test(e2e): wire sandbox operations into Vitest - #5926
Merged
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
57 tasks
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a new ChangesSandbox-operations Vitest job and test updates
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
Contributor
Vitest E2E Scenario Results — ❌ Some jobs failedRun: 28313799712
|
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 1 item to resolve/justify, 0 in-scope improvements
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
PR Review Advisor (Nemotron Ultra) — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 6 items to resolve/justify, 4 in-scope improvements
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
test/e2e-scenario/support-tests/sandbox-operations-workflow-boundary.test.ts (1)
33-35: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winAssert the full default-dispatch result for
{}.The empty-selector branch only checks that
sandbox-operations-vitestis present, so this test still passes if the default path starts returningvalid: falseor flipsliveScenariosRuns. Match the same observable metadata here as you do for the selective-dispatch cases. As per path instructions, "Review tests for behavioral confidence rather than implementation lock-in."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-scenario/support-tests/sandbox-operations-workflow-boundary.test.ts` around lines 33 - 35, The empty-selector assertion in the e2e workflow dispatch test only checks selectedFreeStandingJobs, so it can miss regressions in the default path metadata. Update the {} case in sandbox-operations-workflow-boundary.test to assert the full result from evaluateE2eVitestWorkflowDispatchSelectors, matching the same observable fields used in the selective-dispatch tests such as valid and liveScenariosRuns, while still verifying sandbox-operations-vitest is included.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tools/e2e-scenarios/sandbox-operations-workflow-boundary.mts`:
- Around line 146-149: validateSandboxOperationsWorkflowBoundary() only runs the
job-local validator today, so the public boundary helper misses the shared
selector/gate and inventory coverage checks. Update this function to also invoke
the shared e2e-vitest-scenarios boundary validation after
readSandboxOperationsWorkflow(workflowPath), using the existing
validateSandboxOperationsWorkflow and the shared boundary helper so callers get
the full contract centrally from this entrypoint.
---
Outside diff comments:
In
`@test/e2e-scenario/support-tests/sandbox-operations-workflow-boundary.test.ts`:
- Around line 33-35: The empty-selector assertion in the e2e workflow dispatch
test only checks selectedFreeStandingJobs, so it can miss regressions in the
default path metadata. Update the {} case in
sandbox-operations-workflow-boundary.test to assert the full result from
evaluateE2eVitestWorkflowDispatchSelectors, matching the same observable fields
used in the selective-dispatch tests such as valid and liveScenariosRuns, while
still verifying sandbox-operations-vitest is included.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1856ff6b-b8c1-46c1-b157-2805ba9cd107
📒 Files selected for processing (3)
.github/workflows/e2e-vitest-scenarios.yamltest/e2e-scenario/support-tests/sandbox-operations-workflow-boundary.test.tstools/e2e-scenarios/sandbox-operations-workflow-boundary.mts
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/e2e-vitest-scenarios.yaml
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
Vitest E2E Scenario Results — ❌ Some jobs failedRun: 28313913603
|
Contributor
Vitest E2E Scenario Results —
|
| Job | Result |
|---|---|
| sandbox-operations-vitest |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
Vitest E2E Scenario Results —
|
| Job | Result |
|---|---|
| sandbox-operations-vitest |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
test/e2e-scenario/live/sandbox-operations.test.ts (1)
100-119: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winPass redaction inputs through the shared hosted config instead of hardcoding env names.
onboardSandbox()now accepts a genericproviderEnv, but the artifact redaction still assumes the hosted credentials will always live inNVIDIA_INFERENCE_API_KEYandCOMPATIBLE_API_KEY. That duplicates the contract already exposed byrequireHostedInferenceConfig(), so a future change to the shared mapping can leave onboarding working while CI artifacts stop masking the real secret.Suggested direction
async function onboardSandbox( host: HostCliClient, cleanup: CleanupRegistry, sandboxName: string, artifactName: string, providerEnv: NodeJS.ProcessEnv, + providerRedactions: string[] = [], extraEnv: NodeJS.ProcessEnv = {}, ): Promise<ShellProbeResult> { cleanup.add(`destroy sandbox ${sandboxName}`, () => cleanupSandbox(host, sandboxName)); const result = await host.nemoclaw( @@ - redactionValues: [ - providerEnv.NVIDIA_INFERENCE_API_KEY ?? "", - providerEnv.COMPATIBLE_API_KEY ?? "", - ], + redactionValues: providerRedactions, timeoutMs: 20 * 60_000, }, );Then have the callers pass the hosted redaction values from the shared config instead of re-encoding the env-key names here.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-scenario/live/sandbox-operations.test.ts` around lines 100 - 119, The redaction setup in onboardSandbox() still hardcodes hosted secret env names, which can drift from the shared hosted config contract. Update onboardSandbox() to derive its redaction values from the same shared mapping used by requireHostedInferenceConfig(), and have the callers pass those hosted redaction inputs through providerEnv/extraEnv instead of directly reading NVIDIA_INFERENCE_API_KEY and COMPATIBLE_API_KEY here.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/e2e-scenario/live/sandbox-operations.test.ts`:
- Line 595: The live E2E coverage for agent --json no longer verifies that piped
stdin still reaches the CLI entrypoint. Update the existing sandbox-operations
scenario (the TC-SBX-02b case in the live test suite) to keep an assertion for
stdin passthrough, or add a separate live scenario that exercises printf ... |
nemoclaw ... agent --json while still preserving the current exit-status and
failed-tool provenance checks.
---
Outside diff comments:
In `@test/e2e-scenario/live/sandbox-operations.test.ts`:
- Around line 100-119: The redaction setup in onboardSandbox() still hardcodes
hosted secret env names, which can drift from the shared hosted config contract.
Update onboardSandbox() to derive its redaction values from the same shared
mapping used by requireHostedInferenceConfig(), and have the callers pass those
hosted redaction inputs through providerEnv/extraEnv instead of directly reading
NVIDIA_INFERENCE_API_KEY and COMPATIBLE_API_KEY here.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 039a9a14-8283-4242-87f0-d0a46f7649d1
📒 Files selected for processing (1)
test/e2e-scenario/live/sandbox-operations.test.ts
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
Vitest E2E Scenario Results — ❌ Some jobs failedRun: 28314537135
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Collaborator
Author
|
Live run 28314537135 reached the agent transport checks and exposed another unreliable assertion introduced with #5683, not a legacy The deterministic source/package tests already cover provenance extraction and forwarding. I have removed only this prompt-based live assertion locally while retaining the deterministic non-zero transport check. Artifact upload and cleanup both passed. I will refresh/push #5926 after bootstrap #5927 lands, avoiding another known |
Contributor
Vitest E2E Scenario Results — ✅ All requested jobs passedRun: 28335063162
|
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
test/e2e-scenario/support-tests/sandbox-operations-workflow-boundary.test.ts (1)
33-38: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAvoid coupling this helper to the next workflow job.
Line 34 makes these boundary tests fail if an unrelated job is inserted between
sandbox-operations-vitestandsandbox-survival-vitest. Find the next two-space job key instead so the mutation remains scoped to the sandbox-operations job without encoding sibling order. As per path instructions, “Prefer observable outcomes through the public boundary over source-text, private-shape, or mock-call assertions.”Suggested helper adjustment
function mutateSandboxOperationsJob(source: string, mutate: (jobSource: string) => string): string { const startMarker = " sandbox-operations-vitest:\n"; - const endMarker = " sandbox-survival-vitest:\n"; const start = source.indexOf(startMarker); - const end = source.indexOf(endMarker, start + startMarker.length); expect(start).toBeGreaterThanOrEqual(0); - expect(end).toBeGreaterThan(start); + const rest = source.slice(start + startMarker.length); + const nextJob = /^ [A-Za-z0-9_-]+:\n/m.exec(rest); + const end = nextJob ? start + startMarker.length + nextJob.index : source.length; + expect(end).toBeGreaterThan(start + startMarker.length); const jobSource = source.slice(start, end);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-scenario/support-tests/sandbox-operations-workflow-boundary.test.ts` around lines 33 - 38, The boundary helper in sandbox-operations-workflow-boundary.test.ts is too tightly coupled to the next sibling job marker. Update the logic around the sandbox-operations-vitest check so it finds the next two-space-indented job key after the start marker, rather than hardcoding sandbox-survival-vitest as the end boundary. Keep the assertions in the boundary test focused on the sandbox-operations-vitest block and use the helper’s existing source/index scan approach to locate the next job entry without depending on workflow job order.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/e2e-scenario/live/sandbox-operations.test.ts`:
- Around line 539-540: The recovery check in the sandbox operations test is
soft-passing a real failure by returning a skipped result when the gateway did
not restart. Update the failure path in the recovery logic around the
afterStatus check so that a failed restart or unhealthy Docker state causes the
test to fail rather than emit a passing or skipped scenario result. Keep the
existing gateway recovery flow in the sandbox-operations test, but make the
conditionals in that recovery branch strict so the test only passes when the
gateway actually recovers.
---
Nitpick comments:
In
`@test/e2e-scenario/support-tests/sandbox-operations-workflow-boundary.test.ts`:
- Around line 33-38: The boundary helper in
sandbox-operations-workflow-boundary.test.ts is too tightly coupled to the next
sibling job marker. Update the logic around the sandbox-operations-vitest check
so it finds the next two-space-indented job key after the start marker, rather
than hardcoding sandbox-survival-vitest as the end boundary. Keep the assertions
in the boundary test focused on the sandbox-operations-vitest block and use the
helper’s existing source/index scan approach to locate the next job entry
without depending on workflow job order.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 471fedb7-199c-4f03-99ff-126fde3df4c7
📒 Files selected for processing (4)
.github/workflows/e2e-vitest-scenarios.yamltest/e2e-scenario/live/sandbox-operations.test.tstest/e2e-scenario/support-tests/sandbox-operations-workflow-boundary.test.tstools/e2e-scenarios/sandbox-operations-workflow-boundary.mts
🚧 Files skipped from review as they are similar to previous changes (2)
- .github/workflows/e2e-vitest-scenarios.yaml
- tools/e2e-scenarios/sandbox-operations-workflow-boundary.mts
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
Vitest E2E Scenario Results — ❌ Some jobs failedRun: 28335373856
|
Contributor
Vitest E2E Scenario Results —
|
| Job | Result |
|---|---|
| sandbox-operations-vitest |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
Vitest E2E Scenario Results —
|
| Job | Result |
|---|---|
| sandbox-operations-vitest |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
Vitest E2E Scenario Results —
|
| Job | Result |
|---|---|
| sandbox-operations-vitest |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
Vitest E2E Scenario Results —
|
| Job | Result |
|---|---|
| sandbox-operations-vitest |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
Vitest E2E Scenario Results — ✅ All requested jobs passedRun: 28336361990
|
Collaborator
Author
Exact-head sandbox-operations evidenceVerified head Downloaded artifact
TC-SBX-06 is deliberately not claimed as proven: this runner had no legacy Review dispositions on this frozen head:
Local evidence on the final changes: 48 focused E2E support tests, CLI typecheck, repository architecture checks, YAML/format/lint/security hooks, source-shape budget, and test-file budget passed. The broad |
Collaborator
Author
|
@coderabbitai review |
Contributor
✅ Action performedReview finished.
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
test/e2e-scenario/live/sandbox-operations.test.ts (1)
462-472: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winFail the gateway probe when Docker introspection itself fails.
These branches currently interpret
docker ps/docker inspectfromstdoutalone. A Docker error here can be misreported as"skipped-gateway-absent"or"recovered-by-status", so TC-SBX-06 can pass without actually proving the gateway transition. Only treat the gateway as absent whendocker psexits successfully with empty output, and assert success on the inspect probes before classifying the outcome.Suggested fix
const running = await host.command( "docker", ["ps", "-q", "--filter", `name=${GATEWAY_CONTAINER}`], @@ timeoutMs: 15_000, }, ); + expectExitZero(running, "probe shared NemoClaw gateway container"); if (!running.stdout.trim()) { return "skipped-gateway-absent"; } @@ const afterKill = await host.command( "docker", ["inspect", "-f", "{{.State.Running}}", GATEWAY_CONTAINER], @@ timeoutMs: 15_000, }, ); + expectExitZero(afterKill, "inspect shared NemoClaw gateway after kill"); const recoveryOutcome = afterKill.stdout.trim() === "true" ? "recovered-before-status" : "recovered-by-status"; @@ const afterStatus = await host.command( "docker", ["inspect", "-f", "{{.State.Running}}", GATEWAY_CONTAINER], @@ timeoutMs: 15_000, }, ); expectExitZero(status, `nemoclaw ${sandboxName} status after gateway kill`); + expectExitZero(afterStatus, "inspect shared NemoClaw gateway after status"); expect(afterStatus.stdout.trim(), resultText(afterStatus)).toBe("true");As per path instructions, “Flag ... conditionals that make a test pass without exercising its claim.”
Also applies to: 483-493, 500-510
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-scenario/live/sandbox-operations.test.ts` around lines 462 - 472, The TC-SBX-06 gateway probe logic in the sandbox-operations test is treating Docker command output as if it were success, which can hide failures. Update the gateway checks around host.command for the docker ps and docker inspect probes so they first verify the command succeeded before using stdout to classify the outcome. In the gateway-absent, recovered-by-status, and related branches, only return those states when the corresponding Docker introspection call completes successfully; otherwise fail the probe so the test cannot pass without actually validating the gateway transition.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/e2e-scenario/fixtures/clients/host.ts`:
- Around line 128-146: In cleanupGatewayRegistration, the legacy gateway destroy
fallback is being used for any non-zero gateway remove result, which can mask
real failures in the supported path. Update the logic around
command/resultText/GATEWAY_ALREADY_ABSENT so the fallback only runs when
openshell gateway remove clearly reports an unknown or unrecognized subcommand,
and otherwise fail fast by asserting the remove result. Keep the existing
destroy fallback and cleanup gateway registration flow, but narrow the condition
using the remove command result before invoking the legacy path.
---
Outside diff comments:
In `@test/e2e-scenario/live/sandbox-operations.test.ts`:
- Around line 462-472: The TC-SBX-06 gateway probe logic in the
sandbox-operations test is treating Docker command output as if it were success,
which can hide failures. Update the gateway checks around host.command for the
docker ps and docker inspect probes so they first verify the command succeeded
before using stdout to classify the outcome. In the gateway-absent,
recovered-by-status, and related branches, only return those states when the
corresponding Docker introspection call completes successfully; otherwise fail
the probe so the test cannot pass without actually validating the gateway
transition.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fdfaadb2-d208-4023-a1f2-8c6bc418beb9
📒 Files selected for processing (6)
.github/workflows/e2e-vitest-scenarios.yamltest/e2e-scenario/fixtures/clients/host.tstest/e2e-scenario/live/sandbox-operations.test.tstest/e2e-scenario/support-tests/e2e-clients.test.tstest/e2e-scenario/support-tests/sandbox-operations-workflow-boundary.test.tstools/e2e-scenarios/sandbox-operations-workflow-boundary.mts
🚧 Files skipped from review as they are similar to previous changes (3)
- test/e2e-scenario/support-tests/sandbox-operations-workflow-boundary.test.ts
- .github/workflows/e2e-vitest-scenarios.yaml
- tools/e2e-scenarios/sandbox-operations-workflow-boundary.mts
Contributor
Vitest E2E Scenario Results — ✅ All requested jobs passedRun: 28336717058
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
Vitest E2E Scenario Results — ✅ All requested jobs passedRun: 28337053896
|
Collaborator
Author
Final automated-review dispositionsReviewed the final-head GPT and Nemotron advisor output against
No remaining advisor item changes the scoped implementation. Human review is still required, and the unresolved TC-SBX-06 evidence decision remains visible in #5919. |
21 tasks
jyaunches
pushed a commit
that referenced
this pull request
Jun 30, 2026
## Summary Refreshes the v0.0.70 release docs from the release announcement and the `v0.0.69..v0.0.70` commit range. It also documents the `channels start` policy restoration behavior that was missing from the shared OpenClaw and Hermes command references, and bumps the Fern CLI version used for docs validation. ## Changes - Replaced the stale `v0.0.70` release-notes entry with the actual release themes, including CLI, onboarding, inference, messaging, Windows, documentation, and release-validation changes. - Documented that `channels start` reapplies the matching built-in network policy preset before rebuild and rolls back to disabled if policy restoration fails. - Bumped `fern/fern.config.json` from `5.55.0` to `5.59.0` for the docs refresh. - Source summary: - #5754 -> `docs/about/release-notes.mdx`: Notes Docker Desktop gateway bridge retry behavior during onboarding. - #5930 -> `docs/about/release-notes.mdx`: Links `nemoclaw use` default sandbox selection to the command reference. - #5948 -> `docs/about/release-notes.mdx`: Links reasoning-compatible endpoint validation to inference documentation. - #5950 -> `docs/about/release-notes.mdx`: Links Windows bootstrap WSL recovery behavior to Windows preparation and troubleshooting docs. - #5856 -> `docs/about/release-notes.mdx`: Notes rebuilt policy preset registry repair. - #5882 and #5949 -> `docs/about/release-notes.mdx`: Notes Hermes stale base-image state repair. - #6016 -> `docs/reference/commands.mdx`, `docs/reference/commands-nemohermes.mdx`, and `docs/manage-sandboxes/messaging-channels.mdx`: Documents channel policy restoration and rollback on `channels start`. - #5859 -> `docs/about/release-notes.mdx`: Links quickstart network approval guidance. - #5863 -> `docs/about/release-notes.mdx`: Links Teams allowlist guidance in the messaging page. - #5756, #5926, #6010, and #6011 -> `docs/about/release-notes.mdx`: Summarizes the Vitest E2E validation cutover. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: doc-only prose refresh with no runtime behavior change. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) `npm run docs` exited 0 and Fern reported one existing light-mode accent contrast warning. `fern check --warnings` confirmed the warning is the site theme contrast ratio, not content introduced by this PR. --- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Makes the existing Vitest sandbox-operations replacement reachable from the cutover workflow. The new default-enabled, selectively dispatchable job preserves the legacy Ubuntu/Docker/OpenShell boundary while using Vitest's structured artifacts and cleanup reporting instead of the legacy shell log streamer; it also fixes the previously unexercised replacement to configure hosted-compatible inference rather than treating that credential as a Build API key. ## Related Issue Refs NVIDIA#5919 ## Changes - add `sandbox-operations-vitest` to the Vitest E2E workflow and PR result aggregation - run the existing live replacement with isolated Docker auth, the compiled CLI, OpenShell, and hosted inference - configure both sandbox onboard operations through the shared hosted-inference abstraction - add a focused workflow-boundary test for inventory, default dispatch, and both selective-dispatch inputs ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: CI-only E2E reachability; no user-facing behavior or interface changes - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Targeted evidence: `npx vitest run --project e2e-vitest-support` (54 files, 386 tests); `npm run typecheck:cli`; source-shape and test-size ratchets; normal commit and push hooks. --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added a new live Vitest E2E run for sandbox operations and included it in PR E2E scenario status reporting. * Expanded workflow-boundary validation to block unsafe Docker auth and environment/config scoping, enforce required secret placement, and verify consistent artifact upload and Docker cleanup behavior. * Refined live sandbox assertions (including agent exit behavior), improved gateway recovery reporting, and updated scenario outputs. * **Chores** * Updated sandbox onboarding to use a hosted inference configuration with consistent per-sandbox environment overrides and improved API-key redaction handling; streamlined cleanup/onboarding flow for reliability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Refreshes the v0.0.70 release docs from the release announcement and the `v0.0.69..v0.0.70` commit range. It also documents the `channels start` policy restoration behavior that was missing from the shared OpenClaw and Hermes command references, and bumps the Fern CLI version used for docs validation. ## Changes - Replaced the stale `v0.0.70` release-notes entry with the actual release themes, including CLI, onboarding, inference, messaging, Windows, documentation, and release-validation changes. - Documented that `channels start` reapplies the matching built-in network policy preset before rebuild and rolls back to disabled if policy restoration fails. - Bumped `fern/fern.config.json` from `5.55.0` to `5.59.0` for the docs refresh. - Source summary: - NVIDIA#5754 -> `docs/about/release-notes.mdx`: Notes Docker Desktop gateway bridge retry behavior during onboarding. - NVIDIA#5930 -> `docs/about/release-notes.mdx`: Links `nemoclaw use` default sandbox selection to the command reference. - NVIDIA#5948 -> `docs/about/release-notes.mdx`: Links reasoning-compatible endpoint validation to inference documentation. - NVIDIA#5950 -> `docs/about/release-notes.mdx`: Links Windows bootstrap WSL recovery behavior to Windows preparation and troubleshooting docs. - NVIDIA#5856 -> `docs/about/release-notes.mdx`: Notes rebuilt policy preset registry repair. - NVIDIA#5882 and NVIDIA#5949 -> `docs/about/release-notes.mdx`: Notes Hermes stale base-image state repair. - NVIDIA#6016 -> `docs/reference/commands.mdx`, `docs/reference/commands-nemohermes.mdx`, and `docs/manage-sandboxes/messaging-channels.mdx`: Documents channel policy restoration and rollback on `channels start`. - NVIDIA#5859 -> `docs/about/release-notes.mdx`: Links quickstart network approval guidance. - NVIDIA#5863 -> `docs/about/release-notes.mdx`: Links Teams allowlist guidance in the messaging page. - NVIDIA#5756, NVIDIA#5926, NVIDIA#6010, and NVIDIA#6011 -> `docs/about/release-notes.mdx`: Summarizes the Vitest E2E validation cutover. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: doc-only prose refresh with no runtime behavior change. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) `npm run docs` exited 0 and Fern reported one existing light-mode accent contrast warning. `fern check --warnings` confirmed the warning is the site theme contrast ratio, not content introduced by this PR. --- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
21 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes the existing Vitest sandbox-operations replacement reachable from the cutover workflow. The new default-enabled, selectively dispatchable job preserves the legacy Ubuntu/Docker/OpenShell boundary while using Vitest's structured artifacts and cleanup reporting instead of the legacy shell log streamer; it also fixes the previously unexercised replacement to configure hosted-compatible inference rather than treating that credential as a Build API key.
Related Issue
Refs #5919
Changes
sandbox-operations-vitestto the Vitest E2E workflow and PR result aggregationType of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Targeted evidence:
npx vitest run --project e2e-vitest-support(54 files, 386 tests);npm run typecheck:cli; source-shape and test-size ratchets; normal commit and push hooks.Signed-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit
Tests
Chores