[ShauryaaSharma]

Summary

openclaw plugins install brave-plugin now imports the brave provider profile as
a side effect. The subsequent openclaw doctor --fix --non-interactive tries to
import it again, exits non-zero with "custom provider profile 'brave' already
exists", and kills the Docker build under set -eu.

The fix mirrors the tolerance already present in the host-side TypeScript
(brave-provider-profile.ts:80): capture doctor's output, and if the only
failure is "already exists", treat it as success. Any other non-zero exit still
propagates as a real build failure.

Related Issue

Fixes #5367

Changes

• Dockerfile: wrap openclaw doctor --fix in the Brave path with an
  if ! var=$(cmd 2>&1) guard that passes through "already exists" and fails
  hard on all other non-zero exits

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates

Verification

• No secrets, API keys, or credentials committed
• Git hooks passed during commit and push

---

Signed-off-by: ShauryaaSharma shauryasofficial27@gmail.com

Summary by CodeRabbit

• Chores
  • Improved the setup build process by capturing diagnostic output and using smarter success/failure handling during optional component checks. If a resource already exists, the build now proceeds without failing, while genuine errors still stop the build. This results in clearer logs and more reliable initialization.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 60efaac5-7f6e-4600-9c45-bb3cc2031ced

📥 Commits

Reviewing files that changed from the base of the PR and between 0d584ff and 5b93458.

📒 Files selected for processing (1)

• Dockerfile

🚧 Files skipped from review as they are similar to previous changes (1)

• Dockerfile

---

📝 Walkthrough

Walkthrough

The Dockerfile’s Brave plugin setup now captures openclaw doctor --fix --non-interactive output, prints it on success or failure, and only ignores failures when the output contains “already exists”.

Changes

Brave Doctor Error Guard

Layer / File(s)	Summary
Brave doctor output capture and conditional failure Dockerfile	Wraps the Brave openclaw doctor --fix --non-interactive call in output capture, prints the captured output, and treats failures as acceptable only when the output contains “already exists”.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Suggested reviewers

• cv
• ericksoa

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: handling Brave profile re-imports during the Docker build.
Linked Issues check	✅ Passed	The Dockerfile change addresses #5367 by treating the duplicate brave profile case as success while still failing on other errors.
Out of Scope Changes check	✅ Passed	The diff appears limited to the Brave-related Dockerfile fix and adds no unrelated changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

Dockerfile (1)

694-712: Run the Dockerfile E2E matrix for this build-path change.

This guard is in a container-build-sensitive path and should be validated through the recommended image-level E2E jobs.

As per coding guidelines, "Dockerfile ... changes are only testable with a real container build" and the recommended suite is cloud-e2e, sandbox-survival-e2e, hermes-e2e, rebuild-openclaw-e2e, and openclaw-tui-chat-correlation-e2e.

gh workflow run nightly-e2e.yaml --ref <branch> -f jobs=cloud-e2e,sandbox-survival-e2e,hermes-e2e,rebuild-openclaw-e2e,openclaw-tui-chat-correlation-e2e

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` around lines 694 - 712, This comment requests validation of the
Dockerfile changes through E2E testing rather than requesting a code fix.
Execute the specified E2E test workflow to validate the container build changes
to the openclaw plugin installation and brave-doctor logic. Use the provided gh
workflow command to run the nightly-e2e.yaml workflow with the jobs parameter
set to cloud-e2e, sandbox-survival-e2e, hermes-e2e, rebuild-openclaw-e2e, and
openclaw-tui-chat-correlation-e2e on your feature branch to ensure the
Dockerfile modifications work correctly in a real container build environment.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@Dockerfile`:
- Around line 694-712: This comment requests validation of the Dockerfile
changes through E2E testing rather than requesting a code fix. Execute the
specified E2E test workflow to validate the container build changes to the
openclaw plugin installation and brave-doctor logic. Use the provided gh
workflow command to run the nightly-e2e.yaml workflow with the jobs parameter
set to cloud-e2e, sandbox-survival-e2e, hermes-e2e, rebuild-openclaw-e2e, and
openclaw-tui-chat-correlation-e2e on your feature branch to ensure the
Dockerfile modifications work correctly in a real container build environment.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ed99ec79-c072-4f64-ba23-2992c42d48db

📥 Commits

Reviewing files that changed from the base of the PR and between 2bdee17 and 0d584ff.

📒 Files selected for processing (1)

• Dockerfile

[AryanGupta1112]

LGTM. The fix gracefully handles the expected profile re-import scenario while preserving failure behavior for all other non-zero exits. Nice targeted fix.

_{Approved in CodeRabbit Change Stack}

[wscurran]

✨ Thanks for the proposed fix addressing the Brave provider profile re-import failure during Docker builds. This proposes a way to tolerate the 'already exists' error from openclaw doctor --fix when the Brave plugin installation has already imported the provider profile.

---

Related open issues:

• #5367 [All Platforms][Sandbox] Brave provider profile / plugin pipeline fails during sandbox build and leaves gateway unusable

[ShauryaaSharma]

Was going through @coderabbitai Nitpicks.
Agreed this build-path change should go through the Dockerfile E2E matrix. I can't dispatch nightly-e2e.yaml from my fork, though, every job is gated on github.repository == 'NVIDIA/NemoClaw' and the run needs upstream secrets/runners, so gh workflow run ... --ref no-ops for me.

This needs a maintainer to run the suite (cloud-e2e, sandbox-survival-e2e, hermes-e2e, rebuild-openclaw-e2e, openclaw-tui-chat-correlation-e2e), same gate as the copy-pr-bot approval. Happy to adjust the fix if any of those surface an issue.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@ShauryaaSharma: Understood — the fork-gating on github.repository == 'NVIDIA/NemoClaw' is a real blocker for self-dispatching those workflows. The constraint is clear and your workaround summary is well documented.

The handoff needed from a maintainer is:

Suite	Purpose relative to this fix
sandbox-survival-e2e	Most directly validates the Brave plugin + openclaw doctor --fix path inside the Docker build
rebuild-openclaw-e2e	Covers the image rebuild cycle that was broken by the non-zero exit
cloud-e2e / hermes-e2e / openclaw-tui-chat-correlation-e2e	Regression guard for unrelated paths that share the same Dockerfile

@wscurran — could you trigger the nightly-e2e.yaml matrix against this PR branch when you get a chance? That's the gate blocking merge here. ShauryaaSharma has indicated they're happy to iterate on the fix based on whatever the runs surface.

[ShauryaaSharma]

Rebased onto current NVIDIA:main. Branch is up to date and merges cleanly.

This has been open for ~2 weeks now with one approval already in. @wscurran @ericksoa, could one of you trigger nightly-e2e.yaml against this branch and provide a write-access review when you get a chance? Happy to iterate on any feedback.

[cv]

Maintainer verification on current origin/main (09bef70d50e60d13a12a07a6eac17ebd15155beb) shows that this failure is already fixed:

• A full Brave-enabled Docker build (NEMOCLAW_WEB_SEARCH_ENABLED=1) completed successfully with the image running OpenClaw 2026.5.27; the Brave plugin install and openclaw doctor --fix --non-interactive step passed.
• In isolated pinned-version probes, the old inline tools.web.search.apiKey schema failed plugin installation with status 1, while the current schema installed @openclaw/brave-plugin@2026.5.27 with status 0 and doctor returned status 0.
• [All Platforms][Sandbox] Brave provider profile / plugin pipeline fails during sandbox build and leaves gateway unusable #5367 was filed before fix(onboard): write current web-search schema so the brave plugin install validates #5318 merged. fix(onboard): write current web-search schema so the brave plugin install validates #5318 (56f62b190) changed NemoClaw to emit the current provider-owned plugin schema, removing the original failure.

The reported custom provider profile brave already exists diagnostic comes from the host-side OpenShell provider-profile import, not from the OpenClaw 2026.5.27 doctor/plugin path. Adding a broad Docker guard for already exists would therefore mask unrelated doctor failures without addressing a reproducible defect. The correct current behavior is to keep doctor fail-closed.

Closing without replacement. The sole PR commit is also unsigned/unverified and cannot satisfy the release gate.