Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

Dockerfile.base (1)

132-140: ⚠️ Potential issue | 🟠 Major

Fail closed if min_openclaw_version cannot be parsed.

The OPENCLAW_MIN_VERSION extraction pipeline (grep | awk | tr) silently yields an empty string if the key is missing or renamed in blueprint.yaml. When empty, the sort -V comparison trivially passes because an empty string sorts before any version, effectively disabling the minimum-version guard without failing the build.

🐛 Proposed fix to validate OPENCLAW_MIN_VERSION is non-empty

 RUN --mount=type=bind,source=nemoclaw-blueprint/blueprint.yaml,target=/tmp/blueprint.yaml \
     echo "$OPENCLAW_VERSION" | grep -qxE '[0-9]+(\.[0-9]+)*' \
     || { echo "Error: OPENCLAW_VERSION='$OPENCLAW_VERSION' is invalid (expected e.g. 2026.3.11)."; exit 1; }; \
     OPENCLAW_MIN_VERSION=$(grep 'min_openclaw_version' /tmp/blueprint.yaml | awk '{print $2}' | tr -d '"') \
+    && [ -n "$OPENCLAW_MIN_VERSION" ] \
+    || { echo "Error: Could not parse min_openclaw_version from nemoclaw-blueprint/blueprint.yaml"; exit 1; }; \
     && if [ "$(printf '%s\n%s' "$OPENCLAW_MIN_VERSION" "$OPENCLAW_VERSION" | sort -V | head -n1)" != "$OPENCLAW_MIN_VERSION" ]; then \
         echo "Error: OpenClaw version ${OPENCLAW_VERSION} is below the minimum required version ${OPENCLAW_MIN_VERSION}"; \
         echo "Hint: Update min_openclaw_version in nemoclaw-blueprint/blueprint.yaml or use a newer version."; exit 1; \
     fi \

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@Dockerfile.base` around lines 132 - 140, The min-version guard can be
bypassed when OPENCLAW_MIN_VERSION is empty; update the RUN step that sets
OPENCLAW_MIN_VERSION (the grep/awk/tr pipeline reading
nemoclaw-blueprint/blueprint.yaml) to validate the extracted
OPENCLAW_MIN_VERSION is non-empty and fail the build if it is missing or cannot
be parsed: after computing OPENCLAW_MIN_VERSION check if it is empty (e.g. test
-z "$OPENCLAW_MIN_VERSION") and emit a clear error message and exit non-zero
before proceeding to the sort -V comparison and npm view check so the build
fails fast when min_openclaw_version is absent or malformed.

test/install-preflight.test.js (1)

1519-1523: Consider aligning regex with install.sh or adding a guard for missing match.

The regex /ARG OPENCLAW_VERSION=(\S+)/ doesn't allow whitespace around =, but the install.sh awk pattern does ([[:space:]]*=[[:space:]]*). If someone reformats the Dockerfile to ARG OPENCLAW_VERSION = 2026.3.11, the test would extract undefined and fail with a confusing assertion message.

🔧 Optional: Add guard or align regex

   it("resolve_openclaw_version: falls back to Dockerfile.base when package.json omits it", () => {
-    const expected = fs.readFileSync(path.join(import.meta.dirname, "..", "Dockerfile.base"), "utf-8")
-      .match(/ARG OPENCLAW_VERSION=(\S+)/)?.[1];
+    const dockerfileContent = fs.readFileSync(path.join(import.meta.dirname, "..", "Dockerfile.base"), "utf-8");
+    const expected = dockerfileContent.match(/ARG\s+OPENCLAW_VERSION\s*=\s*(\S+)/)?.[1];
+    expect(expected).toBeDefined(); // fail fast with clear message if format changes
     const r = callInstallerFn('resolve_openclaw_version "$PWD"');
     expect(r.stdout.trim()).toBe(expected);
   });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/install-preflight.test.js` around lines 1519 - 1523, The test in
resolve_openclaw_version uses a strict regex /ARG OPENCLAW_VERSION=(\S+)/ which
fails if there is whitespace around '='; update the extraction in the test that
reads Dockerfile.base to either use a whitespace-tolerant pattern (e.g. allow
\s* around '=') or check the match before indexing (guard match and fail with a
clear message), and keep the rest of the test using
callInstallerFn('resolve_openclaw_version "$PWD"') and
expect(r.stdout.trim()).toBe(expected) so the test either extracts the version
robustly or asserts a helpful error when expected is missing.

Dockerfile.base (1)

146-146: Optional: Quote the variable for defensive consistency.

While the format validation ensures OPENCLAW_VERSION only contains safe characters, quoting the argument is a shell best practice that protects against future regex changes.

Suggested change

-    npm install -g openclaw@${OPENCLAW_VERSION} \
+    npm install -g "openclaw@${OPENCLAW_VERSION}" \

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@Dockerfile.base` at line 146, The npm install line uses an unquoted variable
(OPENCLAW_VERSION)—change the npm install invocation that references
openclaw@${OPENCLAW_VERSION} to quote the version argument (e.g., wrap the
openclaw@... value in double quotes) so the shell treats it as a single,
defensive token even if regex/validation changes in the future; update the line
containing openclaw@${OPENCLAW_VERSION} accordingly.

Dockerfile.base (1)

135-137: Anchor the blueprint version extraction to the actual YAML key for robustness.

While the current grep + awk extraction works correctly (exactly one uncommented min_openclaw_version entry exists), a more anchored extractor prevents accidental consumption of commented or similarly named lines in future maintenance. The suggested awk pattern with format validation adds defensive structure:

♻️ Suggested hardening

-    OPENCLAW_MIN_VERSION=$(grep 'min_openclaw_version' /tmp/blueprint.yaml | awk '{print $2}' | tr -d '"'); \
-    [ -n "$OPENCLAW_MIN_VERSION" ] \
-    || { echo "Error: Could not parse min_openclaw_version from nemoclaw-blueprint/blueprint.yaml"; exit 1; }; \
+    OPENCLAW_MIN_VERSION=$(awk -F': *' '/^[[:space:]]*min_openclaw_version:[[:space:]]*/ { gsub(/"/, "", $2); print $2; exit }' /tmp/blueprint.yaml); \
+    echo "$OPENCLAW_MIN_VERSION" | grep -qxE '[0-9]+(\.[0-9]+)*' \
+    || { echo "Error: Could not parse a valid min_openclaw_version from nemoclaw-blueprint/blueprint.yaml"; exit 1; }; \

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@Dockerfile.base` around lines 135 - 137, The extraction of
OPENCLAW_MIN_VERSION should be made robust by anchoring to the YAML key and
validating the format: replace the current grep+awk pipeline that sets
OPENCLAW_MIN_VERSION with a single awk (or grep -P) command that matches lines
beginning with the literal key "min_openclaw_version" (e.g.
/^min_openclaw_version[[:space:]]*:/), extracts the value after the colon,
strips surrounding quotes, and assigns it to OPENCLAW_MIN_VERSION; keep the
existing check that the variable is non-empty and the error/exit branch
unchanged so a missing or malformed value still triggers the same failure path.