# Install with:
#   sudo cp scripts/automation/nuqloud-op /usr/local/sbin/nuqloud-op
#   sudo chown root:root /usr/local/sbin/nuqloud-op
#   sudo chmod 0750 /usr/local/sbin/nuqloud-op
#   sudo visudo -f /etc/sudoers.d/nuqloud-op
#
# Then paste/adapt:
#
# Defaults!/usr/local/sbin/nuqloud-op !setenv, noexec
# openclaw-agent ALL=(root) NOPASSWD: /usr/local/sbin/nuqloud-op *
#
# Keep openclaw-agent out of the docker group. This wrapper is the only privileged path.