[obs-gap:nemoclaw] nemoclaw: container-sandbox gateway log fetched via `sandbox exec ... tail`, not host filesystem read

[github-actions]

Automated harness-observability audit found a gap for nemoclaw.

• Harness exposes: The real CLI log path (test/cli/logs.test.ts) fetches the OpenClaw gateway log for a sandbox by running openshell sandbox exec -n <name> -- tail -n 200 [-f] /tmp/gateway.log INSIDE the sandbox, then separately calls openshell logs <name> -n 200 --source all for OCSF audit lines — because for container-backed sandboxes /tmp/gateway.log lives in the container's filesystem, not the host's.
• ClawMetry misses: _openshell_sandbox_logs() never calls sandbox exec ... tail /tmp/gateway.log. Instead, for non-terminal sandboxes it merges lines read directly off host candidate paths via _gateway_log_files()/OPENSHELL_GATEWAY_LOG. For a genuinely container-isolated sandbox where the host has no visibility into that path, this silently yields no gateway-log lines instead of the ones the harness's own tail-in-sandbox call would return.
• Where (harness): test/cli/logs.test.ts (createLogsTestSetup / runLogs call sequence: "sandbox exec -n alpha -- tail -n 200 /tmp/gateway.log", "sandbox exec -n alpha -- tail -n 200 -f /tmp/gateway.log")
• Severity: high
• Closest capability: LOGS

Filed by scripts/harness/audit.py. Fingerprint: hgap-bff6366705 (used to dedupe — keep it in the body).

[vivekchand]

Hi @vivekchand! Took a careful look at this one. Here's the plan:

The problem
For container-isolated NemoClaw sandboxes, _openshell_sandbox_logs() tries to read /tmp/gateway.log off the host filesystem — but that file lives inside the container, so ClawMetry silently returns no gateway-log lines when the host path is inaccessible.

Approach

1. clawmetry/adapters/openclaw.py:788-808 — Inside the sandboxRuntimeKind != "terminal" branch, record the event count before the host-path read attempt (_gw_events_before = len(events)).
2. After the existing open(...) block, add a fallback: if no new events were collected from host paths and no OPENSHELL_GATEWAY_LOG env override is set, run openshell sandbox exec -n <name> -- tail -n <count> /tmp/gateway.log via subprocess (reusing the already-imported _sp).
3. Parse the stdout lines as OCSF JSON exactly like the host-path branch does, merging results into events.

This mirrors exactly what the harness does in test/cli/logs.test.ts ("sandbox exec -n alpha -- tail -n 200 /tmp/gateway.log"). The env override path is untouched, so test fixtures that set OPENSHELL_GATEWAY_LOG keep working.

Test plan

• python3 -c 'import ast; ast.parse(open("clawmetry/adapters/openclaw.py").read())' — syntax clean
• python3 -m pytest tests/ -q -k "sandbox" — existing sandbox-related tests pass

Estimated change
~15 lines across 1 file (clawmetry/adapters/openclaw.py).

Drafting a PR now — will link here when ready. If you'd rather drive this yourself, drop a comment and I'll back off.

---

Generated by Claude Code

[vivekchand]

Draft PR opened: #5205. Please review when you have a moment.

---

Generated by Claude Code