security design itself looks sound: the host name is already validated, the generated label is allowlisted again, invalid/absent values are explicitly unset, and hostile operation/channel inputs remain placeholders.
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-7802.docs.buildwithfern.com/nemoclaw |
prekshivyas
requested changes
Jul 29, 2026
prekshivyas
left a comment
prekshivyas
left a comment
Collaborator
There was a problem hiding this comment.
Re-review of exact head 04b962a217c3fd269afcc6766ff6a8757956a970.
Resolved and verified:
- The Bash 3.2 portability blocker is fixed. The focused regression command passes 39/39 tests on GNU Bash 3.2.57.
- The runtime sandbox name remains allowlisted before it reaches a copyable command, the baked fallback is revalidated after the sandbox can mutate it, and the invalid-input path explicitly unsets stale state.
- Documentation Writer Review is current for this head, and both PR Review Advisor lanes report zero findings.
Security review: PASS for secrets, input validation, authentication/authorization, dependencies, error handling/logging, cryptography/data protection, configuration, security testing, and system security. No security findings.
Blocking approval:
0608c3f78e01550bf4badcc537686e479c35f0c5is GitHub unverified (unsigned).fbcdd5d202e1216592260d96a84da489369c1baais GitHub unverified (unsigned).04b962a217c3fd269afcc6766ff6a8757956a970is verified.
Repository policy requires every commit in a contributor-owned PR to appear Verified. Please replace the two unsigned commits with signed, GitHub-verified history. Because that changes the head SHA, refresh the Documentation Writer Review receipt afterward. If the published branch cannot be safely rewritten, use a fresh compliant branch and PR.
At review time there are no failing CI checks; seven CLI shards, the E2E PR gate and coordination, and the JavaScript/TypeScript code-scanning check are still running. Approval remains blocked by commit verification regardless of those results.
23 tasks
Contributor
Author
|
Superseded by #7870 — closing this one. @prekshivyas, following your re-review of
Your Bash 3.2 fix is cherry-picked with your authorship preserved rather than squashed away, The cherry-pick onto current Thanks for pushing the portability fix and for the detailed security pass. |
prekshivyas
added a commit
that referenced
this pull request
Aug 1, 2026
> **Supersedes #7802.** That branch could not be rewritten in place (the `No force push` > ruleset covers every ref except `main`), so this is a fresh branch carrying the same three > commits with GitHub-Verified history, rebased onto current `main`. > > @prekshivyas — your Bash 3.2 fix is cherry-picked here with your authorship intact > (`fix(sandbox): support Bash 3.2 label validation`), now signed so it clears the gate > alongside the other two. The focused command from your re-review still passes on this > head: `npx vitest run --project cli --project integration src/lib/onboard/sandbox-create-launch.test.ts test/repro-7795-connect-shell-sandbox-label.test.ts` -> 39/39. > No other content changed; `docs-review-receipt` re-runs automatically on the new head. <!-- markdownlint-disable MD041 --> ## Summary Inside a sandbox, every hint that prints a copyable host-side `nemoclaw <name> …` command rendered the literal `<name>` placeholder instead of the sandbox name, so the command could not be copied or scripted. Inject the host's validated sandbox name into every sandbox and resolve the hints from it. Closes #7795. ## Reproduction Executed on our DGX Spark aarch64 test host (GB10 GPU), against a sandbox freshly onboarded from `main` at `eeab81cc5`: 1. `node bin/nemoclaw.js onboard --name repro-7795 --non-interactive --yes` 2. `node bin/nemoclaw.js repro-7795 connect` (driven through a real PTY, not `exec`) 3. Inside the connect shell: `openclaw channels add discord` **Environment** - Test machine: our DGX Spark aarch64 test host (GB10 GPU), Ubuntu 24.04.4 LTS - Node.js v22.23.1, Docker 29.6.1, OpenShell CLI 0.0.85 - NemoClaw `main` @ `eeab81cc5542902538c97db63c132c0fdbd4341c` (`v0.0.96-45-geeab81cc5`) - Sandbox `repro-7795`, agent `openclaw`, provider `ollama-local` **Observed on `main` (before fix)** ```text See which rule denied a request: nemoclaw <name> logs --tail 50 MARKER_ENV=[1] Error: 'openclaw channels add' cannot modify channels inside the sandbox. Changes inside the sandbox do not persist across rebuilds. Run 'nemoclaw <name> channels add discord' on the host. ``` `MARKER_ENV` is `echo $OPENSHELL_SANDBOX` in the connect shell. **Observed on `fix/…` (after fix)** ```text NEMOCLAW_SANDBOX_NAME=repro-7795 # entrypoint process environment OPENSHELL_SANDBOX=1 export _NEMOCLAW_SANDBOX_LABEL='repro-7795' # baked into the connect-shell env See which rule denied a request: nemoclaw repro-7795 logs --tail 50 MARKER_ENV=[1] MARKER_LABEL=[repro-7795] Run 'nemoclaw repro-7795 channels add discord' on the host. Run 'nemoclaw repro-7795 channels remove slack' on the host. Run 'nemoclaw repro-7795 channels add <channel>' on the host. ``` The last line is `openclaw channels add "$(cat /etc/shadow)"`: the channel token still degrades to `<channel>` and no file content reaches the command, so the existing token allowlists are unaffected. ## Analysis `_nemoclaw_policy_denial_hint_label()` in `scripts/nemoclaw-start.sh` resolved the name from `OPENSHELL_SANDBOX`, documented there as carrying the sandbox name on OpenShell >= 0.0.44. That assumption does not hold for any process inside the sandbox. OpenShell records `OPENSHELL_SANDBOX=<name>` on the container, but the sandbox supervisor (PID 1) spawns sandbox processes with a rebuilt environment in which the variable is the boolean `1`. Measured on the test host: - container config / PID 1 environment: `OPENSHELL_SANDBOX=repro-7795` - `nemoclaw-start` entrypoint (runs as the unprivileged `sandbox` user): `OPENSHELL_SANDBOX=1`, and none of the other `OPENSHELL_*` values are present - interactive `connect` shell: `OPENSHELL_SANDBOX=1` The real value survives only in PID 1's environment, which is root-owned; the entrypoint runs as `sandbox` and gets `EACCES` on `/proc/1/environ`. The container hostname is the container ID, and no other in-container source carries the name. So the name was genuinely unavailable in-sandbox, and the allowlist correctly rejected `1`, falling back to the placeholder at every call site. This affected both consumers of the helper — the `openclaw channels add/remove` guard hint (`scripts/nemoclaw-start.sh:3774`, added in #7295) and the policy-denial logs breadcrumb (`scripts/nemoclaw-start.sh:3912`, added in #5978). Their unit tests pass only because they set `OPENSHELL_SANDBOX` to a name directly, which never happens in a real connect shell. The troubleshooting docs attributed real-name rendering to OpenShell 0.0.44 or newer. The reproduction on OpenShell 0.0.85 disproved that version distinction, so this PR updates both the implementation and the troubleshooting text. ## Fix `buildSandboxRuntimeEnvArgs()` already injected `NEMOCLAW_SANDBOX_NAME` into the sandbox startup command, but only for LangChain Deep Agents Code. Hoist that injection so every sandbox receives it. The value is the host's own `sandboxName`, already validated by `NAME_VALID_PATTERN` before a sandbox is created, and `NEMOCLAW_SANDBOX_NAME` is an existing documented NemoClaw variable with exactly this meaning — no new contract is introduced. `write_runtime_shell_env()` then bakes that name into the generated connect-shell env as `_NEMOCLAW_SANDBOX_LABEL`, and the renderer falls back to it when `OPENSHELL_SANDBOX` is unusable. Security properties: - The name is allowlisted at the bake site and again at the render site, against the same RFC-1123 pattern as before (`/^[a-z]([a-z0-9-]*[a-z0-9])?$/`, max 63), evaluated under `LC_ALL=C` in a subshell. Re-checking at render time matters because the sandbox can reassign the variable after the file is sourced. - The generator always emits either `export _NEMOCLAW_SANDBOX_LABEL='<name>'` or `unset _NEMOCLAW_SANDBOX_LABEL`, never nothing, so a value pre-set by the sandbox cannot survive into a copyable command when no valid name is available. - `OPENSHELL_SANDBOX` keeps priority when it carries a usable name, so a caller-provided valid runtime name overrides the generated fallback. - When no source yields a valid name the output is the previous `<name>` placeholder, so the failure mode is unchanged. Scope note: the remaining literal `nemoclaw <sandbox> …` strings in this file (the `channels login` guidance, the rebuild / `channels status` / `shields down` messages) are generic instructional text that does not echo a specific user invocation, matching the repo-wide documentation convention. #7295 deliberately replaced only the add/remove branch, so they are left as-is. Tests added: - `test/repro-7795-connect-shell-sandbox-label.test.ts` runs the real `write_runtime_shell_env` generator under the environment the entrypoint actually receives, then sources its output in a shell with `OPENSHELL_SANDBOX=1` — the connect-shell condition — and asserts the rendered hints. It covers both consumers, runtime-name precedence, boolean/empty/absent inputs, seven invalid inputs (including shell metacharacters, an ANSI escape with a newline, and command substitution), the 63-character limit, a sandbox-set label, a pre-set label that must be unset, and agreement with `NAME_VALID_PATTERN`. - `src/lib/onboard/sandbox-create-launch.test.ts` pins that every agent receives `NEMOCLAW_SANDBOX_NAME`, and that it is omitted when no name is known. Both would have failed before this change: the generator emitted no label, so the connect-shell assertions rendered `<name>`. ## Changes - `src/lib/onboard/sandbox-create-launch.ts`: inject `NEMOCLAW_SANDBOX_NAME` for every agent instead of LangChain Deep Agents Code only. - `scripts/nemoclaw-start.sh`: bake the validated name into the connect-shell env, and resolve the hint label from it when `OPENSHELL_SANDBOX` is unusable. - `src/lib/onboard/sandbox-create-launch.test.ts`: coverage for the injection. - `test/repro-7795-connect-shell-sandbox-label.test.ts`: end-to-end connect-shell regression coverage. - `docs/reference/troubleshooting.mdx`: describe the NemoClaw fallback without the incorrect OpenShell version distinction. - Review follow-up: keep the generator compatible with Bash 3.2 and state the fallback removal condition. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — the [maintainer review](#7802 (review)) found the security design sound. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: Updated `docs/reference/troubleshooting.mdx` to describe the NemoClaw-provided name without the incorrect OpenShell version distinction. - Agent: Codex Desktop <!-- docs-review-head-sha: 04b962a --> <!-- docs-review-agents-blob-sha: be20a09 --> ## Verification - [ ] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run --project cli --project integration src/lib/onboard/sandbox-create-launch.test.ts test/repro-7795-connect-shell-sandbox-label.test.ts` passes 39 tests on Bash 3.2.57. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — the docs build passes with 0 errors and 2 existing Fern warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verified end to end on aarch64. The reporter notes the issue is not believed platform-specific, and the mechanism is connect-shell environment behavior rather than architecture, but an x86_64 confirmation before merge would close that gap. ## AI Disclosure - [x] AI-assisted — tools: Claude Code and Codex Desktop Signed-off-by: Yanyun Liao <yanyunl@nvidia.com> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Bug Fixes** - Improved sandbox naming in policy-denial reminders and connect-shell guidance. - Displays the validated sandbox name when available, with a safe `<name>` fallback otherwise. - Ensures sandbox names are consistently propagated across supported agents. - Prevents invalid or unsafe sandbox names from appearing in generated command hints. - Runtime sandbox names now take priority when available. - **Documentation** - Updated troubleshooting guidance to explain sandbox-name display and the `nemoclaw list` fallback. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> --------- Signed-off-by: Yanyun Liao <yanyunl@nvidia.com> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Senthil Ravichandran <senthilr@nvidia.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Inside a sandbox, every hint that prints a copyable host-side
nemoclaw <name> …command rendered the literal<name>placeholder instead of the sandbox name, so the command could not be copied or scripted. Inject the host's validated sandbox name into every sandbox and resolve the hints from it.Closes #7795.
Reproduction
Executed on our DGX Spark aarch64 test host (GB10 GPU), against a sandbox freshly onboarded from
mainateeab81cc5:node bin/nemoclaw.js onboard --name repro-7795 --non-interactive --yesnode bin/nemoclaw.js repro-7795 connect(driven through a real PTY, notexec)openclaw channels add discordEnvironment
main@eeab81cc5542902538c97db63c132c0fdbd4341c(v0.0.96-45-geeab81cc5)repro-7795, agentopenclaw, providerollama-localObserved on
main(before fix)MARKER_ENVisecho $OPENSHELL_SANDBOXin the connect shell.Observed on
fix/…(after fix)The last line is
openclaw channels add "$(cat /etc/shadow)": the channel token still degrades to<channel>and no file content reaches the command, so the existing token allowlists are unaffected.Analysis
_nemoclaw_policy_denial_hint_label()inscripts/nemoclaw-start.shresolved the name fromOPENSHELL_SANDBOX, documented there as carrying the sandbox name on OpenShell >= 0.0.44.That assumption does not hold for any process inside the sandbox. OpenShell records
OPENSHELL_SANDBOX=<name>on the container, but the sandbox supervisor (PID 1) spawns sandbox processes with a rebuilt environment in which the variable is the boolean1. Measured on the test host:OPENSHELL_SANDBOX=repro-7795nemoclaw-startentrypoint (runs as the unprivilegedsandboxuser):OPENSHELL_SANDBOX=1, and none of the otherOPENSHELL_*values are presentconnectshell:OPENSHELL_SANDBOX=1The real value survives only in PID 1's environment, which is root-owned; the entrypoint runs as
sandboxand getsEACCESon/proc/1/environ. The container hostname is the container ID, and no other in-container source carries the name. So the name was genuinely unavailable in-sandbox, and the allowlist correctly rejected1, falling back to the placeholder at every call site.This affected both consumers of the helper — the
openclaw channels add/removeguard hint (scripts/nemoclaw-start.sh:3774, added in #7295) and the policy-denial logs breadcrumb (scripts/nemoclaw-start.sh:3912, added in #5978). Their unit tests pass only because they setOPENSHELL_SANDBOXto a name directly, which never happens in a real connect shell.The troubleshooting docs attributed real-name rendering to OpenShell 0.0.44 or newer. The reproduction on OpenShell 0.0.85 disproved that version distinction, so this PR updates both the implementation and the troubleshooting text.
Fix
buildSandboxRuntimeEnvArgs()already injectedNEMOCLAW_SANDBOX_NAMEinto the sandbox startup command, but only for LangChain Deep Agents Code. Hoist that injection so every sandbox receives it. The value is the host's ownsandboxName, already validated byNAME_VALID_PATTERNbefore a sandbox is created, andNEMOCLAW_SANDBOX_NAMEis an existing documented NemoClaw variable with exactly this meaning — no new contract is introduced.write_runtime_shell_env()then bakes that name into the generated connect-shell env as_NEMOCLAW_SANDBOX_LABEL, and the renderer falls back to it whenOPENSHELL_SANDBOXis unusable.Security properties:
/^[a-z]([a-z0-9-]*[a-z0-9])?$/, max 63), evaluated underLC_ALL=Cin a subshell. Re-checking at render time matters because the sandbox can reassign the variable after the file is sourced.export _NEMOCLAW_SANDBOX_LABEL='<name>'orunset _NEMOCLAW_SANDBOX_LABEL, never nothing, so a value pre-set by the sandbox cannot survive into a copyable command when no valid name is available.OPENSHELL_SANDBOXkeeps priority when it carries a usable name, so a caller-provided valid runtime name overrides the generated fallback.<name>placeholder, so the failure mode is unchanged.Scope note: the remaining literal
nemoclaw <sandbox> …strings in this file (thechannels loginguidance, the rebuild /channels status/shields downmessages) are generic instructional text that does not echo a specific user invocation, matching the repo-wide documentation convention. #7295 deliberately replaced only the add/remove branch, so they are left as-is.Tests added:
test/repro-7795-connect-shell-sandbox-label.test.tsruns the realwrite_runtime_shell_envgenerator under the environment the entrypoint actually receives, then sources its output in a shell withOPENSHELL_SANDBOX=1— the connect-shell condition — and asserts the rendered hints. It covers both consumers, runtime-name precedence, boolean/empty/absent inputs, seven invalid inputs (including shell metacharacters, an ANSI escape with a newline, and command substitution), the 63-character limit, a sandbox-set label, a pre-set label that must be unset, and agreement withNAME_VALID_PATTERN.src/lib/onboard/sandbox-create-launch.test.tspins that every agent receivesNEMOCLAW_SANDBOX_NAME, and that it is omitted when no name is known.Both would have failed before this change: the generator emitted no label, so the connect-shell assertions rendered
<name>.Changes
src/lib/onboard/sandbox-create-launch.ts: injectNEMOCLAW_SANDBOX_NAMEfor every agent instead of LangChain Deep Agents Code only.scripts/nemoclaw-start.sh: bake the validated name into the connect-shell env, and resolve the hint label from it whenOPENSHELL_SANDBOXis unusable.src/lib/onboard/sandbox-create-launch.test.ts: coverage for the injection.test/repro-7795-connect-shell-sandbox-label.test.ts: end-to-end connect-shell regression coverage.docs/reference/troubleshooting.mdx: describe the NemoClaw fallback without the incorrect OpenShell version distinction.Type of Change
Quality Gates
Documentation Writer Review
docs-updateddocs/reference/troubleshooting.mdxto describe the NemoClaw-provided name without the incorrect OpenShell version distinction.Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpx vitest run --project cli --project integration src/lib/onboard/sandbox-create-launch.test.ts test/repro-7795-connect-shell-sandbox-label.test.tspasses 39 tests on Bash 3.2.57.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm run docsbuilds without warnings (doc changes only) — the docs build passes with 0 errors and 2 existing Fern warnings.Verified end to end on aarch64. The reporter notes the issue is not believed platform-specific, and the mechanism is connect-shell environment behavior rather than architecture, but an x86_64 confirmation before merge would close that gap.
AI Disclosure
Signed-off-by: Yanyun Liao yanyunl@nvidia.com
Signed-off-by: Prekshi Vyas prekshiv@nvidia.com
Summary by CodeRabbit
NEMOCLAW_SANDBOX_NAMEconsistently across supported agents.