fix(inference): strip provider marker from URL requests

[jyaunches]

Summary

URL-form Node.js HTTP requests now remove NemoClaw's internal upstream-provider marker before forwarding. Object-form requests and fetch already removed this routing metadata; this closes the remaining egress gap identified after #7485.

Related Issue

Follow-up to #7485, which fixed #6913.

Changes

• Detect string-URL and URL-object forms of http.request and https.request.
• Remove X-NemoClaw-Upstream-Provider from the created request while preserving other headers and original request arguments.
• Add regression coverage for both URL forms and both Node.js transports.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This removes internal routing metadata and changes no command, user configuration, setup flow, policy schema, or documented workflow.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Pending human review of this focused follow-up to fix(inference): strip thinking for Nemotron-3 models #7485.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: nemoclaw-blueprint/scripts/nemotron-inference-fix.js removes the internal provider marker from URL-form Node.js HTTP requests. This changes no command, user configuration, setup flow, policy schema, or documented workflow. npx vitest run test/nemotron-inference-fix.test.ts passed 8 tests on PR SHA 95cd894db; the URL-form regression now inspects real Node HTTP/HTTPS ClientRequest headers while remaining offline.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable; this PR does not change scripts/prepare-dgx-station-host.sh.

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run test/nemotron-inference-fix.test.ts passed 8/8; git diff --check passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not applicable; this is a focused transport compatibility fix.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved handling of HTTP/HTTPS requests made using URL strings or URL objects.
  • Removed the runtime upstream provider marker header case-insensitively, while preserving unrelated headers.
  • URL-form requests now reliably avoid unintended interception, preserving prior pass-through behavior when options aren’t applicable.
• Tests
  • Added a Vitest coverage to validate header behavior for both http URL strings and https URL objects using the “NEMOTRON_FIX” preload.

[coderabbitai]

📝 Walkthrough

Walkthrough

The request wrapper now distinguishes URL-form inputs, normalizes their options, removes the runtime provider marker, and skips chat-completions interception. Tests cover HTTP and HTTPS URL-form requests with case-insensitive headers.

Changes

URL-form request handling

Layer / File(s)	Summary
Normalize and validate URL-form requests nemoclaw-blueprint/scripts/nemotron-inference-fix.js, test/nemotron-inference-fix.test.ts	The preload normalizes request options, removes x-nemoclaw-upstream-provider, preserves unrelated headers, and limits chat-completions interception to object-form requests. Tests cover string and URL inputs for HTTP and HTTPS.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7485: Both changes update provider-marker handling in the Nemotron inference request interception flow.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR removes a URL-form header marker but does not address the linked issue's unsupported thinking-parameter request shape fix.	Add the requested nemotron-3-ultra request-shape fix so NVIDIA Endpoints no longer receive the unsupported thinking parameter.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The changes stay focused on URL-form request handling and regression coverage, with no obvious unrelated scope creep.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: removing the provider marker from URL-form requests in inference plumbing.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-url-provider-marker

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 95cd894 in the codex/fix-url-provid... branch remains at 96%, unchanged from commit 1895f14 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 95cd894 in the codex/fix-url-provid... branch is 80%. The coverage in commit 3e54a83 in the main branch is 81%.

Show a code coverage summary of the most impacted files.

File	main 3e54a83	codex/fix-url-provid... 95cd894	+/-
src/lib/onboard/docker-cdi.ts	80%	70%	-10%
src/lib/shields/index.ts	72%	67%	-5%
src/lib/onboard...e-patch-flow.ts	76%	71%	-5%
src/lib/onboard...host-anchors.ts	94%	90%	-4%
src/lib/onboard/preflight.ts	77%	78%	+1%
src/lib/actions...light-guards.ts	86%	90%	+4%
src/lib/onboard...box-gpu-mode.ts	92%	97%	+5%
src/lib/actions...confirmation.ts	69%	79%	+10%
src/lib/actions...ocker-health.ts	65%	82%	+17%
src/lib/onboard...box-prebuild.ts	74%	92%	+18%

---

_{Updated July 26, 2026 01:28 UTC}

[coderabbitai]

🧹 Nitpick comments (1)

test/nemotron-inference-fix.test.ts (1)

312-368: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Assert headers through a real ClientRequest.

The harness reimplements removeHeader, so this only verifies the wrapper calls the fake method—not that Node’s actual request headers omit the marker. Use real local HTTP/HTTPS requests and inspect their headers before aborting, while keeping the test offline. As per path instructions, prefer observable outcomes through the public boundary over mock-call assertions.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/nemotron-inference-fix.test.ts` around lines 312 - 368, Update the
“preload removes the runtime provider marker from URL-form Node requests
(`#6913`)” test to use real local HTTP and HTTPS server requests instead of
stubbed http.request/https.request methods. Inspect each actual ClientRequest’s
headers before aborting, assert the provider marker is absent while X-Keep
remains, and keep the test fully offline; remove assertions based on the fake
removeHeader call records.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/nemotron-inference-fix.test.ts`:
- Around line 312-368: Update the “preload removes the runtime provider marker
from URL-form Node requests (`#6913`)” test to use real local HTTP and HTTPS
server requests instead of stubbed http.request/https.request methods. Inspect
each actual ClientRequest’s headers before aborting, assert the provider marker
is absent while X-Keep remains, and keep the test fully offline; remove
assertions based on the fake removeHeader call records.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0aa01050-1b97-4c8d-ae26-a1a477c6d7ed

📥 Commits

Reviewing files that changed from the base of the PR and between f3127e0 and 530f7bf.

📒 Files selected for processing (2)

• nemoclaw-blueprint/scripts/nemotron-inference-fix.js
• test/nemotron-inference-fix.test.ts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: inference-routing, network-policy

1 optional E2E recommendation

• openclaw-inference-switch

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[apurvvkumaria]

Exact head 95cd894 is merge-ready: required CI and E2E pass, both advisor lanes report high-confidence zero findings, the valid ClientRequest test feedback is addressed, and no review threads remain. Trivial linked-issue bookkeeping can fix forward.