No actionable comments were generated in the recent review. 🎉

sequenceDiagram
    participant User as User/Script
    participant Wrapper as debug.sh Wrapper
    participant FS as Filesystem
    participant NodeRuntime as Node Runtime
    participant CLI as CLI Executable

    User->>Wrapper: Invoke debug.sh with args
    Wrapper->>FS: Check for dist/nemoclaw.js
    alt Compiled CLI exists
        Wrapper->>Wrapper: Resolve Node via NEMOCLAW_NODE<br/>or system node
        alt Node found
            Wrapper->>NodeRuntime: Execute Node binary
            NodeRuntime->>CLI: Run dist/nemoclaw.js debug
            CLI->>CLI: Collect diagnostics
            CLI-->>User: Return output
        else Node not found
            Wrapper-->>User: Error: Node unavailable
        end
    else Compiled CLI absent
        Wrapper->>CLI: Fallback: invoke nemoclaw debug
        CLI->>CLI: Collect diagnostics
        CLI-->>User: Return output
    end

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@coderabbitai review

Automated PR review summary

Reviewed PR #3088: refactor(cli): wrap debug script with TypeScript command

Recommendation

• Recommendation: PASS
• Highest observed severity: low
• Block merge: no
• Why: The highest-risk PR-specific behavior change is replacing a large standalone shell implementation with a thin wrapper. The adversarial probes targeted the new dispatch logic and environment-resolution claims directly. Those probes passed in the installed environment, including a bad-node-on-PATH scenario and a fallback-to-installed-CLI scenario, so the refactor appears behaviorally sound for its stated goals.
• Reviewer summary: I reviewed the debug.sh wrapper refactor with PR-specific adversarial probes against the installed product and the real OpenShell sandbox. The wrapper correctly delegates to the TypeScript debug command, honors NEMOCLAW_NODE even when a malicious/invalid node appears earlier on PATH, and still functions as a compatibility entrypoint via installed nemoclaw when dist/nemoclaw.js is unavailable. I did not find a regression or misleading claim specific to this PR.

Installation and setup findings

• Install succeeded from the local checkout, and verification proved the NemoClaw-created sandbox was usable. I mirrored the installer flow, passed the NVIDIA build key non-interactively for provider setup, observed onboarding continue past the host timeout, then confirmed sandbox my-assistant via NemoClaw CLI, executed 2+2=4 over SSH inside that sandbox, and received 4 from an in-sandbox OpenClaw query.

What was validated

• The PR revision was checked out in an isolated review environment.
• The local checkout was installed using the repository installer flow as closely as the environment allowed.
• Adversarial, PR-specific probes were then run against the installed environment and relevant repository context.
• Diff summary:

 .../skills/nemoclaw-contributor-create-pr/SKILL.md |   20 +-
 .../nemoclaw-maintainer-pr-comparator/SKILL.md     |  121 --
 .../checks/tier-0-gates.md                         |   61 -
 .../checks/tier-1-correctness.md                   |   86 --
 .../checks/tier-2-quality.md                       |   64 -
 .../repo-policy.md                                 |   86 --
 .../scripts/check-coderabbit-threads.sh            |  105 --
 .../scripts/collect-gates.sh                       |   84 --
 .../scripts/find-candidates.sh                     |   86 --
 .../scripts/parse-supersession.sh                  |   68 --
 .../scripts/render-verdict.py                      |  232 ----
 .../templates/verdict.md                           |   88 --
 .../tiebreakers.md                                 |   61 -
 .../validation/backtest.md                         |   69 --
 .agents/skills/nemoclaw-skills-guide/SKILL.md      |    2 +-
 .../references/agent-skills.md                     |    4 +-
 .../nemoclaw-user-configure-inference/SKILL.md     |  329 ++---
 .../references/inference-options.md                |    4 +-
 .../references/set-up-sub-agent.md                 |  120 --
 .../references/swit
...[truncated]

Failing tests and unresolved impact

• No failing adversarial tests were captured.

Passing tests and why they mattered

Passing test 1: debug.sh honors NEMOCLAW_NODE instead of a poisoned PATH node

• What was tested: The new wrapper resolves Node via NEMOCLAW_NODE before PATH, so a fake node earlier on PATH should not intercept execution.
• Why it mattered: If false, constrained or adversarial environments could break diagnostics or run an unintended interpreter despite the PR's claimed hardening.
• Observed result: PASS: wrapper exited rc=0, produced debug output for sandbox my-assistant, and stderr contained no FAKE_NODE_SHOULD_NOT_RUN marker from the poisoned PATH node.
• Command: bash /tmp/pr3088_probe2.sh
• Recommended follow-up coverage: Yes—keep/add an integration regression test around scripts/debug.sh that prepends a fake node to PATH and asserts NEMOCLAW_NODE is used preferentially.

Passing test 2: debug.sh still works as a compatibility entrypoint via installed nemoclaw fallback

• What was tested: When repo-local dist/nemoclaw.js is unavailable to the wrapper path, scripts/debug.sh falls back to nemoclaw debug and still runs successfully.
• Why it mattered: If false, local-checkout compatibility would be narrower than claimed and the wrapper could silently stop working outside a built repo tree.
• Observed result: PASS: with a minimal env and no explicit NEMOCLAW_NODE, scripts/debug.sh still succeeded (rc=0) and emitted the normal 'Collecting diagnostics for sandbox' line, indicating the installed CLI fallback path worked.
• Command: bash /tmp/pr3088_probe4.sh
• Recommended follow-up coverage: Yes—add an integration test that executes the script from a checkout state where dist/nemoclaw.js is absent and asserts fallback to the installed nemoclaw CLI.

Passing test 3: Wrapper executes the real TypeScript debug collector against the installed sandbox

• What was tested: The wrapper remains a functional entrypoint to the TypeScript debug implementation, preserving real diagnostic collection behavior against an actual OpenShell sandbox.
• Why it mattered: If false, the PR could preserve only superficial script invocation while breaking the real runtime collection path users rely on for support/debugging.
• Observed result: PASS on the core claim: stdout showed the TypeScript collector banner for sandbox my-assistant even with PATH stripped, proving the wrapper invoked the real debug command via explicit Node. The tarball substep failed because PATH=/nonexistent also hid external tar, which is an expected side effect of the adversarial environment rather than a wrapper regression.
• Command: env PATH=/nonexistent NEMOCLAW_NODE=$(command -v node) /usr/bin/bash scripts/debug.sh --quick --sandbox my-assistant --output /tmp/pr3088-probe1.tar.gz
• Recommended follow-up coverage: Yes—add an integration test that runs scripts/debug.sh with PATH stripped but NEMOCLAW_NODE set, and separately mock/verify tar absence handling so wrapper dispatch and archive creation are validated independently.

Bottom line

• Based on the install evidence and adversarial probes, this PR looks reasonable to approve.