CLI improvements and simplifications

[drew]

Summary

A collection of CLI UX improvements to make the nemoclaw command surface cleaner and more intuitive.

Items

1. Clean up sandbox sync conventions

sandbox sync currently uses mutually exclusive flags (--up/--down) to determine direction, which is unconventional and inconsistent with other subcommand groups (forward, policy) that use nested subcommands. Replace --up/--down with the conventional upload/download subcommands.

Current:

nemoclaw sandbox sync <NAME> --up <LOCAL_PATH> [DEST]
nemoclaw sandbox sync <NAME> --down <SANDBOX_PATH> [DEST]

Proposed:

nemoclaw sandbox upload <NAME> <LOCAL_PATH> [DEST]
nemoclaw sandbox download <NAME> <SANDBOX_PATH> [DEST]

nemoclaw sandbox create --upload <LOCAL_PATH>:[SANDBOX_PATH]

passing --git-ignore (name tbd) will apply git ignore before upload

2. Rename cluster to gateway and simplify operations

The cluster command group should be renamed to gateway to better reflect what it represents. The current subcommands (status, use, list, admin {deploy,stop,destroy,info,tunnel}) are replaced with a smaller, clearer set of commands. status moves to a new top-level nemoclaw status command. use is replaced by select. list is removed.

Current:

nemoclaw cluster status
nemoclaw cluster use
nemoclaw cluster list
nemoclaw cluster admin deploy
nemoclaw cluster admin stop
nemoclaw cluster admin destroy
nemoclaw cluster admin info
nemoclaw cluster admin tunnel

Proposed:

nemoclaw gateway start     # Deploy/start the gateway
nemoclaw gateway stop      # Stop the gateway
nemoclaw gateway destroy   # Tear down the gateway
nemoclaw gateway select    # Select the active gateway
nemoclaw status            # Top-level command replacing `cluster status`

3. Make sandbox forward a top-level forward command

Port forwarding is used frequently enough to warrant being a top-level command rather than nested under sandbox. Promote sandbox forward {start,stop,list} to forward {start,stop,list}.

Current:

nemoclaw sandbox forward start <PORT> <NAME>
nemoclaw sandbox forward stop <PORT> <NAME>
nemoclaw sandbox forward list

Proposed:

nemoclaw forward start <PORT> <NAME>
nemoclaw forward stop <PORT> <NAME>
nemoclaw forward list

4. Do the same for policy, logs, and other subcommands

• nemoclaw sandbox logs -> nemoclaw logs
• nemoclaw sandbox policy -> nemoclaw policy

[pimlock]

Few items from my list:

--keep

sandbox create --keep doesn't do anything right now, as everything is kept. I think sandbox entrypoint always runs as sleep infinity and the process from -- echo "OK" runs over the SSH connection, so the sandbox doesn't die after it's finished.

Existing sandbox

When creating a sandbox with existing name:

nemoclaw sandbox create --name openclaw \
          --policy policy-station.yaml \
          --keep \
          --forward 18789 \
          -- echo "OK"
Error:   × status: Internal, message: "persist sandbox failed: execution error: database error: error returned from database: (code: 2067) UNIQUE constraint failed:
  │ objects.object_type, objects.name", details: [], metadata: MetadataMap { headers: {"content-type": "application/grpc", "date": "Fri, 06 Mar 2026 02:54:55
  │ GMT"} }

Updating providers

--type is required in here, but probably shouldn't.

nemoclaw provider update my-openai

Also, it's not possible to change only the config, I need to provide credentials as well when updating.

nemoclaw provider update my-openai --config FOO=bar # doesn't keep credentials

Maybe this shouldn't work, but worth checking.