fix(messaging): tolerate verbose npm metadata output

[chengjiew]

Summary

This PR prevents the OpenClaw messaging build applier from failing with spawnSync npm ENOBUFS when npm emits verbose metadata output while installing the Teams plugin. The fix gives the buffered npm view and npm pack --json calls an explicit bounded buffer while keeping the reviewed archive validation and local archive install flow unchanged.

Related Issue

Fixes #6389

Changes

• Adds a 16 MiB buffer limit for buffered npm metadata/archive calls in src/lib/messaging/applier/build/messaging-build-applier.mts.
• Adds a Teams plugin regression in test/messaging-build-applier.test.ts that emits more than Node's default sync buffer during npm view/npm pack.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: internal build robustness fix; no CLI or docs contract changed.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: focused messaging build-applier tests and diff-scoped hooks passed; trusted archive validation remains unchanged.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: NPM_CONFIG_CACHE=/tmp/nemoclaw-6389-npm-cache npx vitest run test/messaging-build-applier.test.ts passed, 26 tests.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Chengjie Wang chengjiew@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Improved reliability of plugin installation when npm produces extremely verbose metadata output by increasing the command output buffering used during package metadata retrieval and verified archive creation.
  • Reduced the chance of installation failures in noisy npm environments.

• Tests

  • Added a functional test that simulates highly verbose npm view/pack output and verifies the expected install flow and pinned tarball behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1154dad8-0fd7-4bdf-b8c9-f739b8e541dd

📥 Commits

Reviewing files that changed from the base of the PR and between 4a62f4f and f62c576.

📒 Files selected for processing (1)

• test/messaging-build-applier.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• test/messaging-build-applier.test.ts

---

📝 Walkthrough

Walkthrough

This change adds an NPM_METADATA_MAX_BUFFER cap for npm view and npm pack subprocess output in the messaging build applier, and adds a test that exercises Teams plugin installation with very verbose npm metadata output.

Changes

npm spawnSync buffer fix

Layer / File(s)	Summary
maxBuffer constant and spawnSync wiring src/lib/messaging/applier/build/messaging-build-applier.mts	Adds NPM_METADATA_MAX_BUFFER and passes it as maxBuffer to the npm view and npm pack spawnSync calls.
Verbose npm metadata test test/messaging-build-applier.test.ts	Adds a test that stubs npm and openclaw, emits large stderr output, and checks the agent-install trace for the expected view, pack, and install steps.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: bug-fix

Suggested reviewers: jyaunches

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately describes the main fix: handling verbose npm metadata output in messaging builds.
Linked Issues check	✅ Passed	The buffer cap and regression test directly address the ENOBUFS failure for Teams plugin installs during onboard.
Out of Scope Changes check	✅ Passed	The PR stays focused on the npm buffer overflow fix and its regression test, with no unrelated changes shown.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/6389_teams_npm_enobufs

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the fix/6389_teams_npm_e... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	fix/6389_teams_npm_e... f62c576	+/-
nemoclaw/src/se...cret-scanner.ts	—	100%	—
nemoclaw/src/commands/slash.ts	—	100%	—
nemoclaw/src/li...bprocess-env.ts	—	100%	—
nemoclaw/src/bl...eprint/state.ts	—	98%	—
nemoclaw/src/onboard/config.ts	—	98%	—
nemoclaw/src/bl...int/snapshot.ts	—	97%	—
nemoclaw/src/bl...print/runner.ts	—	95%	—
nemoclaw/src/co...ration-state.ts	—	94%	—
nemoclaw/src/bl...ate-networks.ts	—	94%	—
nemoclaw/src/index.ts	—	94%	—

TypeScript / code-coverage/cli

The overall coverage in the fix/6389_teams_npm_e... branch is 75%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	fix/6389_teams_npm_e... f62c576	+/-
src/lib/shields...nsition-lock.ts	—	85%	—
src/lib/onboard/preflight.ts	—	83%	—
src/lib/actions...all/run-plan.ts	—	81%	—
src/lib/state/o...oard-session.ts	—	80%	—
src/lib/actions...licy-channel.ts	—	79%	—
src/lib/state/sandbox.ts	—	75%	—
src/lib/onboard...er-gpu-patch.ts	—	69%	—
src/lib/shields/index.ts	—	68%	—
src/lib/policy/index.ts	—	66%	—
src/lib/onboard.ts	—	28%	—

---

_{Updated July 07, 2026 10:38 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

E2E Advisor Recommendation

Required E2E: messaging-providers
Optional E2E: channels-stop-start

Dispatch hint: messaging-providers

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• messaging-providers (high): Most directly exercises live OpenClaw messaging provider setup, plugin/channel runtime installation, credential placeholder redaction, provider creation, policy, and in-sandbox OpenClaw config contracts through the real CLI/OpenShell boundary. It should catch broad regressions in the messaging build applier's package-install path even though the specific Teams verbose npm output case is unit-covered here.

Optional E2E

• channels-stop-start (high): Useful adjacent confidence for messaging channel rebuild/stop/start behavior across OpenClaw and Hermes with multiple channel manifests and provider reuse. This is optional because the PR change is narrowly in OpenClaw npm plugin archive process buffering and messaging-providers is the primary live coverage.

New E2E recommendations

• Teams messaging plugin installation (medium): Existing live messaging E2E coverage appears to exercise Telegram, Discord, Slack, WeChat, and WhatsApp, but not Teams/Microsoft Teams. The PR fixes a Teams-specific verbose npm metadata/pack output failure, so a future live or targeted E2E should add a Teams channel/plugin install smoke that validates npm view/pack and OpenClaw plugin installation through the sandbox build boundary.
  • Suggested test: Add a Teams channel install/rebuild E2E target or extend an existing messaging channel lifecycle target to include Teams with fake credentials and deterministic npm/plugin install assertions.

Dispatch hint

• Workflow: .github/workflows/e2e.yaml
• jobs input: messaging-providers

[github-actions]

E2E Target Recommendation

Required E2E targets: messaging-providers
Optional E2E targets: None

Dispatch required E2E targets:

• gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=messaging-providers

Workflow run

Full E2E target advisor summary

E2E Target Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E targets

• messaging-providers: The change affects the Messaging build applier's npm view/pack handling for reviewed OpenClaw messaging plugin installation. The wired messaging-providers live E2E job exercises OpenClaw messaging provider/channel onboarding and plugin install/rebuild paths through e2e.yaml.
  • Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=messaging-providers

Optional E2E targets

• None.

Relevant changed files

• src/lib/messaging/applier/build/messaging-build-applier.mts

[github-actions]

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 7 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Action checklist

• PRA-T1 Add or justify test follow-up: Runtime validation
• PRA-T2 Add or justify test follow-up: Runtime validation
• PRA-T3 Add or justify test follow-up: Acceptance clause
• PRA-T4 Add or justify test follow-up: Acceptance clause
• PRA-T5 Add or justify test follow-up: Acceptance clause
• PRA-T6 Add or justify test follow-up: Acceptance clause
• PRA-T7 Add or justify test follow-up: Acceptance clause

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

• PRA-T1 Runtime validation — Run or identify a targeted Docker/onboard or `nemoclaw <sb> channels add teams` runtime validation where Teams is selected and npm emits more than 1 MiB of stderr during `messaging-build-applier.mts --agent openclaw --phase agent-install`, then assert the build proceeds past that agent-install step.. The unit regression is well targeted to the changed code and reproduces the child-process ENOBUFS mechanism while checking installer provenance steps. The linked bug manifested inside a Docker/onboard sandbox build path, so targeted runtime validation would add confidence at that integration boundary without changing the code-review finding posture.
• PRA-T2 Runtime validation — Keep the unit regression that verifies verbose Teams npm output still performs `dist.integrity`, `dist.tarball`, `npm pack --json`/`--pack-destination`, and local `openclaw plugins install --pin` for `@openclaw/msteams@2026.6.10`.. The unit regression is well targeted to the changed code and reproduces the child-process ENOBUFS mechanism while checking installer provenance steps. The linked bug manifested inside a Docker/onboard sandbox build path, so targeted runtime validation would add confidence at that integration boundary without changing the code-review finding posture.
• PRA-T3 Acceptance clause — Running `nemoclaw onboard` or `nemoclaw <sb> channels add teams` with Microsoft Teams credentials configured causes the Docker sandbox image build to fail at Step 110/128 (`messaging-build-applier.mts --agent openclaw --phase agent-install`) with `spawnSync npm ENOBUFS`. — add test evidence or identify existing coverage. The changed source is the `messaging-build-applier.mts --agent openclaw --phase agent-install` implementation path and both affected npm calls now have an explicit 16 MiB buffer. The unit regression constructs a Teams OpenClaw plan and calls `applyMessagingBuildPhase(plan, "agent-install", env)`, but it does not execute the full Docker/onboard or channel-add runtime path.
• PRA-T4 Acceptance clause — The error occurs consistently within ~2 seconds and the sandbox cannot be created. — add test evidence or identify existing coverage. The added regression reproduces the immediate child-process output-buffer failure mode by emitting more than Node's default sync buffer from fake npm stderr, then verifies the install proceeds. Full sandbox creation timing and lifecycle are outside the changed unit test.
• PRA-T5 Acceptance clause — No Teams sandbox can be built on this host. — add test evidence or identify existing coverage. The root child-process buffer condition is addressed for the Teams plugin package path. The PR does not include a full host-level sandbox build validation in the diff evidence.
• PRA-T6 Acceptance clause — Platform scope: Reproduced on Ubuntu 24.04 (x86_64) only; other platforms not tested. — add test evidence or identify existing coverage. The fix uses Node's cross-platform `spawnSync` `maxBuffer` option and does not add platform-specific branches. The diff does not include platform-specific runtime evidence.
• PRA-T7 Acceptance clause — Regression: Unknown — earlier versions not tested. — add test evidence or identify existing coverage. No historical regression analysis is present in the code diff; this clause does not require a code change.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

[coderabbitai]

🧹 Nitpick comments (1)

test/messaging-build-applier.test.ts (1)

617-617: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Test title missing local issue-reference suffix.

Title is behavior-oriented but doesn't include a (#1234) suffix. If this test targets a specific tracked issue (the ENOBUFS report referenced in the PR objectives), consider appending the issue number.

As per coding guidelines, **/*.test.ts: "Write behavior-oriented test titles, and put local issue references in a final (#1234) suffix."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/messaging-build-applier.test.ts` at line 617, The test title in the
`it(...)` within `messaging-build-applier.test.ts` is missing the required local
issue-reference suffix. Update the behavior-oriented title to keep its current
meaning and append the relevant tracked issue in a final `(`#1234`)` suffix so it
follows the project test-title convention.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/messaging-build-applier.test.ts`:
- Line 617: The test title in the `it(...)` within
`messaging-build-applier.test.ts` is missing the required local issue-reference
suffix. Update the behavior-oriented title to keep its current meaning and
append the relevant tracked issue in a final `(`#1234`)` suffix so it follows the
project test-title convention.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f2470b13-556a-4e63-9ea1-5f38c05b6022

📥 Commits

Reviewing files that changed from the base of the PR and between 5a6f489 and 4a62f4f.

📒 Files selected for processing (2)

• src/lib/messaging/applier/build/messaging-build-applier.mts
• test/messaging-build-applier.test.ts

[github-actions]

PR Review Advisor (Nemotron Ultra) — Changes requested

Merge posture: Do not merge yet
Primary next action: Resolve or justify PRA-1: Source-of-truth review needed: NPM_METADATA_MAX_BUFFER workaround for npm verbose stderr.
Open items: 0 required · 2 warnings · 0 suggestions · 2 test follow-ups
Since last review: 0 prior items resolved · 1 still applies · 0 new items found

Action checklist

• PRA-1 Resolve or justify: Source-of-truth review needed: NPM_METADATA_MAX_BUFFER workaround for npm verbose stderr
• PRA-2 Resolve or justify: Workaround for npm verbose metadata output needs documented removal condition in src/lib/messaging/applier/build/messaging-build-applier.mts:141
• PRA-T1 Add or justify test follow-up: Runtime validation
• PRA-T2 Add or justify test follow-up: NPM_METADATA_MAX_BUFFER workaround for npm verbose stderr

Findings index

ID	Severity	Category	Location	Required action
PRA-1	Resolve/justify	architecture	—	Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
PRA-2	Resolve/justify	correctness	src/lib/messaging/applier/build/messaging-build-applier.mts:141	Add a code comment near line 141 referencing #5896 and the removal condition: when npm stops emitting verbose notices by default, or when plugin install method changes (tracked in #5896 archive installer consolidation).

Review findings by urgency: 0 required fixes, 2 items to resolve/justify, 0 in-scope improvements

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

PRA-1 Resolve/justify — Source-of-truth review needed: NPM_METADATA_MAX_BUFFER workaround for npm verbose stderr

• Location: not file-specific
• Category: architecture
• Problem: The advisor marked localized patch analysis as needs_followup.
• Impact: A localized workaround can preserve or hide an invalid state when the source boundary is unclear.
• Recommended action: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
• Missing regression test: New test 'tolerates verbose npm metadata output when installing the Teams plugin ([Ubuntu 24.04][Sandbox] sandbox image build fails with spawnSync npm ENOBUFS when Teams channel is configured during onboard #6389)' simulates 50k verbose lines → build succeeds → all provenance checks (integrity, tarball URL, packed SRI) still pass
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
• Evidence: No comment currently at line 141 explaining removal condition. Previous review (PRA-14) identified this gap.

PRA-2 Resolve/justify — Workaround for npm verbose metadata output needs documented removal condition

• Location: src/lib/messaging/applier/build/messaging-build-applier.mts:141
• Category: correctness
• Problem: The NPM_METADATA_MAX_BUFFER = 16MB constant handles npm CLI emitting excessive verbose notices to stderr during npm view/npm pack for @openclaw/msteams. This is a standard Node.js mitigation for external tool behavior. No comment currently exists near the constant referencing Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps #5896 (archive installer consolidation) or the removal condition (npm stops emitting verbose notices by default, or plugin install method changes).
• Impact: Future maintainers may not know when this workaround can be safely removed, risking indefinite retention of a 16MB buffer allocation.
• Recommended action: Add a code comment near line 141 referencing Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps #5896 and the removal condition: when npm stops emitting verbose notices by default, or when plugin install method changes (tracked in Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps #5896 archive installer consolidation).
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: grep -n -A3 -B3 'NPM_METADATA_MAX_BUFFER' src/lib/messaging/applier/build/messaging-build-applier.mts — verify comment references Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps #5896 and removal condition
• Missing regression test: New test 'tolerates verbose npm metadata output when installing the Teams plugin ([Ubuntu 24.04][Sandbox] sandbox image build fails with spawnSync npm ENOBUFS when Teams channel is configured during onboard #6389)' already proves workaround works; removal condition tracked in Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps #5896
• Done when: The risk is fixed or explicitly justified in the PR. Verification: grep -n -A3 -B3 'NPM_METADATA_MAX_BUFFER' src/lib/messaging/applier/build/messaging-build-applier.mts — verify comment references Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps #5896 and removal condition.
• Evidence: Constant defined at line 141, used at lines 1165 and 1217. Previous review (PRA-14) identified this as resolve/justify. No comment present at line 141 explaining removal condition.

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

• None.

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

• PRA-T1 Runtime validation — Add or identify targeted runtime/integration validation for the changed behavior; do not report external E2E job pass/fail here.. Runtime/sandbox/infrastructure paths need behavioral runtime validation: src/lib/messaging/applier/build/messaging-build-applier.mts. Unit test covers exact failure condition and happy path; broader sandbox integration validated via existing E2E suite.
• PRA-T2 NPM_METADATA_MAX_BUFFER workaround for npm verbose stderr — New test 'tolerates verbose npm metadata output when installing the Teams plugin ([Ubuntu 24.04][Sandbox] sandbox image build fails with spawnSync npm ENOBUFS when Teams channel is configured during onboard #6389)' simulates 50k verbose lines → build succeeds → all provenance checks (integrity, tarball URL, packed SRI) still pass. No comment currently at line 141 explaining removal condition. Previous review (PRA-14) identified this gap.

Since last review details

Current findings, using the urgency labels above:

PRA-1 Resolve/justify — Source-of-truth review needed: NPM_METADATA_MAX_BUFFER workaround for npm verbose stderr

• Location: not file-specific
• Category: architecture
• Problem: The advisor marked localized patch analysis as needs_followup.
• Impact: A localized workaround can preserve or hide an invalid state when the source boundary is unclear.
• Recommended action: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
• Missing regression test: New test 'tolerates verbose npm metadata output when installing the Teams plugin ([Ubuntu 24.04][Sandbox] sandbox image build fails with spawnSync npm ENOBUFS when Teams channel is configured during onboard #6389)' simulates 50k verbose lines → build succeeds → all provenance checks (integrity, tarball URL, packed SRI) still pass
• Done when: The risk is fixed or explicitly justified in the PR. Verification: Inspect the localized patch and source-of-truth review fields for a concrete invalid state, source boundary, source-fix constraint, regression test, and removal condition.
• Evidence: No comment currently at line 141 explaining removal condition. Previous review (PRA-14) identified this gap.

PRA-2 Resolve/justify — Workaround for npm verbose metadata output needs documented removal condition

• Location: src/lib/messaging/applier/build/messaging-build-applier.mts:141
• Category: correctness
• Problem: The NPM_METADATA_MAX_BUFFER = 16MB constant handles npm CLI emitting excessive verbose notices to stderr during npm view/npm pack for @openclaw/msteams. This is a standard Node.js mitigation for external tool behavior. No comment currently exists near the constant referencing Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps #5896 (archive installer consolidation) or the removal condition (npm stops emitting verbose notices by default, or plugin install method changes).
• Impact: Future maintainers may not know when this workaround can be safely removed, risking indefinite retention of a 16MB buffer allocation.
• Recommended action: Add a code comment near line 141 referencing Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps #5896 and the removal condition: when npm stops emitting verbose notices by default, or when plugin install method changes (tracked in Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps #5896 archive installer consolidation).
• Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
• Verification: grep -n -A3 -B3 'NPM_METADATA_MAX_BUFFER' src/lib/messaging/applier/build/messaging-build-applier.mts — verify comment references Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps #5896 and removal condition
• Missing regression test: New test 'tolerates verbose npm metadata output when installing the Teams plugin ([Ubuntu 24.04][Sandbox] sandbox image build fails with spawnSync npm ENOBUFS when Teams channel is configured during onboard #6389)' already proves workaround works; removal condition tracked in Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps #5896
• Done when: The risk is fixed or explicitly justified in the PR. Verification: grep -n -A3 -B3 'NPM_METADATA_MAX_BUFFER' src/lib/messaging/applier/build/messaging-build-applier.mts — verify comment references Post-tag hardening: close OpenClaw 2026.6.9 trust, live-proof, and compatibility-debt gaps #5896 and removal condition.
• Evidence: Constant defined at line 141, used at lines 1165 and 1217. Previous review (PRA-14) identified this as resolve/justify. No comment present at line 141 explaining removal condition.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

[github-actions]

E2E Target Results — ✅ All requested jobs passed

Run: 28859510086
Workflow ref: fix/6389_teams_npm_enobufs
Requested targets: (default — all supported)
Requested jobs: messaging-providers
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
messaging-providers	✅ success

[cv]

Maintainer review: the 16 MiB maxBuffer is a bounded cap at the correct external npm subprocess boundary, not a preallocation or hidden invalid-state workaround. npm's verbose stderr is outside NemoClaw's control; the #6389 regression exceeds Node's default buffer and proves the reviewed integrity, tarball URL, packed SRI, and local archive install flow remain intact. Removal naturally follows replacement of this buffered npm archive path under #5896. All 46 checks are green, the exact-head primary advisor is merge_as_is, and the secondary advisor has no required fixes; its two resolve/justify items are explicitly judged nonblocking for these reasons.