fix(plugin): register nemoclaw command#3777
Conversation
…ailing install loudly, and removing scanner-flagged subprocess usage Signed-off-by: zyang-dev <267119621+zyang-dev@users.noreply.github.com>
📝 WalkthroughWalkthroughReads active model from /sandbox/.openclaw/openclaw.json, uses that model for provider registration, simplifies runtime-context to synchronous static injection, aligns OpenClaw compatibility to 2026.4.24, sets bearer auth id, makes Docker plugin install fail-fast, and updates tests. ChangesNemoClaw inference model resolution and runtime context refactoring
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
There was a problem hiding this comment.
🧹 Nitpick comments (2)
Dockerfile (1)
412-414: Run the Dockerfile E2E matrix before merge.Given this is an image-build/runtime contract change, please run the recommended jobs to validate behavior in real container execution paths:
gh workflow run nightly-e2e.yaml --ref <branch> -f jobs=cloud-e2e,sandbox-survival-e2e,hermes-e2e,rebuild-openclaw-e2eAs per coding guidelines, “Layer ordering, permissions, and baked config changes are only testable with a real container build.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile` around lines 412 - 414, Run the Dockerfile E2E matrix before merging: trigger the nightly-e2e workflow for this branch with the jobs cloud-e2e, sandbox-survival-e2e, hermes-e2e, and rebuild-openclaw-e2e and verify in actual container runs that the Dockerfile steps invoking "openclaw plugins install /opt/nemoclaw", "openclaw plugins enable nemoclaw", and "openclaw plugins inspect nemoclaw --json" complete successfully (no errors, correct exit codes, and expected inspection output), and fix any failures (permissions, missing files, or runtime differences) found during those real container builds/executions.nemoclaw/src/register.test.ts (1)
34-39: ⚡ Quick winMake the missing-config mock path-scoped and ENOENT-shaped.
mockMissingOpenClawConfig()currently throws a generic error for everyreadFileSynccall. That can mask unrelated file reads and doesn’t emulate a real “missing file” condition foropenclaw.json.Proposed patch
const mockedReadFileSync = vi.mocked(readFileSync); +const defaultReadFileSyncImpl = mockedReadFileSync.getMockImplementation(); const mockedLoadOnboardConfig = vi.mocked(loadOnboardConfig); function mockMissingOpenClawConfig(): void { mockedReadFileSync.mockReset(); - mockedReadFileSync.mockImplementation(() => { - throw new Error("openclaw config unavailable"); + mockedReadFileSync.mockImplementation((path, options) => { + if (String(path).endsWith("openclaw.json")) { + const err = new Error("openclaw config unavailable") as NodeJS.ErrnoException; + err.code = "ENOENT"; + throw err; + } + return defaultReadFileSyncImpl + ? defaultReadFileSyncImpl(path as never, options as never) + : ("" as ReturnType<typeof readFileSync>); }); }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@nemoclaw/src/register.test.ts` around lines 34 - 39, Change mockMissingOpenClawConfig to only throw a file-not-found (ENOENT) error for the openclaw.json path instead of throwing for every read; capture the real readFileSync (e.g. originalReadFileSync) and use mockedReadFileSync.mockImplementation((path, ...args) => { if (String(path).includes('openclaw.json')) throw Object.assign(new Error("openclaw config unavailable"), { code: 'ENOENT' }); return originalReadFileSync(path, ...args); }); so unrelated reads still work and code that checks error.code === 'ENOENT' will behave correctly; keep the function name mockMissingOpenClawConfig and mockedReadFileSync in place.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@Dockerfile`:
- Around line 412-414: Run the Dockerfile E2E matrix before merging: trigger the
nightly-e2e workflow for this branch with the jobs cloud-e2e,
sandbox-survival-e2e, hermes-e2e, and rebuild-openclaw-e2e and verify in actual
container runs that the Dockerfile steps invoking "openclaw plugins install
/opt/nemoclaw", "openclaw plugins enable nemoclaw", and "openclaw plugins
inspect nemoclaw --json" complete successfully (no errors, correct exit codes,
and expected inspection output), and fix any failures (permissions, missing
files, or runtime differences) found during those real container
builds/executions.
In `@nemoclaw/src/register.test.ts`:
- Around line 34-39: Change mockMissingOpenClawConfig to only throw a
file-not-found (ENOENT) error for the openclaw.json path instead of throwing for
every read; capture the real readFileSync (e.g. originalReadFileSync) and use
mockedReadFileSync.mockImplementation((path, ...args) => { if
(String(path).includes('openclaw.json')) throw Object.assign(new Error("openclaw
config unavailable"), { code: 'ENOENT' }); return originalReadFileSync(path,
...args); }); so unrelated reads still work and code that checks error.code ===
'ENOENT' will behave correctly; keep the function name mockMissingOpenClawConfig
and mockedReadFileSync in place.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 8158d254-1444-4679-916c-5a072c67c040
📒 Files selected for processing (8)
Dockerfilenemoclaw/package.jsonnemoclaw/src/index.tsnemoclaw/src/package-metadata.test.tsnemoclaw/src/register.test.tsnemoclaw/src/runtime-context.test.tsnemoclaw/src/runtime-context.tstest/fetch-guard-patch-regression.test.ts
…other readFileSync calls intact Signed-off-by: zyang-dev <267119621+zyang-dev@users.noreply.github.com>
cjagwani
left a comment
There was a problem hiding this comment.
Approving — clean fix that targets the root cause from cr7258's analysis (OpenClaw scanner rejecting child_process in gateway-loaded plugin code).
Notes for the record:
- Pin alignment looks correct:
2026.4.24matchesnemoclaw-blueprint/blueprint.yaml:7andagents/openclaw/manifest.yaml:22; the prior2026.5.10-beta.1innemoclaw/package.jsonwas inconsistent. - Fail-fast
RUNatDockerfile:405-419+ the regression test attest/fetch-guard-patch-regression.test.ts:62-86lock in the loud-failure behavior so #2021 can't silently regress again. - Config-read fallback chain in
nemoclaw/src/index.ts:200-238(liveopenclaw.json→ onboard config → hardcoded default) is the right shape; debug-logged read failures will surface in support bundles.
CodeRabbit nitpick (register.test.ts:34-39 path-scoped ENOENT mock) is already addressed in commit 2ed9809a — no further action needed there.
Optional pre-merge: trigger nightly-e2e for extra Dockerfile-matrix coverage, but per-platform e2e + sandbox image builds are already green.
One acceptance gap worth flagging in the v0.0.46 QA pass: no direct test asserts /nemoclaw appears in TUI autocomplete (issue #2021's literal expected result). Build-time install/enable/inspect succeeding is a strong proxy, but manual TUI verification is still warranted at release time.
There was a problem hiding this comment.
🧹 Nitpick comments (1)
Dockerfile (1)
402-404: Verify the fix with recommended E2E tests.The fail-fast plugin installation correctly ensures
/nemoclawcommand registration happens at build time. To confirm this resolves the TUI slash-command issue (#2021) and doesn't regress existing flows, run the E2E test suites recommended for Dockerfile changes.As per coding guidelines, run the following E2E tests on this branch:
gh workflow run nightly-e2e.yaml --ref fix/openclaw-slash-command-registration -f jobs=cloud-e2e,sandbox-survival-e2e,hermes-e2e,rebuild-openclaw-e2eExpected results:
cloud-e2e: Onboard + cloud inference completes without plugin registration errorssandbox-survival-e2e: Gateway restart does not lose the/nemoclawcommandhermes-e2e: Hermes agent onboard + inference works with the plugin enabledrebuild-openclaw-e2e: Workspace state survives rebuild and/nemoclawremains registered🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile` around lines 402 - 404, The Dockerfile change ensures the nemoclaw plugin is installed/enabled at build time using the openclaw CLI (openclaw plugins install /opt/nemoclaw, openclaw plugins enable nemoclaw, openclaw plugins inspect nemoclaw), so validate this by running the recommended E2E workflows: execute the GitHub Actions command to run nightly-e2e.yaml for jobs cloud-e2e, sandbox-survival-e2e, hermes-e2e, rebuild-openclaw-e2e (as provided) and confirm cloud-e2e completes without plugin registration errors, sandbox-survival-e2e preserves the /nemoclaw command across gateway restarts, hermes-e2e allows Hermes agent onboard+inference with the plugin, and rebuild-openclaw-e2e preserves workspace state and the /nemoclaw registration.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@Dockerfile`:
- Around line 402-404: The Dockerfile change ensures the nemoclaw plugin is
installed/enabled at build time using the openclaw CLI (openclaw plugins install
/opt/nemoclaw, openclaw plugins enable nemoclaw, openclaw plugins inspect
nemoclaw), so validate this by running the recommended E2E workflows: execute
the GitHub Actions command to run nightly-e2e.yaml for jobs cloud-e2e,
sandbox-survival-e2e, hermes-e2e, rebuild-openclaw-e2e (as provided) and confirm
cloud-e2e completes without plugin registration errors, sandbox-survival-e2e
preserves the /nemoclaw command across gateway restarts, hermes-e2e allows
Hermes agent onboard+inference with the plugin, and rebuild-openclaw-e2e
preserves workspace state and the /nemoclaw registration.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 0492602d-a062-46ed-95a9-934df40111b5
📒 Files selected for processing (1)
Dockerfile
## Summary Refreshes the NemoClaw docs for v0.0.46 by updating version metadata, release notes, and generated user skills. The refresh also keeps public docs aligned with the docs skip list by removing non-public experimental references from the generated output. ## Related Issue None. ## Changes - #3744 and #3824 -> `docs/about/release-notes.mdx`: Added Windows bootstrap and WSL express install coverage for v0.0.46. - #3392 -> `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/commands.mdx`, `docs/reference/network-policies.mdx`, and policy examples: Refreshed public messaging channel docs around WhatsApp and matching policy presets. - #3742, #3767, #3732, #3786, #3777, and #3808 -> `docs/about/release-notes.mdx`: Added release-note coverage for Hermes managed tools, Bedrock Runtime endpoint detection, WSL Ollama proxying, Model Router Python fallback, plugin command registration, and tool-catalog latency improvements. - #3124 -> `docs/about/release-notes.mdx`: Added release-note coverage for hosted uninstall flag guidance. - Generated `nemoclaw-user-*` skills from the updated MDX docs for the v0.0.46 release. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Verification - [ ] `npx prek run --all-files` passes - [ ] `npm test` passes - [ ] Tests added or updated for new or changed behavior - [x] No secrets, API keys, or credentials committed - [x] Docs updated for user-facing behavior changes - [ ] `make docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification notes: - Commit hooks passed, including markdownlint, gitleaks, docs-to-skills verification, env-var docs, and skills YAML checks. - `python3 scripts/docs-to-skills.py docs/ .agents/skills/ --prefix nemoclaw-user --doc-platform fern-mdx` passed. - `bash test/e2e/e2e-cloud-experimental/check-docs.sh --only-links --local-only --with-skills` passed. - `git diff --check` passed. - `make docs` was attempted but blocked before MDX validation because `npx` received HTTP 403 fetching `fern-api` from npm. --- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Released v0.0.46: improved Windows setup, WhatsApp messaging support, Hermes sandbox/tool routing, Anthropic endpoint compatibility, Ollama proxy routing, model-router fallback, OpenClaw plugin/backup compatibility, sandbox build tooling fixes, and updated uninstall flag behavior. * **Documentation** * Removed WeChat from messaging flows and presets across guides and CLI docs; clarified onboarding and channel setup for WhatsApp. Clarified runtime mutability and filesystem (Landlock) behavior — some changes require sandbox rebuilds; prefer host-side commands for durable config. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/NVIDIA/NemoClaw/pull/3911?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Summary
Fixes NemoClaw’s OpenClaw plugin registration so
/nemoclawis reliably available in the TUI. The plugin install now fails loudly during image build, uses OpenClaw 2026.4.24-compatible metadata, and removes scanner-flagged subprocess usage from the gateway-loaded plugin path.Related Issue
Fixes #2021
Changes
Type of Change
Verification
npx prek run --all-filespassesnpm testpassesmake docsbuilds without warnings (doc changes only)Signed-off-by: zyang-dev 267119621+zyang-dev@users.noreply.github.com
Summary by CodeRabbit
Bug Fixes
Refactor
Tests