fix(e2e): restore fake API port publishing

test/automation/pull-requests/pr-risk-plan.test.ts

@@ -369,6 +369,31 @@ describe("deterministic PR risk plan", () => {
     expect(result.requiredJobs).toEqual([]);
   });
 
+  it.each([
+    "test/e2e/lib/fake-api-port-proxy.mts",
+    "test/e2e/lib/fake-api-port-readiness.mts",
+    "test/e2e/live/messaging-providers-helpers.ts",
+  ])("selects every fake Docker API consumer for %s", (changedFile) => {
+    expect(focusedE2eJobsForChangedFiles([changedFile])).toEqual(
+      [
+        "hermes-discord",
+        "messaging-providers",
+        "openclaw-discord-pairing",
+        "openclaw-slack-pairing",
+      ].map((id) => ({ id, matchedFiles: [changedFile] })),
+    );
+  });
+
+  it("selects both fake Slack API consumers", () => {
+    const changedFile = "test/e2e/lib/fake-slack-api.cjs";
+    expect(focusedE2eJobsForChangedFiles([changedFile])).toEqual(
+      ["messaging-providers", "openclaw-slack-pairing"].map((id) => ({
+        id,
+        matchedFiles: [changedFile],
+      })),
+    );
+  });
+
   it("maps a shared gateway live test to every catalogue fixture (#7921)", () => {
     const changedFiles = ["test/e2e/live/openshell-gateway-upgrade.test.ts"];
     const focusedE2eJobs = catalogueTargetsForChangedFiles(changedFiles).map((target) => ({

test/e2e/fixtures/host-mock-firewall.ts

@@ -24,7 +24,7 @@ interface DockerNetworkInspect {
   Options?: unknown;
 }
 
-interface BridgeTopology {
+export interface BridgeTopology {
   bridgeInterface: string;
   gatewayIp: string;
   prefixLength: number;
@@ -65,7 +65,7 @@ function parseBridgeCidr(value: string): { network: number; prefixLength: number
   return (network & mask) >>> 0 === network ? { network, prefixLength } : undefined;
 }
 
-function parseBridgeTopology(stdout: string): BridgeTopology {
+export function parseBridgeTopology(stdout: string): BridgeTopology {
   let parsed: unknown;
   try {
     parsed = JSON.parse(stdout);

test/e2e/lib/fake-api-port-proxy.mts

@@ -0,0 +1,31 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import net from "node:net";
+
+const target = process.env.NEMOCLAW_FAKE_API_PROXY_TARGET ?? "";
+const portList = process.env.NEMOCLAW_FAKE_API_PROXY_PORTS ?? "";
+if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(target)) {
+  throw new Error("NEMOCLAW_FAKE_API_PROXY_TARGET must be a Docker container name");
+}
+const ports = portList === "8080" ? [8080] : portList === "8080,8081" ? [8080, 8081] : undefined;
+if (!ports) throw new Error("NEMOCLAW_FAKE_API_PROXY_PORTS must be 8080 or 8080,8081");
+
+for (const port of ports) {
+  const server = net.createServer((client) => {
+    const upstream = net.createConnection({ host: target, port });
+    const close = () => {
+      client.destroy();
+      upstream.destroy();
+    };
+    client.on("error", close);
+    upstream.on("error", close);
+    client.pipe(upstream);
+    upstream.pipe(client);
+  });
+  server.once("error", (error) => {
+    process.stderr.write(`fake API proxy listener ${port} failed: ${error.message}\n`);
+    process.exit(1);
+  });
+  server.listen(port, "0.0.0.0");
+}

test/e2e/lib/fake-api-port-readiness.mts

@@ -0,0 +1,150 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { isIP } from "node:net";
+import { pathToFileURL } from "node:url";
+
+const ATTEMPT_TIMEOUT_MS = 1_000;
+const PORT_TRAFFIC_TIMEOUT_MS = 10_000;
+const RETRY_DELAY_MS = 100;
+const MAX_REPLY_BYTES = 8_192;
+const PORT_TRAFFIC_PROBE = "nemoclaw_port_traffic_probe";
+const PORT_TRAFFIC_REPLY = "nemoclaw_port_traffic_reply";
+
+function requirePort(raw: string, name: string): number {
+  if (!/^[1-9][0-9]{0,4}$/u.test(raw)) throw new Error(`${name} must be a decimal port`);
+  const port = Number(raw);
+  if (port > 65_535) throw new Error(`${name} must be at most 65535`);
+  return port;
+}
+
+function urlHost(host: string): string {
+  return isIP(host) === 6 ? `[${host}]` : host;
+}
+
+async function probeHttp(host: string, port: number): Promise<void> {
+  const response = await fetch(`http://${urlHost(host)}:${port}/__nemoclaw_e2e_port_traffic`, {
+    signal: AbortSignal.timeout(ATTEMPT_TIMEOUT_MS),
+  });
+  const reader = response.body?.getReader();
+  if (!reader) return;
+  let replyBytes = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) return;
+    replyBytes += value.byteLength;
+    if (replyBytes > MAX_REPLY_BYTES) {
+      await reader.cancel();
+      throw new Error("REST port traffic reply exceeded 8192 bytes");
+    }
+  }
+}
+
+function probeWebsocket(host: string, port: number): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const socket = new WebSocket(`ws://${urlHost(host)}:${port}/socket-mode`);
+    let settled = false;
+    const finish = (error?: Error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        socket.close();
+      } catch {
+        // Preserve the traffic-check result when the native client is not open.
+      }
+      if (error) reject(error);
+      else resolve();
+    };
+    const timer = setTimeout(() => {
+      finish(new Error("WebSocket port traffic timed out"));
+    }, ATTEMPT_TIMEOUT_MS);
+    socket.addEventListener("open", () => {
+      socket.send(JSON.stringify({ type: PORT_TRAFFIC_PROBE }));
+    });
+    socket.addEventListener("message", (event) => {
+      if (typeof event.data !== "string") {
+        finish(new Error("WebSocket port traffic reply was not text"));
+        return;
+      }
+      if (Buffer.byteLength(event.data, "utf8") > MAX_REPLY_BYTES) {
+        finish(new Error("WebSocket port traffic reply exceeded 8192 bytes"));
+        return;
+      }
+      try {
+        const reply = JSON.parse(event.data);
+        if (reply?.type !== PORT_TRAFFIC_REPLY) {
+          finish(new Error("WebSocket port traffic reply was not recognized"));
+          return;
+        }
+      } catch {
+        finish(new Error("WebSocket port traffic reply was not valid JSON"));
+        return;
+      }
+      finish();
+    });
+    socket.addEventListener("error", () => {
+      finish(new Error("WebSocket port traffic connection failed"));
+    });
+    socket.addEventListener("close", () => {
+      finish(new Error("WebSocket port traffic closed before the reply"));
+    });
+  });
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+export async function proveFakeApiPortTraffic(options: {
+  host: string;
+  restPort: number;
+  websocketPort?: number;
+}): Promise<void> {
+  if (isIP(options.host) === 0) throw new Error("port traffic host must be an IP address");
+  if (!Number.isInteger(options.restPort) || options.restPort < 1 || options.restPort > 65_535) {
+    throw new Error("REST port must be an integer between 1 and 65535");
+  }
+  if (
+    options.websocketPort !== undefined &&
+    (!Number.isInteger(options.websocketPort) ||
+      options.websocketPort < 1 ||
+      options.websocketPort > 65_535)
+  ) {
+    throw new Error("WebSocket port must be an integer between 1 and 65535");
+  }
+  const deadline = Date.now() + PORT_TRAFFIC_TIMEOUT_MS;
+  let lastError: string | undefined;
+  do {
+    try {
+      await probeHttp(options.host, options.restPort);
+      if (options.websocketPort !== undefined) {
+        await probeWebsocket(options.host, options.websocketPort);
+      }
+      return;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+    await sleep(RETRY_DELAY_MS);
+  } while (Date.now() < deadline);
+  throw new Error(`fake API port traffic check failed: ${lastError ?? "no reply"}`);
+}
+
+async function main(): Promise<void> {
+  const [host = "", restPortRaw = "", websocketPortRaw] = process.argv.slice(2);
+  await proveFakeApiPortTraffic({
+    host,
+    restPort: requirePort(restPortRaw, "REST port"),
+    ...(websocketPortRaw === undefined
+      ? {}
+      : { websocketPort: requirePort(websocketPortRaw, "WebSocket port") }),
+  });
+  process.stdout.write("fake API proxy ports carry traffic\n");
+}
+
+if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
+  main().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+  });
+}

test/e2e/lib/fake-slack-api.cjs

@@ -20,6 +20,7 @@ const expectedAppToken = process.env.FAKE_SLACK_API_EXPECTED_APP_TOKEN || "";
 const socketUserId = process.env.FAKE_SLACK_API_SOCKET_USER_ID || "U3730E2E";
 const socketChannelId = process.env.FAKE_SLACK_API_SOCKET_CHANNEL_ID || "D3730E2E";
 const socketTeamId = process.env.FAKE_SLACK_API_SOCKET_TEAM_ID || "T3730E2E";
+const suppressPortTrafficReply = process.env.FAKE_SLACK_API_SUPPRESS_PORT_TRAFFIC_REPLY === "1";
 const MAX_BODY_BYTES = 1024 * 1024;
 const WS_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
 
@@ -298,6 +299,13 @@ function handleUpgrade(req, socket) {
         tokenLooksPlaceholder: tokenLooksPlaceholder(text),
         textRedacted: true,
       });
+      if (messageType === "nemoclaw_port_traffic_probe") {
+        if (!suppressPortTrafficReply) {
+          socket.write(encodeServerText(JSON.stringify({ type: "nemoclaw_port_traffic_reply" })));
+          record({ event: "websocket-port-traffic-reply", path: pathname });
+        }
+        continue;
+      }
       if (!sentEvent) {
         sentEvent = true;
         sendSocketModeEvent(socket);