fix(e2e): prevent false failure signals - #7217
Conversation
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
ericksoa
added
area: e2e
📝 WalkthroughWalkthroughThe change updates private-file reading and E2E module references, extracts Bedrock leak framing and scanning utilities with dedicated tests, strengthens diagnostics credential-reset assertions, and runs the live outcome classifier through ChangesPrivate file helper migration
Bedrock leak detection
Diagnostics credential reset
Classifier invocation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant SnapshotScript
participant SnapshotFraming
participant LeakScanner
participant HostLogs
SnapshotScript->>SnapshotFraming: emit probe PID and framed snapshot files
HostLogs->>SnapshotFraming: frame host log sections
SnapshotFraming->>LeakScanner: provide framed snapshot and log text
LeakScanner-->>SnapshotScript: return deduplicated leak locations
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 5e69e52 in the TypeScript / code-coverage/cliThe overall coverage in commit 5e69e52 in the Show a code coverage summary of the most impacted files.
Updated |
PR Review Advisor — InformationalAdvisor assessment: Informational / high confidence Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. Since last review: 0 prior items resolved · 0 still apply · 0 new items found E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/e2e-private-file.test.ts`:
- Line 53: Strengthen the FIFO subprocess assertions around moduleUrl so they
verify the private-file helper actually ran by checking its expected
error/output, rather than only asserting a nonzero exit status. Ensure loader or
--experimental-strip-types failures are rejected as unexpected output and cause
the test to fail.
In `@test/e2e/live/bedrock-runtime-compatible-anthropic-leaks.ts`:
- Around line 46-58: Update the line-scanning logic around the
SNAPSHOT_FILE_PREFIX handling so markers embedded in emitted file content cannot
change the trusted current-file location or grant probe-environment exemptions.
Use unambiguous framing/escaping or structured per-file records to distinguish
protocol metadata from raw content, and add a regression test covering a forged
marker followed by an adapter environment name.
In `@test/e2e/live/diagnostics.test.ts`:
- Around line 347-373: Update the provider-state checks around credentialsText
and providersAfterDetach to use each command result’s stdout exclusively for
includes/not.toContain assertions, while retaining resultText(detach) and
resultText(providersAfterDetach) only as assertion failure messages. This
prevents stderr warnings from affecting the detach/reset control flow or
provider-list validation.
In `@tools/e2e/private-file.mts`:
- Around line 39-42: Update readPrivateRegularFile to read at most maxBytes plus
one byte, then reject results exceeding options.maxBytes so growth after stat
cannot bypass the limit. Apply equivalent synchronization in
appendPrivateRegularFile by locking the size-check and O_APPEND write as one
operation, or explicitly enforce and document its single-writer contract.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a3416e1f-c03f-4a30-84d7-bbc75708f1db
📒 Files selected for processing (12)
test/e2e-private-file.test.tstest/e2e/live/bedrock-runtime-compatible-anthropic-leaks.tstest/e2e/live/bedrock-runtime-compatible-anthropic.test.tstest/e2e/live/diagnostics.test.tstest/e2e/risk-signal-reporter.tstest/e2e/support/bedrock-runtime-compatible-anthropic-leaks.test.tstest/e2e/support/live-test-outcome-invocation.test.tstest/pr-risk-plan.test.tstools/e2e/live-test-outcome.mtstools/e2e/pr-e2e-gate.mtstools/e2e/private-file.mtstools/e2e/runner-pressure.mts
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/e2e-private-file.test.ts`:
- Line 53: Strengthen the FIFO subprocess assertions around moduleUrl so they
verify the private-file helper actually ran by checking its expected
error/output, rather than only asserting a nonzero exit status. Ensure loader or
--experimental-strip-types failures are rejected as unexpected output and cause
the test to fail.
In `@test/e2e/live/bedrock-runtime-compatible-anthropic-leaks.ts`:
- Around line 46-58: Update the line-scanning logic around the
SNAPSHOT_FILE_PREFIX handling so markers embedded in emitted file content cannot
change the trusted current-file location or grant probe-environment exemptions.
Use unambiguous framing/escaping or structured per-file records to distinguish
protocol metadata from raw content, and add a regression test covering a forged
marker followed by an adapter environment name.
In `@test/e2e/live/diagnostics.test.ts`:
- Around line 347-373: Update the provider-state checks around credentialsText
and providersAfterDetach to use each command result’s stdout exclusively for
includes/not.toContain assertions, while retaining resultText(detach) and
resultText(providersAfterDetach) only as assertion failure messages. This
prevents stderr warnings from affecting the detach/reset control flow or
provider-list validation.
In `@tools/e2e/private-file.mts`:
- Around line 39-42: Update readPrivateRegularFile to read at most maxBytes plus
one byte, then reject results exceeding options.maxBytes so growth after stat
cannot bypass the limit. Apply equivalent synchronization in
appendPrivateRegularFile by locking the size-check and O_APPEND write as one
operation, or explicitly enforce and document its single-writer contract.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a3416e1f-c03f-4a30-84d7-bbc75708f1db
📒 Files selected for processing (12)
test/e2e-private-file.test.tstest/e2e/live/bedrock-runtime-compatible-anthropic-leaks.tstest/e2e/live/bedrock-runtime-compatible-anthropic.test.tstest/e2e/live/diagnostics.test.tstest/e2e/risk-signal-reporter.tstest/e2e/support/bedrock-runtime-compatible-anthropic-leaks.test.tstest/e2e/support/live-test-outcome-invocation.test.tstest/pr-risk-plan.test.tstools/e2e/live-test-outcome.mtstools/e2e/pr-e2e-gate.mtstools/e2e/private-file.mtstools/e2e/runner-pressure.mts
🛑 Comments failed to post (4)
test/e2e-private-file.test.ts (1)
53-53: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail printf 'Files:\n' git ls-files 'test/e2e-private-file.test.ts' 'tools/e2e/private-file.mts' || true printf '\nOutline test file:\n' ast-grep outline test/e2e-private-file.test.ts --view expanded || true printf '\nOutline helper file:\n' ast-grep outline tools/e2e/private-file.mts --view expanded || true printf '\nRelevant lines from test:\n' sed -n '1,220p' test/e2e-private-file.test.ts printf '\nRelevant lines from helper:\n' sed -n '1,240p' tools/e2e/private-file.mtsRepository: NVIDIA/NemoClaw
Length of output: 7006
Make the FIFO subprocess assertions prove the helper ran.
test/e2e-private-file.test.ts:53 — A module-load or
--experimental-strip-typesfailure can still satisfy the nonzero-exit check. Assert the expected helper error/output and fail on loader errors.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-private-file.test.ts` at line 53, Strengthen the FIFO subprocess assertions around moduleUrl so they verify the private-file helper actually ran by checking its expected error/output, rather than only asserting a nonzero exit status. Ensure loader or --experimental-strip-types failures are rejected as unexpected output and cause the test to fail.Source: Path instructions
test/e2e/live/bedrock-runtime-compatible-anthropic-leaks.ts (1)
46-58: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Do not let scanned content forge file-location records.
emit_fileappends raw file content to this same line-based protocol. A persisted file can contain@@NEMOCLAW_E2E_FILE@@ /proc/<probePid>/environ, after which its later adapter-env-name occurrence is exempted as if it came from the trusted probe. The probe PID is already disclosed by the leading marker. Use unambiguous framing/escaping (or scan structured per-file records), and add a regression test with a forged marker in file content.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e/live/bedrock-runtime-compatible-anthropic-leaks.ts` around lines 46 - 58, Update the line-scanning logic around the SNAPSHOT_FILE_PREFIX handling so markers embedded in emitted file content cannot change the trusted current-file location or grant probe-environment exemptions. Use unambiguous framing/escaping or structured per-file records to distinguish protocol metadata from raw content, and add a regression test covering a forged marker followed by an adapter environment name.test/e2e/live/diagnostics.test.ts (1)
347-373: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail # Inspect the target test and helper definitions. git ls-files test/e2e/live/diagnostics.test.ts wc -l test/e2e/live/diagnostics.test.ts sed -n '300,410p' test/e2e/live/diagnostics.test.ts echo '--- resultText references ---' rg -n "function resultText|const resultText|resultText\\(" test/e2e -S echo '--- provider list usage ---' rg -n 'provider.*list|credentialsText.includes|not.toContain\(hosted\.providerName\)' test/e2e/live/diagnostics.test.ts -SRepository: NVIDIA/NemoClaw
Length of output: 50372
🏁 Script executed:
#!/bin/bash set -euo pipefail echo '--- diagnostics helpers around resultText/rawResultText ---' rg -n "function resultText|const resultText|function rawResultText|const rawResultText|runRawNodeCliForLeakAssertion|redactForAssertion" test/e2e/live/diagnostics.test.ts test/e2e -S echo '--- top of diagnostics.test.ts ---' sed -n '1,120p' test/e2e/live/diagnostics.test.ts echo '--- helper definitions if in adjacent files ---' rg -n "runRawNodeCliForLeakAssertion|rawResultText|redactForAssertion" test/e2e/live test/e2e/fixtures test/e2e/support -SRepository: NVIDIA/NemoClaw
Length of output: 7488
🏁 Script executed:
#!/bin/bash set -euo pipefail echo '--- provider list and result helpers ---' rg -n 'provider", "list"|provider list|function resultText|export function resultText|type .*ShellProbeResult|interface .*ShellProbeResult|stdout.*stderr' test/e2e/fixtures test/e2e/live -S echo '--- sandbox openshell result shape references ---' rg -n 'openshell\(' test/e2e/live test/e2e/fixtures -S | head -n 40 echo '--- inspect command result helper used by resultText ---' sed -n '1,140p' test/e2e/fixtures/clients/command.tsRepository: NVIDIA/NemoClaw
Length of output: 29999
Use stdout for provider-state assertions
rawResultText()folds stderr into the same string, so warnings can makecredentialsText.includes(hosted.providerName)take the detach/reset path or makenot.toContain(hosted.providerName)fail even when provider output is correct. Usestdoutfor these checks and keep combined text only in the assertion messages.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e/live/diagnostics.test.ts` around lines 347 - 373, Update the provider-state checks around credentialsText and providersAfterDetach to use each command result’s stdout exclusively for includes/not.toContain assertions, while retaining resultText(detach) and resultText(providersAfterDetach) only as assertion failure messages. This prevents stderr warnings from affecting the detach/reset control flow or provider-list validation.Source: Path instructions
tools/e2e/private-file.mts (1)
39-42: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail printf 'Repo root: '; pwd printf '\nFiles:\n' git ls-files tools/e2e/private-file.mts tools/e2e | sed -n '1,120p' printf '\nCONTRIBUTING.md (if present):\n' git ls-files CONTRIBUTING.md && cat -n CONTRIBUTING.md | sed -n '1,220p' || true printf '\nInspect target file:\n' cat -n tools/e2e/private-file.mts | sed -n '1,220p' printf '\nSearch for maxBytes and descriptor usage:\n' rg -n "maxBytes|descriptor|append|stat\.size|readFileSync" tools/e2e -SRepository: NVIDIA/NemoClaw
Length of output: 29620
🏁 Script executed:
#!/bin/bash set -euo pipefail sed -n '1,220p' tools/e2e/private-file.mts | cat -n printf '\n---\n' rg -n "private-file|maxBytes|O_APPEND|appendFile|readFileSync|statSync|openSync" tools/e2e -SRepository: NVIDIA/NemoClaw
Length of output: 11572
🏁 Script executed:
#!/bin/bash set -euo pipefail echo '--- lines 1-120 ---' sed -n '1,120p' tools/e2e/private-file.mts | cat -n echo '--- lines 121-240 ---' sed -n '121,240p' tools/e2e/private-file.mts | cat -nRepository: NVIDIA/NemoClaw
Length of output: 3598
🌐 Web query:
Node.js fs.readFileSync file descriptor reads until EOF and concurrent append race stat size read behavior💡 Result:
In Node.js, the behavior of reading from a file descriptor depends on the specific method used and the state of the file descriptor's internal position pointer. 1. fs.readFileSync and File Descriptors: When using fs.readFileSync(path), Node.js typically opens the file, reads the entire content from the beginning to the end, and then closes it [1][2]. However, when passing an open file descriptor (fd) to fs.readFileSync(fd), it does not necessarily reset the file position [2][3]. If prior read operations have already moved the file's internal position pointer, fs.readFileSync(fd) will read from that current position until EOF [2][3]. 2. Concurrent Append and Read Race Conditions: Node.js does not provide built-in atomicity guarantees for concurrent reads and writes to the same file [4][5][6]. If a process is appending to a file while another is reading it, the reader may or may not observe the newly appended data depending on the timing of the operating system's I/O scheduling [4]. Because file operations are asynchronous (in the case of fs.readFile) or interleaved with the event loop, there is no guarantee that a read operation will capture a "snapshot" of the file state before or after a concurrent append [5][6]. 3. File System Stat and Read Behavior: Reading a file based on a pre-fetched size (e.g., using fs.statSync to get the size and then reading that number of bytes) is a common pattern but is inherently susceptible to race conditions [7]. If the file size changes due to an append operation between the time of the stat call and the completion of the read operation, the read may result in partial data, inconsistency, or require additional handling to detect the new EOF [4][7]. To ensure data integrity when dealing with concurrent file access, you must implement application-level locking (such as using file locks), maintain queues, or utilize database systems designed to handle concurrency, as the Node.js fs module's standard synchronous and asynchronous methods do not manage cross-operation synchronization for you [5][6][7].
Citations:
- 1: https://nodejs.org/api/fs.html
- 2: https://beta.docs.nodejs.org/fs.html
- 3: https://github.com/nodejs/node/blob/master/doc/api/fs.md
- 4: https://stackoverflow.com/questions/54509334/filesystem-read-write-is-this-a-race-condition
- 5: https://stackoverflow.com/questions/34968763/is-there-any-risk-to-read-write-the-same-file-content-from-different-sessions
- 6: nodejs/node#13572
- 7: https://stackoverflow.com/questions/50435287/is-node-fs-appendfile-atomic
🏁 Script executed:
#!/bin/bash set -euo pipefail printf 'Callers of private-file helpers:\n' rg -n "readPrivateRegularFile|writePrivateRegularFile|appendPrivateRegularFile" tools/e2e -S printf '\nRelevant surrounding code in runner-pressure.mts:\n' sed -n '1,340p' tools/e2e/runner-pressure.mts | cat -n | sed -n '1,340p' printf '\nRelevant surrounding code in live-test-outcome.mts:\n' sed -n '1,180p' tools/e2e/live-test-outcome.mts | cat -n | sed -n '1,180p'Repository: NVIDIA/NemoClaw
Length of output: 22381
🌐 Web query:
Node.js documentation fs.readFileSync file descriptor semantics current position EOF concurrent append💡 Result:
When using
fs.readFileSyncwith a file descriptor in Node.js, the function does not seek to the beginning of the file; it reads from the current file position [1]. If the file descriptor's position has been advanced by previous operations,fs.readFileSyncwill start reading from that current position until the end of the file (EOF) [2][3]. Key semantic points regarding this behavior include: 1. Current Position Persistence: The underlying file descriptor maintains its own offset (the current file position). Unlike some other high-level APIs that may implicitly reset the position,fs.readFileSyncrespects the existing state of the file descriptor [1]. 2. Concurrent Appends: If another process or thread appends data to the file while you are reading,fs.readFileSyncwill read the newly appended data if the read operation reaches the end of the original file and continues into the new data [2][4]. Node.js file system operations are not synchronized or thread-safe; therefore, performing concurrent modifications on the same file can lead to data corruption or unpredictable behavior [2][5]. 3. EOF Handling: If the file is not modified concurrently, the end-of-file is reached when the operation consumes the available data [2][6]. 4. Alternative Approaches: If you require consistent behavior—such as always reading from the beginning of a file—you should manage the file position explicitly usingfs.readSyncwith a specific position offset [1], or open a new file descriptor for the read operation to ensure it starts at offset 0. Becausefs.readFileSyncandfs.readFileare helper functions that simply consume data until EOF based on the current descriptor position, they are often considered unsuitable for scenarios requiring complex seek patterns [1]. For granular control over file offsets and concurrent access, usefs.readorfs.readSyncwith an explicit position argument [2][1].Citations:
- 1: nodejs/node#23433
- 2: https://nodejs.org/api/fs.html
- 3: https://github.com/nodejs/node/blob/master/doc/api/fs.md
- 4: https://nodejs.org/docs/latest-v23.x/api/fs.html
- 5: https://nodejs.org/docs/latest-v24.x/api/fs.html
- 6: https://nodejs.org/docs/latest-v22.x/api/fs.html
🏁 Script executed:
node - <<'JS' const fs = require('node:fs'); const os = require('node:os'); const path = require('node:path'); const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'nemo-private-file-')); const file = path.join(dir, 'sample.txt'); fs.writeFileSync(file, '12345'); const fd = fs.openSync(file, fs.constants.O_RDONLY); try { const before = fs.fstatSync(fd).size; fs.appendFileSync(file, '67890'); const after = fs.fstatSync(fd).size; const data = fs.readFileSync(fd, 'utf8'); console.log(JSON.stringify({ before, after, data, dataLength: Buffer.byteLength(data) })); } finally { fs.closeSync(fd); fs.rmSync(dir, { recursive: true, force: true }); } JSRepository: NVIDIA/NemoClaw
Length of output: 213
Enforce
maxBytesat the I/O boundary.readPrivateRegularFile()can still return more thanmaxBytesif the file grows afterfstatSync(), andappendPrivateRegularFile()has the same size-check race beforeO_APPENDwrites. Read at mostmaxBytes + 1bytes, and either lock appends or make the single-writer contract explicit.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tools/e2e/private-file.mts` around lines 39 - 42, Update readPrivateRegularFile to read at most maxBytes plus one byte, then reject results exceeding options.maxBytes so growth after stat cannot bypass the limit. Apply equivalent synchronization in appendPrivateRegularFile by locking the size-check and O_APPEND write as one operation, or explicitly enforce and document its single-writer contract.
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/e2e-private-file.test.ts (1)
78-83: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAvoid locking this test to stack-frame names.
at readPrivateRegularFileandat openPrivateFileForWriteare implementation details, not part of the FIFO rejection contract. Keep the stable error/path and module-loading assertions, but remove these frame checks to avoid false failures after harmless renames or stack-format changes. As per path instructions, review tests for behavioral confidence rather than implementation lock-in.Suggested adjustment
- expect(read.stderr).toContain("at readPrivateRegularFile"); ... - expect(write.stderr).toContain("at openPrivateFileForWrite");🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-private-file.test.ts` around lines 78 - 83, Remove the stack-frame assertions for “at readPrivateRegularFile” and “at openPrivateFileForWrite” from this FIFO rejection test. Preserve the stable stderr error, FIFO path, status, and module-loading assertions so the test continues validating behavior rather than implementation-specific function names.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/e2e-private-file.test.ts`:
- Around line 78-83: Remove the stack-frame assertions for “at
readPrivateRegularFile” and “at openPrivateFileForWrite” from this FIFO
rejection test. Preserve the stable stderr error, FIFO path, status, and
module-loading assertions so the test continues validating behavior rather than
implementation-specific function names.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: e17088bc-c20a-47ae-828f-26a6a9957afb
📒 Files selected for processing (6)
test/e2e-private-file.test.tstest/e2e/live/bedrock-runtime-compatible-anthropic-leaks.tstest/e2e/live/bedrock-runtime-compatible-anthropic.test.tstest/e2e/live/diagnostics.test.tstest/e2e/support/bedrock-runtime-compatible-anthropic-leaks.test.tstools/e2e/private-file.mts
🚧 Files skipped from review as they are similar to previous changes (4)
- test/e2e/live/bedrock-runtime-compatible-anthropic.test.ts
- tools/e2e/private-file.mts
- test/e2e/live/bedrock-runtime-compatible-anthropic-leaks.ts
- test/e2e/live/diagnostics.test.ts
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
…e-contracts/ae Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
cjagwani
left a comment
cjagwani
left a comment
There was a problem hiding this comment.
Maintainer review complete: exact-head gates pass, security-sensitive E2E boundaries were reviewed, and no unresolved correctness or security findings remain.
3 participants
Summary
Prevents repeated scheduled E2E false negatives caused by the Node/tsx module boundary, attached-provider cleanup ordering, and the Bedrock snapshot probe observing its own injected environment-variable name. The leak check remains strict for real token values and for matches outside the trusted probe environment.
Changes
tsxpath used by the live workflow.Type of Change
Quality Gates
Verification
Verifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpx vitest run --project e2e-support --project integration test/e2e/support/live-test-outcome-invocation.test.ts test/e2e/support/bedrock-runtime-compatible-anthropic-leaks.test.ts test/e2e-private-file.test.ts test/pr-risk-plan.test.ts(75 passed); Node 22.23.1 liverunner-pressure.mts snapshotreproduction passed;npm run typecheck:clipassed.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes —npm testwas attempted after installing the lockfile-pinned nested dependencies, but unrelated base-image, watcher, workflow-discovery, and Oclif environment failures appeared before an installer test stalled for more than 13 minutes; the run was stopped. Focused controller tests, the exact workflow-runtime reproduction, CLI typecheck, normal hooks, ordinary exact-head PR CI, and all seven controller-selected protected E2E shards passed after the current-mainrefresh (controller, child).npm run docsbuilds without warnings (doc changes only)Signed-off-by: Aaron Erickson aerickson@nvidia.com