Skip to content

perf(test): reduce four remaining process hotspots - #6417

Merged
cv merged 6 commits into
mainfrom
codex/perf-next-test-hotspots
Jul 7, 2026
Merged

perf(test): reduce four remaining process hotspots#6417
cv merged 6 commits into
mainfrom
codex/perf-next-test-hotspots

Conversation

@cv

@cv cv commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator

Summary

Reduce four remaining test-process hotspots by narrowing gateway-failure imports, moving host-alias behavior checks to typed in-process seams, batching Windows bootstrap scenarios, and sharing a cache-safe public-dispatch harness. Representative executable, production-adapter, exit, and security-sensitive process contracts remain covered.

Related Issue

Refs #6245.

Changes

  • Load the dependency-light gateway failure factory for helper/composition tests while retaining the real onboard.ts binding and caller process regressions.
  • Exercise host-alias mutations, retries, parsing, and Docker failure classification directly; retain exact public argv translation and one real Docker/Kubectl adapter process contract.
  • Run 21 Windows bootstrap scenarios in isolated PowerShell 5.1-compatible dynamic modules while retaining the real Request-Reboot process-exit case.
  • Move CLI dispatch diagnostics onto a cache-safe in-process harness, share it with oclif compatibility tests, and retain six environment-sensitive executable launches.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: Test execution and internal dependency seams changed; commands, flags, output, defaults, and runtime behavior are unchanged.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent final-diff review confirmed that host-alias validation, argv-array execution, timeout classification, conflict retries, and production adapter boundaries remain intact; Windows and dispatch exit/process contracts remain explicit.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

  • PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npm run build:cli plus targeted Vitest runs across cli, integration, and package-contract: 9 files passed, 1 PowerShell-only file skipped; 97 tests passed and 22 skipped because PowerShell is unavailable locally. Typechecks, Biome, project-membership, createRequire-budget, title/guard, and diff checks also passed.
  • Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

  • New Features

    • Enhanced sandbox host alias command handling (add/list/remove) with improved dry-run behavior.
  • Bug Fixes

    • Added stricter CLI flag validation and clearer command failure reporting (including consistent exit-code behavior).
    • Improved resilience when host alias updates face patch conflicts via retry.
    • Refined Windows bootstrap behavior and messaging for more consistent setup and status handling.
  • Tests

    • Expanded and reorganized unit/integration coverage for host aliases, CLI dispatch/argv translation, public dispatch routing, and Windows bootstrap scenarios.

@cv cv self-assigned this Jul 7, 2026
@coderabbitai

coderabbitai Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3377a66d-7597-4816-92ac-fe32919f67d5

📥 Commits

Reviewing files that changed from the base of the PR and between e1ba406 and 0b5a610.

📒 Files selected for processing (1)
  • test/bootstrap-windows.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • test/bootstrap-windows.test.ts

📝 Walkthrough

Walkthrough

Sandbox host-alias actions now receive injected kubectl and Docker dependencies, with new deps-based entry points and updated command adapters/tests. CLI dispatch tests and Windows bootstrap tests are moved onto shared in-process harnesses with expanded assertions.

Changes

Host Alias Dependency Injection

Layer / File(s) Summary
Deps and execution helpers
src/lib/actions/sandbox/host-aliases.ts
Introduces SandboxHostAliasesDeps, updates Docker probing, and threads kubectl execution through dependency-based helpers and production wiring.
Patch retries and entry delegation
src/lib/actions/sandbox/host-aliases.ts
Updates patch retries to reuse injected dependencies and makes add, list, and remove entry points delegate through the deps-based variants.
Adapter and action tests
src/commands/sandbox/hosts/command-adapters.test.ts, src/lib/actions/sandbox/host-aliases.test.ts, test/cli/sandbox-host-aliases.test.ts
Adds command adapter coverage for flag parsing and error handling, tightens Docker probe assertions, and rewrites host-alias tests around direct dependency mocks and JSON patch validation.
Legacy hosts argv translation
test/package-contract/cli/public-argv-translation.test.ts
Adds contract assertions for translating hosts-add, hosts-list, and hosts-remove into native sandbox:hosts:* argv.

Test Harness Migration

Layer / File(s) Summary
Public dispatch harness
test/support/public-dispatch-test-harness.ts
Adds withDirectPublicDispatch, its harness types, and cache/process interception helpers for in-memory CLI dispatch tests.
Dispatch basics migration
test/cli/dispatch-basics.test.ts
Reworks help, version, unknown-command, sandbox routing, OpenShell, and typo-suggestion tests to assert dispatch behavior through the shared public-dispatch harness.
Oclif compatibility migration
test/cli/oclif-compatibility.test.ts
Removes local dispatch helpers and switches sandbox recovery and status/help compatibility tests to withDirectPublicDispatch.
Gateway failure handler test
src/lib/onboard/gateway-start-failure-integration.test.ts
Builds the gateway start failure handler through createFinalGatewayStartFailureHandler with injected callbacks in the integration test.
Windows bootstrap helpers
test/support/bootstrap-windows-test-helpers.ts
Adds shared PowerShell process and batch execution helpers, payload decoding and validation, and result lookup utilities for bootstrap tests.
Bootstrap test migration
test/bootstrap-windows.test.ts
Rewrites the Windows bootstrap scenarios to use the shared PowerShell harness and validates the richer stdout, status, and JSON assertions across Docker Desktop, WSL repair, Ubuntu install, transcript redaction, and final handoff flows.

Estimated code review effort: 4 (Complex) | ~60 minutes

Possibly related PRs

  • NVIDIA/NemoClaw#2406: Shares the same sandbox host-alias action and adapter area, including dependency injection around host-alias commands.
  • NVIDIA/NemoClaw#3838: Also changes src/lib/actions/sandbox/host-aliases.ts and related tests for host-alias wiring.

Suggested labels: chore

Suggested reviewers: ericksoa, cjagwani, jyaunches

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title matches the PR’s main goal: reducing test process hotspots and improving test performance.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/perf-next-test-hotspots

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the codex/perf-next-test... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main codex/perf-next-test... 0b5a610 +/-
nemoclaw/src/se...cret-scanner.ts 100%
nemoclaw/src/commands/slash.ts 100%
nemoclaw/src/li...bprocess-env.ts 100%
nemoclaw/src/bl...eprint/state.ts 98%
nemoclaw/src/onboard/config.ts 98%
nemoclaw/src/bl...int/snapshot.ts 97%
nemoclaw/src/bl...print/runner.ts 95%
nemoclaw/src/co...ration-state.ts 94%
nemoclaw/src/bl...ate-networks.ts 94%
nemoclaw/src/index.ts 94%

TypeScript / code-coverage/cli

The overall coverage in the codex/perf-next-test... branch is 76%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main codex/perf-next-test... 0b5a610 +/-
src/lib/shields...nsition-lock.ts 85%
src/lib/onboard/preflight.ts 82%
src/lib/actions...all/run-plan.ts 81%
src/lib/state/o...oard-session.ts 80%
src/lib/actions...licy-channel.ts 79%
src/lib/state/sandbox.ts 75%
src/lib/onboard...er-gpu-patch.ts 69%
src/lib/policy/index.ts 66%
src/lib/shields/index.ts 61%
src/lib/onboard.ts 28%

Updated July 07, 2026 20:10 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: sandbox-operations, cloud-onboard
Optional E2E: cloud-onboard

Dispatch hint: sandbox-operations

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • sandbox-operations (medium): The only non-test runtime change is in sandbox host-alias actions, which are user-facing sandbox commands that depend on live Docker/gateway state and kubectl access. Run the live sandbox operations lane to validate the changed CLI build against real sandbox lifecycle and command execution boundaries.
  • cloud-onboard (high): Changed onboard, trace timing, scorecard, or E2E workflow code can affect cloud onboard wall-clock behavior and should refresh the trusted cloud-onboard trace timing signal.

Optional E2E

  • cloud-onboard (high): Optional confidence for the legacy gateway/OpenShell setup that host-alias commands probe before mutating Sandbox resources. Useful if reviewers want broader hosted onboarding coverage, but this PR does not modify onboarding state-machine runtime.

New E2E recommendations

  • sandbox host aliases (high): Existing live E2E coverage appears to exercise broad sandbox operations but not the specific hosts-add, hosts-list, and hosts-remove flow against a live legacy gateway/Sandbox resource. A regression in kubectl patching, conflict retry, or gateway probe behavior could pass the current live lanes.
    • Suggested test: Add a focused live E2E for nemoclaw <sandbox> hosts-add, hosts-list, and hosts-remove that verifies the Sandbox resource hostAliases patch and in-sandbox hostname resolution on a supported legacy gateway environment.

Dispatch hint

  • Workflow: .github/workflows/e2e.yaml
  • jobs input: sandbox-operations

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Recommendation

Required E2E targets: None
Optional E2E targets: None

Workflow run

Full E2E target advisor summary

E2E Target Advisor

Base: origin/main
Head: HEAD
Confidence: medium

Required E2E targets

  • None. No NemoClaw E2E target dispatch is required. The PR changes sandbox host-alias source plus unit/integration test harnesses outside test/e2e; the canonical typed live targets and wired free-standing jobs in e2e.yaml do not exercise the hosts-add/hosts-list/hosts-remove host-alias command path changed here. The onboarding gateway-start and Windows bootstrap changes are tests-only outside test/e2e.

Optional E2E targets

  • None.

Relevant changed files

  • src/lib/actions/sandbox/host-aliases.ts

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 1 test follow-up
Since last review: 0 prior items resolved · 1 still applies · 0 new items found

Action checklist

  • PRA-T1 Add or justify test follow-up: Acceptance clause
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor (Nemotron Ultra) — Changes requested

Merge posture: Do not merge yet
Primary next action: Fix PRA-1: Monolith growth: host-aliases.ts +27 lines to 460 by adding DI pattern instead of extracting; then add or justify PRA-T1.
Open items: 2 required · 4 warnings · 4 suggestions · 6 test follow-ups
Since last review: 0 prior items resolved · 7 still apply · 2 new items found

Action checklist

  • PRA-1 Fix: Monolith growth: host-aliases.ts +27 lines to 460 by adding DI pattern instead of extracting in src/lib/actions/sandbox/host-aliases.ts:1
  • PRA-2 Fix: Public API leaks test-only *WithDeps functions and SandboxHostAliasesDeps type in src/lib/actions/sandbox/host-aliases.ts:25
  • PRA-3 Resolve or justify: New test harness framework layer without documented justification in test/support/public-dispatch-test-harness.ts:1
  • PRA-4 Resolve or justify: New batched PowerShell test runner framework layer without performance justification comment in test/support/bootstrap-windows-test-helpers.ts:1
  • PRA-5 Resolve or justify: Missing --help flag and runOclifCommandById error path tests for command adapters in src/commands/sandbox/hosts/command-adapters.test.ts:1
  • PRA-6 Resolve or justify: Lost CLI integration coverage for host aliases in test/cli/sandbox-host-aliases.test.ts:1
  • PRA-T1 Add or justify test follow-up: Runtime validation
  • PRA-T2 Add or justify test follow-up: Runtime validation
  • PRA-T3 Add or justify test follow-up: Runtime validation
  • PRA-T4 Add or justify test follow-up: Runtime validation
  • PRA-T5 Add or justify test follow-up: Runtime validation
  • PRA-T6 Add or justify test follow-up: Missing --help flag and runOclifCommandById error path tests for command adapters
  • PRA-7 In-scope improvement: SandboxHostAliasesDeps type exported but production deps factories not available in src/lib/actions/sandbox/host-aliases.ts:177
  • PRA-8 In-scope improvement: Embedded PowerShell batch runner lacks unit tests for failure modes in test/support/bootstrap-windows-test-helpers.ts:89
  • PRA-9 In-scope improvement: YAGNI: Single-use DOCKER_HOST environment check in test/cli/dispatch-basics.test.ts:174
  • PRA-10 In-scope improvement: Test over scaffold: Unused registry import in test/cli/sandbox-host-aliases.test.ts:17

Findings index

ID Severity Category Location Required action
PRA-1 Required architecture src/lib/actions/sandbox/host-aliases.ts:1 Extract the DI-enabled core into a separate module (e.g., host-aliases-core.ts) and keep host-aliases.ts as a thin production wrapper, or use test-only module augmentation instead of exporting *WithDeps variants.
PRA-2 Required architecture src/lib/actions/sandbox/host-aliases.ts:25 Mark *WithDeps functions and SandboxHostAliasesDeps as @internal or move to a test-only export barrel. Keep only production entry points (listSandboxHostAliases, addSandboxHostAlias, removeSandboxHostAlias, validate*) as public API.
PRA-3 Resolve/justify architecture test/support/public-dispatch-test-harness.ts:1 Add header comment documenting the replaced modules (withDirectStatusDispatch, withDirectSandboxRecoveryDispatch) and the consolidation rationale. Explain why simpler vitest mock patterns were insufficient.
PRA-4 Resolve/justify architecture test/support/bootstrap-windows-test-helpers.ts:1 Add comment explaining the performance justification (batch vs. per-test process spawn). Document the trade-off and timeout tuning (POWERSHELL_BATCH_EXEC_TIMEOUT_MS=60s). Verify 60s is sufficient for all 21 test cases.
PRA-5 Resolve/justify tests src/commands/sandbox/hosts/command-adapters.test.ts:1 Add test for --help flag routing to oclif help. Add test for runOclifCommandById rejection path.
PRA-6 Resolve/justify correctness test/cli/sandbox-host-aliases.test.ts:1 Add one integration test that exercises the full CLI → adapter → action path for host aliases, or document that command-adapters.test.ts + host-aliases.test.ts together provide sufficient coverage.
PRA-7 Improvement correctness src/lib/actions/sandbox/host-aliases.ts:177 If SandboxHostAliasesDeps is only for test mocking, mark @internal. If intended for external extension, export production deps factories.
PRA-8 Improvement correctness test/support/bootstrap-windows-test-helpers.ts:89 Consider extracting the PowerShell runner to a separate .ps1 file for readability and potential syntax highlighting/linting. Add a smoke test that the batch runner executes a simple case correctly.
PRA-9 Improvement correctness test/cli/dispatch-basics.test.ts:174 Remove the DOCKER_HOST save/restore; the test doesn't mutate it.
PRA-10 Improvement correctness test/cli/sandbox-host-aliases.test.ts:17 Remove the registry import; actionDeps() already provides mocked getSandbox.

🚨 Required before merge

Address these before merging unless a maintainer explicitly overrides the advisor with rationale.

PRA-1 Required — Monolith growth: host-aliases.ts +27 lines to 460 by adding DI pattern instead of extracting

  • Location: src/lib/actions/sandbox/host-aliases.ts:1
  • Category: architecture
  • Problem: File grew from 433 to 460 lines by adding 5 *WithDeps function variants and SandboxHostAliasesDeps type instead of extracting the DI-enabled core. The file is already a large-file hotspot and security-sensitive (sandbox host aliases control plane).
  • Impact: Continues monolith growth in security-sensitive file. Makes future maintenance harder and increases cognitive load. Production exports test-only API surface.
  • Required action: Extract the DI-enabled core into a separate module (e.g., host-aliases-core.ts) and keep host-aliases.ts as a thin production wrapper, or use test-only module augmentation instead of exporting *WithDeps variants.
  • Expected follow-up: Fix before merge or get explicit maintainer override.
  • Verification: wc -l src/lib/actions/sandbox/host-aliases.ts; verify no production caller uses *WithDeps functions
  • Missing regression test: N/A — architecture finding
  • Done when: The required change is committed and verification passes: wc -l src/lib/actions/sandbox/host-aliases.ts; verify no production caller uses *WithDeps functions.
  • Evidence: Diff shows +27 lines adding SandboxHostAliasesDeps type, *WithDeps variants for all public functions, and productionHostAliasesDeps factory. No extraction performed.

PRA-2 Required — Public API leaks test-only *WithDeps functions and SandboxHostAliasesDeps type

  • Location: src/lib/actions/sandbox/host-aliases.ts:25
  • Category: architecture
  • Problem: Exported SandboxHostAliasesDeps type and 5 *WithDeps functions (assertLegacyGatewayHostAliasSupportWithDeps, probeLegacyGatewayContainerWithDeps, listSandboxHostAliasesWithDeps, addSandboxHostAliasWithDeps, removeSandboxHostAliasWithDeps) expand public API surface for testability. No @internal annotation. Consumers could depend on test-only variants, blurring production/test trust boundary.
  • Impact: Consumers could depend on test-only variants, making refactoring harder. Blurs boundary between production and test interfaces. Security-sensitive file exports internal DI structure.
  • Required action: Mark *WithDeps functions and SandboxHostAliasesDeps as @internal or move to a test-only export barrel. Keep only production entry points (listSandboxHostAliases, addSandboxHostAlias, removeSandboxHostAlias, validate*) as public API.
  • Expected follow-up: Fix before merge or get explicit maintainer override.
  • Verification: grep -r "addSandboxHostAliasWithDeps\|SandboxHostAliasesDeps" --include="*.ts" | grep -v test | grep -v "host-aliases.ts"
  • Missing regression test: N/A — API surface finding
  • Done when: The required change is committed and verification passes: grep -r "addSandboxHostAliasWithDeps\|SandboxHostAliasesDeps" --include="*.ts" | grep -v test | grep -v "host-aliases.ts".
  • Evidence: All *WithDeps functions and SandboxHostAliasesDeps type are exported from host-aliases.ts without @internal annotation. productionHostAliasesDeps() is internal but type is public.
Review findings by urgency: 2 required fixes, 4 items to resolve/justify, 4 in-scope improvements

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

PRA-3 Resolve/justify — New test harness framework layer without documented justification

  • Location: test/support/public-dispatch-test-harness.ts:1
  • Category: architecture
  • Problem: New test harness (138 lines) with require.cache manipulation for module reloading. Consolidates withDirectStatusDispatch and withDirectSandboxRecoveryDispatch but introduces a new testing framework layer. Rubric item 7: flag unnecessary new framework layers unless proven small, reused, and clearly needed.
  • Impact: Adds framework complexity. Future contributors must understand require.cache manipulation patterns. If not widely reused, increases maintenance burden.
  • Recommended action: Add header comment documenting the replaced modules (withDirectStatusDispatch, withDirectSandboxRecoveryDispatch) and the consolidation rationale. Explain why simpler vitest mock patterns were insufficient.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: grep -r "withDirectPublicDispatch" test/
  • Missing regression test: N/A — architecture finding
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: grep -r "withDirectPublicDispatch" test/.
  • Evidence: File created in this PR. Used in cli-oclif-compatibility.test.ts and dispatch-basics.test.ts replacing two prior harnesses. No header comment explaining rationale.

PRA-4 Resolve/justify — New batched PowerShell test runner framework layer without performance justification comment

  • Location: test/support/bootstrap-windows-test-helpers.ts:1
  • Category: architecture
  • Problem: New batched PowerShell test runner (306 lines) with embedded PowerShell batch execution script. Reduces PowerShell process spawns from N to 1 per test file. Rubric item 7: evaluate if complexity is justified vs. simpler parallel vitest processes.
  • Impact: Significant test infrastructure code. Embedded PowerShell runner script is complex (70+ line string with error handling, env snapshotting, output conversion). If performance gain is marginal, complexity not justified.
  • Recommended action: Add comment explaining the performance justification (batch vs. per-test process spawn). Document the trade-off and timeout tuning (POWERSHELL_BATCH_EXEC_TIMEOUT_MS=60s). Verify 60s is sufficient for all 21 test cases.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Compare test execution time before/after. Check if POWERSHELL_BATCH_EXEC_TIMEOUT_MS (60s) is sufficient for all cases.
  • Missing regression test: N/A — architecture finding
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Compare test execution time before/after. Check if POWERSHELL_BATCH_EXEC_TIMEOUT_MS (60s) is sufficient for all cases.
  • Evidence: POWERSHELL_BATCH_RUNNER string contains full PowerShell batch execution logic. 21 test cases in bootstrap-windows.test.ts now use batch runner. No comment documenting performance rationale.

PRA-5 Resolve/justify — Missing --help flag and runOclifCommandById error path tests for command adapters

  • Location: src/commands/sandbox/hosts/command-adapters.test.ts:1
  • Category: tests
  • Problem: New command-adapters.test.ts covers argument mapping, unknown flag rejection, and action failure mapping, but lacks tests for: (1) --help flag routing to oclif help, (2) runOclifCommandById rejection/error path.
  • Impact: Regression risk: --help flag behavior and oclif command error propagation not verified for host alias commands.
  • Recommended action: Add test for --help flag routing to oclif help. Add test for runOclifCommandById rejection path.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Run command-adapters.test.ts and verify --help and error path coverage
  • Missing regression test: Add test: HostsAddCommand.run(["--help"]) routes to oclif help without calling action. Add test: runOclifCommandById rejection propagates as process.exit with correct code.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Run command-adapters.test.ts and verify --help and error path coverage.
  • Evidence: command-adapters.test.ts has 3 tests: argument mapping, unknown flag rejection, action failure mapping. No --help or runOclifCommandById error tests.

PRA-6 Resolve/justify — Lost CLI integration coverage for host aliases

  • Location: test/cli/sandbox-host-aliases.test.ts:1
  • Category: correctness
  • Problem: Converted from CLI subprocess tests to direct action function tests using *WithDeps. This improves speed but loses integration coverage of the CLI argument parsing → action function pipeline. command-adapters.test.ts partially covers the adapter layer, but end-to-end CLI dispatch for host aliases is no longer tested.
  • Impact: Regression risk: CLI argument parsing bugs for host aliases would not be caught. Adapter tests cover argument mapping but not the full dispatch chain.
  • Recommended action: Add one integration test that exercises the full CLI → adapter → action path for host aliases, or document that command-adapters.test.ts + host-aliases.test.ts together provide sufficient coverage.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Check if any test still spawns the full CLI binary for host alias commands
  • Missing regression test: Add integration test: spawn CLI binary with `nemoclaw alpha hosts-add host.ip --dry-run` and verify exit 0 + JSON output. Add integration test: spawn CLI binary with `nemoclaw alpha hosts-remove host --dry-run` and verify exit 0 + JSON output.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Check if any test still spawns the full CLI binary for host alias commands.
  • Evidence: sandbox-host-aliases.test.ts now imports action functions directly and uses *WithDeps. No tests spawn the CLI binary for host alias commands.

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

PRA-7 Improvement — SandboxHostAliasesDeps type exported but production deps factories not available

  • Location: src/lib/actions/sandbox/host-aliases.ts:177
  • Category: correctness
  • Problem: productionHostAliasesDeps() factory is internal but SandboxHostAliasesDeps type is exported. This allows consumers to construct custom deps but they cannot easily obtain production implementations (dockerSpawnSync, dockerExecFileSync, registry.getSandbox are not exported).
  • Impact: API inconsistency: type suggests extensibility but production implementations are not accessible. Could confuse external consumers.
  • Suggested action: If SandboxHostAliasesDeps is only for test mocking, mark @internal. If intended for external extension, export production deps factories.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Search for external imports of SandboxHostAliasesDeps outside test files
  • Missing regression test: N/A — API design finding
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: SandboxHostAliasesDeps exported at line 25. productionHostAliasesDeps() at line 177 is not exported. dockerSpawnSync, dockerExecFileSync, registry.getSandbox not exported from this module.

PRA-8 Improvement — Embedded PowerShell batch runner lacks unit tests for failure modes

  • Location: test/support/bootstrap-windows-test-helpers.ts:89
  • Category: correctness
  • Problem: Embedded PowerShell batch runner script (POWERSHELL_BATCH_RUNNER) is a 70+ line string with complex error handling, environment snapshotting, and output conversion. This is test infrastructure code that could have bugs. No unit tests for the runner itself.
  • Impact: Batch runner bugs could cause false test passes/failures. Hard to debug without isolated test coverage.
  • Suggested action: Consider extracting the PowerShell runner to a separate .ps1 file for readability and potential syntax highlighting/linting. Add a smoke test that the batch runner executes a simple case correctly.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run bootstrap-windows tests and verify batch runner produces expected JSON output
  • Missing regression test: Add unit test for PowerShell batch runner parsing/decoding logic (decodeBatchPayload, validateBatchPayload). Add test for timeout exceeded, malformed manifest, missing case ID.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: POWERSHELL_BATCH_RUNNER at line 89. decodeBatchPayload and validateBatchPayload functions have no dedicated tests. Only integration testing via bootstrap-windows.test.ts.

PRA-9 Improvement — YAGNI: Single-use DOCKER_HOST environment check

  • Location: test/cli/dispatch-basics.test.ts:174
  • Category: correctness
  • Problem: Test saves and restores process.env.DOCKER_HOST but no evidence it's mutated by the test. Single-use config check adds noise.
  • Impact: Unnecessary complexity in test. No evidence DOCKER_HOST is set/changed by the test harness.
  • Suggested action: Remove the DOCKER_HOST save/restore; the test doesn't mutate it.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run dispatch-basics.test.ts and verify DOCKER_HOST unchanged (or remove check entirely)
  • Missing regression test: N/A — test simplification
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Lines 174 and 190: const dockerHost = process.env.DOCKER_HOST; expect(process.env.DOCKER_HOST).toBe(dockerHost); No code between them mutates DOCKER_HOST.

PRA-10 Improvement — Test over scaffold: Unused registry import

  • Location: test/cli/sandbox-host-aliases.test.ts:17
  • Category: correctness
  • Problem: Imports * as registry from "../../src/lib/state/registry" but only uses it for type inference in actionDeps() where getSandbox is mocked anyway.
  • Impact: Unnecessary import adds confusion. The mock in actionDeps() doesn't use the real registry.
  • Suggested action: Remove the registry import; actionDeps() already provides mocked getSandbox.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run sandbox-host-aliases.test.ts and verify no type errors
  • Missing regression test: N/A — test simplification
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Line 17: import * as registry from "../../src/lib/state/registry"; Not used anywhere in the file. actionDeps() at line 38 provides its own getSandbox mock.
Simplification opportunities: 4 possible cuts, net -30 lines possible

These are safe simplification checks only. Do not remove validation, security controls, data-loss prevention, or required tests.

  • PRA-1 shrink (src/lib/actions/sandbox/host-aliases.ts:1): 5 *WithDeps function exports + SandboxHostAliasesDeps type + productionHostAliasesDeps factory (27 lines)
    • Replacement: Extract to host-aliases-core.ts with internal DI; host-aliases.ts re-exports only production entry points
    • Net: -27 lines
    • Safety boundary: Must preserve validation, driver checks, gateway probe classification, resourceVersion retry logic, and kubectl command construction exactly
  • PRA-7 shrink (src/lib/actions/sandbox/host-aliases.ts:177): export keyword from SandboxHostAliasesDeps type (line 25)
    • Replacement: Add @internal JSDoc or move to test-only export barrel
    • Net: 0 lines
    • Safety boundary: Must not break test files that import SandboxHostAliasesDeps for mocking
  • PRA-9 yagni (test/cli/dispatch-basics.test.ts:174): Lines 174 and 190 (DOCKER_HOST save/restore)
    • Replacement: Remove both lines
    • Net: -2 lines
    • Safety boundary: Must not remove if future test code mutates DOCKER_HOST
  • PRA-10 delete (test/cli/sandbox-host-aliases.test.ts:17): Line 17: import * as registry from "../../src/lib/state/registry";
    • Replacement: Remove import
    • Net: -1 lines
    • Safety boundary: No safety boundary — import is unused
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

  • PRA-T1 Runtime validation — HostsAddCommand.run(["--help"]) routes to oclif help without calling action. Runtime/sandbox/infrastructure paths need behavioral runtime validation: src/lib/actions/sandbox/host-aliases.ts. Lost CLI integration coverage (PRA-7) and missing --help/error path tests (PRA-5) require runtime validation.
  • PRA-T2 Runtime validation — runOclifCommandById rejection propagates as process.exit with correct code. Runtime/sandbox/infrastructure paths need behavioral runtime validation: src/lib/actions/sandbox/host-aliases.ts. Lost CLI integration coverage (PRA-7) and missing --help/error path tests (PRA-5) require runtime validation.
  • PRA-T3 Runtime validation — Full CLI spawn: nemoclaw alpha hosts-add host.ip --dry-run → exit 0 + JSON output. Runtime/sandbox/infrastructure paths need behavioral runtime validation: src/lib/actions/sandbox/host-aliases.ts. Lost CLI integration coverage (PRA-7) and missing --help/error path tests (PRA-5) require runtime validation.
  • PRA-T4 Runtime validation — Full CLI spawn: nemoclaw alpha hosts-remove host --dry-run → exit 0 + JSON output. Runtime/sandbox/infrastructure paths need behavioral runtime validation: src/lib/actions/sandbox/host-aliases.ts. Lost CLI integration coverage (PRA-7) and missing --help/error path tests (PRA-5) require runtime validation.
  • PRA-T5 Runtime validation — PowerShell batch runner: timeout exceeded → throws with clear message. Runtime/sandbox/infrastructure paths need behavioral runtime validation: src/lib/actions/sandbox/host-aliases.ts. Lost CLI integration coverage (PRA-7) and missing --help/error path tests (PRA-5) require runtime validation.
  • PRA-T6 Missing --help flag and runOclifCommandById error path tests for command adapters — Add test for --help flag routing to oclif help. Add test for runOclifCommandById rejection path.
Since last review details

Current findings, using the urgency labels above:

PRA-1 Required — Monolith growth: host-aliases.ts +27 lines to 460 by adding DI pattern instead of extracting

  • Location: src/lib/actions/sandbox/host-aliases.ts:1
  • Category: architecture
  • Problem: File grew from 433 to 460 lines by adding 5 *WithDeps function variants and SandboxHostAliasesDeps type instead of extracting the DI-enabled core. The file is already a large-file hotspot and security-sensitive (sandbox host aliases control plane).
  • Impact: Continues monolith growth in security-sensitive file. Makes future maintenance harder and increases cognitive load. Production exports test-only API surface.
  • Required action: Extract the DI-enabled core into a separate module (e.g., host-aliases-core.ts) and keep host-aliases.ts as a thin production wrapper, or use test-only module augmentation instead of exporting *WithDeps variants.
  • Expected follow-up: Fix before merge or get explicit maintainer override.
  • Verification: wc -l src/lib/actions/sandbox/host-aliases.ts; verify no production caller uses *WithDeps functions
  • Missing regression test: N/A — architecture finding
  • Done when: The required change is committed and verification passes: wc -l src/lib/actions/sandbox/host-aliases.ts; verify no production caller uses *WithDeps functions.
  • Evidence: Diff shows +27 lines adding SandboxHostAliasesDeps type, *WithDeps variants for all public functions, and productionHostAliasesDeps factory. No extraction performed.

PRA-2 Required — Public API leaks test-only *WithDeps functions and SandboxHostAliasesDeps type

  • Location: src/lib/actions/sandbox/host-aliases.ts:25
  • Category: architecture
  • Problem: Exported SandboxHostAliasesDeps type and 5 *WithDeps functions (assertLegacyGatewayHostAliasSupportWithDeps, probeLegacyGatewayContainerWithDeps, listSandboxHostAliasesWithDeps, addSandboxHostAliasWithDeps, removeSandboxHostAliasWithDeps) expand public API surface for testability. No @internal annotation. Consumers could depend on test-only variants, blurring production/test trust boundary.
  • Impact: Consumers could depend on test-only variants, making refactoring harder. Blurs boundary between production and test interfaces. Security-sensitive file exports internal DI structure.
  • Required action: Mark *WithDeps functions and SandboxHostAliasesDeps as @internal or move to a test-only export barrel. Keep only production entry points (listSandboxHostAliases, addSandboxHostAlias, removeSandboxHostAlias, validate*) as public API.
  • Expected follow-up: Fix before merge or get explicit maintainer override.
  • Verification: grep -r "addSandboxHostAliasWithDeps\|SandboxHostAliasesDeps" --include="*.ts" | grep -v test | grep -v "host-aliases.ts"
  • Missing regression test: N/A — API surface finding
  • Done when: The required change is committed and verification passes: grep -r "addSandboxHostAliasWithDeps\|SandboxHostAliasesDeps" --include="*.ts" | grep -v test | grep -v "host-aliases.ts".
  • Evidence: All *WithDeps functions and SandboxHostAliasesDeps type are exported from host-aliases.ts without @internal annotation. productionHostAliasesDeps() is internal but type is public.

PRA-3 Resolve/justify — New test harness framework layer without documented justification

  • Location: test/support/public-dispatch-test-harness.ts:1
  • Category: architecture
  • Problem: New test harness (138 lines) with require.cache manipulation for module reloading. Consolidates withDirectStatusDispatch and withDirectSandboxRecoveryDispatch but introduces a new testing framework layer. Rubric item 7: flag unnecessary new framework layers unless proven small, reused, and clearly needed.
  • Impact: Adds framework complexity. Future contributors must understand require.cache manipulation patterns. If not widely reused, increases maintenance burden.
  • Recommended action: Add header comment documenting the replaced modules (withDirectStatusDispatch, withDirectSandboxRecoveryDispatch) and the consolidation rationale. Explain why simpler vitest mock patterns were insufficient.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: grep -r "withDirectPublicDispatch" test/
  • Missing regression test: N/A — architecture finding
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: grep -r "withDirectPublicDispatch" test/.
  • Evidence: File created in this PR. Used in cli-oclif-compatibility.test.ts and dispatch-basics.test.ts replacing two prior harnesses. No header comment explaining rationale.

PRA-4 Resolve/justify — New batched PowerShell test runner framework layer without performance justification comment

  • Location: test/support/bootstrap-windows-test-helpers.ts:1
  • Category: architecture
  • Problem: New batched PowerShell test runner (306 lines) with embedded PowerShell batch execution script. Reduces PowerShell process spawns from N to 1 per test file. Rubric item 7: evaluate if complexity is justified vs. simpler parallel vitest processes.
  • Impact: Significant test infrastructure code. Embedded PowerShell runner script is complex (70+ line string with error handling, env snapshotting, output conversion). If performance gain is marginal, complexity not justified.
  • Recommended action: Add comment explaining the performance justification (batch vs. per-test process spawn). Document the trade-off and timeout tuning (POWERSHELL_BATCH_EXEC_TIMEOUT_MS=60s). Verify 60s is sufficient for all 21 test cases.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Compare test execution time before/after. Check if POWERSHELL_BATCH_EXEC_TIMEOUT_MS (60s) is sufficient for all cases.
  • Missing regression test: N/A — architecture finding
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Compare test execution time before/after. Check if POWERSHELL_BATCH_EXEC_TIMEOUT_MS (60s) is sufficient for all cases.
  • Evidence: POWERSHELL_BATCH_RUNNER string contains full PowerShell batch execution logic. 21 test cases in bootstrap-windows.test.ts now use batch runner. No comment documenting performance rationale.

PRA-5 Resolve/justify — Missing --help flag and runOclifCommandById error path tests for command adapters

  • Location: src/commands/sandbox/hosts/command-adapters.test.ts:1
  • Category: tests
  • Problem: New command-adapters.test.ts covers argument mapping, unknown flag rejection, and action failure mapping, but lacks tests for: (1) --help flag routing to oclif help, (2) runOclifCommandById rejection/error path.
  • Impact: Regression risk: --help flag behavior and oclif command error propagation not verified for host alias commands.
  • Recommended action: Add test for --help flag routing to oclif help. Add test for runOclifCommandById rejection path.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Run command-adapters.test.ts and verify --help and error path coverage
  • Missing regression test: Add test: HostsAddCommand.run(["--help"]) routes to oclif help without calling action. Add test: runOclifCommandById rejection propagates as process.exit with correct code.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Run command-adapters.test.ts and verify --help and error path coverage.
  • Evidence: command-adapters.test.ts has 3 tests: argument mapping, unknown flag rejection, action failure mapping. No --help or runOclifCommandById error tests.

PRA-6 Resolve/justify — Lost CLI integration coverage for host aliases

  • Location: test/cli/sandbox-host-aliases.test.ts:1
  • Category: correctness
  • Problem: Converted from CLI subprocess tests to direct action function tests using *WithDeps. This improves speed but loses integration coverage of the CLI argument parsing → action function pipeline. command-adapters.test.ts partially covers the adapter layer, but end-to-end CLI dispatch for host aliases is no longer tested.
  • Impact: Regression risk: CLI argument parsing bugs for host aliases would not be caught. Adapter tests cover argument mapping but not the full dispatch chain.
  • Recommended action: Add one integration test that exercises the full CLI → adapter → action path for host aliases, or document that command-adapters.test.ts + host-aliases.test.ts together provide sufficient coverage.
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Check if any test still spawns the full CLI binary for host alias commands
  • Missing regression test: Add integration test: spawn CLI binary with `nemoclaw alpha hosts-add host.ip --dry-run` and verify exit 0 + JSON output. Add integration test: spawn CLI binary with `nemoclaw alpha hosts-remove host --dry-run` and verify exit 0 + JSON output.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Check if any test still spawns the full CLI binary for host alias commands.
  • Evidence: sandbox-host-aliases.test.ts now imports action functions directly and uses *WithDeps. No tests spawn the CLI binary for host alias commands.

PRA-7 Improvement — SandboxHostAliasesDeps type exported but production deps factories not available

  • Location: src/lib/actions/sandbox/host-aliases.ts:177
  • Category: correctness
  • Problem: productionHostAliasesDeps() factory is internal but SandboxHostAliasesDeps type is exported. This allows consumers to construct custom deps but they cannot easily obtain production implementations (dockerSpawnSync, dockerExecFileSync, registry.getSandbox are not exported).
  • Impact: API inconsistency: type suggests extensibility but production implementations are not accessible. Could confuse external consumers.
  • Suggested action: If SandboxHostAliasesDeps is only for test mocking, mark @internal. If intended for external extension, export production deps factories.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Search for external imports of SandboxHostAliasesDeps outside test files
  • Missing regression test: N/A — API design finding
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: SandboxHostAliasesDeps exported at line 25. productionHostAliasesDeps() at line 177 is not exported. dockerSpawnSync, dockerExecFileSync, registry.getSandbox not exported from this module.

PRA-8 Improvement — Embedded PowerShell batch runner lacks unit tests for failure modes

  • Location: test/support/bootstrap-windows-test-helpers.ts:89
  • Category: correctness
  • Problem: Embedded PowerShell batch runner script (POWERSHELL_BATCH_RUNNER) is a 70+ line string with complex error handling, environment snapshotting, and output conversion. This is test infrastructure code that could have bugs. No unit tests for the runner itself.
  • Impact: Batch runner bugs could cause false test passes/failures. Hard to debug without isolated test coverage.
  • Suggested action: Consider extracting the PowerShell runner to a separate .ps1 file for readability and potential syntax highlighting/linting. Add a smoke test that the batch runner executes a simple case correctly.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run bootstrap-windows tests and verify batch runner produces expected JSON output
  • Missing regression test: Add unit test for PowerShell batch runner parsing/decoding logic (decodeBatchPayload, validateBatchPayload). Add test for timeout exceeded, malformed manifest, missing case ID.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: POWERSHELL_BATCH_RUNNER at line 89. decodeBatchPayload and validateBatchPayload functions have no dedicated tests. Only integration testing via bootstrap-windows.test.ts.

PRA-9 Improvement — YAGNI: Single-use DOCKER_HOST environment check

  • Location: test/cli/dispatch-basics.test.ts:174
  • Category: correctness
  • Problem: Test saves and restores process.env.DOCKER_HOST but no evidence it's mutated by the test. Single-use config check adds noise.
  • Impact: Unnecessary complexity in test. No evidence DOCKER_HOST is set/changed by the test harness.
  • Suggested action: Remove the DOCKER_HOST save/restore; the test doesn't mutate it.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run dispatch-basics.test.ts and verify DOCKER_HOST unchanged (or remove check entirely)
  • Missing regression test: N/A — test simplification
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Lines 174 and 190: const dockerHost = process.env.DOCKER_HOST; expect(process.env.DOCKER_HOST).toBe(dockerHost); No code between them mutates DOCKER_HOST.

PRA-10 Improvement — Test over scaffold: Unused registry import

  • Location: test/cli/sandbox-host-aliases.test.ts:17
  • Category: correctness
  • Problem: Imports * as registry from "../../src/lib/state/registry" but only uses it for type inference in actionDeps() where getSandbox is mocked anyway.
  • Impact: Unnecessary import adds confusion. The mock in actionDeps() doesn't use the real registry.
  • Suggested action: Remove the registry import; actionDeps() already provides mocked getSandbox.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Run sandbox-host-aliases.test.ts and verify no type errors
  • Missing regression test: N/A — test simplification
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Line 17: import * as registry from "../../src/lib/state/registry"; Not used anywhere in the file. actionDeps() at line 38 provides its own getSandbox mock.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (1)
test/support/bootstrap-windows-test-helpers.ts (1)

205-297: 🚀 Performance & Scalability | 🔵 Trivial

All-or-nothing batch failure hides per-case attribution.

Individual case failures are nicely captured per-case (status/stderr fields via the try/catch inside the PS loop), but if the outer process times out (e.g. one case hangs) or writes to the process-level stderr stream, runPowerShellBatch throws one generic error for the whole batch (Line 276-280), and every one of the 21 migrated itPowerShell tests that share this beforeAll will fail with the same undifferentiated message — losing the isolation the previous per-test spawns gave you.

Consider capturing/flushing partial per-case results to disk as each case completes (so a timeout/hang still yields which case was running), or at least surfacing the last-known case id in the thrown error to speed up triage.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/support/bootstrap-windows-test-helpers.ts` around lines 205 - 297, The
batch runner currently turns any outer process timeout or stderr output into one
generic failure in runPowerShellBatch, which hides which PowerShellBatchCase was
last executing. Update runPowerShellBatch and/or the PowerShell batch runner so
partial per-case results are persisted or surfaced as execution progresses, and
include the last-known case id in the thrown error when the processResult fails.
Use decodeBatchPayload, validateBatchPayload, and the batch execution block in
runPowerShellBatch to locate the change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/bootstrap-windows.test.ts`:
- Around line 619-660: The transcript redaction assertions in the Windows
bootstrap tests are only checking for doubly-escaped strings, so they can miss
leaked sensitive content. Update the expectations in the affected bootstrap test
cases around the parsed stdout checks to match the raw single-backslash
PowerShell output instead, using the same test block and redaction-related
assertions to ensure the sensitive paths/user info are actually excluded.

In `@test/cli/dispatch-basics.test.ts`:
- Around line 173-206: The `--help` and `version` cases in
`dispatch-basics.test.ts` only verify that `runOclifCommandById` was invoked,
but the stubbed harness hides any real output, so these tests miss regressions
in the actual help/version behavior. Update the tests around
`withDirectPublicDispatch`, `dispatchCli`, `runOclifCommandById`, and
`runOclifArgv` so they assert an observable result through the public boundary,
such as captured stdout/stderr content from the help/version command or a
real-process smoke check, and keep the call-routing assertion only as a
secondary check if needed.

---

Nitpick comments:
In `@test/support/bootstrap-windows-test-helpers.ts`:
- Around line 205-297: The batch runner currently turns any outer process
timeout or stderr output into one generic failure in runPowerShellBatch, which
hides which PowerShellBatchCase was last executing. Update runPowerShellBatch
and/or the PowerShell batch runner so partial per-case results are persisted or
surfaced as execution progresses, and include the last-known case id in the
thrown error when the processResult fails. Use decodeBatchPayload,
validateBatchPayload, and the batch execution block in runPowerShellBatch to
locate the change.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1a0fe51b-14b6-4fd0-ba05-6226ffc9528a

📥 Commits

Reviewing files that changed from the base of the PR and between 376ebe2 and e1ba406.

📒 Files selected for processing (11)
  • src/commands/sandbox/hosts/command-adapters.test.ts
  • src/lib/actions/sandbox/host-aliases.test.ts
  • src/lib/actions/sandbox/host-aliases.ts
  • src/lib/onboard/gateway-start-failure-integration.test.ts
  • test/bootstrap-windows.test.ts
  • test/cli-oclif-compatibility.test.ts
  • test/cli/dispatch-basics.test.ts
  • test/cli/sandbox-host-aliases.test.ts
  • test/package-contract/cli/public-argv-translation.test.ts
  • test/support/bootstrap-windows-test-helpers.ts
  • test/support/public-dispatch-test-harness.ts

Comment thread test/bootstrap-windows.test.ts
Comment thread test/cli/dispatch-basics.test.ts
@cv

cv commented Jul 7, 2026

Copy link
Copy Markdown
Collaborator Author

Maintainer review decision: Nemotron override

I am explicitly overriding Nemotron findings PRA-1 and PRA-2 for this PR and accepting the current host-alias architecture.

Rationale:

  • host-aliases.ts grows by a net 27 lines to thread one immutable dependency object through the existing cohesive action pipeline. Extracting a core module would relocate the same security-sensitive logic and enlarge the diff and module surface without changing behavior or test performance.
  • Exported *WithDeps seams are an established repository pattern, including connect.ts, gateway-restart.ts, and logs.ts. No production caller imports the new seams, and productionHostAliasesDeps() remains private.
  • Adding @internal would be documentary only because this TypeScript configuration does not enable stripInternal; it would not materially narrow the emitted API. Keeping the seam consistent with neighboring action modules is preferable in this focused performance PR.

The remaining advisor items are resolved or justified as follows:

  • PRA-3/PRA-4: the dispatch harness is reused by two suites and documents its cache-isolation purpose; the PR records the process-reduction rationale. The PowerShell batch runs 21 production-script scenarios in isolated modules, retains the separate process-exit case, and passed the real WSL lane.
  • PRA-5: the host command adapters do not call runOclifCommandById. Real host-alias help routing is covered in test/cli/sandbox-mutations.test.ts; generic runner help and rejection behavior is covered in src/lib/cli/oclif-runner.test.ts; host-specific parse and action-error mapping is covered in command-adapters.test.ts.
  • PRA-6: coverage is deliberately layered: exact compiled public argv translation, real oclif command parsing/flag mapping, direct action behavior, and one real production Docker/Kubectl adapter contract. Restoring a full mutation subprocess would duplicate those boundaries and undo the targeted speedup.
  • PRA-7: covered by the PRA-2 decision above.
  • PRA-8: the 21 real PowerShell cases are the batch-runner smoke coverage; WSL executed them successfully. Additional meta-tests would expand test infrastructure without a demonstrated gap.
  • PRA-9: the DOCKER_HOST assertion intentionally guards the shared harness state-restoration contract.
  • PRA-10: the registry import is not unused; it is used by the retained production-wrapper adapter test.
  • PRA-T1 through PRA-T6: covered by the layered runtime evidence above or rejected where they target the wrong boundary.

CodeRabbit accepted the corrected transcript-redaction assertions and withdrew its help/version concern after verifying the existing real-process witnesses. Final-head CI is green: 40 passed, 2 intentionally skipped, with all review threads resolved and every commit GitHub-verified.

@cv
cv merged commit f203006 into main Jul 7, 2026
46 checks passed
@cv
cv deleted the codex/perf-next-test-hotspots branch July 7, 2026 20:33
cv added a commit that referenced this pull request Jul 7, 2026
<!-- markdownlint-disable MD041 -->
## Summary
Run the integration project as a bounded four-worker phase during the
canonical local `npm test`, while keeping CI, coverage, focused
integration, and direct Vitest runs serialized. Isolate two onboarding
fixtures from host-global dashboard ports so the parallel suite remains
deterministic. This is the final cumulative #6245 step after the named
onboarding conversions, representative process-contract work, and
sequenced loader cleanup already merged; the final clean-build Node 22
suite passes in 3:52.03.

## Related Issue
Closes #6245.

## Changes
- Replace the dashboard-exhaustion fixture's real host listeners with a
fake `lsof` while retaining the real CLI, preflight, diagnostic, and
non-zero exit contract.
- Give the restore-intent fixture an explicit existing dashboard forward
so unrelated host port occupancy cannot divert the behavior under test.
- Resolve integration scheduling from npm lifecycle, CI, coverage, and
worker-cap inputs: local `npm test` uses at most four workers in group
1, while every safety-sensitive route stays serial.
- Add a behavior matrix covering local, CI, coverage, focused, direct,
and explicit worker-throttle modes.
- Complete the cumulative #6245 acceptance path after #6276/#6336/#6383
converted the named onboarding hotspots, #6285/#6417 retained
representative process contracts, and #6286/#6299/#6388/#6415 sequenced
loader cleanup after process removal.
- Record the final host-specific timings, hotspot disposition, and
retained process-contract inventory in `test/README.md` as an advisory
acceptance snapshot rather than a permanent CI budget.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: Test fixtures and local
test-runner scheduling changed; NemoClaw commands, configuration,
runtime behavior, and CI/coverage workflows are unchanged.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Independent final-diff
review confirmed that the fake `lsof` preserves the real
CLI/preflight/exit contract, the restore-intent assertions remain
intact, and resolved CI/coverage configurations remain serialized.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: Real
CLI exhaustion contract passed; restore-intent passed with all 11
dashboard ports deliberately occupied; scheduling matrix passed 14/14
through the lifecycle-triggered config; `npm run test:projects:check`
reported 1,327 files disjoint across 8 projects.
- [x] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result: Clean-build Node 22 `npm
test -- --reporter=blob` under the normal `umask 022` passed 1,251 files
and 13,879 tests with 39 skipped, 1 todo, and zero failures in 3:52.03,
down 73% from the issue's 14:19.65 baseline despite a larger suite. The
matching diff-scoped routine pre-commit stage passed in 13.95s. #6270
separately removed full coverage from routine pre-commit while
preserving manual and authoritative CI gates.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Integration test runs now use adaptive scheduling to speed up local
execution while keeping CI/focused runs serialized.

* **Bug Fixes**
* Improved reliability of onboarding regression coverage by simulating
dashboard port exhaustion in a hermetic way.
* Updated onboarding-related fixtures to better match the intended
readiness/exit behavior.

* **Tests**
* Added coverage for integration scheduling behavior (local caps,
invalid inputs, and CI/coverage scenarios).

* **Documentation**
* Added test-suite documentation with a local performance snapshot and
key test hotspots.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
<!-- markdownlint-disable MD041 -->
## Summary
Reduce four remaining test-process hotspots by narrowing gateway-failure
imports, moving host-alias behavior checks to typed in-process seams,
batching Windows bootstrap scenarios, and sharing a cache-safe
public-dispatch harness. Representative executable, production-adapter,
exit, and security-sensitive process contracts remain covered.

## Related Issue
Refs NVIDIA#6245.

## Changes
- Load the dependency-light gateway failure factory for
helper/composition tests while retaining the real `onboard.ts` binding
and caller process regressions.
- Exercise host-alias mutations, retries, parsing, and Docker failure
classification directly; retain exact public argv translation and one
real Docker/Kubectl adapter process contract.
- Run 21 Windows bootstrap scenarios in isolated PowerShell
5.1-compatible dynamic modules while retaining the real `Request-Reboot`
process-exit case.
- Move CLI dispatch diagnostics onto a cache-safe in-process harness,
share it with oclif compatibility tests, and retain six
environment-sensitive executable launches.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: Test execution and internal
dependency seams changed; commands, flags, output, defaults, and runtime
behavior are unchanged.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Independent final-diff
review confirmed that host-alias validation, argv-array execution,
timeout classification, conflict retries, and production adapter
boundaries remain intact; Windows and dispatch exit/process contracts
remain explicit.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: `npm
run build:cli` plus targeted Vitest runs across `cli`, `integration`,
and `package-contract`: 9 files passed, 1 PowerShell-only file skipped;
97 tests passed and 22 skipped because PowerShell is unavailable
locally. Typechecks, Biome, project-membership, createRequire-budget,
title/guard, and diff checks also passed.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Enhanced sandbox host alias command handling (add/list/remove) with
improved dry-run behavior.

* **Bug Fixes**
* Added stricter CLI flag validation and clearer command failure
reporting (including consistent exit-code behavior).
* Improved resilience when host alias updates face patch conflicts via
retry.
* Refined Windows bootstrap behavior and messaging for more consistent
setup and status handling.

* **Tests**
* Expanded and reorganized unit/integration coverage for host aliases,
CLI dispatch/argv translation, public dispatch routing, and Windows
bootstrap scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
<!-- markdownlint-disable MD041 -->
## Summary
Run the integration project as a bounded four-worker phase during the
canonical local `npm test`, while keeping CI, coverage, focused
integration, and direct Vitest runs serialized. Isolate two onboarding
fixtures from host-global dashboard ports so the parallel suite remains
deterministic. This is the final cumulative NVIDIA#6245 step after the named
onboarding conversions, representative process-contract work, and
sequenced loader cleanup already merged; the final clean-build Node 22
suite passes in 3:52.03.

## Related Issue
Closes NVIDIA#6245.

## Changes
- Replace the dashboard-exhaustion fixture's real host listeners with a
fake `lsof` while retaining the real CLI, preflight, diagnostic, and
non-zero exit contract.
- Give the restore-intent fixture an explicit existing dashboard forward
so unrelated host port occupancy cannot divert the behavior under test.
- Resolve integration scheduling from npm lifecycle, CI, coverage, and
worker-cap inputs: local `npm test` uses at most four workers in group
1, while every safety-sensitive route stays serial.
- Add a behavior matrix covering local, CI, coverage, focused, direct,
and explicit worker-throttle modes.
- Complete the cumulative NVIDIA#6245 acceptance path after NVIDIA#6276/NVIDIA#6336/NVIDIA#6383
converted the named onboarding hotspots, NVIDIA#6285/NVIDIA#6417 retained
representative process contracts, and NVIDIA#6286/NVIDIA#6299/NVIDIA#6388/NVIDIA#6415 sequenced
loader cleanup after process removal.
- Record the final host-specific timings, hotspot disposition, and
retained process-contract inventory in `test/README.md` as an advisory
acceptance snapshot rather than a permanent CI budget.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: Test fixtures and local
test-runner scheduling changed; NemoClaw commands, configuration,
runtime behavior, and CI/coverage workflows are unchanged.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Independent final-diff
review confirmed that the fake `lsof` preserves the real
CLI/preflight/exit contract, the restore-intent assertions remain
intact, and resolved CI/coverage configurations remain serialized.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: Real
CLI exhaustion contract passed; restore-intent passed with all 11
dashboard ports deliberately occupied; scheduling matrix passed 14/14
through the lifecycle-triggered config; `npm run test:projects:check`
reported 1,327 files disjoint across 8 projects.
- [x] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result: Clean-build Node 22 `npm
test -- --reporter=blob` under the normal `umask 022` passed 1,251 files
and 13,879 tests with 39 skipped, 1 todo, and zero failures in 3:52.03,
down 73% from the issue's 14:19.65 baseline despite a larger suite. The
matching diff-scoped routine pre-commit stage passed in 13.95s. NVIDIA#6270
separately removed full coverage from routine pre-commit while
preserving manual and authoritative CI gates.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Integration test runs now use adaptive scheduling to speed up local
execution while keeping CI/focused runs serialized.

* **Bug Fixes**
* Improved reliability of onboarding regression coverage by simulating
dashboard port exhaustion in a hermetic way.
* Updated onboarding-related fixtures to better match the intended
readiness/exit behavior.

* **Tests**
* Added coverage for integration scheduling behavior (local caps,
invalid inputs, and CI/coverage scenarios).

* **Documentation**
* Added test-suite documentation with a local performance snapshot and
key test hotspots.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@wscurran wscurran added the area: ci CI workflows, checks, release automation, or GitHub Actions label Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: ci CI workflows, checks, release automation, or GitHub Actions

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants