[latenighthackathon]

Summary

The --dangerously-skip-permissions flag is accepted by nemoclaw onboard (usage line in src/lib/onboard-command.ts:39, parse in src/lib/onboard.ts:6301) and is surfaced on nemoclaw <sandbox> status for sandboxes created with it — but it has no entry in the reference docs. A user reading docs/reference/commands.md has no way to learn what the flag disables, when it is intended for use, or the security implications.

Changes

Add a subsection under nemoclaw onboard (after --from) that:

• Leads with a warning that the flag is development-only and unsafe for production credentials or shared hosts.
• Enumerates the concrete effects: network policy (all endpoints open, no method/path filtering), filesystem (sandbox home writable, normally Landlock-restricted), and what stays gated (messaging and inference credentials).
• Covers both the flag form and the NEMOCLAW_DANGEROUSLY_SKIP_PERMISSIONS=1 env var form for non-interactive runs.
• Notes that the flag is persisted on the registry entry and surfaced by nemoclaw <sandbox> status (Permissions: dangerously-skip-permissions (shields permanently down)), and that re-running nemoclaw onboard without the flag restores the default policy.
• Adds the flag to the top-level usage line for completeness.

Testing

Docs-only. Verified:

• The policy path cited (nemoclaw-blueprint/policies/openclaw-sandbox-permissive.yaml) exists and is used when the flag is set — src/lib/onboard.ts:3640.
• The env var form is honored — src/lib/onboard.ts:6302.
• The status-command surfacing is real — src/nemoclaw.ts:1443.

Checklist

• Follows Conventional Commits
• Commit is signed (SSH)
• DCO Signed-off-by trailer present

Signed-off-by: latenighthackathon latenighthackathon@users.noreply.github.com

Summary by CodeRabbit

Documentation

• Documented new --dangerously-skip-permissions flag for nemoclaw onboard command, disabling network and filesystem restrictions in development/testing environments
• Added NEMOCLAW_DANGEROUSLY_SKIP_PERMISSIONS=1 environment variable for non-interactive setups
• Documented how to check permissions status and restore normal restrictions

[coderabbitai]

📝 Walkthrough

Walkthrough

Documentation update to the nemoclaw onboard command reference, adding details about a new --dangerously-skip-permissions flag that disables sandbox network and filesystem restrictions for development and testing purposes, including environment variable support and status reporting behavior.

Changes

Cohort / File(s)	Summary
Documentation Update docs/reference/commands.md	Added --dangerously-skip-permissions flag documentation to the nemoclaw onboard command, including behavior details, policy file reference, environment variable alternative, and sandbox status reporting information.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A flag to skip the walls so tall,
When testing needs no shield at all,
Permissions down for dev's delight,
But heed the warnings—use aright! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and specifically summarizes the main change: documentation of the --dangerously-skip-permissions flag for the nemoclaw onboard command, which matches the primary focus of the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

docs/reference/commands.md (1)

180-200: Align this section with docs style: one sentence per line and active voice.

Please split multi-sentence lines (Lines 180, 193, and 199) into one sentence per source line, and rewrite passive constructions like “is honored” / “is persisted” into active voice.

As per coding guidelines, "One sentence per line in source (makes diffs readable). Flag paragraphs where multiple sentences appear on the same line." and "Active voice required. Flag passive constructions."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/reference/commands.md` around lines 180 - 200, Split any source lines
that contain multiple sentences in the paragraphs describing the
--dangerously-skip-permissions flag, the NEMOCLAW_DANGEROUSLY_SKIP_PERMISSIONS
env var usage, and the sandbox registry persistence so each sentence lives on
its own line; also convert passive phrasing to active voice (e.g., change "is
honored via NEMOCLAW_DANGEROUSLY_SKIP_PERMISSIONS=1" to "nemoclaw honors
NEMOCLAW_DANGEROUSLY_SKIP_PERMISSIONS=1" and change "is persisted on the sandbox
registry entry" to "nemoclaw persists the flag on the sandbox registry entry"),
ensure the warning/logging sentence is a single active-voice sentence, and keep
the command examples (--dangerously-skip-permissions and the env-var onboarding
invocation) unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@docs/reference/commands.md`:
- Around line 180-200: Split any source lines that contain multiple sentences in
the paragraphs describing the --dangerously-skip-permissions flag, the
NEMOCLAW_DANGEROUSLY_SKIP_PERMISSIONS env var usage, and the sandbox registry
persistence so each sentence lives on its own line; also convert passive
phrasing to active voice (e.g., change "is honored via
NEMOCLAW_DANGEROUSLY_SKIP_PERMISSIONS=1" to "nemoclaw honors
NEMOCLAW_DANGEROUSLY_SKIP_PERMISSIONS=1" and change "is persisted on the sandbox
registry entry" to "nemoclaw persists the flag on the sandbox registry entry"),
ensure the warning/logging sentence is a single active-voice sentence, and keep
the command examples (--dangerously-skip-permissions and the env-var onboarding
invocation) unchanged.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5e28eeb3-b340-4240-9c4f-830e558c72d9

📥 Commits

Reviewing files that changed from the base of the PR and between 9339a85 and ddb8b1b.

📒 Files selected for processing (1)

• docs/reference/commands.md

[wscurran]

✨ Thanks for submitting this PR that proposes a way to improve the documentation — this could help provide a more accurate and informative resource for users.

[jyaunches]

Docs-only PR documenting an existing, well-tested feature. Verified the --dangerously-skip-permissions flag implementation across onboard-command.ts, policies.ts, shields.ts, nemoclaw.ts, and registry.ts. The claim that re-running nemoclaw onboard without the flag tightens the sandbox is accurate — registerSandbox() fully replaces the entry, clearing the flag and rebuilding with the restrictive base policy. Clean to merge.