fix(sandbox): reject managed startup env wrapper without nemoclaw-start terminator

[laitingsheng]

Summary

The managed startup env wrapper only rejected a missing nemoclaw-start terminator when the argument sequence carried NEMOCLAW_STARTUP_PROFILE_B64 or NEMOCLAW_CORPORATE_CA_B64, so env NEMOCLAW_AUTO_PAIR_FAST_REENTRY_INTERVAL_SECS=5 /bin/sh returned success and kept the unnormalized arguments. It now rejects any supported managed variable name that appears in the leading assignment run without the terminator, while a user command tail that only looks like an assignment still passes through unchanged.

Related Issue

Fixes #8595

Changes

• Lift the supported-variable set in scripts/lib/entrypoint-env-wrapper.sh out of the inline case into one _nemoclaw_supported_names value, so the terminator-missing branch and the assignment validation loop read the same list instead of drifting apart.
• Reject a terminator-less sequence when any supported managed name appears in the leading assignment run. The existing rejection of NEMOCLAW_STARTUP_PROFILE_B64 and NEMOCLAW_CORPORATE_CA_B64 in any argument position is unchanged, so no current guarantee is relaxed.
• Scope the wider check to the leading assignment run so env FOO=bar /bin/sh -c NEMOCLAW_SANDBOX_NAME=probe stays a user command. test/entrypoint-env-wrapper.test.ts pins that boundary.
• Add three fail-closed cases to test/entrypoint-env-wrapper.test.ts covering the reported sequence, a two-assignment variant, and a trust payload in the command tail, and give every case in that table a distinct name so a failure identifies the broken contract.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: the wrapper is an in-container root entrypoint contract with no page in docs/, and the only producer of this argument sequence is the launch renderer, which always emits the terminator. The newly rejected shape is reachable only by a hand-built container command.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Nine-category security review passed with no findings: fix(sandbox): reject managed startup env wrapper without nemoclaw-start terminator #8609 (comment)
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: PR fix(sandbox): reject managed startup env wrapper without nemoclaw-start terminator #8609 changes internal managed-startup wrapper validation and its regression tests. The launch renderer still supplies /usr/local/bin/nemoclaw-start, and public documentation does not expose this OCI argument grammar. docs/reference/commands.mdx already documents the affected environment variable.
• Agent: Codex Desktop

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run test/entrypoint-env-wrapper.test.ts — 12/12 pass. npx vitest run test/pr-risk-plan.test.ts test/sandbox-provisioning-helper-permissions.test.ts test/sandbox-rlimit-hooks.test.ts test/hermes-doctor-config-hash.test.ts — 128/128 pass. test/hermes-start.test.ts, test/service-env.test.ts, test/sandbox-provisioning.test.ts, test/sandbox-build-context.test.ts, test/openclaw-final-image-layout.test.ts, and test/hermes-final-image-layout.test.ts also pass.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Tinson Lai tinsonl@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved validation of environment variable assignments during application startup.
  • Preserved valid command arguments that resemble environment assignments.
  • Continued blocking unsafe startup and profile variables in both leading assignments and command arguments.
  • Added support for validating multiple managed variables and handling invalid assignment sequences correctly.
  • Improved handling of unrelated commands and explicit user-provided command arguments.

[coderabbitai]

📝 Walkthrough

Walkthrough

The entrypoint wrapper centralizes managed-variable validation, tracks leading assignments, rejects malformed startup handoffs, and preserves command-tail arguments. Tests cover valid command tails and unsafe or malformed assignment sequences.

Changes

Managed environment validation

Layer / File(s)	Summary
Wrapper parsing and validation scripts/lib/entrypoint-env-wrapper.sh	The wrapper centralizes supported environment names, tracks the leading assignment sequence, rejects managed variables when the nemoclaw-start handoff is missing or malformed, and uses the allowlist for assignment validation.
Regression coverage test/entrypoint-env-wrapper.test.ts	Tests verify command-tail preservation and rejection of unsafe managed variables, malformed assignment sequences, unrelated commands, and missing startup terminators.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes address issue #8595 by rejecting terminator-less managed assignments while preserving valid command-tail arguments.
Out of Scope Changes check	✅ Passed	The implementation and tests remain within the linked issue scope and support terminator validation and managed-variable handling.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main fix: rejecting managed startup environment arguments without the required nemoclaw-start terminator.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/entrypoint-env-wrapper-terminator

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit e402ed4 in the fix/entrypoint-env-w... branch remains at 96%, unchanged from commit f817ad6 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit e402ed4 in the fix/entrypoint-env-w... branch remains at 82%, unchanged from commit f817ad6 in the main branch.

Show a code coverage summary of the most impacted files.

File	main f817ad6	fix/entrypoint-env-w... e402ed4	+/-
src/lib/inferen...ollama/proxy.ts	36%	33%	-3%
src/lib/adapter...ateway-drift.ts	57%	56%	-1%
src/lib/onboard...eway-process.ts	88%	88%	0%
src/lib/sandbox...rce-identity.ts	86%	86%	0%
src/lib/sandbox...rsion-scheme.ts	100%	100%	0%
src/lib/messagi...annel-config.ts	95%	99%	+4%
src/lib/actions...ence-gateway.ts	82%	91%	+9%
src/lib/actions...ocker-health.ts	61%	78%	+17%

---

_{Updated August 10, 2026 21:28 UTC}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/entrypoint-env-wrapper.test.ts`:
- Around line 87-100: Update the two affected test titles in the enclosing
describe block, including “leaves a user command tail that only looks like a
managed assignment,” by appending the exact suffix “(`#8595`)” to each title while
preserving their existing wording.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4c49839e-841c-4474-9014-9a9e4f262e5d

📥 Commits

Reviewing files that changed from the base of the PR and between aeaaf1a and 4ad4655.

📒 Files selected for processing (2)

• scripts/lib/entrypoint-env-wrapper.sh
• test/entrypoint-env-wrapper.test.ts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

3 terminology differences from the second opinion

Advisory only. These are normalized differences from the primary terminology receipt.

• user command tail at test/entrypoint-env-wrapper.test.ts:87: primary classified it as justified; the second opinion classified it as define.
• terminator at scripts/lib/entrypoint-env-wrapper.sh:68: selected only by the second-opinion lane as established.
• degraded handoff at scripts/lib/entrypoint-env-wrapper.sh:85: selected only by the second-opinion lane as define.

4 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• managed-image-protected-runtime: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• onboard-managed-image-buildless-e2e: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• onboard-repair: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• inference-routing: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• define — leading assignment run at scripts/lib/entrypoint-env-wrapper.sh:86: Define this parser boundary in the changed comment and test title.
• justified — user command tail at test/entrypoint-env-wrapper.test.ts:87: Retain this modifier because the contrast identifies the rejection boundary.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: managed-image-multiarch-startup, device-auth-health, issue-4462-scope-upgrade-approval, openclaw-inference-switch

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[cv]

Accepted issue #8595 scope is implemented without a product-surface expansion. The wrapper uses one exact managed-variable set, rejects missing terminators before environment mutation, preserves user command tails, and adds positive and negative regression tests. Security review found no blocker across all nine rubric categories. No competing PR exists, the automated finding is resolved, the current advisor reports no findings, the PR is not behind main, and no maintainer review exists.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[apurvvkumaria]

Security review — PASS\n\nReviewed the current change in scripts/lib/entrypoint-env-wrapper.sh and its regression tests against all nine repository security categories. No security findings.\n\n- Secrets and Credentials — PASS: The wrapper does not print assignment values or trust payloads. Diagnostics contain only fixed guidance and managed variable names.\n- Input Validation and Data Sanitization — PASS: Managed names are matched against the supported allowlist, and the existing validation for names, lengths, newlines, and duplicates remains intact for valid handoff.\n- Authentication and Authorization — PASS: The change does not alter an authentication or authorization boundary. It tightens the root entrypoint handoff boundary.\n- Dependencies and Supply Chain — PASS: The change adds no dependency, image, or package update.\n- Error Handling and Logging — PASS: Missing terminators fail closed with a nonzero result before managed values are exported, without disclosing their contents.\n- Cryptography and Data Protection — PASS: The change does not alter cryptography, and encoded trust data is never logged.\n- Configuration and Security Controls — PASS: Detection and validation use the same supported managed-variable set, with restrictive default behavior when the terminator is absent.\n- Security Testing — PASS: Focused tests cover the reported sequence, mixed assignments, trust data in an ordinary command tail, unsupported names, repeated names, and preservation of ordinary command tails.\n- System Security — PASS: A degraded managed-startup sequence is rejected before state mutation, while valid nemoclaw-start handoff and ordinary user commands keep their prior behavior.\n\nCurrent code scanning, shell checks, focused tests, sandbox tests, and required repository checks pass. The OpenClaw managed-startup job remains in progress and must also pass before merge.