Skip to content

test(e2e): hotfix nightly stabilizers - #5802

Merged
jyaunches merged 17 commits into
mainfrom
hotfix/e2e-nightly-stabilizers
Jun 25, 2026
Merged

test(e2e): hotfix nightly stabilizers#5802
jyaunches merged 17 commits into
mainfrom
hotfix/e2e-nightly-stabilizers

Conversation

@jyaunches

@jyaunches jyaunches commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Summary

Ports the focused E2E stabilizers from dep/openshell-v0.0.67 / PR #5596 onto current main after PR #5760, without merging the full OpenShell 0.0.67 branch.

This targets the full-main nightly failures from run 28172043426:

  • kimi-inference-compat-e2e — relax live Kimi trajectory shape expectations.
  • common-egress-agent-e2e — tolerate wrapped reply tokens like REFER\nENCE_AGENT_OK.
  • sessions-agents-cli-e2e — keep sessions admin RPCs local/SDK-backed and avoid multiline RPC args.

Also includes the small channel/remove rebuild staging stabilizer carried by the shared matrix-stabilization commit.

Validation

  • Local push hooks could not fully run because this worktree is missing local npm dependencies (tsx, typescript, Biome dependency klaw).
  • Shellcheck/gitleaks/basic pre-commit checks passed before the dependency-gated hooks failed.
  • Focused nightly E2E dispatch is being run separately on this branch.

Notes

  • Does not port the full OpenShell 0.0.67 upgrade.
  • Does not claim to fix diagnostics-e2e HTTP 403; that failure looked infra/upstream/credential-like.

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

  • Bug Fixes
    • Improved sandbox gateway RPC execution with pairing-aware retry, clear retry/no-retry gating, and stricter handling of unsupported admin methods.
    • Added safer parsing and richer failure diagnostics with token redaction in returned output and logged errors.
  • New Features
    • Enhanced gateway RPC results to include separate diagnostic output and tightened admin method support via allowlisting.
  • Tests
    • Expanded Vitest coverage for gateway orchestration/output handling and stream capture behavior.
    • Strengthened OpenClaw text assertions, updated e2e token/PONG checks, and relaxed Kimi validations for mock vs live.
    • Prevented Telegram env reuse after channel removal.
  • Chores
    • Added optional stdout/stderr stream capture controls for OpenShell helpers.

@coderabbitai

coderabbitai Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

The PR updates sandbox gateway execution, stdout/stderr capture and redaction, shared E2E token matching, Telegram channel cleanup, and Kimi compatibility validation for mock versus live runs.

Changes

Sandbox and E2E validation updates

Layer / File(s) Summary
Stderr capture support
src/lib/adapters/openshell/runtime.ts, src/lib/adapters/openshell/client.ts, src/lib/security/redact.ts, src/lib/adapters/openshell/client.test.ts
captureOpenshell and its result types now carry stdout/stderr, and the full-secret redaction pattern matches more key/value forms.
Admin RPC execution path
src/lib/actions/sandbox/sessions/gateway-rpc.ts
callOpenclawGateway now allowlists admin methods, runs an embedded admin RPC script in the sandbox, base64-encodes params, retries pairing failures once, and returns redacted diagnostic output.
Gateway RPC tests
src/lib/actions/sandbox/sessions/gateway-rpc-call.test.ts
The test suite covers command construction, retry behavior, unsupported methods, failure classification, stdout/stderr parsing, and redaction handling.
Token matching helpers
test/e2e/lib/openclaw-json.sh
The Bash helpers add whitespace-normalized token checks for 42 and for arbitrary expected substrings.
Agent reply assertions
test/e2e/test-common-egress-agent-e2e.sh, test/e2e/test-openclaw-inference-switch.sh
The OpenClaw, Hermes, and inference-switch reply checks now use the shared token helper instead of fixed-string grep checks.
Telegram env reset
test/e2e/test-channels-add-remove.sh
After removing the Telegram channel, the test clears Telegram environment inputs before rebuilding.
Kimi compatibility rules
test/e2e/test-kimi-inference-compat.sh
The Kimi verifier now varies its trajectory and text checks by mock mode, records summary fields, and changes PASS messaging by mode.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested labels

area: e2e, bug-fix

Suggested reviewers

  • sandl99
  • prekshivyas

Poem

A bunny tapped the sandbox door,
With tokens gleaming evermore.
I hopped through stderr, soft and bright,
And found the replies matched just right.
🐇✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title is concise and accurately reflects the PR’s main goal: stabilizing E2E/nightly test failures.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch hotfix/e2e-nightly-stabilizers

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the hotfix/e2e-nightly-s... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main hotfix/e2e-nightly-s... 923a5b8 +/-
nemoclaw/src/se...cret-scanner.ts 100%
nemoclaw/src/commands/slash.ts 100%
nemoclaw/src/li...bprocess-env.ts 100%
nemoclaw/src/bl...eprint/state.ts 98%
nemoclaw/src/onboard/config.ts 98%
nemoclaw/src/bl...int/snapshot.ts 97%
nemoclaw/src/bl...print/runner.ts 95%
nemoclaw/src/co...ration-state.ts 94%
nemoclaw/src/bl...ate-networks.ts 94%
nemoclaw/src/index.ts 94%

TypeScript / code-coverage/cli

The overall coverage in the hotfix/e2e-nightly-s... branch is 47%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main hotfix/e2e-nightly-s... 923a5b8 +/-
src/lib/state/o...oard-session.ts 91%
src/lib/inference/local.ts 76%
src/lib/sandbox/config.ts 72%
src/lib/actions...dbox/rebuild.ts 71%
src/lib/onboard/preflight.ts 64%
src/lib/actions...licy-channel.ts 60%
src/lib/state/sandbox.ts 55%
src/lib/onboard...er-gpu-patch.ts 50%
src/lib/policy/index.ts 49%
src/lib/onboard.ts 19%

Updated June 25, 2026 17:28 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: sessions-agents-cli-e2e, issue-4462-scope-upgrade-approval-e2e, credential-sanitization-e2e
Optional E2E: openclaw-inference-switch-e2e, common-egress-agent-e2e, kimi-inference-compat-e2e, channels-add-remove-e2e, rebuild-openclaw-e2e

Dispatch hint: sessions-agents-cli-e2e,issue-4462-scope-upgrade-approval-e2e,credential-sanitization-e2e

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • sessions-agents-cli-e2e (high): Directly exercises the changed production path: sessions reset and sessions delete via the OpenClaw gateway in a real sandbox, including JSON envelope parsing and pairing/scope-upgrade retry behavior.
  • issue-4462-scope-upgrade-approval-e2e (high): Required for the touched pairing/scope-upgrade and proxy-env gateway boundary. It validates real CLI scope-upgrade approval, proxy-env sourcing, and that subsequent OpenClaw agent traffic stays on the gateway path.
  • credential-sanitization-e2e (high): The PR changes credential redaction/security handling and gateway-token diagnostics. This is the closest existing live credential-boundary E2E to ensure sandbox/runtime flows do not expose credentials, though it does not fully cover the new gateway-RPC stderr redaction path.

Optional E2E

  • openclaw-inference-switch-e2e (high): Useful because this PR changes the OpenClaw JSON/text helper and the inference-switch script assertion. It verifies a real OpenClaw agent turn still works through a switched inference route.
  • common-egress-agent-e2e (very high): Useful confidence for the modified helper/assertions that parse OpenClaw agent text and validate real agent turns under common-egress network policy.
  • kimi-inference-compat-e2e (high): Optional because the Kimi live trajectory acceptance was changed. Run if you want confidence that the updated test still passes against the public Kimi/OpenClaw tool-call path.
  • channels-add-remove-e2e (high): Optional because only the E2E script changed, but it is the direct coverage for the adjusted post-remove rebuild behavior and Telegram provider/policy cleanup assertions.
  • rebuild-openclaw-e2e (high): Adjacent confidence for OpenClaw gateway token/proxy-env runtime behavior across rebuilds, which is related to the new gateway-RPC proxy-env sourcing and token handling.

New E2E recommendations

  • OpenClaw sessions admin RPC security (high): Existing live E2Es cover happy-path sessions reset/delete and scope-upgrade approval, but not the new negative security contract for the backend gateway RPC wrapper: refusing symlink or wrong-permission /tmp/nemoclaw-proxy-env.sh, preserving separate stdout/stderr, and redacting OPENCLAW_GATEWAY_TOKEN from failure diagnostics.
    • Suggested test: Add a sessions-admin-rpc-security E2E that creates a disposable OpenClaw sandbox, temporarily replaces /tmp/nemoclaw-proxy-env.sh with an unsafe symlink or wrong-mode file, verifies nemoclaw <sandbox> sessions reset --json fails closed without token leakage, restores the file, and verifies reset/delete still succeed.

Dispatch hint

  • Workflow: .github/workflows/nightly-e2e.yaml
  • jobs input: sessions-agents-cli-e2e,issue-4462-scope-upgrade-approval-e2e,credential-sanitization-e2e

@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: sessions-agents-cli-vitest
Optional Vitest E2E scenarios: ubuntu-repo-cloud-openclaw

Dispatch required Vitest E2E scenarios:

  • gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=sessions-agents-cli-vitest

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required Vitest E2E scenarios

  • sessions-agents-cli-vitest: The PR changes the sessions gateway RPC path, OpenShell capture stream handling, and gateway diagnostic redaction. The sessions/agents CLI Vitest job is the focused live coverage for host-side sessions reset/delete dispatch through the OpenClaw gateway, pairing/scope approval handling, JSON envelope parsing, and separated stdout/stderr behavior.
    • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field jobs=sessions-agents-cli-vitest

Optional Vitest E2E scenarios

  • ubuntu-repo-cloud-openclaw: Adjacent registry scenario for the standard Ubuntu Docker OpenClaw onboarding path. Useful if reviewers want broader confidence that the OpenShell client/runtime helper changes did not regress baseline onboarding, smoke, inference, or credential checks.
    • Dispatch: gh workflow run e2e-vitest-scenarios.yaml --ref <pr-head-ref> --field scenarios=ubuntu-repo-cloud-openclaw

Relevant changed files

  • src/lib/actions/sandbox/sessions/gateway-rpc.ts
  • src/lib/adapters/openshell/client.ts
  • src/lib/adapters/openshell/runtime.ts
  • src/lib/security/redact.ts

@github-actions

github-actions Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 3 test follow-ups
Since last review: 3 prior items resolved · 0 still apply · 0 new items found

Action checklist

  • PRA-T1 Add or justify test follow-up: Runtime validation
  • PRA-T2 Add or justify test follow-up: Runtime validation
  • PRA-T3 Add or justify test follow-up: Runtime validation
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

  • PRA-T1 Runtime validation — Real sandbox `nemoclaw <sandbox> sessions reset` and `nemoclaw <sandbox> sessions delete` complete through the SDK backend path without creating a fresh CLI device-pairing request.. Unit coverage is strong for the generated sessions RPC wrapper and OpenShell stream helpers, but the primary changed behavior crosses real OpenShell sandbox exec argument handling, shell/base64 decoding, proxy-env sourcing, Node data-URL loading, OpenClaw SDK package resolution, loopback gateway-token use, backend authorization, and stdout/stderr diagnostics.
  • PRA-T2 Runtime validation — Real sandbox sessions admin RPC parses stdout separately from stderr and redacts gateway-token diagnostics if stderr contains `OPENCLAW_GATEWAY_TOKEN=<value>` or a JSON `token` field.. Unit coverage is strong for the generated sessions RPC wrapper and OpenShell stream helpers, but the primary changed behavior crosses real OpenShell sandbox exec argument handling, shell/base64 decoding, proxy-env sourcing, Node data-URL loading, OpenClaw SDK package resolution, loopback gateway-token use, backend authorization, and stdout/stderr diagnostics.
  • PRA-T3 Runtime validation — Real sandbox/proxy-env port validation rejects `0`, `65536`, `01`, whitespace-padded values, and authority suffixes such as `18789@attacker.example` before SDK import or gateway-token use.. Unit coverage is strong for the generated sessions RPC wrapper and OpenShell stream helpers, but the primary changed behavior crosses real OpenShell sandbox exec argument handling, shell/base64 decoding, proxy-env sourcing, Node data-URL loading, OpenClaw SDK package resolution, loopback gateway-token use, backend authorization, and stdout/stderr diagnostics.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/actions/sandbox/sessions/gateway-rpc.ts`:
- Around line 24-25: The retry matcher in gateway-rpc.ts is too broad because
RETRYABLE_PAIRING_FAILURE currently matches every GatewayClientRequestError, not
just pairing-pending cases. Narrow the regex to only the actual pairing-specific
messages handled by the auto-pair flow, and remove the generic
GatewayClientRequestError fallback. Update the retry check used by the gateway
RPC/session logic so only pairing-related failures trigger the second pass, and
keep the behavior aligned with the surrounding pairing retry handling in the
same module.

In `@test/e2e/test-kimi-inference-compat.sh`:
- Around line 707-708: The verifier logic in the toolMeta checks can crash when
`meta` contains `None` or other non-string values because `sorted(...)` is
called directly on `meta_commands`. Update the checks around `toolMetas[*].meta`
to validate/filter values before sorting (or sort with a safe key) so the code
reports a structured error instead of raising `TypeError`. Apply the same fix in
both places that compare the command set, using the existing `meta_commands`
validation path.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c0e166ec-d0a9-41b4-be88-23c09f9f473d

📥 Commits

Reviewing files that changed from the base of the PR and between 3cedcbf and 0e0a854.

📒 Files selected for processing (7)
  • src/lib/actions/sandbox/sessions/gateway-rpc-call.test.ts
  • src/lib/actions/sandbox/sessions/gateway-rpc.ts
  • src/lib/adapters/openshell/runtime.ts
  • test/e2e/lib/openclaw-json.sh
  • test/e2e/test-channels-add-remove.sh
  • test/e2e/test-common-egress-agent-e2e.sh
  • test/e2e/test-kimi-inference-compat.sh

Comment thread src/lib/actions/sandbox/sessions/gateway-rpc.ts Outdated
Comment thread test/e2e/test-kimi-inference-compat.sh Outdated
@github-actions

Copy link
Copy Markdown
Contributor

Selective E2E Results — ❌ Some jobs failed

Run: 28180735807
Target ref: hotfix/e2e-nightly-stabilizers
Requested jobs: openclaw-tui-chat-correlation-e2e,kimi-inference-compat-e2e,sessions-agents-cli-e2e,openclaw-inference-switch-e2e,common-egress-agent-e2e,diagnostics-e2e
Summary: 5 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
common-egress-agent-e2e ✅ success
diagnostics-e2e ✅ success
kimi-inference-compat-e2e ✅ success
openclaw-inference-switch-e2e ❌ failure
openclaw-tui-chat-correlation-e2e ✅ success
sessions-agents-cli-e2e ✅ success

Failed jobs: openclaw-inference-switch-e2e. Check run artifacts for logs.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/test-openclaw-inference-switch.sh`:
- Line 331: The assertion in the shell test lost the previous case-insensitive
behavior because `openclaw_agent_text_has_token` only does a case-sensitive
match. Update the check in the `if [ "$rc" -eq 0 ] && ...` block to preserve
case tolerance for the `PONG` token, either by normalizing `reply` before
calling `openclaw_agent_text_has_token` or by otherwise making the comparison
case-insensitive in this test path.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c2afc2b6-7180-4745-b18b-96eb7dca6af2

📥 Commits

Reviewing files that changed from the base of the PR and between 0e0a854 and f091837.

📒 Files selected for processing (1)
  • test/e2e/test-openclaw-inference-switch.sh

Comment thread test/e2e/test-openclaw-inference-switch.sh Outdated
@github-actions

Copy link
Copy Markdown
Contributor

Selective E2E Results — ✅ All requested jobs passed

Run: 28181664999
Target ref: hotfix/e2e-nightly-stabilizers
Requested jobs: openclaw-inference-switch-e2e
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
openclaw-inference-switch-e2e ✅ success

@github-actions

Copy link
Copy Markdown
Contributor

Vitest E2E Scenario Results — ❌ Some jobs failed

Run: 28188745957
Workflow ref: hotfix/e2e-nightly-stabilizers
Requested scenarios: (default — all supported)
Requested jobs: sessions-agents-cli-vitest
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
sessions-agents-cli-vitest ❌ failure

Failed jobs: sessions-agents-cli-vitest. Check run artifacts for logs.

@jyaunches
jyaunches merged commit e521f6a into main Jun 25, 2026
174 of 178 checks passed
@jyaunches
jyaunches deleted the hotfix/e2e-nightly-stabilizers branch June 25, 2026 17:39
@github-actions

Copy link
Copy Markdown
Contributor

Selective E2E Results — ⚠️ Run cancelled — no signal

Run: 28188743907
Target ref: hotfix/e2e-nightly-stabilizers
Requested jobs: sessions-agents-cli-e2e,issue-4462-scope-upgrade-approval-e2e,credential-sanitization-e2e
Summary: 0 passed, 0 failed, 3 cancelled, 0 skipped

Job Result
credential-sanitization-e2e ⚠️ cancelled
issue-4462-scope-upgrade-approval-e2e ⚠️ cancelled
sessions-agents-cli-e2e ⚠️ cancelled

@cv cv added the v0.0.68 label Jun 25, 2026
cv pushed a commit that referenced this pull request Jun 26, 2026
## Summary
Restore issue #5849 parity package `Package B` for PR #5802 hotfix
stabilizer bash-suite deltas.

## Related Issues
Refs #5849
Refs #5802

## Scope gate
- Package: `Package B` / `test(e2e): audit hotfix stabilizer parity`
- Included PRs all merged and touched `test/e2e`: yes — #5802 is merged
and touched `test/e2e/lib/openclaw-json.sh`,
`test/e2e/test-channels-add-remove.sh`,
`test/e2e/test-common-egress-agent-e2e.sh`,
`test/e2e/test-kimi-inference-compat.sh`, and
`test/e2e/test-openclaw-inference-switch.sh`
- Out of scope: unmerged/non-bash PRs; shell lane retirement / PR #5756
cleanup; Package C Hermes v2026.6.19 audit rows

## Parity map
| ID | Source PR | Contract | Inference classification | Vitest
assertion / waiver | Status |
| --- | --- | --- | --- | --- | --- |
| B1 | #5802 | Kimi mock trajectories stay strict for split
`hostname`/`date`/`uptime`, while public NVIDIA mode may choose fewer
safe exec calls but must not record a combined shell command |
`public-nvidia required` with `mock` fallback |
`test/e2e-scenario/live/kimi-inference-compat-helpers.ts`;
`test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts`
| covered |
| B2 | #5802 | OpenClaw inference-switch agent reply accepts
deterministic `PONG` even when wrapped by model/stream whitespace |
`hosted-compatible capable` |
`test/e2e-scenario/live/openclaw-inference-switch.test.ts` | covered |
| B3 | #5802 | Channels add/remove post-remove rebuild must not use
stale host Telegram env inputs to stage a fresh channel add |
`hosted-compatible capable` |
`test/e2e-scenario/live/channels-add-remove.test.ts` now rebuilds after
remove with base env only | covered |
| B4 | #5802 | Common-egress OpenClaw/Hermes reference-agent token
checks tolerate wrapped `REFERENCE_AGENT_OK` /
`HERMES_REFERENCE_AGENT_OK` tokens | `hosted-compatible capable` |
Existing `test/e2e-scenario/live/common-egress-agent.test.ts`
parser/token tests | already covered |
| B5 | #5802 | Sessions admin RPC uses local/backend OpenClaw gateway
path, avoids multiline OpenShell args, preserves stdout/stderr
diagnostics, redacts token-shaped failures | `none` | Existing
`src/lib/actions/sandbox/sessions/gateway-rpc-call.test.ts`,
`src/lib/adapters/openshell/client.test.ts`, and
`src/lib/security/redact` coverage | already covered |
| B6 | #5802 | `openclaw-json` helper accepts wrapped deterministic
reply tokens | `none` | Existing `test/openclaw-agent-json.test.ts` and
`test/helpers/e2e-answer-assertions.test.ts`; live migrated tests use
equivalent token compaction | already covered |

## Inference mode support
- Default mode for touched live targets: `mock/hermetic` for Kimi
fallback; hosted-compatible/public routes remain opt-in/live-runner
validated
- Real inference support preserved: yes — Kimi public NVIDIA mode
remains explicit; OpenClaw inference switch/common-egress/channels live
scenarios still use hosted-compatible/public credentials as before
- Modes validated in this PR: focused local support/unit coverage and
non-destructive live-project filtered assertions; full live E2E requires
selective workflow/runner secrets
- If not validated with real inference: full live scenarios
install/onboard real sandboxes and require CI runner secrets; this PR
preserves those paths but does not execute them locally

## Validation
- [x] `git diff --check`
- [x] `npm run typecheck:cli`
- [x] `npx vitest run --project e2e-vitest-support
test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts`
- [x] `npx vitest run
src/lib/actions/sandbox/sessions/gateway-rpc-call.test.ts
src/lib/adapters/openshell/client.test.ts
test/openclaw-agent-json.test.ts
test/helpers/e2e-answer-assertions.test.ts`
- [x] `NEMOCLAW_RUN_E2E_SCENARIOS=1 npx vitest run --project
e2e-scenarios-live test/e2e-scenario/live/common-egress-agent.test.ts
test/e2e-scenario/live/openclaw-inference-switch.test.ts
--testNamePattern 'common-egress agent|reply matching'`
- [ ] selective live E2E workflow for Package B targets, if
requested/available

Notes:
- `git commit` hooks ran repository-wide CLI tests and failed on
unrelated local setup/timeouts (`nemoclaw/dist` missing,
`nemoclaw/node_modules/json5` missing, several 5s local timeouts).
Commit/push used `--no-verify` after targeted Package B validations
passed.
- First normal push pre-push hook was killed by signal 9; branch was
pushed with `--no-verify`.

## Follow-ups / waivers
- None for Package B rows.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved post-channel removal rebuild behavior to prevent reuse of
Telegram-related environment inputs.
* Enhanced OpenClaw “PONG” verification to reliably detect
whitespace-split tokens while rejecting partial or surrounding-text
variants.
* Strengthened Kimi inference/trajectory validation with stricter
handling of tool/meta and source-command sequencing, including detection
of unsafe leftovers.
* **Tests**
* Updated Kimi live end-to-end checks to validate results using the
selected inference mode.
* Expanded compatibility-mode tests with structured trajectory summary
assertions and new negative cases for malformed or unsafe source
commands.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
## Summary
Ports the focused E2E stabilizers from `dep/openshell-v0.0.67` / PR
NVIDIA#5596 onto current `main` after PR NVIDIA#5760, without merging the full
OpenShell 0.0.67 branch.

This targets the full-main nightly failures from run 28172043426:
- `kimi-inference-compat-e2e` — relax live Kimi trajectory shape
expectations.
- `common-egress-agent-e2e` — tolerate wrapped reply tokens like
`REFER\nENCE_AGENT_OK`.
- `sessions-agents-cli-e2e` — keep sessions admin RPCs local/SDK-backed
and avoid multiline RPC args.

Also includes the small channel/remove rebuild staging stabilizer
carried by the shared matrix-stabilization commit.

## Validation
- Local push hooks could not fully run because this worktree is missing
local npm dependencies (`tsx`, `typescript`, Biome dependency `klaw`).
- Shellcheck/gitleaks/basic pre-commit checks passed before the
dependency-gated hooks failed.
- Focused nightly E2E dispatch is being run separately on this branch.

## Notes
- Does not port the full OpenShell 0.0.67 upgrade.
- Does not claim to fix `diagnostics-e2e` HTTP 403; that failure looked
infra/upstream/credential-like.

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved sandbox gateway RPC execution with pairing-aware retry, clear
retry/no-retry gating, and stricter handling of unsupported admin
methods.
* Added safer parsing and richer failure diagnostics with token
redaction in returned output and logged errors.
* **New Features**
* Enhanced gateway RPC results to include separate diagnostic output and
tightened admin method support via allowlisting.
* **Tests**
* Expanded Vitest coverage for gateway orchestration/output handling and
stream capture behavior.
* Strengthened OpenClaw text assertions, updated e2e token/PONG checks,
and relaxed Kimi validations for mock vs live.
  * Prevented Telegram env reuse after channel removal.
* **Chores**
* Added optional stdout/stderr stream capture controls for OpenShell
helpers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Aaron Erickson <aerickson@nvidia.com>
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
## Summary
Restore issue NVIDIA#5849 parity package `Package B` for PR NVIDIA#5802 hotfix
stabilizer bash-suite deltas.

## Related Issues
Refs NVIDIA#5849
Refs NVIDIA#5802

## Scope gate
- Package: `Package B` / `test(e2e): audit hotfix stabilizer parity`
- Included PRs all merged and touched `test/e2e`: yes — NVIDIA#5802 is merged
and touched `test/e2e/lib/openclaw-json.sh`,
`test/e2e/test-channels-add-remove.sh`,
`test/e2e/test-common-egress-agent-e2e.sh`,
`test/e2e/test-kimi-inference-compat.sh`, and
`test/e2e/test-openclaw-inference-switch.sh`
- Out of scope: unmerged/non-bash PRs; shell lane retirement / PR NVIDIA#5756
cleanup; Package C Hermes v2026.6.19 audit rows

## Parity map
| ID | Source PR | Contract | Inference classification | Vitest
assertion / waiver | Status |
| --- | --- | --- | --- | --- | --- |
| B1 | NVIDIA#5802 | Kimi mock trajectories stay strict for split
`hostname`/`date`/`uptime`, while public NVIDIA mode may choose fewer
safe exec calls but must not record a combined shell command |
`public-nvidia required` with `mock` fallback |
`test/e2e-scenario/live/kimi-inference-compat-helpers.ts`;
`test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts`
| covered |
| B2 | NVIDIA#5802 | OpenClaw inference-switch agent reply accepts
deterministic `PONG` even when wrapped by model/stream whitespace |
`hosted-compatible capable` |
`test/e2e-scenario/live/openclaw-inference-switch.test.ts` | covered |
| B3 | NVIDIA#5802 | Channels add/remove post-remove rebuild must not use
stale host Telegram env inputs to stage a fresh channel add |
`hosted-compatible capable` |
`test/e2e-scenario/live/channels-add-remove.test.ts` now rebuilds after
remove with base env only | covered |
| B4 | NVIDIA#5802 | Common-egress OpenClaw/Hermes reference-agent token
checks tolerate wrapped `REFERENCE_AGENT_OK` /
`HERMES_REFERENCE_AGENT_OK` tokens | `hosted-compatible capable` |
Existing `test/e2e-scenario/live/common-egress-agent.test.ts`
parser/token tests | already covered |
| B5 | NVIDIA#5802 | Sessions admin RPC uses local/backend OpenClaw gateway
path, avoids multiline OpenShell args, preserves stdout/stderr
diagnostics, redacts token-shaped failures | `none` | Existing
`src/lib/actions/sandbox/sessions/gateway-rpc-call.test.ts`,
`src/lib/adapters/openshell/client.test.ts`, and
`src/lib/security/redact` coverage | already covered |
| B6 | NVIDIA#5802 | `openclaw-json` helper accepts wrapped deterministic
reply tokens | `none` | Existing `test/openclaw-agent-json.test.ts` and
`test/helpers/e2e-answer-assertions.test.ts`; live migrated tests use
equivalent token compaction | already covered |

## Inference mode support
- Default mode for touched live targets: `mock/hermetic` for Kimi
fallback; hosted-compatible/public routes remain opt-in/live-runner
validated
- Real inference support preserved: yes — Kimi public NVIDIA mode
remains explicit; OpenClaw inference switch/common-egress/channels live
scenarios still use hosted-compatible/public credentials as before
- Modes validated in this PR: focused local support/unit coverage and
non-destructive live-project filtered assertions; full live E2E requires
selective workflow/runner secrets
- If not validated with real inference: full live scenarios
install/onboard real sandboxes and require CI runner secrets; this PR
preserves those paths but does not execute them locally

## Validation
- [x] `git diff --check`
- [x] `npm run typecheck:cli`
- [x] `npx vitest run --project e2e-vitest-support
test/e2e-scenario/support-tests/kimi-inference-compat-helpers.test.ts`
- [x] `npx vitest run
src/lib/actions/sandbox/sessions/gateway-rpc-call.test.ts
src/lib/adapters/openshell/client.test.ts
test/openclaw-agent-json.test.ts
test/helpers/e2e-answer-assertions.test.ts`
- [x] `NEMOCLAW_RUN_E2E_SCENARIOS=1 npx vitest run --project
e2e-scenarios-live test/e2e-scenario/live/common-egress-agent.test.ts
test/e2e-scenario/live/openclaw-inference-switch.test.ts
--testNamePattern 'common-egress agent|reply matching'`
- [ ] selective live E2E workflow for Package B targets, if
requested/available

Notes:
- `git commit` hooks ran repository-wide CLI tests and failed on
unrelated local setup/timeouts (`nemoclaw/dist` missing,
`nemoclaw/node_modules/json5` missing, several 5s local timeouts).
Commit/push used `--no-verify` after targeted Package B validations
passed.
- First normal push pre-push hook was killed by signal 9; branch was
pushed with `--no-verify`.

## Follow-ups / waivers
- None for Package B rows.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved post-channel removal rebuild behavior to prevent reuse of
Telegram-related environment inputs.
* Enhanced OpenClaw “PONG” verification to reliably detect
whitespace-split tokens while rejecting partial or surrounding-text
variants.
* Strengthened Kimi inference/trajectory validation with stricter
handling of tool/meta and source-command sequencing, including detection
of unsafe leftovers.
* **Tests**
* Updated Kimi live end-to-end checks to validate results using the
selected inference mode.
* Expanded compatibility-mode tests with structured trajectory summary
assertions and new negative cases for malformed or unsafe source
commands.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@wscurran wscurran added area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance labels Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: e2e End-to-end tests, nightly failures, or validation infrastructure chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants