feat(gateway): manage the default gateway service

[sandl99]

Summary

NemoClaw now gives its default OpenShell gateway on port 8080 an explicit host-service owner: a validated systemd user service on Linux or the official Homebrew service on Apple Silicon. NemoClaw-managed custom ports retain the detached-process lifecycle, while a declared external supervisor retains authority on any matching port.

Related Issue

Fixes #6903

Product Scope

Verdict: PASS. Issue #6903 contains the member-authored lifecycle, ownership, compatibility, security, and validation decision for the managed default gateway, and the decision is incorporated into the #7209 release-validation tracker. The refreshed implementation also preserves main's separately accepted external-supervisor contract from #7246.

This product-scope verdict is based on those design records. It is separate from, and does not infer approval from, GitHub's mergeStateStatus.

Changes

• Implement the Install and uninstall a managed OpenShell gateway service for reboot persistence #6903 managed-service design for the default gateway port.
• Validate systemd and Homebrew service identity, executable paths, listeners, TLS/auth configuration, health, and XDG-managed environment state before changing lifecycle ownership.
• Stage but do not start NemoClaw's marked Linux user unit during install; onboarding selects and starts it only after configuration and port ownership are valid.
• Preserve detached-process behavior for NemoClaw-managed custom ports and platforms without the selected service manager.
• Preserve main's externally supervised lifecycle authority on both default and custom ports.
• Keep installer staging, runtime service identity, and reboot recovery aligned with absolute XDG_BIN_HOME and XDG_CONFIG_HOME values, while retaining their default paths.
• Remove only NemoClaw-owned service and environment state during managed uninstall while preserving upstream, Homebrew, and externally supervised resources.
• Add focused unit, installer, uninstall, lifecycle, reboot-recovery, adversarial-file, and documentation-contract coverage.
• Update platform, command, architecture, uninstall, and troubleshooting documentation.

The service-selection path is required by #6903 so reboot ownership is explicit. Starting another detached process cannot provide that contract; the gateway service, installer service, uninstall, and lifecycle suites protect the selection and ownership boundaries.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: automated exact-head nine-category review passed for head 617cbc1d62 and base d3162e3422; independent human sensitive-path review remains outstanding.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: Reviewed docs/get-started/prerequisites.mdx, docs/manage-sandboxes/uninstall-nemoclaw.mdx, docs/reference/architecture.mdx, docs/reference/commands.mdx, docs/reference/platform-support.mdx, and docs/reference/troubleshooting.mdx at PR SHA 617cbc1d6 against base SHA d3162e342. Verified the complete exact-head/base diff, terminology, product-scope boundaries, lifecycle and uninstall accuracy, recovery commands, and code-sample presentation against WRITING.md and docs/CONTRIBUTING.md; the readiness merge resolution preserves supplied environment input plus main’s Node 25 SNI behavior; git diff --check passed.
• Agent: Codex Desktop documentation-writer subagent /root/pr7319_docs_review_118571

DGX Station Hardware Evidence

Not applicable; scripts/prepare-dgx-station-host.sh is unchanged.

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 183 changed CLI tests; 36 changed E2E-support tests; 116 changed integration tests with 1 skipped; 40 installer-integration tests with 1 skipped. Follow-up behavior head d07a0576b: 8 authority tests passed; the macOS E2E command passed 9 tests with 2 environment-skipped. Credential-sanitization fix: E2E-support passed 1,595 tests with 12 skipped, and the focused live test collected successfully without executing credentialed actions. Exact refreshed head 33bb483259: gateway-service runtime tests passed 21/21, installer service tests passed 9/9, polling-helper tests passed 3/3, sandbox-provisioning tests passed 62/62, the live test collected successfully, test-size and CLI type checks passed, the documentation build passed, and the complete canonical-base diff-aware hook gate passed. Exact head d5e9e2d916: all 8 GPU rollback tests passed with deterministic terminal-phase fixtures. Exact refreshed head 2788106318: 82 focused CLI tests and 68 provisioning/uninstall integration tests passed, the documentation build passed, and normal pre-commit and commit-message hooks passed. Exact head ea29c8b28b: all 7 gateway-service uninstall tests passed after the current-main fixture update, and normal pre-commit and commit-message hooks passed. Exact refreshed head da79a35c73: 45 CLI recovery/service tests and 10 process-recovery integration tests passed. Exact refreshed head b0e9c86ceb: 133 focused Perl-runtime, sandbox-provisioning, runner, and workflow-boundary tests passed outside the restricted sandbox; the canonical-base pre-commit, commit-message, and pre-push hook suites passed. Exact head 9a3148c0aa: 20 focused lifecycle/E2E-support tests passed after formatter output, staged pre-commit/security hooks passed, canonical-base pre-push checks passed, and the docs build passed. Exact refreshed head ed20dfd741: 49 focused lifecycle and E2E scorecard tests passed; canonical-base pre-commit/security, commit-message, and pre-push hooks passed; the docs build passed. Exact refreshed head 34fbcfb4ad: 182 focused service, lifecycle, installer, and E2E scorecard tests passed outside the restricted sandbox; canonical-base pre-commit/security, commit-message, and pre-push hooks passed; the docs build passed. Exact refreshed head 611b8fe05f: the expanded service, lifecycle, installer, Hermes, and workflow suite passed 259 tests with 12 expected skips; canonical-base pre-commit/security, commit-message, and pre-push hooks passed; the docs build passed. Exact refreshed head 0a69b289ac: the expanded service, lifecycle, installer, Hermes, and workflow suite passed 261 tests with 12 expected skips; canonical-base pre-commit/security, commit-message, and pre-push hooks passed; the docs build passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: not run locally; the required full CI and exact-pair E2E gates are being monitored.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — passed with 0 errors and 2 existing Fern warnings.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only) — not applicable; this PR changes existing pages.

---

Signed-off-by: San Dang sdang@nvidia.com

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

This PR adds managed OpenShell gateway installation and lifecycle handling across Linux and Apple Silicon macOS, including service ownership, port validation, secure environment-file updates, uninstall cleanup, reboot recovery, installer pinning, tests, and documentation.

Changes

Gateway lifecycle and platform support

Layer / File(s)	Summary
Installer and platform service setup scripts/install-openshell.sh, scripts/install.sh, scripts/checks/*, scripts/lib/*, test/install-*, docs/reference/platform-support.mdx, ci/platform-matrix.json	Adds pinned Apple Silicon Homebrew formula installation, NemoClaw-managed Linux systemd user-service staging, strict installer asset verification, and platform-specific gateway guidance.
Gateway service authority and onboarding src/lib/onboard/docker-driver-gateway-service.ts, src/lib/onboard/docker-driver-gateway-port-listener.ts, src/lib/onboard.ts, src/lib/onboard/docker-driver-gateway-runtime.ts, src/lib/onboard/docker-driver-gateway-cutover.ts	Resolves trusted gateway services, validates listener ownership, wires service startup and health checks, and distinguishes managed-service processes during gateway reuse.
Gateway environment and safe file handling src/lib/onboard/docker-driver-gateway-env.ts, src/lib/adapters/fs/regular-file.ts, src/lib/onboard/gateway-http-readiness.ts, related tests	Validates and quotes local DOCKER_HOST socket values, supports injected environment/config roots, avoids symlink-following writes, and handles TLS readiness for IP endpoints.
Owned gateway uninstall cleanup src/lib/actions/uninstall/run-plan.ts, src/lib/actions/uninstall/*test.ts, docs/manage-sandboxes/uninstall-nemoclaw.mdx, docs/reference/commands.mdx	Removes only NemoClaw-managed default-port service and environment artifacts, preserves foreign or upstream resources, and implements --keep-openshell semantics.
Reboot recovery and validation test/e2e/fixtures/phases/lifecycle.ts, test/e2e/support/*, test/e2e/registry/*, docs/reference/troubleshooting.mdx, docs/reference/architecture.mdx	Restarts the managed user service during post-reboot recovery, waits for gateway connectivity, and updates expected-state and troubleshooting procedures.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related issues

• NemoClaw cold-boot gateway recovery starts a gateway, then rolls it back #7418 — Addresses related managed supervisor startup and cold-boot gateway recovery behavior.
• [Ubuntu 24.04][Sandbox] After reboot: sandbox container exit-0 crash-loops (reliable) and connect recovery can recreate the container and lose /sandbox/.openclaw/workspace/ (observed once) #7404 — Covers related post-reboot gateway-service recovery, though not the sandbox recreation path.

Possibly related PRs

• NVIDIA/NemoClaw#7351 — Both modify uninstall cleanup scoping in run-plan.ts.
• NVIDIA/NemoClaw#7374 — Both update installer trust and openshell.rb pin handling.

Suggested labels: security, area: docs

Suggested reviewers: ericksoa, cv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 6.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR implements a durable default gateway service, preserves upstream services, handles uninstall, and updates tests/docs as required by #6903.
Out of Scope Changes check	✅ Passed	The changed files all support gateway service ownership, install/uninstall, recovery, or the required test/docs updates; no clear unrelated work stands out.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: managing the default gateway service for supported platforms.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/6903-managed-gateway-service-v2

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7319.docs.buildwithfern.com/nemoclaw

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 617cbc1 in the fix/6903-managed-gat... branch remains at 96%, unchanged from commit d3162e3 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 617cbc1 in the fix/6903-managed-gat... branch is 81%. The coverage in commit 66f9383 in the main branch is 80%.

Show a code coverage summary of the most impacted files.

File	main 66f9383	fix/6903-managed-gat... 617cbc1	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/onboard...ort-listener.ts	100%	95%	-5%
src/lib/onboard...or-reconnect.ts	86%	83%	-3%
src/lib/platform.ts	84%	89%	+5%
src/lib/onboard...eway-service.ts	76%	82%	+6%
src/lib/onboard...ndbox-create.ts	83%	91%	+8%
src/lib/onboard...ess-identity.ts	90%	100%	+10%
src/lib/onboard...-create-plan.ts	75%	88%	+13%
src/lib/onboard...ndbox-create.ts	33%	83%	+50%
src/lib/adapter...regular-file.ts	0%	91%	+91%

---

_{Updated July 25, 2026 21:37 UTC}

[coderabbitai]

🧹 Nitpick comments (6)

scripts/install-openshell.sh (2)

650-651: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Harden the curl fallback with timeouts and TLS options.

Unlike fetch_file in scripts/check-installer-hash.sh (which uses --proto '=https' --tlsv1.2 --connect-timeout 10 --max-time 30 --retry), this fallback runs a bare curl -fL -sS. A stalled endpoint can hang the installer indefinitely, and the downloaded openshell.rb is subsequently executed by Homebrew. Consider matching the hardened flags for consistent timeout/TLS behavior.

🛡️ Proposed change

-  curl -fL -sS "https://github.com/NVIDIA/OpenShell/releases/download/${release_tag}/openshell.rb" \
-    -o "$output"
+  curl --proto '=https' --tlsv1.2 -fL -sS \
+    --connect-timeout 10 --max-time 30 --retry 3 --retry-delay 1 --retry-all-errors \
+    "https://github.com/NVIDIA/OpenShell/releases/download/${release_tag}/openshell.rb" \
+    -o "$output"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/install-openshell.sh` around lines 650 - 651, Harden the curl
invocation in the fallback download flow by adding enforced HTTPS/TLS 1.2,
connection and total timeouts, and retry behavior consistent with fetch_file.
Keep the existing release URL, output path, and fail/silent/show-error behavior
unchanged.

---

781-786: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Make the standalone-fallback warning conditional on the missing brew.

The warn "Homebrew is not installed…" is placed unconditionally after the inner if, so it is correct only because install_macos_homebrew_formula always exits. If that function is ever changed to return on a path, this branch would print "Homebrew is not installed" on a host where Homebrew is installed and then fall through to the standalone gateway. Move the warning into an explicit else.

♻️ Proposed structure

 if [ "$OS" = "Darwin" ]; then
   if command -v brew >/dev/null 2>&1; then
     install_macos_homebrew_formula
+  else
+    warn "Homebrew is not installed; installing the standalone OpenShell gateway without reboot persistence."
   fi
-  warn "Homebrew is not installed; installing the standalone OpenShell gateway without reboot persistence."
 fi

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/install-openshell.sh` around lines 781 - 786, In the Darwin branch,
update the Homebrew check around install_macos_homebrew_formula so the
standalone-fallback warning runs only in an explicit else branch when brew is
unavailable. Preserve the existing formula installation path without warning or
falling through when command -v brew succeeds.

scripts/install.sh (1)

1366-1388: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Keep the OpenShell unit definition single-sourced scripts/install.sh:1366-1388 duplicates buildNemoclawOpenShellGatewayUserService in src/lib/onboard/docker-driver-gateway-service.ts; add a parity test or generate one from the other so the marker, EnvironmentFile, and ExecStartPre args don’t drift.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/install.sh` around lines 1366 - 1388, The OpenShell gateway
user-service definition is duplicated between the installer heredoc and
buildNemoclawOpenShellGatewayUserService. Make one source authoritative or add a
parity test covering the marker, EnvironmentFile, and ExecStartPre
certificate-generation arguments, so both definitions remain synchronized.

src/lib/onboard.ts (1)

1984-2015: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy lift

Move port-ownership policy into a focused gateway module.

These helpers add ownership decisions and lifecycle failure policy to src/lib/onboard.ts; keep this entrypoint to dependency wiring and invoke a focused service/helper instead.

As per path instructions, src/lib/onboard.ts must remain entry setup and dependency wiring, while lifecycle effects belong in focused services.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/onboard.ts` around lines 1984 - 2015, Move reportUntrustedGatewayPort
and validateServicePortOwner out of the onboard entrypoint into a focused
gateway port-ownership service/helper. Keep the ownership validation and
exit/throw behavior unchanged, and update src/lib/onboard.ts to wire
dependencies and invoke that service rather than implementing lifecycle policy
locally.

Source: Path instructions

src/lib/actions/uninstall/run-plan.ts (1)

763-862: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Hardcoded fs.* calls bypass the existing runtime DI pattern.

removeNemoclawOpenShellGatewayUserService and removeNemoclawOpenShellGatewayEnv call fs.lstatSync, fs.readFileSync, fs.writeFileSync, and fs.chmodSync directly, while every other filesystem/process interaction in this file goes through the injectable UninstallRuntime (existsSync, rmSync, run). This is why the companion test (run-plan-gateway-service.test.ts) has to fall back to vi.spyOn(fs, "readFileSync") on the real module to simulate a read failure, instead of injecting a fake through deps/runtime like the rest of the suite does.

Consider adding these as injectable functions on UninstallRunDeps/UninstallRuntime for consistency with the rest of the file and to avoid global module monkey-patching in tests.

As per path instructions, "actions orchestrate, domain modules make pure decisions, adapters own host/process/network boundaries, and state modules own persisted files and state I/O," and src/lib/README.md notes to "avoid adding host-boundary/process/filesystem/OS concerns to domain logic... those belong in src/lib/adapters/** so tests can inject fakes."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/actions/uninstall/run-plan.ts` around lines 763 - 862, Replace the
direct filesystem calls in removeNemoclawOpenShellGatewayUserService and
removeNemoclawOpenShellGatewayEnv with injectable operations exposed through
UninstallRunDeps and UninstallRuntime, including lstat, read, write, and chmod
as needed. Thread the implementations through the runtime construction and
update callers/tests to inject fakes, eliminating reliance on global fs spies
while preserving the existing behavior and error handling.

Source: Path instructions

src/lib/actions/uninstall/run-plan-gateway-segregation.test.ts (1)

519-522: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Import the shared gateway marker constant here. This fixture duplicates the marker string; reusing NEMOCLAW_OPENSHELL_GATEWAY_USER_SERVICE_MARKER_LINE keeps the test aligned with the source of truth and avoids future drift.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/actions/uninstall/run-plan-gateway-segregation.test.ts` around lines
519 - 522, Update the fixture in the relevant uninstall plan test to import and
reuse NEMOCLAW_OPENSHELL_GATEWAY_USER_SERVICE_MARKER_LINE instead of duplicating
the gateway marker string in fs.writeFileSync. Preserve the existing service
content and formatting while sourcing the marker from the shared constant.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@scripts/install-openshell.sh`:
- Around line 650-651: Harden the curl invocation in the fallback download flow
by adding enforced HTTPS/TLS 1.2, connection and total timeouts, and retry
behavior consistent with fetch_file. Keep the existing release URL, output path,
and fail/silent/show-error behavior unchanged.
- Around line 781-786: In the Darwin branch, update the Homebrew check around
install_macos_homebrew_formula so the standalone-fallback warning runs only in
an explicit else branch when brew is unavailable. Preserve the existing formula
installation path without warning or falling through when command -v brew
succeeds.

In `@scripts/install.sh`:
- Around line 1366-1388: The OpenShell gateway user-service definition is
duplicated between the installer heredoc and
buildNemoclawOpenShellGatewayUserService. Make one source authoritative or add a
parity test covering the marker, EnvironmentFile, and ExecStartPre
certificate-generation arguments, so both definitions remain synchronized.

In `@src/lib/actions/uninstall/run-plan-gateway-segregation.test.ts`:
- Around line 519-522: Update the fixture in the relevant uninstall plan test to
import and reuse NEMOCLAW_OPENSHELL_GATEWAY_USER_SERVICE_MARKER_LINE instead of
duplicating the gateway marker string in fs.writeFileSync. Preserve the existing
service content and formatting while sourcing the marker from the shared
constant.

In `@src/lib/actions/uninstall/run-plan.ts`:
- Around line 763-862: Replace the direct filesystem calls in
removeNemoclawOpenShellGatewayUserService and removeNemoclawOpenShellGatewayEnv
with injectable operations exposed through UninstallRunDeps and
UninstallRuntime, including lstat, read, write, and chmod as needed. Thread the
implementations through the runtime construction and update callers/tests to
inject fakes, eliminating reliance on global fs spies while preserving the
existing behavior and error handling.

In `@src/lib/onboard.ts`:
- Around line 1984-2015: Move reportUntrustedGatewayPort and
validateServicePortOwner out of the onboard entrypoint into a focused gateway
port-ownership service/helper. Keep the ownership validation and exit/throw
behavior unchanged, and update src/lib/onboard.ts to wire dependencies and
invoke that service rather than implementing lifecycle policy locally.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 0af3104d-53b3-4139-8b54-de15ab5b5eba

📥 Commits

Reviewing files that changed from the base of the PR and between d5fa194 and 2469e0b.

📒 Files selected for processing (40)

• ci/platform-matrix.json
• ci/source-shape-test-budget.json
• docs/get-started/prerequisites.mdx
• docs/manage-sandboxes/uninstall-nemoclaw.mdx
• docs/reference/architecture.mdx
• docs/reference/commands.mdx
• docs/reference/platform-support.mdx
• docs/reference/troubleshooting.mdx
• scripts/check-installer-hash.sh
• scripts/checks/extract-installer-pins.mts
• scripts/install-openshell.sh
• scripts/install.sh
• src/lib/actions/uninstall/run-plan-gateway-segregation.test.ts
• src/lib/actions/uninstall/run-plan-gateway-service.test.ts
• src/lib/actions/uninstall/run-plan.test.ts
• src/lib/actions/uninstall/run-plan.ts
• src/lib/onboard.ts
• src/lib/onboard/docker-driver-gateway-env-deb-override.test.ts
• src/lib/onboard/docker-driver-gateway-env-service.test.ts
• src/lib/onboard/docker-driver-gateway-env.test.ts
• src/lib/onboard/docker-driver-gateway-env.ts
• src/lib/onboard/docker-driver-gateway-port-listener.test.ts
• src/lib/onboard/docker-driver-gateway-port-listener.ts
• src/lib/onboard/docker-driver-gateway-service.test.ts
• src/lib/onboard/docker-driver-gateway-service.ts
• src/lib/onboard/gateway-binding.test.ts
• src/lib/onboard/gateway-binding.ts
• src/lib/onboard/gateway-http-readiness.test.ts
• src/lib/onboard/gateway-http-readiness.ts
• src/lib/onboard/openshell-install.ts
• test/e2e/fixtures/phases/lifecycle.ts
• test/e2e/registry/definitions/baseline.ts
• test/e2e/registry/expected-states.ts
• test/e2e/support/e2e-expected-state.test.ts
• test/e2e/support/e2e-phase-lifecycle.test.ts
• test/install-openshell-gateway-service.test.ts
• test/install-openshell-version-check.test.ts
• test/installer-hash-check.test.ts
• test/onboard-gateway-prelaunch-cutover.test.ts
• test/reboot-recovery-docs.test.ts

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 5 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections differ; Nemotron reported the same number of blockers, 5 more warnings, the same number of suggestions.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture, full-e2e, onboard-repair, onboard-resume

3 optional E2E recommendations

• ubuntu-repo-docker-post-reboot-recovery
• gateway-guard-recovery
• gateway-health-honest

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

🧹 Nitpick comments (2)

src/lib/adapters/fs/regular-file.ts (1)

36-46: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

readUtf8 is not idempotent across repeated calls.

fs.readFileSync(descriptor, ...) reads from the fd's current position and advances it; a second readUtf8() call on the same OpenRegularFile would return an empty string rather than the file content again, since the descriptor is already at EOF. replaceUtf8 avoids this by using an explicit position (0), but readUtf8 doesn't. No current caller reads twice, but this is a silent-data-loss footgun for a shared, reusable adapter (used for credential/env files) if a future caller reads more than once per instance.

🛡️ Proposed fix: read via explicit position

   return {
     close,
-    readUtf8: () => String(fs.readFileSync(descriptor, "utf-8")),
+    readUtf8: () => {
+      const size = fs.fstatSync(descriptor).size;
+      const buffer = Buffer.alloc(size);
+      fs.readSync(descriptor, buffer, 0, size, 0);
+      return buffer.toString("utf-8");
+    },
     replaceUtf8: (contents, mode) => {

Node's own docs/issue tracker confirm read-via-fd continues from the current position rather than always starting at the beginning, which is the mechanism behind this concern.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/adapters/fs/regular-file.ts` around lines 36 - 46, Update the
readUtf8 method in the returned OpenRegularFile adapter to read from offset 0
explicitly, matching replaceUtf8’s positioned I/O, so repeated calls always
return the full file contents without depending on the descriptor’s current
position.

src/lib/actions/uninstall/run-plan.ts (1)

767-883: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Split the two Linux gateway-cleanup helpers to reduce complexity.

removeNemoclawOpenShellGatewayUserService and removeNemoclawOpenShellGatewayEnv each mix open/read/validate/disable/remove/reload steps in one function body, matching the tool's own code_block_complexity_high signal for this range. Extracting the "read + validate marker" step from the "disable/remove/reload" step (and similarly for the env cleanup) would make each piece independently testable and easier to reason about.

As per coding guidelines, "Keep function complexity low and avoid introducing unnecessary complexity hotspots."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/actions/uninstall/run-plan.ts` around lines 767 - 883, Split
removeNemoclawOpenShellGatewayUserService into focused helpers for reading and
validating the managed service marker and for disabling, removing, and reloading
the service, preserving its current return and warning behavior. Similarly
decompose removeNemoclawOpenShellGatewayEnv so file access/content preservation
and deletion are handled by smaller independently testable helpers. Keep the
existing public helper names and cleanup outcomes unchanged.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/lib/actions/uninstall/run-plan.ts`:
- Around line 767-883: Split removeNemoclawOpenShellGatewayUserService into
focused helpers for reading and validating the managed service marker and for
disabling, removing, and reloading the service, preserving its current return
and warning behavior. Similarly decompose removeNemoclawOpenShellGatewayEnv so
file access/content preservation and deletion are handled by smaller
independently testable helpers. Keep the existing public helper names and
cleanup outcomes unchanged.

In `@src/lib/adapters/fs/regular-file.ts`:
- Around line 36-46: Update the readUtf8 method in the returned OpenRegularFile
adapter to read from offset 0 explicitly, matching replaceUtf8’s positioned I/O,
so repeated calls always return the full file contents without depending on the
descriptor’s current position.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f766cc62-694b-4697-8e22-b8cc0acd6c0b

📥 Commits

Reviewing files that changed from the base of the PR and between 66a424c and 8a3334a.

📒 Files selected for processing (8)

• scripts/checks/extract-installer-pins.mts
• scripts/install-openshell.sh
• src/lib/actions/uninstall/run-plan-gateway-segregation.test.ts
• src/lib/actions/uninstall/run-plan-gateway-service.test.ts
• src/lib/actions/uninstall/run-plan.ts
• src/lib/adapters/fs/regular-file.test.ts
• src/lib/adapters/fs/regular-file.ts
• test/install-openshell-gateway-service.test.ts

🚧 Files skipped from review as they are similar to previous changes (3)

• test/install-openshell-gateway-service.test.ts
• scripts/checks/extract-installer-pins.mts
• scripts/install-openshell.sh

[senthilr-nv]

Reviewed the file changes for PR #7319 at head da79a35 against base 9aaca48. I approve this exact revision for squash merge once all required CI and E2E gates pass. This approval is limited to this head/base pair and must be renewed if either SHA changes.