docs(network-policy): start remote TUI without a source-checkout env step

[JulienAu]

Summary

The Remote Sandbox tab of the network request approval page told users to run cd ~/nemoclaw and . .env before openshell term. A standard public-installer setup has no source checkout and no .env file, so the chained procedure stopped at bash: .env: No such file or directory and never launched the TUI. The remote instructions now start the TUI directly with openshell term, matching the Local Sandbox tab.

Related Issue

Fixes #8464

Changes

• docs/network-policy/approve-network-requests.mdx: remove the cd ~/nemoclaw and . .env steps from the Remote Sandbox tab and adjust the lead-in sentence. The later walkthrough section already covers the source-checkout case separately.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification: prose and command sample change in one documentation page, no code behavior involved.
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Maintainer nine-category review PASS; documentation-only correction with no runtime policy, permission, or trust-boundary change.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: docs/network-policy/approve-network-requests.mdx; full-page review against installer behavior, CLI reference, monitoring guide, service startup output, agent variants, and documentation conventions passed with no findings.
• Agent: Codex independent documentation reviewer

---

Signed-off-by: JulienAu 16043912+JulienAu@users.noreply.github.com

Summary by CodeRabbit

• Documentation
  • Updated remote sandbox instructions to launch the terminal interface directly on the remote host.
  • Removed unnecessary steps for changing directories and sourcing environment variables.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

📝 Walkthrough

Walkthrough

The remote sandbox instructions now start the OpenShell TUI directly. They no longer require changing to ~/nemoclaw or sourcing .env.

Changes

Remote network approval documentation

Layer / File(s)	Summary
Direct remote TUI startup docs/network-policy/approve-network-requests.mdx	The remote-host walkthrough removes the cd ~/nemoclaw and . .env commands before openshell term.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested labels: area: docs, v0.0.103

Suggested reviewers: cv, aasthajh

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The change removes the failing checkout and .env steps and starts the remote TUI with openshell term, meeting issue #8464.
Out of Scope Changes check	✅ Passed	The changes are limited to the documented remote TUI command flow and align with issue #8464.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main documentation change: starting the remote TUI without the source-checkout environment step.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[apurvvkumaria]

Maintainer update for the current branch revision:

• Audited the remote instructions against the public installer, CLI reference, monitoring guide, and service startup output. After connecting to the sandbox host, running openshell term directly is the supported flow; a NemoClaw source checkout and .env are not required for the TUI.
• Integrated current main without changing the contributor's effective documentation fix.
• All review threads are clear, and CodeRabbit reported no actionable findings.
• Strict documentation validation passed with 0 errors and 2 existing warnings. The network-policy published-route contract passed 9/9, and all applicable repository hooks passed.
• Independent documentation review passed with no findings. The prerequisites, remote-host scope, all agent variants, and the separate source-checkout walkthrough remain accurate.
• Security review: secrets/credentials PASS (the incorrect .env sourcing is removed); input validation N/A; authentication/authorization N/A; dependencies N/A; error handling/logging N/A; cryptography N/A; runtime configuration PASS (no policy or runtime configuration changes); tests/validation PASS; holistic review PASS (no permissions or trust boundaries are broadened).
• Both commits retain DCO signoffs and are reported as Verified by GitHub.

The failed advisor jobs are infrastructure failures: GitHub Actions returned service-unavailable errors while resolving actions, and the publisher consequently had no artifact to download. I did not rerun those failures. Fresh checks are queued during the ongoing Actions outage.

No product or architecture decision is required. This PR remains unmerged until repository checks recover and pass and an independent approval is present.

[apurvvkumaria]

Independent current-branch readiness review: PASS, no required fixes.

• The remote instruction matches the canonical CLI contract: SSH to the sandbox host and run openshell term there. A source checkout and .env file are not required.
• The public installer installs OpenShell on the host path or configures the user-local binary path for later shells.
• Removing . .env improves security by avoiding execution of checkout-provided shell content and loading of unrelated environment values.
• Documentation validation passes with 0 errors, the 2 existing repository warnings, synchronized agent variants, and all 67 guarded routes.
• Repository markdown lint and diff checks pass. The previously observed lint locations near the later walkthrough are unchanged base content whose line numbers shifted after this two-line deletion.
• Both commits are GitHub Verified, DCO is present, and there are zero review threads.

The remaining blockers are independent approval and hosted workflows queued during the GitHub Actions outage. I am not creating duplicate reruns while the incident remains active.

[apurvvkumaria]

Approve — the current branch revision correctly removes source-checkout-only setup from the ordinary remote TUI path while preserving that setup in the separate walkthrough section. The full page remains internally consistent, the command now matches the local-host path and public-installer environment, the documentation and security reviews are current, both commits are Verified with DCO declarations, and there are no unresolved review threads. The isolated worktree lacks installed documentation tooling, so the protected hosted documentation result remains required before merge; the recorded current-revision documentation build passed with zero errors.

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

1 semantic terminology decision

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — TUI at docs/network-policy/approve-network-requests.mdx:47: Keep `TUI`; it is the repository-controlled term for a terminal user interface.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.