fix(onboard): reject sandbox names starting with a digit and allow retry

latenighthackathon · latenighthackathon · commit a3515526aa80 · 2026-03-30T17:16:45.000-05:00
Names starting with a digit (e.g., '7racii') pass the current regex
but fail downstream in Kubernetes. The user is forced to delete
~/.nemoclaw to recover because the invalid name is persisted in the
session and reused on retry.

Tighten the regex from ^[a-z0-9] to ^[a-z] so digit-prefixed names
are caught at prompt time. Replace process.exit(1) with a retry loop
(up to 3 attempts) so users can correct the name without restarting.
Non-interactive mode still exits immediately on invalid input.

Signed-off-by: latenighthackathon &lt;latenighthackathon@users.noreply.github.com&gt;
diff --git a/bin/lib/onboard.js b/bin/lib/onboard.js
@@ -1787,22 +1787,39 @@ async function recoverGatewayRuntime() {
 // ── Step 3: Sandbox ──────────────────────────────────────────────
 
 async function promptValidatedSandboxName() {
-  const nameAnswer = await promptOrDefault(
-    "  Sandbox name (lowercase, numbers, hyphens) [my-assistant]: ",
-    "NEMOCLAW_SANDBOX_NAME", "my-assistant"
-  );
-  const sandboxName = (nameAnswer || "my-assistant").trim().toLowerCase();
+  const MAX_ATTEMPTS = 3;
+  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+    const nameAnswer = await promptOrDefault(
+      "  Sandbox name (lowercase, starts with letter, hyphens ok) [my-assistant]: ",
+      "NEMOCLAW_SANDBOX_NAME", "my-assistant"
+    );
+    const sandboxName = (nameAnswer || "my-assistant").trim().toLowerCase();
+
+    // Validate: RFC 1123 subdomain — lowercase alphanumeric and hyphens,
+    // must start with a letter (not a digit) to satisfy Kubernetes naming.
+    if (/^[a-z]([a-z0-9-]*[a-z0-9])?$/.test(sandboxName)) {
+      return sandboxName;
+    }
 
-  // Validate: RFC 1123 subdomain — lowercase alphanumeric and hyphens,
-  // must start and end with alphanumeric (required by Kubernetes/OpenShell)
-  if (!/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/.test(sandboxName)) {
     console.error(`  Invalid sandbox name: '${sandboxName}'`);
-    console.error("  Names must be lowercase, contain only letters, numbers, and hyphens,");
-    console.error("  and must start and end with a letter or number.");
-    process.exit(1);
+    if (/^[0-9]/.test(sandboxName)) {
+      console.error("  Names must start with a letter, not a digit.");
+    } else {
+      console.error("  Names must be lowercase, contain only letters, numbers, and hyphens,");
+      console.error("  and must start and end with a letter or number.");
+    }
+
+    if (isNonInteractive()) {
+      process.exit(1);
+    }
+
+    if (attempt < MAX_ATTEMPTS - 1) {
+      console.error("  Please try again.\n");
+    }
   }
 
-  return sandboxName;
+  console.error("  Too many invalid attempts.");
+  process.exit(1);
 }
 
 // eslint-disable-next-line complexity
diff --git a/test/onboard.test.js b/test/onboard.test.js
@@ -440,6 +440,24 @@ describe("onboard helpers", () => {
     }
   });
 
+  it("rejects sandbox names starting with a digit", () => {
+    // The validation regex must require names to start with a letter,
+    // not a digit — Kubernetes rejects digit-prefixed names downstream.
+    const SANDBOX_NAME_REGEX = /^[a-z]([a-z0-9-]*[a-z0-9])?$/;
+
+    expect(SANDBOX_NAME_REGEX.test("my-assistant")).toBe(true);
+    expect(SANDBOX_NAME_REGEX.test("a")).toBe(true);
+    expect(SANDBOX_NAME_REGEX.test("agent-1")).toBe(true);
+    expect(SANDBOX_NAME_REGEX.test("test-sandbox-v2")).toBe(true);
+
+    expect(SANDBOX_NAME_REGEX.test("7racii")).toBe(false);
+    expect(SANDBOX_NAME_REGEX.test("1sandbox")).toBe(false);
+    expect(SANDBOX_NAME_REGEX.test("123")).toBe(false);
+    expect(SANDBOX_NAME_REGEX.test("-start-hyphen")).toBe(false);
+    expect(SANDBOX_NAME_REGEX.test("end-hyphen-")).toBe(false);
+    expect(SANDBOX_NAME_REGEX.test("")).toBe(false);
+  });
+
   it("passes credential names to openshell without embedding secret values in argv", () => {
     const repoRoot = path.join(import.meta.dirname, "..");
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-onboard-inference-"));
