Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.agents/skills/nemoclaw-user-reference/references/troubleshooting.md:
- Around line 359-364: Update step 3 in troubleshooting.md to recommend using
the existing automated command by replacing the manual backup/recreate
instruction with guidance to run the documented "nemoclaw <name> rebuild"
command (which performs backup, destroys the old sandbox, recreates it with the
current image, and restores state); ensure the text references the exact command
syntax "nemoclaw <name> rebuild" and optionally points readers to the earlier
section that documents that command (lines describing the rebuild behavior) for
consistency and safety.

In `@scripts/type-safety-hotspots.ts`:
- Around line 14-15: The current tsDirectiveCount uses countMatches(text,
COMMENT_DIRECTIVE_RE) which scans the whole file and picks up directives inside
strings; instead extract only comment text and run the regex against that: use
the TypeScript compiler API (e.g., ts.getLeadingCommentRanges and
ts.getTrailingCommentRanges on the SourceFile.getFullText()) or iterate over all
comment ranges via ts.forEachChild and collect comment ranges, concatenate their
substrings and call countMatches(commentsText, COMMENT_DIRECTIVE_RE) to compute
tsDirectiveCount; update any other uses (e.g., where `@ts-nocheck` was already
handled) to use the same comment-only extraction logic.
- Around line 392-504: The containsWeakType function is too large and should be
split into smaller per-node-kind helpers (e.g., handleParenthesizedType,
handleArrayType, handleTupleType, handleUnionIntersection, handleTypeLiteral,
handleTypeReference, handleFunctionOrConstructorType, handleConditionalType,
etc.) and a small dispatch table to call the correct handler for each
ts.TypeNode kind; each helper should accept (typeNode, aliases, seen) and return
boolean, preserve existing logic (including new Set(seen) where currently used),
and ensure containsWeakType becomes a thin dispatcher that delegates to these
helpers (or the map) to reduce cyclomatic complexity.

In `@src/lib/agent-defs.ts`:
- Around line 113-118: The code currently accepts any finite number for port
fields; update validation so ports are whole TCP port integers in the valid
range. In readNumberArray (and the equivalent single-number reader used for
health_probe.port) only accept entries where Number.isInteger(entry) is true and
entry >= 1 && entry <= 65535, filter out others and return undefined if no valid
ports remain; add the same integer+range check where health_probe.port is parsed
(referencing readNumberArray and the health probe parsing logic) so manifest
load fails fast on invalid ports.

---

Outside diff comments:
In `@nemoclaw/src/commands/migration-state.ts`:
- Around line 262-276: collectExternalRoots must accept and forward the
environment object so path resolution uses the same env as detectHostOpenClaw:
add an env parameter to collectExternalRoots and use it when calling
defaultWorkspacePath (e.g., defaultWorkspacePath(env)) and when resolving user
paths inside registerRoot (replace resolveUserPath(...) with
resolveUserPath(..., env) or otherwise pass env through to that helper); update
callers (including detectHostOpenClaw) to pass their env through so
workspace/default paths and any resolveUserPath uses are consistent across the
call chain (refer to functions collectExternalRoots, registerRoot,
defaultWorkspacePath, resolveUserPath, and detectHostOpenClaw).

In `@src/lib/onboard-session.ts`:
- Around line 706-729: summarizeForDebug currently redacts endpointUrl but
returns session.failure verbatim, which can leak tokens when called with an
in-memory session; update summarizeForDebug to re-sanitize the failure before
returning (e.g., call the existing normalizeSession or a dedicated redactFailure
helper to strip/replace bearer/API tokens and other secrets from
session.failure) and return the sanitized failure field instead of the raw
session.failure; reference summarizeForDebug, normalizeSession, redactUrl, and
createSession to locate where to apply the sanitization.

In `@src/lib/platform.ts`:
- Around line 90-103: getPodmanSocketCandidates currently returns Linux socket
paths for any non-"darwin" platform, which yields invalid candidates on
unsupported platforms like "win32"; update getPodmanSocketCandidates to
explicitly handle platforms: return macOS paths when
opts.platform/process.platform === "darwin", return Linux paths when platform
=== "linux" (using uid from opts.uid/process.getuid()), and return an empty
array for all other platforms so callers don't receive invalid socket paths.
Ensure references to opts.platform, process.platform, opts.uid, process.getuid,
and the uid variable remain correct when implementing the branching.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/type-safety-hotspots.ts`:
- Around line 883-884: The current scan only updates the file-level metric via
addPattern(fileMetrics, "tsDirectiveCount", countDirectiveComments(text)) and
never increments RawFunctionData.tsDirectiveCount, so inline TS suppressions
inside functions are missed by computeFunctionRawUnsafety() and
buildFunctionReasons(); modify the scanner that calls countDirectiveComments to
preserve each directive's position and, for each directive whose location falls
within the source range of the active functionStack entry, increment that
functionStack entry's RawFunctionData.tsDirectiveCount (and still increment the
fileMetrics counter), ensuring directive positions are captured and attributed
to the correct function.
- Around line 634-639: The matcher currently recognizes JSON.parse/JSON5.parse
and yaml.load (lowercase) plus YAML.parse (uppercase), but misses YAML.load
(uppercase); update the conditional that returns the parse boundary to also
match (owner.text === "YAML" && member === "load") and ideally consolidate the
YAML checks so both owner.text values ("YAML" and "yaml") accept both member
values ("parse" and "load")—modify the expression around the existing owner.text
=== "YAML"/"yaml" and member checks (the returned boolean expression) to include
these additional conditions or replace with a small set/array membership test to
cover both namespaces and both methods.