test(cli): split sandbox connect inference tests

ci/test-file-size-budget.json

@@ -8,11 +8,10 @@
     "test/channels-add-preset.test.ts": 1915,
     "test/generate-openclaw-config.test.ts": 2106,
     "test/install-preflight.test.ts": 4397,
-    "test/nemoclaw-start.test.ts": 5319,
+    "test/nemoclaw-start.test.ts": 5310,
     "test/onboard-messaging.test.ts": 2122,
     "test/onboard-selection.test.ts": 7757,
     "test/onboard.test.ts": 4887,
-    "test/policies.test.ts": 3147,
-    "test/sandbox-connect-inference.test.ts": 1577
+    "test/policies.test.ts": 3143
   }
 }

scripts/find-source-shape-tests.ts

@@ -210,18 +210,6 @@ function isReadFileCall(node: ts.CallExpression): boolean {
   return false;
 }
 
-function isSourceTextLikeName(name: string): boolean {
-  return /(src|source|text|content|body|block|snippet|heredoc|docker|script|shell|fn|lines?|matches|calls|usages)/i.test(
-    name,
-  );
-}
-
-function isTextDerivation(initText: string): boolean {
-  return /(\.indexOf\b|\.search\b|\.includes\b|\.match(All)?\b|\.slice\b|\.split\b|\.replace(All)?\b|\.trim(End)?\b|\.join\b|String\(|(?:YAML|yaml|JSON)\.parse\b|yaml\.load\b|Heredoc\b|Snippet\b|Block\b|extract[A-Z]|load[A-Z]|parse[A-Z])/.test(
-    initText,
-  );
-}
-
 function isExecutionResultDerivation(initText: string): boolean {
   return /\b(?:spawnSync|execFileSync|execSync|run(?:Logged|Docker|Bash|WithLib|Embedded|Patch|Hermes|Openclaw|Daemon|Fetch|Command)\w*)\b/.test(
     initText,

src/lib/cli/command-display-metadata.test.ts

@@ -4,7 +4,6 @@
 import { Config as OclifConfig } from "@oclif/core";
 import { describe, expect, it } from "vitest";
 
-import { getRegisteredOclifCommandsMetadata } from "./oclif-metadata";
 import { COMMANDS, visibleCommands } from "./command-registry";
 
 describe("public command display metadata", () => {
@@ -36,5 +35,4 @@ describe("public command display metadata", () => {
 
     expect(invalid).toEqual([]);
   });
-
 });

src/lib/core/version.test.ts

@@ -2,11 +2,47 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { describe, it, expect, beforeAll, afterAll } from "vitest";
+import { execFileSync } from "node:child_process";
 import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { getVersion } from "../../../dist/lib/core/version";
 
+const repoRoot = join(import.meta.dirname, "..", "..", "..");
+
+function withoutGitEnv(): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (!key.startsWith("GIT_") && value !== undefined) {
+      env[key] = value;
+    }
+  }
+  return env;
+}
+
+function withEnv<T>(overrides: NodeJS.ProcessEnv, fn: () => T): T {
+  const previous = new Map<string, string | undefined>();
+  for (const [key, value] of Object.entries(overrides)) {
+    previous.set(key, process.env[key]);
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    for (const [key, value] of previous) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  }
+}
+
 describe("lib/version", () => {
   let testDir: string;
 
@@ -42,6 +78,32 @@ describe("lib/version", () => {
     writeFileSync(join(testDir, "package.json"), JSON.stringify({ version: "1.2.3" }));
   });
 
+  it("ignores inherited Git hook environment for explicit roots", () => {
+    const gitDir = execFileSync("git", ["rev-parse", "--absolute-git-dir"], {
+      cwd: repoRoot,
+      encoding: "utf-8",
+      env: withoutGitEnv(),
+    }).trim();
+
+    writeFileSync(join(testDir, ".version"), "2.3.4\n");
+    try {
+      const result = withEnv(
+        {
+          GIT_CONFIG_COUNT: "1",
+          GIT_CONFIG_KEY_0: "core.hooksPath",
+          GIT_CONFIG_VALUE_0: "/tmp/hostile-hooks",
+          GIT_DIR: gitDir,
+          GIT_INDEX_FILE: join(testDir, "hostile-index"),
+          GIT_WORK_TREE: repoRoot,
+        },
+        () => getVersion({ rootDir: testDir }),
+      );
+      expect(result).toBe("2.3.4");
+    } finally {
+      rmSync(join(testDir, ".version"));
+    }
+  });
+
   it("returns a string", () => {
     expect(typeof getVersion({ rootDir: testDir })).toBe("string");
   });

src/lib/core/version.ts

@@ -15,6 +15,16 @@ function isPackageInfo(value: PackageInfo | null): value is { version: string }
   return typeof value?.version === "string";
 }
 
+function gitEnvForRoot(): NodeJS.ProcessEnv {
+  const env: NodeJS.ProcessEnv = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (!key.startsWith("GIT_") && value !== undefined) {
+      env[key] = value;
+    }
+  }
+  return env;
+}
+
 export interface VersionOptions {
   /** Override the repo root directory. */
   rootDir?: string;
@@ -35,6 +45,7 @@ export function getVersion(opts: VersionOptions = {}): string {
     const raw = execFileSync("git", ["describe", "--tags", "--match", "v*"], {
       cwd: root,
       encoding: "utf-8",
+      env: gitEnvForRoot(),
       stdio: ["ignore", "pipe", "ignore"],
     }).trim();
     if (raw) return raw.replace(/^v/, "");

src/lib/dashboard-url-command.test.ts

@@ -3,11 +3,7 @@
 
 import { describe, expect, it, vi } from "vitest";
 
-import {
-  DashboardUrlCommandError,
-  buildDashboardUrl,
-  runDashboardUrlCommand,
-} from "./dashboard-url-command";
+import { buildDashboardUrl, runDashboardUrlCommand } from "./dashboard-url-command";
 
 function makeSinks() {
   const out: string[] = [];

src/lib/inference/ollama/proxy.ts

@@ -9,7 +9,6 @@ import type { GpuInfo } from "../local";
 
 const path = require("path");
 const { spawn, spawnSync } = require("child_process");
-const http = require("http");
 const { ROOT, SCRIPTS, run, runCapture, shellQuote } = require("../../runner");
 const { OLLAMA_PORT, OLLAMA_PROXY_PORT } = require("../../core/ports");
 const { waitForPort } = require("../../core/wait");
@@ -38,7 +37,6 @@ const {
   loadLocalAdapterPid,
   persistLocalAdapterPid,
   readLocalAdapterTextFile,
-  removeLocalAdapterFile,
   spawnDetachedNodeAdapter,
   writeLocalAdapterSecretFile,
 } = require("../local-adapter-lifecycle");
@@ -122,10 +120,6 @@ function loadPersistedProxyPid(): number | null {
   return loadLocalAdapterPid(PROXY_PID_PATH);
 }
 
-function clearPersistedProxyPid(): void {
-  removeLocalAdapterFile(PROXY_PID_PATH);
-}
-
 // ── Process management ───────────────────────────────────────────
 
 function isOllamaProxyProcess(pid: number | null | undefined): boolean {

src/lib/inference/onboard-probes.ts

@@ -15,7 +15,6 @@ const {
 const {
   isNvcfFunctionNotFoundForAccount,
   nvcfFunctionNotFoundMessage,
-  shouldForceCompletionsApi,
 } = require("../validation");
 
 const {

src/lib/onboard.ts

@@ -62,9 +62,6 @@ const {
   createGatewayBootstrapRepairHelpers,
   getGatewayBootstrapRepairPlan,
 }: typeof import("./onboard/gateway-bootstrap") = require("./onboard/gateway-bootstrap");
-const {
-  verifyWebSearchInsideSandbox: verifyWebSearchInsideSandboxWithDeps,
-}: typeof import("./onboard/web-search-verify") = require("./onboard/web-search-verify");
 const {
   buildDirectGpuPolicyYaml,
   buildDirectSandboxGpuProofCommands,
@@ -123,11 +120,10 @@ const pRetry = require("p-retry");
  *  Covers CSI (color, erase, cursor), OSC, and C1 two-byte escapes per ECMA-48. */
 const ANSI_RE = /\x1B(?:\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1B\\)|[@-_])/g;
 const runner: typeof import("./runner") = require("./runner");
-const { ROOT, SCRIPTS, redact, run, runShell, runCapture, runFile, shellQuote, validateName } =
-  runner;
+const { ROOT, SCRIPTS, redact, run, runCapture, runFile, validateName } = runner;
 const braveProviderProfile: typeof import("./onboard/brave-provider-profile") = require("./onboard/brave-provider-profile");
 const nameValidation: typeof import("./name-validation") = require("./name-validation");
-const { NAME_ALLOWED_FORMAT, getNameValidationGuidance } = nameValidation;
+const { getNameValidationGuidance } = nameValidation;
 const docker: typeof import("./adapters/docker") = require("./adapters/docker");
 const {
   dockerContainerInspectFormat,
@@ -178,14 +174,12 @@ const localInference: typeof import("./inference/local") = require("./inference/
 const {
   findReachableOllamaHost,
   resetOllamaHostCache,
-  getDefaultOllamaModel,
   getLocalProviderBaseUrl,
   getLocalProviderHealthCheck,
   getLocalProviderValidationBaseUrl,
   getOllamaModelOptions,
   getOllamaWarmupCommand,
   OLLAMA_HOST_DOCKER_INTERNAL,
-  validateOllamaModel,
   validateLocalProvider,
 } = localInference;
 const {
@@ -227,8 +221,6 @@ const {
   HERMES_AUTH_METHOD_API_KEY,
   HERMES_AUTH_METHOD_OAUTH,
   HERMES_NOUS_API_KEY_CREDENTIAL_ENV,
-  HERMES_NOUS_API_KEY_HELP_URL,
-  getRequestedHermesAuthMethod,
   hermesAuthMethodLabel,
   normalizeHermesAuthMethod,
 } = hermesAuth;
@@ -258,7 +250,6 @@ const {
   OLLAMA_PROXY_CREDENTIAL_ENV,
   VLLM_LOCAL_CREDENTIAL_ENV,
   getProviderLabel,
-  getEffectiveProviderName,
   getNonInteractiveProvider,
   getNonInteractiveModel,
   getSandboxInferenceConfig,
@@ -270,7 +261,6 @@ const {
   OLLAMA_PROXY_CREDENTIAL_ENV: string;
   VLLM_LOCAL_CREDENTIAL_ENV: string;
   getProviderLabel: (key: string) => string;
-  getEffectiveProviderName: (key: string | null | undefined) => string | null;
   getNonInteractiveProvider: () => string | null;
   getNonInteractiveModel: (providerKey: string) => string | null;
   getSandboxInferenceConfig: (
@@ -285,7 +275,7 @@ const {
     inferenceCompat: LooseObject | null;
   };
 };
-const { sleepSeconds, waitForHttp, waitUntil } = require("./core/wait");
+const { sleepSeconds, waitUntil } = require("./core/wait");
 const platformUtils: typeof import("./platform") = require("./platform");
 const { isWsl, shouldPatchCoredns } = platformUtils;
 const {
@@ -353,7 +343,6 @@ const {
   exitOnSandboxGpuConfigErrors,
   formatSandboxGpuPassthroughNote,
   resolveSandboxGpuFlagFromOptions,
-  sandboxGpuRemediationLines,
   validateSandboxGpuPreflight,
 } = sandboxGpuPreflight;
 const openshellVersion: typeof import("./onboard/openshell-version") = require("./onboard/openshell-version");
@@ -473,8 +462,6 @@ const { getDockerDriverGatewayEndpoint } = dockerDriverGatewayEnv;
 const dockerDriverGatewayRuntimeMarker: typeof import("./onboard/docker-driver-gateway-runtime-marker") =
   require("./onboard/docker-driver-gateway-runtime-marker");
 const gatewayBinding: typeof import("./onboard/gateway-binding") = require("./onboard/gateway-binding");
-const hostGatewayProcess: typeof import("./onboard/host-gateway-process") =
-  require("./onboard/host-gateway-process");
 const vmDriverProcess: typeof import("./onboard/vm-driver-process") = require("./onboard/vm-driver-process");
 const preflightUtils: typeof import("./onboard/preflight") = require("./onboard/preflight");
 const clusterImagePatch: typeof import("./cluster-image-patch") = require("./cluster-image-patch");
@@ -572,9 +559,6 @@ const DIM = USE_COLOR ? "\x1b[2m" : "";
 const RESET = USE_COLOR ? "\x1b[0m" : "";
 let OPENSHELL_BIN: string | null = null;
 const GATEWAY_NAME = gatewayBinding.resolveGatewayName(GATEWAY_PORT);
-const OPENCLAW_LAUNCH_AGENT_PLIST = "~/Library/LaunchAgents/ai.openclaw.gateway.plist";
-
-const BRAVE_SEARCH_HELP_URL = "https://brave.com/search/api/";
 
 import type {
   JsonObject as LooseObject,
@@ -647,7 +631,6 @@ const {
   openshellArgv,
   runOpenshell,
   runCaptureOpenshell,
-  safeOpenShellArgument,
   getGatewayPortArg,
   getDockerDriverGatewayEndpointArg,
 } = createOpenshellCliHelpers({
@@ -708,7 +691,7 @@ const selectOnboardAgent = createSelectOnboardAgent({
 });
 
 
-const { getTransportRecoveryMessage, getProbeRecovery } = validationRecovery;
+const { getTransportRecoveryMessage } = validationRecovery;
 
 // Validation functions — delegated to src/lib/validation.ts
 const {
@@ -718,7 +701,6 @@ const {
   validateNvidiaApiKeyValue,
   isSafeModelId,
   shouldSkipResponsesProbe,
-  shouldForceCompletionsApi,
 } = validation;
 
 // validateNvidiaApiKeyValue — see validation import above
@@ -731,7 +713,6 @@ const {
   resolveHermesNousApiKey,
   stageNousApiKeyProviderEnv,
   ensureHermesNousApiKeyEnv,
-  openshellResultMessage,
   checkHermesProviderStoreReachable,
 } = hermesAuth.createHermesAuthHelpers({
   isNonInteractive,
@@ -959,7 +940,6 @@ function isInferenceRouteReady(provider: string, model: string): boolean {
 }
 
 const {
-  sandboxExistsInGateway,
   pruneStaleSandboxEntry,
   shouldRestoreLatestBackupOnRecreate,
   confirmRecreateForSelectionDrift,
@@ -974,9 +954,6 @@ const {
 
 
 const {
-  validateBraveSearchApiKey,
-  promptBraveSearchRecovery,
-  promptBraveSearchApiKey,
   ensureValidatedBraveSearchCredential,
   configureWebSearch,
   verifyWebSearchInsideSandbox,
@@ -1000,8 +977,6 @@ const {
   verifyOnboardInferenceSmoke,
   getProbeAuthMode,
   getValidationProbeCurlArgs,
-  probeOpenAiLikeEndpoint,
-  probeAnthropicEndpoint,
 } = require("./inference/onboard-probes");
 
 const {
@@ -3840,7 +3815,7 @@ async function createSandbox(
 
 type ProviderChoice = { key: string; label: string };
 
-const { readLiveInference, readRecordedProvider, readRecordedNimContainer, readRecordedModel } =
+const { readRecordedProvider, readRecordedNimContainer, readRecordedModel } =
   providerRecovery.createProviderRecoveryHelpers({
     parseGatewayInference,
     runCaptureOpenshell,
@@ -6238,7 +6213,6 @@ async function onboard(opts: OnboardOptions = {}): Promise<void> {
 
     const recordedSandboxName =
       session?.steps?.sandbox?.status === "complete" ? session?.sandboxName || null : null;
-    const resumeSandboxNameForGpu = recordedSandboxName || requestedSandboxName || null;
 
     console.log("");
     console.log(`  ${cliDisplayName()} Onboarding`);

src/lib/onboard/config-sync.test.ts

@@ -102,6 +102,7 @@ describe("sandbox config sync helpers", () => {
     try {
       const nemoclawDir = path.join(homeDir, ".nemoclaw");
       fs.mkdirSync(nemoclawDir, { mode: 0o755 });
+      fs.chmodSync(nemoclawDir, 0o755);
       const script = buildSandboxConfigSyncScript({
         endpointType: "custom",
         endpointUrl: "https://inference.local/v1",
@@ -128,6 +129,7 @@ describe("sandbox config sync helpers", () => {
     try {
       const nemoclawDir = path.join(homeDir, ".nemoclaw");
       fs.mkdirSync(nemoclawDir, { mode: 0o755 });
+      fs.chmodSync(nemoclawDir, 0o755);
       writeFakeCommand(fakeBin, "id", "1234");
       writeFakeCommand(fakeBin, "stat", "0");
       const script = buildSandboxConfigSyncScript({