fix(sandbox): resolve OpenClaw workspace templates from installed pac… by IronLung7 · Pull Request #3449 · NVIDIA/NemoClaw

IronLung7 · 2026-05-13T08:38:13Z

…kage

Summary

Fix empty default workspaces when OpenClaw bootstrap is skipped.

NemoClaw sets agents.defaults.skipBootstrap=true to avoid the interactive identity setup turn. OpenClaw normally seeds workspace template files during that bootstrap path, so NemoClaw added its own seeding step. However, the seeder only looked under $(npm root -g)/openclaw/....

In the sandbox, npm root -g can resolve to /tmp/npm-global/lib/node_modules, while the bundled OpenClaw package and templates are installed under /usr/local/lib/node_modules/openclaw. That made the seeder miss the real templates and leave /sandbox/.openclaw/workspace/ empty.

Related Issue

Fixes #3240

Changes

Resolve OpenClaw workspace templates from multiple package roots:
- $(npm root -g)/openclaw
- /usr/local/lib/node_modules/openclaw
- the package root inferred from command -v openclaw
Support both source and dist template layouts:
- docs/reference/templates
- dist/docs/reference/templates
Keep the behavior conservative: no synthetic fallback templates are generated if OpenClaw templates are missing.
Use the shared sandbox step-down prefix for root-mode seeding.
Add regression coverage for default template discovery, binary-root discovery, missing-template behavior, skipBootstrap gating, no-clobber behavior, and symlink refusal.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Verification

npx prek run --all-files passes
npm test passes
Tests added or updated for new or changed behavior
No secrets, API keys, or credentials committed
Docs updated for user-facing behavior changes
make docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Leo Zhu lingyuez@nvidia.com

Summary by CodeRabbit

Improvements
- Improved workspace template discovery: searches multiple candidate locations and records attempted paths for better resolution and diagnostics
- Template seeding now runs via the standard privilege-drop wrapper for safer permission handling
- Seeding won’t overwrite existing files, refuses symlinked workspaces, and respects explicit bootstrap skip
Tests
- Added comprehensive tests covering template seeding, layout resolution, skip/bootstrap behavior, and safety checks

copy-pr-bot · 2026-05-13T08:38:17Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

coderabbitai · 2026-05-13T08:38:26Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

seed_default_workspace_templates now probes multiple candidate OpenClaw package roots (global npm root, system path, binary package dir), searches multiple template subpaths, and logs tried locations. Root-mode invocation uses STEP_DOWN_PREFIX_SANDBOX. A Vitest suite validates discovery variants, seeding behavior, safety checks, and the startup invocation.

Changes

Template Seeding Discovery and Execution

Layer / File(s)	Summary
Template discovery and seeding logic enhancement `scripts/nemoclaw-start.sh`	`seed_default_workspace_templates` now collects candidate OpenClaw package roots from global `npm root -g`, packaged `/usr/local/...`, and resolved binary package dir; searches multiple `docs/reference/templates` and `dist/...` subpaths; sets `templates_dir` on first match and logs tried paths when none found.
Privilege step-down invocation update `scripts/nemoclaw-start.sh`	Root startup switches from an inline `gosu sandbox` call to executing `seed_default_workspace_templates` under the shared `STEP_DOWN_PREFIX_SANDBOX` wrapper.
Test harness and fixtures `test/nemoclaw-start.test.ts`	Adds `runSeed` helper to write isolated `openclaw.json` and execute the extracted shell function; adds `writeTemplates` fixture to generate deterministic template files (including `BOOTSTRAP.md`) for tests.
Template layout detection tests `test/nemoclaw-start.test.ts`	Validates seeding documented templates (skipping `BOOTSTRAP.md`), supports both `docs/reference/templates` and `dist/docs/reference/templates` layouts via fake `npm` package trees, and verifies package-root resolution from the `openclaw` binary path.
Behavioral and safety test cases `test/nemoclaw-start.test.ts`	Checks behavior when templates are missing (no files created, diagnostic emitted), enforces `skipBootstrap` flag, preserves existing workspace files (no clobber), refuses to seed symlinked workspace directories, and asserts STEP_DOWN_PREFIX_SANDBOX usage in startup invocation.
Telegram diagnostics test stub `test/nemoclaw-start.test.ts`	Adds `seed_default_workspace_templates_as_sandbox()` stub delegating to `seed_default_workspace_templates` in the Telegram startup test scaffold.

Sequence Diagram

sequenceDiagram
  participant Seeder as seed_default_workspace_templates
  participant NPM as "npm root (-g)"
  participant SYS as "/usr/local/lib/node_modules/openclaw"
  participant BIN as "openclaw binary package dir"
  Seeder->>NPM: query global npm root
  Seeder->>SYS: probe fixed system package path
  Seeder->>BIN: resolve package dir from openclaw binary
  Seeder->>Seeder: check docs/reference/templates and dist/docs/reference/templates subpaths
  Seeder->>Seeder: set templates_dir on first match or log tried: list

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐰 I hopped through npm roots and the binary den,
I traced docs and dist to find templates again.
I left BOOTSTRAP untouched and kept user files whole,
Stepped down to sandbox with a careful soul.
Seeds planted, tests passing — nibble, thump, and stroll.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title mentions resolving OpenClaw workspace templates from installed packages, which aligns with the main change (updating template discovery logic), but is truncated and incomplete.
Linked Issues check	✅ Passed	The PR addresses all coding requirements from issue `#3240`: resolves templates from multiple package roots, supports both source and dist layouts, implements conservative missing-template behavior, uses shared step-down mechanism, and adds comprehensive regression tests.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to the linked issue: updates to sandbox template seeding logic and comprehensive test coverage; no unrelated modifications detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

+    openclaw_pkg_roots+=("/usr/local/lib/node_modules/openclaw")
+    if openclaw_bin="$(command -v openclaw 2>/dev/null)"; then
+      openclaw_real="$(readlink -f "$openclaw_bin" 2>/dev/null || printf '%s\n' "$openclaw_bin")"
+      openclaw_pkg="$(cd "$(dirname "$openclaw_real")/.." 2>/dev/null && pwd -P || true)"


…kage

github-actions · 2026-05-20T17:53:16Z

Selective E2E Results — ✅ All requested jobs passed

Run: 26179700021
Target ref: 90148e61a065c6f1c1ce81a815d51fd3a216b1a8
Workflow ref: main
Requested jobs: cloud-e2e
Summary: 1 passed, 0 failed, 0 skipped

Job	Result
cloud-e2e	✅ success

jyaunches

Approved after manual E2E advisor review and dispatching required follow-up E2E coverage. Required runs are in progress.

jyaunches · 2026-05-20T18:31:28Z

Thanks for the contribution. This PR is currently blocked by the repository rule requiring verified commit signatures. I’m going to carry this forward in a maintainer-squashed PR so the fix can land, but for future contributions please configure commit signing so GitHub shows your commits as Verified before opening the PR. See GitHub’s docs for signing commits with GPG, SSH, or S/MIME.

## Summary Carries forward PR #3449 as a maintainer-signed squash commit so the sandbox workspace template fix can pass the repository verified-signature merge rule. The change resolves OpenClaw workspace templates from the installed package instead of relying on mutable source checkout paths. ## Related Issue Fixes #3240 ## Changes - Update `scripts/nemoclaw-start.sh` to resolve workspace templates from the installed package location. - Add regression coverage in `test/nemoclaw-start.test.ts` for sandbox template seeding and step-down wrapper behavior. - Preserve original author attribution via `Co-authored-by` on the signed squash commit. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Verification - [ ] `npx prek run --all-files` passes - [ ] `npm test` passes - [x] Tests added or updated for new or changed behavior - [x] No secrets, API keys, or credentials committed - [x] Docs updated for user-facing behavior changes - [ ] `make docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>  ## Summary by CodeRabbit * **Improvements** * More reliable default workspace template discovery and seeding across installation layouts, including sandboxed start flows; emits clearer diagnostics when no templates are found. * **Tests** * Added comprehensive tests covering template seeding behavior, edge cases (skip bootstrap, existing content, symlinked workspaces), multiple template layouts, and sandboxed invocation.  [![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/NVIDIA/NemoClaw/pull/3917?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>

cv · 2026-05-21T01:12:00Z

Done in #3917

IronLung7 · 2026-05-21T09:18:36Z

Thank you @jyaunches

IronLung7 mentioned this pull request May 13, 2026

/sandbox/.openclaw/workspace/ is empty #3240

Closed

2 tasks

github-advanced-security AI found potential problems May 13, 2026

View reviewed changes

wscurran added integration: openclaw OpenClaw integration behavior fix labels May 13, 2026

IronLung7 force-pushed the fix-workspace-3240 branch from d860a77 to 32d9125 Compare May 19, 2026 10:02

fix(sandbox): resolve OpenClaw workspace templates from installed pac…

e39cec4

…kage

IronLung7 force-pushed the fix-workspace-3240 branch from 32d9125 to e39cec4 Compare May 19, 2026 10:02

IronLung7 and others added 6 commits May 20, 2026 09:52

Merge branch 'main' into fix-workspace-3240

147f7c7

test(sandbox): cover template seeding step-down behavior

75c41bb

test(start): stub sandbox template seeding wrapper

60d154f

test(start): simplify step-down wrapper coverage

69b9abd

test(start): show sandbox seeding failure output

8495c09

test(start): avoid shell source mutation in seeding test

e2005dc

jyaunches self-requested a review May 20, 2026 12:42

jyaunches added 3 commits May 20, 2026 08:43

Merge branch 'main' into fix-workspace-3240

67be628

test(start): stub npm root for sandbox seeding

f50b7e1

test(start): isolate sandbox step-down wrapper test

90148e6

Merge branch 'main' into fix-workspace-3240

badb3d4

jyaunches added the v0.0.47 Release target label May 20, 2026

jyaunches approved these changes May 20, 2026

View reviewed changes

jyaunches enabled auto-merge (squash) May 20, 2026 18:19

jyaunches mentioned this pull request May 20, 2026

fix(sandbox): resolve workspace templates from package #3917

Merged

12 tasks

Merge branch 'main' into fix-workspace-3240

ee2d363

cv closed this May 21, 2026

auto-merge was automatically disabled May 21, 2026 01:12
Pull request was closed

wscurran added area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery bug-fix PR fixes a bug or regression and removed fix labels Jun 3, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(sandbox): resolve OpenClaw workspace templates from installed pac…#3449

fix(sandbox): resolve OpenClaw workspace templates from installed pac…#3449
IronLung7 wants to merge 12 commits into
NVIDIA:mainfrom
IronLung7:fix-workspace-3240

IronLung7 commented May 13, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

copy-pr-bot Bot commented May 13, 2026

Uh oh!

coderabbitai Bot commented May 13, 2026 •

edited

Loading

Reviews paused

Walkthrough

Changes

Sequence Diagram

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented May 20, 2026

Uh oh!

jyaunches left a comment

Uh oh!

jyaunches commented May 20, 2026

Uh oh!

cv commented May 21, 2026

Uh oh!

IronLung7 commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

IronLung7 commented May 13, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Verification

Summary by CodeRabbit

Uh oh!

copy-pr-bot Bot commented May 13, 2026

Uh oh!

coderabbitai Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram

Estimated code review effort

Poem

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented May 20, 2026

Selective E2E Results — ✅ All requested jobs passed

Uh oh!

jyaunches left a comment

Choose a reason for hiding this comment

Uh oh!

jyaunches commented May 20, 2026

Uh oh!

cv commented May 21, 2026

Uh oh!

IronLung7 commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

IronLung7 commented May 13, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 13, 2026 •

edited

Loading