[All Platforms][CLI&UX] nemoclaw <sandbox> destroy recommends openshell gateway destroy, which is not a valid subcommand

[hulynn]

Description

After destroying a sandbox with nemoclaw <sandbox> destroy --force -y, the CLI prints a follow-up hint telling the user how to remove the shared NemoClaw gateway that was intentionally preserved:

Shared NemoClaw gateway preserved. Re-run 'openshell gateway destroy -g nemoclaw' to remove it,
or pass '--cleanup-gateway' / set NEMOCLAW_CLEANUP_GATEWAY=1 next time. (#2166)

The suggested command does not work. openshell gateway has no destroy subcommand, so running it verbatim fails with error: unrecognized subcommand 'destroy'. The message references #2166, which suggests it's a known follow-up area, but the printed command is unusable as-is.

Either the message is stale (the subcommand was renamed or never landed under this name), or the installed OpenShell CLI is out of sync with the version the message was written for. Either way, the user is stuck.

Environment

Host:              macOS (Mac Studio)
Container runtime: colima
OpenShell CLI:     bundled by NemoClaw installer (no destroy subcommand under openshell gateway)

Steps to Reproduce

1. Have a NemoClaw install with at least one sandbox sharing the default nemoclaw gateway.
2. Destroy the sandbox without passing the cleanup-gateway flag:

   nemoclaw test destroy --force -y

3. Read the follow-up hint in the output.
4. Run the command it recommends:

   openshell gateway destroy -g nemoclaw

Expected Result

Either the printed command works and removes the shared nemoclaw gateway, or the hint prints the actual command supported by the currently installed OpenShell CLI (e.g. openshell gateway remove -g nemoclaw). The hint and the CLI it targets should be in sync.

Actual Result

nemoclaw test destroy --force -y succeeds then prints the invalid hint. Following it:

% openshell gateway destroy -g nemoclaw
error: unrecognized subcommand 'destroy'
Usage: openshell gateway [OPTIONS] [COMMAND]
For more information, try '--help'.

Valid commands per --help:
  openshell gateway add http://127.0.0.1:8080 --local
  openshell gateway select my-gateway
  openshell gateway info
  openshell gateway remove my-gateway

Logs

Shared NemoClaw gateway preserved. Re-run 'openshell gateway destroy -g nemoclaw' to remove it,
or pass '--cleanup-gateway' / set NEMOCLAW_CLEANUP_GATEWAY=1 next time. (#2166)
✓ Sandbox 'test' destroyed

[AzeelSajjad]

Two separate findings here.

The exact message in the report is already fixed. 6fa18814c ("fix(cli): recommend and run 'openshell gateway remove' on all platforms (#6569)", shipped in v0.0.79) replaced a process.platform === "linux" ? "gateway remove" : "gateway destroy -g" ternary in the destroy hint with an unconditional gateway remove. macOS took the non-Linux branch, which is why the quoted output shows gateway destroy -g. That string cannot be produced at current main. Could you confirm the NemoClaw version used for the repro? If it predates v0.0.79, the destroy hint alone is resolved.

The same defect survived in three other hints, which #8270 fixes. Each printed openshell gateway destroy -g <name> unconditionally, behind a prose caveat (# For OpenShell releases that still expose lifecycle commands:) that an operator reading a failure hint has no way to evaluate — knowing the installed OpenShell's capabilities is exactly the information they're missing at that moment:

• src/lib/onboard/gateway-start-failure.ts — gateway fails to start after all retries
• src/lib/onboard/gpu-recovery.ts — GPU passthrough mismatch, no sandboxes registered
• src/lib/onboard/gateway-gpu-passthrough.ts — GPU passthrough mismatch, sandbox registry unreadable

All three now render their command block through a single helper gated on gatewayCliSupportsLifecycleCommands, the probe the gateway execution paths already used. The legacy verb prints only when openshell gateway --help actually advertises it, which is what the expected result in this report asks for. The flag fails closed, so a path that has not run the probe prints only the verb current OpenShell accepts.

One related item left out of scope: scripts/install.sh prints openshell gateway remove X || openshell gateway destroy -g X. The || makes it self-correcting, so it cannot produce the unrecognized subcommand failure reported here.