feat(cli): add gateway-token command to retrieve auth token

bin/lib/onboard.js

@@ -2353,6 +2353,8 @@ async function onboard(opts = {}) {
 
 module.exports = {
   buildSandboxConfigSyncScript,
+  buildControlUiUrls,
+  fetchGatewayAuthTokenFromSandbox,
   getFutureShellPathHint,
   createSandbox,
   getSandboxInferenceConfig,

bin/nemoclaw.js

@@ -22,7 +22,11 @@ const YW = _useColor ? "\x1b[1;33m" : "";
 
 const { ROOT, SCRIPTS, run, runCapture: _runCapture, runInteractive, shellQuote, validateName } = require("./lib/runner");
 const { resolveOpenshell } = require("./lib/resolve-openshell");
-const { startGatewayForRecovery } = require("./lib/onboard");
+const {
+  buildControlUiUrls,
+  fetchGatewayAuthTokenFromSandbox,
+  startGatewayForRecovery,
+} = require("./lib/onboard");
 const {
   ensureApiKey,
   ensureGithubToken,
@@ -647,6 +651,82 @@ function sandboxLogs(sandboxName, follow) {
   runOpenshell(args);
 }
 
+/**
+ * Wait for a TCP port to accept connections, with timeout.
+ */
+function waitForPort(port, timeoutMs = 10000) {
+  const net = require("net");
+  const start = Date.now();
+  return new Promise((resolve, reject) => {
+    function tryConnect() {
+      const sock = net.createConnection({ port, host: "127.0.0.1" }, () => {
+        sock.destroy();
+        resolve();
+      });
+      sock.on("error", () => {
+        sock.destroy();
+        if (Date.now() - start > timeoutMs) {
+          reject(new Error(`Port ${port} not ready after ${timeoutMs}ms`));
+        } else {
+          setTimeout(tryConnect, 500);
+        }
+      });
+    }
+    tryConnect();
+  });
+}
+
+async function sandboxGatewayToken(sandboxName) {
+  await ensureLiveSandboxOrExit(sandboxName);
+  const token = fetchGatewayAuthTokenFromSandbox(sandboxName);
+  if (!token) {
+    console.error(`  ${_RD}Error${R}: Could not retrieve gateway auth token from sandbox '${sandboxName}'.`);
+    console.error(`  Make sure the sandbox is running and accessible.`);
+    process.exit(1);
+  }
+  // Print warning to stderr before token to stdout
+  console.error(`  ${YW}⚠️  Treat this token like a password. Do not share it or include it in logs/screencasts.${R}`);
+  console.log(token);
+}
+
+async function sandboxOpen(sandboxName) {
+  await ensureLiveSandboxOrExit(sandboxName);
+  // Start port forward and wait for it to be ready
+  runOpenshell(["forward", "start", "--background", "18789", sandboxName], { ignoreError: true });
+  await waitForPort(18789, 10000);
+
+  const token = fetchGatewayAuthTokenFromSandbox(sandboxName);
+  if (!token) {
+    console.error(`  ${_RD}Error${R}: Could not retrieve gateway auth token from sandbox '${sandboxName}'.`);
+    console.error(`  Make sure the sandbox is running and accessible.`);
+    process.exit(1);
+  }
+
+  const urls = buildControlUiUrls(token);
+  const url = urls[0]; // Use the first URL (localhost)
+
+  // Log without token to avoid exposure in terminal history/screencasts
+  const safeUrl = url.replace(/#.*$/, "");
+  console.log(`  Opening Control UI at ${safeUrl} ...`);
+
+  // Open URL in default browser (platform-appropriate)
+  // Windows "start" is a cmd built-in, not an executable — requires shell: true
+  const isWin = process.platform === "win32";
+  const opener = process.platform === "darwin" ? "open" : isWin ? "start" : "xdg-open";
+  try {
+    const child = require("child_process").spawn(opener, isWin ? ["", url] : [url], {
+      stdio: "ignore",
+      detached: true,
+      shell: isWin,
+    });
+    child.unref();
+  } catch (_e) {
+    console.error(`  ${_RD}Error${R}: Could not open browser. Please open this URL manually:`);
+    console.error(`  ${url}`);
+    process.exit(1);
+  }
+}
+
 async function sandboxPolicyAdd(sandboxName) {
   const allPresets = policies.listPresets();
   const applied = policies.getAppliedPresets(sandboxName);
@@ -724,6 +804,8 @@ function help() {
     nemoclaw <name> connect          Shell into a running sandbox
     nemoclaw <name> status           Sandbox health + NIM status
     nemoclaw <name> logs ${D}[--follow]${R}  Stream sandbox logs
+    nemoclaw <name> open             Open Control UI in browser with auth token
+    nemoclaw <name> gateway-token    Print the gateway auth token ${D}(for scripts)${R}
     nemoclaw <name> destroy          Stop NIM + delete sandbox ${D}(--yes to skip prompt)${R}
 
   ${G}Policy Presets:${R}
@@ -800,15 +882,17 @@ const [cmd, ...args] = process.argv.slice(2);
     const actionArgs = args.slice(1);
 
     switch (action) {
-      case "connect":     await sandboxConnect(cmd); break;
-      case "status":      await sandboxStatus(cmd); break;
-      case "logs":        sandboxLogs(cmd, actionArgs.includes("--follow")); break;
-      case "policy-add":  await sandboxPolicyAdd(cmd); break;
-      case "policy-list": sandboxPolicyList(cmd); break;
-      case "destroy":     await sandboxDestroy(cmd, actionArgs); break;
+      case "connect":       await sandboxConnect(cmd); break;
+      case "status":        await sandboxStatus(cmd); break;
+      case "logs":          sandboxLogs(cmd, actionArgs.includes("--follow")); break;
+      case "policy-add":    await sandboxPolicyAdd(cmd); break;
+      case "policy-list":   sandboxPolicyList(cmd); break;
+      case "gateway-token": await sandboxGatewayToken(cmd); break;
+      case "open":          await sandboxOpen(cmd); break;
+      case "destroy":       await sandboxDestroy(cmd, actionArgs); break;
       default:
         console.error(`  Unknown action: ${action}`);
-        console.error(`  Valid actions: connect, status, logs, policy-add, policy-list, destroy`);
+        console.error(`  Valid actions: connect, status, logs, policy-add, policy-list, gateway-token, open, destroy`);
         process.exit(1);
     }
     return;