Summary

nemoclaw <name> rebuild (and nemoclaw onboard --resume after a failed rebuild) fails during the in-image OpenClaw JS patch step (Step 17 of Dockerfile, "Patch 4 — graceful EACCES in replaceConfigFile"). The Python script's literal-string assert no longer matches the source in the bundled OpenClaw, because the base sandbox image now ships OpenClaw 2026.4.24 while NemoClaw v0.0.29's blueprint pin is min_openclaw_version: 2026.4.9.

The result: any rebuild on a fresh v0.0.29 install destroys the sandbox during the recreate step and cannot recover via onboard --resume (same patch, same failure).

Repro

curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash   # default install, build provider
nemoclaw <sandbox-name> rebuild --yes

Error trace

Step 16/56 : RUN ... INFO: OpenClaw 2026.4.24 is current (>= 2026.4.9), no upgrade needed
Step 17/56 : RUN set -eu; ... # Patch 4 ...
 ---> Running in <id>
Traceback (most recent call last):
  File "<string>", line 1, in <module>
AssertionError: writeConfigFile(params.nextConfig) pattern not found
The command '/bin/bash -o pipefail -c set -eu; ...' returned a non-zero code: 1

Recreate failed after sandbox was destroyed.
Backup is preserved at: ~/.nemoclaw/rebuild-backups/<name>/<timestamp>

The literal pattern Patch 4 searches for —

\tawait writeConfigFile(params.nextConfig, {\n\t\t...writeOptions,\n\t\t...params.writeOptions\n\t});

— no longer appears in /usr/local/lib/node_modules/openclaw/dist/*.js for OpenClaw 2026.4.24, presumably due to a refactor of replaceConfigFile.

Environment

• NemoClaw: v0.0.29
• OpenShell: 0.0.36 (per cluster image tag)
• OpenClaw (in base image): 2026.4.24
• OS: Ubuntu 24.04 / kernel 6.17.0-22-generic
• Docker: 29.1.3
• Node: 25.6.1
• GPU: RTX 4090
• Provider: build (NVIDIA Endpoints, hosted)
• Sandbox image digest pinned in blueprint: sha256:b3d832b596ab6b7184a9dcb4ae93337ca32851a4f93b00765cc12de26baa3a9a

Suggested fix

One of:

1. Bump min_openclaw_version in nemoclaw-blueprint/blueprint.yaml to 2026.4.24 and update Patch 4's literal-string match (or pattern-match against the new shape of replaceConfigFile).
2. Make Patch 4 tolerant of a missing pattern when the bundled OpenClaw version is >= 2026.4.X where the refactor landed — warn instead of failing the build, since the function may now handle EACCES natively.
3. Pin the sandbox image digest to one whose OpenClaw is 2026.4.9 (revert image bump) until Patch 4 is re-targeted.

Happy to test a candidate fix.