fix(e2e): prepare dashboard remote bind during onboard

[jyaunches]

Summary

PR #7632 moved dashboard remote-bind coverage into unified E2E, but the target supplied NEMOCLAW_DASHBOARD_BIND only when reconnecting, after install and onboarding had generated loopback-only configuration. This change enforces the remote-bind opt-in in the target command environment so onboarding prepares remote exposure before connect.

The first exact-head replay then reached connect and re-established the dashboard forward, but the test recognized only the older background-forward message. The test now accepts the current recovery proof before its existing forward-list assertions verify the actual all-interface bind.

Changes

• Add a dashboard remote-bind environment builder that preserves the sanitized fixture PATH and keeps NEMOCLAW_DASHBOARD_BIND=0.0.0.0 fixed after command overlays.
• Use the shared environment for both install/onboarding and reconnect so the generated configuration and forward request agree.
• Recognize Dashboard port forward re-established. as proof when connect has no numeric exit code; the following assertions still require an actual forward for the sandbox and port bound to 0.0.0.0.
• Add fast E2E-support coverage for the required onboarding values, fixed remote-bind opt-in, and positive and negative connect-proof results. The helper serves only the dashboard-remote-bind live target; an install-only inline change would leave reconnect and future target commands free to drift.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: This changes only an internal live E2E target and its fast contract coverage; supported product behavior and user-facing configuration are unchanged.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Reviewed the test-only environment boundary to confirm the all-interface bind remains confined to the explicitly opted-in dashboard-remote-bind target, command overlays cannot weaken it, secrets remain scoped to the install step, and no production path changes.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: No documentation paths changed. Reviewed test/e2e/live/dashboard-remote-bind.test.ts, test/e2e/live/dashboard-remote-bind-env.ts, and test/e2e/support/dashboard-remote-bind-env.test.ts against the writing contract and controlled word list; final review approved with no findings.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — focused E2E-support tests passed 4 tests; npm run test:changed passed 4 tests; Biome and git diff --check passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — not applicable to this target-scoped live E2E environment fix.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• New Features
  • Improved remote dashboard setup so dashboard services consistently bind to all network interfaces when configured for remote access.
  • Sandbox setup now applies the selected sandbox name and supports forwarding optional inference credentials.
• Bug Fixes
  • Prevented command-level environment overrides from unintentionally disabling remote dashboard exposure.
• Tests
  • Added coverage for remote dashboard environment configuration, sandbox recreation, credential forwarding, and bind-address enforcement.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds reusable helpers for constructing remote dashboard E2E environments and detecting dashboard port-forward startup, updates the live dashboard bind test to use them, and adds coverage for environment overrides and connection output handling.

Changes

Dashboard remote bind

Layer / File(s)	Summary
Remote bind environment and connection helpers test/e2e/live/dashboard-remote-bind-env.ts	Builds the shared environment with availability-probe settings, PATH augmentation, sandbox variables, gateway configuration, and an enforced 0.0.0.0 dashboard bind; also detects successful or re-established port forwarding.
Live dashboard test integration test/e2e/live/dashboard-remote-bind.test.ts	Uses the shared environment builder and connection-start predicate for the dashboard connect contract check.
Helper behavior coverage test/e2e/support/dashboard-remote-bind-env.test.ts	Tests sandbox and PATH settings, API key forwarding, protected bind overrides, and connection detection for recovery and missing proof output.

Estimated code review effort: 3 (Moderate) | ~15 minutes

Suggested labels: area: e2e, area: sandbox

Suggested reviewers: cv, prekshivyas, aasthajh

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: preparing dashboard remote bind during onboarding in the E2E flow.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-dashboard-remote-bind-onboard

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 6f999c4 in the codex/fix-dashboard-... branch remains at 96%, unchanged from commit cd49b2f in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 6f999c4 in the codex/fix-dashboard-... branch remains at 81%, unchanged from commit cd49b2f in the main branch.

Show a code coverage summary of the most impacted files.

File	main cd49b2f	codex/fix-dashboard-... 6f999c4	+/-
src/lib/onboard/docker-cdi.ts	80%	70%	-10%
src/lib/onboard...host-anchors.ts	94%	90%	-4%
src/lib/actions...eway-restart.ts	95%	94%	-1%
src/lib/onboard/preflight.ts	80%	80%	0%
src/lib/actions...light-guards.ts	86%	90%	+4%
src/lib/onboard...box-gpu-mode.ts	92%	97%	+5%
src/lib/domain/.../connect-env.ts	89%	97%	+8%
src/lib/actions...confirmation.ts	69%	79%	+10%
src/lib/actions...ocker-health.ts	65%	82%	+17%
src/lib/onboard...box-prebuild.ts	74%	92%	+18%

---

_{Updated July 29, 2026 21:14 UTC}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/e2e/live/dashboard-remote-bind-env.ts`:
- Around line 13-14: Update the environment overlay around
buildAvailabilityProbeEnv() so PATH is derived from that helper’s returned
environment rather than raw process.env.PATH, preserving all fixture and child
PATH entries while prepending the local bin directories.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 70623481-fe0f-4d58-bf46-ff09ec39b7bc

📥 Commits

Reviewing files that changed from the base of the PR and between cd49b2f and 03dc164.

📒 Files selected for processing (3)

• test/e2e/live/dashboard-remote-bind-env.ts
• test/e2e/live/dashboard-remote-bind.test.ts
• test/e2e/support/dashboard-remote-bind-env.test.ts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, security-posture, dashboard-remote-bind

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.