[All Platforms][CLI&UX] nemoclaw tunnel stop reports gateway not running and exits 0 while in-sandbox openclaw gateway keeps running #4951

Description

nemoclaw tunnel stop (and its deprecated alias nemoclaw stop) tries to stop the in-sandbox OpenClaw gateway by running an awk-based pgrep inside the sandbox container. The detection regex in src/lib/tunnel/services.ts:480 is:

cmd ~ /(^|[[:space:]/])openclaw-gateway([[:space:]]|$)/
  || cmd ~ /(^|[[:space:]/])openclaw[[:space:]]+gateway([[:space:]]|$)/

It expects the running gateway's argv (ps -eo args=) to contain either openclaw-gateway (hyphen) or openclaw gateway (space-separated). But the openclaw binary rewrites its own argv via process.title = 'openclaw', so the running process always shows just openclaw in argv with no gateway suffix.

Result: find_gateway_pids returns empty → stop script exits 1 → reportStopResult interprets exit 1 as "gateway was not running" → command exits 0 with no error.

User-visible impact: user runs nemoclaw tunnel stop thinking the in-sandbox gateway and channel pollers will shut down, but they keep running. The command's rc=0 falsely confirms success. Subsequent restart attempts may conflict, and channels (Slack/Telegram/Discord) keep polling.

Environment

Reproducible on both:
  Ubuntu 24.04 LTS x86_64  (kernel 6.17.0-23-generic) — no-GPU host
  Ubuntu 24.04 LTS aarch64 (kernel 6.17.0-1021-nvidia-64k) — GPU host
NemoClaw:  v0.0.60
OpenShell: 0.0.44 (docker driver)
OpenClaw:  v2026.5.27

Steps to Reproduce

1. Onboard any sandbox (no GPU is fine):

   nemoclaw onboard --name respawn-test --non-interactive --no-gpu

2. Verify gateway is running:

   CNAME=$(docker ps --filter name=openshell- --format '{{.Names}}' | head -1)
   docker exec $CNAME pgrep -af '^openclaw$'
   # expect: <PID> openclaw

3. Run: nemoclaw tunnel stop

4. Check gateway PID again:

   docker exec $CNAME pgrep -af '^openclaw$'

Expected Result

Step 3 reports "OpenClaw gateway stopped inside sandbox." and exits 0.

Step 4 returns empty (gateway terminated).

Actual Result

Step 3:

[services] Stopping in-sandbox OpenClaw gateway (sandbox: respawn-test)...
[services] OpenClaw gateway was not running inside sandbox.
[services] cloudflared was not running
[services] All services stopped.
rc=0

Step 4 still returns the same PID (e.g. 1383 openclaw). Gateway was NOT stopped.

Logs

Code references:
  src/lib/tunnel/services.ts:471-514  (GATEWAY_STOP_SCRIPT — awk regex)
  src/lib/tunnel/services.ts:562-585  (reportStopResult — exit 1 -> "not running")
  scripts/nemoclaw-start.sh:3185,3238 (gateway spawn: `nohup "$OPENCLAW" gateway run --port ...`)

Commit:
  69403e011b (Brandon Pelfrey, 2026-05-01) — original regex, unchanged

Suggested fixes:
  1. Update regex to match the rewritten argv (just `openclaw` running as user `sandbox`).
  2. Use a PID file written by nemoclaw-start instead of regex-based detection.
  3. Stop relying on argv inspection — use OPENCLAW_GATEWAY_TOKEN/socket to send shutdown.
  4. Cross-repo: change openclaw to NOT rewrite argv (or to retain `gateway` suffix).

NVB#6282411