fix(sandbox): include generate-openclaw-config.py in optimized build context

[brandonpelfrey]

Summary

PR #2449 extracted inline Python config generation from the Dockerfile into scripts/generate-openclaw-config.py and added a COPY instruction (Dockerfile line 195), but did not update stageOptimizedSandboxBuildContext() to include the new file. This causes every nemoclaw onboard to fail with a Docker COPY failed: file not found in build context error. This PR adds the missing copyFileSync and a regression test assertion.

Related Issue

Fixes #2503
Closes #2509

Changes

• src/lib/sandbox-build-context.ts — Added fs.copyFileSync for scripts/generate-openclaw-config.py in stageOptimizedSandboxBuildContext(), alongside the existing nemoclaw-start.sh and lib/sandbox-init.sh copies.
• test/sandbox-build-context.test.ts — Added assertion that scripts/generate-openclaw-config.py is present in the staged optimized build context, preventing future regressions.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• make docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

AI Disclosure

• AI-assisted — tool: Claude Code (pi)

---

Signed-off-by: Brandon Pelfrey bpelfrey@nvidia.com

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates NemoClaw policy management documentation to highlight custom preset security considerations and workflow details, while extending the sandbox build context to stage a Python script (generate-openclaw-config.py) for Docker builds.

Changes

Cohort / File(s)	Summary
Documentation Updates .agents/skills/nemoclaw-user-manage-policy/SKILL.md	Adds "Gotchas" section warning that custom preset hosts bypass NemoClaw review and may expand sandbox egress. Updates warning formatting. Documents custom preset removal workflow, noting that presets applied via --from-file/--from-dir are tracked in the sandbox registry and can be removed by name using policy-remove.
Sandbox Build Context & Tests src/lib/sandbox-build-context.ts, test/sandbox-build-context.test.ts	Extends optimized sandbox path to copy generate-openclaw-config.py into the staged scripts directory during build context staging. Adds corresponding test assertion to verify the script is present in staged output.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 A Python script hops into the scripts folder with care,
While warnings about presets float through the air,
NemoClaw's gotchas are now crystal clear,
Custom preset journeys documented here! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: including a missing Python script in the optimized sandbox build context to fix Docker build failures.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/optimized-build-context-missing-config-generator

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.agents/skills/nemoclaw-user-manage-policy/SKILL.md (1)

132-133: Inconsistent warning format styles.

Line 314 uses a bold "Warning:" blockquote format, while Line 132 uses the > [!WARNING] GitHub callout format. Consider standardizing on one format throughout the document for consistency.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.agents/skills/nemoclaw-user-manage-policy/SKILL.md around lines 132 - 133,
The document mixes two warning styles: the GitHub callout `> [!WARNING]` used
for the `openshell policy set` note and a bold "Warning:" block used elsewhere
(e.g., the other warning around "Warning:" text); standardize them by picking
one style and converting the other to match—either replace the `> [!WARNING]`
callout that precedes the line "`openshell policy set` **replaces** the
sandbox's live policy..." to the bold block format used at Line 314, or convert
the bold "Warning:" block to the `> [!WARNING]` callout so all warnings use the
same format throughout SKILL.md.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.agents/skills/nemoclaw-user-manage-policy/SKILL.md:
- Around line 132-133: The document mixes two warning styles: the GitHub callout
`> [!WARNING]` used for the `openshell policy set` note and a bold "Warning:"
block used elsewhere (e.g., the other warning around "Warning:" text);
standardize them by picking one style and converting the other to match—either
replace the `> [!WARNING]` callout that precedes the line "`openshell policy
set` **replaces** the sandbox's live policy..." to the bold block format used at
Line 314, or convert the bold "Warning:" block to the `> [!WARNING]` callout so
all warnings use the same format throughout SKILL.md.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 45889ab1-2f2e-43aa-8658-4c5da26421ea

📥 Commits

Reviewing files that changed from the base of the PR and between db1ef3c and 73e9564.

📒 Files selected for processing (3)

• .agents/skills/nemoclaw-user-manage-policy/SKILL.md
• src/lib/sandbox-build-context.ts
• test/sandbox-build-context.test.ts