fix(cli): avoid blocking follow log streams

Signed-off-by: Yimo Jiang <yimoj@nvidia.com>

Author: yimoj

src/nemoclaw.ts

@@ -1908,12 +1908,13 @@ async function sandboxStatus(sandboxName: string) {
 }
 
 function sandboxLogs(sandboxName: string, follow: boolean) {
-  enableSandboxAuditLogs(sandboxName);
   if (follow) {
     streamSandboxFollowLogs(sandboxName);
+    enableSandboxAuditLogsInBackground(sandboxName);
     return;
   }
 
+  enableSandboxAuditLogs(sandboxName);
   runOpenclawGatewayLogs(sandboxName, false);
   const args = buildSandboxLogsArgs(sandboxName, false);
   const result = runOpenshell(args, {
@@ -1980,6 +1981,8 @@ function streamSandboxFollowLogs(sandboxName: string): void {
   let exiting = false;
   let completedSources = 0;
   let finalStatus = 0;
+  let requestedExitCode: number | null = null;
+  let forcedExitTimer: NodeJS.Timeout | null = null;
 
   const stopChildren = (signal: NodeJS.Signals) => {
     for (const { child } of sources) {
@@ -1988,6 +1991,16 @@ function streamSandboxFollowLogs(sandboxName: string): void {
       }
     }
   };
+  const maybeExit = () => {
+    if (completedSources !== sources.length) {
+      return;
+    }
+    if (forcedExitTimer) {
+      clearTimeout(forcedExitTimer);
+      forcedExitTimer = null;
+    }
+    process.exit(requestedExitCode ?? finalStatus);
+  };
   const exitFromSignal = (signal: NodeJS.Signals | null): number => {
     if (!signal) return 1;
     const signalNumber = os.constants.signals[signal];
@@ -1998,30 +2011,33 @@ function streamSandboxFollowLogs(sandboxName: string): void {
     status: number,
     detail: string | null = null,
   ) => {
-    if (source.done || exiting) return;
+    if (source.done) return;
     source.done = true;
     completedSources += 1;
     if (status !== 0 && finalStatus === 0) {
       finalStatus = status;
     }
-    if (completedSources < sources.length) {
+    if (completedSources < sources.length && !exiting) {
       const suffix = detail || `exit ${status}`;
       console.error(`  ${source.label} stopped (${suffix}); continuing with remaining log source.`);
     }
-    if (completedSources === sources.length) {
-      process.exit(finalStatus);
-    }
+    maybeExit();
+  };
+  const requestExitAfterSignal = (signal: NodeJS.Signals, exitCode: number) => {
+    if (requestedExitCode !== null) return;
+    exiting = true;
+    requestedExitCode = exitCode;
+    stopChildren(signal);
+    forcedExitTimer = setTimeout(() => process.exit(exitCode), 2000);
+    forcedExitTimer.unref?.();
+    maybeExit();
   };
 
   process.once("SIGINT", () => {
-    exiting = true;
-    stopChildren("SIGINT");
-    process.exit(130);
+    requestExitAfterSignal("SIGINT", 130);
   });
   process.once("SIGTERM", () => {
-    exiting = true;
-    stopChildren("SIGTERM");
-    process.exit(143);
+    requestExitAfterSignal("SIGTERM", 143);
   });
 
   for (const source of sources) {
@@ -2035,23 +2051,78 @@ function streamSandboxFollowLogs(sandboxName: string): void {
 }
 
 function enableSandboxAuditLogs(sandboxName: string) {
-  const args = ["settings", "set", sandboxName, "--key", "ocsf_json_enabled", "--value", "true"];
+  const args = buildEnableSandboxAuditLogsArgs(sandboxName);
   const result = runOpenshell(args, {
     stdio: ["ignore", "ignore", "pipe"],
     ignoreError: true,
     timeout: getLogsProbeTimeoutMs(),
   });
   if (result.status !== 0) {
-    const stderr = String(result.stderr || "").trim();
-    console.error(
-      `  Warning: failed to enable OpenShell audit logs for sandbox '${sandboxName}' ` +
-        `(${describeLogProbeResult(result)}): openshell ${args.join(" ")}`,
-    );
-    if (stderr) {
-      console.error(`  ${stderr}`);
+    warnSandboxAuditLogsUnavailable(sandboxName, args, result);
+  }
+}
+
+function enableSandboxAuditLogsInBackground(sandboxName: string): void {
+  const args = buildEnableSandboxAuditLogsArgs(sandboxName);
+  const child = spawn(getOpenshellBinary(), args, {
+    cwd: ROOT,
+    env: process.env,
+    stdio: ["ignore", "ignore", "pipe"],
+  });
+  let stderr = "";
+  let timedOut = false;
+  let reported = false;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    child.kill("SIGTERM");
+  }, getLogsProbeTimeoutMs());
+  timeout.unref?.();
+
+  child.stderr?.on("data", (chunk: Buffer | string) => {
+    stderr += chunk.toString();
+  });
+  child.on("error", (error: Error) => {
+    clearTimeout(timeout);
+    reported = true;
+    warnSandboxAuditLogsUnavailable(sandboxName, args, {
+      status: null,
+      stderr,
+      error,
+    });
+  });
+  child.on("close", (code: number | null, signal: NodeJS.Signals | null) => {
+    clearTimeout(timeout);
+    if (reported || code === 0) {
+      return;
     }
-    console.error("  Policy denial events may be missing from OpenShell logs.");
+    reported = true;
+    warnSandboxAuditLogsUnavailable(sandboxName, args, {
+      status: code,
+      stderr,
+      signal,
+      error: timedOut ? new Error(`openshell ${args.join(" ")} timed out`) : undefined,
+    });
+  });
+}
+
+function warnSandboxAuditLogsUnavailable(
+  sandboxName: string,
+  args: string[],
+  result: SpawnLikeResult,
+): void {
+  const stderr = String(result.stderr || "").trim();
+  console.error(
+    `  Warning: failed to enable OpenShell audit logs for sandbox '${sandboxName}' ` +
+      `(${describeLogProbeResult(result)}): openshell ${args.join(" ")}`,
+  );
+  if (stderr) {
+    console.error(`  ${stderr}`);
   }
+  console.error("  Policy denial events may be missing from OpenShell logs.");
+}
+
+function buildEnableSandboxAuditLogsArgs(sandboxName: string): string[] {
+  return ["settings", "set", sandboxName, "--key", "ocsf_json_enabled", "--value", "true"];
 }
 
 function buildSandboxOpenclawGatewayLogsArgs(sandboxName: string, follow: boolean): string[] {

test/cli.test.ts

@@ -538,6 +538,23 @@ describe("CLI dispatch", () => {
     expect(r.out).toContain(FAKE_OPENSHELL_LOG_LINE);
   });
 
+  it("starts logs --follow streams before audit enable completes", () => {
+    const setup = createLogsTestSetup("nemoclaw-cli-logs-follow-audit-slow-", [
+      'if [ "$1" = "settings" ]; then',
+      "  sleep 2",
+      "  exit 0",
+      "fi",
+    ]);
+
+    const start = Date.now();
+    const r = setup.runLogs("alpha logs --follow", { NEMOCLAW_LOGS_PROBE_TIMEOUT_MS: "500" });
+
+    expect(Date.now() - start).toBeLessThan(1500);
+    expect(r.code).toBe(0);
+    expect(r.out).toContain(FAKE_OPENCLAW_LOG_LINE);
+    expect(r.out).toContain(FAKE_OPENSHELL_LOG_LINE);
+  });
+
   it("keeps logs --follow running when one log source exits", { timeout: 15000 }, async () => {
     const home = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-cli-logs-follow-source-exit-"));
     const localBin = path.join(home, "bin");
@@ -622,6 +639,68 @@ describe("CLI dispatch", () => {
     }
   });
 
+  it("waits for logs --follow children to stop after SIGTERM", { timeout: 15000 }, async () => {
+    const home = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-cli-logs-follow-sigterm-wait-"));
+    const localBin = path.join(home, "bin");
+    const markerFile = path.join(home, "logs-follow-sigterm-wait-args");
+    fs.mkdirSync(localBin, { recursive: true });
+    writeSandboxRegistry(home);
+    fs.writeFileSync(
+      path.join(localBin, "openshell"),
+      [
+        "#!/usr/bin/env bash",
+        `marker_file=${JSON.stringify(markerFile)}`,
+        'printf \'%s\\n\' "$*" >> "$marker_file"',
+        'if [ "$1" = "settings" ]; then',
+        "  exit 0",
+        "fi",
+        'if [ "$1" = "logs" ] || [ "$1" = "sandbox" ]; then',
+        "  trap 'sleep 0.3; exit 0' TERM INT",
+        "  while true; do sleep 1; done",
+        "fi",
+        "exit 0",
+      ].join("\n"),
+      { mode: 0o755 },
+    );
+
+    const child = spawn(process.execPath, [CLI, "alpha", "logs", "--follow"], {
+      cwd: path.join(import.meta.dirname, ".."),
+      env: { ...process.env, HOME: home, PATH: `${localBin}:${process.env.PATH || ""}` },
+      stdio: "ignore",
+    });
+    const exitPromise = new Promise<number | null>((resolve) => {
+      child.once("exit", (code) => resolve(code));
+    });
+    const readCalls = () =>
+      fs.existsSync(markerFile) ? fs.readFileSync(markerFile, "utf8").trim().split(/\n/) : [];
+
+    try {
+      let calls: string[] = [];
+      const deadline = Date.now() + 10000;
+      while (Date.now() < deadline) {
+        calls = readCalls();
+        if (
+          calls.includes("logs alpha -n 200 --source all --tail") &&
+          calls.includes("sandbox exec -n alpha -- tail -n 200 -f /tmp/gateway.log")
+        ) {
+          break;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 100));
+      }
+      child.kill("SIGTERM");
+      const exitedEarly = await Promise.race([
+        exitPromise.then(() => true),
+        new Promise<boolean>((resolve) => setTimeout(() => resolve(false), 100)),
+      ]);
+      expect(exitedEarly).toBe(false);
+      expect(await exitPromise).toBe(143);
+    } finally {
+      if (child.exitCode === null) {
+        child.kill("SIGKILL");
+      }
+    }
+  });
+
   it("uses named sandbox exec for bridge status helpers", () => {
     const home = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-cli-status-messaging-"));
     const localBin = path.join(home, "bin");