docs/security/best-practices.md (1)

233-247: Split this section to one sentence per line and drop the routine bold emphasis.

The new paragraph and default-row text pack multiple sentences onto single source lines, and **not** reads like emphasis the style guide explicitly asks us to avoid in routine prose. LLM pattern detected.

As per coding guidelines, "One sentence per line in source (makes diffs readable)." and "Unnecessary bold on routine instructions ... should be flagged."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/security/best-practices.md` around lines 233 - 247, Split the
highlighted paragraph and the "Default" table cell so each sentence is on its
own source line, and remove routine bold emphasis (e.g., change "The gateway
auth token is **not** baked..." to "The gateway auth token is not baked..." and
drop other unnecessary **...** formatting); update the "Runtime token
generation" and "Default" sentences similarly so every sentence in that section
is on a separate line and no routine instructions use bold.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard.ts (1)

6953-6959: ⚠️ Potential issue | 🟠 Major

Keep env-file fallback reachable when openclaw.json parse/read fails.

A read/parse error here is caught by the outer catch, which returns early and skips /tmp/nemoclaw-gateway-token.env fallback.

🩹 Proposed fix

     if (result.status === 0) {
       const jsonPath = findOpenclawJsonPath(tmpDir);
       if (jsonPath) {
-        const cfg = JSON.parse(fs.readFileSync(jsonPath, "utf-8"));
-        const token = cfg && cfg.gateway && cfg.gateway.auth && cfg.gateway.auth.token;
-        if (typeof token === "string" && token.length > 0) return token;
+        try {
+          const cfg = JSON.parse(fs.readFileSync(jsonPath, "utf-8"));
+          const token = cfg && cfg.gateway && cfg.gateway.auth && cfg.gateway.auth.token;
+          if (typeof token === "string" && token.length > 0) return token;
+        } catch {
+          // fall through to the env-file fallback below
+        }
       }
     }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lib/onboard.ts` around lines 6953 - 6959, The current block that reads
and parses openclaw.json (using findOpenclawJsonPath(tmpDir), fs.readFileSync
and JSON.parse) can throw and cause the outer catch to return early, skipping
the /tmp/nemoclaw-gateway-token.env fallback; change the logic so
reading/parsing openclaw.json is wrapped in its own try/catch (inside the
result.status === 0 branch) and on any read/parse error simply ignore the JSON
path and continue (do not rethrow or return), then fall back to reading the env
file (/tmp/nemoclaw-gateway-token.env) if no valid token found in cfg; ensure
the function still returns immediately only when a valid string token is found.

src/lib/onboard.ts (1)

6901-6914: Consolidate duplicate recursive search implementations.

findFileRecursive(...) and findOpenclawJsonPath(...) now duplicate the same traversal logic. Keep one recursive implementation and wrap specialized lookups around it.

♻️ Proposed refactor

 function findOpenclawJsonPath(dir: string): string | null {
-  if (!fs.existsSync(dir)) return null;
-  const entries = fs.readdirSync(dir, { withFileTypes: true });
-  for (const e of entries) {
-    const p = path.join(dir, e.name);
-    if (e.isDirectory()) {
-      const found: string | null = findOpenclawJsonPath(p);
-      if (found) return found;
-    } else if (e.name === "openclaw.json") {
-      return p;
-    }
-  }
-  return null;
+  return findFileRecursive(dir, "openclaw.json");
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lib/onboard.ts` around lines 6901 - 6914, There are two duplicate
directory-traversal implementations (findFileRecursive and
findOpenclawJsonPath); remove the duplicate by keeping a single recursive
utility (e.g., findFileRecursive) and make findOpenclawJsonPath simply call that
utility with the appropriate target name(s) or predicates; update any callers to
use the shared function and delete the redundant traversal code to avoid
maintenance drift (refer to functions findFileRecursive and findOpenclawJsonPath
to locate and consolidate the logic).

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

src/lib/onboard.ts (1)

6088-6094: ⚠️ Potential issue | 🟠 Major

JSON parse errors still prevent the env-file fallback path.

At Line 6091, a read/parse failure throws to the outer catch (Line 6112), so step 2 (/tmp/nemoclaw-gateway-token.env) is never attempted.

🩹 Suggested fix

     if (result.status === 0) {
       const jsonPath = findOpenclawJsonPath(tmpDir);
       if (jsonPath) {
-        const cfg = JSON.parse(fs.readFileSync(jsonPath, "utf-8"));
-        const token = cfg && cfg.gateway && cfg.gateway.auth && cfg.gateway.auth.token;
-        if (typeof token === "string" && token.length > 0) return token;
+        try {
+          const cfg = JSON.parse(fs.readFileSync(jsonPath, "utf-8"));
+          const token = cfg && cfg.gateway && cfg.gateway.auth && cfg.gateway.auth.token;
+          if (typeof token === "string" && token.length > 0) return token;
+        } catch {
+          // Continue to env-file fallback.
+        }
       }
     }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lib/onboard.ts` around lines 6088 - 6094, The JSON read/parse in the
openclaw JSON block can throw and short-circuit the env-file fallback; wrap the
file read+JSON.parse for the path returned by findOpenclawJsonPath(tmpDir) in a
local try/catch so parse/read errors are swallowed (or logged) and control falls
through to the subsequent env-file fallback (do not return or rethrow on parse
failure). Specifically, locate the block that calls
findOpenclawJsonPath(tmpDir), JSON.parse(fs.readFileSync(...)) and extracts
gateway.auth.token, and change it so only a successfully parsed string token
causes an immediate return, while any exception simply skips to the next step.

scripts/nemoclaw-start.sh (1)

677-708: ⚠️ Potential issue | 🟠 Major

Make the config rename durable before updating .config-hash.

The temp-file + os.replace() closes the truncation window, but the containing directory is never fsync'd. A crash after the replace but before that directory entry is durable can leave the old openclaw.json alongside a new .config-hash, which will trip verify_config_integrity() on the next boot.

💡 Minimal durability fix

   python3 - "$config_file" "$token" <<'PYINJECT'
 import json, os, sys, tempfile

 config_file, token = sys.argv[1], sys.argv[2]
+dir_name = os.path.dirname(config_file) or "."
+dir_fd = os.open(dir_name, os.O_RDONLY)

 with open(config_file) as f:
     cfg = json.load(f)

 cfg.setdefault("gateway", {}).setdefault("auth", {})["token"] = token

-dir_name = os.path.dirname(config_file) or "."
 fd, tmp_path = tempfile.mkstemp(dir=dir_name, prefix=".openclaw.json.")
 try:
     with os.fdopen(fd, "w") as f:
         json.dump(cfg, f, indent=2)
         f.flush()
         os.fsync(f.fileno())
     os.chmod(tmp_path, 0o444)
     os.replace(tmp_path, config_file)
+    os.fsync(dir_fd)
 except Exception:
     try:
         os.unlink(tmp_path)
     except FileNotFoundError:
         pass
     raise
+finally:
+    os.close(dir_fd)
 PYINJECT

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/nemoclaw-start.sh` around lines 677 - 708, The atomic replace leaves
the directory entry not yet durable; after calling os.replace(tmp_path,
config_file) in the Python block, open the containing directory (use
os.open(dir_name, os.O_RDONLY) or os.O_DIRECTORY) and call os.fsync(dir_fd) then
close the fd so the rename is flushed to disk before the script updates the
.config-hash; this ensures the directory entry for openclaw.json is durable
prior to running the sha256sum step. Reference: the Python temp-file flow using
tempfile.mkstemp, os.replace(tmp_path, config_file), and the subsequent
sha256sum update; add the dir fsync right after os.replace and before leaving
the try block.