refactor(rebuild): lower cognitive complexity ratchet to 244

biome.json

@@ -86,7 +86,7 @@
         "noExcessiveCognitiveComplexity": {
           "level": "error",
           "options": {
-            "maxAllowedComplexity": 245
+            "maxAllowedComplexity": 244
           }
         }
       },

src/lib/actions/sandbox/rebuild.ts

@@ -293,6 +293,24 @@ function hookOutputsFromBuildSteps(
   return { outputs };
 }
 
+function countActiveSandboxSessionsForRebuild(sandboxName: string): number {
+  const opsBinRebuild = resolveOpenshell();
+  // Source boundary: active-session detection depends on host process listing
+  // and the OpenShell binary being installed. A failed/unavailable detector is
+  // not evidence of active sessions, and rebuild's safety preflights still run
+  // before destructive work. Keep the prior fail-open prompt behavior here;
+  // remove this fallback only if session detection becomes a required, typed
+  // OpenShell API that can distinguish "zero sessions" from "unavailable".
+  if (!opsBinRebuild) return 0;
+
+  try {
+    const sessionResult = getActiveSandboxSessions(sandboxName, createSessionDeps(opsBinRebuild));
+    return sessionResult.detected ? sessionResult.sessions.length : 0;
+  } catch {
+    return 0;
+  }
+}
+
 async function reapplyMessagingManifestAfterOpenClawDoctor(
   sandboxName: string,
   plan: SandboxMessagingPlan | null,
@@ -347,18 +365,7 @@ export async function rebuildSandbox(
     : (_msg: string, code = 1) => process.exit(code);
 
   // Active session detection — enrich the confirmation prompt if sessions are active
-  let rebuildActiveSessionCount = 0;
-  const opsBinRebuild = resolveOpenshell();
-  if (opsBinRebuild) {
-    try {
-      const sessionResult = getActiveSandboxSessions(sandboxName, createSessionDeps(opsBinRebuild));
-      if (sessionResult.detected) {
-        rebuildActiveSessionCount = sessionResult.sessions.length;
-      }
-    } catch {
-      /* non-fatal */
-    }
-  }
+  const rebuildActiveSessionCount = countActiveSandboxSessionsForRebuild(sandboxName);
 
   const sb = registry.getSandbox(sandboxName) as any;
   if (!sb) {

test/rebuild-credential-preflight.test.ts

@@ -80,6 +80,7 @@ function createFixture(opts: {
   messagingPlanChannels?: string[] | null;
   dockerBuildExitCode?: number;
   providerRegistered?: boolean;
+  activeSessionCount?: number | null;
 }) {
   const {
     sandboxName = "my-assistant",
@@ -92,6 +93,7 @@ function createFixture(opts: {
     messagingPlanChannels = null,
     dockerBuildExitCode = 0,
     providerRegistered = true,
+    activeSessionCount = 0,
   } = opts;
   const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-2273-"));
   tmpFixtures.push(tmpDir);
@@ -248,6 +250,21 @@ process.exit(0);
     { mode: 0o755 },
   );
 
+  // ── Fake ps for active SSH session detection ──────────────────
+  const activeSessionLines = Array.from(
+    { length: activeSessionCount ?? 0 },
+    (_, index) => `${9000 + index} ssh openshell-${sandboxName}`,
+  ).join("\n");
+  fs.writeFileSync(
+    path.join(tmpDir, "ps"),
+    `#!/usr/bin/env node
+if (${activeSessionCount === null ? "true" : "false"}) process.exit(1);
+process.stdout.write(${JSON.stringify(activeSessionLines)} + (${JSON.stringify(activeSessionLines)} ? "\\n" : ""));
+process.exit(0);
+`,
+    { mode: 0o755 },
+  );
+
   // ── Fake Docker ───────────────────────────────────────────────
   // Hermes rebuild forces a base-image build before backup/delete.
   // This fixture only exercises rebuild session state, so Docker succeeds.
@@ -301,24 +318,24 @@ process.exit(0);
 function runRebuild(
   fixture: ReturnType<typeof createFixture>,
   extraEnv: Record<string, string> = {},
+  options: { yes?: boolean; input?: string } = {},
 ) {
-  return spawnSync(
-    process.execPath,
-    [path.join(REPO_ROOT, "bin", "nemoclaw.js"), fixture.sandboxName, "rebuild", "--yes"],
-    {
-      cwd: REPO_ROOT,
-      encoding: "utf-8",
-      env: {
-        HOME: fixture.tmpDir,
-        PATH: fixture.tmpDir + ":" + NODE_BIN + ":/usr/bin:/bin",
-        NEMOCLAW_NON_INTERACTIVE: "1",
-        NEMOCLAW_NO_CONNECT_HINT: "1",
-        NO_COLOR: "1",
-        ...extraEnv,
-      },
-      timeout: 30_000,
+  const argv = [path.join(REPO_ROOT, "bin", "nemoclaw.js"), fixture.sandboxName, "rebuild"];
+  if (options.yes !== false) argv.push("--yes");
+  return spawnSync(process.execPath, argv, {
+    cwd: REPO_ROOT,
+    encoding: "utf-8",
+    input: options.input,
+    env: {
+      HOME: fixture.tmpDir,
+      PATH: fixture.tmpDir + ":" + NODE_BIN + ":/usr/bin:/bin",
+      NEMOCLAW_NON_INTERACTIVE: "1",
+      NEMOCLAW_NO_CONNECT_HINT: "1",
+      NO_COLOR: "1",
+      ...extraEnv,
     },
-  );
+    timeout: 30_000,
+  });
 }
 
 function registryHasSandbox(fixture: ReturnType<typeof createFixture>): boolean {
@@ -334,6 +351,49 @@ function registryHasSandbox(fixture: ReturnType<typeof createFixture>): boolean
 
 describe("Issue #2273: atomic rebuild", () => {
   describe("Layer 2: preflight credential check", () => {
+    it("prints active SSH session warning before interactive confirmation", {
+      timeout: 60_000,
+    }, () => {
+      const f = createFixture({
+        activeSessionCount: 2,
+        savedCredential: {
+          key: "NVIDIA_INFERENCE_API_KEY",
+          value: "nvapi-test-key-for-rebuild",
+        },
+      });
+
+      const result = runRebuild(f, {}, { yes: false, input: "n\n" });
+      const output = (result.stderr || "") + (result.stdout || "");
+
+      expect(result.status).toBe(0);
+      expect(output).toContain("Active SSH sessions detected (2 connections)");
+      expect(output).toContain("terminate all active sessions with a Broken pipe error");
+      expect(output).toContain("Proceed? [y/N]:");
+      expect(output).toContain("Cancelled.");
+      expect(output).not.toContain("Backing up sandbox state");
+    });
+
+    it("omits active SSH warning when detection is unavailable", {
+      timeout: 60_000,
+    }, () => {
+      const f = createFixture({
+        activeSessionCount: null,
+        savedCredential: {
+          key: "NVIDIA_INFERENCE_API_KEY",
+          value: "nvapi-test-key-for-rebuild",
+        },
+      });
+
+      const result = runRebuild(f, {}, { yes: false, input: "n\n" });
+      const output = (result.stderr || "") + (result.stdout || "");
+
+      expect(result.status).toBe(0);
+      expect(output).not.toContain("Active SSH");
+      expect(output).toContain("Proceed? [y/N]:");
+      expect(output).toContain("Cancelled.");
+      expect(output).not.toContain("Backing up sandbox state");
+    });
+
     it("aborts rebuild BEFORE destroying sandbox when credential is missing", {
       timeout: 60_000,
     }, () => {