fix(onboard): don't abort onboard when Brave Search key validation fails

[laitingsheng]

Summary

nemoclaw onboard --non-interactive aborted with exit 1 whenever the Brave Web Search API key validation failed (HTTP 429 / 403 / network error / invalid key), even though Brave Web Search is an optional integration. Users were left with provider/gateway/inference partially configured but no sandbox. Downgrade the failure to a warning and skip the integration so the wizard continues to steps [5/8]–[8/8] and exits 0 if everything else succeeds.

Related issues

Closes #2507

Changes

• src/lib/onboard.ts: in the non-interactive branch of configureWebSearch, replace process.exit(1) on validateBraveSearchApiKey failure with console.warn + return null. The warning points users at `nemoclaw config web-search` to re-enable the integration later. Matches the existing "no web search" return contract already used elsewhere in the function.
• test/onboard-brave-validation.test.ts: regression test using the curl-shim + spawned-Node-script pattern from test/onboard-selection.test.ts. Covers (a) HTTP 429 -> result is null, no process.exit calls, warning mentions the recovery command; (b) HTTP 200 -> result is { fetchEnabled: true }.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• make docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

AI Disclosure

• AI-assisted — tool: Claude Code

---

Signed-off-by: Tinson Lai tinsonl@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Brave Web Search configuration now warns and disables web search on invalid API keys, and provides instructions to re-enable, instead of terminating the process.
• Tests
  • Added a non-interactive integration test validating Brave API key handling for success and rate-limit scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d6bd29c2-432f-4887-b332-b2c077d22c26

📥 Commits

Reviewing files that changed from the base of the PR and between a4227f5 and 990cd2c.

📒 Files selected for processing (1)

• src/lib/onboard.ts

---

📝 Walkthrough

Walkthrough

Non-interactive Brave Web Search API key validation now emits warnings and returns null (disabling web search) on failure instead of exiting the process. A new integration-style test runs the onboard logic in a subprocess with a shimmed curl to validate both failure (HTTP 429) and success (HTTP 200) behaviors.

Changes

Cohort / File(s)	Summary
Brave validation runtime src/lib/onboard.ts	Non-interactive Brave API key validation failures no longer call process.exit(1); they log warnings (including guidance to re-enable via nemoclaw config web-search) and return null to disable web search.
Brave validation tests test/onboard-brave-validation.test.ts	Added integration-style test that executes compiled onboard code in a subprocess with NEMOCLAW_NON_INTERACTIVE=1, a shimmed curl, and temporary env; asserts behavior for HTTP 429 (result null, warning present, no exit) and HTTP 200 (fetch enabled, no exit).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I sniffed the keys and gave a thump,
A warning hop — no sudden dump.
Web search sleeps, the onboarding goes,
I nibble logs where calm wind blows. 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: the PR prevents onboard abort when Brave Search API key validation fails, which is the core issue being addressed.
Linked Issues check	✅ Passed	The PR fully addresses issue #2507 requirements: (1) non-interactive onboard no longer aborts on Brave validation failure [2507]; (2) warning includes failure reason and recovery command [2507]; (3) onboarding continues to steps [5/8]–[8/8] [2507]; (4) exits 0 when other steps succeed [2507]; (5) skips Brave Web Search enabling when validation fails [2507].
Out of Scope Changes check	✅ Passed	All changes are strictly within scope of issue #2507: onboard.ts changes implement the validation-failure-to-warning downgrade, and the new test validates the fix with curl-shimming and non-interactive execution patterns.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/2507-brave-validation-non-fatal

---

_{Review rate limit: 7/10 reviews remaining, refill in 17 minutes and 50 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@test/onboard-brave-validation.test.ts`:
- Around line 45-48: Replace the hardcoded ":" PATH separator usages in the test
with Node's cross-platform path.delimiter: update the PATH construction that
uses fakeBin + ":" + process.env.PATH (and the similar concatenations around
tmpDir/bin at the other two occurrences) to join with path.delimiter instead;
locate these string concatenations near the variables repoRoot, tmpDir, fakeBin
and scriptPath in onboard-brave-validation.test.ts and swap ":" for
path.delimiter so the test works on Windows and POSIX CI runners.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f14d26e4-3910-4cfa-abf0-348785c647db

📥 Commits

Reviewing files that changed from the base of the PR and between 6f7f0c6 and a4227f5.

📒 Files selected for processing (2)

• src/lib/onboard.ts
• test/onboard-brave-validation.test.ts

[wscurran]

✨ Thanks for submitting this pull request that proposes a way to fix a bug where the onboard process aborts when Brave Search key validation fails.

---

Related open issues:

• #2507 [Ubuntu 22.04][Onboard] Brave Search API key validation failure aborts non-interactive onboard