nemoclaw connect ignores gated NEMOCLAW_VLLM_MODEL without HF_TOKEN, enters sandbox with exit 0

[lyral-commits]

Description

When nemoclaw connect is invoked with a gated model specified via NEMOCLAW_VLLM_MODEL (deepseek-r1-distill-70b) and no HF_TOKEN set, the command performs no gated-model preflight check. It silently ignores NEMOCLAW_VLLM_MODEL, connects directly into the sandbox, and returns exit 0. It should fail fast (exit 1) with an actionable error before entering the sandbox.

Environment

Field	Value
Device	a1u2n2g-0087-02
OS	Ubuntu 24.04
Architecture	x86_64
Node.js	v22.22.3
npm	10.9.8
Docker	29.5.3, build d1c06ef
OpenShell CLI	0.0.44
NemoClaw	v0.0.55
OpenClaw	v2026.5.22

Steps to Reproduce

unset HF_TOKEN HUGGING_FACE_HUB_TOKEN
NEMOCLAW_VLLM_MODEL=deepseek-r1-distill-70b nemoclaw my-assistant connect

Expected Result

The command fails fast: exit code 1, an actionable error message mentioning the gated model / required HF_TOKEN, and NO sandbox shell is entered.

Actual Result

No gated-model preflight is performed. NEMOCLAW_VLLM_MODEL is silently ignored, the sandbox shell is entered, and the command returns exit 0. Two issues observed:

1. [High] nemoclaw connect lacks a gated-model preflight — with NEMOCLAW_VLLM_MODEL=deepseek-r1-distill-70b and no HF_TOKEN, the command does not error or block; it enters the sandbox directly (exit 0).
2. [Medium] No actionable error message — the user has no way to know the gated-model configuration did not take effect, nor that an HF_TOKEN is required.

Step-by-step results

Step	Description	Expected	Actual	Verdict
1	gated model connect	fast exit, no sandbox@	entered sandbox	❌
2	exit code	1	0	❌
3	no sandbox shell	no sandbox@	sandbox@ appeared	❌
4	error message	contains gated/token keywords	none	❌
5	no vLLM container	NO_VLLM_CONTAINER	NO_VLLM_CONTAINER	⚠️
6	control group	normal connect, exit 0	normal connect, exit 0	✅

Logs

Not captured

[laitingsheng]

Fixed by #4567 + #4588