test(openshell): cover IPv6 loopback gRPC endpoint by ericksoa · Pull Request #6828 · NVIDIA/NemoClaw

ericksoa · 2026-07-14T04:59:42Z

Summary

Adds the positive regression coverage requested during review of the plaintext gRPC loopback hardening, proving that both IPv4 and IPv6 literal loopback endpoints remain accepted.

This is PR 3 of 26 in the OpenShell gRPC migration stack.

Changes

Instantiate and close the real direct gRPC API for http://127.0.0.1:8080.
Instantiate and close the real direct gRPC API for http://[::1]:8080.
Keep the existing negative coverage for hostnames, non-loopback addresses, and malformed IP literals unchanged.

Stack

Stack index: refactor(openshell): establish sandbox control boundary #6790
Depends on: feat(openshell): route session reads over pinned gRPC #6791
Review this PR against base branch chore/openshell-grpc-protocol/ae to see only this test slice.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification: this slice adds focused regression coverage only.
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — focused direct gRPC client tests passed (21 tests); npm run typecheck:cli passed
Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — targeted and changed-graph validation were used; required CI supplies the broad repository gates
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Aaron Erickson aerickson@nvidia.com

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

coderabbitai · 2026-07-14T04:59:49Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: e129b549-f689-4262-a855-e20dac475a8b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/openshell-grpc-client/ae

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-07-14T05:00:24Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the chore/openshell-grpc... branch.

TypeScript / code-coverage/cli

The overall coverage in the feat/openshell-grpc-... branch remains at 79%, unchanged from the chore/openshell-grpc... branch.

Show a code coverage summary of the most impacted files.

File	`chore/openshell-grpc...` b85f5b2	`feat/openshell-grpc-...` 46986df	+/-
`src/lib/adapter...ocker/volume.ts`	85%	70%	-15%
`src/lib/messagi...onfig-parser.ts`	77%	62%	-15%
`src/lib/adapter.../docker/pull.ts`	79%	83%	+4%
`src/lib/messagi...nes/template.ts`	95%	100%	+5%
`src/lib/messagi...onfig-parser.ts`	83%	90%	+7%
`src/lib/messagi...parser-utils.ts`	86%	95%	+9%
`src/lib/messagi...ate-resolver.ts`	76%	88%	+12%
`src/lib/messagi...ate-resolver.ts`	56%	78%	+22%
`src/lib/adapter...dbox-control.ts`	0%	98%	+98%
`src/lib/adapter...dbox-control.ts`	0%	100%	+100%

_{Updated July 14, 2026 05:07 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

github-actions · 2026-07-14T05:03:28Z

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Primary next action: No advisor follow-up required beyond maintainer review.
Findings: 0 blockers · 0 warnings · 0 optional suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Nemotron 3 Ultra (non-blocking second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron is a non-blocking second opinion. Its prose, findings, and E2E guidance do not change the primary assessment above and remain in workflow artifacts only.

E2E guidance

Advisory only: coverage and selector recommendations are non-authoritative. E2E / PR Gate independently computes and dispatches trusted jobs without consuming this output.

Recommended coverage: None
Recommended selectors: None

1 optional coverage item · 1 optional selector · 0 new-test recommendations

Optional coverage sandbox-operations — Selected from the trusted checked-in E2E coverage inventory.
Optional selector sandbox-operations — Selected as a trusted checked-in E2E job.

Workflow run details

This is an automated, non-authoritative review. Findings are inputs to maintainer adjudication. Warnings and optional suggestions do not require a response or follow-up. A human maintainer makes the final merge decision.

cv · 2026-07-16T20:06:06Z

Closing as absorbed by the current base branch. The base advanced from bd68383c to b3482315 and now contains the identical IPv4/IPv6 literal-loopback acceptance test. A conflict-free git merge-tree --write-tree b3482315 46986df8 produces tree 2194cdc9, exactly equal to b3482315^{tree}, so merging this PR would be a no-op. No contributor branch was modified or deleted.

## Summary Routes OpenClaw session-list reads through an authenticated direct gRPC client for the sandbox's named OpenShell gateway. The compatibility path retries through supported OpenShell CLI execution only when configuration or sandbox lookup fails before dispatch, so completed commands are never replayed. This is PR 4 of 26 in the OpenShell gRPC migration stack. ## Changes - Resolve a named gateway's endpoint and auth mode from OpenShell user or system metadata, while loading mTLS and OIDC credentials only from the user's gateway directory. - Construct authenticated direct-gRPC clients for plaintext loopback, mTLS, and OIDC gateways, and fail closed for edge-tunneled or unknown auth modes. - Route OpenClaw session listing through direct gRPC with a bounded deadline; retry through the CLI only for read-only configuration or sandbox-lookup failures that occur before command dispatch. - Distinguish pre-dispatch lookup failures from completed nonzero commands and post-dispatch stream failures so the fallback cannot replay a command with an unknown outcome. - Cover credential resolution and routing in `grpc-gateway-config.test.ts`, `grpc-sandbox-control.test.ts`, `sandbox-control-routing.test.ts`, and `passthrough.test.ts`; a direct unconditional switch is insufficient because named gateways can require different auth material and staged compatibility is safe only before dispatch. ## Stack - Stack index: #6790 - Depends on: #6828 - Follow-up docs: #6794 - Review this PR against base branch `feat/openshell-grpc-client/ae` to see only this slice. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: the command-reference update is isolated in the immediate stacked docs-only follow-up #6794; this implementation slice updates its inline CLI help together with the behavior. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: transport-boundary review completed; only configuration and lookup failures before a read-only dispatch are eligible for CLI retry, while completed commands and post-dispatch failures are never replayed. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — the four focused gateway-config, gRPC-control, routing, and session-passthrough test files passed (60 tests); `npm run typecheck:cli` passed - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — targeted and changed-graph validation were used; required CI supplies the broad repository gates - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Co-authored-by: Apurv Kumaria <akumaria@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>

ericksoa added 7 commits July 13, 2026 21:03

chore(stack): carry transport scanner coverage

1d381aa

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

fix(openshell): require literal loopback for plaintext gRPC

7f21edc

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): carry formatted review fixture

d6b8c0d

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): carry current main

f097525

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): pair protocol with its first consumer

48748eb

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

test(openshell): accept IPv6 loopback gRPC endpoints

96ec06e

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

chore(stack): carry externally landed loopback hardening

46986df

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

This was referenced Jul 14, 2026

feat(openshell): route session reads over authenticated gRPC #6793

Merged

refactor(openshell): establish sandbox control boundary #6790

Closed

wscurran added area: networking DNS, proxy, TLS, ports, host aliases, or connectivity area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery chore Build, CI, dependency, or tooling maintenance labels Jul 14, 2026

apurvvkumaria self-assigned this Jul 16, 2026

apurvvkumaria added the v0.0.85 label Jul 16, 2026

cv closed this Jul 16, 2026

Navigation Menu

Uh oh!

test(openshell): cover IPv6 loopback gRPC endpoint - #6828

test(openshell): cover IPv6 loopback gRPC endpoint#6828
ericksoa wants to merge 7 commits into
chore/openshell-grpc-protocol/aefrom
feat/openshell-grpc-client/ae

ericksoa commented Jul 14, 2026

Uh oh!

coderabbitai Bot commented Jul 14, 2026

Review skipped

Uh oh!

github-code-quality Bot commented Jul 14, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 14, 2026 •

edited

Loading

Uh oh!

cv commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

ericksoa commented Jul 14, 2026

Summary

Changes

Stack

Type of Change

Quality Gates

Verification

Uh oh!

coderabbitai Bot commented Jul 14, 2026

Review skipped

Uh oh!

github-code-quality Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — Informational

Model lanes

E2E guidance

Uh oh!

cv commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-code-quality Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 14, 2026 •

edited

Loading