Description

openclaw doctor --fix inside a NemoClaw sandbox unconditionally tries to append shell completion to /sandbox/.bashrc, but /sandbox/.bashrc is owned by root and mode 444 (read-only) — so the write throws EACCES and doctor exits non-zero (1), even when the rest of the doctor pipeline (HEARTBEAT template, plugins, skills check) ran cleanly.

Completion install should be opportunistic / best-effort, not a hard error that pollutes the exit code. Real users running openclaw doctor --fix as part of routine sandbox maintenance see exit:1 and reasonably assume something is broken when in fact only the optional shell-completion step failed.

Environment

Device:        DGX Spark (spark-8158)
OS:            Ubuntu 24.04.4 LTS (Linux 6.17.0-1014-nvidia)
Architecture:  aarch64
Node.js:       v22.23.1
npm:           10.9.8
Docker:        Docker version 29.2.1, build a5c7197
OpenShell CLI: openshell 0.0.44
NemoClaw:      nemoclaw v0.0.70
OpenClaw:      OpenClaw v2026.5.27

Steps to Reproduce

1. Onboard a fresh OpenClaw sandbox on v0.0.70:

   NEMOCLAW_PROVIDER=build NVIDIA_INFERENCE_API_KEY=<KEY> \
     nemoclaw onboard --name repro-test --fresh --non-interactive --yes \
                      --yes-i-accept-third-party-software

2. Run doctor --fix:

   nemoclaw repro-test exec -- bash -c "openclaw doctor --fix; echo doctor_exit:$?"

3. Check /sandbox/.bashrc permissions to confirm it is intentionally read-only:

   nemoclaw repro-test exec -- ls -la /sandbox/.bashrc

Expected Result

doctor --fix should exit 0 when the only failure is an optional sub-step (shell-completion install). The user should either:

• (a) see a single-line warning ("shell completion not installed: /sandbox/.bashrc is read-only — run openclaw completion install on a writable shell rc file if you want it") with exit 0, OR
• (b) /sandbox/.bashrc should be writable so the completion install can succeed.

Either way, an EACCES on the optional completion install should not poison the overall doctor --fix exit code.

Actual Result

Clean reproduction — single doctor --fix invocation on a fresh sandbox:

◇  Doctor changes ----------
│  Replaced $OPENCLAW_HOME/.openclaw/workspace/HEARTBEAT.md with the
│  clean heartbeat template.
----
Error: Failed to install completion: EACCES: permission denied, open '/sandbox/.bashrc'
doctor_exit:1

File perms confirming root ownership + 444 read-only:

$ ls -la /sandbox/.bashrc
-r--r--r-- 1 root root 30 Jun 26 16:59 /sandbox/.bashrc

The doctor pipeline ran to completion (skills check, plugins, doctor changes all green); only the trailing "install completion" step failed because /sandbox/.bashrc is owned by root and mode 444. The non-zero exit propagates out of doctor as if the whole check failed.

Logs

$ nemoclaw repro-test exec -- bash -c "openclaw doctor --fix; echo doctor_exit:$?"
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
██░▄▄▄░██░▄▄░██░▄▄▄██░▀██░██░▄▄▀██░████░▄▄▀██░███░██
██░███░██░▀▀░██░▄▄▄██░█░█░██░█████░████░▀▀░██░█░█░██
██░▀▀▀░██░█████░▀▀▀██░██▄░██░▀▀▄██░▀▀░█░██░██▄▀▄▀▄██
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
                       OPENCLAW

┌  OpenClaw doctor
│
◇  Skills status ───────────╮
│  Eligible: 15             │
│  Missing requirements: 0  │
│  Blocked by allowlist: 0  │
├───────────────────────────╯
│
◇  Plugins ──────╮
│  Loaded: 57    │
│  Imported: 0   │
│  Disabled: 35  │
│  Errors: 0     │
├────────────────╯
│
◇  Doctor changes ────────────────────────────────────────────────────╮
│  Replaced $OPENCLAW_HOME/.openclaw/workspace/HEARTBEAT.md with the  │
│  clean heartbeat template.                                          │
├─────────────────────────────────────────────────────────────────────╯
Error: Failed to install completion: EACCES: permission denied, open '/sandbox/.bashrc'
doctor_exit:1

$ nemoclaw repro-test exec -- ls -la /sandbox/.bashrc
-r--r--r-- 1 root root 30 Jun 26 16:59 /sandbox/.bashrc

NVB#6395992