fix: bake CHAT_UI_URL into Docker build for remote dashboard access

docs/deployment/deploy-to-remote-gpu.md

@@ -88,6 +88,28 @@ Run a test agent prompt inside the remote sandbox:
 $ openclaw agent --agent main --local -m "Hello from the remote sandbox" --session-id test
 ```
 
+## Remote Dashboard Access
+
+The NemoClaw dashboard validates the browser origin against an allowlist baked
+into the sandbox image at build time.  By default the allowlist only contains
+`http://127.0.0.1:18789`.  When accessing the dashboard from a remote browser
+(for example through a Brev public URL or an SSH port-forward), set
+`CHAT_UI_URL` to the origin the browser will use **before** running setup:
+
+```console
+$ export CHAT_UI_URL="https://openclaw0-<id>.brevlab.com"
+$ nemoclaw deploy <instance-name>
+```
+
+For SSH port-forwarding, the origin is typically `http://127.0.0.1:18789` (the
+default), so no extra configuration is needed.
+
+:::{note}
+On Brev, set `CHAT_UI_URL` in the launchable environment configuration so it is
+available when the setup script builds the sandbox image.  If `CHAT_UI_URL` is
+not set on a headless host, `brev-setup.sh` prints a warning.
+:::
+
 ## GPU Configuration
 
 The deploy script uses the `NEMOCLAW_GPU` environment variable to select the GPU type.

scripts/brev-setup.sh

@@ -189,6 +189,21 @@ info "nemoclaw $(nemoclaw --version) installed"
 
 # Use sg docker to ensure docker group is active (usermod -aG doesn't
 # take effect in the current session without re-login)
+
+# CHAT_UI_URL tells onboard which browser origin to allow in the gateway
+# config.  On Brev, the launchable config should set this to the public URL
+# (e.g. https://openclaw0-<id>.brevlab.com).  Without it the dashboard
+# rejects remote browsers with "origin not allowed".
+# Ref: https://github.com/NVIDIA/NemoClaw/issues/795
+if [ -n "${CHAT_UI_URL:-}" ]; then
+  export CHAT_UI_URL
+  info "CHAT_UI_URL=${CHAT_UI_URL}"
+elif [ -z "${DISPLAY:-}" ] && [ ! -e /tmp/.X11-unix ]; then
+  warn "CHAT_UI_URL is not set.  Remote browser access will fail with"
+  warn "'origin not allowed' unless you set CHAT_UI_URL to the public URL"
+  warn "of this instance (e.g. https://openclaw0-<id>.brevlab.com)."
+fi
+
 info "Running nemoclaw onboard..."
 export NVIDIA_API_KEY
 exec sg docker -c "nemoclaw onboard --non-interactive"

test/runner.test.js

@@ -377,7 +377,7 @@ describe("regression guards", () => {
       calls.push(args);
       return {
         status: 0,
-        stdout: "visit https://alice:secret@example.com/?token=abc123456789\n",
+        stdout: "visit https://alice:secret@example.com/?token=abc123456789\n", // gitleaks:allow
         stderr: "",
       };
     };