Skip to content

test(e2e): migrate scope upgrade approval to Vitest - #5498

Merged
cv merged 13 commits into
mainfrom
e2e-migrate/test-issue-4462-scope-upgrade-approval
Jun 17, 2026
Merged

test(e2e): migrate scope upgrade approval to Vitest#5498
cv merged 13 commits into
mainfrom
e2e-migrate/test-issue-4462-scope-upgrade-approval

Conversation

@cv

@cv cv commented Jun 16, 2026

Copy link
Copy Markdown
Collaborator

Summary

Migrate test-issue-4462-scope-upgrade-approval.sh into the live Vitest E2E system. Adds test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts and issue-4462-scope-upgrade-approval-vitest workflow wiring. The Vitest test installs a real sandbox, verifies the proxy-env devices-approve guard, approves or observes the CLI scope upgrade without operator.admin, and confirms a final agent turn stays on the gateway path.

Related Issue

Refs #5098

Changes

  • Adds or wires the free-standing live Vitest scenario issue-4462-scope-upgrade-approval.
  • Adds selective workflow dispatch via issue-4462-scope-upgrade-approval-vitest in .github/workflows/e2e-vitest-scenarios.yaml.
  • Preserves the legacy system boundaries from test-issue-4462-scope-upgrade-approval.sh while leaving legacy shell retirement to Epic: Migrate legacy bash E2E into the Vitest E2E system #5098 Phase 11.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Verification

  • Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes
  • Targeted tests pass for changed behavior
  • Full npm test passes (broad runtime changes only)
  • Tests added or updated for new or changed behavior
  • No secrets, API keys, or credentials committed
  • Docs updated for user-facing behavior changes
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Targeted local checks run while preparing these branches:

  • npx vitest run --project e2e-vitest-support test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts --silent=false --reporter=default
  • npm run typecheck:cli for branches adding new TypeScript tests
  • git diff --check

Selective same-runner dispatch: https://github.com/NVIDIA/NemoClaw/actions/runs/27670190210 — in progress after merge-from-main refresh


Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

  • Tests
    • Added a new live end-to-end scenario test to ensure scope-upgrade approval follows the gateway path and does not grant elevated admin access to CLI clients.
  • CI / Automation
    • Added a dedicated end-to-end Vitest run that executes the scenario and uploads test artifacts for review.
    • Updated pull request reporting so the new scenario job’s results are included in the PR status summary.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv cv self-assigned this Jun 16, 2026
@copy-pr-bot

copy-pr-bot Bot commented Jun 16, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Adds a new TypeScript Vitest live E2E test for the issue-4462 scope-upgrade approval scenario, replacing the prior shell-based test. The test embeds a bash/Python script that validates scope-upgrade approval flows and absence of operator.admin leakage. A matching GitHub Actions CI job is added to the e2e-vitest-scenarios.yaml workflow and wired into report-to-pr.

Changes

Scope-upgrade approval Vitest migration

Layer / File(s) Summary
Test constants, environment setup, and cleanup
test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts
Defines scenario name, live-test gating, sandbox naming helper, environment variable constructor, and an async cleanup that destroys the CLI sandbox and OpenShell gateway while swallowing errors.
Embedded bash/Python scope-upgrade approval script
test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts
Inline bash script with Python helpers that reads OpenClaw device state, selects or approves a pending scope-upgrade request without granting operator.admin, triggers agent interaction when no pending request exists, and asserts the final output contains 42 via the gateway path.
Live test execution harness and result recording
test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts
Wires the full test: writes scenario JSON, checks Docker availability, installs prerequisites with redacted secrets, base64-encodes and executes the embedded script in the sandbox, asserts success marker presence, runs cleanup, and writes scenario-result.json as passed.
CI workflow job and report-to-pr wiring
.github/workflows/e2e-vitest-scenarios.yaml
Adds issue-4462-scope-upgrade-approval-vitest job with Node setup, dep install, CLI build, OpenShell install, OPENSHELL_BIN resolution, Vitest run, and artifact upload; extends report-to-pr.needs to include the new job.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related issues

Possibly related PRs

  • NVIDIA/NemoClaw#5243: Adds the Vitest "jobs selector" workflow plumbing in the same e2e-vitest-scenarios.yaml that gates the new job dispatch logic.
  • NVIDIA/NemoClaw#5406: Stabilizes the same issue-4462 scope-upgrade approval scenario by handling preapproved and already-satisfied states in the bash script logic.
  • NVIDIA/NemoClaw#5412: Modifies the same E2E #4462 test logic to handle legacy/gateway-mode completion paths via bash script adjustments and post-approval assertions.

Suggested labels

area: e2e, chore, v0.0.65

Poem

🐇 Hop hop, the shell script's gone away,
Now TypeScript Vitest rules the day!
Scope upgrades approved, no admin leak,
The gateway path is what we seek.
42 confirmed—the bunny cheers! 🎉

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The pull request title 'test(e2e): migrate scope upgrade approval to Vitest' accurately describes the main change—migrating a shell-based E2E test to Vitest. It is specific, clear, and directly reflects the primary objective of the changeset.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch e2e-migrate/test-issue-4462-scope-upgrade-approval

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions

github-actions Bot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: None
Optional E2E: issue-4462-scope-upgrade-approval-vitest

Dispatch hint: issue-4462-scope-upgrade-approval-vitest

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • None. No merge-blocking E2E is required because the PR only adds E2E test/workflow coverage and does not change runtime installer, onboarding, sandbox, credential, policy, inference, or assistant-flow implementation code.

Optional E2E

  • issue-4462-scope-upgrade-approval-vitest (high): This is the newly added live scenario job. Running it validates the new workflow entry, selector wiring, secret/env setup, artifact path, and the scenario's scope-upgrade approval coverage.

New E2E recommendations

  • None.

Dispatch hint

  • Workflow: .github/workflows/e2e-vitest-scenarios.yaml
  • jobs input: issue-4462-scope-upgrade-approval-vitest

@github-actions

github-actions Bot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: issue-4462-scope-upgrade-approval-vitest
Optional Vitest E2E scenarios: None

Dispatch required Vitest E2E scenarios:

  • gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=issue-4462-scope-upgrade-approval-vitest

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required Vitest E2E scenarios

  • issue-4462-scope-upgrade-approval-vitest: Focused free-standing Vitest job wired for changed live test test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts.
    • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=issue-4462-scope-upgrade-approval-vitest

Optional Vitest E2E scenarios

  • None.

Relevant changed files

  • .github/workflows/e2e-vitest-scenarios.yaml
  • test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts

@github-actions

github-actions Bot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor

Findings: 3 needs attention, 4 worth checking, 0 nice ideas
Since last review: 0 prior items resolved, 7 still apply, 0 new items found

Review findings

🛠️ Needs attention

  • No-pending branch can skip the no-admin assertion (test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts:161): The scenario's security contract is that the CLI scope upgrade reaches operator.read/operator.write without operator.admin, but the no-pending/not-reproduced success path can exit before the final scope assertion. If assert_agent_scopes_without_admin fails, the following elif can still accept a successful agent answer, emit ISSUE_4462_SCOPE_UPGRADE_OK, and exit 0.
    • Recommendation: Require the no-admin assertion to pass on every success path. If the no-pending branch remains, explicitly fail it whenever any CLI paired device has operator.admin before emitting ISSUE_4462_SCOPE_UPGRADE_OK.
    • Evidence: Lines 159-160 attempt assert_agent_scopes_without_admin; lines 161-165 can then print TRIGGER_COMPLETED_WITHOUT_PENDING_SCOPE_UPGRADE and ISSUE_4462_SCOPE_UPGRADE_OK with exit 0. The final assertion around line 198 is bypassed by that early exit.
  • Scenario can pass without exercising pending scope-upgrade creation and rejection (test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts:159): Issue OpenClaw CLI scope-upgrade approval deadlocks and forces openclaw agent into embedded fallback #4462's core behavior is a low-scope CLI agent turn causing a pending operator.read/operator.write request and rejected gateway connection until approval. This migrated test only approves a request when one is observed, and otherwise accepts already-approved or no-pending/not-reproduced states, so the main success marker can be reached without proving the fix path.
    • Recommendation: Require the pending request path for this issue-4462 fix gate, or split preapproved/no-pending tolerance into a separate documented scenario while adding deterministic regression coverage for low-scope CLI -> pending read/write request -> approval -> final gateway path.
    • Evidence: When request_id remains empty after the trigger, lines 159-165 accept SCOPE_ALREADY_APPROVED or TRIGGER_COMPLETED_WITHOUT_PENDING_SCOPE_UPGRADE instead of requiring a pending request and a rejected/pending first gateway connection.
  • Initial low-scope CLI pairing precondition is not asserted (test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts:144): The linked issue starts from a CLI device paired only with operator.pairing and states that openclaw devices list --json works and shows that state. The migrated test runs the command but ignores failures and never parses the output, so it does not prove the starting authorization state required by the issue.
    • Recommendation: Assert that openclaw devices list --json succeeds and shows a CLI paired device with operator.pairing but without operator.read, operator.write, or operator.admin, or document why this migrated fix gate intentionally starts after that state and identify separate coverage.
    • Evidence: Line 144 redirects openclaw devices list --json to /tmp/issue4462-devices-list.json with || true. The file is not parsed afterward; later helpers only accept read/write-approved devices and do not prove the initial pairing-only state.

🔎 Worth checking

  • Source-of-truth review needed: TRIGGER_COMPLETED_WITHOUT_PENDING_SCOPE_UPGRADE no-pending tolerance: The advisor marked localized patch analysis as missing.
    • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
    • Evidence: Lines 161-165 emit TRIGGER_COMPLETED_WITHOUT_PENDING_SCOPE_UPGRADE and ISSUE_4462_SCOPE_UPGRADE_OK before exit 0.
  • Approve guard check no longer proves the subprocess env boundary (test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts:78): The legacy shell test wrapped openclaw and asserted that the openclaw devices approve subprocess saw OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_PORT, and OPENCLAW_GATEWAY_TOKEN unset while the caller shell retained its gateway env. The migrated test only greps for the guard string and observes approval success, which is weaker evidence for the trusted auth boundary that fixed OpenClaw CLI scope-upgrade approval deadlocks and forces openclaw agent into embedded fallback #4462.
    • Recommendation: Restore the subprocess-env probe from the legacy shell test, or explicitly document why guard-string presence plus approval success is sufficient for this migration.
    • Evidence: Line 78 checks /tmp/nemoclaw-proxy-env.sh for the devices approve guard and line 176 runs openclaw devices approve "$request_id" --json. The legacy test emitted and checked __APPROVE_SUBPROCESS_ENV__=unset:unset:unset.
  • New default live job expands inference-secret exposure to checked-out code (.github/workflows/e2e-vitest-scenarios.yaml:2115): The workflow adds another free-standing live E2E job that runs by default when both inputs.jobs and inputs.scenarios are empty. That job receives NVIDIA_INFERENCE_API_KEY and runs repository code from the checked-out ref, including install.sh, scripts/install-openshell.sh, the built CLI, and the new Vitest test. The added job keeps pinned actions and persist-credentials: false, but it still expands the default secret-bearing trusted-code boundary.
    • Recommendation: Confirm this scenario intentionally belongs in the default secret-bearing workflow set, or restrict it to explicit jobs/scenarios selection if default execution is not required. Keep the pinned-action, checkout credential, and artifact redaction boundaries.
    • Evidence: The job condition includes the default case (inputs.jobs == '' && inputs.scenarios == ''), and the Vitest step passes NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}.
  • No-pending tolerance lacks source-of-truth criteria (test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts:161): The TRIGGER_COMPLETED_WITHOUT_PENDING_SCOPE_UPGRADE path tolerates an unexpected no-pending state, but the migrated test does not encode the invalid state's source boundary, why the source cannot be made deterministic here, what regression prevents drift, or when the tolerance can be removed. Because this tolerance can satisfy the main issue gate, it risks hiding regressions in the pending-upgrade path.
    • Recommendation: Make the invalid state impossible at setup time if possible. If the tolerance remains, encode or document the source boundary, source-fix constraint, regression test, and removal condition, and avoid using it to satisfy the main issue-4462 fix gate.
    • Evidence: Lines 161-165 print TRIGGER_COMPLETED_WITHOUT_PENDING_SCOPE_UPGRADE and ISSUE_4462_SCOPE_UPGRADE_OK before exiting 0. The scenario artifact contracts do not explain this tolerated state or a removal condition.

🌱 Nice ideas

  • None.
Consider writing more tests for
  • **Runtime validation** — openclaw devices list --json succeeds after install and shows a CLI paired device with operator.pairing but without operator.read, operator.write, or operator.admin.. The changed behavior crosses live sandbox setup, installer execution, gateway device authorization, scope approval, workflow selector routing, and inference-secret handling. A live Vitest scenario is the right level, but several security-relevant branches are not yet proved.
  • **Runtime validation** — A low-scope openclaw agent turn creates a pending CLI scope-upgrade request containing operator.read/operator.write and the first gateway connection is rejected or reported pending before approval.. The changed behavior crosses live sandbox setup, installer execution, gateway device authorization, scope approval, workflow selector routing, and inference-secret handling. A live Vitest scenario is the right level, but several security-relevant branches are not yet proved.
  • **Runtime validation** — openclaw devices approve <requestId> --json approves the exact pending request, removes it from pending, grants read/write, and never grants operator.admin.. The changed behavior crosses live sandbox setup, installer execution, gateway device authorization, scope approval, workflow selector routing, and inference-secret handling. A live Vitest scenario is the right level, but several security-relevant branches are not yet proved.
  • **Runtime validation** — Every success path, including any preapproved or no-pending branch, fails if any CLI paired device includes operator.admin.. The changed behavior crosses live sandbox setup, installer execution, gateway device authorization, scope approval, workflow selector routing, and inference-secret handling. A live Vitest scenario is the right level, but several security-relevant branches are not yet proved.
  • **Runtime validation** — The openclaw devices approve subprocess sees OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_PORT, and OPENCLAW_GATEWAY_TOKEN unset while the caller shell retains its gateway environment.. The changed behavior crosses live sandbox setup, installer execution, gateway device authorization, scope approval, workflow selector routing, and inference-secret handling. A live Vitest scenario is the right level, but several security-relevant branches are not yet proved.
  • **Approve guard check no longer proves the subprocess env boundary** — Restore the subprocess-env probe from the legacy shell test, or explicitly document why guard-string presence plus approval success is sufficient for this migration.
  • **Acceptance clause:** NemoClaw/OpenClaw appears to auto-pair the CLI device with a minimal operator.pairing scope. — add test evidence or identify existing coverage. The new script runs openclaw devices list --json at line 144 but ignores failures and never asserts a paired CLI device with only operator.pairing.
  • **Acceptance clause:** In that state, openclaw devices list --json works and shows the CLI under paired, but only with operator.pairing. — add test evidence or identify existing coverage. Line 144 redirects devices list output to a temp file with || true; the test never parses that output or checks that the command succeeded.
Since last review details

Current findings:

  • Source-of-truth review needed: TRIGGER_COMPLETED_WITHOUT_PENDING_SCOPE_UPGRADE no-pending tolerance: The advisor marked localized patch analysis as missing.
    • Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
    • Evidence: Lines 161-165 emit TRIGGER_COMPLETED_WITHOUT_PENDING_SCOPE_UPGRADE and ISSUE_4462_SCOPE_UPGRADE_OK before exit 0.
  • No-pending branch can skip the no-admin assertion (test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts:161): The scenario's security contract is that the CLI scope upgrade reaches operator.read/operator.write without operator.admin, but the no-pending/not-reproduced success path can exit before the final scope assertion. If assert_agent_scopes_without_admin fails, the following elif can still accept a successful agent answer, emit ISSUE_4462_SCOPE_UPGRADE_OK, and exit 0.
    • Recommendation: Require the no-admin assertion to pass on every success path. If the no-pending branch remains, explicitly fail it whenever any CLI paired device has operator.admin before emitting ISSUE_4462_SCOPE_UPGRADE_OK.
    • Evidence: Lines 159-160 attempt assert_agent_scopes_without_admin; lines 161-165 can then print TRIGGER_COMPLETED_WITHOUT_PENDING_SCOPE_UPGRADE and ISSUE_4462_SCOPE_UPGRADE_OK with exit 0. The final assertion around line 198 is bypassed by that early exit.
  • Scenario can pass without exercising pending scope-upgrade creation and rejection (test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts:159): Issue OpenClaw CLI scope-upgrade approval deadlocks and forces openclaw agent into embedded fallback #4462's core behavior is a low-scope CLI agent turn causing a pending operator.read/operator.write request and rejected gateway connection until approval. This migrated test only approves a request when one is observed, and otherwise accepts already-approved or no-pending/not-reproduced states, so the main success marker can be reached without proving the fix path.
    • Recommendation: Require the pending request path for this issue-4462 fix gate, or split preapproved/no-pending tolerance into a separate documented scenario while adding deterministic regression coverage for low-scope CLI -> pending read/write request -> approval -> final gateway path.
    • Evidence: When request_id remains empty after the trigger, lines 159-165 accept SCOPE_ALREADY_APPROVED or TRIGGER_COMPLETED_WITHOUT_PENDING_SCOPE_UPGRADE instead of requiring a pending request and a rejected/pending first gateway connection.
  • Initial low-scope CLI pairing precondition is not asserted (test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts:144): The linked issue starts from a CLI device paired only with operator.pairing and states that openclaw devices list --json works and shows that state. The migrated test runs the command but ignores failures and never parses the output, so it does not prove the starting authorization state required by the issue.
    • Recommendation: Assert that openclaw devices list --json succeeds and shows a CLI paired device with operator.pairing but without operator.read, operator.write, or operator.admin, or document why this migrated fix gate intentionally starts after that state and identify separate coverage.
    • Evidence: Line 144 redirects openclaw devices list --json to /tmp/issue4462-devices-list.json with || true. The file is not parsed afterward; later helpers only accept read/write-approved devices and do not prove the initial pairing-only state.
  • Approve guard check no longer proves the subprocess env boundary (test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts:78): The legacy shell test wrapped openclaw and asserted that the openclaw devices approve subprocess saw OPENCLAW_GATEWAY_URL, OPENCLAW_GATEWAY_PORT, and OPENCLAW_GATEWAY_TOKEN unset while the caller shell retained its gateway env. The migrated test only greps for the guard string and observes approval success, which is weaker evidence for the trusted auth boundary that fixed OpenClaw CLI scope-upgrade approval deadlocks and forces openclaw agent into embedded fallback #4462.
    • Recommendation: Restore the subprocess-env probe from the legacy shell test, or explicitly document why guard-string presence plus approval success is sufficient for this migration.
    • Evidence: Line 78 checks /tmp/nemoclaw-proxy-env.sh for the devices approve guard and line 176 runs openclaw devices approve "$request_id" --json. The legacy test emitted and checked __APPROVE_SUBPROCESS_ENV__=unset:unset:unset.
  • New default live job expands inference-secret exposure to checked-out code (.github/workflows/e2e-vitest-scenarios.yaml:2115): The workflow adds another free-standing live E2E job that runs by default when both inputs.jobs and inputs.scenarios are empty. That job receives NVIDIA_INFERENCE_API_KEY and runs repository code from the checked-out ref, including install.sh, scripts/install-openshell.sh, the built CLI, and the new Vitest test. The added job keeps pinned actions and persist-credentials: false, but it still expands the default secret-bearing trusted-code boundary.
    • Recommendation: Confirm this scenario intentionally belongs in the default secret-bearing workflow set, or restrict it to explicit jobs/scenarios selection if default execution is not required. Keep the pinned-action, checkout credential, and artifact redaction boundaries.
    • Evidence: The job condition includes the default case (inputs.jobs == '' && inputs.scenarios == ''), and the Vitest step passes NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}.
  • No-pending tolerance lacks source-of-truth criteria (test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts:161): The TRIGGER_COMPLETED_WITHOUT_PENDING_SCOPE_UPGRADE path tolerates an unexpected no-pending state, but the migrated test does not encode the invalid state's source boundary, why the source cannot be made deterministic here, what regression prevents drift, or when the tolerance can be removed. Because this tolerance can satisfy the main issue gate, it risks hiding regressions in the pending-upgrade path.
    • Recommendation: Make the invalid state impossible at setup time if possible. If the tolerance remains, encode or document the source boundary, source-fix constraint, regression test, and removal condition, and avoid using it to satisfy the main issue-4462 fix gate.
    • Evidence: Lines 161-165 print TRIGGER_COMPLETED_WITHOUT_PENDING_SCOPE_UPGRADE and ISSUE_4462_SCOPE_UPGRADE_OK before exiting 0. The scenario artifact contracts do not explain this tolerated state or a removal condition.

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

@github-code-quality

github-code-quality Bot commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the e2e-migrate/test-iss... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main e2e-migrate/test-iss... 2c41351 +/-
nemoclaw/src/se...cret-scanner.ts 100%
nemoclaw/src/commands/slash.ts 100%
nemoclaw/src/li...bprocess-env.ts 100%
nemoclaw/src/bl...eprint/state.ts 98%
nemoclaw/src/onboard/config.ts 98%
nemoclaw/src/bl...int/snapshot.ts 97%
nemoclaw/src/bl...print/runner.ts 95%
nemoclaw/src/co...ration-state.ts 94%
nemoclaw/src/bl...ate-networks.ts 94%
nemoclaw/src/index.ts 94%

TypeScript / code-coverage/cli

The overall coverage in the e2e-migrate/test-iss... branch is 46%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main e2e-migrate/test-iss... 2c41351 +/-
src/lib/state/o...oard-session.ts 90%
src/lib/inference/local.ts 76%
src/lib/sandbox/config.ts 72%
src/lib/actions...dbox/rebuild.ts 67%
src/lib/onboard/preflight.ts 64%
src/lib/actions...licy-channel.ts 56%
src/lib/state/sandbox.ts 55%
src/lib/policy/index.ts 49%
src/lib/onboard...er-gpu-patch.ts 44%
src/lib/onboard.ts 18%

Updated June 17, 2026 06:30 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

Comment thread test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts Fixed
Comment thread test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts Fixed
@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ❌ Some jobs failed

Run: 27629709761
Workflow ref: e2e-migrate/test-issue-4462-scope-upgrade-approval
Requested scenarios: (default — all supported)
Requested jobs: issue-4462-scope-upgrade-approval-vitest
Summary: 1 passed, 1 failed, 35 skipped

Job Result
bedrock-runtime-compatible-anthropic-vitest ⏭️ skipped
channels-add-remove-vitest ⏭️ skipped
cloud-inference-vitest ⏭️ skipped
common-egress-agent-vitest ⏭️ skipped
credential-migration-vitest ⏭️ skipped
credential-sanitization-vitest ⏭️ skipped
double-onboard-vitest ⏭️ skipped
gateway-drift-preflight-vitest ⏭️ skipped
gateway-guard-recovery ⏭️ skipped
gateway-health-honest-vitest ⏭️ skipped
generate-matrix ✅ success
hermes-e2e-vitest ⏭️ skipped
hermes-root-entrypoint-smoke-vitest ⏭️ skipped
inference-routing-vitest ⏭️ skipped
issue-2478-crash-loop-recovery-vitest ⏭️ skipped
issue-4434-tui-unreachable-inference-vitest ⏭️ skipped
issue-4462-scope-upgrade-approval-vitest ❌ failure
launchable-smoke-vitest ⏭️ skipped
live-scenarios ⏭️ skipped
messaging-compatible-endpoint-vitest ⏭️ skipped
messaging-providers-vitest ⏭️ skipped
model-router-provider-routed-inference-vitest ⏭️ skipped
network-policy-vitest ⏭️ skipped
onboard-negative-paths-vitest ⏭️ skipped
openclaw-inference-switch-vitest ⏭️ skipped
openclaw-skill-cli-vitest ⏭️ skipped
openclaw-tui-chat-correlation-vitest ⏭️ skipped
openshell-version-pin-vitest ⏭️ skipped
rebuild-openclaw-vitest ⏭️ skipped
runtime-overrides-vitest ⏭️ skipped
sandbox-rebuild-vitest ⏭️ skipped
sandbox-survival-vitest ⏭️ skipped
sessions-agents-cli-vitest ⏭️ skipped
shields-config-vitest ⏭️ skipped
skill-agent-vitest ⏭️ skipped
state-backup-restore-vitest ⏭️ skipped
token-rotation-vitest ⏭️ skipped

Failed jobs: issue-4462-scope-upgrade-approval-vitest. Check run artifacts for logs.

@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ❌ Some jobs failed

Run: 27630405507
Workflow ref: e2e-migrate/test-issue-4462-scope-upgrade-approval
Requested scenarios: (default — all supported)
Requested jobs: issue-4462-scope-upgrade-approval-vitest
Summary: 1 passed, 1 failed, 35 skipped

Job Result
bedrock-runtime-compatible-anthropic-vitest ⏭️ skipped
channels-add-remove-vitest ⏭️ skipped
cloud-inference-vitest ⏭️ skipped
common-egress-agent-vitest ⏭️ skipped
credential-migration-vitest ⏭️ skipped
credential-sanitization-vitest ⏭️ skipped
double-onboard-vitest ⏭️ skipped
gateway-drift-preflight-vitest ⏭️ skipped
gateway-guard-recovery ⏭️ skipped
gateway-health-honest-vitest ⏭️ skipped
generate-matrix ✅ success
hermes-e2e-vitest ⏭️ skipped
hermes-root-entrypoint-smoke-vitest ⏭️ skipped
inference-routing-vitest ⏭️ skipped
issue-2478-crash-loop-recovery-vitest ⏭️ skipped
issue-4434-tui-unreachable-inference-vitest ⏭️ skipped
issue-4462-scope-upgrade-approval-vitest ❌ failure
launchable-smoke-vitest ⏭️ skipped
live-scenarios ⏭️ skipped
messaging-compatible-endpoint-vitest ⏭️ skipped
messaging-providers-vitest ⏭️ skipped
model-router-provider-routed-inference-vitest ⏭️ skipped
network-policy-vitest ⏭️ skipped
onboard-negative-paths-vitest ⏭️ skipped
openclaw-inference-switch-vitest ⏭️ skipped
openclaw-skill-cli-vitest ⏭️ skipped
openclaw-tui-chat-correlation-vitest ⏭️ skipped
openshell-version-pin-vitest ⏭️ skipped
rebuild-openclaw-vitest ⏭️ skipped
runtime-overrides-vitest ⏭️ skipped
sandbox-rebuild-vitest ⏭️ skipped
sandbox-survival-vitest ⏭️ skipped
sessions-agents-cli-vitest ⏭️ skipped
shields-config-vitest ⏭️ skipped
skill-agent-vitest ⏭️ skipped
state-backup-restore-vitest ⏭️ skipped
token-rotation-vitest ⏭️ skipped

Failed jobs: issue-4462-scope-upgrade-approval-vitest. Check run artifacts for logs.

@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ❌ Some jobs failed

Run: 27631165609
Workflow ref: e2e-migrate/test-issue-4462-scope-upgrade-approval
Requested scenarios: (default — all supported)
Requested jobs: issue-4462-scope-upgrade-approval-vitest
Summary: 1 passed, 1 failed, 35 skipped

Job Result
bedrock-runtime-compatible-anthropic-vitest ⏭️ skipped
channels-add-remove-vitest ⏭️ skipped
cloud-inference-vitest ⏭️ skipped
common-egress-agent-vitest ⏭️ skipped
credential-migration-vitest ⏭️ skipped
credential-sanitization-vitest ⏭️ skipped
double-onboard-vitest ⏭️ skipped
gateway-drift-preflight-vitest ⏭️ skipped
gateway-guard-recovery ⏭️ skipped
gateway-health-honest-vitest ⏭️ skipped
generate-matrix ✅ success
hermes-e2e-vitest ⏭️ skipped
hermes-root-entrypoint-smoke-vitest ⏭️ skipped
inference-routing-vitest ⏭️ skipped
issue-2478-crash-loop-recovery-vitest ⏭️ skipped
issue-4434-tui-unreachable-inference-vitest ⏭️ skipped
issue-4462-scope-upgrade-approval-vitest ❌ failure
launchable-smoke-vitest ⏭️ skipped
live-scenarios ⏭️ skipped
messaging-compatible-endpoint-vitest ⏭️ skipped
messaging-providers-vitest ⏭️ skipped
model-router-provider-routed-inference-vitest ⏭️ skipped
network-policy-vitest ⏭️ skipped
onboard-negative-paths-vitest ⏭️ skipped
openclaw-inference-switch-vitest ⏭️ skipped
openclaw-skill-cli-vitest ⏭️ skipped
openclaw-tui-chat-correlation-vitest ⏭️ skipped
openshell-version-pin-vitest ⏭️ skipped
rebuild-openclaw-vitest ⏭️ skipped
runtime-overrides-vitest ⏭️ skipped
sandbox-rebuild-vitest ⏭️ skipped
sandbox-survival-vitest ⏭️ skipped
sessions-agents-cli-vitest ⏭️ skipped
shields-config-vitest ⏭️ skipped
skill-agent-vitest ⏭️ skipped
state-backup-restore-vitest ⏭️ skipped
token-rotation-vitest ⏭️ skipped

Failed jobs: issue-4462-scope-upgrade-approval-vitest. Check run artifacts for logs.

@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All jobs passed

Run: 27631676124
Workflow ref: e2e-migrate/test-issue-4462-scope-upgrade-approval
Requested scenarios: (default — all supported)
Requested jobs: issue-4462-scope-upgrade-approval-vitest
Summary: 2 passed, 0 failed, 35 skipped

Job Result
bedrock-runtime-compatible-anthropic-vitest ⏭️ skipped
channels-add-remove-vitest ⏭️ skipped
cloud-inference-vitest ⏭️ skipped
common-egress-agent-vitest ⏭️ skipped
credential-migration-vitest ⏭️ skipped
credential-sanitization-vitest ⏭️ skipped
double-onboard-vitest ⏭️ skipped
gateway-drift-preflight-vitest ⏭️ skipped
gateway-guard-recovery ⏭️ skipped
gateway-health-honest-vitest ⏭️ skipped
generate-matrix ✅ success
hermes-e2e-vitest ⏭️ skipped
hermes-root-entrypoint-smoke-vitest ⏭️ skipped
inference-routing-vitest ⏭️ skipped
issue-2478-crash-loop-recovery-vitest ⏭️ skipped
issue-4434-tui-unreachable-inference-vitest ⏭️ skipped
issue-4462-scope-upgrade-approval-vitest ✅ success
launchable-smoke-vitest ⏭️ skipped
live-scenarios ⏭️ skipped
messaging-compatible-endpoint-vitest ⏭️ skipped
messaging-providers-vitest ⏭️ skipped
model-router-provider-routed-inference-vitest ⏭️ skipped
network-policy-vitest ⏭️ skipped
onboard-negative-paths-vitest ⏭️ skipped
openclaw-inference-switch-vitest ⏭️ skipped
openclaw-skill-cli-vitest ⏭️ skipped
openclaw-tui-chat-correlation-vitest ⏭️ skipped
openshell-version-pin-vitest ⏭️ skipped
rebuild-openclaw-vitest ⏭️ skipped
runtime-overrides-vitest ⏭️ skipped
sandbox-rebuild-vitest ⏭️ skipped
sandbox-survival-vitest ⏭️ skipped
sessions-agents-cli-vitest ⏭️ skipped
shields-config-vitest ⏭️ skipped
skill-agent-vitest ⏭️ skipped
state-backup-restore-vitest ⏭️ skipped
token-rotation-vitest ⏭️ skipped

@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All jobs passed

Run: 27633396676
Workflow ref: e2e-migrate/test-issue-4462-scope-upgrade-approval
Requested scenarios: (default — all supported)
Requested jobs: issue-4462-scope-upgrade-approval-vitest
Summary: 2 passed, 0 failed, 35 skipped

Job Result
bedrock-runtime-compatible-anthropic-vitest ⏭️ skipped
channels-add-remove-vitest ⏭️ skipped
cloud-inference-vitest ⏭️ skipped
common-egress-agent-vitest ⏭️ skipped
credential-migration-vitest ⏭️ skipped
credential-sanitization-vitest ⏭️ skipped
double-onboard-vitest ⏭️ skipped
gateway-drift-preflight-vitest ⏭️ skipped
gateway-guard-recovery ⏭️ skipped
gateway-health-honest-vitest ⏭️ skipped
generate-matrix ✅ success
hermes-e2e-vitest ⏭️ skipped
hermes-root-entrypoint-smoke-vitest ⏭️ skipped
inference-routing-vitest ⏭️ skipped
issue-2478-crash-loop-recovery-vitest ⏭️ skipped
issue-4434-tui-unreachable-inference-vitest ⏭️ skipped
issue-4462-scope-upgrade-approval-vitest ✅ success
launchable-smoke-vitest ⏭️ skipped
live-scenarios ⏭️ skipped
messaging-compatible-endpoint-vitest ⏭️ skipped
messaging-providers-vitest ⏭️ skipped
model-router-provider-routed-inference-vitest ⏭️ skipped
network-policy-vitest ⏭️ skipped
onboard-negative-paths-vitest ⏭️ skipped
openclaw-inference-switch-vitest ⏭️ skipped
openclaw-skill-cli-vitest ⏭️ skipped
openclaw-tui-chat-correlation-vitest ⏭️ skipped
openshell-version-pin-vitest ⏭️ skipped
rebuild-openclaw-vitest ⏭️ skipped
runtime-overrides-vitest ⏭️ skipped
sandbox-rebuild-vitest ⏭️ skipped
sandbox-survival-vitest ⏭️ skipped
sessions-agents-cli-vitest ⏭️ skipped
shields-config-vitest ⏭️ skipped
skill-agent-vitest ⏭️ skipped
state-backup-restore-vitest ⏭️ skipped
token-rotation-vitest ⏭️ skipped

@cv
cv marked this pull request as ready for review June 16, 2026 17:03

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/e2e-vitest-scenarios.yaml:
- Around line 1822-1840: The NVIDIA_INFERENCE_API_KEY environment variable in
the "Run issue-4462-scope-upgrade-approval live Vitest test" job is
inconsistently sourced from secrets.NVIDIA_API_KEY, while all other occurrences
throughout the workflow use secrets.NVIDIA_INFERENCE_API_KEY. Update the env
section for this job to source NVIDIA_INFERENCE_API_KEY from
secrets.NVIDIA_INFERENCE_API_KEY to maintain consistency with the rest of the
workflow.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 81c266e9-91f7-4ec8-93b7-327d627cdbd6

📥 Commits

Reviewing files that changed from the base of the PR and between 6c0fb04 and 87d5cc8.

📒 Files selected for processing (2)
  • .github/workflows/e2e-vitest-scenarios.yaml
  • test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts

Comment thread .github/workflows/e2e-vitest-scenarios.yaml
@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All jobs passed

Run: 27635628747
Workflow ref: e2e-migrate/test-issue-4462-scope-upgrade-approval
Requested scenarios: (default — all supported)
Requested jobs: issue-4462-scope-upgrade-approval-vitest
Summary: 2 passed, 0 failed, 35 skipped

Job Result
bedrock-runtime-compatible-anthropic-vitest ⏭️ skipped
channels-add-remove-vitest ⏭️ skipped
cloud-inference-vitest ⏭️ skipped
common-egress-agent-vitest ⏭️ skipped
credential-migration-vitest ⏭️ skipped
credential-sanitization-vitest ⏭️ skipped
double-onboard-vitest ⏭️ skipped
gateway-drift-preflight-vitest ⏭️ skipped
gateway-guard-recovery ⏭️ skipped
gateway-health-honest-vitest ⏭️ skipped
generate-matrix ✅ success
hermes-e2e-vitest ⏭️ skipped
hermes-root-entrypoint-smoke-vitest ⏭️ skipped
inference-routing-vitest ⏭️ skipped
issue-2478-crash-loop-recovery-vitest ⏭️ skipped
issue-4434-tui-unreachable-inference-vitest ⏭️ skipped
issue-4462-scope-upgrade-approval-vitest ✅ success
launchable-smoke-vitest ⏭️ skipped
live-scenarios ⏭️ skipped
messaging-compatible-endpoint-vitest ⏭️ skipped
messaging-providers-vitest ⏭️ skipped
model-router-provider-routed-inference-vitest ⏭️ skipped
network-policy-vitest ⏭️ skipped
onboard-negative-paths-vitest ⏭️ skipped
openclaw-inference-switch-vitest ⏭️ skipped
openclaw-skill-cli-vitest ⏭️ skipped
openclaw-tui-chat-correlation-vitest ⏭️ skipped
openshell-version-pin-vitest ⏭️ skipped
rebuild-openclaw-vitest ⏭️ skipped
runtime-overrides-vitest ⏭️ skipped
sandbox-rebuild-vitest ⏭️ skipped
sandbox-survival-vitest ⏭️ skipped
sessions-agents-cli-vitest ⏭️ skipped
shields-config-vitest ⏭️ skipped
skill-agent-vitest ⏭️ skipped
state-backup-restore-vitest ⏭️ skipped
token-rotation-vitest ⏭️ skipped

@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All jobs passed

Run: 27636908661
Workflow ref: e2e-migrate/test-issue-4462-scope-upgrade-approval
Requested scenarios: (default — all supported)
Requested jobs: issue-4462-scope-upgrade-approval-vitest
Summary: 2 passed, 0 failed, 35 skipped

Job Result
bedrock-runtime-compatible-anthropic-vitest ⏭️ skipped
channels-add-remove-vitest ⏭️ skipped
cloud-inference-vitest ⏭️ skipped
common-egress-agent-vitest ⏭️ skipped
credential-migration-vitest ⏭️ skipped
credential-sanitization-vitest ⏭️ skipped
double-onboard-vitest ⏭️ skipped
gateway-drift-preflight-vitest ⏭️ skipped
gateway-guard-recovery ⏭️ skipped
gateway-health-honest-vitest ⏭️ skipped
generate-matrix ✅ success
hermes-e2e-vitest ⏭️ skipped
hermes-root-entrypoint-smoke-vitest ⏭️ skipped
inference-routing-vitest ⏭️ skipped
issue-2478-crash-loop-recovery-vitest ⏭️ skipped
issue-4434-tui-unreachable-inference-vitest ⏭️ skipped
issue-4462-scope-upgrade-approval-vitest ✅ success
launchable-smoke-vitest ⏭️ skipped
live-scenarios ⏭️ skipped
messaging-compatible-endpoint-vitest ⏭️ skipped
messaging-providers-vitest ⏭️ skipped
model-router-provider-routed-inference-vitest ⏭️ skipped
network-policy-vitest ⏭️ skipped
onboard-negative-paths-vitest ⏭️ skipped
openclaw-inference-switch-vitest ⏭️ skipped
openclaw-skill-cli-vitest ⏭️ skipped
openclaw-tui-chat-correlation-vitest ⏭️ skipped
openshell-version-pin-vitest ⏭️ skipped
rebuild-openclaw-vitest ⏭️ skipped
runtime-overrides-vitest ⏭️ skipped
sandbox-rebuild-vitest ⏭️ skipped
sandbox-survival-vitest ⏭️ skipped
sessions-agents-cli-vitest ⏭️ skipped
shields-config-vitest ⏭️ skipped
skill-agent-vitest ⏭️ skipped
state-backup-restore-vitest ⏭️ skipped
token-rotation-vitest ⏭️ skipped

…e-4462-scope-upgrade-approval

# Conflicts:
#	.github/workflows/e2e-vitest-scenarios.yaml
@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All jobs passed

Run: 27638947760
Workflow ref: e2e-migrate/test-issue-4462-scope-upgrade-approval
Requested scenarios: (default — all supported)
Requested jobs: issue-4462-scope-upgrade-approval-vitest
Summary: 2 passed, 0 failed, 36 skipped

Job Result
bedrock-runtime-compatible-anthropic-vitest ⏭️ skipped
channels-add-remove-vitest ⏭️ skipped
cloud-inference-vitest ⏭️ skipped
common-egress-agent-vitest ⏭️ skipped
credential-migration-vitest ⏭️ skipped
credential-sanitization-vitest ⏭️ skipped
double-onboard-vitest ⏭️ skipped
gateway-drift-preflight-vitest ⏭️ skipped
gateway-guard-recovery ⏭️ skipped
gateway-health-honest-vitest ⏭️ skipped
generate-matrix ✅ success
hermes-e2e-vitest ⏭️ skipped
hermes-root-entrypoint-smoke-vitest ⏭️ skipped
inference-routing-vitest ⏭️ skipped
issue-2478-crash-loop-recovery-vitest ⏭️ skipped
issue-4434-tui-unreachable-inference-vitest ⏭️ skipped
issue-4462-scope-upgrade-approval-vitest ✅ success
launchable-smoke-vitest ⏭️ skipped
live-scenarios ⏭️ skipped
messaging-compatible-endpoint-vitest ⏭️ skipped
messaging-providers-vitest ⏭️ skipped
model-router-provider-routed-inference-vitest ⏭️ skipped
network-policy-vitest ⏭️ skipped
onboard-negative-paths-vitest ⏭️ skipped
onboard-resume-vitest ⏭️ skipped
openclaw-inference-switch-vitest ⏭️ skipped
openclaw-skill-cli-vitest ⏭️ skipped
openclaw-tui-chat-correlation-vitest ⏭️ skipped
openshell-version-pin-vitest ⏭️ skipped
rebuild-openclaw-vitest ⏭️ skipped
runtime-overrides-vitest ⏭️ skipped
sandbox-rebuild-vitest ⏭️ skipped
sandbox-survival-vitest ⏭️ skipped
sessions-agents-cli-vitest ⏭️ skipped
shields-config-vitest ⏭️ skipped
skill-agent-vitest ⏭️ skipped
state-backup-restore-vitest ⏭️ skipped
token-rotation-vitest ⏭️ skipped

cv added 2 commits June 16, 2026 14:05
…e-4462-scope-upgrade-approval

# Conflicts:
#	.github/workflows/e2e-vitest-scenarios.yaml
…e-4462-scope-upgrade-approval

# Conflicts:
#	.github/workflows/e2e-vitest-scenarios.yaml
@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All jobs passed

Run: 27649248534
Workflow ref: e2e-migrate/test-issue-4462-scope-upgrade-approval
Requested scenarios: (default — all supported)
Requested jobs: issue-4462-scope-upgrade-approval-vitest
Summary: 2 passed, 0 failed, 38 skipped

Job Result
bedrock-runtime-compatible-anthropic-vitest ⏭️ skipped
channels-add-remove-vitest ⏭️ skipped
cloud-inference-vitest ⏭️ skipped
cloud-onboard-vitest ⏭️ skipped
common-egress-agent-vitest ⏭️ skipped
credential-migration-vitest ⏭️ skipped
credential-sanitization-vitest ⏭️ skipped
double-onboard-vitest ⏭️ skipped
full-e2e-vitest ⏭️ skipped
gateway-drift-preflight-vitest ⏭️ skipped
gateway-guard-recovery ⏭️ skipped
gateway-health-honest-vitest ⏭️ skipped
generate-matrix ✅ success
hermes-e2e-vitest ⏭️ skipped
hermes-root-entrypoint-smoke-vitest ⏭️ skipped
inference-routing-vitest ⏭️ skipped
issue-2478-crash-loop-recovery-vitest ⏭️ skipped
issue-4434-tui-unreachable-inference-vitest ⏭️ skipped
issue-4462-scope-upgrade-approval-vitest ✅ success
launchable-smoke-vitest ⏭️ skipped
live-scenarios ⏭️ skipped
messaging-compatible-endpoint-vitest ⏭️ skipped
messaging-providers-vitest ⏭️ skipped
model-router-provider-routed-inference-vitest ⏭️ skipped
network-policy-vitest ⏭️ skipped
onboard-negative-paths-vitest ⏭️ skipped
onboard-resume-vitest ⏭️ skipped
openclaw-inference-switch-vitest ⏭️ skipped
openclaw-skill-cli-vitest ⏭️ skipped
openclaw-tui-chat-correlation-vitest ⏭️ skipped
openshell-version-pin-vitest ⏭️ skipped
rebuild-openclaw-vitest ⏭️ skipped
runtime-overrides-vitest ⏭️ skipped
sandbox-rebuild-vitest ⏭️ skipped
sandbox-survival-vitest ⏭️ skipped
sessions-agents-cli-vitest ⏭️ skipped
shields-config-vitest ⏭️ skipped
skill-agent-vitest ⏭️ skipped
state-backup-restore-vitest ⏭️ skipped
token-rotation-vitest ⏭️ skipped

…e-4462-scope-upgrade-approval

# Conflicts:
#	.github/workflows/e2e-vitest-scenarios.yaml
@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All jobs passed

Run: 27658237219
Workflow ref: e2e-migrate/test-issue-4462-scope-upgrade-approval
Requested scenarios: (default — all supported)
Requested jobs: issue-4462-scope-upgrade-approval-vitest
Summary: 2 passed, 0 failed, 39 skipped

Job Result
bedrock-runtime-compatible-anthropic-vitest ⏭️ skipped
channels-add-remove-vitest ⏭️ skipped
cloud-inference-vitest ⏭️ skipped
cloud-onboard-vitest ⏭️ skipped
common-egress-agent-vitest ⏭️ skipped
credential-migration-vitest ⏭️ skipped
credential-sanitization-vitest ⏭️ skipped
double-onboard-vitest ⏭️ skipped
full-e2e-vitest ⏭️ skipped
gateway-drift-preflight-vitest ⏭️ skipped
gateway-guard-recovery ⏭️ skipped
gateway-health-honest-vitest ⏭️ skipped
generate-matrix ✅ success
gpu-double-onboard-vitest ⏭️ skipped
hermes-e2e-vitest ⏭️ skipped
hermes-root-entrypoint-smoke-vitest ⏭️ skipped
inference-routing-vitest ⏭️ skipped
issue-2478-crash-loop-recovery-vitest ⏭️ skipped
issue-4434-tui-unreachable-inference-vitest ⏭️ skipped
issue-4462-scope-upgrade-approval-vitest ✅ success
launchable-smoke-vitest ⏭️ skipped
live-scenarios ⏭️ skipped
messaging-compatible-endpoint-vitest ⏭️ skipped
messaging-providers-vitest ⏭️ skipped
model-router-provider-routed-inference-vitest ⏭️ skipped
network-policy-vitest ⏭️ skipped
onboard-negative-paths-vitest ⏭️ skipped
onboard-resume-vitest ⏭️ skipped
openclaw-inference-switch-vitest ⏭️ skipped
openclaw-skill-cli-vitest ⏭️ skipped
openclaw-tui-chat-correlation-vitest ⏭️ skipped
openshell-version-pin-vitest ⏭️ skipped
rebuild-openclaw-vitest ⏭️ skipped
runtime-overrides-vitest ⏭️ skipped
sandbox-rebuild-vitest ⏭️ skipped
sandbox-survival-vitest ⏭️ skipped
sessions-agents-cli-vitest ⏭️ skipped
shields-config-vitest ⏭️ skipped
skill-agent-vitest ⏭️ skipped
state-backup-restore-vitest ⏭️ skipped
token-rotation-vitest ⏭️ skipped

…e-4462-scope-upgrade-approval

# Conflicts:
#	.github/workflows/e2e-vitest-scenarios.yaml
@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ✅ All jobs passed

Run: 27670190210
Workflow ref: e2e-migrate/test-issue-4462-scope-upgrade-approval
Requested scenarios: (default — all supported)
Requested jobs: issue-4462-scope-upgrade-approval-vitest
Summary: 2 passed, 0 failed, 40 skipped

Job Result
bedrock-runtime-compatible-anthropic-vitest ⏭️ skipped
channels-add-remove-vitest ⏭️ skipped
cloud-inference-vitest ⏭️ skipped
cloud-onboard-vitest ⏭️ skipped
common-egress-agent-vitest ⏭️ skipped
credential-migration-vitest ⏭️ skipped
credential-sanitization-vitest ⏭️ skipped
double-onboard-vitest ⏭️ skipped
full-e2e-vitest ⏭️ skipped
gateway-drift-preflight-vitest ⏭️ skipped
gateway-guard-recovery ⏭️ skipped
gateway-health-honest-vitest ⏭️ skipped
generate-matrix ✅ success
gpu-double-onboard-vitest ⏭️ skipped
hermes-e2e-vitest ⏭️ skipped
hermes-root-entrypoint-smoke-vitest ⏭️ skipped
inference-routing-vitest ⏭️ skipped
issue-2478-crash-loop-recovery-vitest ⏭️ skipped
issue-4434-tui-unreachable-inference-vitest ⏭️ skipped
issue-4462-scope-upgrade-approval-vitest ✅ success
launchable-smoke-vitest ⏭️ skipped
live-scenarios ⏭️ skipped
messaging-compatible-endpoint-vitest ⏭️ skipped
messaging-providers-vitest ⏭️ skipped
model-router-provider-routed-inference-vitest ⏭️ skipped
network-policy-vitest ⏭️ skipped
onboard-negative-paths-vitest ⏭️ skipped
onboard-repair-vitest ⏭️ skipped
onboard-resume-vitest ⏭️ skipped
openclaw-inference-switch-vitest ⏭️ skipped
openclaw-skill-cli-vitest ⏭️ skipped
openclaw-tui-chat-correlation-vitest ⏭️ skipped
openshell-version-pin-vitest ⏭️ skipped
rebuild-openclaw-vitest ⏭️ skipped
runtime-overrides-vitest ⏭️ skipped
sandbox-rebuild-vitest ⏭️ skipped
sandbox-survival-vitest ⏭️ skipped
sessions-agents-cli-vitest ⏭️ skipped
shields-config-vitest ⏭️ skipped
skill-agent-vitest ⏭️ skipped
state-backup-restore-vitest ⏭️ skipped
token-rotation-vitest ⏭️ skipped

@cv
cv merged commit 1baae3c into main Jun 17, 2026
78 checks passed
@cv
cv deleted the e2e-migrate/test-issue-4462-scope-upgrade-approval branch June 17, 2026 06:35
@cv cv added the v0.0.66 label Jun 17, 2026
@wscurran wscurran added area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance labels Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants