fix: nemohermes first-run signed installer health probes

src/lib/adapters/openshell/resolve.test.ts

@@ -1,11 +1,11 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import { describe, it, expect } from "vitest";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { describe, expect, it } from "vitest";
-import { resolveOpenshell } from "./resolve";
+import { resolveOpenshell } from "../../dist/lib/resolve-openshell";
 
 describe("lib/resolve-openshell", () => {
   it("returns command -v result when absolute path", () => {
@@ -64,25 +64,6 @@ describe("lib/resolve-openshell", () => {
     ).toBe("/usr/local/bin/openshell");
   });
 
-  it("falls back to the Apple Silicon Homebrew prefix at /opt/homebrew/bin (#5334)", () => {
-    expect(
-      resolveOpenshell({
-        commandVResult: null,
-        checkExecutable: (p) => p === "/opt/homebrew/bin/openshell",
-      }),
-    ).toBe("/opt/homebrew/bin/openshell");
-  });
-
-  it("prefers /opt/homebrew/bin over /usr/local/bin (#5334)", () => {
-    expect(
-      resolveOpenshell({
-        commandVResult: null,
-        checkExecutable: (p) =>
-          p === "/opt/homebrew/bin/openshell" || p === "/usr/local/bin/openshell",
-      }),
-    ).toBe("/opt/homebrew/bin/openshell");
-  });
-
   it("falls back to /usr/bin", () => {
     expect(
       resolveOpenshell({

src/lib/adapters/openshell/resolve.ts

@@ -50,17 +50,8 @@ export function resolveOpenshell(opts: ResolveOpenshellOptions = {}): string | n
   }
 
   // Step 2: fallback candidates
-  //
-  // `/opt/homebrew/bin` is the Apple Silicon Homebrew prefix. It is frequently
-  // absent from the non-interactive/login shell that drives onboarding (Homebrew
-  // only adds it via `brew shellenv`, which many profiles source after the
-  // non-interactive guard), so `command -v openshell` above can miss a perfectly
-  // good Homebrew install. Probing the prefix directly keeps NemoClaw coherent
-  // with a Homebrew-installed OpenShell instead of reporting "openshell not
-  // found" while the binary sits in `/opt/homebrew/bin` (#5334).
   const candidates = [
     ...(home?.startsWith("/") ? [`${home}/.local/bin/openshell`] : []),
-    "/opt/homebrew/bin/openshell",
     "/usr/local/bin/openshell",
     "/usr/bin/openshell",
   ];

src/lib/agent-onboard.test.ts

@@ -0,0 +1,149 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, it, expect, beforeEach, afterEach, afterAll, vi } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+// Import from compiled dist/ so coverage is attributed correctly.
+import { printDashboardUi } from "../../dist/lib/agent-onboard";
+import type { AgentDefinition } from "./agent-defs";
+
+function makeAgent(overrides: Partial<AgentDefinition> = {}): AgentDefinition {
+  return {
+    name: "agent",
+    displayName: "Agent",
+    healthProbe: { url: "http://127.0.0.1:19000/", port: 19000, timeout_seconds: 5 },
+    forwardPort: 19000,
+    dashboard: { kind: "ui", label: "UI", path: "/" },
+    configPaths: {
+      dir: "/tmp/agent",
+      configFile: "/tmp/agent/config.yaml",
+      envFile: null,
+      format: "yaml",
+    },
+    stateDirs: [],
+    versionCommand: "agent --version",
+    expectedVersion: null,
+    hasDevicePairing: false,
+    phoneHomeHosts: [],
+    messagingPlatforms: [],
+    dockerfileBasePath: null,
+    dockerfilePath: null,
+    startScriptPath: null,
+    policyAdditionsPath: null,
+    policyPermissivePath: null,
+    pluginDir: null,
+    legacyPaths: null,
+    agentDir: "/tmp/agent",
+    manifestPath: "/tmp/agent/manifest.yaml",
+    ...overrides,
+  };
+}
+
+const apiAgent = makeAgent({
+  name: "hermes",
+  displayName: "Hermes Agent",
+  forwardPort: 8642,
+  dashboard: { kind: "api", label: "OpenAI-compatible API", path: "/v1" },
+});
+
+const uiAgent = makeAgent({
+  name: "ficticious-ui",
+  displayName: "Ficticious",
+  forwardPort: 19000,
+  dashboard: { kind: "ui", label: "UI", path: "/" },
+});
+
+// Regression fixture for issue #2078 — matches the text a user sees when
+// no token is available and prevents the wording from regressing to
+// something that implies port 8642 is a browser UI.
+const buildUrlsLoopback = (token: string | null, port: number): string[] => {
+  const hash = token ? `#token=${token}` : "";
+  return [`http://127.0.0.1:${port}/${hash}`];
+};
+
+describe("printDashboardUi — regression for #2078 (port 8642 is not a chat UI)", () => {
+  const logSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+  const noteSpy = vi.fn();
+
+  beforeEach(() => {
+    logSpy.mockClear();
+    noteSpy.mockReset();
+  });
+
+  afterEach(() => {
+    logSpy.mockClear();
+  });
+
+  afterAll(() => {
+    logSpy.mockRestore();
+  });
+
+  it("labels an API-kind agent as the API — not a UI — and does not embed a token in the URL", () => {
+    printDashboardUi("sandbox-x", "secret-token", apiAgent, {
+      note: noteSpy,
+      buildControlUiUrls: buildUrlsLoopback,
+    });
+
+    const output = logSpy.mock.calls.map((args) => String(args[0])).join("\n");
+    expect(output).toContain("Hermes Agent OpenAI-compatible API");
+    expect(output).not.toContain("UI (tokenized URL");
+    expect(output).toContain("Port 8642 must be forwarded before connecting.");
+    expect(output).toContain("http://127.0.0.1:8642/v1");
+    // Token-in-URL-fragment auth does not apply to the OpenAI API endpoint.
+    expect(output).not.toContain("#token=secret-token");
+  });
+
+  it("prints the API URL consistently whether or not a gateway token was read", () => {
+    printDashboardUi("sandbox-x", null, apiAgent, {
+      note: noteSpy,
+      buildControlUiUrls: buildUrlsLoopback,
+    });
+
+    const output = logSpy.mock.calls.map((args) => String(args[0])).join("\n");
+    expect(output).toContain("Hermes Agent OpenAI-compatible API");
+    expect(output).toContain("http://127.0.0.1:8642/v1");
+    // The API endpoint does not require the gateway token — don't confuse
+    // the user with the OpenClaw-style "token missing" warning.
+    expect(noteSpy).not.toHaveBeenCalled();
+  });
+
+  it("prints tokenized URL with save-now warning for UI-kind agents", () => {
+    printDashboardUi("sandbox-y", "tok", uiAgent, {
+      note: noteSpy,
+      buildControlUiUrls: buildUrlsLoopback,
+    });
+
+    const output = logSpy.mock.calls.map((args) => String(args[0])).join("\n");
+    expect(output).toContain(
+      "Ficticious UI (tokenized URL; treat it like a password; save it now - it will not be printed again)",
+    );
+    expect(output).toContain("Port 19000 must be forwarded before opening this URL.");
+    expect(output).toContain("http://127.0.0.1:19000/#token=tok");
+  });
+});
+
+describe("handleAgentSetup guards", () => {
+  it("fails onboarding instead of completing when the agent binary or health probe is missing", () => {
+    const source = fs.readFileSync(path.join(import.meta.dirname, "agent-onboard.ts"), "utf-8");
+
+    expect(source).toContain("verifyAgentBinaryAvailable");
+    expect(source).toContain(
+      'resolved="$(command -v ${shellQuote(executable)} 2>/dev/null || true)"',
+    );
+    expect(source).toContain('[ "$resolved" = ${shellQuote(binaryPath)} ]');
+    expect(source).toContain("failAgentSetup");
+    expect(source).toContain('onboardSession.markStepFailed("agent_setup"');
+    expect(source).toContain("gateway did not respond within");
+    expect(source).not.toContain("gateway may still be starting");
+  });
+
+  it("accepts Hermes JSON health responses without substring false positives", () => {
+    const source = fs.readFileSync(path.join(import.meta.dirname, "agent-onboard.ts"), "utf-8");
+
+    expect(source).toContain("function isHealthProbeOk");
+    expect(source).toContain("JSON.parse(body)");
+    expect(source).toContain('parsed.status === "ok"');
+    expect(source).not.toContain('.includes("ok")');
+  });
+});