Hermes dashboard internal port is not validated against the dashboard port during onboarding

[latenighthackathon]

Description

NemoClaw validates the Hermes dashboard ports before creating the sandbox in resolveHermesDashboardOnboardState. When the dashboard is enabled it rejects the external port (NEMOCLAW_HERMES_DASHBOARD_PORT) if it equals the resolved dashboard/chat-UI port or the internal port. The internal port (NEMOCLAW_HERMES_DASHBOARD_INTERNAL_PORT), however, is only checked against the external port, never against the resolved dashboard port. Setting the internal port equal to the dashboard port passes onboarding validation and then collides when the dashboard forward is started.

Code: https://github.com/NVIDIA/NemoClaw/blob/main/src/lib/onboard/hermes-dashboard.ts#L43

Steps to Reproduce

1. Onboard a Hermes agent with the dashboard enabled (NEMOCLAW_HERMES_DASHBOARD=1).
2. Set NEMOCLAW_HERMES_DASHBOARD_INTERNAL_PORT equal to the resolved dashboard/chat-UI port.
3. Run nemoclaw onboard.

Expected Result

Onboarding rejects NEMOCLAW_HERMES_DASHBOARD_INTERNAL_PORT up front when it equals the resolved dashboard port, with a clear message, the same way the external port is already rejected.

Actual Result

The collision is not caught during validation; onboarding proceeds and the dashboard forward fails later on the duplicated port.

Suggested Fix

Add the symmetric check: reject when the internal port equals the resolved dashboard port (config.internalPort === effectivePort), mirroring the existing external-port guard.

[wscurran]

✨ Thanks for submitting this detailed issue about the Hermes dashboard internal port not being validated against the dashboard port during onboarding. This identifies a bug in the Hermes onboarding process that affects the dashboard functionality.