[Brev][Onboard] OpenClaw onboard web UI shows a red error card with RETRY for benign build warnings from steps that succeeded

Read onboard-ui/lib/services/nemoclaw.ts and inspect parseOnboardStderr(), focusing on how BuildKit stderr lines become error events. Reproduce the OpenClaw onboarding flow or review the provided logs, then verify that benign lines do not create a persistent RETRY card while genuine failures and non-zero exits still do.

Description

The NemoClaw onboarding web UI served by nemoclaw-onboard-ui.service on a Brev launchable renders a red error card with a RETRY button under the "Create sandbox" step while onboarding the OpenClaw agent, quoting sandbox image build output #69 0.449 BEGIN failed--compilation aborted at (eval 1) line 4.

That build step actually succeeds (#69 DONE 0.8s). The image build runs to completion, the sandbox reaches Phase: Ready, and onboarding proceeds through all 8 phases. The UI never retracts or supersedes the error card, so the operator is shown a failure for a successful onboarding and is invited to click RETRY, which re-runs brev-quickstart and rebuilds the entire sandbox for no reason. Going back to the dashboard and clicking Chat with Agent opens a working chat and the agent responds normally, confirming the onboarding the UI flagged as failed actually produced a fully usable agent.

Unlike the related reports for other agents, the flagged text here is not never-firing guard text in the Dockerfile: it is genuine output from commands that ran and succeeded. 12 build-output lines across 7 steps trip the UI's error detection, including an INFO-level success message that is flagged only because a filename contains the substring error (see Actual Result).

Reproduced with agent OpenClaw v2026.7.1. The affected steps are apt and Node steps that do not depend on the inference provider; the run verified here used OpenRouter, and the same #69 step was reported on a run using NVIDIA Cloud (build).

• Platform scope: Reproduced on Brev launchable (Ubuntu 22.04) only; other platforms not tested
• Regression: Unknown — earlier versions not tested

Environment

Device:        Brev launchable instance (n2d-standard-4, CPU-only, no GPU)
OS:            Ubuntu 22.04.5 LTS (Linux 6.8.0-1064-gcp)
Architecture:  x86_64
Node.js:       v22.23.2
npm:           10.9.8
Docker:        Docker version 29.1.3, build 29.1.3-0ubuntu3~22.04.2
OpenShell CLI: openshell 0.0.85
NemoClaw:      nemoclaw v0.0.97
OpenClaw:      OpenClaw 2026.7.1 (2d2ddc4)

Steps to Reproduce

1. Create a Brev instance from the NemoClaw launchable and open the onboarding web UI (port 3000) in a browser.

2. Select agent OpenClaw, any supported provider and model, sandbox name my-assistant.

3. Start onboarding and watch the "Create sandbox" step and the Activity Log.

4. When the image build reaches step #69 (the apt toolchain-purge step), observe the step status in the UI.

5. Let onboarding run to completion, then on the host run:

   nemoclaw list
   nemoclaw my-assistant status
   

6. Back in the onboarding UI, go to the dashboard and click Chat with Agent.

Expected Result

BuildKit progress and build command output are rendered as build progress. The UI reports an error only when a build step actually fails (BuildKit prints its own ERROR: process "..." did not complete successfully) or when brev-quickstart exits non-zero. A step that reports DONE is shown as complete, and a successful onboarding ends in the success state with no RETRY offered.

Actual Result

A red error card with a RETRY button appears under "Create sandbox" quoting:

#69 0.449 BEGIN failed--compilation aborted at (eval 1) line 4.

The card stays on screen while the build continues past that step and onboarding completes:

#69 DONE 0.8s
#112 exporting to image
Sandbox 'my-assistant' created
[7/8] Setting up OpenClaw inside sandbox
[8/8] Policy presets
nemoclaw my-assistant status -> Phase: Ready, Harness: OpenClaw (gateway),
                                Agent: OpenClaw v2026.7.1, Inference reachable
dashboard "Chat with Agent"  -> opens a working chat; the agent responds
                                normally to interactive prompts

12 build-output lines across 7 steps match the UI's error detection. None of them indicates a failure; every one of these steps reported DONE:

#69 0.398 BEGIN failed--compilation aborted at (eval 1) line 4.
#72 0.462 Warning: Ignoring extra certs from `/usr/local/share/nemoclaw/corporate-ca.pem`, load failed: error:80000002:...
#76 0.362 Warning: Ignoring extra certs from `/usr/local/share/nemoclaw/corporate-ca.pem`, load failed: error:80000002:...
#76 1.208 (same warning)
#76 1.672 (same warning)
#76 2.040 (same warning)
#79 1.601 (same warning)
#84 0.475 INFO: patched OpenClaw #4434 diagnostics in assistant-error-format-Ccvn1r0A.js
#95 1.677 (same warning)
#95 5.896 (same warning)
#98 1.636 (same warning)
#98 8.166 (same warning)

Note #84: an INFO-level success message is flagged as an error purely because the filename it names contains the substring error (assistant-error-format-Ccvn1r0A.js).

Analysis

1. BuildKit writes its progress lines and the stdout/stderr of each RUN step to stderr, prefixed #NN {elapsed} {text}.
2. onboard-ui/lib/services/nemoclaw.ts, parseOnboardStderr(), emits a hard {type:"error"} event for any stderr line matching /\b(error|failed)\b/i (the full pattern also covers unauthorized, forbidden, authentication, invalid api key, upstream unavailable). There is no exclusion for build output and no notion of whether the step later reported DONE, so a single benign warning permanently marks the whole "Create sandbox" step as failed.
3. For OpenClaw the matching text is ordinary command output rather than Dockerfile guard text:
   • #69: apt-get autoremove --purge removes libgdbm6t64 and libgdbm-compat4t64, which leaves debconf's Perl unable to load Debconf/Log.pm; debconf prints a warning ending BEGIN failed--compilation aborted. apt then completes the removal, the step's final checks (ps --version, chattr, tmux) pass, and the step reports DONE.
   • The repeated Node warning Ignoring extra certs ... load failed comes from an empty /usr/local/share/nemoclaw/corporate-ca.pem when NEMOCLAW_CORPORATE_CA_B64 is not set.
   • #84 is an INFO success line whose payload is a filename containing error.

Suggested fix: in parseOnboardStderr(), skip BuildKit lines (/^#\d+\s/), or only raise an error on BuildKit's own ERROR: process "..." did not complete successfully marker and on a non-zero child exit code. This case cannot be fixed by rewording Dockerfile guard text, because the matching strings come from third-party command output.

Secondary observations, noted for completeness and not the subject of this report: the autoremove in step #69 breaking debconf's Perl, and the empty corporate-ca.pem producing 10 identical Node warnings, are both build noise worth cleaning up independently.

Related Bugs / not duplicate of

Issues #8101 (LangChain Deep Agents Code) and #8105 (Hermes Agent) report the same UI symptom, but in those cases the matching text is never-firing guard text inside the agent Dockerfile.

This report is filed separately because the trigger is different in kind: the matching strings here are genuine output from third-party commands (apt, debconf, Node) and from an INFO success message naming a file whose name contains error. A per-agent workaround of rewording Dockerfile guard text would fix #8101 and #8105 but would not fix this. The parseOnboardStderr() change suggested above resolves all three.

Logs

Onboarding UI service log (host names removed), showing the flagged output and the successful continuation of the same build:

[onboard] #69 0.296 The following packages will be REMOVED:
[onboard] #69 0.296   libgdbm-compat4t64* libgdbm6t64*
[onboard] #69 0.398 debconf: Perl may be unconfigured (Can't locate Debconf/Log.pm in @INC ...
[onboard] #69 0.398 BEGIN failed--compilation aborted at (eval 1) line 4.
[onboard] #69 0.398 ) -- aborting
[onboard] #69 0.429 0 upgraded, 0 newly installed, 2 to remove and 0 not upgraded.
[onboard] #69 0.532 Removing libgdbm-compat4t64:amd64 (1.24-2) ...
[onboard] #69 0.559 Removing libgdbm6t64:amd64 (1.24-2) ...
[onboard] #69 0.589 Processing triggers for libc-bin (2.41-12+deb13u3) ...
[onboard] #69 0.751 ps from procps-ng 4.0.4
[onboard] #69 DONE 0.8s
[onboard] #112 exporting to image
[onboard] * Sandbox 'my-assistant' created
[onboard] [7/8] Setting up OpenClaw inside sandbox
[onboard] [8/8] Policy presets

Anyone who plans to fix one of #8101, #8105 and #8109 should consider to fix them altogether.