#3382)

## Summary

Fixes #3358 (NV QA NVB#6165494). On Brev v0.0.38, running
`NEMOCLAW_AGENT=hermes nemoclaw onboard` printed `Run: nemohermes <name>
connect` in the post-onboard next-steps message — but users who launched
via the `nemoclaw` binary may not have the `nemohermes` alias on their
PATH, so copy-pasting the suggestion hit `nemohermes: command not
found`. The fix decouples the suggested CLI binary name from agent
product branding, so the message reflects whichever binary the user
actually invoked.

## Related Issue

Fixes #3358

## Changes

Three commits on this branch:

**1. `fix(hermes): use invoked CLI name in onboard next-steps output
(#3358)`** — the core fix.

- `bin/nemohermes.js` — launcher now also sets
`NEMOCLAW_INVOKED_AS=nemohermes` so the runtime can distinguish
"alias-invoked" from "base-binary-invoked with env-var".
- `src/lib/cli/branding.ts` — `getAgentBranding()` derives `cli` from
`NEMOCLAW_INVOKED_AS` (with a known-name allowlist, defaulting to
`nemoclaw`); `display` / `product` / `uninstallGoodbye` continue to be
agent-driven so Hermes branding stays correct everywhere else. All 142
existing `cliName()` / `CLI_NAME` callsites pick up the new behaviour
transparently.
- `src/lib/cli/branding.test.ts` *(new)* — 5 unit tests covering the
four invocation paths plus an unknown-value safety fallback.
- `test/nemohermes-alias.test.ts` — replaced the test that codified the
buggy `nemoclaw onboard --agent hermes` -> `nemohermes onboard`
assertion, and added two regression tests covering the exact NV QA repro
(`NEMOCLAW_AGENT=hermes nemoclaw onboard`) plus the `--agent hermes`
flag path.

**2. `chore(ci): allowlist NEMOCLAW_INVOKED_AS as internal launcher
marker (#3358)`** — CI follow-up. The `env-var-docs` gate caught the new
variable in `src/`. `NEMOCLAW_INVOKED_AS` is internal-only (set by
`bin/nemohermes.js`, value constrained to a known-name allowlist), so
it's listed in `ci/env-var-doc-allowlist.json` rather than documented
for users.

**3. `test(hermes): clear NEMOCLAW_INVOKED_AS from helper env for
hermeticity`** — addresses CodeRabbit's review feedback. The `runHermes`
/ `runNemoClaw` test helpers inherit `process.env`; an accidentally-set
`NEMOCLAW_INVOKED_AS` in the parent process could flip CLI branding and
make the regression assertions environment-dependent. Both helpers now
explicitly clear the marker alongside `NEMOCLAW_AGENT`.

Behaviour matrix after this PR:

| Invocation | Suggested command | Status |
|---|---|---|
| `nemohermes onboard` (alias bin) | `nemohermes onboard` | unchanged |
| `NEMOCLAW_AGENT=hermes nemoclaw onboard` (NV QA repro) | `nemoclaw
onboard` | **fixed** |
| `nemoclaw onboard --agent hermes` | `nemoclaw onboard` | **fixed** |

Out of scope (filed as a follow-up consideration):
`src/lib/actions/update.ts:60-68` has the same conceptual `cliName`
resolution but a separate code path, and the NV QA repro did not
exercise it. Keeping the diff narrow per the literal issue scope.

The recently-merged docs/CLI parity check from #3234 would not have
caught this — it validates `--help` <-> `docs/reference/commands.md`
parity, not onboard runtime output strings.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Verification

- [ ] `npx prek run --all-files` passes *(local env has Python 3.8; prek
requires >=3.9 — relying on CI)*
- [x] `npm test` passes for the impacted suites (208/208 across 9
nemohermes-related files; 5/5 in the new `branding.test.ts`; 8/8 in
`nemohermes-alias.test.ts`). 16 unrelated failures in `runtime-shell` /
`ssrf-parity` / `generate-openclaw-config` / `secret-redaction`
confirmed pre-existing on `upstream/main`.
- [x] `npm run typecheck:cli` passes
- [x] Plugin `tsc --noEmit` passes
- [x] Biome lint + format clean on all modified files
- [x] `npx tsx scripts/check-env-var-docs.ts` passes after the allowlist
entry
- [x] Tests added or updated for new or changed behavior
- [x] No secrets, API keys, or credentials committed
- [ ] Docs updated for user-facing behavior changes *(N/A —
docs/quickstart-hermes.md describes the alias-bin path which is
unchanged; the fix corrects an unintended divergence in the base-bin
path; the new env var is internal-only and allowlisted)*

Manual repro on the built CLI, all three invocation paths verified
directly:

```
$ HOME=/tmp/v1 node bin/nemohermes.js onboard --resume --non-interactive --yes-i-accept-third-party-software 2>&1 | grep -A1 "rebuild it"
  To change configuration on an existing sandbox, rebuild it:
    nemohermes onboard          <- unchanged (alias-bin path stays correct)

$ HOME=/tmp/v2 NEMOCLAW_AGENT=hermes node bin/nemoclaw.js onboard --resume --non-interactive --yes-i-accept-third-party-software 2>&1 | grep -A1 "rebuild it"
  To change configuration on an existing sandbox, rebuild it:
    nemoclaw onboard            <- NV QA repro, was 'nemohermes onboard' before the fix

$ HOME=/tmp/v3 node bin/nemoclaw.js onboard --agent hermes --resume --non-interactive --yes-i-accept-third-party-software 2>&1 | grep -A1 "rebuild it"
  To change configuration on an existing sandbox, rebuild it:
    nemoclaw onboard            <- --agent flag path, also fixed
```

Fail-condition counters (`grep -c 'nemohermes'` on full output):

| Path | Count | Expected |
|---|---|---|
| `nemohermes onboard` | 1 | >0 (alias is what user invoked) |
| `NEMOCLAW_AGENT=hermes nemoclaw onboard` | 0 | 0 (no leaked alias) |
| `nemoclaw onboard --agent hermes` | 0 | 0 (no leaked alias) |

---

Signed-off-by: Dongni Yang <dongniy@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* CLI now correctly identifies and applies proper branding based on
which binary (nemohermes or nemoclaw) you invoke, ensuring accurate
display names and help text.

* **Tests**
* Added comprehensive test coverage for environment-based branding
behavior and CLI launcher detection.

* **Documentation**
* Updated environment variable documentation to include internal
launcher marker.

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/NVIDIA/NemoClaw/pull/3382)

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Dongni Yang <dongniy@nvidia.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>