test(e2e): migrate test-hermes-root-entrypoint-smoke.sh to vitest [IND-4]

.github/workflows/e2e-vitest-scenarios.yaml

@@ -45,14 +45,33 @@ jobs:
         run: |
           set -euo pipefail
           args=(--emit-live-matrix)
+          matrix=""
           if [ -n "${SCENARIOS}" ]; then
             if [[ ! "${SCENARIOS}" =~ ^[A-Za-z0-9_-]+(,[A-Za-z0-9_-]+)*$ ]]; then
               echo "::error::Invalid scenario input: ${SCENARIOS}" >&2
               exit 1
             fi
-            args+=(--scenarios "${SCENARIOS}")
+
+            standalone_scenarios=",hermes-root-entrypoint-smoke,"
+            registry_scenarios=()
+            IFS=',' read -ra requested_scenarios <<< "${SCENARIOS}"
+            for scenario in "${requested_scenarios[@]}"; do
+              if [[ "${standalone_scenarios}" == *",${scenario},"* ]]; then
+                continue
+              fi
+              registry_scenarios+=("${scenario}")
+            done
+
+            if [ "${#registry_scenarios[@]}" -gt 0 ]; then
+              registry_csv="$(IFS=,; echo "${registry_scenarios[*]}")"
+              args+=(--scenarios "${registry_csv}")
+            else
+              matrix="[]"
+            fi
+          fi
+          if [ -z "${matrix}" ]; then
+            matrix="$(npx tsx test/e2e-scenario/scenarios/run.ts "${args[@]}")"
           fi
-          matrix="$(npx tsx test/e2e-scenario/scenarios/run.ts "${args[@]}")"
           echo "matrix=${matrix}" >> "$GITHUB_OUTPUT"
           MATRIX_JSON="${matrix}" python - <<'PY' >> "$GITHUB_STEP_SUMMARY"
           import json
@@ -69,6 +88,7 @@ jobs:
 
   live-scenarios:
     needs: generate-matrix
+    if: ${{ needs.generate-matrix.outputs.matrix != '[]' }}
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 45
     strategy:
@@ -250,6 +270,73 @@ jobs:
           if-no-files-found: ignore
           retention-days: 14
 
+  hermes-root-entrypoint-smoke-vitest:
+    if: ${{ inputs.scenarios == '' || contains(format(',{0},', inputs.scenarios), ',hermes-root-entrypoint-smoke,') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    env:
+      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/hermes-root-entrypoint-smoke
+      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Authenticate to Docker Hub
+        env:
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
+            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
+            exit 0
+          fi
+          login_succeeded=0
+          for attempt in 1 2 3; do
+            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
+              login_succeeded=1
+              break
+            fi
+            if [[ "$attempt" -lt 3 ]]; then
+              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
+              sleep 5
+            fi
+          done
+          if [[ "$login_succeeded" -ne 1 ]]; then
+            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
+          fi
+
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install root dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Run Hermes root entrypoint smoke live test
+        # Migrated from test/e2e/test-hermes-root-entrypoint-smoke.sh. This
+        # builds the real Hermes image unless NEMOCLAW_HERMES_TEST_IMAGE points
+        # at a prebuilt image, then probes the root entrypoint via Docker.
+        run: |
+          set -euo pipefail
+          npx vitest run --project e2e-scenarios-live \
+            test/e2e-scenario/live/hermes-root-entrypoint-smoke.test.ts \
+            --silent=false --reporter=default
+
+      - name: Upload Hermes root entrypoint smoke artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: e2e-vitest-scenarios-hermes-root-entrypoint-smoke
+          path: e2e-artifacts/vitest/hermes-root-entrypoint-smoke/
+          include-hidden-files: false
+          if-no-files-found: ignore
+          retention-days: 14
+
   # Focused coverage slice for the #2603/#3145 OpenClaw websocket
   # protocol/history contract. The retained legacy bash lane remains the
   # source for full closeout until a later PR proves replacement and deletes it.

.github/workflows/sandbox-images-and-e2e.yaml

@@ -97,18 +97,35 @@ jobs:
           path: /tmp/nemoclaw-hermes-sandbox-secret-boundary.log
           if-no-files-found: ignore
 
-      - name: Run Hermes root entrypoint smoke
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install root dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Run Hermes root entrypoint smoke Vitest test
         env:
+          E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/hermes-root-entrypoint-smoke
           NEMOCLAW_HERMES_TEST_IMAGE: nemoclaw-hermes-production
-        run: bash test/e2e/test-hermes-root-entrypoint-smoke.sh
+          NEMOCLAW_RUN_E2E_SCENARIOS: "1"
+        run: |
+          set -euo pipefail
+          npx vitest run --project e2e-scenarios-live \
+            test/e2e-scenario/live/hermes-root-entrypoint-smoke.test.ts \
+            --silent=false --reporter=default
 
-      - name: Upload Hermes root entrypoint smoke log on failure
-        if: failure()
+      - name: Upload Hermes root entrypoint smoke artifacts
+        if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: hermes-root-entrypoint-smoke-log
-          path: /tmp/nemoclaw-hermes-root-entrypoint-smoke.log
+          name: hermes-root-entrypoint-smoke-artifacts
+          path: e2e-artifacts/vitest/hermes-root-entrypoint-smoke/
+          include-hidden-files: false
           if-no-files-found: ignore
+          retention-days: 14
 
   build-sandbox-images-arm64:
     if: inputs.run_arm64