Summary

Migrate test/e2e/test-gateway-drift-preflight.sh with the simplest equivalent Vitest coverage.

Related Issues

Refs #5098
Refs #3399
Refs #3423

Contract mapping

• Legacy assertion: protobuf invalid-wire sandbox-list failures fail closed and do not classify a registered sandbox as stopped.
  • Replacement: test/gateway-drift-preflight.test.ts drives the real repo CLI through fake openshell/docker binaries and asserts fail-closed diagnostics/no backup success.
  • Boundary preserved: real node bin/nemoclaw.js backup-all, PATH-resolved openshell sandbox list, fake process exit/output boundary, and filesystem registry state.
• Legacy assertion: stale patched cluster gateway image drift fails before openshell sandbox list.
  • Replacement: test/gateway-drift-preflight.test.ts fakes active Docker cluster inspect output and asserts image drift output plus no sandbox-list call.
  • Boundary preserved: real CLI preflight, PATH-resolved Docker inspect shim, OpenShell version shim, and process exit behavior.
• Legacy assertion: host-process gateway binary drift blocks both backup-all and upgrade-sandboxes --check before sandbox-list.
  • Replacement: test/gateway-drift-preflight.test.ts seeds runtime markers/fallback binaries and invokes both real CLI commands.
  • Boundary preserved: real host-process runtime marker JSON, live fake gateway PID for marker trust, /proc/process identity probe, and fallback binary resolution.
• Legacy assertion: a stale dead-PID runtime marker does not fabricate host-process drift when the live fallback gateway binary matches the installed CLI.
  • Replacement: test/gateway-drift-preflight.test.ts seeds a stale marker pointing at an old binary and asserts the CLI proceeds to openshell sandbox list.
  • Boundary preserved: real marker file semantics, fallback PATH sibling resolution, and subprocess call logging.

Simplicity check

• Test shape: focused process Vitest test in test/gateway-drift-preflight.test.ts.
• Original runner/lane: regression-e2e.yaml job gateway-drift-preflight-e2e, runs-on: ubuntu-latest, Node 22, fake Docker/OpenShell shims, no secrets.
• Replacement runner: same runner class via e2e-vitest-scenarios.yaml job gateway-drift-preflight-vitest, runs-on: ubuntu-latest, Node 22, no secrets.
• New shared helpers: none; one-off fake CLI/Docker/OpenShell helpers stay local to the test.
• New framework/registry/ledger: none
• Workflow changes: add selective free-standing Vitest job and selector inventory mapping; legacy shell script and regression lane deletion deferred to Epic: Migrate legacy bash E2E into the Vitest E2E system #5098 Phase 11.
• Selective dispatch: e2e-vitest-scenarios.yaml with jobs=gateway-drift-preflight-vitest on this PR branch.

Verification

• npm ci --ignore-scripts
• npm run build:cli
• npx vitest run --project cli test/gateway-drift-preflight.test.ts --silent=false --reporter=default
• npx vitest run --project e2e-vitest-support test/e2e-scenario/support-tests/e2e-scenarios-workflow.test.ts
• npm run typecheck:cli
• git diff --check
• PR: test(e2e): migrate test-gateway-drift-preflight.sh to vitest #5350
• Same-runner selective run: https://github.com/NVIDIA/NemoClaw/actions/runs/27438428046 — queued

Note: local full pre-push CLI suite was attempted by hooks but is not part of the focused migration validation and failed on unrelated local environment/pre-existing issues (nemoclaw/node_modules/json5 missing, nemoclaw/dist/blueprint/private-networks.js missing, macOS timeout/platform expectations). Focused migration validations above passed.

Summary by CodeRabbit

• New Features

  • Added gateway drift preflight checks to prevent unsafe backup and upgrade operations by detecting schema mismatches, gateway image drift, and host-process incompatibilities.

• Tests

  • Expanded end-to-end Vitest scenarios covering gateway drift detection, fail-closed behavior, and various drift permutations.

• Chores

  • CI updated with a new automated job for gateway-drift-preflight and integrated so its results appear in PR reports.