fix(e2e): accept non-root sandbox ownership for WhatsApp QR preload (#4522)

[hunglp6d]

Summary

The messaging-providers-e2e nightly job failed because test-messaging-providers.sh assertion M-WA6b expected the WhatsApp compact-QR preload file to be owned root:444, but the sandbox runs in non-root mode where emit_sandbox_sourced_file() (in scripts/lib/sandbox-init.sh) produces sandbox:444 instead. The file permissions (mode 444 = read-only) are the security-relevant property; ownership differs only by privilege-separation posture. This PR widens the assertion to accept both ownership variants.

Related Issue

Fixes #4636

Changes

• test/e2e/test-messaging-providers.sh: Add an elif branch to the M-WA6b assertion that accepts sandbox:444 alongside root:444, with a comment explaining why non-root mode produces a different owner.

Validation

A focused custom-e2e.yaml workflow was run on a sibling branch to confirm this fix repairs the regression. The workflow re-runs only the jobs from the original nightly that this PR targets, on ubuntu-latest, off the same fix commit as this PR.

• Validation branch: fix/nightly-e2e-whatsapp-qr-preload-owner-451f26f-custom-e2e on hunglp6d/NemoClaw
• Validation run: #26792502483 — success
• Targeted jobs: messaging-providers-e2e (#78975726764)
• Original failing run: 26790528855 on 451f26f6a9e56d2bdc05cff47985545bb79c77a2

The validation branch is intentionally not the head of this PR — it carries an extra .github/workflows/custom-e2e.yaml commit that is scaffolding, not part of the fix. Re-run the validation by pushing any commit to the validation branch.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes

AI Disclosure

• AI-assisted — tool: Claude Code

---

Signed-off-by: Hung Le hple@nvidia.com

Summary by CodeRabbit

• Tests

  • Improved end-to-end messaging provider tests to enhance WhatsApp compact-QR preload verification. Now correctly recognizes sandbox file ownership configurations as valid installation cases in addition to existing root ownership scenarios and failure detection.

• Bug Fixes

  • Fixed test case handling to properly validate alternative file ownership modes during messaging provider setup verification.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2fca5154-6f4a-445f-a254-bfa10563c4db

📥 Commits

Reviewing files that changed from the base of the PR and between ef1d4af and 616bb48.

📒 Files selected for processing (1)

• test/e2e/test-messaging-providers.sh

---

📝 Walkthrough

Walkthrough

This PR updates a WhatsApp compact-QR preload file ownership check in the messaging providers E2E test. The assertion now accepts sandbox:444 ownership/mode as a valid success case for non-root sandbox installations, alongside the existing root:444 case, while preserving failure handling for truly unexpected states.

Changes

WhatsApp Preload File Ownership Assertion

Layer / File(s)	Summary
WhatsApp preload ownership assertion widening test/e2e/test-messaging-providers.sh	The M-WA6b assertion adds an elif branch that treats sandbox:444 ownership as a successful installation outcome. The branch includes explanatory comments clarifying that non-root sandbox mode naturally produces this ownership variant while preserving the critical read-only mode (444). The existing root:444 success case and failure paths remain intact.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

A sandbox plays in file permissions fine,
The test now smiles at sandbox:444 in line,
Non-root is welcome, the QR preload blooms,
Less test-flakiness haunting those E2E rooms! 🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: widening the WhatsApp QR preload file ownership check to accept non-root sandbox ownership.
Linked Issues check	✅ Passed	The PR directly addresses issue #4636 by accepting sandbox:444 as valid, fixing the test failure described in the linked issue.
Out of Scope Changes check	✅ Passed	All changes are scoped to the messaging-providers test file and directly fix the failing assertion; no unrelated modifications present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Selective E2E Results — ❌ Some jobs failed

Run: 26822746929
Target ref: main
Requested jobs: messaging-providers-e2e
Summary: 0 passed, 1 failed, 0 skipped

Job	Result
messaging-providers-e2e	❌ failure

Failed jobs: messaging-providers-e2e. Check run artifacts for logs.

[sandl99]

Superseded by #4671, which carries the same fix on an internal NVIDIA/NemoClaw branch so E2E can be triggered without fork-branch restrictions.