fix(e2e): stabilize residual release gates - #5911
Merged
Merged
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe TUI startup harness now writes lifecycle markers to a separate marker capture file, the issue-4434 live scenario skips when hosted inference is gateway-managed, and the double-onboard rebuild step now uses the provided fake base URL. ChangesTUI marker capture separation
Hosted inference skip gate
Double-onboard rebuild environment
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
PR Review Advisor (Nemotron Ultra) — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
Contributor
E2E Advisor RecommendationRequired E2E: None Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 3 items to resolve/justify, 0 in-scope improvements
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
test/langchain-deepagents-code-image.test.ts (1)
474-485: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftAvoid source-text assertions for the marker-sidecar contract.
These checks lock the test to the shell script’s exact implementation and still do not prove the sidecar path works when executed. Prefer driving the harness through its boundary and asserting emitted artifacts / sanitized output instead. As per path instructions, "Prefer observable outcomes through the public boundary over source-text, private-shape, or mock-call assertions."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/langchain-deepagents-code-image.test.ts` around lines 474 - 485, The marker-sidecar test is asserting shell script source text instead of verifying the contract through execution. Update the test in langchain-deepagents-code-image.test.ts to drive the TUI harness via its public boundary and assert the resulting artifacts/sanitized output from the marker sidecar flow, rather than checking for exact strings like tuiStartupCheck or append_marker in the script contents. Keep the focus on observable outcomes from the executed harness, using the existing marker capture behavior and emitted files as the validation point.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/e2e-script-workflow.test.ts`:
- Around line 1290-1304: The current test in e2e-script-workflow.test.ts is
locked to source text by comparing indexOf positions in
issue-4434-tui-unreachable-inference.test.ts, so replace it with a behavioral
assertion through the public boundary. Update the test to execute the scenario
with NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1 and verify the hosted skip outcome
while asserting the firewall mutation path is not reached, using the scenario
runner and the observable effects around requireHostedInferenceConfig and the
iptables mutation instead of inspecting file contents.
---
Nitpick comments:
In `@test/langchain-deepagents-code-image.test.ts`:
- Around line 474-485: The marker-sidecar test is asserting shell script source
text instead of verifying the contract through execution. Update the test in
langchain-deepagents-code-image.test.ts to drive the TUI harness via its public
boundary and assert the resulting artifacts/sanitized output from the marker
sidecar flow, rather than checking for exact strings like tuiStartupCheck or
append_marker in the script contents. Keep the focus on observable outcomes from
the executed harness, using the existing marker capture behavior and emitted
files as the validation point.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b28e3eae-1e5c-4309-bb7e-498e8d4f38b2
📒 Files selected for processing (5)
test/deepagents-code-tui-startup-check.test.tstest/e2e-scenario/live/issue-4434-tui-unreachable-inference.test.tstest/e2e-script-workflow.test.tstest/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.shtest/langchain-deepagents-code-image.test.ts
Comment on lines
+1290
to
+1304
| it("skips the issue #4434 sandbox-egress repro for gateway-managed hosted inference", () => { | ||
| const liveTest = readFileSync( | ||
| "test/e2e-scenario/live/issue-4434-tui-unreachable-inference.test.ts", | ||
| "utf8", | ||
| ); | ||
| const hostedSkip = liveTest.indexOf('process.env.NEMOCLAW_E2E_USE_HOSTED_INFERENCE === "1"'); | ||
| const hostedConfig = liveTest.indexOf("requireHostedInferenceConfig(secrets)"); | ||
| const firewallMutation = liveTest.indexOf('["iptables", "-I", "DOCKER-USER"'); | ||
|
|
||
| expect(hostedSkip).toBeGreaterThanOrEqual(0); | ||
| expect(liveTest).toContain( | ||
| "hosted compatible inference is gateway-managed; this repro only blocks sandbox egress", | ||
| ); | ||
| expect(hostedSkip).toBeLessThan(hostedConfig); | ||
| expect(hostedSkip).toBeLessThan(firewallMutation); |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
This assertion is implementation-locked instead of behavioral.
Reading the scenario source and comparing indexOf(...) values only proves the current text layout, not that hosted mode actually exits before requireHostedInferenceConfig(secrets) or the iptables mutation runs. Please drive this through the public boundary instead—for example, execute the scenario with NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1 and assert the skip outcome while proving the mutation path is not reached. As per path instructions, "Prefer observable outcomes through the public boundary over source-text" and "Migration tests must prove the superseded path is unreachable or removed."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/e2e-script-workflow.test.ts` around lines 1290 - 1304, The current test
in e2e-script-workflow.test.ts is locked to source text by comparing indexOf
positions in issue-4434-tui-unreachable-inference.test.ts, so replace it with a
behavioral assertion through the public boundary. Update the test to execute the
scenario with NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1 and verify the hosted skip
outcome while asserting the firewall mutation path is not reached, using the
scenario runner and the observable effects around requireHostedInferenceConfig
and the iptables mutation instead of inspecting file contents.
Source: Path instructions
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/e2e-scenario/support-tests/ci-compatible-inference.test.ts`:
- Around line 31-37: The environment cleanup in the CI-compatible inference test
is using a conditional delete pattern that trips test-conditionals:scan. Update
the setup around the env merge in ci-compatible-inference.test.ts to build env
from a sanitized process.env snapshot up front, then merge hostedEnv without any
post-merge if/delete logic; use the existing hostedEnv and env initialization
block as the place to refactor this.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: d820f870-b652-4889-845d-f8f3f12d1c12
📒 Files selected for processing (4)
test/e2e-scenario/fixtures/ci-compatible-inference.tstest/e2e-scenario/live/issue-4434-tui-unreachable-inference.test.tstest/e2e-scenario/support-tests/ci-compatible-inference.test.tstest/e2e-script-workflow.test.ts
💤 Files with no reviewable changes (1)
- test/e2e-script-workflow.test.ts
Collaborator
Author
|
Automated review follow-up for current head
No automated reviewer reports a required/security/correctness finding on the current head. |
cv
enabled auto-merge (squash)
June 27, 2026 21:44
cv
disabled auto-merge
June 27, 2026 21:44
21 tasks
21 tasks
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Stabilizes the final residual release-gate harnesses uncovered by fresh `main` validation. Deep Agents TUI evidence now uses a sidecar so Expect's buffered `log_file` cannot overwrite lifecycle markers, the issue NVIDIA#4434 sandbox-egress repro skips gateway-managed hosted inference just as its legacy shell lane already does, and double-onboard stale recovery receives its exact target-scoped custom endpoint. ## Changes - Write Deep Agents prompt and lifecycle evidence to a separate marker sidecar, fold it into the sanitized capture, and remove the sensitive intermediate during cleanup. - Preserve the actual prompt match alongside readiness and exit markers so strict prompt/exit assertions remain intact. - Skip the issue NVIDIA#4434 sandbox-egress firewall repro before onboarding or mutation when either the explicit sentinel or hosted-compatible key selects gateway-managed inference. - Align double-onboard stale rebuild recovery with the legacy shell gate by passing the target's fake endpoint instead of intentionally mismatched ambient values. - Extend helper, image-contract, workflow, and runtime support tests for the new boundaries. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: release-gate harness behavior only; no user-facing behavior changed. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review of E2E-only capture cleanup and firewall preconditions; the sidecar is sanitized then deleted, and the hosted-mode guard executes before onboarding or firewall mutation. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Targeted verification: ```bash npm test -- --run test/deepagents-code-tui-startup-check.test.ts test/langchain-deepagents-code-image.test.ts test/e2e-script-workflow.test.ts test/e2e-scenario/support-tests/ci-compatible-inference.test.ts NEMOCLAW_RUN_E2E_SCENARIOS=1 NEMOCLAW_ISSUE_4434_LIVE=1 NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1 npx vitest run --project e2e-scenarios-live test/e2e-scenario/live/issue-4434-tui-unreachable-inference.test.ts --silent=false --reporter=default bash -n test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh npx prek run shfmt --files test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh npx prek run shellcheck --files test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh npm run typecheck:cli ``` --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved TUI startup lifecycle verification by isolating and preserving readiness/exit marker streams through sanitization, and ensuring temporary marker artifacts are fully cleaned up. * Updated the live issue-4434 scenario to skip when gateway-managed hosted inference is detected. * **Tests** * Expanded Deep Agents Code TUI startup e2e coverage to validate marker appending/concatenation and final capture content. * Added CI-compatible inference detection fixture coverage (including live gating assertions). * Enhanced double-onboard rebuild coverage to use the provided fake base URL and avoid the prior hardcoded invalid endpoint/model. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
wscurran
added
area: ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stabilizes the final residual release-gate harnesses uncovered by fresh
mainvalidation. Deep Agents TUI evidence now uses a sidecar so Expect's bufferedlog_filecannot overwrite lifecycle markers, the issue #4434 sandbox-egress repro skips gateway-managed hosted inference just as its legacy shell lane already does, and double-onboard stale recovery receives its exact target-scoped custom endpoint.Changes
Type of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Targeted verification:
npm test -- --run test/deepagents-code-tui-startup-check.test.ts test/langchain-deepagents-code-image.test.ts test/e2e-script-workflow.test.ts test/e2e-scenario/support-tests/ci-compatible-inference.test.ts NEMOCLAW_RUN_E2E_SCENARIOS=1 NEMOCLAW_ISSUE_4434_LIVE=1 NEMOCLAW_E2E_USE_HOSTED_INFERENCE=1 npx vitest run --project e2e-scenarios-live test/e2e-scenario/live/issue-4434-tui-unreachable-inference.test.ts --silent=false --reporter=default bash -n test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh npx prek run shfmt --files test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh npx prek run shellcheck --files test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh npm run typecheck:cliSigned-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit
Bug Fixes
Tests