Description

Description:

During the sandbox/setup wizard, the Slack Bot Token field accepts and saves an obviously invalid value such as abcd. The UI shows ✓ slack token saved and continues creating the sandbox/providers without any validation. This suggests the setup flow does not validate Slack token format or token validity before proceeding.

Environment: - Platform: WSL arm

• OS: Ubuntu 24.04
• NemoClaw: v0.0.15
• OpenShell: 0.0.26
• OpenClaw: 2026.4.2 (d74a122)
• Install method: curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
• Runtime detected by installer: docker

Steps to Reproduce:

1. Run: curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
2. Select slack under Messaging channels
3. Enter abcd as the Slack Bot Token
4. Continue the setup flow
5. Observe that the UI shows ✓ slack token saved
6. The wizard proceeds to sandbox/provider creation

Actual:

An invalid Slack Bot Token is accepted and saved, and setup continues without error.

Available messaging channels:
[1] ○ telegram — Telegram bot messaging
[2] ○ discord — Discord bot messaging
[3] ● slack — Slack bot messaging

Press 1-3 to toggle, Enter when done:
Slack API → Your Apps → OAuth & Permissions → Bot User OAuth Token (xoxb-...).

Slack Bot Token: ****

✓ slack token saved
[6/8] Creating sandbox

──────────────────────────────────────────────────

Sandbox name (lowercase, starts with letter, hyphens ok) [my-assistant]: test

✓ Created provider test-slack-bridge

✓ Created provider test-brave-search

Expect:
The setup flow should reject invalid Slack Bot Tokens before continuing. At minimum it should validate the expected xoxb-... format. Ideally it should also validate the token against Slack API before saving.

[NVB# 6081420]