test(wsl): align subprocess fixtures with runtime contracts

[ericksoa]

Outcome

Make the remaining WSL subprocess fixtures recognize the runtime contracts they simulate. The Ollama recovery fixture accepts both supported GNU timeout locations, and the Podman diagnostic fixture honors the command budget supplied by its caller.

Reason

WSL run 36969000132, on the merge of #12573, cleared all 13 original failures. Shards 2 and 3 passed. Two fixture failures still prevented live onboarding:

• Shard 1: the onboarding execution-proof stub recognized only /usr/bin/timeout. The newly selected /usr/bin/gnutimeout fell through to the real runner instead of receiving the fixture's successful proof response.
• Shard 4: the diagnostic collector supplied a 60-second command budget, but its test's host-command stub imposed a separate 10-second startup timeout. The real Node/tsx collector process timed out before the fixture completed.

Related issues

Refs #12285, #12281, and #12573.

Changes

• Recognize the two fixed GNU timeout paths while preserving every existing argument and command-order check in the Ollama fixture.
• Run the existing recovery case for both paths with a failing unmatched-command fallback. The previous default no-op fallback could return zero for an unrecognized wrapped command, leaving the test unable to detect the missing path.
• Pass the collector's requested timeoutMs into its real child process and give the surrounding test cleanup headroom. Retain the assertions for successful execution, empty stderr, and the collector's exact serialized result.

Verification

• npx vitest run --project integration --project e2e-support test/helpers/onboard-child-runtime.test.ts test/e2e/support/podman-owner-diagnostic.test.ts — all 26 tests passed.
• Targeted test/onboarding/onboard-selection.test.ts systemd-timeout recovery case — passed. The same case also passed in a temporary fixture forcing prefixed-GNU availability, with its original assertions unchanged.
• GNU fixture regression — the prefixed path failed before the matcher repair and passed afterward.
• Cold-start reproduction — a temporary 10.5-second Node preload reproduced the old 10-second timeout; the corrected fixture completed successfully under the requested budget. Temporary reproduction files were removed.
• Growth guardrails — all seven passed. Normal signed-commit hooks passed.
• Publication validation and CLI type checking — passed. Commit 326fa28b71668ee89599f93b6daaa3b9ee0ba3bd is GitHub Verified.
• Diff inspected for secrets, API keys, and credentials; none found.
• Actual WSL validation remains pending. The main-only platform workflow must run the four WSL shards and live onboarding before success on that runner can be claimed.

Review notes

This three-file change is limited to test fixtures and their coverage; it does not alter runtime behavior or validation assertions. It adds one table case for the prefixed GNU path. Self-review checked the diff against 5b3bd580c9b6496c9dd9e095bd9db53f9d0e6b29, including preservation of unsupported-command rejection and diagnostic-result checks. Automated CI and review are pending.

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Runtime detection now recognizes GNU timeout when available under either of its supported executable names.
• Tests
  • Expanded coverage for both executable names and timeout-handling scenarios.
  • Applied a shared timeout limit to the diagnostic test.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (1)

test/README.md — configured

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: NVIDIA/NemoClaw/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1d68f3b1-86b7-477b-bba3-4640e919c975

📥 Commits

Reviewing files that changed from the base of the PR and between 5b3bd58 and 326fa28.

📒 Files selected for processing (3)

• test/e2e/support/podman-owner-diagnostic.test.ts
• test/helpers/onboard-child-runtime.test.ts
• test/helpers/onboard-child-runtime.ts

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The Podman diagnostic test now uses the shared test timeout and passes it to its command mock. Child-runtime proof matching now accepts /usr/bin/gnutimeout, and the fallback-order test covers both timeout executable paths.

Changes

Podman diagnostic test timeout

Layer / File(s)	Summary
Apply shared timeout to collector test test/e2e/support/podman-owner-diagnostic.test.ts	The collector test uses testTimeout(65_000) and passes the supplied timeout to spawnSync. Existing output and successful-execution assertions remain.

Child-runtime proof matching

Layer / File(s)	Summary
Match timeout executables in fallback tests test/helpers/onboard-child-runtime.ts, test/helpers/onboard-child-runtime.test.ts	The direct service-user proof matcher accepts /usr/bin/gnutimeout. The fallback-order test runs for both timeout paths and checks the systemd timeout, timeout-first recovery, and rejection of sudo-first ordering.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: deepujain

Merge Risk: ⚪ Minimal · up to 326fa

This change only updates test fixtures to match the subprocess behavior they simulate, so it has no production impact. It is low risk to merge; real WSL validation is still pending in the platform workflow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating WSL subprocess test fixtures to match runtime contracts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 326fa28 in the fix/wsl-remaining-fi... branch is 97%. The line coverage in commit 63002cd in the main branch is 96%.

Show a line coverage summary of the most impacted files.

File	main 63002cd	fix/wsl-remaining-fi... 326fa28	+/-
nemoclaw/src/onboard/config.ts	98%	96%	-2%
nemoclaw/src/index.ts	94%	93%	-1%
nemoclaw/src/bl...t-management.ts	100%	100%	0%
nemoclaw/src/co.../config-show.ts	100%	100%	0%
nemoclaw/src/commands/slash.ts	100%	100%	0%
nemoclaw/src/on...native-route.ts	0%	100%	+100%

TypeScript / code-coverage/cli

The overall line coverage in commit 326fa28 in the fix/wsl-remaining-fi... branch is 85%. The line coverage in commit 63002cd in the main branch is 84%.

Show a line coverage summary of the most impacted files.

File	main 63002cd	fix/wsl-remaining-fi... 326fa28	+/-
src/lib/actions.../status-text.ts	84%	46%	-38%
src/lib/onboard...al-inference.ts	84%	90%	+6%
src/lib/inferen...file/cleanup.ts	73%	80%	+7%
src/lib/state/p...l-retirement.ts	79%	89%	+10%
src/lib/onboard.../application.ts	55%	72%	+17%
src/lib/onboard...mage/catalog.ts	69%	90%	+21%
src/lib/securit...zer-boundary.ts	0%	85%	+85%
src/lib/adapter...gnostics-cli.ts	0%	87%	+87%
src/lib/onboard...ternal-image.ts	0%	94%	+94%
src/lib/securit...ig-structure.ts	0%	94%	+94%

---

_{Updated October 02, 2026 06:58 UTC}

[github-actions]

PR Review Advisor finished for commit 326fa28. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

Request review only when Require no Advisor blockers is green.

All previous runs