fix(cli): accept channels status without --wait

[Dreamstick9]

Summary

nemoclaw <sandbox> channels status rejected every invocation without --wait, including the documented no-wait forms, with All of the following must be provided when using --timeout: --wait. The timeout flag combined default: 180 with dependsOn: ["wait"], and oclif validates dependsOn whenever the flag has a value, so the parser default triggered the dependency check on every parse. This change removes the parser default; showSandboxChannelStatus already applies the documented 180-second budget, so --wait behavior is unchanged and an explicit --timeout still requires --wait.

Related Issue

Fixes #8883.

Reproduction

Against unmodified main at ac6adacd, the new regression cases fail with the reported rejection; with this change they pass:

× accepts the documented no-wait invocation ["alpha"] (#8883)
× accepts the documented no-wait invocation ["alpha","--channel","slack"] (#8883)
  → Error: All of the following must be provided when using --timeout: --wait

The new repository check also pinpoints the defect on unmodified main (src/commands/sandbox/channels/status.ts:35 timeout, exit 1) and passes on this branch (exit 0).

Changes

• src/commands/sandbox/channels/status.ts: remove default: 180 from the timeout flag and state the 180-second default in the flag description. The readiness action keeps applying the default (DEFAULT_WAIT_TIMEOUT_SECONDS in src/lib/actions/sandbox/channel-status.ts).
• src/commands/sandbox/channels/status.test.ts: add no-wait regression cases that fail on unfixed main, and pin the forwarded contract for --wait without --timeout (timeoutSeconds: undefined).
• src/lib/actions/sandbox/channel-status.test.ts: pin the 180-second budget when the caller omits timeoutSeconds (readiness elapsedMs: 180000 and the first policy-probe deadline).
• scripts/checks/no-defaulted-dependent-flags.mts + registration in scripts/checks/run.mts: new repository check that rejects any oclif flag combining a parser default with dependsOn. Requirement and consumer: this defect class is a per-flag combination any command can silently reintroduce, invisible to type checks and per-command tests; the check runs in npm run checks:repository via the repository-checks pre-commit hook and CI. A direct change alone cannot prevent recurrence. Protecting test: test/no-defaulted-dependent-flags.test.ts.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: the fix restores behavior the docs already document; docs/reference/commands.mdx describes the no-wait forms and states "The default timeout is 180 seconds, and --timeout <seconds> requires --wait", which now matches the CLI for the first time. Confirmed by the documentation writer review below.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent reviewer subagent (Claude Code) reviewed the diff; the change is flag parsing only — no security control, credential, network, or sandbox behavior changes, and the new check reads repository sources only. Maintainer confirmation welcome during review.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: Independent review: PASS — the CLI description and tests preserve the documented 180-second wait budget while allowing no-wait status, and the CI staging text names the exact libssh2 source mismatch.
• Agent: Codex Desktop

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result: npx vitest run --project cli src/commands/sandbox/channels/status.test.ts src/lib/actions/sandbox/channel-status.test.ts → 24 passed; npx vitest run --project integration test/no-defaulted-dependent-flags.test.ts → 6 passed; npx vitest run --project integration test/checks-runner.test.ts → passed with the PRA-1 registration assertion; npx tsx scripts/checks/no-defaulted-dependent-flags.mts → exit 0 on this branch, exit 1 on unmodified main
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: SKIP=hadolint npm run check (applies because scripts/checks/run.mts gains a check; hadolint binary unavailable on this host and the diff changes no Dockerfile): the --all-files pre-commit stage passes; the full-suite manual stage fails on this macOS host only in tests that also fail on unmodified upstream main at the merge base 164a7bee — rerunning the failing set there fails 8 tests vs 6 at the PR head, a strict subset that includes documented issue Ollama WSL probe-order test fails on macOS because isWsl short-circuits on platform #8868 — and none of those files import the changed files. npm run checks:repository passes end to end with the new check; the PR CI aggregate is the authoritative broad run.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Kushagar Garg dreamstick909@gmail.com

Summary by CodeRabbit

• New Features

  • Added an automated check that detects dependent flags with default values and reports actionable file, line, and flag details.
  • Integrated the check into standard repository validation.

• Bug Fixes

  • Improved sandbox channel status handling when waiting is not requested.
  • Preserved the documented 180-second readiness-check timeout without rejecting valid command invocations.

• Tests

  • Added coverage for flag validation, check registration, and sandbox status timeout behavior.
  • Updated managed-image workflow validation for the current staging security contract.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: afd4ce26-6d70-4d79-8c62-168383cab831

📥 Commits

Reviewing files that changed from the base of the PR and between fd585e9 and 8c0ac2e.

📒 Files selected for processing (2)

• .github/workflows/managed-images.yaml
• test/managed-image-publication-workflow.test.ts

---

📝 Walkthrough

Walkthrough

The channel status command now applies its timeout default in the action layer. A repository check detects flag definitions that combine default and dependsOn. The staging QA workflow uses a new source commit.

Changes

Channel status validation

Layer / File(s)	Summary
Channel status timeout behavior src/commands/sandbox/channels/status.ts, src/commands/sandbox/channels/status.test.ts, src/lib/actions/sandbox/channel-status.test.ts	The parser no longer supplies a default timeout. Tests verify no-wait invocations and the action-layer 180-second readiness timeout.
Defaulted dependent flag guard scripts/checks/no-defaulted-dependent-flags.mts, scripts/checks/run.mts, test/no-defaulted-dependent-flags.test.ts, test/checks-runner.test.ts	The AST-based check detects invalid Flags.<method> definitions, scans supported source paths, formats violations, and runs through the repository check registry. Tests cover invalid and valid flag patterns, path filtering, and registration.

Managed image source update

Layer / File(s)	Summary
Staging QA source pin .github/workflows/managed-images.yaml, test/managed-image-publication-workflow.test.ts	The staging QA source description and commit SHA change to the nemoclaw2 security contract. The workflow test expects the new SHA.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Mergeability Score: ⚪ Minimal · up to 8c0ac

This change restores documented no-wait channel-status usage while preserving the 180-second wait budget and explicit --timeout contract. Targeted tests and repository checks pass, and no actionable merge-blocking risk remains beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant showSandboxChannelStatus
  participant GatewayPolicy
  CLI->>showSandboxChannelStatus: invoke status with undefined timeout
  showSandboxChannelStatus->>showSandboxChannelStatus: apply 180-second timeout budget
  showSandboxChannelStatus->>GatewayPolicy: check readiness with propagated deadline

Loading

Possibly related PRs

• NVIDIA/NemoClaw#8930: Updates tooling references in the same scripts/checks/run.mts registry.

Suggested reviewers: cv

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The managed-image workflow and expected commit update are unrelated to issue #8883 and the stated CLI objectives.	Remove the managed-image workflow changes or move them to a separate pull request.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The change removes the parser default, preserves explicit timeout dependency validation, and adds regression coverage for no-wait status commands with and without channels.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary CLI change: allowing channels status to run without --wait.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / low confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: Same-session synthesis validation failed; the advisor result is incomplete.

Model lanes

• GPT-5.6 Terra (primary): Completed · low confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

2 terminology differences from the second opinion

Advisory only. These are normalized differences from the primary terminology receipt.

• no-wait at src/commands/sandbox/channels/status.test.ts:66: selected only by the second-opinion lane as established.
• nemoclaw2 at .github/workflows/managed-images.yaml:114: selected only by the second-opinion lane as established.

4 additional E2E selections from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

• hermes-slack: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• hermes-discord: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• channels-add-remove: The completed second-opinion lane identified E2E coverage that the primary lane omitted.
• channels-stop-start: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• define — parser default at scripts/checks/no-defaulted-dependent-flags.mts:7: Define the term where used. The changed comments explain its contrast with the action-layer fallback.
• established — action layer at scripts/checks/no-defaulted-dependent-flags.mts:9: Retain the established term for the command-to-action boundary.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite for the commit under review.

Recommended E2E: None

Manual-only E2E: managed-image-multiarch-startup
The manual PR workflow does not run these selectors for the commit under review. Run them from reviewed code on main.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[wscurran]

✨ Thanks for the fix. This restores the documented no-wait behavior for channels status. Maintainers will review the CLI argument parsing change.

---

Related open issues:

• #8883 [All Platforms][CLI&UX] channels status rejects ordinary no-wait invocations

[Dreamstick9]

✨ Thanks for the fix. This restores the documented no-wait behavior for channels status. Maintainers will review the CLI argument parsing change.

Related open issues:

• #8883 [All Platforms][CLI&UX] channels status rejects ordinary no-wait invocations

Thanks for the review man, also I have that issue you mentioned linked in the pr description

[apurvvkumaria]

The current CI blocker is unrelated to this PR.

• Static checks, builds, type checks, installer tests, package audits, plugin tests, and the first 10 CLI shards pass.
• CLI shard 11 fails in unchanged src/lib/state/mcp-lifecycle-lock-acquisition.test.ts after waiting for the sandbox mutation lock for alpha.
• This PR changes the channel-status flag contract and its repository check. It does not change lifecycle-lock acquisition.
• The workflow is on attempt two. The single transient-failure retry is exhausted, so I will not rerun it again.

The PR requires CI or test-harness owner intervention before all repository gates can pass. No PR source change is indicated by this failure.

[prekshivyas]

Approved based on code review. Required CI checks remain merge gates.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[cv]

The no-wait status path preserves the documented wait budget and explicit timeout contract. The repository guard covers parser defaults combined with dependent flags, the staging source matches the current libssh2 inventory, and required checks pass on 8c0ac2e. No security, correctness, documentation, or review finding remains.