[yaoyu-33]

What / expected

Run OpenClaw in borrowed or agent-owned task sandboxes through EnvironmentServer sessions, using the shared execute/close lifecycle. No agent session uses the existing local CLI. Invalid/closed sessions never fall back to the host; cleanup must finish before verification.

• Preserve tool output, usage, failure diagnostics and cleanup evidence.
• Bootstrap only missing runtime prerequisites; keep task setup and verification Resources-owned.
• Match Pi's request allow-list and Pi/Codex's install/close budgets. Local installs are shared and retryable, including after every waiting caller cancels.

No separate feature issue: this completes the session integration requested here. Shared-helper/fixture cleanup is tracked in #4306.

Compatibility / concerns

The shipped YAML replaces the fixed nvinf provider/model with Gym's policy_model and ${policy_model_name}. Removed example keys (workspace_root, openclaw_agent_id, thinking, system_prompt, extra_args, env, concurrency) use class defaults unless overridden. resources_server changes from required to null: local /run still needs an explicit binding; direct /v1/responses does not.

Local installation now happens on first use, off the event loop, with shared attempts and retry after failure—not at startup. Sandbox install/close budgets are 600/60s. Unsupported session controls and required external HTTP/MCP tools fail explicitly. Eval-only; one worker. Existing local usage accounting and outer-cancellation limitations are separate follow-ups. No benchmark recipes or accuracy baselines are migrated.

Session request metadata is rejected, including extra_body.seed from num_repeats_add_seed; disable that option for this path. Configure chat_template_kwargs on the Gym model server; the rejection now explains this.

Validation

Current head: 0ba7a55c7dab00208ff4ba4f0d3e086feef60e28; merged main f2695eb4c.

Pytest selection: responses_api_agents/openclaw_agent/tests, responses_api_models/vllm_model/tests, and core test_sandbox_session, test_sandbox_supervisor_client, test_agent_sessions, test_agent_session_retries, test_add_legacy_agent_environment_servers, test_global_config. Run with --import-mode=importlib -q -o addopts='' -o log_cli=false; Linux exclusions are named below.

• macOS/Python 3.13.14: 1,109 passed / 31 platform/runtime skips; all-file pre-commit and whitespace checks pass. The initial restricted run hit process-inspection/socket permissions; the final permitted rerun passes without exclusions.
• Linux/Python 3.13.14: 1,138 passed / 2 deselected. The exclusions are previously reproduced vLLM endpoint-mtime failures (test_publish_rebinds_clients_and_clears_sessions, test_unpublished_endpoint_grace_lifecycle); those unchanged files match main. Canonical isolated gym env test and core-wide coverage were not rerun.
• New regressions fail before the fix for the missing configuration hint and cancelled-waiter install retry; metadata rejection does not consume activation.
• Real OpenClaw 2026.6.11 + nvidia/nemotron-3-super-120b-a12b, borrowed Docker sandbox, stock math verifier: reward 1, 3 model calls, 13,214 tokens, paired tools, tool-written answer and retained observations. Normal model-server retries recovered two HTTP 429s within the same episode. Agent close confirms cleanup before verification; Resources then removes the container.
• Full current-head CI and maintainer approval remain separate gates. This is functional validation, not a fresh SWE-Pro accuracy baseline.

Earlier revision-pinned evidence

At c0136aee8, owned and borrowed model smokes scored 1 each. HSG SWE-Pro completed official grading with reward 0, 161/178 tests passed; the model hit its output limit without a patch. At fa5ae88e1, direct/local and legacy /run routing smokes scored 1; one direct response returned zero usage, while /run usage was positive. That local accounting gap is not fixed here. Earlier runs are not presented as validation of this head.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ananthsub]

Thanks for this. The sandbox-session path closely follows the Pi (#3626) and Codex (#3640) shape:

• sandbox_provider defaults to None;
• sandbox_install_timeout_seconds and a 60-second close timeout;
• a shared first-use local install off the event loop, with retry;
• BaseException handling that keeps partial transcripts;
• an installer that verifies checksums and accepts both the Debian and RHEL certificate paths;
• stderr.log collected as an artifact.

Whether an agent session exists picks the path, with no extra selector, which keeps the config simple.

Main requests:

1. Drop "native" terminology. It appears in the PR title and description, the README, user-facing error messages, the installer, and the tests. The repo moved away from it in #4070. "Sandbox sessions" matches the other harnesses.
2. Add a compatibility note to the PR description for the shipped openclaw_agent.yaml changes: the nvinf provider and model are removed, several local keys are removed, and resources_server is now null.
3. Consider an allow-list for request validation, as Pi has, so that new Responses API fields are rejected by default.

Smaller items: the install timeout is 900 while Pi and Codex use 600; the local install moved from startup to first use; and the session helpers are duplicated across harnesses, which can be a follow-up.

[yaoyu-33]

/ok to test 01218cd

[ananthsub]

Thanks for the quick turnaround. All seven threads are resolved:

• "native" is gone from the title, README, error messages, installer and tests.
• The compatibility note and the first-use install note are in the README and the PR description.
• The install timeout is now 600.
• The request allow-list matches Pi's code exactly, with a test that rejects a newly added schema field.
• The shared helpers are tracked in #4306.

The OpenClaw tests pass locally on Linux.

New comments are all nits (two inline). The allow-list now rejects request metadata, including the seeded-repeat seed, and the chat_template_kwargs hint was lost. Also, the PR description says the request-field contract matches "Pi/Codex", but Codex still uses a deny-list; only Pi has the allow-list.

[yaoyu-33]

/ok to test 0ba7a55

[github-actions]

🔄 Merge queue validation started! You can track the progress here: https://github.com/NVIDIA-NeMo/Gym/actions/runs/38022831491