test(ci): stabilize platform vitest on main

[cv]

Summary

Stabilizes the platform Vitest failures from the main push run by making the affected tests hermetic across macOS and WSL. The changes keep CI-only environment differences from steering tests into the wrong platform branches.

Changes

• Stub healthy Docker for the connect-readiness gateway recovery test so it exercises the disconnected OpenShell gateway path instead of host Docker availability.
• Clear inherited WSL environment for the generic Linux sandbox GPU preflight test so it stays on the CDI path.
• Force the installer Docker group re-exec test to run its Linux branch even when the suite runs on macOS.
• Update the Dockerfile runtime-tools snippet test to mock the newly required tmux runtime tool.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx prek run --all-files passes
• npm test passes
• Tests added or updated for new or changed behavior
• No secrets, API keys, or credentials committed
• Docs updated for user-facing behavior changes
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Tests
  • Enhanced test coverage for GPU preflight validation, Docker daemon health checks, installer platform detection, and package installation verification to improve test reliability and prevent false failures on different runner environments.

[coderabbitai]

📝 Walkthrough

Walkthrough

PR updates four test fixtures across the sandbox, Docker, and installer verification suites. Changes include aligning GPU preflight function arguments, injecting Docker health stubs to isolate gateway tests, adding platform guards for non-Linux test runners, and extending provisioning mocks to verify tmux installation.

Changes

Test Fixture and Stub Corrections

Layer / File(s)	Summary
GPU preflight test function call alignment src/lib/onboard/sandbox-gpu-preflight.test.ts	Adds explicit env: {} argument to align the test's validateSandboxGpuPreflight call with the function's expected options shape.
Docker gateway test isolation stub test/cli.test.ts	Injects writeHealthyDockerStub(localBin) to prevent CLI Docker-outage preflight checks from interfering with the disconnected-gateway scenario.
Installer platform guard bypass for test test/install-docker-group-reexec.test.ts	Adds Bash uname() stub returning Linux so installer platform guards proceed and continue through ensure_docker slow-path logic on non-Linux test runners.
Provisioning tmux verification fixture extension test/sandbox-provisioning.test.ts	Extends mocked apt-get and command behavior to track tmux installation: introduces tmuxMarker variable, updates script to touch marker when tmux=3.5a-3 is installed, and makes command -v tmux consult the marker.

Possibly related PRs

• NVIDIA/NemoClaw#4605: Adds CLI Docker-outage preflight logic that this PR's Docker stub injection guards against.
• NVIDIA/NemoClaw#4622: Similarly updates test/cli.test.ts to call writeHealthyDockerStub(localBin) to isolate Docker preflight behavior.

Suggested labels

Docker, fix, Sandbox

Poem

🐰 Four little fixtures get their fix today,
Stubs and markers guide the tests their way,
Platform guards and Docker health agree,
The sandbox runs just right, you'll see! ✨

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'test(ci): stabilize platform vitest on main' directly relates to the primary objective of the pull request: stabilizing platform Vitest failures by making tests hermetic across macOS and WSL.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/main-platform-vitest-failures

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

E2E Advisor Recommendation

Required E2E: None
Optional E2E: None

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• None. No E2E is recommended because this PR changes only test files and does not alter runtime/user-flow code for onboarding, installation, sandbox lifecycle, credentials, network policy, inference routing, deployment, or assistant behavior. The affected coverage should be handled by the existing unit/integration test jobs that execute these test files.

Optional E2E

• None.

New E2E recommendations

• None.

[github-actions]

E2E Scenario Advisor Recommendation

Required scenario E2E: None
Optional scenario E2E: None

Workflow run

Full scenario advisor summary

E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required scenario E2E

• None. Changes are limited to unit/integration test files outside test/e2e-scenario/ and do not affect scenario E2E runtime, metadata, workflows, suites, expected states, or scenario-relevant onboarding/install helper implementation paths.

Optional scenario E2E

• None.

Relevant changed files

• None.

[github-actions]

PR Review Advisor

Findings: 0 needs attention, 0 worth checking, 0 nice ideas
Top item: No actionable findings

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

test/sandbox-provisioning.test.ts (1)

685-702: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add assertions to verify tmux installation.

The test sets up complete mocking infrastructure for tmux (marker variable, apt-get stub, command stub) but includes no assertions to verify that tmux is actually installed or that command -v tmux succeeds. This means the test cannot catch regressions if the Dockerfile stops installing tmux.

✅ Suggested assertions to add

After line 719, add assertions similar to the existing procps/e2fsprogs checks:

       expect(calls).toContain("apt-get install -y --no-install-recommends e2fsprogs=1.47.2-3+b11");
       expect(result.stdout).toContain("procps test version");
+      expect(calls).toContain("apt-get install -y --no-install-recommends tmux=3.5a-3");
+      expect(fs.existsSync(tmuxMarker)).toBe(true);
     } finally {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/sandbox-provisioning.test.ts` around lines 685 - 702, The test defines
tmux_marker, the apt-get() stub that touches tmux_marker, and the command() stub
that checks tmux via tmux_marker but never asserts it; add assertions mirroring
the procps/e2fsprogs checks to verify tmux was installed and command -v tmux
succeeds by checking the tmux_marker (and/or examining the call_log) after the
Docker run—look for tmux_marker, the apt-get() stub, and command() stub in the
test and insert assertions similar to the existing checks for ps_marker and
chattr_marker.

🧹 Nitpick comments (1)

test/sandbox-provisioning.test.ts (1)

679-679: ⚡ Quick win

Update test name to include tmux.

The test now sets up tmux tracking infrastructure but the test name only mentions "procps and e2fsprogs". Since the PR summary describes tmux as a "newly required runtime tool", the test description should reflect this addition.

📝 Suggested test name update

-  it("runtime hardening installs procps and e2fsprogs when a stale base lacks ps and chattr", () => {
+  it("runtime hardening installs procps, e2fsprogs, and tmux when a stale base lacks ps, chattr, and tmux", () => {

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/sandbox-provisioning.test.ts` at line 679, Update the test description
string for the it(...) block currently reading "runtime hardening installs
procps and e2fsprogs when a stale base lacks ps and chattr" to also mention tmux
(e.g., "runtime hardening installs procps, e2fsprogs, and tmux when a stale base
lacks ps and chattr") so the test name reflects the added tmux tracking setup;
change the string in the it(...) invocation in the
test/sandbox-provisioning.test.ts file where that test is defined.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@test/sandbox-provisioning.test.ts`:
- Around line 685-702: The test defines tmux_marker, the apt-get() stub that
touches tmux_marker, and the command() stub that checks tmux via tmux_marker but
never asserts it; add assertions mirroring the procps/e2fsprogs checks to verify
tmux was installed and command -v tmux succeeds by checking the tmux_marker
(and/or examining the call_log) after the Docker run—look for tmux_marker, the
apt-get() stub, and command() stub in the test and insert assertions similar to
the existing checks for ps_marker and chattr_marker.

---

Nitpick comments:
In `@test/sandbox-provisioning.test.ts`:
- Line 679: Update the test description string for the it(...) block currently
reading "runtime hardening installs procps and e2fsprogs when a stale base lacks
ps and chattr" to also mention tmux (e.g., "runtime hardening installs procps,
e2fsprogs, and tmux when a stale base lacks ps and chattr") so the test name
reflects the added tmux tracking setup; change the string in the it(...)
invocation in the test/sandbox-provisioning.test.ts file where that test is
defined.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 883eaf8b-c312-4f12-bf73-6172212382b6

📥 Commits

Reviewing files that changed from the base of the PR and between 798d5a3 and 3af30c0.

📒 Files selected for processing (4)

• src/lib/onboard/sandbox-gpu-preflight.test.ts
• test/cli.test.ts
• test/install-docker-group-reexec.test.ts
• test/sandbox-provisioning.test.ts