fix(inference): sanitize route display output

[HwangJohn]

Summary

nemoclaw inference get now sanitizes provider and model values before rendering the human-readable terminal output. JSON output and the returned route payload remain unchanged so machine consumers keep the raw gateway route contract.

Changes

• Reuse the existing sanitizeRouteValueForDisplay helper for the human-readable provider/model lines in runInferenceGet.
• Add regression coverage that preserves the raw returned values while stripping control characters from rendered terminal output.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: terminal display hardening only; no command syntax, option, or documented workflow changes.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review scoped to display-only sanitization; JSON output and returned payload remain unchanged.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project cli src/lib/actions/inference-get.test.ts src/lib/inference/config.test.ts passed locally on Windows and on DGX Spark Linux.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: HwangJohn angelic805@gmail.com

Summary by CodeRabbit

• Bug Fixes

  • Sanitized provider and model values in human-readable inference output to prevent control characters and unwanted line breaks.
  • Kept the original provider and model values in returned data while sanitizing only their displayed log representations.

• Tests

  • Added coverage for inference output containing ANSI/control characters to ensure only the human-readable logging path performs sanitization.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: c2bba902-a038-44cb-b2a8-5c48a5e980b9

📥 Commits

Reviewing files that changed from the base of the PR and between b29d509 and ca35ac6.

📒 Files selected for processing (1)

• src/lib/actions/inference-get.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/lib/actions/inference-get.test.ts

---

📝 Walkthrough

Walkthrough

runInferenceGet sanitizes provider and model values for human-readable logs while preserving raw returned values. Tests cover ANSI, control-character, and line-ending handling.

Changes

Inference route display

Layer / File(s)	Summary
Sanitized inference output src/lib/actions/inference-get.ts, src/lib/actions/inference-get.test.ts	The non-JSON logging path sanitizes provider and model values with "unknown" fallbacks; tests verify cleaned logs and unchanged raw return values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: area: inference, bug-fix

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: sanitizing inference route display output.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

src/lib/actions/inference-get.test.ts (1)

62-76: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Cover sanitization of model as well.

The fixture puts a control character only in provider; model contains only a line terminator, so this test would pass even if model-specific sanitization were removed. Add an embedded control character to the model value and assert both its raw return value and sanitized log output.

As per path instructions, tests should provide behavioral confidence through observable outcomes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/actions/inference-get.test.ts` around lines 62 - 76, Update the test
“sanitizes route values only for human-readable output” to include an embedded
control character in the model fixture, then assert that runInferenceGet returns
the raw model value while deps.log contains its sanitized human-readable form.
Preserve the existing provider assertions and verify sanitization independently
for both route values.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/lib/actions/inference-get.test.ts`:
- Around line 62-76: Update the test “sanitizes route values only for
human-readable output” to include an embedded control character in the model
fixture, then assert that runInferenceGet returns the raw model value while
deps.log contains its sanitized human-readable form. Preserve the existing
provider assertions and verify sanitization independently for both route values.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 88d0a006-1872-4ad0-a7f1-623df97ae53a

📥 Commits

Reviewing files that changed from the base of the PR and between 464df86 and b29d509.

📒 Files selected for processing (2)

• src/lib/actions/inference-get.test.ts
• src/lib/actions/inference-get.ts

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: inference-routing, network-policy

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[apurvvkumaria]

Reviewed exact head ca35ac6. The change limits sanitization to human-readable output, preserves raw values for callers and JSON serialization, covers both provider and model control characters, and reuses the established route-display sanitizer. Focused validation: npx vitest run --project cli src/lib/actions/inference-get.test.ts (5/5 passed). No blocking security or correctness findings.