test(onboard): silence the tsx loader deprecation in JWT bundle children

[laitingsheng]

Summary

On Node.js v26 the JWT bundle concurrency test failed even though all twelve helper subprocesses exited 0 and published one identical bundle. Each helper runs under node --import tsx, and tsx calls module.register(), which Node 26 deprecated as DEP0205, so every child wrote a warning line to stderr and the test's exact-empty stderr assertion rejected it. The helpers now start with --disable-warning=DEP0205, so the test passes on Node 26 while any other child stderr still fails it.

Related Issue

Fixes #7837

Changes

• src/lib/onboard/docker-driver-gateway-jwt-bundle.test.ts: pass --disable-warning=DEP0205 to each concurrent JWT bundle helper subprocess, named through a TSX_LOADER_DEPRECATION constant.
• Suppression is scoped to the single deprecation code the TypeScript loader emits, not the broader --no-warnings used by other helper spawns in this repository, so a NemoClaw runtime warning from the child would still fail the test.
• The only changed file is a test; no runtime onboarding, credential, or gateway code is touched.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: the change adjusts test subprocess flags only and alters no user-facing behavior.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: static-checks fails on this branch for a reason that predates it — src/lib/core/shell-quote.ts: fan-in is 26; lower or remove its 27 limit in ci/source-architecture-budget.json. The same stale limit fails on main and is already corrected in fix(state): restore preserved backups into replacement sandboxes #7814; this branch does not touch import fan-in.

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: no documentation paths changed; the diff is one test file and no user-facing behavior changes.
• Agent: Claude Code

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project cli src/lib/onboard/docker-driver-gateway-jwt-bundle.test.ts on Node v26.5.0 — 12 passed (12); the same command failed before the change with twelve [DEP0205] stderr lines. Temporarily writing an unrelated line to a helper's stderr still failed the test, confirming the assertion keeps its guard. npm run typecheck:cli and npx biome check on the changed file both clean.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Tinson Lai tinsonl@nvidia.com

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 3935ea7c-1e99-4e51-a66d-c684c71a85a6

📥 Commits

Reviewing files that changed from the base of the PR and between 6f3afab and a278731.

📒 Files selected for processing (1)

• src/lib/onboard/docker-driver-gateway-jwt-bundle.test.ts

---

📝 Walkthrough

Walkthrough

The concurrent JWT-bundle test defines the DEP0205 warning identifier and passes it to spawned Node subprocesses through --disable-warning, alongside the existing TSX loader arguments.

Changes

JWT bundle subprocess warning handling

Layer / File(s)	Summary
Configure subprocess warning suppression src/lib/onboard/docker-driver-gateway-jwt-bundle.test.ts	Defines the DEP0205 warning constant and applies it to concurrent JWT-bundle helper subprocesses.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7838: Updates the same concurrent subprocess arguments to suppress related Node/TSX loader warnings.

Suggested reviewers: brandonpelfrey, cv, dnandakumar-nv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the test change to suppress the tsx deprecation warning in JWT bundle child processes.
Linked Issues check	✅ Passed	The change matches #7837 by silencing DEP0205 in the JWT bundle subprocesses while keeping other stderr and exit-code failures intact.
Out of Scope Changes check	✅ Passed	The PR stays scoped to the JWT bundle test harness and does not introduce unrelated runtime or onboarding changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/jwt-bundle-node26-warnings

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit af907ce in the fix/jwt-bundle-node2... branch remains at 96%, unchanged from commit 376beb5 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit af907ce in the fix/jwt-bundle-node2... branch remains at 81%, unchanged from commit 376beb5 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 376beb5	fix/jwt-bundle-node2... af907ce	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/policy/...ne-exclusion.ts	91%	97%	+6%

---

_{Updated July 30, 2026 02:42 UTC}

[cjagwani]

Approved exact head af907ce03b644d60ae265b7a2067c75e1ff56ad2.

The child process suppresses only Node warning DEP0205; the existing exact-empty stderr assertion continues to catch every other warning/error. The change is test-only, preserves production behavior, and is covered by all 50 green exact-head checks. DCO is present, both commits are Verified, and no unresolved review findings remain. The stale-base gate is waived because GitHub reports MERGEABLE/conflict-free and maintainers directed us not to refresh solely for base currency.