Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/monitoring/monitor-sandbox-activity.md`:
- Around line 84-85: Add a MyST warning admonition (:::{warning}) immediately
before the sentence that recommends changing NEMOCLAW_METRICS_HOST to enable
remote scraping, stating that the /metrics endpoint is unauthenticated and
exposing it beyond localhost may leak operational metadata; include scope (which
services/hosts or networks may be affected), risk (what kind of data could be
exposed), and remediation guidance (prefer scraping over a secure network, use
firewall rules, or bind to loopback and proxy/secure the endpoint) and reference
the environment variables NEMOCLAW_METRICS_HOST and NEMOCLAW_METRICS_PORT and
the /metrics path so readers know exactly which setting and endpoint the warning
applies to.

---

Outside diff comments:
In `@nemoclaw/eslint.config.mjs`:
- Around line 1-4: Add the required repository SPDX license header at the top of
this module (above the import statements) so the file includes an
SPDX-License-Identifier line and any required copyright/owner line; update the
top of eslint.config.mjs (the module containing the import statements tseslint,
tsparser, and prettier) to include the standard project header block exactly as
used by other source files.

---

Nitpick comments:
In `@nemoclaw/src/observability/server.ts`:
- Around line 38-53: The createMetricsRequestHandler currently serves metrics
for any HTTP method; update the returned handler to only allow GET: inspect
req.method at the top of the function and if it's not "GET" respond with 405
Method Not Allowed (include an "Allow: GET" header and a short plain-text body
like "method not allowed\n"), otherwise proceed to validate url.pathname and
call registry.renderPrometheus() as before; modify the handler returned by
createMetricsRequestHandler (which receives IncomingMessage and ServerResponse)
to enforce this method check.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@nemoclaw/src/observability/server.ts`:
- Around line 21-31: resolveMetricsPort currently validates ports 0–65535 which
permits privileged ports; update its validation to accept either 0 (for
OS-assigned ephemeral ports used in tests) or the same unprivileged range used
by parsePort (1024–65535) to keep behavior consistent; modify the check in
resolveMetricsPort to allow parsed === 0 || (Number.isInteger(parsed) && parsed
>= 1024 && parsed <= 65535), update the thrown Error message to reflect the new
allowed range, and add a brief comment referencing parsePort and the reason 0 is
allowed for clarity.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@nemoclaw/src/observability/metrics.ts`:
- Around line 210-216: The HELP text is inserted verbatim in renderPrometheus
which can produce invalid Prometheus exposition when metadata.help contains
backslashes or newlines; update renderPrometheus to escape HELP text by
replacing backslashes with double-backslashes and newlines with '\n' (or
otherwise escaping sequences Prometheus expects) before pushing `# HELP ${name}
${metadata.help}` so that the HELP line uses the escaped help string; target the
renderPrometheus method and the usage of metadata.help when building the lines
array to apply the escaping transformation.

In `@nemoclaw/src/observability/server.ts`:
- Around line 62-66: Wrap the call to registry.renderPrometheus() in a try/catch
inside the request handler so a thrown error does not escape: call
registry.renderPrometheus() in the try, send 200 headers and the body on
success, and on catch log the error (use the project logger like processLogger
or console.error) then respond with a 500 status and a safe plain-text error
body; ensure you don't send headers twice (i.e., only call res.writeHead/res.end
in the try or in the catch branch).

In `@test/legacy-path-guard.test.ts`:
- Line 12: The constant TSX_LOADER currently points to an internal file path;
change its value to the documented public module specifier by replacing the
path.join(REPO_ROOT, "node_modules", "tsx", "dist", "loader.mjs") assignment so
TSX_LOADER is simply "tsx" (update any code that imports/uses TSX_LOADER
accordingly), ensuring the module is resolved via package exports rather than a
hard-coded internal file path.

---

Nitpick comments:
In `@nemoclaw/src/index.ts`:
- Around line 335-369: The metrics-service block inside register() is
self-contained and should be moved to a small helper to reduce cyclomatic
complexity: create a function registerMetricsService(api: Api) (or similar) that
checks isMetricsEnabled(), calls api.registerService with the same id
"nemoclaw-metrics" and the existing start/stop logic that uses
startMetricsServer, MetricsServer and the logger, and then call that helper from
register(); preserve error handling and the metricsServer variable scoping by
keeping it internal to the helper so behavior is unchanged.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@vitest.config.ts`:
- Around line 10-11: The current boolean runBrevE2e var is too permissive;
change its logic to require both the secret and an explicit opt-in (or CI) so
cloud E2E won't run just because the token exists—replace the definition of
runBrevE2e with a compound check like: token present AND (explicit opt-in env
var e.g. BREV_E2E === '1' OR process.env.CI === 'true'), and apply the same
stricter gating to the other related checks around the e2e-brev suite referenced
in the block at lines 49-59 (update any uses of runBrevE2e or duplicate token
checks to use this new opt-in+token logic).

---

Outside diff comments:
In `@nemoclaw/src/blueprint/runner.ts`:
- Around line 293-307: The code performs validateEndpointForMetrics twice when a
CLI override (endpointUrl) is supplied, causing redundant validation and a
misleading "blueprint" source; modify the logic around
validateEndpointForMetrics and inferenceCfg so that when endpointUrl is provided
and used to set inferenceCfg.endpoint you skip the subsequent "blueprint"
validation—either by changing the second conditional to only run when no CLI
override was applied (e.g., if (!endpointUrl && inferenceCfg.endpoint)) or by
using a boolean flag (e.g., overrideApplied) set after validating endpointUrl;
ensure references to validateEndpointForMetrics, inferenceCfg, endpointUrl, and
the "override"/"blueprint" source labels are adjusted so metrics reflect the
true source and the endpoint is validated only once.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@nemoclaw/src/blueprint/runner.ts`:
- Around line 339-340: The metrics call in metrics.observeOperation that creates
the "blueprint_execution" series is using the user-controlled label profile
which causes unbounded cardinality; remove profile from the label set passed to
metrics.observeOperation (keep only bounded labels like action and status) where
observeOperation("blueprint_execution", { action: "plan", profile }, () =>
actionPlanImpl(...)) is invoked, and instead ensure the profile value remains
recorded in logs or the plan output (e.g., add it to existing logging around
actionPlanImpl or the returned plan) so you do not lose the profile context.

In `@test/cli.test.ts`:
- Line 310: The per-test Jest timeout is still 15s while runWithEnv("debug
--quick 2>&1", { HOME: home }, 30000) (and the similar call at the other
location) allows the subprocess 30s; update the enclosing tests to increase
their Jest timeout to at least 30000ms (either by adding a timeout argument to
the test(...) call or calling jest.setTimeout(30000) for these tests) so the
test harness won't abort early when runWithEnv takes up to 30s.

In `@test/http-proxy-fix-e2e.test.ts`:
- Around line 274-275: Remove the invalid eslint-disable comments and eliminate
the non-null assertions by adding explicit null checks for the mock object
before accessing its properties (replace occurrences of "mock!.port" and other
"mock!" usages). For each place that currently uses mock! (referenced as mock
and its port property), remove the eslint comment and add a guard such as if
(!mock) throw new Error("expected mock to be initialized") or use a test
assertion like expect(mock).toBeDefined() before accessing mock.port so the code
no longer relies on the non-null assertion operator.

---

Outside diff comments:
In `@nemoclaw/src/blueprint/runner.ts`:
- Around line 293-305: The code is revalidating an endpoint override as if it
came from a blueprint, causing duplicate/mislabelled metrics; update the block
that calls validateEndpointForMetrics for the final endpoint so it only runs
when there was no CLI override (i.e., only when endpointUrl is falsy).
Concretely, in runner.ts adjust the condition around
validateEndpointForMetrics/inferenceCfg.endpoint so that if endpointUrl is
provided you skip the second call (or otherwise keep using the already-validated
value), referencing validateEndpointForMetrics, endpointUrl, and
inferenceCfg.endpoint to locate and change the logic.