fix(entrypoint): gracefully skip invalid overrides instead of hard-exit

[jyaunches]

Summary

Fixes #2698 — runtime-overrides-e2e test 14 crashes because invalid override validation uses return 1, which under set -euo pipefail kills the container before CMD runs.

Root Cause

PR #2659 tightened the trigger guard for apply_model_override() but kept return 1 for validation failures. When NEMOCLAW_CONTEXT_WINDOW=notanumber is rejected, return 1 propagates through set -e and exits the entrypoint. The container dies before the test can read the config.

Fix

Change non-security-critical validation failures from return 1 to return 0:

• Invalid API type → skip, don't crash
• Non-integer context window → skip, don't crash
• Non-integer max tokens → skip, don't crash
• Invalid reasoning boolean → skip, don't crash
• Non-http CORS origin → skip, don't crash

Security-critical rejections remain return 1:

• Symlink on config/hash path (indicates tampering)
• Control characters in model override (indicates injection)
• Oversized model override (indicates injection)

The security warning is still logged to stderr, but the container starts normally with config unchanged.

Verification

• Unit tests pass (test/nemoclaw-start.test.ts — assertions use toContain on message strings which are preserved)
• runtime-overrides-e2e passes (to be validated on sparky)

AI Disclosure

• AI-assisted — tool: Claude Code (pi agent)

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved startup resilience by gracefully handling invalid configuration parameters. The system now logs warnings and continues instead of aborting when misconfigured environment variables are detected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e6957a74-fcdd-41c8-bd77-6e1dc9262c50

📥 Commits

Reviewing files that changed from the base of the PR and between 24725d2 and 1d5894e.

📒 Files selected for processing (1)

• scripts/nemoclaw-start.sh

---

📝 Walkthrough

Walkthrough

The pull request modifies validation error handling in the entrypoint script. When environment variable validation fails for model/API parameters and CORS origin, the script now logs a warning and continues startup instead of exiting with failure, preserving build-time defaults and preventing container abort.

Changes

Cohort / File(s)	Summary
Entrypoint Validation Logic scripts/nemoclaw-start.sh	Modified apply_model_override() and apply_cors_override() to return success (0) on non-security-critical validation failures (malformed integers, invalid booleans, invalid API types) instead of return 1. Functions now log "— skipping override" warnings to stderr and allow startup to proceed with unmodified config.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 A rabbit hops with glee so bright,
For now the startup gets it right!
Bad numbers don't cause crash and burn,
Just skip and safely, homeward turn. 🏡✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: making invalid overrides skip gracefully instead of hard-exiting the entrypoint.
Linked Issues check	✅ Passed	The PR fully addresses #2698 objectives: non-security validation failures now return 0 instead of 1, logging warnings while allowing container startup with unchanged config.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to addressing #2698: modified only the error handling behavior for validation failures in nemoclaw-start.sh.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/2698-runtime-overrides-graceful-reject

---

_{Review rate limit: 8/10 reviews remaining, refill in 10 minutes and 5 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}