refactor(onboard): lower cognitive complexity ratchet to 245

[cv]

Summary

Lower the cognitive-complexity ratchet from 255 to 245 by extracting the highest-complexity onboarding provider-selection paths out of setupNim. This keeps the new Biome rule moving downward one offender at a time without adding ignore comments or per-file exceptions.

Changes

• Lowered complexity/noExcessiveCognitiveComplexity from 255 to 245 in biome.json.
• Extracted remote provider/model validation into src/lib/onboard/setup-nim-selection.ts to keep src/lib/onboard.ts net-neutral for the growth guardrail.
• Extracted local NIM, vLLM, and routed-provider handling from setupNim into smaller helpers while preserving the existing mutable selection state.
• Uses the shared SetupNimSelectionState type from setup-nim-selection.ts to avoid duplicated selection-state contracts.
• Fixed local NIM cloud fallback and retry paths so failed/unavailable NIM cannot return incomplete model state or leak stale nimContainer values.
• Documented vLLM and Hermes recommendation source-boundary fallbacks in code.
• Added selection-state tests for cloud fallback, retry cleanup, custom-compatible API selection, and provider validation retry behavior.
• Removed the credential-env-name interpolation that CodeQL flagged in the non-interactive provider credential error path.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx @biomejs/biome lint --only=complexity/noExcessiveCognitiveComplexity --max-diagnostics=none .

• npx @biomejs/biome lint src/lib/onboard.ts src/lib/onboard/setup-nim-selection.ts src/lib/onboard/setup-nim-selection.test.ts biome.json

• npm run typecheck:cli

• npx vitest run --project cli src/lib/onboard/providers.test.ts src/lib/onboard/provider-selection.test.ts src/lib/onboard/provider-selection-prompt.test.ts src/lib/onboard/vllm-menu.test.ts src/lib/onboard/routed-inference.test.ts src/lib/inference/nim.test.ts src/lib/onboard/setup-nim-selection.test.ts

• Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes

• Targeted tests pass for changed behavior

• Tests added or updated for new or changed behavior

• Full npm test passes (broad runtime changes only)

• No secrets, API keys, or credentials committed

• Docs updated for user-facing behavior changes

• npm run docs builds without warnings (doc changes only)

• Doc pages follow the style guide (doc changes only)

• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• New Features

  • Upgraded onboarding inference model selection with stronger validation across remote and local sources, including guided retries.
  • Added cloud fallback configuration to enable smoother model switching.

• Improvements

  • Improved provider/model discovery and normalization for OpenAI-compatible, Anthropic-compatible, and local options.
  • Automatically adjusts preferred inference API behavior to match the selected model/endpoint.

• Tests

  • Expanded coverage for cloud fallback, retry handling, and remote model validation behavior.

• Chores

  • Tightened linting complexity thresholds.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d869d8ae-d6d4-4393-b8aa-815a474e7e25

📥 Commits

Reviewing files that changed from the base of the PR and between ed3170a and bd0e630.

📒 Files selected for processing (1)

• src/lib/onboard.ts

💤 Files with no reviewable changes (1)

• src/lib/onboard.ts

---

📝 Walkthrough

Walkthrough

Extracts NIM inference-selection logic from inline branches in setupNim() into four dedicated handler functions (handleVllmSelection, handleRoutedSelection, handleNimLocalSelection, handleRemoteProviderSelection) sharing a SetupNimSelectionState. Remote-model validation is moved into a new src/lib/onboard/setup-nim-selection.ts module via createRemoteModelValidator. The Biome maxAllowedComplexity threshold is reduced from 255 to 245.

Changes

NIM Selection Handler Extraction and Remote Model Validator

Layer / File(s)	Summary
SetupNimSelectionState types and module utilities src/lib/onboard/setup-nim-selection.ts, src/lib/onboard/setup-nim-selection.test.ts	Defines SetupNimSelectionBackNavigation, SetupNimSelectionState with generic Hermes auth parameter, CloudFallbackConfig, and utility functions applyCloudFallbackSelection and clearNimContainerBeforeRetry; unit tests validate state mutation, clearing behavior, and fixture construction.
Remote model validator implementation src/lib/onboard/setup-nim-selection.ts, src/lib/onboard/setup-nim-selection.test.ts	Defines internal provider/probe/auth types, validation result unions and factory dependencies, shouldRetryModel classifier, and createRemoteModelValidator factory that returns an async validateSelectedRemoteModel dispatcher branching by provider key (custom, anthropicCompatible, anthropic, default) with retry classification and NEMOCLAW_PREFERRED_API normalization; async tests cover custom endpoint routing and retry-model mapping.
Validator wiring in onboard.ts src/lib/onboard.ts	Imports createRemoteModelValidator and constructs validateSelectedRemoteModel with OpenAI/Anthropic endpoint validators, probe requirements, auth handlers, and back-to-selection marker support.
Handler functions and setupNim() integration src/lib/onboard.ts	Implements handleVllmSelection (local model discovery via /v1/models), handleRoutedSelection (routed blueprint config with credential/env hydration), handleNimLocalSelection (GPU VRAM filtering, NGC container lifecycle, cloud fallback/retry cleanup), and handleRemoteProviderSelection (endpoint prompting, Hermes auth/tool-gateways, iterative model validation), each consuming SetupNimSelectionState and returning selected/retry-selection outcomes. Refactors setupNim() Step 3 selection-loop branches for all four provider paths to construct state, delegate to handlers, and destructure updated fields back to outer variables with continuation on retry-selection.

Biome Complexity Threshold

Layer / File(s)	Summary
noExcessiveCognitiveComplexity threshold biome.json	Reduces maxAllowedComplexity from 255 to 245.

Sequence Diagram

sequenceDiagram
  participant setupNim as setupNim() Step 3
  participant handler as handler function
  participant validator as validateSelectedRemoteModel
  participant remote as Remote Provider API

  setupNim->>handler: create SetupNimSelectionState
  handler->>validator: call with selected model
  validator->>remote: probe/validate model
  remote-->>validator: validation result
  validator-->>handler: "selected" or "retry-*"
  handler-->>setupNim: return updated state
  alt retry-selection
    setupNim->>setupNim: continue selection loop
  else selected
    setupNim->>setupNim: store provider/model/endpoint
  end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

• NVIDIA/NemoClaw#5419: Both PRs modify biome.json to ratchet down the noExcessiveCognitiveComplexity maxAllowedComplexity threshold.
• NVIDIA/NemoClaw#5173: Both refactor Step 3 inference/provider selection in setupNim(), extracting and restructuring provider resolution branches into dedicated helpers.
• NVIDIA/NemoClaw#5175: Both refactor setupNim()'s inference/provider selection flow, with this PR restructuring selection loop branches around new handler functions.

Suggested labels

refactor, area: cli, area: onboarding, area: architecture, v0.0.64

Poem

🐇 Hop hop, the branches grow too wide,
So helpers were born to tuck inside.
handleVllm, handleRouted too —
Each handler knows just what to do!
The complexity threshold drops with glee,
Cleaner code for you and me. 🌿

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'refactor(onboard): lower cognitive complexity ratchet to 245' directly describes the main change: lowering the Biome linting threshold from 255 to 245 as evidenced by biome.json changes and the cognitive complexity refactoring across the onboarding module.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ratchet/245-setup-nim-cognitive-complexity

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the ratchet/245-setup-ni... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	ratchet/245-setup-ni... bd0e630	+/-
nemoclaw/src/se...cret-scanner.ts	—	100%	—
nemoclaw/src/commands/slash.ts	—	100%	—
nemoclaw/src/li...bprocess-env.ts	—	100%	—
nemoclaw/src/bl...eprint/state.ts	—	98%	—
nemoclaw/src/onboard/config.ts	—	98%	—
nemoclaw/src/bl...int/snapshot.ts	—	97%	—
nemoclaw/src/bl...print/runner.ts	—	95%	—
nemoclaw/src/co...ration-state.ts	—	94%	—
nemoclaw/src/bl...ate-networks.ts	—	94%	—
nemoclaw/src/index.ts	—	94%	—

TypeScript / code-coverage/cli

The overall coverage in the ratchet/245-setup-ni... branch is 44%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	ratchet/245-setup-ni... bd0e630	+/-
src/lib/state/o...oard-session.ts	—	90%	—
src/lib/inference/local.ts	—	77%	—
src/lib/sandbox/config.ts	—	72%	—
src/lib/inference/nim.ts	—	72%	—
src/lib/onboard/preflight.ts	—	64%	—
src/lib/state/sandbox.ts	—	55%	—
src/lib/actions...licy-channel.ts	—	52%	—
src/lib/onboard...er-gpu-patch.ts	—	50%	—
src/lib/policy/index.ts	—	49%	—
src/lib/onboard.ts	—	17%	—

---

_{Updated June 15, 2026 18:02 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

PR Review Advisor

Findings: 0 needs attention, 7 worth checking, 0 nice ideas
Since last review: 0 prior items resolved, 4 still apply, 0 new items found

Review findings

🛠️ Needs attention

• None.

🔎 Worth checking

• Source-of-truth review needed: src/lib/onboard.ts vLLM /v1/models parse/query handling: The advisor marked localized patch analysis as needs_followup.
  • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Evidence: src/lib/onboard.ts:3380-3384 documents the boundary and removal condition; src/lib/onboard.ts:3385 queries /v1/models; src/lib/onboard.ts:3392 validates isSafeModelId; src/lib/onboard.ts:3400 catches parse/query failures.
• Source-of-truth review needed: src/lib/onboard.ts Hermes Provider model recommendation fallback: The advisor marked localized patch analysis as needs_followup.
  • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Evidence: src/lib/onboard.ts:3718 calls getHermesProviderModelOptions; src/lib/onboard.ts:3719-3729 documents the source boundary, why fallback is used, and the removal condition.
• Source-of-truth review needed: src/lib/onboard.ts Local NIM cloud fallback and retry cleanup: The advisor marked localized patch analysis as needs_followup.
  • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Evidence: src/lib/onboard.ts:3505 applies cloud fallback when no NIM models fit; src/lib/onboard.ts:3594 applies fallback after failed health; src/lib/onboard.ts:3617 and src/lib/onboard.ts:3621 clear nimContainer before retry. src/lib/onboard/setup-nim-selection.test.ts:29 covers only helper-level fallback mutation.
• Add setupNim orchestration coverage for mutable provider state (src/lib/onboard.ts:4084): The extraction still moves security- and runtime-sensitive provider selection data through a mutable SetupNimSelectionState and then manually destructures selected fields back into setupNim locals. The helper tests cover some mutations, but they do not invoke setupNim or prove the caller/callee contract for credentialEnv, endpointUrl, hermesAuthMethod, hermesToolGateways, preferredInferenceApi, provider, model, and nimContainer across the remote, NIM, vLLM, and routed branches.
  • Recommendation: Add targeted setupNim/provider-selection tests or return a complete typed selection result assigned atomically. Cover Hermes API-key/OAuth state and tool gateways, credential aliasing/non-overwrite, routed endpoint/credential propagation, local NIM fallback and retry cleanup, and vLLM negative paths.
  • Evidence: Remote, NIM, vLLM, and routed branches construct SetupNimSelectionState objects and destructure subsets back into setupNim locals around src/lib/onboard.ts:4084, src/lib/onboard.ts:4110, src/lib/onboard.ts:4350, and src/lib/onboard.ts:4360. The added tests in src/lib/onboard/setup-nim-selection.test.ts exercise helper functions but not setupNim orchestration.
• Add vLLM /v1/models fail-closed regression coverage (src/lib/onboard.ts:3380): The vLLM branch documents the external local-process boundary and continues to fail closed for malformed, empty, or unsafe model data, but the new tests do not exercise those negative paths. Because onboarding accepts a model ID from a local external process before provider state is returned, this remains a security-relevant fail-closed path.
  • Recommendation: Add setupNim/provider-selection coverage that mocks malformed JSON, an empty data array, and an unsafe model id from /v1/models, and verifies onboarding does not return a selected local provider/model or write partial local-provider state.
  • Evidence: src/lib/onboard.ts:3380-3384 documents the local vLLM source boundary and removal condition; src/lib/onboard.ts:3385 queries http://127.0.0.1:${VLLM\_PORT}/v1/models; src/lib/onboard.ts:3392 validates isSafeModelId; src/lib/onboard.ts:3400 catches parse/query failures. No added test exercises the vLLM branch.
• Add Hermes recommendation fallback propagation coverage (src/lib/onboard.ts:3718): The Hermes Provider branch now explains why failed Nous recommendation lookup falls back to current/default model prompting, but there is still no regression test proving the extracted mutable-state path preserves Hermes auth method, credential env, tool gateways, preferred API, and model state.
  • Recommendation: Add a Hermes Provider setupNim test where getHermesProviderModelOptions throws and verify the selected Hermes auth method, credential env, tool gateways, preferred API, and model propagate without stale or reset state.
  • Evidence: src/lib/onboard.ts:3718 calls nousModels.getHermesProviderModelOptions(); src/lib/onboard.ts:3719-3729 catches errors, documents the source boundary, and continues with fallback model prompting. The new tests do not cover the Hermes Provider setupNim path.
• Add full setupNim coverage for Local NIM fallback and retry cleanup (src/lib/onboard.ts:3505): The new helper tests verify applyCloudFallbackSelection and clearNimContainerBeforeRetry directly, but they do not prove setupNim returns a complete cloud fallback state when no NIM models fit or health fails, nor that validation retries cannot leak a stale nimContainer through the orchestration boundary.
  • Recommendation: Add setupNim-level tests for no fitting NIM models, NIM health failure fallback, and Local NIM validation retry=model/retry=selection. Verify provider, endpointUrl, credentialEnv, model, preferredInferenceApi, and nimContainer in the returned selection.
  • Evidence: src/lib/onboard.ts:3505 applies cloud fallback when no NIM models fit; src/lib/onboard.ts:3594 applies cloud fallback after failed NIM health; src/lib/onboard.ts:3617 and src/lib/onboard.ts:3621 clear nimContainer before retry. src/lib/onboard/setup-nim-selection.test.ts:29 covers only the helper mutation.

🌱 Nice ideas

• None.

Consider writing more tests for

• **Runtime validation** — setupNim falls back from local NIM with no fitting models to the build provider default model, endpoint, credential env, preferredInferenceApi null, and nimContainer null.. The changed files are runtime onboarding/provider glue that determines credentials, auth modes, routed endpoints, local inference setup, and gateway registration state. Unit helper tests are useful, but full setupNim behavior and security-relevant negative paths remain under-covered.
• **Runtime validation** — setupNim falls back from local NIM health failure to the build provider default model, endpoint, credential env, preferredInferenceApi null, and nimContainer null.. The changed files are runtime onboarding/provider glue that determines credentials, auth modes, routed endpoints, local inference setup, and gateway registration state. Unit helper tests are useful, but full setupNim behavior and security-relevant negative paths remain under-covered.
• **Runtime validation** — setupNim clears nimContainer and returns to provider selection when Local NIM validation returns retry=model or retry=selection.. The changed files are runtime onboarding/provider glue that determines credentials, auth modes, routed endpoints, local inference setup, and gateway registration state. Unit helper tests are useful, but full setupNim behavior and security-relevant negative paths remain under-covered.
• **Runtime validation** — setupNim preserves an explicit provider-specific credential env when NEMOCLAW_PROVIDER_KEY is also set, and applies NEMOCLAW_PROVIDER_KEY only when the provider-specific env is empty.. The changed files are runtime onboarding/provider glue that determines credentials, auth modes, routed endpoints, local inference setup, and gateway registration state. Unit helper tests are useful, but full setupNim behavior and security-relevant negative paths remain under-covered.
• **Runtime validation** — setupNim returns Hermes API-key auth method, HERMES_NOUS_API_KEY credential env, selected tool gateways, selected model, and openai-completions after Hermes Provider selection.. The changed files are runtime onboarding/provider glue that determines credentials, auth modes, routed endpoints, local inference setup, and gateway registration state. Unit helper tests are useful, but full setupNim behavior and security-relevant negative paths remain under-covered.
• **Add setupNim orchestration coverage for mutable provider state** — Add targeted setupNim/provider-selection tests or return a complete typed selection result assigned atomically. Cover Hermes API-key/OAuth state and tool gateways, credential aliasing/non-overwrite, routed endpoint/credential propagation, local NIM fallback and retry cleanup, and vLLM negative paths.
• **Add vLLM /v1/models fail-closed regression coverage** — Add setupNim/provider-selection coverage that mocks malformed JSON, an empty data array, and an unsafe model id from /v1/models, and verifies onboarding does not return a selected local provider/model or write partial local-provider state.
• **Add Hermes recommendation fallback propagation coverage** — Add a Hermes Provider setupNim test where getHermesProviderModelOptions throws and verify the selected Hermes auth method, credential env, tool gateways, preferred API, and model propagate without stale or reset state.

Since last review details

Current findings:

• Source-of-truth review needed: src/lib/onboard.ts vLLM /v1/models parse/query handling: The advisor marked localized patch analysis as needs_followup.
  • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Evidence: src/lib/onboard.ts:3380-3384 documents the boundary and removal condition; src/lib/onboard.ts:3385 queries /v1/models; src/lib/onboard.ts:3392 validates isSafeModelId; src/lib/onboard.ts:3400 catches parse/query failures.
• Source-of-truth review needed: src/lib/onboard.ts Hermes Provider model recommendation fallback: The advisor marked localized patch analysis as needs_followup.
  • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Evidence: src/lib/onboard.ts:3718 calls getHermesProviderModelOptions; src/lib/onboard.ts:3719-3729 documents the source boundary, why fallback is used, and the removal condition.
• Source-of-truth review needed: src/lib/onboard.ts Local NIM cloud fallback and retry cleanup: The advisor marked localized patch analysis as needs_followup.
  • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
  • Evidence: src/lib/onboard.ts:3505 applies cloud fallback when no NIM models fit; src/lib/onboard.ts:3594 applies fallback after failed health; src/lib/onboard.ts:3617 and src/lib/onboard.ts:3621 clear nimContainer before retry. src/lib/onboard/setup-nim-selection.test.ts:29 covers only helper-level fallback mutation.
• Add setupNim orchestration coverage for mutable provider state (src/lib/onboard.ts:4084): The extraction still moves security- and runtime-sensitive provider selection data through a mutable SetupNimSelectionState and then manually destructures selected fields back into setupNim locals. The helper tests cover some mutations, but they do not invoke setupNim or prove the caller/callee contract for credentialEnv, endpointUrl, hermesAuthMethod, hermesToolGateways, preferredInferenceApi, provider, model, and nimContainer across the remote, NIM, vLLM, and routed branches.
  • Recommendation: Add targeted setupNim/provider-selection tests or return a complete typed selection result assigned atomically. Cover Hermes API-key/OAuth state and tool gateways, credential aliasing/non-overwrite, routed endpoint/credential propagation, local NIM fallback and retry cleanup, and vLLM negative paths.
  • Evidence: Remote, NIM, vLLM, and routed branches construct SetupNimSelectionState objects and destructure subsets back into setupNim locals around src/lib/onboard.ts:4084, src/lib/onboard.ts:4110, src/lib/onboard.ts:4350, and src/lib/onboard.ts:4360. The added tests in src/lib/onboard/setup-nim-selection.test.ts exercise helper functions but not setupNim orchestration.
• Add vLLM /v1/models fail-closed regression coverage (src/lib/onboard.ts:3380): The vLLM branch documents the external local-process boundary and continues to fail closed for malformed, empty, or unsafe model data, but the new tests do not exercise those negative paths. Because onboarding accepts a model ID from a local external process before provider state is returned, this remains a security-relevant fail-closed path.
  • Recommendation: Add setupNim/provider-selection coverage that mocks malformed JSON, an empty data array, and an unsafe model id from /v1/models, and verifies onboarding does not return a selected local provider/model or write partial local-provider state.
  • Evidence: src/lib/onboard.ts:3380-3384 documents the local vLLM source boundary and removal condition; src/lib/onboard.ts:3385 queries http://127.0.0.1:${VLLM\_PORT}/v1/models; src/lib/onboard.ts:3392 validates isSafeModelId; src/lib/onboard.ts:3400 catches parse/query failures. No added test exercises the vLLM branch.
• Add Hermes recommendation fallback propagation coverage (src/lib/onboard.ts:3718): The Hermes Provider branch now explains why failed Nous recommendation lookup falls back to current/default model prompting, but there is still no regression test proving the extracted mutable-state path preserves Hermes auth method, credential env, tool gateways, preferred API, and model state.
  • Recommendation: Add a Hermes Provider setupNim test where getHermesProviderModelOptions throws and verify the selected Hermes auth method, credential env, tool gateways, preferred API, and model propagate without stale or reset state.
  • Evidence: src/lib/onboard.ts:3718 calls nousModels.getHermesProviderModelOptions(); src/lib/onboard.ts:3719-3729 catches errors, documents the source boundary, and continues with fallback model prompting. The new tests do not cover the Hermes Provider setupNim path.
• Add full setupNim coverage for Local NIM fallback and retry cleanup (src/lib/onboard.ts:3505): The new helper tests verify applyCloudFallbackSelection and clearNimContainerBeforeRetry directly, but they do not prove setupNim returns a complete cloud fallback state when no NIM models fit or health fails, nor that validation retries cannot leak a stale nimContainer through the orchestration boundary.
  • Recommendation: Add setupNim-level tests for no fitting NIM models, NIM health failure fallback, and Local NIM validation retry=model/retry=selection. Verify provider, endpointUrl, credentialEnv, model, preferredInferenceApi, and nimContainer in the returned selection.
  • Evidence: src/lib/onboard.ts:3505 applies cloud fallback when no NIM models fit; src/lib/onboard.ts:3594 applies cloud fallback after failed NIM health; src/lib/onboard.ts:3617 and src/lib/onboard.ts:3621 clear nimContainer before retry. src/lib/onboard/setup-nim-selection.test.ts:29 covers only the helper mutation.

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

[github-actions]

E2E Advisor Recommendation

Required E2E: cloud-onboard-e2e, inference-routing-vitest, bedrock-runtime-compatible-anthropic-vitest, model-router-provider-routed-inference-e2e
Optional E2E: onboard-negative-paths-vitest, cloud-inference-e2e, gpu-e2e

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• cloud-onboard-e2e (high): Runs the real non-interactive onboard path with hosted inference, sandbox creation, credential setup, policy selection, and provider/model selection; this is the broadest guard for the setupNim refactor.
• inference-routing-vitest (medium): Covers custom OpenAI-compatible provider routing, invalid-key and unreachable-endpoint classification, cleanup, and credential isolation around inference.local without live provider quota.
• bedrock-runtime-compatible-anthropic-vitest (medium): Directly exercises the anthropicCompatible remote-provider path that was moved into the new selection/validation helper, including hidden adapter-token handling and inference.local routing through a hermetic Bedrock-compatible endpoint.
• model-router-provider-routed-inference-e2e (medium): The routed provider branch was refactored; this regression job proves onboard creates a working Model Router provider route instead of producing inference.local 503s.

Optional E2E

• onboard-negative-paths-vitest (low): Useful adjacent confidence for fail-closed onboarding/provider validation behavior after moving retry and error handling into setup-nim-selection helpers.
• cloud-inference-e2e (high): Additional end-to-end confidence that a sandbox onboarded through the changed provider-selection flow can complete a real assistant inference request through inference.local.
• gpu-e2e (very high): Optional high-cost local-inference smoke for the broader setupNim selection loop; it does not specifically cover Local NIM/vLLM but can catch regressions in local provider onboarding on a GPU runner.

New E2E recommendations

• local NIM onboarding (high): The PR changes Local NIM model selection, NGC credential prompting, container start state, validation retry cleanup, and cloud fallback, but existing E2E coverage appears to focus on Ollama GPU rather than a Local NIM container path.
  • Suggested test: Add a Local NIM setupNim E2E/scenario that runs on a GPU-capable runner or with a hermetic NIM-compatible mock, verifies NGC key forwarding, container-state cleanup on validation retry, cloud fallback when health fails, and final inference.local route configuration.
• local vLLM onboarding (medium): The refactor adds fail-closed /v1/models parsing and forced chat-completions behavior for vLLM, but no existing E2E job specifically validates the Local vLLM provider selection branch.
  • Suggested test: Add a Local vLLM provider-selection E2E with a lightweight mock /v1/models and /v1/chat/completions endpoint to verify safe model-id rejection, preferred API forcing, and route setup.

[github-actions]

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: ubuntu-repo-cloud-openclaw
Optional Vitest E2E scenarios: None

Dispatch required Vitest E2E scenarios:

• gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field scenarios=ubuntu-repo-cloud-openclaw

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required Vitest E2E scenarios

• ubuntu-repo-cloud-openclaw: The PR refactors setupNim provider/model selection and remote validation used by the onboard flow. The live-supported Ubuntu cloud OpenClaw scenario is the smallest typed Vitest scenario that exercises the affected onboarding path end-to-end.
  • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field scenarios=ubuntu-repo-cloud-openclaw

Optional Vitest E2E scenarios

• None.

Relevant changed files

• src/lib/onboard.ts
• src/lib/onboard/setup-nim-selection.ts

[github-actions]

Selective E2E Results — ✅ All requested jobs passed

Run: 27557046406
Target ref: 30e2b108928aa05a0d04fadefdf0d17b50a2266c
Workflow ref: main
Requested jobs: bedrock-runtime-compatible-anthropic-e2e
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
bedrock-runtime-compatible-anthropic-e2e	✅ success

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/onboard.ts`:
- Around line 3519-3522: When no NIM models fit the GPU VRAM and the code
returns "selected" while breaking out of selectionLoop, the state.model remains
null, causing setupNim() to return an incomplete provider/model selection.
Before returning "selected" in the fallback case, populate the cloud fallback
configuration by setting state.model to the appropriate cloud provider/model
selection so that setupNim() can properly fall back to cloud API inference
instead of returning incomplete results. Apply this fix at both the initial
fallback location and the secondary affected location mentioned in the comment.
- Around line 3626-3627: The retry paths that return "retry-selection" (when
validation.retry is "selection" or "model", or when validation.ok is false)
leave state.nimContainer set with a stale value. This stale container name
persists into the next iteration of the selection loop, causing non-NIM
selections to incorrectly use the failed NIM container. Before each return
statement that returns "retry-selection", clear state.nimContainer to ensure no
stale local-NIM state carries forward to subsequent provider selections.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 426eab54-be42-4cc5-b913-46b50c30fabb

📥 Commits

Reviewing files that changed from the base of the PR and between f4f3c58 and 30e2b10.

📒 Files selected for processing (3)

• biome.json
• src/lib/onboard.ts
• src/lib/onboard/setup-nim-selection.ts

[github-actions]

Selective E2E Results — ✅ All requested jobs passed

Run: 27557870341
Target ref: 7778b051207fe76b314ab8e823d4e5a0aa1ea5f1
Workflow ref: main
Requested jobs: messaging-compatible-endpoint-e2e
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
messaging-compatible-endpoint-e2e	✅ success

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.