test(e2e): migrate test-tunnel-lifecycle.sh to vitest

.github/workflows/e2e-vitest-scenarios.yaml

@@ -4377,6 +4377,121 @@ jobs:
           docker logout docker.io || true
           rm -rf "${DOCKER_CONFIG}"
 
+  tunnel-lifecycle-vitest:
+    needs: generate-matrix
+    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',tunnel-lifecycle-vitest,') || contains(format(',{0},', inputs.scenarios), ',tunnel-lifecycle,') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 75
+    env:
+      FREE_STANDING_VITEST_JOB: "1"
+      FREE_STANDING_SCENARIO_ID: "tunnel-lifecycle"
+      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/tunnel-lifecycle
+      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
+      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
+      NEMOCLAW_NON_INTERACTIVE: "1"
+      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
+      NEMOCLAW_SANDBOX_NAME: "e2e-tunnel-lifecycle"
+      OPENSHELL_GATEWAY: "nemoclaw"
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Configure isolated Docker auth directory
+        run: echo "DOCKER_CONFIG=${RUNNER_TEMP}/docker-config-tunnel-lifecycle" >> "$GITHUB_ENV"
+
+      - name: Authenticate to Docker Hub
+        env:
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
+            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
+            exit 0
+          fi
+          mkdir -p "${DOCKER_CONFIG}"
+          chmod 700 "${DOCKER_CONFIG}"
+          login_succeeded=0
+          for attempt in 1 2 3; do
+            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
+              login_succeeded=1
+              break
+            fi
+            if [[ "$attempt" -lt 3 ]]; then
+              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
+              sleep 5
+            fi
+          done
+          if [[ "$login_succeeded" -ne 1 ]]; then
+            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
+          fi
+
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install root dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Build CLI
+        run: npm run build:cli
+
+      - name: Install and verify cloudflared prerequisite
+        run: |
+          set -euo pipefail
+          if command -v cloudflared >/dev/null 2>&1; then
+            cloudflared --version
+            exit 0
+          fi
+          source test/e2e/lib/cloudflared-version-resolver.sh
+          sudo mkdir -p --mode=0755 /usr/share/keyrings
+          curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null
+          echo "deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflared.list >/dev/null
+          sudo apt-get update -qq
+          available_versions="$(apt-cache madison cloudflared | awk '{print $3}')"
+          cf_min_version="${CLOUDFLARED_MIN_VERSION:-$CLOUDFLARED_DEFAULT_MIN_VERSION}"
+          if [ -n "${CLOUDFLARED_VERSION:-}" ]; then
+            cf_version="$(cloudflared_resolve_package_version "$available_versions" "$cf_min_version" "$CLOUDFLARED_VERSION")"
+          else
+            cf_version="$(cloudflared_resolve_package_version "$available_versions" "$cf_min_version")"
+          fi
+          sudo apt-get install -y "cloudflared=${cf_version}"
+          cloudflared --version
+
+      - name: Run tunnel lifecycle live test
+        # Migrated from test/e2e/test-tunnel-lifecycle.sh. This preserves the
+        # real Docker/OpenShell onboard, host cloudflared quick-tunnel,
+        # local-dashboard readiness, public tunnel probe, and stop/status
+        # cleanup boundaries under Vitest.
+        env:
+          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
+        run: |
+          set -euo pipefail
+          npx vitest run --project e2e-scenarios-live \
+            test/e2e-scenario/live/tunnel-lifecycle.test.ts \
+            --silent=false --reporter=default
+
+      - name: Upload tunnel lifecycle artifacts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: e2e-vitest-scenarios-tunnel-lifecycle
+          path: e2e-artifacts/vitest/tunnel-lifecycle/
+          include-hidden-files: false
+          if-no-files-found: ignore
+          retention-days: 14
+
+      - name: Clean up Docker auth
+        if: always()
+        run: |
+          set -euo pipefail
+          docker logout docker.io || true
+          rm -rf "${DOCKER_CONFIG}"
+
   # ── PR result comment (mirrors nightly-e2e.yaml's report-to-pr) ───────────
   # Posts a results table on the open PR for the dispatching branch (or the
   # PR identified by `inputs.pr_number`). `if: always()` so the comment lands
@@ -4444,6 +4559,7 @@ jobs:
         gateway-health-honest-vitest,
         device-auth-health-vitest,
         channels-add-remove-vitest,
+        tunnel-lifecycle-vitest,
         telegram-injection-vitest,
         channels-stop-start-vitest,
       ]

test/cli/sandbox-status-json.test.ts

@@ -7,9 +7,9 @@ import net from "node:net";
 import os from "node:os";
 import path from "node:path";
 
-import { runWithEnv, writeSandboxRegistry } from "./helpers";
+import { runWithEnv, testTimeoutOptions, writeSandboxRegistry } from "./helpers";
 
-describe("CLI sandbox status JSON output", () => {
+describe("CLI sandbox status JSON output", testTimeoutOptions(20_000), () => {
   it("sandbox status --json emits structured per-sandbox report", () => {
     const home = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-cli-sandbox-status-json-"));
     const localBin = path.join(home, "bin");

test/cloudflared-version-resolver.test.ts

@@ -23,6 +23,7 @@ if [[ "\${1:-}" != "--compare-versions" ]]; then
 fi
 rank() {
   case "\${1:-}" in
+    2020.1.1) printf '20200101' ;;
     2026.4.30) printf '20260430' ;;
     2026.5.1~rc1) printf '20260500' ;;
     2026.5.1) printf '20260501' ;;
@@ -89,13 +90,21 @@ describe("cloudflared APT package resolver", () => {
     expect(result.stderr).toContain("meets minimum 2026.5.1");
   });
 
-  it("preserves exact CLOUDFLARED_VERSION overrides for emergency repro", () => {
+  it("preserves syntactically valid exact CLOUDFLARED_VERSION overrides for emergency repro", () => {
     const result = runResolver("2026.5.1\n2026.5.10", "2026.5.1", "2020.1.1");
 
     expect(result.status).toBe(0);
     expect(result.stdout.trim()).toBe("2020.1.1");
   });
 
+  it("rejects invalid CLOUDFLARED_VERSION overrides before apt install", () => {
+    const result = runResolver("2026.5.1\n2026.5.10", "2026.5.1", "bad/min");
+
+    expect(result.status).not.toBe(0);
+    expect(result.stderr).toContain("invalid CLOUDFLARED_VERSION");
+    expect(result.stdout.trim()).toBe("");
+  });
+
   it("rejects invalid minimum versions before comparing package versions", () => {
     const result = runResolver("2026.5.1", "bad/min");