fix(installer): accept the current mode-bound Station Express resume receipt (#8205)

[jason-ma-nv]

Summary

DGX Station Express writes a mode-bound resume receipt before host preparation, but the onboarding completion parser rejected that same receipt after a reboot/relogin continuation. The deployment could become fully healthy and print OpenClaw is ready, then exit nonzero while completing the session with:

Error: DGX Station Express installer resume state is malformed.

Cause: scripts/install.sh save_station_express_resume writes a ten-field receipt ending in mode=%s (install.sh:3975), but readStationExpressInstallerResumeGeneration() only accepted the legacy three-field, agent-bound six-field, and port-bound nine-field formats. The ten-field mode-bound receipt (split("\n") → 11 elements) matched no branch, so completeSession() could not validate and retire the receipt the installer itself wrote.

Fixes #8205.

Changes

• src/lib/onboard/station-express-resume.ts: add a modeFormat branch to readStationExpressInstallerResumeGeneration() that accepts the exact ten-field receipt—the nine port-bound fields plus mode=<express|provider>, with STATION_EXPRESS_RECEIPT_MODES mirroring validate_station_install_mode() in install.sh. Legacy formats stay accepted; an unknown or expanded mode is still rejected.
• src/lib/onboard/station-express-resume.test.ts: retain focused parser rejection coverage for an unknown mode without duplicating the installer's accepted receipt format.
• test/install-station-resume-cleanup.test.ts: exercise the real save_station_express_resume writer and production parser together for both express and provider, and verify that writer/parser field drift is rejected.

Verification

Run on the Ubuntu host (npm ci + plugin build, Node 22), against a clean clone of this branch:

• npm run typecheck:cli → exit 0.
• New tests with the fix: npx vitest run --project cli src/lib/onboard/station-express-resume.test.ts -t "mode-bound" → 2 passed (accept current receipt; reject unknown mode).
• Full suite with the fix: npx vitest run --project cli src/lib/onboard/station-express-resume.test.ts → 63 passed.
• Reverting only the source fix, keeping the tests: the acceptance test fails with Error: DGX Station Express installer resume state is malformed.—the exact reported failure.

Additional contract validation for the Advisor finding:

• The focused CLI and installer-integration run passed 117 tests across the parser and real writer/parser contract suites.
• Biome, test-title validation, and git diff --check passed.
• Normal pre-commit and pre-push hooks passed, including repository checks and CLI type-checking.

Documentation

No user-visible surface change. This is an internal installer-resume receipt contract, and the behavior is corrected so a healthy Station Express deployment no longer fails at session completion. No documentation update is required.

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Test-only change replaces a handwritten receipt fixture with installer-writer/parser contract coverage. No user-visible behavior or documentation changed. The review covered terminology, structure, voice, and embedded Bash presentation; no findings.
• Agent: Codex Desktop

Signed-off-by: Jason Ma jama@nvidia.com

Summary by CodeRabbit

• New Features

  • Added support for installer receipts that specify express or provider modes.
  • Continued support for existing receipt formats, including legacy and port-only formats.

• Bug Fixes

  • Invalid or unknown receipt modes are now rejected as malformed.

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 77cc677 in the fix/8205-station-exp... branch remains at 96%, unchanged from commit 8295d20 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 77cc677 in the fix/8205-station-exp... branch remains at 81%, unchanged from commit 8295d20 in the main branch.

Show a code coverage summary of the most impacted files.

File	main 8295d20	fix/8205-station-exp... 77cc677	+/-
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/onboard...press-resume.ts	78%	76%	-2%
src/lib/credentials/store.ts	56%	55%	-1%
src/lib/inferen...er-discovery.ts	88%	87%	-1%
src/lib/inferen...y-production.ts	48%	48%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%

---

_{Updated August 04, 2026 15:10 UTC}

[coderabbitai]

📝 Walkthrough

Walkthrough

Station Express resume validation now accepts exact mode-bound receipts with mode=express or mode=provider. Legacy formats remain supported. Installer tests cover valid modes, malformed modes, receipt validation, and temporary-state cleanup.

Changes

Station Express receipt handling

Layer / File(s)	Summary
Mode-bound receipt validation src/lib/onboard/station-express-resume.ts	The parser accepts exact 11-line receipts with validated fields and allowed modes. Supported legacy formats remain valid.
Installer resume contract tests src/lib/onboard/station-express-resume.test.ts, test/install-station-resume-cleanup.test.ts	Tests cover express and provider receipts, unknown modes, generation validation, temporary-home cleanup, and shared repository setup.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: area: onboarding

Suggested reviewers: apurvvkumaria, brandonpelfrey

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The parser accepts supported mode-bound and legacy receipts and rejects malformed modes, with production contract tests covering the linked issue objectives [#8205].
Out of Scope Changes check	✅ Passed	The changes remain within scope by updating receipt parsing and adding installer resume contract tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the parser change to accept the current mode-bound Station Express resume receipt.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/8205-station-express-mode-receipt

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/onboard/station-express-resume.test.ts`:
- Around line 654-669: Add a separate public-boundary acceptance test alongside
the existing ten-field receipt test that writes modeReceiptText("provider") and
verifies assertStationExpressInstallerResumeMatches does not throw. Keep the
test focused on provider-mode behavior and use the same temporary
HOME/state-directory setup and cleanup without asserting implementation details.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5e41318a-fc83-4ac2-9e17-7d4e0030b610

📥 Commits

Reviewing files that changed from the base of the PR and between 7b4c42d and ebe1584.

📒 Files selected for processing (2)

• src/lib/onboard/station-express-resume.test.ts
• src/lib/onboard/station-express-resume.ts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

2 terminology differences from the second opinion

Advisory only. These are normalized differences from the primary terminology receipt.

• provider resume receipt at test/install-station-resume-cleanup.test.ts:66: selected only by the second-opinion lane as justified.
• mode-bound receipt at src/lib/onboard/station-express-resume.test.ts:648: selected only by the second-opinion lane as justified.

3 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• ubuntu-repo-docker-post-reboot-recovery: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• spark-install: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• full-e2e: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• justified — mode-bound at src/lib/onboard/station-express-resume.test.ts:648: Keep "mode-bound" for receipts that include mode=.
• established — port-bound at src/lib/onboard/station-express-resume.ts:347: Keep "port-bound" for the port-field receipt shape.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: onboard-repair, onboard-resume, cloud-onboard

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[cv]

Reviewed the exact two-file diff and compared the parser values with validate_station_install_mode() in scripts/install.sh. The new shape remains strict about line count, field names, agents, sandbox name, policy tier, ports, mode, revision, model, and generation. I found no credential, injection, authorization, dependency, logging, cryptography, configuration, or privilege regression.

The CodeRabbit request for a separate provider acceptance test is reasonable additional contract coverage but is not a correctness blocker: express and provider use the same Set.has path, the current acceptance test exercises the ten-field shape, and the unknown-value test exercises rejection.

I cannot approve this SHA because both Advisor jobs failed, the required E2E gate is cancelled, and the branch is behind current main. Refresh it, obtain current required checks, and add the final documentation-writer review receipt with no-docs-needed evidence if the independent review confirms this internal receipt fix has no documentation impact.

[cv]

Reviewed commit d701132e0a. The only change after the prior receipt-parser review is the main merge. The ten-field mode shape remains strict and matches the installer writer; no code defect was found.

Approval is blocked by the shared main capability-union failure tracked by #8213, failed required E2E/CI, and a documentation-writer receipt that must identify this commit.

[senthilr-nv]

No blocking findings. The parser accepts only the exact mode-bound receipt shape, preserves legacy compatibility, rejects unknown modes, and the installer contract tests cover both express and provider using the real writer and public parser. CI is green. Approved.