fix(messaging): stabilize detailed channel status JSON

[jyaunches]

Summary

Keep the schema-version-1 detailed channel-status JSON envelope stable when a probe-capable channel is paused. Previously, the same OpenClaw Telegram command returned a nested report while active and flat verdict and signals fields while paused; paused detailed status now remains nested, keeps its bounded informational result, skips the live probe, and exits 0.

Related Issue

Fixes #10015

Changes

• Wrap the existing basic signals in a ChannelHealthReport only when a detailed request targets a channel with an applicable health hook and that hook produces no live report.
• Preserve the existing flat summary and no-health-hook responses.
• Treat the informational nested fallback as a successful status result.
• Add focused paused-channel coverage and a real CLI process regression for nemoclaw my-assistant channels status --channel telegram --json.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: PASS review
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every published commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 3 focused source files / 29 tests; 1 real-process integration file / 1 test; CLI typecheck passed
• Applicable broad gate passed — not applicable; this is a narrow status-response repair, and npm run validate:pr passed
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Improved channel status reporting for paused WhatsApp and Telegram channels.
  • Ensured informational status results complete successfully.
  • Added consistent report metadata and exit codes for paused channels.
  • Preserved basic diagnostics when detailed health information is unavailable.

• Tests

  • Added coverage for paused-channel JSON status output.
  • Verified that status checks avoid unnecessary live gateway and process probes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 36f79850-3e70-4319-89a8-237aa2bf1ad6

📥 Commits

Reviewing files that changed from the base of the PR and between d02e4f2 and 00784a8.

📒 Files selected for processing (2)

• src/lib/actions/sandbox/channel-status.test.ts
• src/lib/actions/sandbox/channel-status.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/lib/actions/sandbox/channel-status.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Paused probe-capable channels now return a nested detailed status report. The report includes metadata, signals, hints, and a successful info exit code. Unit and CLI integration tests validate the paused Telegram and WhatsApp paths.

Changes

Channel status reporting

Layer / File(s)	Summary
Report contracts and builders src/lib/actions/sandbox/channel-status.ts	Named detailed and basic report types clarify the report union. Basic report builders return the basic report type, and info verdicts exit successfully with dim rendering.
Paused detailed report flow src/lib/actions/sandbox/channel-status.ts, src/lib/actions/sandbox/channel-status.test.ts, test/cli/channel-status-json.test.ts	Paused channels with health hooks wrap diagnostics in a detailed report with probe metadata and hints. Tests validate the nested envelope, paused signals, exit code, and skipped probes.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 00784

This change stabilizes paused-channel status responses while preserving existing summary behavior and adding focused coverage; no actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant ChannelStatusAction
  participant SandboxRegistry
  participant OpenshellExecutable
  CLI->>ChannelStatusAction: request paused Telegram status as JSON
  ChannelStatusAction->>SandboxRegistry: read channel configuration
  ChannelStatusAction->>OpenshellExecutable: execute sandbox status handling
  ChannelStatusAction-->>CLI: return nested detailed report
  Note over ChannelStatusAction,OpenshellExecutable: skip live gateway and process probes

Loading

Suggested reviewers: sandl99, dreamstick9, laitingsheng

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: stabilizing detailed channel-status JSON for messaging channels.
Linked Issues check	✅ Passed	The changes satisfy the paused-channel nested report, informational verdict, probe skip, signal preservation, exit code, and CLI test requirements in [#10015].
Out of Scope Changes check	✅ Passed	The changes are limited to channel-status report handling and focused tests required by [#10015].
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[jyaunches]

Verdict

PASS. The exact PR head d02e4f28191677493259ec4c52425dc97e51faf4 is safe to merge from a security perspective. It changes only the shape of an existing bounded status result. It does not add credential access, process authority, network access, policy mutation, dependencies, or sandbox execution. No findings.

Findings Table

No findings.

Detailed Analysis

1. Secrets and Credentials — PASS. The new envelope copies only the existing allowlisted diagnostic signals and hints. It does not read, serialize, or log credential values, endpoints, raw channel responses, or sandbox output.
2. Input Validation and Data Sanitization — PASS. Existing sandbox and channel normalization remains authoritative. The change introduces no new input, parser, shell argument, path, URL, or rendering interpretation.
3. Authentication and Authorization — PASS. No authentication, authorization, ownership, gateway, or sandbox access decision changes.
4. Dependencies and Third-Party Libraries — PASS. No package, lockfile, image, downloaded artifact, or runtime-loading change is present.
5. Error Handling and Logging — PASS. The informational nested result preserves the prior paused/basic exit-0 behavior. Existing failed live-probe verdicts remain nonzero; the change does not suppress a probe because paused channels already skipped it. Output remains bounded to existing status fields.
6. Cryptography and Data Protection — PASS. No cryptographic mechanism, transport, storage, or protected-data lifecycle changes.
7. Configuration and Security Headers — PASS. No policy, environment variable, manifest, container, browser, or network configuration changes.
8. Security Testing — PASS. Focused tests cover paused WhatsApp and Telegram behavior. The real CLI process test proves the exact public JSON keys, informational verdict, exit 0, bounded paused signals, and absence of the Telegram gateway-log or process probe.
9. System Security — PASS. The existing trust boundaries remain in place: registry state selects the paused branch, the live probe remains skipped, and the host-side status renderer only repackages already-sanitized diagnostics. Summary output, unsupported agent/channel pairs, readiness waits, and active live probes remain on their prior paths.

Files Reviewed

• src/lib/actions/sandbox/channel-status.ts
• src/lib/actions/sandbox/channel-status.test.ts
• test/cli/channel-status-json.test.ts