fix(advisor): bypass sandbox login profiles - #11590

#!/usr/bin/env bash
set -euo pipefail

rg -n 'openshell|`@nvidia/openshell-sdk`|0\.0\.116' \
  -g 'package*.json' -g '*.yml' -g '*.yaml' -g '*.ts' -g '*.mts' . || true

if ! command -v openshell >/dev/null 2>&1; then
  echo "openshell is not installed in this environment"
  exit 2
fi

openshell --version

if ! openshell sandbox exec --help 2>&1 | grep -F -- '--no-login-shell'; then
  echo "installed openshell does not support --no-login-shell"
  exit 1
fi

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- changed file context ---'
sed -n '390,455p' tools/openshell-agent/runtime.mts

printf '%s\n' '--- direct version and executable bindings ---'
rg -n -C 3 'HERMES_PORTABLE_OPENSHELL_VERSION|QUALIFIED_STABLE_OPENSHELL_VERSION|openshell-sdk|openshellVersion|NEMOCLAW_OPENSHELL_BIN|resolveOpenshell|sandbox exec|no-login-shell' \
  tools/openshell-agent package.json package-lock.json pnpm-lock.yaml yarn.lock src/lib/adapters src/lib/onboard 2>/dev/null | head -n 500

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- candidate manifests and runtime files ---'
git ls-files | rg '(^|/)(package(-lock)?\.json|pnpm-lock\.yaml|yarn\.lock|runtime\.mts|resolve-shared|resolve\.ts|openshell-version|docker-driver-gateway-runtime)' | head -n 200

printf '%s\n' '--- exact package/version references ---'
rg -n -C 2 '0\.0\.116|`@nvidia/openshell-sdk`|openshell.*(version|binary)|resolveOpenshell|sandbox exec|no-login-shell' \
  tools/openshell-agent package.json package-lock.json pnpm-lock.yaml yarn.lock src 2>/dev/null | head -n 500

#!/usr/bin/env bash
set -euo pipefail
sed -n '390,455p' tools/openshell-agent/runtime.mts
printf '\n--- package and runtime bindings ---\n'
rg -n -C 3 '0\.0\.116|`@nvidia/openshell-sdk`|HERMES_PORTABLE_OPENSHELL_VERSION|QUALIFIED_STABLE_OPENSHELL_VERSION|resolveOpenshell|NEMOCLAW_OPENSHELL_BIN|sandbox exec|no-login-shell' \
  tools/openshell-agent package.json package-lock.json pnpm-lock.yaml yarn.lock src 2>/dev/null | head -n 500

#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' '--- OpenShell installation contract ---'
sed -n '250,330p' src/lib/onboard/openshell-install.ts
rg -n -C 3 '0\.0\.116|OPENSHELL_VERSION|openshell.*(install|download|pin)|min_openshell_version' \
  scripts src/lib/onboard tools/openshell-agent package.json package-lock.json 2>/dev/null | head -n 300

printf '%s\n' '--- agent runtime callers and tests ---'
rg -n -C 4 'execOpenShellSandbox|openShellSandboxExecArguments|tools\.run\("openshell"|no-login-shell' \
  tools/openshell-agent 2>/dev/null | head -n 250

#!/usr/bin/env bash
set -euo pipefail
url='https://raw.githubusercontent.com/NVIDIA/OpenShell/v0.0.116/crates/openshell-cli/src/main.rs'
body="$(curl -fsSL "$url")"
printf '%s\n' '--- v0.0.116 parser references ---'
printf '%s\n' "$body" | rg -n -C 3 'sandbox|exec|login|no-login|Args|Parser' | head -n 250
printf '%s\n' '--- exact flag presence ---'
if printf '%s\n' "$body" | grep -F -- '--no-login-shell'; then
  echo 'flag present'
else
  echo 'flag absent'
fi

#!/usr/bin/env bash
set -euo pipefail
for path in \
  crates/openshell-cli/src/commands/sandbox.rs \
  crates/openshell-cli/src/sandbox.rs \
  crates/openshell-cli/src/commands.rs \
  crates/openshell-cli/src/main.rs
do
  url="https://raw.githubusercontent.com/NVIDIA/OpenShell/v0.0.116/$path"
  status="$(curl -sS -o /tmp/openshell-source -w '%{http_code}' "$url")"
  if [ "$status" = 200 ]; then
    echo "--- $path ---"
    rg -n -C 4 'sandbox.*exec|Exec|login|no_login|no-login|struct.*Args|derive\(Parser' /tmp/openshell-source | head -n 250
  fi
done

#!/usr/bin/env bash
set -euo pipefail
url='https://raw.githubusercontent.com/NVIDIA/OpenShell/v0.0.116/crates/openshell-cli/src/main.rs'
curl -fsSL "$url" | sed -n '1560,1635p'