fix(cli): guide deprecated global start

docs/manage-sandboxes/run-sandboxes.mdx

@@ -158,7 +158,8 @@ $$nemoclaw tunnel start
 ```
 
 `$$nemoclaw tunnel stop` stops the tunnel and asks NemoClaw to stop the in-sandbox gateway for the selected or default sandbox.
-The older `$$nemoclaw start` still works as a deprecated alias.
+The older `$$nemoclaw start` now prints migration guidance and exits successfully without starting
+a sandbox or tunnel. Use `$$nemoclaw <name> start` or `$$nemoclaw tunnel start` explicitly.
 </AgentOnly>
 <AgentOnly variant="hermes">
 

docs/reference/commands.mdx

@@ -3950,7 +3950,9 @@ export CLOUDFLARE_TUNNEL_TOKEN=<cloudflare-tunnel-token>
 $$nemoclaw tunnel start
 ```
 
-`$$nemoclaw start` remains as a deprecated alias that prints a warning and delegates to `tunnel start`.
+`$$nemoclaw start` remains as a deprecated compatibility command. It exits successfully after
+printing guidance for `$$nemoclaw <name> start` and `$$nemoclaw tunnel start`; it does not start
+either resource itself.
 
 ### `$$nemoclaw tunnel stop`
 
@@ -3985,10 +3987,12 @@ $$nemoclaw tunnel status
 ### `$$nemoclaw start`
 
 <Warning>
-Deprecated. Use `$$nemoclaw tunnel start` instead.
+Deprecated. Use `$$nemoclaw <name> start` for a stopped sandbox or `$$nemoclaw tunnel start` for
+the optional public-URL tunnel.
 </Warning>
 
-This command remains as a compatibility alias to `$$nemoclaw tunnel start`.
+This compatibility command prints migration guidance and exits successfully without changing
+sandbox or tunnel state.
 
 ### `$$nemoclaw stop`
 

src/commands/simple-global-oclif-adapters.test.ts

@@ -289,11 +289,12 @@ describe("simple global oclif adapters", () => {
 
   it("maps tunnel and deprecated service commands to service actions", async () => {
     await TunnelStartCommand.run([], rootDir);
+    expect(mocks.runStartCommand).toHaveBeenCalledTimes(1);
     await TunnelStopCommand.run([], rootDir);
     await DeprecatedStartCommand.run([], rootDir);
+    expect(mocks.runStartCommand).toHaveBeenCalledTimes(1);
     await DeprecatedStopCommand.run([], rootDir);
 
-    expect(mocks.runStartCommand).toHaveBeenCalledTimes(2);
     expect(mocks.runStopCommand).toHaveBeenCalledTimes(2);
     expect(mocks.runStartCommand).toHaveBeenCalledWith(
       expect.objectContaining({ listSandboxes: expect.any(Function), startAll: mocks.startAll }),

src/commands/start.ts

@@ -2,26 +2,25 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { NemoClawCommand } from "../lib/cli/nemoclaw-oclif-command";
-import { serviceDeps } from "../lib/tunnel/command-support";
-import { runStartCommand } from "../lib/tunnel/service-command";
-import { startAll } from "../lib/tunnel/services";
+
+const DEPRECATED_START_MESSAGE =
+  "Deprecated: 'nemoclaw start' no longer starts a resource. Use 'nemoclaw <name> start' for a stopped sandbox or 'nemoclaw tunnel start' for the optional public-URL tunnel.";
 
 export default class DeprecatedStartCommand extends NemoClawCommand {
   static id = "start";
   static strict = true;
-  static summary = "Deprecated alias for 'tunnel start'";
-  static description = "Deprecated alias for tunnel start.";
+  static summary = "Deprecated command that prints start migration guidance";
+  static description =
+    "Use 'nemoclaw <name> start' or 'nemoclaw tunnel start'; this command does not start a sandbox or public-URL tunnel.";
   static usage = ["start"];
   static examples = ["<%= config.bin %> start"];
   static state = "deprecated" as const;
   static deprecationOptions = {
-    message:
-      "Deprecated: 'nemoclaw start' is now 'nemoclaw tunnel start'. To start a stopped sandbox container instead, use 'nemoclaw <name> start'. See 'nemoclaw help'.",
+    message: DEPRECATED_START_MESSAGE,
   };
   static flags = {};
 
   public async run(): Promise<void> {
     await this.parse(DeprecatedStartCommand);
-    await runStartCommand({ ...serviceDeps(), startAll });
   }
 }

test/cli/dispatch-basics.test.ts

@@ -75,7 +75,7 @@ describe("CLI dispatch", () => {
   });
 
   it(
-    "start does not prompt for NVIDIA_INFERENCE_API_KEY before launching local services",
+    "deprecated start does not prompt for NVIDIA_INFERENCE_API_KEY or launch local services",
     testTimeoutOptions(35_000),
     () => {
       const home = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-cli-start-no-key-"));
@@ -112,7 +112,7 @@ describe("CLI dispatch", () => {
       );
 
       const r = runWithEnv(
-        "start",
+        "start 2>&1",
         {
           HOME: home,
           PATH: `${localBin}:${process.env.PATH || ""}`,
@@ -124,8 +124,9 @@ describe("CLI dispatch", () => {
 
       expect(r.code).toBe(0);
       expect(r.out).not.toContain("NVIDIA API Key required");
-      // Services module now runs in-process (no bash shelling)
-      expect(r.out).toContain("NemoClaw Services");
+      expect(r.out).toContain("nemoclaw <name> start");
+      expect(r.out).toContain("nemoclaw tunnel start");
+      expect(fs.existsSync(markerFile)).toBe(false);
     },
   );
 

test/cli/tunnel-command.test.ts

@@ -30,11 +30,20 @@ describe("tunnel CLI dispatch", () => {
     expect(r.out).toContain("Start the cloudflared public-URL tunnel");
   });
 
-  it("deprecated start --help exits 0 and shows alias usage", () => {
+  it("deprecated start --help exits 0 and describes migration-only behavior", () => {
     const r = run("start --help");
     expect(r.code).toBe(0);
-    expect(r.out).toContain("start");
-    expect(r.out).toContain("Deprecated alias");
+    expect(r.out).toContain("this command does not");
+    expect(r.out).toContain("start a sandbox or public-URL tunnel");
+    expect(r.out).toContain("nemoclaw <name> start");
+    expect(r.out).toContain("nemoclaw tunnel start");
+  });
+
+  it("deprecated start exits 0 with sandbox-scoped migration guidance (#9303)", () => {
+    const r = run("start 2>&1");
+    expect(r.code).toBe(0);
+    expect(r.out).toContain("nemoclaw <name> start");
+    expect(r.out).toContain("nemoclaw tunnel start");
   });
 
   it("tunnel stop --help exits 0 and shows tunnel usage", () => {

test/e2e/support/e2e-collaborator-permission-retry.test.ts

@@ -36,9 +36,9 @@ const AUTHORIZATION_STEPS: AuthorizationStep[] = [
     name: "Authorize release qualification waiver",
   },
   {
-    deniedMessage: "Launchable image publication requires a repository maintainer or administrator",
-    mismatchMessage: "Launchable image publication permission response did not match the actor",
-    name: "Authorize Launchable image publication",
+    deniedMessage: "Launchable E2E requires a repository maintainer or administrator",
+    mismatchMessage: "Launchable E2E permission response did not match the actor",
+    name: "Authorize Launchable E2E maintainer dispatch",
   },
 ];