test(dcode): exercise bare default connect

[apurvvkumaria]

Summary

Exercise bare nemoclaw connect --probe-only in the existing Deep Agents Code live acceptance and prove that it reaches the exact ready registry default established by onboarding. The prior check supplied the sandbox name explicitly; the first bare-connect version also left a list-to-connect race that could accept a different healthy sandbox.

Related Issue

Closes #7034
Validates the public default-routing behavior reported in #6627.

Changes

• Add readyDefaultSandbox to nemoclaw list --json, sourced from the same non-pending registry selector used by bare connect after recovery.
• Qualify terminal-agent probe success output with the sandbox name.
• Require both displayed and ready defaults to match the DCode sandbox, unset every sandbox-name environment alias, run the actual bare probe, and exact-match its sandbox-qualified success line.
• Cover malformed and missing inventory, both selector mismatches, list failure, wrong-sandbox success output, and nonzero connect status.
• Document the additive JSON field, its point-in-time semantics, and the sandbox-qualified probe output.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent exact-path correctness and security audit passed; exact-head GitHub advisors and CI will rerun after push.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — CLI unit 48/48; runtime and recovery 14/14; exact list JSON 2/2; CLI terminal integration 1/1; image contract 1/1; shfmt, ShellCheck, Bash syntax, Biome, CLI typecheck, test-title and project-membership checks passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: not applicable to this focused CLI contract and live acceptance; exact changed-range npm run check:diff passed.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — 0 errors and 2 pre-existing warnings; routes and all generated agent variants passed.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Apurv Kumaria akumaria@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Improved nemoclaw connect --probe-only verification for Deep Agents Code managed inference routes, including correct “bare” route sandbox targeting after onboarding.
  • Added more precise diagnostics for missing or mismatched sandbox targets, and clearer attribution when the managed route is rejected.

• Tests

  • Expanded headless acceptance coverage for correct, repeated, mixed, wrong/missing, and failure scenarios.
  • Added assertions for expected connect-probe command ordering and environment handling, plus validation that observed targets match the expected sandbox set.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: de85c90e-4138-4649-90e9-fd1ff6af5255

📥 Commits

Reviewing files that changed from the base of the PR and between 15de804 and 48d4db7.

📒 Files selected for processing (3)

• test/e2e/e2e-cloud-experimental/checks/07-deepagents-code-headless-inference.sh
• test/langchain-deepagents-code-headless-runtime.test.ts
• test/langchain-deepagents-code-image.test.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• test/langchain-deepagents-code-headless-runtime.test.ts
• test/langchain-deepagents-code-image.test.ts

---

📝 Walkthrough

Walkthrough

The Deep Agents Code headless inference acceptance check now invokes bare nemoclaw connect --probe-only, records the OpenShell sandbox target, validates it against the onboarded default, and distinguishes target mismatches from managed-route failures. Runtime and image tests cover these behaviors.

Changes

Deep Agents Code bare connect

Layer / File(s)	Summary
Bare connect probe and failure attribution test/e2e/e2e-cloud-experimental/checks/07-deepagents-code-headless-inference.sh	The probe unsets sandbox-name variables, records OpenShell targets through a shim, validates the expected sandbox, and reports distinct target and route failures.
Connect probe contract coverage test/langchain-deepagents-code-headless-runtime.test.ts, test/langchain-deepagents-code-image.test.ts	Tests cover matching, repeated, missing, wrong, mixed, and failing targets, while asserting the bare command form and execution ordering.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant DCodeCheck
  participant NemoClawCLI
  participant OpenShellShim
  DCodeCheck->>OpenShellShim: record sandbox targets
  DCodeCheck->>NemoClawCLI: run bare connect --probe-only
  NemoClawCLI->>OpenShellShim: execute target
  DCodeCheck->>OpenShellShim: validate expected target
  DCodeCheck->>DCodeCheck: classify probe result

Loading

Possibly related issues

• NVIDIA/NemoClaw#7031 — Related to fail-closed validation in the Deep Agents Code connect probe, although this change specifically validates sandbox targeting.

Suggested labels: area: e2e

Suggested reviewers: ericksoa, laitingsheng

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the bare default-connect test focus.
Linked Issues check	✅ Passed	The changes validate bare nemoclaw connect --probe-only against the registry default and add contract coverage against explicit routing regressions.
Out of Scope Changes check	✅ Passed	All added tests and probe assertions support the bare default-sandbox routing objective; no unrelated scope stands out.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/7034-dcode-bare-connect

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

---

_{Updated July 17, 2026 00:06 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture, inference-routing, network-policy, ubuntu-repo-cloud-langchain-deepagents-code

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cv]

Blocking exact head ce3f94b on Advisor PRA-1. The new bare-connect coverage is valuable, but setup/lifecycle evidence targets $SANDBOX_NAME while bare connect --probe-only independently resolves the registry default. The canonical happy path currently aligns them, yet a mismatched override/default could combine evidence from two sandboxes and falsely pass, violating this script’s shared-evidence contract. Before the bare probe, explicitly assert the ready registry default equals $SANDBOX_NAME, add a mismatch regression, then rerun exact-diff CI/E2E and request rereview.

[github-actions]

E2E Target Results — ⚠️ Run cancelled — no signal

Run: 29522627679
Workflow ref: codex/7034-dcode-bare-connect
Requested targets: ubuntu-repo-cloud-langchain-deepagents-code
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 0 passed, 0 failed, 1 cancelled, 0 skipped, 0 unknown

Test	Result	Total wall clock time
live	⚠️ cancelled	19s

[apurvvkumaria]

Addressed the requested shared-evidence gap at verified head 9675333fa353b3acfa4b69e615f9944cb01bf58e. The acceptance now reads the same non-pending registry selector as bare connect after recovery, requires both displayed and ready defaults to equal the DCode sandbox with all sandbox-name aliases unset, and exact-matches the sandbox-qualified success line emitted by the actual bare probe. Different-sandbox success output and nonzero status after a success-looking marker both fail closed. Focused CLI/runtime/recovery coverage, exact JSON contracts, shfmt, ShellCheck, docs, typecheck, and the full changed-range gate pass. @cv please rereview the exact head when CI settles.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7036.docs.buildwithfern.com/nemoclaw

[github-actions]

E2E Target Results — ✅ All selected tests passed

Run: 29525767493
Workflow ref: codex/7034-dcode-bare-connect
Requested targets: ubuntu-repo-cloud-langchain-deepagents-code
Requested test IDs: (default — all default-enabled tests; explicit-only tests openshell-gateway-auth-contract, mcp-bridge-dev, hermes-gpu-startup, sandbox-rlimits-connect, and jetson-nvmap-gpu are skipped unless selected)
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped, 0 unknown

Test	Result	Total wall clock time
live	✅ success	8m 52s

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@test/e2e/e2e-cloud-experimental/checks/07-deepagents-code-headless-inference.sh`:
- Around line 190-196: The connect-status handling in
validate_connect_target_trace must validate the trace before returning a nonzero
connect status, prioritizing missing or mismatched sandbox-target attribution
over the connection failure; update
test/e2e/e2e-cloud-experimental/checks/07-deepagents-code-headless-inference.sh
at lines 190-196 accordingly. Add a regression case covering both a wrong target
and nonzero exit in test/langchain-deepagents-code-headless-runtime.test.ts at
lines 131-136.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: dd268d9d-ee9b-4ced-ae6b-162d0151599c

📥 Commits

Reviewing files that changed from the base of the PR and between ce3f94b and 15de804.

📒 Files selected for processing (3)

• test/e2e/e2e-cloud-experimental/checks/07-deepagents-code-headless-inference.sh
• test/langchain-deepagents-code-headless-runtime.test.ts
• test/langchain-deepagents-code-image.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• test/langchain-deepagents-code-image.test.ts

[apurvvkumaria]

Exact head 15de804f328c5421cb7c3dfb8a89cd9352a29ef2 passed all 36 ordinary checks. In trusted run 29537095370, network-policy completed both live tests successfully (1 file, 2 tests, 405.21s), after which GitHub cancelled the workflow and simultaneously cancelled the remaining Hermes security-posture job; no product assertion failure was reported. The controller correctly finalized the exact-head gate as failed because cancelled evidence cannot be accepted. Same-diff recovery is being fixed fail-closed in #7054 using explicit infrastructure-only retry markers; this PR remains active and unmerged.