fix(supervisor): preserve standard sbin paths in sandbox shells

[elezar]

Summary

Preserve standard sbin directories in sandbox child shells when CDI exposes tools such as /usr/sbin/nvidia-smi on Orin systems. This PR is stacked directly on #4204 and includes its latest socket validation and musl opener fixes.

Related Issue

Related to #1606. Depends on #4204, which contains the CDI resolver, sandbox consumer, Docker producer, and RPM vendor mapping fix.

Changes

• Normalize child PATH values to include /usr/local/sbin, /usr/sbin, and /sbin only when both the CDI context and effective policy require a standard-sbin path.
• Apply the gated repair to shell entrypoints, SSH exec/login shells, and provider-supplied PATH values.
• Install an idempotent repair in existing .bashrc files while rejecting symlinks, symlinked parents, and non-regular startup files.
• Preserve current reserved-environment filtering during launch and exec.
• Cover gate behavior, PATH normalization, startup snippet idempotency and symlink handling, shell wrapping, provider PATH values, and child environments with unit tests.

Testing

• mise run pre-commit passes on the rebased branch.
• cargo test --locked -p openshell-sandbox --lib: 51 native tests passed.
• Linux sandbox test build passed; 48 focused tests passed in isolated Linux containers: 14 child-environment tests, 23 process tests, and 11 boundary-exec tests, including piped and PTY exec.
• Rebases to exactly one commit above feat(gpu): derive Docker sandbox requirements from CDI specs #4204 at d87c6abb7.
• Repeat Docker GPU E2E and Orin hardware validation against this rebased head.

Earlier Orin validation found /usr/sbin/nvidia-smi and reported the GPU, while a non-GPU sandbox retained its original PATH. Those hardware results have not been rerun on this head.

Checklist

• Follows Conventional Commits.
• Commit is signed off (DCO).

[github-actions]

Label test:e2e-gpu applied for d4ddb87. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute GPU E2E after building the required supervisor image once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[sandl99]

AGX Thor validation update

We reproduced the Jetson CUDA failure and passed the NemoClaw onboarding GPU gate on an NVIDIA AGX Thor through OpenShell's native Docker CDI route.

✓ GPU proof passed: nvidia-smi when available
✓ GPU proof passed: /proc/<pid>/task/<tid>/comm write
✓ GPU proof passed: cuInit(0) via libcuda.so.1
✓ Sandbox CUDA usability proven (cuInit succeeded).

The isolation result was:

host                                      cuInit(0)=0
plain Docker CDI                          cuInit(0)=0
same container and non-root UID/GIDs      cuInit(0)=0
OpenShell supervisor without /sys access  cuInit(0)=801
OpenShell supervisor with /sys read-only  cuInit(0)=0

This confirms that #2846 fixes the Jetson PATH issue: /usr/sbin/nvidia-smi was found and passed. It also shows two separate gaps outside this PR's current scope:

1. Thor CUDA initialization requires sysfs access that is not present in the CDI-enriched Landlock policy. We used a test-only read-only /sys grant. A production fix should define the minimum safe sysfs contract or explicitly approve the broader read-only grant.
2. The Thor CDI enrichment generated 301 filesystem paths, which exceeded the current 256-path policy limit. We used a local 512-path limit for this test.

The tested binary was based on OpenShell 1e5116ca8 plus the local path-limit change, not the current #2846 commit e2c6cc7d29df69ca5cefad107cd989de605127ec. The result should therefore be repeated on the final upstream stack after the sysfs and policy-capacity gaps are resolved. This comment records GPU-stage evidence only; it does not claim that full NemoClaw onboarding exited successfully.

The sysfs and path-capacity work appears best tracked under #1606 or a focused child issue, while #2846 remains the PATH fix.

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. api-behavior — No explicit risk acceptance found

When CDI is active and policy covers an sbin path, explicit PATH values now gain /usr/local/sbin:/usr/sbin:/sbin, and an empty PATH becomes a nonempty default.

• Impact: CLI and SDK consumers relying on exact PATH values, empty command lookup, or command-not-found behavior can observe different executables and output.
• Action: Preserve explicit PATH values in v0.1.5 and make sbin augmentation an opt-in behavior with migration guidance in a later minor train.
• PR: fix(supervisor): preserve standard sbin paths in sandbox shells #2846

2. state — No explicit risk acceptance found

A gated CDI workload launch previously left $HOME/.bashrc untouched but now appends an OpenShell PATH snippet to an existing regular .bashrc.

• Impact: Existing sandboxes can acquire durable unrequested dotfile changes that break managed-file checks and alter later shells even after CDI is no longer used.
• Action: Remove automatic .bashrc writes from v0.1.5 or require explicit opt-in and provide cleanup guidance for modified workspaces.
• PR: fix(supervisor): preserve standard sbin paths in sandbox shells #2846

Review details

• Execution: complete
• Candidate: PR #2846 (9e790f613ba76d25975a64a30540cdcdff4b3be4)
• Baseline: 33350a881f55011286e7c3a68d8007e43e50e0bf (33350a881f55011286e7c3a68d8007e43e50e0bf)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run