fix(sandbox): name the sandbox in in-sandbox host-side hints by yanyunl1991 · Pull Request #7870 · NVIDIA/NemoClaw

yanyunl1991 · 2026-07-30T02:50:43Z

Supersedes #7802. That branch could not be rewritten in place (the No force push
ruleset covers every ref except main), so this is a fresh branch carrying the same three
commits with GitHub-Verified history, rebased onto current main.

@prekshivyas — your Bash 3.2 fix is cherry-picked here with your authorship intact
(fix(sandbox): support Bash 3.2 label validation), now signed so it clears the gate
alongside the other two. The focused command from your re-review still passes on this
head: npx vitest run --project cli --project integration src/lib/onboard/sandbox-create-launch.test.ts test/repro-7795-connect-shell-sandbox-label.test.ts -> 39/39.
No other content changed; docs-review-receipt re-runs automatically on the new head.

Summary

Inside a sandbox, every hint that prints a copyable host-side nemoclaw <name> … command rendered the literal <name> placeholder instead of the sandbox name, so the command could not be copied or scripted. Inject the host's validated sandbox name into every sandbox and resolve the hints from it.

Closes #7795.

Reproduction

Executed on our DGX Spark aarch64 test host (GB10 GPU), against a sandbox freshly onboarded from main at eeab81cc5:

node bin/nemoclaw.js onboard --name repro-7795 --non-interactive --yes
node bin/nemoclaw.js repro-7795 connect (driven through a real PTY, not exec)
Inside the connect shell: openclaw channels add discord

Environment

Test machine: our DGX Spark aarch64 test host (GB10 GPU), Ubuntu 24.04.4 LTS
Node.js v22.23.1, Docker 29.6.1, OpenShell CLI 0.0.85
NemoClaw main @ eeab81cc5542902538c97db63c132c0fdbd4341c (v0.0.96-45-geeab81cc5)
Sandbox repro-7795, agent openclaw, provider ollama-local

Observed on main (before fix)

  See which rule denied a request:  nemoclaw <name> logs --tail 50
MARKER_ENV=[1]
Error: 'openclaw channels add' cannot modify channels inside the sandbox.
Changes inside the sandbox do not persist across rebuilds.
Run 'nemoclaw <name> channels add discord' on the host.

MARKER_ENV is echo $OPENSHELL_SANDBOX in the connect shell.

Observed on fix/… (after fix)

NEMOCLAW_SANDBOX_NAME=repro-7795      # entrypoint process environment
OPENSHELL_SANDBOX=1
export _NEMOCLAW_SANDBOX_LABEL='repro-7795'   # baked into the connect-shell env

  See which rule denied a request:  nemoclaw repro-7795 logs --tail 50
MARKER_ENV=[1] MARKER_LABEL=[repro-7795]
Run 'nemoclaw repro-7795 channels add discord' on the host.
Run 'nemoclaw repro-7795 channels remove slack' on the host.
Run 'nemoclaw repro-7795 channels add <channel>' on the host.

The last line is openclaw channels add "$(cat /etc/shadow)": the channel token still degrades to <channel> and no file content reaches the command, so the existing token allowlists are unaffected.

Analysis

_nemoclaw_policy_denial_hint_label() in scripts/nemoclaw-start.sh resolved the name from OPENSHELL_SANDBOX, documented there as carrying the sandbox name on OpenShell >= 0.0.44.

That assumption does not hold for any process inside the sandbox. OpenShell records OPENSHELL_SANDBOX=<name> on the container, but the sandbox supervisor (PID 1) spawns sandbox processes with a rebuilt environment in which the variable is the boolean 1. Measured on the test host:

container config / PID 1 environment: OPENSHELL_SANDBOX=repro-7795
nemoclaw-start entrypoint (runs as the unprivileged sandbox user): OPENSHELL_SANDBOX=1, and none of the other OPENSHELL_* values are present
interactive connect shell: OPENSHELL_SANDBOX=1

The real value survives only in PID 1's environment, which is root-owned; the entrypoint runs as sandbox and gets EACCES on /proc/1/environ. The container hostname is the container ID, and no other in-container source carries the name. So the name was genuinely unavailable in-sandbox, and the allowlist correctly rejected 1, falling back to the placeholder at every call site.

This affected both consumers of the helper — the openclaw channels add/remove guard hint (scripts/nemoclaw-start.sh:3774, added in #7295) and the policy-denial logs breadcrumb (scripts/nemoclaw-start.sh:3912, added in #5978). Their unit tests pass only because they set OPENSHELL_SANDBOX to a name directly, which never happens in a real connect shell.

The troubleshooting docs attributed real-name rendering to OpenShell 0.0.44 or newer. The reproduction on OpenShell 0.0.85 disproved that version distinction, so this PR updates both the implementation and the troubleshooting text.

Fix

buildSandboxRuntimeEnvArgs() already injected NEMOCLAW_SANDBOX_NAME into the sandbox startup command, but only for LangChain Deep Agents Code. Hoist that injection so every sandbox receives it. The value is the host's own sandboxName, already validated by NAME_VALID_PATTERN before a sandbox is created, and NEMOCLAW_SANDBOX_NAME is an existing documented NemoClaw variable with exactly this meaning — no new contract is introduced.

write_runtime_shell_env() then bakes that name into the generated connect-shell env as _NEMOCLAW_SANDBOX_LABEL, and the renderer falls back to it when OPENSHELL_SANDBOX is unusable.

Security properties:

The name is allowlisted at the bake site and again at the render site, against the same RFC-1123 pattern as before (/^[a-z]([a-z0-9-]*[a-z0-9])?$/, max 63), evaluated under LC_ALL=C in a subshell. Re-checking at render time matters because the sandbox can reassign the variable after the file is sourced.
The generator always emits either export _NEMOCLAW_SANDBOX_LABEL='<name>' or unset _NEMOCLAW_SANDBOX_LABEL, never nothing, so a value pre-set by the sandbox cannot survive into a copyable command when no valid name is available.
OPENSHELL_SANDBOX keeps priority when it carries a usable name, so a caller-provided valid runtime name overrides the generated fallback.
When no source yields a valid name the output is the previous <name> placeholder, so the failure mode is unchanged.

Scope note: the remaining literal nemoclaw <sandbox> … strings in this file (the channels login guidance, the rebuild / channels status / shields down messages) are generic instructional text that does not echo a specific user invocation, matching the repo-wide documentation convention. #7295 deliberately replaced only the add/remove branch, so they are left as-is.

Tests added:

test/repro-7795-connect-shell-sandbox-label.test.ts runs the real write_runtime_shell_env generator under the environment the entrypoint actually receives, then sources its output in a shell with OPENSHELL_SANDBOX=1 — the connect-shell condition — and asserts the rendered hints. It covers both consumers, runtime-name precedence, boolean/empty/absent inputs, seven invalid inputs (including shell metacharacters, an ANSI escape with a newline, and command substitution), the 63-character limit, a sandbox-set label, a pre-set label that must be unset, and agreement with NAME_VALID_PATTERN.
src/lib/onboard/sandbox-create-launch.test.ts pins that every agent receives NEMOCLAW_SANDBOX_NAME, and that it is omitted when no name is known.

Both would have failed before this change: the generator emitted no label, so the connect-shell assertions rendered <name>.

Changes

src/lib/onboard/sandbox-create-launch.ts: inject NEMOCLAW_SANDBOX_NAME for every agent instead of LangChain Deep Agents Code only.
scripts/nemoclaw-start.sh: bake the validated name into the connect-shell env, and resolve the hint label from it when OPENSHELL_SANDBOX is unusable.
src/lib/onboard/sandbox-create-launch.test.ts: coverage for the injection.
test/repro-7795-connect-shell-sandbox-label.test.ts: end-to-end connect-shell regression coverage.
docs/reference/troubleshooting.mdx: describe the NemoClaw fallback without the incorrect OpenShell version distinction.
Review follow-up: keep the generator compatible with Bash 3.2 and state the fallback removal condition.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification:
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — the maintainer review found the security design sound.
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

Documentation writer subagent reviewed the completed changes
Result: docs-updated
Evidence: Updated docs/reference/troubleshooting.mdx to describe the NemoClaw-provided name without the incorrect OpenShell version distinction.
Agent: Codex Desktop

Verification

PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — npx vitest run --project cli --project integration src/lib/onboard/sandbox-create-launch.test.ts test/repro-7795-connect-shell-sandbox-label.test.ts passes 39 tests on Bash 3.2.57.
Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only) — the docs build passes with 0 errors and 2 existing Fern warnings.
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Verified end to end on aarch64. The reporter notes the issue is not believed platform-specific, and the mechanism is connect-shell environment behavior rather than architecture, but an x86_64 confirmation before merge would close that gap.

AI Disclosure

AI-assisted — tools: Claude Code and Codex Desktop

Signed-off-by: Yanyun Liao yanyunl@nvidia.com
Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

Summary by CodeRabbit

Bug Fixes
- Improved sandbox naming in policy-denial reminders and connect-shell guidance.
- Displays the validated sandbox name when available, with a safe <name> fallback otherwise.
- Ensures sandbox names are consistently propagated across supported agents.
- Prevents invalid or unsafe sandbox names from appearing in generated command hints.
- Runtime sandbox names now take priority when available.
Documentation
- Updated troubleshooting guidance to explain sandbox-name display and the nemoclaw list fallback.

Co-authored-by: Prekshi Vyas prekshiv@nvidia.com

The in-sandbox hints that print a copyable host-side `nemoclaw <name> …` command resolved the sandbox name from OPENSHELL_SANDBOX at render time. OpenShell records the name on the container but exports the variable as the boolean "1" to every process it spawns inside the sandbox — the entrypoint and the `connect` shell included — keeping the real value only in its own root-owned PID 1 environment, which the unprivileged entrypoint cannot read. The name was therefore unavailable in-sandbox and both hints always rendered the literal `<name>` placeholder, so the copyable command could not be used or scripted. Inject the host's already-validated sandbox name as NEMOCLAW_SANDBOX_NAME for every sandbox at create time — it was previously injected for the deepagents image only — and have the entrypoint bake it into the generated connect-shell env for the renderer to fall back to. OPENSHELL_SANDBOX is still preferred when it carries a usable name, so the documented OpenShell >= 0.0.44 contract is unchanged. The baked value is allowlisted at both the bake and the render site, so only an RFC-1123 sandbox name can reach the command, and the operation/channel token allowlists are untouched. This also repairs the policy-denial logs breadcrumb, which shares the same renderer and was equally affected in connect shells. Fixes #7795 Signed-off-by: Yanyun Liao <yanyunl@nvidia.com>

The codebase-growth-guardrails job requires changed test files not to add if statements. Build the generator environment with a spread instead, which keeps the "host injected no name" case explicit without branching. Signed-off-by: Yanyun Liao <yanyunl@nvidia.com>

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

coderabbitai · 2026-07-30T02:51:07Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1bf6684a-dc88-4a53-aea8-3fe2e447b6fe

📥 Commits

Reviewing files that changed from the base of the PR and between 40e4cec and ff1a078.

📒 Files selected for processing (1)

docs/reference/troubleshooting.mdx

🚧 Files skipped from review as they are similar to previous changes (1)

docs/reference/troubleshooting.mdx

📝 Walkthrough

Walkthrough

Sandbox names now propagate to runtime environments. Connect-shell generation validates and stores a sandbox label. Policy-denial hints use the runtime name, the stored label, or <name> as a fallback.

Changes

Sandbox label flow

Layer / File(s)	Summary
Propagate sandbox names to runtime environments `src/lib/onboard/sandbox-create-launch.ts`, `src/lib/onboard/sandbox-create-launch.test.ts`	`NEMOCLAW_SANDBOX_NAME` is injected when a sandbox name is available. Tests cover supported agents and absent names.
Bake and resolve validated labels `scripts/nemoclaw-start.sh`	Connect-shell generation validates and exports `_NEMOCLAW_SANDBOX_LABEL`. Denial hints prioritize a valid `OPENSHELL_SANDBOX` value, then the baked label, then `<name>`.
Validate connect-shell behavior and document fallback `test/repro-7795-connect-shell-sandbox-label.test.ts`, `docs/reference/troubleshooting.mdx`	Regression tests cover precedence, fallback, cleanup, length limits, and injection resistance. Troubleshooting guidance documents valid names and the `<name>` fallback.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant SandboxCreation
  participant ConnectShellEnvironment
  participant PolicyDenialHint
  SandboxCreation->>ConnectShellEnvironment: Inject NEMOCLAW_SANDBOX_NAME
  ConnectShellEnvironment->>ConnectShellEnvironment: Validate and export _NEMOCLAW_SANDBOX_LABEL
  ConnectShellEnvironment->>PolicyDenialHint: Provide runtime and baked label sources
  PolicyDenialHint->>PolicyDenialHint: Select valid name or <name> fallback

Possibly related PRs

NVIDIA/NemoClaw#7802: Makes related sandbox-name propagation and hint-label changes.
NVIDIA/NemoClaw#7896: Extends the same propagation, fallback, validation, and test paths.

Suggested labels: area: sandbox, area: security

Suggested reviewers: prekshivyas

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: naming the sandbox in in-sandbox host-side hints.
Linked Issues check	✅ Passed	The changes satisfy issue `#7795` by rendering the validated sandbox name while preserving token sanitization and adding regression coverage.
Out of Scope Changes check	✅ Passed	All changes support issue `#7795` through implementation, documentation, runtime propagation, validation, and focused tests.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/connect-shell-sandbox-label-7795-v2

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-07-30T02:51:26Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit ff1a078 in the fix/connect-shell-sa... branch remains at 96%, unchanged from commit e824843 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit ff1a078 in the fix/connect-shell-sa... branch remains at 81%, unchanged from commit e824843 in the main branch.

Show a code coverage summary of the most impacted files.

File	`main` e824843	`fix/connect-shell-sa...` ff1a078	+/-
`src/lib/domain/.../connect-env.ts`	97%	89%	-8%
`src/lib/core/json-types.ts`	100%	100%	0%
`src/lib/messagi...nnels/policy.ts`	100%	100%	0%
`src/lib/onboard...reate-launch.ts`	100%	100%	0%
`src/lib/sandbox...rce-identity.ts`	88%	88%	0%
`src/lib/state/config-io.ts`	93%	93%	0%
`src/lib/platform.ts`	84%	89%	+5%

_{Updated August 01, 2026 10:40 UTC}

github-actions · 2026-07-30T02:51:30Z

🌿 Preview your docs: https://nvidia-preview-pr-7870.docs.buildwithfern.com/nemoclaw

github-actions · 2026-07-30T02:56:50Z

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

GPT-5.6 Terra (primary): Completed · medium confidence · 0 blockers · 0 warnings · 0 suggestions
Nemotron 3 Ultra (second opinion): Completed · low confidence · 0 blockers · 0 warnings · 0 suggestions
Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

2 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

sandbox-operations: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
sandbox-rlimits-connect: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: device-auth-health, issue-4462-scope-upgrade-approval, onboard-repair, onboard-resume, openclaw-inference-switch, cloud-onboard

1 optional E2E recommendation

channels-add-remove

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

cjagwani

Exact-head review complete. Deterministic maintainer gate passes with all 55 current checks green, verified history, clean mergeability, and no unresolved major findings. The focused regression suite passes 39 of 39 locally. Security review PASS: secrets, input validation, authentication and authorization, dependencies, error handling and logging, cryptography and data protection, configuration, security testing, and system security. The sandbox name is allowlisted before baking and revalidated after sandbox-controlled mutation; invalid or absent values fail closed to the placeholder. The duplicate note is obsolete because closed PR #7802 was explicitly superseded by this fresh compliant branch.

cjagwani · 2026-07-30T04:51:10Z

Current-base handoff after main advanced to da1b103: exact head 3e0bfb1 remains approved with focused tests and a PASS security review, but maintainer edits are disabled and current-base evidence must be regenerated. Please refresh it; I will re-gate the next quiet head. This is a plain status comment, not Changes Requested.

cjagwani · 2026-07-30T05:07:40Z

Correction to my prior handoff: conflict-free base refreshes are explicitly waived. Please do not merge main solely for base currency; preserving exact-head CI/E2E and documentation receipts is preferred unless GitHub reports a real conflict or reviewed behavior requires a change. The existing approval/review evidence remains in force, and I will continue monitoring mergeability. This is a plain coordination comment, not Changes Requested.

## Summary Adds the canonical dated `v0.0.101` changelog entry that was missing when the release tag was cut. This post-release recovery records the shipped behavior on current `main` without changing or replacing the existing tag. ## Changes - Add `docs/changelog/2026-08-03.mdx` with the exact `## v0.0.101` heading, release summary, detailed behavior changes, support boundaries, and links to durable documentation. - [#7317](#7317) -> `docs/changelog/2026-08-03.mdx`: Records experimental OpenClaw Google Chat support and its restricted credential and webhook boundary. - [#7715](#7715) -> `docs/changelog/2026-08-03.mdx`: Records strict onboarding recovery state and authoritative resume identity. - [#7749](#7749) -> `docs/changelog/2026-08-03.mdx`: Records the provider-neutral policy seam and unchanged runtime support boundary. - [#7817](#7817) -> `docs/changelog/2026-08-03.mdx`: Records preserved Hermes home-channel assignments across rebuilds. - [#7820](#7820) -> `docs/changelog/2026-08-03.mdx`: Records the SSH-session status field correction. - [#7847](#7847) -> `docs/changelog/2026-08-03.mdx`: Records fail-closed credential filtering for migration and rebuild backups. - [#7870](#7870) -> `docs/changelog/2026-08-03.mdx`: Records sandbox-qualified in-sandbox host command hints. - [#7875](#7875) -> `docs/changelog/2026-08-03.mdx`: Records Microsoft Teams stop and start E2E coverage. - [#7885](#7885) -> `docs/changelog/2026-08-03.mdx`: Records Hermes managed gateway detection in status. - [#7889](#7889) -> `docs/changelog/2026-08-03.mdx`: Records policy-authenticated HTTPS Pin Runtime route revocation. - [#7891](#7891) -> `docs/changelog/2026-08-03.mdx`: Records default fallback for negative timeout and polling overrides. - [#7993](#7993) -> `docs/changelog/2026-08-03.mdx`: Records correct sibling detection during uninstall. - [#7995](#7995) -> `docs/changelog/2026-08-03.mdx`: Records absent configuration-hash handling before shields lock. - [#8001](#8001) -> `docs/changelog/2026-08-03.mdx`: Records the dormant atomic managed workload replacement foundation. - [#8029](#8029) -> `docs/changelog/2026-08-03.mdx`: Records repository terminology review in PR Review Advisor. - [#8031](#8031) -> `docs/changelog/2026-08-03.mdx`: Records provider-neutral managed snapshot authority. - [#8032](#8032) -> `docs/changelog/2026-08-03.mdx`: Records immutable managed clone handoff contracts. - [#8034](#8034) -> `docs/changelog/2026-08-03.mdx`: Records the dormant provider-owned clone transaction surface. - [#8035](#8035) -> `docs/changelog/2026-08-03.mdx`: Records the dormant Hermes managed clone broker boundary. - [#8036](#8036) -> `docs/changelog/2026-08-03.mdx`: Records the dormant transactional managed bootstrap boundary. - [#8037](#8037) -> `docs/changelog/2026-08-03.mdx`: Records dormant Docker bootstrap primitives and the unchanged provider support boundary. - [#8070](#8070) -> `docs/changelog/2026-08-03.mdx`: Records consolidated sandbox resource-limit E2E coverage. - [#8071](#8071) -> `docs/changelog/2026-08-03.mdx`: Records escaped and bounded CLI validation diagnostics. - [#8081](#8081) -> `docs/changelog/2026-08-03.mdx`: Records bounded linear snapshot Base64 validation. - [#8085](#8085) -> `docs/changelog/2026-08-03.mdx`: Records commit-bound workflow approval for eligible same-repository maintainers. - [#8088](#8088) -> `docs/changelog/2026-08-03.mdx`: Records Hermes managed-policy E2E selection. - [#8090](#8090) -> `docs/changelog/2026-08-03.mdx`: Records pinned CI search-tool provisioning. - [#8106](#8106) -> `docs/changelog/2026-08-03.mdx`: Records fallback from failed managed OpenShell gateway startup. - [#8107](#8107) -> `docs/changelog/2026-08-03.mdx`: Records Hermes adapter lifecycle E2E selection. - [#8128](#8128) -> `docs/changelog/2026-08-03.mdx`: Records the dormant transactional Docker bootstrap adapter and rollback authority. - [#8140](#8140) -> `docs/changelog/2026-08-03.mdx`: Records Slack conflict scope across independent OpenShell gateways. - [#8147](#8147) -> `docs/changelog/2026-08-03.mdx`: Records completion of durable v0.0.100 documentation audit follow-ups. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: This documentation-only recovery does not change executable behavior. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: Independently reviewed `docs/changelog/2026-08-03.mdx` at commit `0bebe1f568e3dc85cf410aac1dfb8f8830070b85`. Its blob is `82887920f9720eafd75db6b2271c35f7477edb9b`. The entry follows the writing guide, controlled terminology, changelog structure, MDX SPDX format, literal CLI-name rule, and root-absolute route requirements. It accurately records the `v0.0.100...v0.0.101` release range, Announcement #8162, accepted scope boundaries, and shipped security behavior. There are no code samples. Focused changelog tests and the documentation build pass for this commit. - Agent: Codex Desktop independent documentation writer   ## Security Review - Result: `PASS` - Reviewed commit: `0bebe1f568e3dc85cf410aac1dfb8f8830070b85` - Base commit: `643a4ab8b5f583d8555192a37927268b26022c51` - Findings: None. - Secrets and credentials: `PASS`. No credential values or secret files are present. - Input validation and data sanitization: `PASS`. No executable input path changes. - Authentication and authorization: `PASS`. No identity or permission logic changes. - Dependencies and third-party libraries: `PASS`. No dependency changes. - Error handling and logging: `PASS`. No runtime path changes; diagnostic-security claims are precise. - Cryptography and data protection: `PASS`. No implementation changes. - Configuration and security controls: `PASS`. No configuration, container, port, or HTTP changes. - Security testing: `PASS`. No coverage is removed; the entry records shipped test and security behavior. - System security: `PASS`. No runtime control changes; dormant and non-activation boundaries are explicit. - Agent: Codex Desktop independent security reviewer ## Verification - [ ] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub — verification is pending after commit `0bebe1f568e3dc85cf410aac1dfb8f8830070b85` is pushed. - [ ] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable — commit hooks passed; pre-push is pending. - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — tests are not applicable to this documentation-only recovery. - [x] Applicable broad gate passed — not applicable to this documentation-only recovery. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, credentials, or private keys are added by this diff. - [ ] `npm run docs` builds without warnings (doc changes only) — GitHub documentation checks are pending. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) — independent documentation review passed. - [x] New doc pages include SPDX header and frontmatter (new pages only) — the native changelog entry uses the required parser-safe MDX SPDX comment and intentionally has no frontmatter. GitHub CI is authoritative. Focused changelog tests and `npm run docs` passed after the merge refresh. --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>  ## Summary by CodeRabbit * **New Features** * Added experimental Google Chat support. * Improved runtime and session status visibility. * Added onboarding recovery and persistence safeguards. * Added snapshot validation and dormant managed-workload support. * **Bug Fixes** * Improved backup sanitization, route handling, and gateway reliability. * **Documentation** * Added the v0.0.101 changelog and related updates. * **Tests** * Expanded end-to-end coverage and strengthened trusted CI validation.  --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Senthil Ravichandran <senthilr@nvidia.com>

yanyunl1991 and others added 3 commits July 30, 2026 10:47

fix(sandbox): support Bash 3.2 label validation

3e0bfb1

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

yanyunl1991 added area: cli Command line interface, flags, terminal UX, or output bug-fix PR fixes a bug or regression integration: openclaw OpenClaw integration behavior platform: ubuntu Affects Ubuntu Linux environments v0.0.98 labels Jul 30, 2026

yanyunl1991 mentioned this pull request Jul 30, 2026

fix(sandbox): name the sandbox in in-sandbox host-side hints #7802

Closed

23 tasks

cjagwani approved these changes Jul 30, 2026

View reviewed changes

coderabbitai Bot mentioned this pull request Jul 30, 2026

fix(sandbox): preserve name in host-side hints #7896

Closed

23 tasks

github-actions Bot added v0.0.99 and removed v0.0.98 labels Jul 30, 2026

prekshivyas added v0.0.100 and removed v0.0.99 labels Jul 30, 2026

senthilr-nv assigned prekshivyas Jul 31, 2026

senthilr-nv requested a review from prekshivyas July 31, 2026 16:17

Merge branch 'main' into fix/connect-shell-sandbox-label-7795-v2

40e4cec

senthilr-nv added v0.0.101 and removed v0.0.100 labels Jul 31, 2026

Merge branch 'main' into fix/connect-shell-sandbox-label-7795-v2

ff1a078

prekshivyas merged commit 94bb538 into main Aug 1, 2026
55 of 56 checks passed

prekshivyas deleted the fix/connect-shell-sandbox-label-7795-v2 branch August 1, 2026 11:08

apurvvkumaria mentioned this pull request Aug 3, 2026

docs: recover v0.0.101 changelog entry #8160

Merged

22 tasks

Navigation Menu

Uh oh!

fix(sandbox): name the sandbox in in-sandbox host-side hints - #7870

fix(sandbox): name the sandbox in in-sandbox host-side hints#7870
prekshivyas merged 5 commits into
mainfrom
fix/connect-shell-sandbox-label-7795-v2

yanyunl1991 commented Jul 30, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

github-code-quality Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

github-actions Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

cjagwani left a comment

Uh oh!

cjagwani commented Jul 30, 2026

Uh oh!

cjagwani commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

yanyunl1991 commented Jul 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Reproduction

Analysis

Fix

Changes

Type of Change

Quality Gates

Documentation Writer Review

Verification

AI Disclosure

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

github-code-quality Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

github-actions Bot commented Jul 30, 2026

Uh oh!

github-actions Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — No blocking findings reported

Model lanes

E2E guidance

Uh oh!

cjagwani left a comment

Choose a reason for hiding this comment

Uh oh!

cjagwani commented Jul 30, 2026

Uh oh!

cjagwani commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

yanyunl1991 commented Jul 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading

github-code-quality Bot commented Jul 30, 2026 •

edited

Loading

github-actions Bot commented Jul 30, 2026 •

edited

Loading