Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@Dockerfile`:
- Around line 152-217: This Dockerfile introduces runtime-altering patches to
OpenClaw (see OC_DIST and patched symbols like withStrictGuardedFetchMode →
withTrustedEnvProxyGuardedFetchMode, assertExplicitProxyAllowed,
replaceConfigFile, and DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS), so gate the PR
with the E2E suites before merge: add required CI status checks or a pre-merge
pipeline that runs cloud-e2e, sandbox-survival-e2e, hermes-e2e, and
rebuild-openclaw-e2e and block merging until they pass (ensure the check names
match these suites and attach them to this Dockerfile change/patch block).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/rcf_patch.py`:
- Around line 16-23: The regex is too broad and spacing-sensitive: change the
search to first extract only the replaceConfigFile function body (anchor on the
function declaration name replaceConfigFile) and then run the pattern against
that substring, and relax the "!await" match to allow whitespace (use
"!\\s*await" instead of "!await") so it matches variants with spaces; keep the
rest of the pattern targeting the tryWriteSingleTopLevelIncludeMutation and
writeConfigFile call sites to ensure only the intended block is patched.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@Dockerfile`:
- Around line 152-198: This change alters Dockerfile image-layer patching
(patches touching OC_DIST, rcf_patch.py, replaceConfigFile, OPENSHELL_SANDBOX
behavior and install-safe-path/install-package-dir edits) and must be validated
by running the full Dockerfile E2E matrix before merging: run cloud-e2e,
sandbox-survival-e2e, hermes-e2e, and rebuild-openclaw-e2e against this branch
(build the container to exercise the sed/python patches and check
replaceConfigFile EACCES warning, install-safe-path/stat and install-package-dir
symlink behavior), capture logs/artifacts for any failures, and post the passing
results or failing test output to the PR for reviewer signoff.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@scripts/install.sh`:
- Around line 320-362: The watcher is being launched and later treated as a
success even when curl is unavailable, causing false success and restart thrash;
guard watcher creation and the success check by ensuring curl is present: before
writing watcher_script and spawning the detached Node watcher (the block that
defines watcher_script and the node -e spawn), add a check that command_exists
curl is true and only then start the watcher, and remove or change the later
branch that returns 0 when curl is missing (the block that reads watcher_pid and
returns 0 if !command_exists curl && [[ -n "$watcher_pid" ]] ...) so we do not
treat a running watcher as healthy without curl. Use the symbols watcher_script,
tick/healthy (in the embedded script), the node -e spawn invocation, and
watcher_pid to locate and update the logic.

In `@src/lib/build-context.ts`:
- Around line 76-83: The TLS recovery hint prints a hard-coded gateway name
("nemoclaw") which mixes branding; in the failure.kind === "tls_cert_mismatch"
branch replace the literal "openshell gateway trust -g nemoclaw" string with one
that uses the CLI_NAME constant (e.g. use string interpolation so the command
reads `${CLI_NAME} gateway trust -g ${CLI_NAME}` or similar) so the trust hint
and the resume hint both use CLI_NAME consistently.

In `@src/lib/local-inference.ts`:
- Around line 79-80: getResolvedOllamaHost() currently returns
_resolvedOllamaHost or OLLAMA_LOCALHOST without attempting to resolve the actual
reachable host; update it to call findReachableOllamaHost() when
_resolvedOllamaHost is unset so WSL/docker cases (e.g., host.docker.internal)
are discovered before falling back to OLLAMA_LOCALHOST; specifically, inside
getResolvedOllamaHost() call findReachableOllamaHost(), await or handle its
result as appropriate, assign that value to _resolvedOllamaHost, and then return
_resolvedOllamaHost or OLLAMA_LOCALHOST as a final fallback.

In `@src/lib/nim.ts`:
- Around line 96-113: The perGpuMB field currently uses parsed[0].memoryMB which
misreports heterogeneous hosts; update the logic in the block that builds the
return object (using parsed: ParsedGpu[], allSameName, canRunNimWithMemory) to
only set perGpuMB when every GPU has the same memory (compute a new
allSameMemory check like parsed.every(p => p.memoryMB === parsed[0].memoryMB))
or else omit/leave perGpuMB undefined; leave totalMemoryMB and nimCapable as-is.

In `@src/lib/onboard-ollama-proxy.ts`:
- Around line 497-548: unloadOllamaModels currently fires the /api/ps GET and
spawns /api/generate POSTs but returns immediately; change unloadOllamaModels to
return a Promise that resolves after the /api/ps response is fully parsed and
all unload POSTs have completed (or rejected on fatal error). Implement by
wrapping the initial http.get call in a Promise, collecting per-unload request
Promises (resolve on 'finish' or 'end' and reject on 'error' or timeout) for
each unloadReq created in the loop, and resolve the main Promise only after
Promise.all of those unload Promises settles; keep the best-effort semantics by
handling individual unload errors but ensure the returned Promise only settles
when all unload attempts have finished so callers can await it.

In `@src/lib/onboard.ts`:
- Around line 4582-4589: The vllm-local ambiguity is being collapsed too early
by providerNameToOptionKey (or the name === "vllm-local" mapping) because it
maps "vllm-local" to "vllm" whenever opts.hasNimContainer is falsy, which
prevents the downstream ambiguity branch from running during non-interactive
recovery; update the mapping logic (providerNameToOptionKey or the initial name
normalization) to preserve the "vllm-local" sentinel when recovery is
non-interactive or when ambiguity needs to be resolved (e.g., check
opts.recoveryNonInteractive or equivalent) so the later code that inspects
opts.hasNimContainer and the ambiguity branch can run, and only collapse
"vllm-local" to "vllm" when it is safe (explicit hasNimContainer true/false in
interactive flows) — adjust callers referencing name === "vllm-local" and
opts.hasNimContainer accordingly to handle the preserved sentinel.

In `@src/lib/sandbox-build-context.ts`:
- Around line 78-80: The optimized build context is missing scripts/rcf_patch.py
caused by the whitelist used when creating the optimized root-scripts; update
the whitelist logic in sandbox-build-context.ts (the code that copies from
sourceBlueprintDir to stagedBlueprintDir using fs.cpSync and path.join) to
include "scripts/rcf_patch.py" so the optimized build context contains that
file; locate the whitelist/allowedFiles array or function that filters
root-scripts and add "scripts/rcf_patch.py" (or broaden the scripts/* inclusion)
so the Dockerfile COPY for scripts/rcf_patch.py will find the file during
optimized builds.

In `@src/nemoclaw.ts`:
- Around line 3852-3855: The error message printed when the Docker container
probe fails is misleadingly saying "Failed to query live sandbox state from
OpenShell"; update the messaging in the probe failure branches (the check that
calls probeGatewayRunning() around the if block and the similar branch at lines
handling the Docker probe near 3917-3920) to clearly indicate a Docker
probe/container health check failure (e.g., mention "Docker probe" or "container
probe" and the probe function name probeGatewayRunning) so operators know the
failure originated from the Docker/container probe rather than an OpenShell
query; modify both branches to use consistent, explicit text and include any
available probe error details if present.
- Around line 3838-3845: The gateway probe uses dockerInspect in
probeGatewayRunning and lacks a timeout; modify the dockerInspect invocation to
pass the shared OPENSHELL_PROBE_TIMEOUT_MS as the operation timeout (alongside
the existing ignoreError and suppressOutput options) so the call fails fast when
Docker is unresponsive; update the dockerInspect call in probeGatewayRunning to
include the timeout option and keep the existing return logic based on
result.status and result.stdout.

---

Outside diff comments:
In `@src/lib/onboard.ts`:
- Around line 3658-3666: The second URL construction using new URL(...) when
process.env.CHAT_UI_URL lacks "://" can throw on malformed values; update the
block that sets parsed (the branch where controlUiPort == null) to validate or
wrap the parse in a try/catch (around new URL and subsequent parsed.port
assignment) and handle failures by falling back to a safe default or skipping
chatUiUrl assignment so sandbox creation doesn't abort; reference the
variables/idents involved: process.env.CHAT_UI_URL, controlUiPort, parsed,
effectivePort, and chatUiUrl.
- Line 1545: The function agentSupportsWebSearch() currently only detects ARG
lines that include an equals sign; update its regex to also match the valid
Dockerfile form without a default value. Replace the current
/^\s*ARG\s+NEMOCLAW_WEB_SEARCH_ENABLED=/m test with a pattern that allows either
an equals sign with an optional value or the end of the token (for example
matching /^\s*ARG\s+NEMOCLAW_WEB_SEARCH_ENABLED(?:\s*=.*)?/m or
/^\s*ARG\s+NEMOCLAW_WEB_SEARCH_ENABLED(?:\s*=|$)/m), ensuring whitespace is
tolerated; keep the change localized to agentSupportsWebSearch().

In `@src/lib/services.ts`:
- Around line 304-324: The banner's fixed pad width (padEnd(52)) in the services
display causes the right border to misalign when AGENT_PRODUCT_NAME makes the
line longer; update the rendering to compute the box width dynamically from the
longest rendered line (use the strings built for CLI_DISPLAY_NAME + " Services",
the Public URL line when tunnelUrl exists, and the Messaging line that
concatenates AGENT_PRODUCT_NAME) and then pad each line to that computed width
(instead of hardcoded 52) before printing the top/bottom borders and side bars;
adjust the padEnd calls and border strings accordingly so CLI_DISPLAY_NAME,
AGENT_PRODUCT_NAME, and tunnelUrl are all referenced in the width calculation
and stay within the box.

---

Nitpick comments:
In `@Dockerfile`:
- Around line 371-495: The PR touches Dockerfile image-layer and
runtime-permission logic (the large RUN migration block and subsequent RUN
chown/chmod and sha256sum steps) but the reviewer requests you run the required
E2E matrices before merging; please execute cloud-e2e, sandbox-survival-e2e,
hermes-e2e, and rebuild-openclaw-e2e against this image change, capture and
attach the failing/passing job logs, and only merge if all pass (or document any
accepted failures with rationale), referencing the Dockerfile RUN migration
block, the chown/chmod lines, and the .config-hash creation so reviewers can
correlate test results to the exact changes.

In `@src/lib/onboard.ts`:
- Around line 7685-8359: This change touches core onboarding logic in function
onboard (src/lib/onboard.ts), so before merging run the targeted E2E matrix to
catch regressions: execute cloud-e2e, sandbox-operations-e2e, and
rebuild-openclaw-e2e on this branch and verify resume/reuse/rebuild paths
(resume, gateway/sandbox reuse, inference/provider selection, sandbox
create/rebuild, and agent/openclaw setup) all pass; if any fail, reproduce
locally against the failing step in onboard (e.g., provider_selection,
inference, sandbox, gateway, openclaw) and fix the failing logic before merging.

In `@src/lib/sandbox-state.ts`:
- Around line 559-566: Run the end-to-end tests to validate backup/restore
behavior for the lifecycle-path changes: on this branch execute the
snapshot-commands-e2e (snapshot create/list/restore lifecycle) and
rebuild-openclaw-e2e (workspace state survives rebuild) suites and confirm they
pass; focus validation around the backup/restore flow exercised by
backupSandboxState (and the related code around lines ~803-815) to ensure
sandbox state backup and restore work correctly after your changes before
merging.

In `@src/nemoclaw.ts`:
- Around line 3835-3922: The PR touches snapshot/gateway probing and recovery
(functions probeGatewayRunning and sandboxSnapshot) and per the repo guidelines
you must run the targeted E2E suites before merging: run sandbox-survival-e2e,
sandbox-operations-e2e, and skip-permissions-e2e (nightly/targeted) and attach
their green CI artifacts; if any test fails, reproduce locally against your
branch and fix regressions in probeGatewayRunning/sandboxSnapshot before
re-running tests. Ensure the test run names and results are included in the PR
description or CI status so reviewers can confirm the required E2E suites
passed.