scripts/nemoclaw-start.sh (1)

187-190: Gateway output not redirected to log file unlike root path.

In the root path (line 237), gateway output is redirected to /tmp/gateway.log. Here it goes to stdout, which may clutter the terminal or be lost. Consider redirecting for consistency and debuggability:

♻️ Proposed consistency fix

   # Start gateway in background, auto-pair, then wait
-  "$OPENCLAW" gateway run &
+  "$OPENCLAW" gateway run >>/tmp/gateway.log 2>&1 &

Note: You may need to ensure /tmp/gateway.log is writable by the current user (likely fine since /tmp is world-writable).

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/nemoclaw-start.sh` around lines 187 - 190, The gateway process is
launched with "$OPENCLAW" gateway run & and its PID stored in GATEWAY_PID but
its stdout/stderr are not redirected (unlike the later invocation that writes to
/tmp/gateway.log); update the launch of the gateway in the background to
redirect stdout and stderr to /tmp/gateway.log (or the same log path used
elsewhere) so logs are captured consistently and then set GATEWAY_PID=$! and
echo as before; ensure the chosen log file is writable by the current user.

scripts/nemoclaw-start.sh (1)

183-197: ⚠️ Potential issue | 🟠 Major

Pin HOME before starting the non-root flow.

Line 60 writes the auth profile under ~/.openclaw/..., while Line 81 and Lines 39-47 still read /sandbox/.openclaw explicitly. In this branch, gateway run and start_auto_pair inherit the same current HOME, so a non-root launch with HOME unset or pointing elsewhere can read and write a different state tree than the one you verified and printed URLs from. The root path stays aligned because every sandbox-side subprocess runs under gosu sandbox.

🛠️ Proposed fix

 if [ "$(id -u)" -ne 0 ]; then
   echo "[gateway] Running as non-root (uid=$(id -u)) — privilege separation disabled"
+  export HOME=/sandbox
   verify_config_integrity || true
   write_auth_profile

Please verify this path with a non-root launch where HOME is unset or not /sandbox.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/nemoclaw-start.sh` around lines 183 - 197, The non-root branch can
read/write a different $HOME than the sandbox state you validated; pin HOME to
the sandbox before any actions in that branch so write_auth_profile, gateway
run, start_auto_pair and print_dashboard_urls all operate on the same directory.
Update the non-root block (the branch that checks id -u and uses NEMOCLAW_CMD,
OPENCLAW, write_auth_profile, verify_config_integrity, gateway run,
start_auto_pair, print_dashboard_urls) to export HOME=/sandbox (or the canonical
sandbox path used elsewhere) immediately after entering the branch and before
calling verify_config_integrity/write_auth_profile or launching processes so
subsequent commands inherit the correct HOME. Ensure this change is only applied
in the non-root branch and does not alter the root/gosu sandbox behavior.

scripts/nemoclaw-start.sh (2)

186-186: ⚠️ Potential issue | 🟠 Major

Missing HOME export before write_auth_profile.

The write_auth_profile function uses os.path.expanduser('~/.openclaw/...'), which depends on the HOME environment variable. In non-root mode with arbitrary UIDs (e.g., Kubernetes mapped users), HOME may be unset or incorrect, causing credentials to be written to the wrong location and authentication to fail.

The root path handles this via gosu sandbox which inherits HOME from /etc/passwd. The non-root path should explicitly set it:

🔧 Proposed fix

   echo "[gateway] Running as non-root (uid=$(id -u)) — privilege separation disabled"
-  verify_config_integrity || true
+  if ! verify_config_integrity; then
+    echo "[SECURITY WARNING] Config integrity check failed — proceeding anyway (non-root mode)"
+  fi
+  export HOME=/sandbox
   write_auth_profile

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/nemoclaw-start.sh` at line 186, The non-root startup path calls
write_auth_profile but may run with HOME unset or incorrect (so
os.path.expanduser('~/.openclaw/...') writes to the wrong place); before
invoking write_auth_profile ensure HOME is explicitly exported to the target
user's home directory (same approach as the root path uses via gosu sandbox) by
determining the intended home (from /etc/passwd or an env value) and exporting
HOME in the non-root branch prior to calling write_auth_profile so credentials
are written to the correct location.

---

185-185: ⚠️ Potential issue | 🟠 Major

Config integrity failures are silently ignored.

The || true suppresses verification failures without any warning. While operational flexibility may be intentional, this weakens security guarantees compared to the root path (line 205). At minimum, emit a visible warning when verification fails.

🛡️ Proposed fix: warn on failure

-  verify_config_integrity || true
+  if ! verify_config_integrity; then
+    echo "[SECURITY WARNING] Config integrity check failed — proceeding anyway (non-root mode)"
+  fi

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/nemoclaw-start.sh` at line 185, The script currently silences
failures from verify_config_integrity by appending "|| true", which hides
verification errors; change this to surface a warning instead of swallowing the
failure: replace the "verify_config_integrity || true" usage so that when
verify_config_integrity exits non‑zero you emit a visible warning to stderr
(e.g., via echo >&2 or logger) but continue execution, or alternately remove the
"|| true" if you want to fail fast; ensure the change targets the call to
verify_config_integrity so verification failures are at least logged.