refactor(cli): remove deprecated deploy command

ci/source-architecture-budget.json

@@ -12,19 +12,19 @@
       "src/lib/adapters/openshell/timeouts.ts": 38,
       "src/lib/agent/defs.ts": 33,
       "src/lib/cli/branding.ts": 86,
-      "src/lib/cli/nemoclaw-oclif-command.ts": 107,
+      "src/lib/cli/nemoclaw-oclif-command.ts": 106,
       "src/lib/cli/terminal-style.ts": 43,
       "src/lib/core/json-types.ts": 37,
       "src/lib/core/ports.ts": 89,
       "src/lib/core/shell-quote.ts": 28,
       "src/lib/core/url-utils.ts": 30,
-      "src/lib/core/wait.ts": 38,
-      "src/lib/credentials/store.ts": 46,
+      "src/lib/core/wait.ts": 37,
+      "src/lib/credentials/store.ts": 45,
       "src/lib/inference/config.ts": 30,
       "src/lib/inference/web-search.ts": 21,
       "src/lib/messaging/channels/index.ts": 25,
       "src/lib/onboard/gateway-binding.ts": 53,
-      "src/lib/runner.ts": 86,
+      "src/lib/runner.ts": 85,
       "src/lib/security/redact.ts": 54,
       "src/lib/state/onboard-session.ts": 36,
       "src/lib/state/mcp-lifecycle-lock.ts": 21,
@@ -61,7 +61,7 @@
   "allowedCycles": [],
   "maxRootFiles": {
     "src/lib/onboard": 308,
-    "src/lib/actions": 19,
+    "src/lib/actions": 18,
     "src/lib/actions/sandbox": 183,
     "src/lib/state": 39,
     "src/lib/inference": 63,

docs/reference/commands.mdx

@@ -1366,22 +1366,6 @@ If that cleanup cannot inspect, restore, or verify the mutable config permission
 
 When you want a shell inside the sandbox rather than an agent session, use `$$nemoclaw <name> connect`.
 
-### `$$nemoclaw deploy`
-
-<Warning>
-The `$$nemoclaw deploy` command is deprecated.
-Prefer provisioning the remote host separately, then running the standard NemoClaw installer and `$$nemoclaw onboard` on that host.
-</Warning>
-
-Deploy NemoClaw to a remote GPU instance through [Brev](https://brev.nvidia.com).
-This command remains as a compatibility wrapper for the older Brev-specific bootstrap flow.
-The Brev instance name is the positional argument.
-The sandbox name comes from `NEMOCLAW_SANDBOX_NAME` and defaults to `my-assistant`; invalid sandbox names fail before Brev provisioning starts.
-
-```bash
-$$nemoclaw deploy <instance-name>
-```
-
 ### `$$nemoclaw <name> connect`
 
 Connect to a sandbox by name.
@@ -5546,22 +5530,6 @@ The following flags change defaults for commands that manage existing sandboxes.
 | `NEMOCLAW_UNINSTALL_ALL_GATEWAY_PORTS` | `1` to opt in | Makes `$$nemoclaw uninstall` remove every gateway port on the host instead of only the port `NEMOCLAW_GATEWAY_PORT` selects. Equivalent to passing the `--all-gateway-ports` flag; the whole-host `Proceed?` confirmation still applies unless `--yes` is also passed. Each port runs as its own uninstall, and the variable is dropped from those runs so the sweep cannot re-enter itself. |
 | `NEMOCLAW_UNINSTALL_DESTROY_USER_DATA` | `1` to opt in | Acknowledges data loss during `$$nemoclaw uninstall`, skips eligible fresh sandbox backups, and removes the otherwise-preserved entries (`rebuild-backups/`, `backups/`, `sandboxes.json`) in the selected gateway's state root. It does not select the explicit `--destroy-user-data` CLI-shim removal path; shim handling follows the ordinary selected-gateway scope. The global `Proceed?` confirmation still applies unless `--yes` is also passed. |
 
-<AgentOnly variant="openclaw">
-### Deprecated Brev Deployment
-
-The following variables configure the deprecated `$$nemoclaw deploy` compatibility command.
-The maintained remote-server path does not use these variables.
-For the current remote-server deployment path, refer to [Deploy to a Headless Server](../deployment/deploy-to-headless-server).
-
-| Variable | Default | Effect |
-|----------|---------|--------|
-| `NEMOCLAW_BREV_PROVIDER` | `gcp` | Cloud provider for Brev instance creation. |
-| `NEMOCLAW_GPU` | `a2-highgpu-1g:nvidia-tesla-a100:1` | GPU specification (instance type and GPU model) for the Brev instance. |
-| `NEMOCLAW_DEPLOY_NO_CONNECT` | unset | When set to `1`, skips the automatic `connect` step after the remote deploy completes. |
-| `NEMOCLAW_DEPLOY_NO_START_SERVICES` | unset | When set to `1`, skips starting services automatically after the remote deploy. |
-
-</AgentOnly>
-
 ### Legacy `$$nemoclaw setup`
 
 Deprecated. Use `$$nemoclaw onboard` instead.

docs/reference/troubleshooting.mdx

@@ -1001,7 +1001,7 @@ Escaping can make the preview longer than 80 output characters.
 This prevents a rejected name from injecting control sequences into terminal or CI output.
 
 Names that collide with global CLI commands are also rejected.
-Reserved names include `onboard`, `list`, `deploy`, `setup`, `start`, `stop`, `status`, `debug`, `uninstall`, `credentials`, and `help`.
+Reserved names include `onboard`, `list`, `setup`, `start`, `stop`, `status`, `debug`, `uninstall`, `credentials`, and `help`.
 Using a reserved name would cause the CLI to route to the global command instead of the sandbox.
 
 If the name does not match these rules or is reserved, the wizard exits with an error.

package.json

@@ -59,8 +59,9 @@
     "build:policy-boundary": "tsc -p nemoclaw/tsconfig.shared.json",
     "catalog:compile": "tsx src/lib/inference/serving/generate-catalog.ts",
     "catalog:check": "tsx src/lib/inference/serving/generate-catalog.ts --check",
-    "build:cli": "npm run build:policy-boundary && tsc -p tsconfig.src.json && node dist/lib/core/generate-build-identity.js && node dist/lib/inference/serving/generate-catalog.js && node dist/lib/cli/generate-oclif-metadata-manifest.js && if find nemoclaw-blueprint/scripts -name '*.ts' -print -quit | grep -q .; then tsc -p nemoclaw-blueprint/tsconfig.json; fi",
+    "build:cli": "npm run prune:retired-cli && npm run build:policy-boundary && tsc -p tsconfig.src.json && node dist/lib/core/generate-build-identity.js && node dist/lib/inference/serving/generate-catalog.js && node dist/lib/cli/generate-oclif-metadata-manifest.js && if find nemoclaw-blueprint/scripts -name '*.ts' -print -quit | grep -q .; then tsc -p nemoclaw-blueprint/tsconfig.json; fi",
     "clean:cli": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
+    "prune:retired-cli": "node -e \"const fs = require('node:fs'); for (const prefix of ['dist/commands/deploy', 'dist/lib/actions/deploy']) for (const suffix of ['.js', '.js.map', '.d.ts', '.d.ts.map']) fs.rmSync(prefix + suffix, { force: true }); fs.rmSync('dist/lib/deploy', { recursive: true, force: true })\"",
     "typecheck:cli": "tsc -p tsconfig.cli.json",
     "validate:configs": "tsx scripts/validate-configs.mts",
     "generate:agent-state-lock-plans": "node --import tsx scripts/lib/generate-agent-state-lock-plans.mts",

src/commands/simple-global-oclif-adapters.test.ts

@@ -38,7 +38,6 @@ const mocks = vi.hoisted(() => {
     listSandboxes: vi.fn(() => ({ sandboxes: [] })),
     resolveOpenshell: vi.fn(() => "/usr/bin/openshell"),
     runDebugCommandWithOptions: vi.fn(),
-    runDeployAction: vi.fn().mockResolvedValue(undefined),
     runDashboardUrlCommand: vi.fn(() => undefined),
     runGatewayTokenCommand: vi.fn(() => undefined),
     runStartCommand: vi.fn().mockResolvedValue(undefined),
@@ -77,7 +76,6 @@ vi.mock("../lib/dashboard-url-command", () => ({
   runDashboardUrlCommand: mocks.runDashboardUrlCommand,
 }));
 vi.mock("../lib/actions/global", () => ({
-  runDeployAction: mocks.runDeployAction,
   showRootHelp: mocks.showRootHelp,
   showVersion: mocks.showVersion,
 }));
@@ -112,7 +110,6 @@ vi.mock("../lib/state/mcp-lifecycle-lock-acquisition", async (importOriginal) =>
 
 import { log } from "../lib/cli/logger";
 import DebugCliCommand from "./debug";
-import DeployCliCommand from "./deploy";
 import RootHelpCommand from "./root/help";
 import VersionCommand from "./root/version";
 import DashboardUrlCliCommand, {
@@ -139,12 +136,11 @@ describe("simple global oclif adapters", testTimeoutOptions(30_000), () => {
     vi.restoreAllMocks();
   });
 
-  it("maps debug and deploy parser output to actions", async () => {
+  it("maps debug parser output to its action", async () => {
     await DebugCliCommand.run(
       ["--quick", "--output", "/tmp/debug.tar.gz", "--sandbox", "alpha"],
       rootDir,
     );
-    await DeployCliCommand.run(["gpu-alpha"], rootDir);
 
     expect(mocks.runDebugCommandWithOptions).toHaveBeenCalledWith(
       { quick: true, output: "/tmp/debug.tar.gz", sandboxName: "alpha" },
@@ -153,7 +149,6 @@ describe("simple global oclif adapters", testTimeoutOptions(30_000), () => {
         runDebug: expect.any(Function),
       }),
     );
-    expect(mocks.runDeployAction).toHaveBeenCalledWith("gpu-alpha");
   });
 
   it("keeps debug -q scoped to quick diagnostics instead of global quiet mode", async () => {

src/lib/README.md

@@ -33,7 +33,6 @@ Some older modules are still too large or coupled to split directly into actions
 src/lib/agent/**        agent definition, agent-specific onboarding, runtime helpers
 src/lib/credentials/**  credential storage and credential command support
 src/lib/dashboard/**    dashboard contract, health, and recovery helpers
-src/lib/deploy/**       deploy/build-image support that is not yet action-shaped
 src/lib/diagnostics/**  debug collection and diagnostic report helpers
 src/lib/inference/**    inference config, health probes, local runtime helpers
 src/lib/inventory/**    list/status inventory shaping and presentation models

src/lib/actions/global.test.ts

@@ -8,12 +8,10 @@ const mocks = vi.hoisted(() => ({
   garbageCollectImages: vi.fn().mockResolvedValue(undefined),
   help: vi.fn(),
   recoverNamedGatewayRuntime: vi.fn().mockResolvedValue({ recovered: true }),
-  runDeployAction: vi.fn().mockResolvedValue(undefined),
   runOnboardAction: vi.fn().mockResolvedValue(undefined),
   version: vi.fn(),
 }));
 
-vi.mock("./deploy", () => ({ runDeployAction: mocks.runDeployAction }));
 vi.mock("../gateway-runtime-action", () => ({
   recoverNamedGatewayRuntime: mocks.recoverNamedGatewayRuntime,
 }));
@@ -30,7 +28,6 @@ import {
   listManagedMcpCredentialReservations,
   recoverNamedGatewayRuntime,
   runBackupAllAction,
-  runDeployAction,
   runGarbageCollectImagesAction,
   runOnboardAction,
   runUpgradeSandboxesAction,
@@ -45,17 +42,15 @@ describe("global cli action facade", () => {
     setGlobalCliActionRuntimeHooksForTest({});
   });
 
-  it("forwards onboarding, deploy, maintenance, and help actions", async () => {
+  it("forwards onboarding, maintenance, and help actions", async () => {
     const onboardRuntimeDeps = { googlechatTunnelRuntime: {} };
     await runOnboardAction({ resume: true }, onboardRuntimeDeps);
-    await runDeployAction("gpu-alpha");
     await runBackupAllAction();
     await runGarbageCollectImagesAction({ dryRun: true });
     showRootHelp();
     showVersion();
 
     expect(mocks.runOnboardAction).toHaveBeenCalledWith({ resume: true }, onboardRuntimeDeps);
-    expect(mocks.runDeployAction).toHaveBeenCalledWith("gpu-alpha");
     expect(mocks.backupAll).toHaveBeenCalledWith();
     expect(mocks.garbageCollectImages).toHaveBeenCalledWith({ dryRun: true });
     expect(mocks.help).toHaveBeenCalledWith();

src/lib/actions/global.ts

@@ -7,7 +7,6 @@ import {
 } from "../domain/lifecycle/options";
 import { recoverNamedGatewayRuntime as recoverNamedGatewayRuntimeAction } from "../gateway-runtime-action";
 import type { OnboardFlags } from "../onboard/command-support";
-import { runDeployAction as executeDeployAction } from "./deploy";
 import {
   backupAll as executeBackupAllAction,
   garbageCollectImages as executeGarbageCollectImagesAction,
@@ -44,10 +43,6 @@ export async function runOnboardAction(
   await executeOnboardAction(flags, runtimeDeps);
 }
 
-export async function runDeployAction(instanceName?: string): Promise<void> {
-  await executeDeployAction(instanceName);
-}
-
 export async function runBackupAllAction(): Promise<void> {
   await executeBackupAllAction();
 }

src/lib/cli/public-display-defaults.ts

@@ -62,13 +62,6 @@ const PUBLIC_DISPLAY_LAYOUT: Record<string, readonly PublicDisplayLayout[]> = {
       flags: "[--quick] [--output FILE|-o FILE] [--sandbox NAME]",
     },
   ],
-  deploy: [
-    {
-      group: "Compatibility Commands",
-      order: 31,
-      deprecated: true,
-    },
-  ],
   gc: [
     {
       group: "Cleanup",

src/lib/credentials/command-support.ts

@@ -22,7 +22,7 @@ export function printCredentialsUsage(log: (message?: string) => void = console.
   log("    reset <PROVIDER> [--yes]        Remove a provider credential so onboard re-prompts");
   log("");
   log("  Credentials live in the OpenShell gateway. Inspect with `openshell provider list`.");
-  log("  Nothing is persisted to host disk; deploy/non-onboard commands read from env vars.");
+  log("  Nothing is persisted to host disk; credential registration reads values from env vars.");
   log("");
 }
 

src/lib/credentials/store.ts

@@ -52,7 +52,6 @@ export const KNOWN_CREDENTIAL_ENV_KEYS: readonly string[] = [
   "GITHUB_TOKEN",
   "HF_TOKEN",
   "HUGGING_FACE_HUB_TOKEN",
-  "ALLOWED_CHAT_IDS",
   ...listMessagingCredentialMetadata().map((credential) => credential.providerEnvKey),
 ];