refactor(rebuild): lower cognitive complexity ratchet to 215

[cv]

Summary

Continue the stacked cognitive-complexity ratchet by lowering the threshold from 224 to 215. This trims the rebuild hotspot by moving the rebuild version banner into a small helper.

Changes

• Lowered complexity/noExcessiveCognitiveComplexity from 224 to 215 in biome.json.
• Extracted rebuild version summary output into printRebuildVersionSummary.
• Kept the current/target version display behavior unchanged while reducing rebuildSandbox complexity below the new ceiling.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Verification

• npx @biomejs/biome lint --only=complexity/noExcessiveCognitiveComplexity --max-diagnostics=none .

• npm run typecheck:cli

• npx vitest run --project cli test/rebuild-credential-preflight.test.ts test/rebuild-stale-recovery.test.ts src/lib/actions/sandbox/rebuild-gateway-drift.test.ts

• Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes

• Targeted tests pass for changed behavior

• Tests added or updated for new or changed behavior

• Full npm test passes (broad runtime changes only)

• No secrets, API keys, or credentials committed

• Docs updated for user-facing behavior changes

• npm run docs builds without warnings (doc changes only)

• Doc pages follow the style guide (doc changes only)

• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Chores

  • Updated linter configuration thresholds.

• Refactor

  • Improved code organization in sandbox rebuild handling for better maintainability.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 354514d1-e8ea-4e36-a9f1-45fdffaf2b25

📥 Commits

Reviewing files that changed from the base of the PR and between 8385fe7 and 51492b1.

📒 Files selected for processing (2)

• biome.json
• src/lib/actions/sandbox/rebuild.ts

---

📝 Walkthrough

Walkthrough

rebuildSandbox in rebuild.ts extracts its inline version-summary console.log block into a new printRebuildVersionSummary(sandboxName, agentName, versionCheck) helper. The biome.json noExcessiveCognitiveComplexity threshold is lowered from 224 to 215 to match the reduced function complexity.

Changes

Rebuild version summary extraction and complexity ratchet

Layer / File(s)	Summary
printRebuildVersionSummary helper and call-site replacement src/lib/actions/sandbox/rebuild.ts	New printRebuildVersionSummary function centralizes the rebuild header and conditional current/target version console.log output; rebuildSandbox replaces the inline block with a single call to this helper.
Biome cognitive complexity threshold lowered to 215 biome.json	maxAllowedComplexity reduced from 224 to 215 in the noExcessiveCognitiveComplexity rule, reflecting the complexity reduction from the extraction above.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• NVIDIA/NemoClaw#5422: Both PRs tighten biome.json's noExcessiveCognitiveComplexity threshold and refactor rebuildSandbox in rebuild.ts by extracting different inline logic blocks into helpers.
• NVIDIA/NemoClaw#5426: Both PRs extract inline guard/console-reporting logic from rebuildSandbox into helper functions and adjust the noExcessiveCognitiveComplexity threshold in biome.json.
• NVIDIA/NemoClaw#5427: Both PRs modify the same Biome linter setting noExcessiveCognitiveComplexity.maxAllowedComplexity in biome.json, ratcheting the threshold downward.

Poem

🐇 A helper was born to carry the log,
No more inline clutter to sift through the fog.
Complexity shrinks, the threshold drops low,
From 224 to 215 — watch the numbers go!
Clean little function, tidy and bright,
The rabbit hops on through the refactored night. ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly reflects the main changes: lowering the cognitive complexity threshold from 224 to 215 in biome.json and refactoring rebuild.ts to achieve this reduction.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ratchet/215-rebuild-version-header

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the ratchet/215-rebuild-... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	ratchet/215-rebuild-... 51492b1	+/-
nemoclaw/src/se...cret-scanner.ts	—	100%	—
nemoclaw/src/commands/slash.ts	—	100%	—
nemoclaw/src/li...bprocess-env.ts	—	100%	—
nemoclaw/src/bl...eprint/state.ts	—	98%	—
nemoclaw/src/onboard/config.ts	—	98%	—
nemoclaw/src/bl...int/snapshot.ts	—	97%	—
nemoclaw/src/bl...print/runner.ts	—	95%	—
nemoclaw/src/co...ration-state.ts	—	94%	—
nemoclaw/src/bl...ate-networks.ts	—	94%	—
nemoclaw/src/index.ts	—	94%	—

TypeScript / code-coverage/cli

The overall coverage in the ratchet/215-rebuild-... branch is 45%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	ratchet/215-rebuild-... 51492b1	+/-
src/lib/state/o...oard-session.ts	—	90%	—
src/lib/inference/local.ts	—	76%	—
src/lib/sandbox/config.ts	—	72%	—
src/lib/onboard/preflight.ts	—	64%	—
src/lib/actions...dbox/rebuild.ts	—	60%	—
src/lib/state/sandbox.ts	—	55%	—
src/lib/actions...licy-channel.ts	—	52%	—
src/lib/onboard...er-gpu-patch.ts	—	50%	—
src/lib/policy/index.ts	—	49%	—
src/lib/onboard.ts	—	17%	—

---

_{Updated June 15, 2026 21:35 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

E2E Advisor Recommendation

Required E2E: rebuild-openclaw-e2e
Optional E2E: rebuild-hermes-e2e, test-sandbox-rebuild.sh

Dispatch hint: rebuild-openclaw-e2e

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• rebuild-openclaw-e2e (moderate): This is the primary existing live rebuild coverage for the changed sandbox rebuild action. It exercises installing NemoClaw, creating an older OpenClaw sandbox, running nemoclaw <name> rebuild --yes, and verifying state preservation, version upgrade, credential backup boundaries, policy preservation, and gateway token rotation.

Optional E2E

• rebuild-hermes-e2e (moderate): Useful adjacent confidence because the changed rebuild implementation is shared across agents. Run if maintainers want coverage that the same rebuild path still works for Hermes-specific sandbox images and registry/session metadata.
• test-sandbox-rebuild.sh (moderate): Additional focused rebuild/state-preservation script coverage exists, but it is not currently exposed as a named nightly workflow job in the inspected workflow. It can be run through the reusable E2E script runner if targeted script-level validation is desired.

New E2E recommendations

• None.

Dispatch hint

• Workflow: .github/workflows/nightly-e2e.yaml
• jobs input: rebuild-openclaw-e2e

[github-actions]

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: sandbox-rebuild-vitest
Optional Vitest E2E scenarios: rebuild-openclaw-vitest

Dispatch required Vitest E2E scenarios:

• gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=sandbox-rebuild-vitest

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required Vitest E2E scenarios

• sandbox-rebuild-vitest: The PR changes the sandbox rebuild implementation. The sandbox-rebuild Vitest job runs the live rebuild path through the NemoClaw CLI and is the smallest wired Vitest scenario job covering this surface.
  • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=sandbox-rebuild-vitest

Optional Vitest E2E scenarios

• rebuild-openclaw-vitest: Adjacent OpenClaw-specific rebuild coverage also exercises the same rebuild command with OpenClaw state preservation and gateway-token rotation, but the code change is a generic rebuild refactor so this is secondary to sandbox-rebuild.
  • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=rebuild-openclaw-vitest

Relevant changed files

• src/lib/actions/sandbox/rebuild.ts

[github-actions]

PR Review Advisor

Findings: 0 needs attention, 0 worth checking, 0 nice ideas
Since last review: 0 prior items resolved, 0 still apply, 0 new items found

Consider writing more tests for

• **Runtime validation** — Verify rebuildSandbox("alpha", ["--yes"]) prints both `Current: OpenClaw v...` and `Target: OpenClaw v...` when checkAgentVersion returns both sandboxVersion and expectedVersion.. The changed TypeScript file is sandbox lifecycle CLI code. The refactor appears behavior-preserving, so this is not an actionable finding, but targeted runtime-style output checks would increase confidence.
• **Runtime validation** — Verify rebuildSandbox("alpha", ["--yes"]) omits only the `Current` line when sandboxVersion is absent but still prints the `Target` line.. The changed TypeScript file is sandbox lifecycle CLI code. The refactor appears behavior-preserving, so this is not an actionable finding, but targeted runtime-style output checks would increase confidence.
• **Runtime validation** — Verify rebuildSandbox("alpha", ["--yes"]) omits only the `Target` line when expectedVersion is absent but still prints the `Current` line.. The changed TypeScript file is sandbox lifecycle CLI code. The refactor appears behavior-preserving, so this is not an actionable finding, but targeted runtime-style output checks would increase confidence.
• **Runtime validation** — Verify rebuildSandbox("alpha", ["--yes"]) preserves the surrounding blank-line and `Rebuild sandbox 'alpha'` banner structure when neither version value is returned.. The changed TypeScript file is sandbox lifecycle CLI code. The refactor appears behavior-preserving, so this is not an actionable finding, but targeted runtime-style output checks would increase confidence.

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.