Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/actions/sandbox/rebuild.ts`:
- Around line 108-125: The auth-method detection can incorrectly default to
"oauth" when session?.hermesAuthMethod and state?.auth_method are missing even
though an exported NOUS_API_KEY exists; update the logic around
normalizeHermesRebuildAuthMethod(...) and
hermesProviderAuth.HERMES_NOUS_API_KEY_CREDENTIAL_ENV so that the presence of
hydrateCredentialEnv(hermesProviderAuth.HERMES_NOUS_API_KEY_CREDENTIAL_ENV)
forces the chosen authMethod to "api_key". Concretely, compute envKey =
hydrateCredentialEnv(...), then set authMethod = "api_key" if envKey is truthy
(even if normalizeHermesRebuildAuthMethod returned null/undefined), and keep the
existing branches that check api_key vs oauth (functions/variables to touch:
normalizeHermesRebuildAuthMethod,
hermesProviderAuth.HERMES_NOUS_API_KEY_CREDENTIAL_ENV, hydrateCredentialEnv,
authMethod, credentialEnv, session?.hermesAuthMethod, state?.auth_method).

In `@src/lib/hermes-provider-auth.ts`:
- Around line 226-240: The registration currently ignores the negotiated base
URL and falls back to oauth.DEFAULT_INFERENCE_BASE_URL when persisting provider
info; update registerHermesInferenceProvider to pass the chosen baseUrl through
to the helper that persists API-key credentials, and modify
ensureHermesProviderApiKeyCredentials to accept a baseUrl parameter and use it
when calling upsertProvider (so HERMES_PROVIDER_NAME and the credential entry
are stored with the negotiated baseUrl rather than DEFAULT_INFERENCE_BASE_URL);
ensure all call sites of ensureHermesProviderApiKeyCredentials (including where
registerHermesInferenceProvider is invoked) are updated to forward the baseUrl.
- Line 1: Remove the top-level "// `@ts-nocheck`" and add explicit TypeScript
types across this CLI auth module: annotate all function signatures, parameter
and return types in exported functions, and type the imported symbols (e.g., the
oauth import, onboardProviders, and any credential/state objects) to match the
shapes used by the typed oauth-device-code.ts implementation; ensure the module
is type-checked under tsconfig.cli.json, add or reference appropriate
interfaces/types for device-code responses, token objects, and provider configs,
and update any untyped usages to satisfy the compiler.

In `@src/lib/inference/model-prompts.ts`:
- Around line 187-225: The topLevelLimit is ignored unless otherShowsFullList is
true because visibleOptions falls back to modelOptions; change visibleOptions to
always be modelOptions.slice(0, topLevelLimit) (use topLevelLimit computed
above) so the menu shows the top-N + "Other..." option regardless of
otherShowsFullList, adjust defaultChoice to treat the "Other..." entry
(visibleOptions.length + 1) as the fallback when defaultIndex is outside
visibleOptions regardless of shouldOfferFullList, and keep the branch that
handles index === visibleOptions.length but choose between
promptFullRemoteModelList and promptManualModelId based on shouldOfferFullList;
update references: topLevelLimit, shouldOfferFullList, visibleOptions,
defaultChoice, promptFullRemoteModelList, promptManualModelId, modelOptions,
options.otherShowsFullList.

In `@src/lib/oauth-device-code.ts`:
- Around line 210-218: The success path that parses TokenResponse only checks
for refresh_token; update the resp.status === 200 handling (the block that casts
to TokenResponse) to also validate that payload.access_token is present and
non-empty and throw an OAuthError (similar to the existing
"token_response_missing_refresh_token") when it's missing; ensure you reference
TokenResponse and reuse OAuthError for a clear error code/message so we never
return/persist a payload missing access_token.

---

Outside diff comments:
In `@src/lib/actions/sandbox/rebuild.ts`:
- Around line 242-260: The logic in sessionMatchesTarget currently treats a
missing session.sandboxName as a match, letting orphaned sessions supply
provider/credentialEnv; change sessionMatchesTarget to only be true when
session.sandboxName is present and equals sandboxName (i.e. session?.sandboxName
=== sandboxName). This will ensure
getRebuildCredentialEnvFromRegistry(sb.provider) is used when sandboxName is
unknown and that rebuildCredentialEnv and rebuildProvider (referenced by
rebuildCredentialEnv, sessionMatchesTarget, rebuildProvider,
getRebuildCredentialEnvFromRegistry) come from the registry unless the session
explicitly belongs to the target sandbox.

In `@src/lib/onboard.ts`:
- Around line 4151-4164: The preflight check erroneously compares the numeric
port to DASHBOARD_PORT, rejecting custom dashboard ports; update the conditional
inside the requiredPorts loop (where checkPortAvailable is used) to detect the
dashboard entry by its envVar instead of only DASHBOARD_PORT—e.g. replace the
`(port === GATEWAY_PORT || port === DASHBOARD_PORT)` check with `(port ===
GATEWAY_PORT || envVar === "NEMOCLAW_DASHBOARD_PORT")` (or include both port ===
DASHBOARD_PORT || envVar === "NEMOCLAW_DASHBOARD_PORT") so custom
`--control-ui-port` values (the port variable) are treated as the dashboard and
can be reused when `gatewayReuseState === "healthy"`.

---

Nitpick comments:
In `@src/lib/onboard.ts`:
- Around line 1583-1598: The selectOnboardAgent function signature and option
type should be simplified to remove unused resume and canPrompt parameters:
update the selectOnboardAgent declaration and its parameter type to only accept
agentFlag and session, and ensure the call to agentOnboard.resolveAgent({
agentFlag, session }) remains unchanged; adjust any TypeScript types or JSDoc
for selectOnboardAgent to reflect the new two-parameter contract so callers
(e.g., the place passing resume/canPrompt) no longer expect those options.

In `@src/lib/state/onboard-session.ts`:
- Line 130: Constrain the hermesAuthMethod field to a strict union and validate
it before persisting/reading: change the hermesAuthMethod declaration on the
OnboardSession shape to the union type "oauth" | "api_key" (or undefined), add a
small type-guard/validation where the session is written
(validateHermesAuthMethod(value): value is "oauth" | "api_key") and use it to
reject or coerce any other string before saving, and likewise validate/normalize
when loading the session (return undefined or a safe default for invalid
values). Update all places that set or read hermesAuthMethod to use the new
union type and guard (references: hermesAuthMethod, OnboardSession, and the
read/write locations noted in the comment).

In `@test/hermes-provider-foundation.test.ts`:
- Around line 34-38: The spawnSync invocations in
hermes-provider-foundation.test.ts currently pass a full copy of process.env
(e.g. the spawnSync call that produces result) which can leak DISCORD_* or
TELEGRAM_* values; create a sanitizedEnv by shallow-copying process.env, delete
any keys that start with "DISCORD_" or "TELEGRAM_" (e.g. using
Object.keys(safeEnv).forEach(k => { if (/^(DISCORD_|TELEGRAM_)/.test(k)) delete
safeEnv[k]; })), then pass env: { ...safeEnv, HOME: tmpDir } to spawnSync; apply
the same change to the other spawnSync sites in this test file so all onboarding
tests are hermetic.