[Ubuntu 24.04][Onboard] NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=silent prints unsupported-value error but exits with code 0

[PrachiShevate-nv]

Description

On Ubuntu 24.04 with NemoClaw v0.0.54, nemoclaw onboard in non-interactive Ollama mode correctly detects an unsupported NEMOCLAW_NON_INTERACTIVE_SUDO_MODE value of silent and prints the expected error message, but it exits with status code 0 instead of 1. This makes automation and CI scripts treat the failure as success, while the same code path for force exits with code 1 as intended.

Environment

• Device: Ubuntu 24.04 server
• OS: Ubuntu 24.04
• Architecture: x86_64
• Node.js: v22.22.3
• npm: 10.9.8
• Docker: Docker version 29.2.1, build a5c7197
• OpenShell CLI: openshell 0.0.44
• NemoClaw: v0.0.54
• OpenClaw: OpenClaw 2026.5.22 (a374c3a)

Steps to Reproduce

1. Ensure Ollama is installed and active: systemctl status ollama shows active and Docker is running.

2. Confirm no sandbox named sudo-mode-invalid-test exists: nemoclaw list | grep sudo-mode-invalid-test returns empty.

3. Set non-interactive env vars:

   export NEMOCLAW_NON_INTERACTIVE=1
   export NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=silent
   export NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1
   export NEMOCLAW_PROVIDER=install-ollama

4. Run onboarding and capture logs:

   nemoclaw onboard --name sudo-mode-invalid-test 2>&1 | tee /tmp/onboard-invalid-sudo.log
   echo "EXIT:$?"

5. Search for the sudo-mode error line:

   grep 'NEMOCLAW_NON_INTERACTIVE_SUDO_MODE' /tmp/onboard-invalid-sudo.log

6. Verify that no sandbox was created:

   docker ps -a | grep openshell
   nemoclaw list | grep sudo-mode-invalid-test

7. As a control, repeat with force (shows correct exit code 1):

   export NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=force
   nemoclaw onboard --name sudo-mode-invalid-test2 2>&1; echo "EXIT:$?"

8. As a valid case, repeat with prompt (succeeds and creates a sandbox):

   export NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=prompt
   nemoclaw onboard --name sudo-mode-prompt-test 2>&1 | tee /tmp/onboard-prompt.log
   echo "EXIT:$?"

Expected Result

For any unsupported NEMOCLAW_NON_INTERACTIVE_SUDO_MODE value (e.g. silent, force):

• nemoclaw onboard should print:

  Unsupported NEMOCLAW_NON_INTERACTIVE_SUDO_MODE value: <value>. Use 'prompt' or leave it unset.

• Onboarding should stop before gateway/sandbox creation or any Ollama systemd changes.

• The process should exit with status code 1 so automation detects a failure.

• No new OpenShell containers or sudo-mode-invalid-test sandbox should appear in docker ps -a or nemoclaw list.

For the valid value prompt:

• No "Unsupported NEMOCLAW_NON_INTERACTIVE_SUDO_MODE" error should appear.
• Onboarding should proceed through Ollama/systemd configuration, provider setup, and sandbox creation (or fail later for unrelated reasons).

Actual Result

With NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=silent

export NEMOCLAW_NON_INTERACTIVE=1
export NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=silent
export NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1
export NEMOCLAW_PROVIDER=install-ollama
nemoclaw onboard --name sudo-mode-invalid-test 2>&1 | tee /tmp/onboard-invalid-sudo.log
echo "EXIT:$?"

[non-interactive] Agent: OpenClaw
NemoClaw Onboarding (non-interactive mode)
===================
[1/8] Preflight checks
──────────────────────────────────────────────────
✓ Docker is running
✓ Docker can start bridge containers
✓ Container DNS resolution works
✓ Container runtime: docker
✓ Container runtime resources: 16 vCPU / 251.4 GiB
✓ openshell CLI: openshell 0.0.44
✓ Port 8080 already owned by healthy NemoClaw runtime (OpenShell gateway)
✓ NVIDIA GPU detected (NVIDIA GeForce RTX 5090, 32607 MB)
✓ Docker CDI GPU support detected (/etc/cdi/nvidia.yaml, /run/cdi/nvidia.yaml)
✓ Sandbox GPU: enabled (auto)
✓ Memory OK: 257441 MB RAM + 0 MB swap
NVIDIA GPU detected; enabling OpenShell GPU passthrough. Use --no-gpu to opt out.
[2/8] Starting OpenShell gateway
──────────────────────────────────────────────────
[reuse] Skipping gateway (running)
Reusing healthy NemoClaw gateway.
[3/8] Configuring inference provider
──────────────────────────────────────────────────
[non-interactive] Provider: ollama
Configuring Ollama systemd loopback override...
Applying an Ollama systemd override (OLLAMA_HOST=127.0.0.1:11434).
The next steps use sudo to write the drop-in, reload systemd, and restart
the service; you may be prompted for your password.
Unsupported NEMOCLAW_NON_INTERACTIVE_SUDO_MODE value: silent. Use 'prompt' or leave it unset.
EXIT:0                                                  ← should be 1

• grep 'NEMOCLAW_NON_INTERACTIVE_SUDO_MODE' /tmp/onboard-invalid-sudo.log returns:

  Unsupported NEMOCLAW_NON_INTERACTIVE_SUDO_MODE value: silent. Use 'prompt' or leave it unset.

• docker ps -a | grep openshell; nemoclaw list | grep sudo-mode-invalid-test shows nothing (no sandbox created).

• Exit code is 0, even though onboarding printed an error and stopped early.

With NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=force (control)

export NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=force
nemoclaw onboard --name sudo-mode-invalid-test2 2>&1; echo "EXIT:$?"

[non-interactive] Agent: OpenClaw
...
Unsupported NEMOCLAW_NON_INTERACTIVE_SUDO_MODE value: force. Use 'prompt' or leave it unset.
EXIT:1

• Message is identical (unsupported value).
• Exit code is correctly 1.

With NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=prompt (valid)

export NEMOCLAW_NON_INTERACTIVE_SUDO_MODE=prompt
nemoclaw onboard --name sudo-mode-prompt-test 2>&1 | tee /tmp/onboard-prompt.log
echo "EXIT:$?"

[non-interactive] Agent: OpenClaw
NemoClaw Onboarding (non-interactive mode)
===================
[1/8] Preflight checks
...
[2/8] Starting OpenShell gateway
...
[3/8] Configuring inference provider
...
✓ Using Ollama on localhost:11434 (proxy on :11435)
Loading Ollama model: qwen2.5:7b
Chat Completions API available — OpenClaw will use openai-completions.
✓ Using Ollama runtime context length: 32768 tokens
...
[4/8] Setting up inference provider
...
[6/8] Creating sandbox
...

• No "Unsupported NEMOCLAW_NON_INTERACTIVE_SUDO_MODE" error appears.
• Onboarding proceeds to configure inference and build the sandbox image.

Logs

Main CLI logs are captured above under Actual Result (including the full silent and force outputs and the key excerpt from the prompt run).

No additional gateway or system logs were captured for this specific exit-code issue.

[kagura-agent]

Hi, I'd like to work on this. The fix should be straightforward — the silent validation branch needs to exit with code 1 instead of 0 to match the force branch behavior. I'll submit a PR with a fix and test once assigned. 🙏

[kagura-agent]

After reviewing the source code, I want to flag a potential test methodology concern before investing in a PR:

The validation in src/lib/onboard/ollama-systemd.ts (L37-45) treats all non-prompt values identically — both silent and force hit the same process.exit(1) path:

if (rawMode && rawMode !== "prompt") {
  console.error(`  Unsupported ...`);
  process.exit(1);
}

The existing test (onboard-selection.test.ts L2231-2239) verifies this for value foo and expects exit code 1.

In the reproduction steps, the silent case uses | tee (which makes $? capture tee's exit code 0), while the force control uses ; (which correctly captures nemoclaw's exit code 1). This could explain the observed difference:

# silent: $? = tee's exit code (0)
nemoclaw onboard ... 2>&1 | tee /tmp/log; echo "EXIT:$?"

# force: $? = nemoclaw's exit code (1) 
nemoclaw onboard ... 2>&1; echo "EXIT:$?"

Could you verify with set -o pipefail or echo ${PIPESTATUS[0]} whether the exit code difference persists? If it does, I'd be happy to investigate further — there might be a subtle interaction I'm missing.