fix(onboard): upgrade OpenShell to 0.0.24 for sandbox survival across restarts

bin/lib/onboard.js

@@ -1548,7 +1548,9 @@ async function preflight() {
     console.log("  ⓘ Running under WSL");
   }
 
-  // OpenShell CLI
+  // OpenShell CLI — install if missing, upgrade if below minimum version.
+  // MIN_VERSION in install-openshell.sh handles the version gate; calling it
+  // when openshell already exists is safe (it exits early if version is OK).
   let openshellInstall = { localBin: null, futureShellPathHint: null };
   if (!isOpenshellInstalled()) {
     console.log("  openshell CLI not found. Installing...");
@@ -1558,6 +1560,37 @@ async function preflight() {
       console.error("  Install manually: https://github.com/NVIDIA/OpenShell/releases");
       process.exit(1);
     }
+  } else {
+    // Ensure the installed version meets the minimum required by install-openshell.sh.
+    // The script itself is idempotent — it exits early if the version is already sufficient.
+    const currentVersion = getInstalledOpenshellVersion();
+    if (!currentVersion) {
+      console.log("  openshell version could not be determined. Reinstalling...");
+      openshellInstall = installOpenshell();
+      if (!openshellInstall.installed) {
+        console.error("  Failed to reinstall openshell CLI.");
+        console.error("  Install manually: https://github.com/NVIDIA/OpenShell/releases");
+        process.exit(1);
+      }
+    } else {
+      const parts = currentVersion.split(".").map(Number);
+      const minParts = [0, 0, 24]; // must match MIN_VERSION in scripts/install-openshell.sh
+      const needsUpgrade =
+        parts[0] < minParts[0] ||
+        (parts[0] === minParts[0] && parts[1] < minParts[1]) ||
+        (parts[0] === minParts[0] && parts[1] === minParts[1] && parts[2] < minParts[2]);
+      if (needsUpgrade) {
+        console.log(
+          `  openshell ${currentVersion} is below minimum required version. Upgrading...`,
+        );
+        openshellInstall = installOpenshell();
+        if (!openshellInstall.installed) {
+          console.error("  Failed to upgrade openshell CLI.");
+          console.error("  Install manually: https://github.com/NVIDIA/OpenShell/releases");
+          process.exit(1);
+        }
+      }
+    }
   }
   console.log(
     `  ✓ openshell CLI: ${runCaptureOpenshell(["--version"], { ignoreError: true }) || "unknown"}`,

scripts/brev-launchable-ci-cpu.sh

@@ -40,7 +40,7 @@
 set -euo pipefail
 
 # ── Configuration ────────────────────────────────────────────────────
-OPENSHELL_VERSION="${OPENSHELL_VERSION:-v0.0.20}"
+OPENSHELL_VERSION="${OPENSHELL_VERSION:-v0.0.24}"
 NEMOCLAW_REF="${NEMOCLAW_REF:-main}"
 TARGET_USER="${SUDO_USER:-$(id -un)}"
 TARGET_HOME="$(getent passwd "$TARGET_USER" | cut -d: -f6)"
@@ -161,7 +161,27 @@ fi
 # 4. OpenShell CLI
 # ══════════════════════════════════════════════════════════════════════
 if command -v openshell >/dev/null 2>&1; then
-  info "OpenShell CLI already installed: $(openshell --version 2>&1 || echo unknown)"
+  _installed_ver="$(openshell --version 2>&1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || echo '0.0.0')"
+  _pinned_ver="${OPENSHELL_VERSION#v}" # strip leading 'v'
+  if [ "$_installed_ver" = "$_pinned_ver" ]; then
+    info "OpenShell CLI already installed at pinned version: $_installed_ver"
+  else
+    info "OpenShell CLI $_installed_ver does not match pinned ${_pinned_ver} — reinstalling..."
+    ARCH="$(uname -m)"
+    case "$ARCH" in
+      x86_64 | amd64) ASSET="openshell-x86_64-unknown-linux-musl.tar.gz" ;;
+      aarch64 | arm64) ASSET="openshell-aarch64-unknown-linux-musl.tar.gz" ;;
+      *) fail "Unsupported architecture: $ARCH" ;;
+    esac
+    tmpdir="$(mktemp -d)"
+    retry 3 10 "download openshell" \
+      curl -fsSL -o "$tmpdir/$ASSET" \
+      "https://github.com/NVIDIA/OpenShell/releases/download/${OPENSHELL_VERSION}/${ASSET}"
+    tar xzf "$tmpdir/$ASSET" -C "$tmpdir"
+    sudo install -m 755 "$tmpdir/openshell" /usr/local/bin/openshell
+    rm -rf "$tmpdir"
+    info "OpenShell CLI upgraded: $(openshell --version 2>&1 || echo unknown)"
+  fi
 else
   info "Installing OpenShell CLI ${OPENSHELL_VERSION}..."
   ARCH="$(uname -m)"

scripts/install-openshell.sh

@@ -35,7 +35,7 @@ info "Detected $OS_LABEL ($ARCH_LABEL)"
 
 # Minimum version required for sandbox persistence across gateway restarts
 # (deterministic k3s node name + workspace PVC: NVIDIA/OpenShell#739, #488)
-MIN_VERSION="0.0.22"
+MIN_VERSION="0.0.24"
 
 version_gte() {
   # Returns 0 (true) if $1 >= $2 — portable, no sort -V (BSD compat)