e2e-vitest-scenarios.yaml

# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: E2E / Vitest Scenarios

on:
  workflow_dispatch:
    inputs:
      scenarios:
        description: "Optional comma-separated typed scenario ids. Empty runs all live Vitest-supported scenarios."
        required: false
        default: ""
        type: string
      jobs:
        description: "Optional comma-separated free-standing live Vitest job ids. Empty runs all jobs only when scenarios is also empty."
        required: false
        default: ""
        type: string
      pr_number:
        description: Optional PR number for selective-dispatch result comments.
        required: false
        type: string
        default: ""

permissions:
  contents: read

concurrency:
  group: e2e-vitest-scenarios-${{ github.ref }}-${{ inputs.scenarios || 'supported' }}-${{ inputs.jobs || 'all-jobs' }}
  cancel-in-progress: false

jobs:
  generate-matrix:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.matrix.outputs.matrix }}
      hermes_selected: ${{ steps.matrix.outputs.hermes_selected }}
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - id: matrix
        name: Generate Vitest scenario matrix
        env:
          JOBS: ${{ inputs.jobs }}
          SCENARIOS: ${{ inputs.scenarios }}
        run: |
          set -euo pipefail
          inventory_output="$(npx tsx tools/e2e-scenarios/free-standing-workflow-inventory.mts --shell)"
          allowed_jobs=""
          free_standing_scenarios_csv=""
          free_standing_scenario_jobs_csv=""
          seen_inventory_keys=","
          while IFS= read -r line || [ -n "${line}" ]; do
            line="${line#"${line%%[![:space:]]*}"}"
            line="${line%"${line##*[![:space:]]}"}"
            if [[ -z "${line}" || "${line}" == \#* ]]; then
              continue
            fi
            if [[ ! "${line}" =~ ^(allowed_jobs|free_standing_scenarios_csv|free_standing_scenario_jobs_csv)=([A-Za-z0-9_:-]+(,[A-Za-z0-9_:-]+)*)$ ]]; then
              echo "::error::free-standing workflow inventory must be data-only key=value" >&2
              exit 1
            fi
            inventory_key="${BASH_REMATCH[1]}"
            inventory_value="${BASH_REMATCH[2]}"
            if [[ "${seen_inventory_keys}" == *",${inventory_key},"* ]]; then
              echo "::error::free-standing workflow inventory must not redefine ${inventory_key}" >&2
              exit 1
            fi
            seen_inventory_keys="${seen_inventory_keys}${inventory_key},"
            case "${inventory_key}" in
              allowed_jobs) allowed_jobs="${inventory_value}" ;;
              free_standing_scenarios_csv) free_standing_scenarios_csv="${inventory_value}" ;;
              free_standing_scenario_jobs_csv) free_standing_scenario_jobs_csv="${inventory_value}" ;;
            esac
          done <<< "${inventory_output}"
          for required_inventory_key in allowed_jobs free_standing_scenarios_csv free_standing_scenario_jobs_csv; do
            if [[ -z "${!required_inventory_key:-}" ]]; then
              echo "::error::free-standing workflow inventory missing ${required_inventory_key}" >&2
              exit 1
            fi
          done
          seen_allowed_jobs=","
          IFS=',' read -r -a allowed_job_entries <<< "${allowed_jobs}"
          for job in "${allowed_job_entries[@]}"; do
            if [[ ! "${job}" =~ ^[A-Za-z0-9_-]+$ ]]; then
              echo "::error::free-standing workflow inventory contains invalid job id" >&2
              exit 1
            fi
            if [[ "${seen_allowed_jobs}" == *",${job},"* ]]; then
              echo "::error::free-standing workflow inventory repeats job id" >&2
              exit 1
            fi
            seen_allowed_jobs="${seen_allowed_jobs}${job},"
          done
          seen_free_standing_scenarios=","
          IFS=',' read -r -a free_standing_scenario_entries <<< "${free_standing_scenarios_csv}"
          for scenario in "${free_standing_scenario_entries[@]}"; do
            if [[ ! "${scenario}" =~ ^[A-Za-z0-9_-]+$ ]]; then
              echo "::error::free-standing workflow inventory contains invalid scenario id" >&2
              exit 1
            fi
            if [[ "${seen_free_standing_scenarios}" == *",${scenario},"* ]]; then
              echo "::error::free-standing workflow inventory repeats scenario id" >&2
              exit 1
            fi
            seen_free_standing_scenarios="${seen_free_standing_scenarios}${scenario},"
          done
          IFS=',' read -r -a scenario_job_entries <<< "${free_standing_scenario_jobs_csv}"
          seen_scenario_mappings=","
          derived_free_standing_scenarios=()
          for entry in "${scenario_job_entries[@]}"; do
            if [[ ! "${entry}" =~ ^[A-Za-z0-9_-]+:[A-Za-z0-9_-]+$ ]]; then
              echo "::error::Invalid free-standing scenario mapping" >&2
              exit 1
            fi
            scenario="${entry%%:*}"
            job="${entry#*:}"
            if [[ "${seen_scenario_mappings}" == *",${scenario},"* ]]; then
              echo "::error::free-standing workflow inventory repeats scenario mapping" >&2
              exit 1
            fi
            seen_scenario_mappings="${seen_scenario_mappings}${scenario},"
            if [[ "${seen_allowed_jobs}" != *",${job},"* ]]; then
              echo "::error::Free-standing scenario maps to unknown job" >&2
              exit 1
            fi
            derived_free_standing_scenarios+=("${scenario}")
          done
          derived_free_standing_scenarios_csv="$(IFS=,; echo "${derived_free_standing_scenarios[*]}")"
          if [[ "${free_standing_scenarios_csv}" != "${derived_free_standing_scenarios_csv}" ]]; then
            echo "::error::free_standing_scenarios_csv must match scenario mapping keys" >&2
            exit 1
          fi
          args=(--emit-live-matrix)
          matrix=""
          hermes_selected=false
          registry_scenarios=()
          is_free_standing_scenario() {
            [[ ",${free_standing_scenarios_csv}," == *",$1,"* ]]
          }
          if [ -n "${JOBS}" ] && [ -n "${SCENARIOS}" ]; then
            echo "::error::Use either scenarios or jobs, not both." >&2
            exit 1
          fi
          if [ -n "${JOBS}" ]; then
            if [[ ! "${JOBS}" =~ ^[A-Za-z0-9_-]+(,[A-Za-z0-9_-]+)*$ ]]; then
              echo "::error::Invalid jobs input; use comma-separated job ids" >&2
              exit 1
            fi
            IFS=',' read -r -a selected_jobs <<< "${JOBS}"
            for job in "${selected_jobs[@]}"; do
              if [[ ",${allowed_jobs}," != *",${job},"* ]]; then
                echo "::error::Unknown free-standing Vitest job: ${job}" >&2
                echo "::error::Allowed jobs: ${allowed_jobs}" >&2
                exit 1
              fi
              case "${job}" in
                hermes-e2e-vitest)
                  hermes_selected=true
                  ;;
              esac
            done
            matrix="[]"
          elif [ -n "${SCENARIOS}" ]; then
            if [[ ! "${SCENARIOS}" =~ ^[A-Za-z0-9_-]+(,[A-Za-z0-9_-]+)*$ ]]; then
              echo "::error::Invalid scenario input; use comma-separated scenario ids containing only letters, numbers, underscores, and hyphens." >&2
              exit 1
            fi
            IFS=',' read -r -a requested_scenarios <<< "${SCENARIOS}"
            for scenario in "${requested_scenarios[@]}"; do
              case "${scenario}" in
                hermes-e2e)
                  hermes_selected=true
                  ;;
              esac
              if is_free_standing_scenario "${scenario}"; then
                continue
              fi
              registry_scenarios+=("${scenario}")
            done
            if [ "${#registry_scenarios[@]}" -gt 0 ]; then
              registry_csv="$(IFS=,; echo "${registry_scenarios[*]}")"
              args+=(--scenarios "${registry_csv}")
              matrix="$(npx tsx test/e2e-scenario/scenarios/run.ts "${args[@]}")"
            else
              matrix="[]"
            fi
          else
            hermes_selected=true
            matrix="$(npx tsx test/e2e-scenario/scenarios/run.ts "${args[@]}")"
          fi
          echo "matrix=${matrix}" >> "$GITHUB_OUTPUT"
          echo "hermes_selected=${hermes_selected}" >> "$GITHUB_OUTPUT"
          MATRIX_JSON="${matrix}" python3 - <<'PY' >> "$GITHUB_STEP_SUMMARY"
          import json
          import os

          rows = json.loads(os.environ["MATRIX_JSON"])
          print("## Vitest E2E Scenario Matrix")
          print()
          print("| Scenario | Runner | Label |")
          print("| --- | --- | --- |")
          for row in rows:
              print(f"| `{row['id']}` | `{row['runner']}` | {row['label']} |")
          PY

  live-scenarios:
    needs: generate-matrix
    if: ${{ inputs.jobs == '' && needs.generate-matrix.outputs.matrix != '[]' }}
    runs-on: ${{ matrix.runner }}
    timeout-minutes: 45
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.generate-matrix.outputs.matrix) }}
    env:
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run Vitest live E2E scenarios
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
          SCENARIO_ID: ${{ matrix.id }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live test/e2e-scenario/live/registry-scenarios.test.ts -t "^${SCENARIO_ID}$" --silent=false --reporter=default

      - name: Summarize artifacts
        if: always()
        env:
          SCENARIO_ID: ${{ matrix.id }}
          SCENARIO_LABEL: ${{ matrix.label }}
        run: |
          python3 - <<'PY' >> "$GITHUB_STEP_SUMMARY"
          import json
          import os
          from pathlib import Path

          root = Path(os.environ["E2E_ARTIFACT_DIR"]) / os.environ["SCENARIO_ID"]
          plan_path = root / "run-plan.json"
          print("## Vitest E2E Scenarios")
          print()
          print("- Project: `e2e-scenarios-live`")
          print(f"- Scenario: `{os.environ['SCENARIO_ID']}`")
          print(f"- Label: `{os.environ['SCENARIO_LABEL']}`")
          print(f"- Artifact root: `{root}`")
          print()
          print("| Scenario | Manifest | Expected state | Suites | Phases |")
          print("| --- | --- | --- | --- | --- |")
          if plan_path.exists():
              plan = json.loads(plan_path.read_text(encoding="utf-8"))
              suites = ", ".join(plan.get("suiteIds") or []) or "(none)"
              phases = ", ".join(plan.get("phases") or []) or "(none)"
              print(
                  "| "
                  f"`{plan.get('scenarioId') or os.environ['SCENARIO_ID']}` | "
                  f"`{plan.get('manifestPath') or 'not-yet-defined'}` | "
                  f"`{plan.get('expectedStateId') or 'not-yet-defined'}` | "
                  f"{suites} | {phases} |"
              )
          else:
              print(
                  "| "
                  f"`{os.environ['SCENARIO_ID']}` | `(missing run-plan.json)` | "
                  "`(missing run-plan.json)` | `(missing)` | `(missing)` |"
              )
          PY

      - name: Upload Vitest E2E artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-${{ matrix.id }}
          path: |
            e2e-artifacts/vitest/${{ matrix.id }}/run-plan.json
            e2e-artifacts/vitest/${{ matrix.id }}/scenario.json
            e2e-artifacts/vitest/${{ matrix.id }}/scenario-result.json
            e2e-artifacts/vitest/${{ matrix.id }}/environment.result.json
            e2e-artifacts/vitest/${{ matrix.id }}/onboarding.result.json
            e2e-artifacts/vitest/${{ matrix.id }}/state-validation.result.json
            e2e-artifacts/vitest/${{ matrix.id }}/actions/
            e2e-artifacts/vitest/${{ matrix.id }}/logs/
            e2e-artifacts/vitest/${{ matrix.id }}/shell/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  # Free-standing live tests under test/e2e-scenario/live/ that don't fit the
  # registry-driven steady-state probe model. Each gets a discrete job here
  # because the matrix above only runs registry-scenarios.test.ts. Modeled on
  # #5049's free-standing pattern.
  openshell-version-pin-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',openshell-version-pin-vitest,') || contains(format(',{0},', inputs.scenarios), ',openshell-version-pin,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "openshell-version-pin"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/openshell-version-pin
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Run OpenShell version-pin live test
        # Migrated from test/e2e/test-openshell-version-pin.sh. Hermetic
        # installer-script behavioral test — no real network, no real install.
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/openshell-version-pin.test.ts \
            --silent=false --reporter=default

      - name: Upload OpenShell version-pin artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-openshell-version-pin
          path: e2e-artifacts/vitest/openshell-version-pin/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  onboard-negative-paths-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',onboard-negative-paths-vitest,') || contains(format(',{0},', inputs.scenarios), ',onboard-negative-paths,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "onboard-negative-paths"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/onboard-negative-paths
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run onboard negative-paths live test
        # Direct Vitest coverage for test/e2e/test-onboard-negative-paths.sh's
        # invalid-key contract. This intentionally bypasses typed registry and
        # state-validation machinery because the behavior is CLI exit/output.
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/onboard-negative-paths.test.ts \
            --silent=false --reporter=default

      - name: Upload onboard negative-paths artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-onboard-negative-paths
          path: e2e-artifacts/vitest/onboard-negative-paths/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  # Focused coverage for test/e2e/test-skill-agent-e2e.sh's live skill
  # injection + real OpenClaw agent-turn contract. The retained legacy bash
  # lane remains in nightly-e2e.yaml until #5098 Phase 11 shell retirement.
  skill-agent-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',skill-agent-vitest,') || contains(format(',{0},', inputs.scenarios), ',skill-agent,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "skill-agent"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/skill-agent
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        # The migrated skill-agent lane invokes helper scripts that call
        # `openshell` after the repo CLI onboard command has returned. Install
        # and resolve OpenShell in the workflow parent so PATH/OPENSHELL_BIN is
        # available to both Vitest and the bash helpers.
        run: bash scripts/install-openshell.sh

      - name: Run skill-agent live test
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            ls -la /usr/local/bin/openshell "$HOME/.local/bin/openshell" 2>&1 || true
            exit 1
          fi
          export OPENSHELL_BIN
          echo "Using OPENSHELL_BIN=$OPENSHELL_BIN"
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/skill-agent.test.ts \
            --silent=false --reporter=default

      - name: Upload skill-agent artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-skill-agent
          path: |
            e2e-artifacts/vitest/skill-agent/*/artifact-summary.json
            e2e-artifacts/vitest/skill-agent/*/cleanup.json
            e2e-artifacts/vitest/skill-agent/*/cleanup-skill-agent-summary.json
            e2e-artifacts/vitest/skill-agent/*/scenario.json
            e2e-artifacts/vitest/skill-agent/*/scenario-result.json
            e2e-artifacts/vitest/skill-agent/*/shell/*.result.json
            e2e-artifacts/vitest/skill-agent/*/shell/*.stdout.txt
            e2e-artifacts/vitest/skill-agent/*/shell/*.stderr.txt
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  # Focused coverage for test/e2e/test-openclaw-skill-cli-e2e.sh's direct
  # OpenClaw skills CLI contract. The retained legacy bash lane remains in
  # nightly-e2e.yaml until #5098 Phase 11 shell retirement.
  openclaw-skill-cli-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',openclaw-skill-cli-vitest,') || contains(format(',{0},', inputs.scenarios), ',openclaw-skill-cli,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "openclaw-skill-cli"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/openclaw-skill-cli
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-openclaw-skill-cli"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run OpenClaw skill CLI live test
        env:
          NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/openclaw-skill-cli.test.ts \
            --silent=false --reporter=default

      - name: Upload OpenClaw skill CLI artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-openclaw-skill-cli
          path: e2e-artifacts/vitest/openclaw-skill-cli/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

      - name: Clean up Docker auth
        if: always()
        shell: bash
        run: |
          docker logout docker.io >/dev/null 2>&1 || true

  hermes-root-entrypoint-smoke-vitest:
    needs: generate-matrix
    if: ${{ needs.generate-matrix.result == 'success' && ((inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',hermes-root-entrypoint-smoke-vitest,') || contains(format(',{0},', inputs.scenarios), ',hermes-root-entrypoint-smoke,')) }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "hermes-root-entrypoint-smoke"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/hermes-root-entrypoint-smoke
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Run Hermes root entrypoint smoke live test
        # Migrated from test/e2e/test-hermes-root-entrypoint-smoke.sh. This
        # builds the real Hermes image unless NEMOCLAW_HERMES_TEST_IMAGE points
        # at a prebuilt image, then probes the root entrypoint via Docker.
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/hermes-root-entrypoint-smoke.test.ts \
            --silent=false --reporter=default

      - name: Upload Hermes root entrypoint smoke artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-hermes-root-entrypoint-smoke
          path: e2e-artifacts/vitest/hermes-root-entrypoint-smoke/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  inference-routing-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',inference-routing-vitest,') || contains(format(',{0},', inputs.scenarios), ',inference-routing,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "inference-routing"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/inference-routing
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run inference routing live test
        # Direct Vitest coverage for test/e2e/test-inference-routing.sh. The
        # always-on PR-safe slices prove invalid-key and unreachable-endpoint
        # classification/cleanup without spending live provider quota; real
        # NVIDIA credential isolation and third-party provider smokes stay
        # skipped unless their secrets are explicitly supplied by a future
        # workflow.
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/inference-routing.test.ts \
            --silent=false --reporter=default

      - name: Upload inference routing artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-inference-routing
          path: e2e-artifacts/vitest/inference-routing/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  cloud-inference-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',cloud-inference-vitest,') || contains(format(',{0},', inputs.scenarios), ',cloud-inference,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 50
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "cloud-inference"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/cloud-inference
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-cloud-inference"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run cloud inference live test
        # Migrated from test/e2e/test-cloud-inference-e2e.sh. The Vitest test
        # preserves the legacy install.sh/onboard path, posts a live PONG
        # request through sandbox inference.local, and reuses the skill
        # filesystem validators from the retained bash helpers.
        env:
          NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/cloud-inference.test.ts \
            --silent=false --reporter=default

      - name: Upload cloud inference artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-cloud-inference
          path: e2e-artifacts/vitest/cloud-inference/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  kimi-inference-compat-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',kimi-inference-compat-vitest,') || contains(format(',{0},', inputs.scenarios), ',kimi-inference-compat,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 50
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "kimi-inference-compat"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/kimi-inference-compat
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-kimi-compat"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm
      - name: Install root dependencies
        run: npm ci --ignore-scripts
      - name: Build CLI
        run: npm run build:cli
      - name: Install OpenShell CLI
        run: bash scripts/install-openshell.sh
      - name: Run Kimi compatibility live Vitest test
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          export OPENSHELL_BIN="$(command -v openshell || true)"
          npx vitest run --project e2e-scenarios-live             test/e2e-scenario/live/kimi-inference-compat.test.ts             --silent=false --reporter=default
      - name: Upload Kimi compatibility artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-kimi-inference-compat
          path: e2e-artifacts/vitest/kimi-inference-compat/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  issue-4434-tui-unreachable-inference-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',issue-4434-tui-unreachable-inference-vitest,') || contains(format(',{0},', inputs.scenarios), ',issue-4434-tui-unreachable-inference,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 120
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "issue-4434-tui-unreachable-inference"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/issue-4434-tui-unreachable-inference
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_ISSUE_4434_LIVE: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Install issue #4434 host dependencies
        run: |
          set -euo pipefail
          sudo apt-get update
          sudo apt-get install -y expect iptables

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        run: bash scripts/install-openshell.sh

      - name: Run issue #4434 TUI unreachable inference live test
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            ls -la /usr/local/bin/openshell "$HOME/.local/bin/openshell" 2>&1 || true
            exit 1
          fi
          export OPENSHELL_BIN
          echo "Using OPENSHELL_BIN=$OPENSHELL_BIN"
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/issue-4434-tui-unreachable-inference.test.ts \
            --silent=false --reporter=default

      - name: Upload issue #4434 TUI unreachable inference artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-issue-4434-tui-unreachable-inference
          path: e2e-artifacts/vitest/issue-4434-tui-unreachable-inference/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  credential-sanitization-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',credential-sanitization-vitest,') || contains(format(',{0},', inputs.scenarios), ',credential-sanitization,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 65
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "credential-sanitization"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/credential-sanitization
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-credential-sanitization"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run credential sanitization live test
        # Migrated from test/e2e/test-credential-sanitization.sh. Preserves the
        # same ubuntu-latest + Docker/OpenShell + NVIDIA_INFERENCE_API_KEY lane by running
        # install.sh, onboarding a real sandbox, and probing sandbox state from
        # Vitest while fixture redaction owns evidence logs.
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/credential-sanitization.test.ts \
            --silent=false --reporter=default

      - name: Upload credential sanitization artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-credential-sanitization
          path: e2e-artifacts/vitest/credential-sanitization/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

      - name: Clean up Docker auth
        if: always()
        shell: bash
        run: |
          docker logout docker.io >/dev/null 2>&1 || true

  credential-migration-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',credential-migration-vitest,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 50
    env:
      FREE_STANDING_VITEST_JOB: "1"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/credential-migration
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-cred-migration"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run credential migration live test
        # Migrated from test/e2e/test-credential-migration.sh. This live test
        # stages NVIDIA_INFERENCE_API_KEY through legacy credentials.json as the
        # custom provider's COMPATIBLE_API_KEY. The hosted service behind this
        # repo-scoped secret is inference-api.nvidia.com, not Build/NVIDIA
        # Endpoints, so the test must exercise the compatible-provider route.
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
          NEMOCLAW_PROVIDER: custom
          NEMOCLAW_ENDPOINT_URL: https://inference-api.nvidia.com/v1
          NEMOCLAW_MODEL: nvidia/nvidia/nemotron-3-super-v3
          NEMOCLAW_COMPAT_MODEL: nvidia/nvidia/nemotron-3-super-v3
          NEMOCLAW_PREFERRED_API: openai-completions
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/credential-migration.test.ts \
            --silent=false --reporter=default

      - name: Upload credential migration artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-credential-migration
          path: e2e-artifacts/vitest/credential-migration/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  sessions-agents-cli-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',sessions-agents-cli-vitest,') || contains(format(',{0},', inputs.scenarios), ',sessions-agents-cli,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 70
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "sessions-agents-cli"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/sessions-agents-cli
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-sessions-agents-cli"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        run: |
          set -euo pipefail
          env -u DOCKER_CONFIG -u DOCKERHUB_USERNAME -u DOCKERHUB_TOKEN -u NVIDIA_API_KEY -u GITHUB_TOKEN \
            bash scripts/install-openshell.sh

      - name: Run sessions/agents CLI live test
        # Migrated from test/e2e/test-sessions-agents-cli.sh. This stays as a
        # host-side CLI live test because the contract is argv translation,
        # OpenClaw gateway dispatch, pending pairing/scope approval, and JSON
        # envelope handling for sessions/agents commands.
        env:
          NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/sessions-agents-cli.test.ts \
            --silent=false --reporter=default

      - name: Upload sessions/agents CLI artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-sessions-agents-cli
          path: e2e-artifacts/vitest/sessions-agents-cli/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  runtime-overrides-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',runtime-overrides-vitest,') || contains(format(',{0},', inputs.scenarios), ',runtime-overrides,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "runtime-overrides"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/runtime-overrides
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Run runtime overrides live test
        # Migrated from test/e2e/test-runtime-overrides.sh. Builds the real
        # sandbox image and exercises the runtime ENTRYPOINT override boundary.
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/runtime-overrides.test.ts \
            --silent=false --reporter=default

      - name: Upload runtime overrides artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-runtime-overrides
          path: e2e-artifacts/vitest/runtime-overrides/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  hermes-e2e-vitest:
    needs: generate-matrix
    if: ${{ needs.generate-matrix.outputs.hermes_selected == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 75
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "hermes-e2e"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/hermes-e2e
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_AGENT: hermes
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_RECREATE_SANDBOX: "1"
      NEMOCLAW_SANDBOX_NAME: e2e-hermes
      NEMOCLAW_MODEL: minimaxai/minimax-m2.7
      NEMOCLAW_ONBOARD_VALIDATION_TIMEOUT_SECONDS: "60"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run Hermes live Vitest test
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/hermes-e2e.test.ts \
            --silent=false --reporter=default

      - name: Upload Hermes live Vitest artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-hermes-e2e
          path: e2e-artifacts/vitest/hermes-e2e/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  network-policy-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',network-policy-vitest,') || contains(format(',{0},', inputs.scenarios), ',network-policy,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "network-policy"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/network-policy
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      # Raw OpenShell sandbox commands in the migrated live test must target
      # the gateway registered by NemoClaw onboarding even when OpenShell has
      # no active gateway selected on the runner.
      OPENSHELL_GATEWAY: nemoclaw
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell
        # Runs without workflow tokens, Docker credentials, or NVIDIA_INFERENCE_API_KEY.
        # scripts/install-openshell.sh pins the OpenShell version and verifies
        # release SHA-256 checksums before installation.
        env:
          NEMOCLAW_NON_INTERACTIVE: "1"
        run: |
          set -euo pipefail
          env -u DOCKER_CONFIG -u DOCKERHUB_USERNAME -u DOCKERHUB_TOKEN -u NVIDIA_INFERENCE_API_KEY -u GITHUB_TOKEN bash scripts/install-openshell.sh

      - name: Run network-policy live test
        # Migrated from test/e2e/test-network-policy.sh. Free-standing anchor
        # for live network policy allow/deny probes; shell retirement remains
        # deferred to #5098 Phase 11.
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/network-policy.test.ts \
            --silent=false --reporter=default

      - name: Upload network-policy artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-network-policy
          path: e2e-artifacts/vitest/network-policy/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  common-egress-agent-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',common-egress-agent-vitest,') || contains(format(',{0},', inputs.scenarios), ',common-egress-agent,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 120
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "common-egress-agent"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/common-egress-agent
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_RECREATE_SANDBOX: "1"
      OPENSHELL_GATEWAY: nemoclaw
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell
        # Direct Vitest execution uses bin/nemoclaw.js instead of install.sh,
        # so install OpenShell explicitly before onboard and SSH-agent probes.
        env:
          NEMOCLAW_NON_INTERACTIVE: "1"
        run: |
          set -euo pipefail
          env -u DOCKER_CONFIG -u DOCKERHUB_USERNAME -u DOCKERHUB_TOKEN -u NVIDIA_API_KEY -u GITHUB_TOKEN bash scripts/install-openshell.sh

      - name: Run common-egress agent live test
        # Migrated from test/e2e/test-common-egress-agent-e2e.sh. Preserves
        # OpenClaw balanced/open and Hermes open common-egress agent-turn
        # coverage against real sandbox policy and live hosted inference.
        env:
          NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            ls -la /usr/local/bin/openshell "$HOME/.local/bin/openshell" 2>&1 || true
            exit 1
          fi
          export OPENSHELL_BIN
          echo "Using OPENSHELL_BIN=$OPENSHELL_BIN"
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/common-egress-agent.test.ts \
            --silent=false --reporter=default

      - name: Upload common-egress agent artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-common-egress-agent
          path: e2e-artifacts/vitest/common-egress-agent/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  shields-config-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',shields-config-vitest,') || contains(format(',{0},', inputs.scenarios), ',shields-config,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "shields-config"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/shields-config
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: e2e-shields
      OPENSHELL_GATEWAY: nemoclaw
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Run shields-config live test
        # Migrated from test/e2e/test-shields-config.sh. The Vitest test runs
        # bash install.sh to preserve installer/onboard fidelity, then probes
        # real shields/config behavior against the live sandbox.
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/shields-config.test.ts \
            --silent=false --reporter=default

      - name: Upload shields-config artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-shields-config
          path: |
            e2e-artifacts/vitest/shields-config/
            /tmp/nemoclaw-e2e-shields-install.log
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  rebuild-openclaw-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',rebuild-openclaw-vitest,') || contains(format(',{0},', inputs.scenarios), ',rebuild-openclaw,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 130
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "rebuild-openclaw"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/rebuild-openclaw
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell
        # Direct Vitest execution uses bin/nemoclaw.js instead of install.sh,
        # so install OpenShell explicitly before onboard/rebuild commands.
        env:
          NEMOCLAW_NON_INTERACTIVE: "1"
        run: |
          set -euo pipefail
          env -u DOCKER_CONFIG -u DOCKERHUB_USERNAME -u DOCKERHUB_TOKEN -u NVIDIA_INFERENCE_API_KEY -u GITHUB_TOKEN bash scripts/install-openshell.sh

      - name: Run OpenClaw rebuild live test
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            ls -la /usr/local/bin/openshell "$HOME/.local/bin/openshell" 2>&1 || true
            exit 1
          fi
          export OPENSHELL_BIN
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/rebuild-openclaw.test.ts \
            --silent=false --reporter=default

      - name: Upload OpenClaw rebuild artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-rebuild-openclaw
          path: e2e-artifacts/vitest/rebuild-openclaw/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  sandbox-rebuild-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',sandbox-rebuild-vitest,') || contains(format(',{0},', inputs.scenarios), ',sandbox-rebuild,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "sandbox-rebuild"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/sandbox-rebuild
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      OPENSHELL_GATEWAY: nemoclaw
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell
        env:
          NEMOCLAW_NON_INTERACTIVE: "1"
        run: |
          set -euo pipefail
          env -u DOCKER_CONFIG -u DOCKERHUB_USERNAME -u DOCKERHUB_TOKEN -u NVIDIA_INFERENCE_API_KEY -u GITHUB_TOKEN bash scripts/install-openshell.sh

      - name: Run sandbox rebuild live test
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            ls -la /usr/local/bin/openshell "$HOME/.local/bin/openshell" 2>&1 || true
            exit 1
          fi
          export OPENSHELL_BIN
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/sandbox-rebuild.test.ts \
            --silent=false --reporter=default

      - name: Upload sandbox rebuild artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-sandbox-rebuild
          path: e2e-artifacts/vitest/sandbox-rebuild/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  state-backup-restore-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',state-backup-restore-vitest,') || contains(format(',{0},', inputs.scenarios), ',state-backup-restore,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "state-backup-restore"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/state-backup-restore
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: e2e-state-backup
      OPENSHELL_GATEWAY: nemoclaw
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell
        env:
          NEMOCLAW_NON_INTERACTIVE: "1"
        run: |
          set -euo pipefail
          env -u DOCKER_CONFIG -u DOCKERHUB_USERNAME -u DOCKERHUB_TOKEN -u NVIDIA_API_KEY -u GITHUB_TOKEN bash scripts/install-openshell.sh

      - name: Run state backup restore live test
        env:
          NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            ls -la /usr/local/bin/openshell "$HOME/.local/bin/openshell" 2>&1 || true
            exit 1
          fi
          export OPENSHELL_BIN
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/state-backup-restore.test.ts \
            --silent=false --reporter=default

      - name: Upload state backup restore artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-state-backup-restore
          path: e2e-artifacts/vitest/state-backup-restore/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  double-onboard-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',double-onboard-vitest,') || contains(format(',{0},', inputs.scenarios), ',double-onboard,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "double-onboard"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/double-onboard
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        run: bash scripts/install-openshell.sh

      - name: Run double-onboard live Vitest test
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            ls -la /usr/local/bin/openshell "$HOME/.local/bin/openshell" 2>&1 || true
            exit 1
          fi
          export OPENSHELL_BIN
          echo "Using OPENSHELL_BIN=$OPENSHELL_BIN"
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/double-onboard.test.ts \
            --silent=false --reporter=default

      - name: Upload double-onboard Vitest artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-double-onboard
          path: e2e-artifacts/vitest/double-onboard/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  concurrent-gateway-ports-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',concurrent-gateway-ports-vitest,') || contains(format(',{0},', inputs.scenarios), ',concurrent-gateway-ports,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "concurrent-gateway-ports"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/concurrent-gateway-ports
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        run: bash scripts/install-openshell.sh

      - name: Run concurrent gateway ports live Vitest test
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            ls -la /usr/local/bin/openshell "$HOME/.local/bin/openshell" 2>&1 || true
            exit 1
          fi
          export OPENSHELL_BIN
          echo "Using OPENSHELL_BIN=$OPENSHELL_BIN"
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/concurrent-gateway-ports.test.ts \
            --silent=false --reporter=default

      - name: Upload concurrent gateway ports Vitest artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-concurrent-gateway-ports
          path: e2e-artifacts/vitest/concurrent-gateway-ports/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  onboard-resume-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',onboard-resume-vitest,') || contains(format(',{0},', inputs.scenarios), ',onboard-resume,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "onboard-resume"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/onboard-resume
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-resume"
      NEMOCLAW_PROVIDER: "custom"
      NEMOCLAW_ENDPOINT_URL: "https://inference-api.nvidia.com/v1"
      NEMOCLAW_MODEL: "nvidia/nvidia/nemotron-3-super-v3"
      NEMOCLAW_COMPAT_MODEL: "nvidia/nvidia/nemotron-3-super-v3"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        run: bash scripts/install-openshell.sh

      - name: Run onboard-resume live Vitest test
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
          COMPATIBLE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            exit 1
          fi
          export OPENSHELL_BIN
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/onboard-resume.test.ts \
            --silent=false --reporter=default

      - name: Upload onboard-resume artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-onboard-resume
          path: e2e-artifacts/vitest/onboard-resume/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  full-e2e-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',full-e2e-vitest,') || contains(format(',{0},', inputs.scenarios), ',full-e2e,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 75
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "full-e2e"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/full-e2e
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-full-vitest"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        run: bash scripts/install-openshell.sh

      - name: Run full-e2e live Vitest test
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            exit 1
          fi
          export OPENSHELL_BIN
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/full-e2e.test.ts \
            --silent=false --reporter=default

      - name: Upload full-e2e artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-full-e2e
          path: e2e-artifacts/vitest/full-e2e/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14


  cloud-onboard-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',cloud-onboard-vitest,') || contains(format(',{0},', inputs.scenarios), ',cloud-onboard,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 70
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "cloud-onboard"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/cloud-onboard
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-cloud-onboard-vitest"
      NEMOCLAW_PUBLIC_INSTALL_REF: "${{ github.sha }}"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        run: bash scripts/install-openshell.sh

      - name: Run cloud-onboard live Vitest test
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            exit 1
          fi
          export OPENSHELL_BIN
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/cloud-onboard.test.ts \
            --silent=false --reporter=default

      - name: Upload cloud-onboard artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-cloud-onboard
          path: e2e-artifacts/vitest/cloud-onboard/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  gpu-double-onboard-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',gpu-double-onboard-vitest,') || contains(format(',{0},', inputs.scenarios), ',gpu-double-onboard,') }}
    runs-on: linux-amd64-gpu-rtxpro6000-latest-1
    timeout-minutes: 100
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "gpu-double-onboard"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/gpu-double-onboard
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-gpu-double-onboard-vitest"
      NEMOCLAW_PROVIDER: "ollama"
      NEMOCLAW_OLLAMA_PROXY_PORT: "11435"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        run: bash scripts/install-openshell.sh

      - name: Run gpu-double-onboard live Vitest test
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            exit 1
          fi
          export OPENSHELL_BIN
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/gpu-double-onboard.test.ts \
            --silent=false --reporter=default

      - name: Upload gpu-double-onboard artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-gpu-double-onboard
          path: e2e-artifacts/vitest/gpu-double-onboard/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  onboard-repair-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',onboard-repair-vitest,') || contains(format(',{0},', inputs.scenarios), ',onboard-repair,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 75
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "onboard-repair"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/onboard-repair
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-repair-vitest"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        run: bash scripts/install-openshell.sh

      - name: Run onboard-repair live Vitest test
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            exit 1
          fi
          export OPENSHELL_BIN
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/onboard-repair.test.ts \
            --silent=false --reporter=default

      - name: Upload onboard-repair artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-onboard-repair
          path: e2e-artifacts/vitest/onboard-repair/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  issue-4462-scope-upgrade-approval-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',issue-4462-scope-upgrade-approval-vitest,') || contains(format(',{0},', inputs.scenarios), ',issue-4462-scope-upgrade-approval,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "issue-4462-scope-upgrade-approval"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/issue-4462-scope-upgrade-approval
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-issue-4462-vitest"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        run: bash scripts/install-openshell.sh

      - name: Run issue-4462-scope-upgrade-approval live Vitest test
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            exit 1
          fi
          export OPENSHELL_BIN
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/issue-4462-scope-upgrade-approval.test.ts \
            --silent=false --reporter=default

      - name: Upload issue-4462-scope-upgrade-approval artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-issue-4462-scope-upgrade-approval
          path: e2e-artifacts/vitest/issue-4462-scope-upgrade-approval/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  token-rotation-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',token-rotation-vitest,') || contains(format(',{0},', inputs.scenarios), ',token-rotation,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "token-rotation"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/token-rotation
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run token rotation live test
        # Migrated from nightly-e2e.yaml token-rotation-e2e. Preserve the
        # original runner class: ubuntu-latest with Docker/OpenShell plus the
        # legacy-supported fake OpenAI-compatible endpoint path and fake
        # Telegram/Discord/Slack token boundary.
        env:
          GITHUB_TOKEN: ${{ github.token }}
          TELEGRAM_BOT_TOKEN_A: "test-fake-token-A-rotation-e2e"
          TELEGRAM_BOT_TOKEN_B: "test-fake-token-B-rotation-e2e"
          DISCORD_BOT_TOKEN_A: "dc-a-rotation-e2e"
          DISCORD_BOT_TOKEN_B: "dc-b-rotation-e2e"
          SLACK_BOT_TOKEN_A: "xoxb-fake-A-rotation-e2e"
          SLACK_BOT_TOKEN_B: "xoxb-fake-B-rotation-e2e"
          SLACK_APP_TOKEN_A: "xapp-fake-A-rotation-e2e"
          SLACK_APP_TOKEN_B: "xapp-fake-B-rotation-e2e"
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/token-rotation.test.ts \
            --silent=false --reporter=default

      - name: Upload token rotation artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-token-rotation
          path: e2e-artifacts/vitest/token-rotation/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  messaging-compatible-endpoint-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',messaging-compatible-endpoint-vitest,') || contains(format(',{0},', inputs.scenarios), ',messaging-compatible-endpoint,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "messaging-compatible-endpoint"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/messaging-compatible-endpoint
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-msg-compat"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run messaging compatible endpoint live test
        # Migrated from test/e2e/test-messaging-compatible-endpoint.sh.
        # Preserves the fake OpenAI-compatible endpoint, Telegram messaging
        # config, inference.local, OpenClaw agent-turn, and proxy hop-header
        # strip boundaries without relying on real messaging/provider secrets.
        env:
          NEMOCLAW_COMPAT_MOCK_API_KEY: "fake-compatible-key-e2e"
          TELEGRAM_ALLOWED_IDS: "123456789"
          TELEGRAM_BOT_TOKEN: "test-fake-telegram-token-e2e"
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/messaging-compatible-endpoint.test.ts \
            --silent=false --reporter=default

      - name: Upload messaging compatible endpoint artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-messaging-compatible-endpoint
          path: e2e-artifacts/vitest/messaging-compatible-endpoint/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  messaging-providers-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',messaging-providers-vitest,') || contains(format(',{0},', inputs.scenarios), ',messaging-providers,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "messaging-providers"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/messaging-providers
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run messaging providers live Vitest test
        # Migrated from test/e2e/test-messaging-providers.sh. The test keeps
        # the legacy fake-token defaults, optional _REAL secret overrides,
        # provider placeholder redaction checks, and WhatsApp QR-only parity.
        env:
          NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
          TELEGRAM_BOT_TOKEN_REAL: ${{ secrets.TELEGRAM_BOT_TOKEN_REAL }}
          DISCORD_BOT_TOKEN_REAL: ${{ secrets.DISCORD_BOT_TOKEN_REAL }}
          SLACK_BOT_TOKEN_REAL: ${{ secrets.SLACK_BOT_TOKEN_REAL }}
          SLACK_APP_TOKEN_REAL: ${{ secrets.SLACK_APP_TOKEN_REAL }}
          TELEGRAM_ALLOWED_IDS: ${{ secrets.TELEGRAM_ALLOWED_IDS }}
          TELEGRAM_AUTHORIZED_CHAT_IDS: ${{ secrets.TELEGRAM_AUTHORIZED_CHAT_IDS }}
          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
          TELEGRAM_CHAT_ID_E2E: ${{ secrets.TELEGRAM_CHAT_ID_E2E }}
          DISCORD_CHANNEL_ID_E2E: ${{ secrets.DISCORD_CHANNEL_ID_E2E }}
          SLACK_CHANNEL_ID_E2E: ${{ secrets.SLACK_CHANNEL_ID_E2E }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/messaging-providers.test.ts \
            --silent=false --reporter=default

      - name: Upload messaging providers artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-messaging-providers
          path: e2e-artifacts/vitest/messaging-providers/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  launchable-smoke-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',launchable-smoke-vitest,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      FREE_STANDING_VITEST_JOB: "1"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/launchable-smoke
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-launchable"
      NEMOCLAW_RECREATE_SANDBOX: "1"
      NEMOCLAW_MODEL: minimaxai/minimax-m2.7
      SKIP_DOCKER_PULL: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Run launchable smoke live test
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/launchable-smoke.test.ts \
            --silent=false --reporter=default

      - name: Upload launchable smoke artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-launchable-smoke
          path: e2e-artifacts/vitest/launchable-smoke/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  # Focused coverage slice for the provider-routed Model Router inference
  # contract. The retained legacy bash lane remains the source for full
  # closeout until a later PR proves replacement and deletes it.
  model-router-provider-routed-inference-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',model-router-provider-routed-inference-vitest,') || contains(format(',{0},', inputs.scenarios), ',model-router-provider-routed-inference,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "model-router-provider-routed-inference"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/model-router-provider-routed-inference
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Configure isolated Docker auth directory
        run: echo "DOCKER_CONFIG=${RUNNER_TEMP}/docker-config-model-router-provider-routed-inference" >> "$GITHUB_ENV"

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          mkdir -p "${DOCKER_CONFIG}"
          chmod 700 "${DOCKER_CONFIG}"
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run Model Router provider-routed inference live test
        # Direct Vitest coverage for
        # test/e2e/test-model-router-provider-routed-inference.sh. It preserves
        # the real provider-routed onboard, host model-router health, and
        # sandbox inference.local completion boundaries without adding registry
        # or migration-ledger wiring.
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/model-router-provider-routed-inference.test.ts \
            --silent=false --reporter=default

      - name: Upload Model Router provider-routed inference artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-model-router-provider-routed-inference
          path: e2e-artifacts/vitest/model-router-provider-routed-inference/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

      - name: Clean up Docker auth
        if: always()
        run: |
          set -euo pipefail
          docker logout docker.io || true
          rm -rf "${DOCKER_CONFIG}"

  snapshot-commands-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',snapshot-commands-vitest,') || contains(format(',{0},', inputs.scenarios), ',snapshot-commands,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 40
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "snapshot-commands"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/snapshot-commands
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-snapshot"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Configure isolated Docker auth directory
        run: echo "DOCKER_CONFIG=${RUNNER_TEMP}/docker-config-snapshot-commands" >> "$GITHUB_ENV"

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          mkdir -p "${DOCKER_CONFIG}"
          chmod 700 "${DOCKER_CONFIG}"
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Run snapshot commands live test
        # Migrated from test/e2e/test-snapshot-commands.sh. Preserves the
        # original ubuntu-latest + Docker/OpenShell + NVIDIA_API_KEY runner
        # contract by driving install.sh and the real snapshot CLI lifecycle.
        env:
          NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/snapshot-commands.test.ts \
            --silent=false --reporter=default

      - name: Upload snapshot commands artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-snapshot-commands
          path: e2e-artifacts/vitest/snapshot-commands/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

      - name: Clean up Docker auth
        if: always()
        run: |
          set -euo pipefail
          docker logout docker.io || true
          rm -rf "${DOCKER_CONFIG}"

  sandbox-survival-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',sandbox-survival-vitest,') || contains(format(',{0},', inputs.scenarios), ',sandbox-survival,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "sandbox-survival"
      DOCKER_CONFIG: ${{ github.workspace }}/.docker-config-sandbox-survival
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/sandbox-survival
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-survival"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          mkdir -p "${DOCKER_CONFIG}"
          chmod 700 "${DOCKER_CONFIG}"
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run sandbox survival live test
        # Migrated from test/e2e/test-sandbox-survival.sh. This intentionally
        # runs install.sh from Vitest to preserve installer/OpenShell/onboard
        # fidelity before exercising gateway restart, state survival, and live
        # inference.local before and after restart.
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/sandbox-survival.test.ts \
            --silent=false --reporter=default

      - name: Upload sandbox survival artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-sandbox-survival
          path: e2e-artifacts/vitest/sandbox-survival/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

      - name: Clean up Docker auth
        if: always()
        run: |
          set -euo pipefail
          docker logout docker.io || true
          rm -rf "${DOCKER_CONFIG}"

  diagnostics-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',diagnostics-vitest,') || contains(format(',{0},', inputs.scenarios), ',diagnostics,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "diagnostics"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/diagnostics
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-diag"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run diagnostics live test
        # Migrated from test/e2e/test-diagnostics.sh. This preserves the
        # ubuntu-latest + Docker/OpenShell + NVIDIA_API_KEY lane by running
        # debug archives, install.sh/onboard, sandbox exec/status, and
        # gateway-backed credentials list/reset from Vitest.
        env:
          NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live             test/e2e-scenario/live/diagnostics.test.ts             --silent=false --reporter=default

      - name: Upload diagnostics artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-diagnostics
          path: e2e-artifacts/vitest/diagnostics/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  gateway-drift-preflight-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',gateway-drift-preflight-vitest,') || contains(format(',{0},', inputs.scenarios), ',gateway-drift-preflight,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "gateway-drift-preflight"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/gateway-drift-preflight
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run gateway drift preflight Vitest test
        # Migrated from test/e2e/test-gateway-drift-preflight.sh. This keeps
        # the real repo CLI, PATH-resolved openshell/docker shims, host-process
        # marker/PID probes, and process exit behavior while avoiding live
        # Docker/OpenShell mutation.
        run: |
          set -euo pipefail
          npx vitest run --project cli             test/gateway-drift-preflight.test.ts             --silent=false --reporter=default

      - name: Upload gateway drift preflight artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-gateway-drift-preflight
          path: e2e-artifacts/vitest/gateway-drift-preflight/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  # Focused coverage slice for the #2603/#3145 OpenClaw websocket
  # protocol/history contract. The retained legacy bash lane remains the
  # source for full closeout until a later PR proves replacement and deletes it.
  openclaw-tui-chat-correlation-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',openclaw-tui-chat-correlation-vitest,') || contains(format(',{0},', inputs.scenarios), ',openclaw-tui-chat-correlation,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 75
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "openclaw-tui-chat-correlation"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/openclaw-tui-chat-correlation
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run OpenClaw TUI chat correlation live test
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/openclaw-tui-chat-correlation.test.ts \
            --silent=false --reporter=default

      - name: Upload OpenClaw TUI chat correlation artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-openclaw-tui-chat-correlation
          path: e2e-artifacts/vitest/openclaw-tui-chat-correlation/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  # ── Free-standing recovery scenarios (#2701) ─────────────────────────
  # Recovery / disruption scenarios don't fit the steady-state expected-state
  # registry that drives `live-scenarios` above. They run as free-standing
  # Vitest test files using the same `e2e-scenarios-live` project, framework
  # fixtures, and live-project gate — just outside the matrix.
  #
  # First failing-test-first guard for #2701 (gateway recovery does not
  # restore the /tmp guard chain after pod recreate). Will fail on `main`
  # until the #2701 fix lands; flips green afterwards.
  gateway-guard-recovery:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',gateway-guard-recovery,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 45
    env:
      FREE_STANDING_VITEST_JOB: "1"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/gateway-guard-recovery
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      # nemoclaw onboard registers the gateway under the canonical name
      # "nemoclaw" (src/lib/actions/sandbox/connect.ts:NEMOCLAW_GATEWAY_NAME)
      # but does not call `openshell gateway select` to mark it active. The
      # SandboxClient and recovery probes invoke `openshell sandbox exec`
      # directly, which fails with "No active gateway" when no active
      # gateway is configured. Setting OPENSHELL_GATEWAY here tells openshell
      # to use the named gateway for every invocation (per `openshell` -h
      # GATEWAY FLAGS: env: OPENSHELL_GATEWAY=).
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        # Onboard expects openshell to already be on PATH — install.sh handles
        # this for the legacy bash E2E suite (which runs `bash install.sh
        # --non-interactive` end-to-end). The Vitest fixture path skips
        # install.sh and invokes `bin/nemoclaw.js onboard` directly, so we
        # need to run the standalone openshell installer here. Mirrors what
        # `maybe_install_openshell_during_install` does in install.sh.
        run: bash scripts/install-openshell.sh

      - name: Run Vitest gateway-guard-recovery scenario
        env:
          NVIDIA_INFERENCE_API_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}
        run: |
          set -euo pipefail
          # OpenShell installs to /usr/local/bin on GitHub-hosted runners
          # (writable by the runner user, no sudo) or to ~/.local/bin in
          # NEMOCLAW_NON_INTERACTIVE mode when /usr/local/bin is not writable.
          # See scripts/install-openshell.sh:394-425. Cover both paths.
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          # Resolve the actual install path so the framework's SandboxClient
          # can spawn it without relying on PATH inheritance from the test
          # process (the framework also accepts OPENSHELL_BIN as an override).
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            ls -la /usr/local/bin/openshell "$HOME/.local/bin/openshell" 2>&1 || true
            exit 1
          fi
          export OPENSHELL_BIN
          echo "Using OPENSHELL_BIN=$OPENSHELL_BIN"
          "$OPENSHELL_BIN" --version
          npx vitest run \
            --project e2e-scenarios-live \
            test/e2e-scenario/live/gateway-guard-recovery.test.ts \
            --reporter=default --silent=false

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-gateway-guard-recovery
          path: e2e-artifacts/vitest/gateway-guard-recovery/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  openclaw-inference-switch-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',openclaw-inference-switch-vitest,') || contains(format(',{0},', inputs.scenarios), ',openclaw-inference-switch,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "openclaw-inference-switch"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/openclaw-inference-switch
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-openclaw-inference-switch"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run OpenClaw inference switch live test
        # Migrated from test/e2e/test-openclaw-inference-switch.sh. Preserves
        # the real install.sh/OpenShell/Docker/live-provider boundary while
        # Vitest owns the route, config, registry, inference.local, and agent
        # assertions.
        env:
          NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/openclaw-inference-switch.test.ts \
            --silent=false --reporter=default

      - name: Upload OpenClaw inference switch artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-openclaw-inference-switch
          path: |
            e2e-artifacts/vitest/openclaw-inference-switch/
            /tmp/nemoclaw-e2e-openclaw-inference-switch-install.log
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

      - name: Clean up Docker auth
        if: always()
        shell: bash
        run: |
          docker logout docker.io >/dev/null 2>&1 || true

  # Focused coverage slice for the Bedrock Runtime compatible Anthropic
  # endpoint contract. The retained legacy bash lane remains the source for
  # full closeout until #5098 Phase 11 shell retirement.
  bedrock-runtime-compatible-anthropic-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',bedrock-runtime-compatible-anthropic-vitest,') || contains(format(',{0},', inputs.scenarios), ',bedrock-runtime-compatible-anthropic,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        agent: [openclaw, hermes]
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "bedrock-runtime-compatible-anthropic"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/bedrock-runtime-compatible-anthropic/${{ matrix.agent }}
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_RECREATE_SANDBOX: "1"
      NEMOCLAW_AGENT: ${{ matrix.agent }}
      NEMOCLAW_SANDBOX_NAME: e2e-bedrock-${{ matrix.agent }}
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Configure isolated Docker auth directory
        run: echo "DOCKER_CONFIG=${RUNNER_TEMP}/docker-config-bedrock-runtime-compatible-anthropic-${{ matrix.agent }}" >> "$GITHUB_ENV"

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          mkdir -p "${DOCKER_CONFIG}"
          chmod 700 "${DOCKER_CONFIG}"
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Run Bedrock Runtime compatible Anthropic live test
        # Direct Vitest coverage for
        # test/e2e/test-bedrock-runtime-compatible-anthropic.sh. Preserves the
        # fake Bedrock Runtime endpoint, /etc/hosts mapping, source CLI
        # onboard, OpenShell adapter route, agent-specific runtime probes, and
        # leak-scan contract for both OpenClaw and Hermes.
        run: |
          set -euo pipefail
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/bedrock-runtime-compatible-anthropic.test.ts \
            --silent=false --reporter=default

      - name: Upload Bedrock Runtime compatible Anthropic artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-bedrock-runtime-compatible-anthropic-${{ matrix.agent }}
          path: e2e-artifacts/vitest/bedrock-runtime-compatible-anthropic/${{ matrix.agent }}/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

      - name: Clean up Docker auth
        if: always()
        run: |
          set -euo pipefail
          docker logout docker.io || true
          rm -rf "${DOCKER_CONFIG}"

  gateway-health-honest-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',gateway-health-honest-vitest,') || contains(format(',{0},', inputs.scenarios), ',gateway-health-honest,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "gateway-health-honest"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/gateway-health-honest
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        run: bash scripts/install-openshell.sh

      - name: Run gateway health honesty live test
        # Migrated from test/e2e/test-gateway-health-honest.sh. It invokes
        # real startGateway() with a sabotaged Docker-driver gateway binary
        # and asserts the crashed process is never reported healthy.
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/gateway-health-honest.test.ts \
            --silent=false --reporter=default

      - name: Upload gateway health honesty artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-gateway-health-honest
          path: e2e-artifacts/vitest/gateway-health-honest/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

  channels-add-remove-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',channels-add-remove-vitest,') || contains(format(',{0},', inputs.scenarios), ',channels-add-remove,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 75
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "channels-add-remove"
      DOCKER_CONFIG: ${{ github.workspace }}/.docker-config-channels-add-remove
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/channels-add-remove
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-channels-add-remove"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          mkdir -p "${DOCKER_CONFIG}"
          chmod 700 "${DOCKER_CONFIG}"
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell
        env:
          NEMOCLAW_NON_INTERACTIVE: "1"
        run: |
          set -euo pipefail
          env -u DOCKER_CONFIG -u DOCKERHUB_USERNAME -u DOCKERHUB_TOKEN -u NVIDIA_API_KEY -u GITHUB_TOKEN bash scripts/install-openshell.sh

      - name: Run channels add/remove live test
        # Migrated from test/e2e/test-channels-add-remove.sh. Preserves the
        # real OpenClaw + Docker/OpenShell boundary for onboard-empty,
        # channels add, rebuild, gateway credential reuse, policy-list, and
        # channels remove cleanup.
        env:
          NVIDIA_API_KEY: ${{ secrets.NVIDIA_API_KEY }}
          TELEGRAM_BOT_TOKEN: "test-fake-telegram-token-add-remove-e2e"
          TELEGRAM_ALLOWED_IDS: "123456789"
          TELEGRAM_REQUIRE_MENTION: "0"
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            ls -la /usr/local/bin/openshell "$HOME/.local/bin/openshell" 2>&1 || true
            exit 1
          fi
          export OPENSHELL_BIN
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/channels-add-remove.test.ts \
            --silent=false --reporter=default

      - name: Upload channels add/remove artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-channels-add-remove
          path: e2e-artifacts/vitest/channels-add-remove/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

      - name: Clean up Docker auth
        if: always()
        run: |
          set -euo pipefail
          docker logout docker.io || true
          rm -rf "${DOCKER_CONFIG}"

  issue-2478-crash-loop-recovery-vitest:
    needs: generate-matrix
    if: ${{ (inputs.jobs == '' && inputs.scenarios == '') || contains(format(',{0},', inputs.jobs), ',issue-2478-crash-loop-recovery-vitest,') || contains(format(',{0},', inputs.scenarios), ',issue-2478-crash-loop-recovery,') }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    env:
      FREE_STANDING_VITEST_JOB: "1"
      FREE_STANDING_SCENARIO_ID: "issue-2478-crash-loop-recovery"
      E2E_ARTIFACT_DIR: ${{ github.workspace }}/e2e-artifacts/vitest/issue-2478-crash-loop-recovery
      NEMOCLAW_CLI_BIN: ${{ github.workspace }}/bin/nemoclaw.js
      NEMOCLAW_RUN_E2E_SCENARIOS: "1"
      NEMOCLAW_NON_INTERACTIVE: "1"
      NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE: "1"
      NEMOCLAW_SANDBOX_NAME: "e2e-2478"
      OPENSHELL_GATEWAY: "nemoclaw"
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Configure isolated Docker auth directory
        run: echo "DOCKER_CONFIG=${RUNNER_TEMP}/docker-config-issue-2478-crash-loop-recovery" >> "$GITHUB_ENV"

      - name: Authenticate to Docker Hub
        env:
          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
          DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
        shell: bash
        run: |
          set -euo pipefail
          if [[ -z "${DOCKERHUB_USERNAME}" || -z "${DOCKERHUB_TOKEN}" ]]; then
            echo "::notice::Docker Hub credentials not configured; continuing with anonymous pulls."
            exit 0
          fi
          mkdir -p "${DOCKER_CONFIG}"
          chmod 700 "${DOCKER_CONFIG}"
          login_succeeded=0
          for attempt in 1 2 3; do
            if echo "${DOCKERHUB_TOKEN}" | timeout 30s docker login docker.io --username "${DOCKERHUB_USERNAME}" --password-stdin; then
              login_succeeded=1
              break
            fi
            if [[ "$attempt" -lt 3 ]]; then
              echo "::warning::Docker Hub login attempt ${attempt} failed; retrying."
              sleep 5
            fi
          done
          if [[ "$login_succeeded" -ne 1 ]]; then
            echo "::warning::Docker Hub login failed after 3 attempts; continuing with anonymous pulls."
          fi

      - name: Set up Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
        with:
          node-version: 22
          cache: npm

      - name: Install root dependencies
        run: npm ci --ignore-scripts

      - name: Build CLI
        run: npm run build:cli

      - name: Install OpenShell CLI
        run: bash scripts/install-openshell.sh

      - name: "Run issue #2478 crash-loop recovery live Vitest test"
        run: |
          set -euo pipefail
          export PATH="$HOME/.local/bin:$HOME/.npm-global/bin:$PATH"
          if command -v openshell >/dev/null 2>&1; then
            OPENSHELL_BIN="$(command -v openshell)"
          elif [ -x "$HOME/.local/bin/openshell" ]; then
            OPENSHELL_BIN="$HOME/.local/bin/openshell"
          else
            echo "::error::OpenShell CLI not found after install"
            ls -la /usr/local/bin/openshell "$HOME/.local/bin/openshell" 2>&1 || true
            exit 1
          fi
          export OPENSHELL_BIN
          echo "Using OPENSHELL_BIN=$OPENSHELL_BIN"
          "$OPENSHELL_BIN" --version
          npx vitest run --project e2e-scenarios-live \
            test/e2e-scenario/live/issue-2478-crash-loop-recovery.test.ts \
            --silent=false --reporter=default

      - name: "Upload issue #2478 crash-loop recovery artifacts"
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: e2e-vitest-scenarios-issue-2478-crash-loop-recovery
          path: e2e-artifacts/vitest/issue-2478-crash-loop-recovery/
          include-hidden-files: false
          if-no-files-found: ignore
          retention-days: 14

      - name: Clean up Docker auth
        if: always()
        run: |
          set -euo pipefail
          docker logout docker.io || true
          rm -rf "${DOCKER_CONFIG}"

  # ── PR result comment (mirrors nightly-e2e.yaml's report-to-pr) ───────────
  # Posts a results table on the open PR for the dispatching branch (or the
  # PR identified by `inputs.pr_number`). `if: always()` so the comment lands
  # even when scenario jobs failed — that's the whole point of a result
  # comment. Same shape as nightly-e2e.yaml:report-to-pr so reviewers see
  # consistent comment formatting across both suites.
  report-to-pr:
    runs-on: ubuntu-latest
    needs:
      [
        generate-matrix,
        live-scenarios,
        openshell-version-pin-vitest,
        onboard-negative-paths-vitest,
        skill-agent-vitest,
        openclaw-skill-cli-vitest,
        inference-routing-vitest,
        cloud-inference-vitest,
        kimi-inference-compat-vitest,
        credential-sanitization-vitest,
        credential-migration-vitest,
        sessions-agents-cli-vitest,
        runtime-overrides-vitest,
        hermes-e2e-vitest,
        hermes-root-entrypoint-smoke-vitest,
        network-policy-vitest,
        common-egress-agent-vitest,
        shields-config-vitest,
        rebuild-openclaw-vitest,
        sandbox-rebuild-vitest,
        state-backup-restore-vitest,
        token-rotation-vitest,
        messaging-compatible-endpoint-vitest,
        messaging-providers-vitest,
        launchable-smoke-vitest,
        double-onboard-vitest,
        concurrent-gateway-ports-vitest,
        full-e2e-vitest,
        cloud-onboard-vitest,
        gpu-double-onboard-vitest,
        onboard-repair-vitest,
        issue-4462-scope-upgrade-approval-vitest,
        onboard-resume-vitest,
        model-router-provider-routed-inference-vitest,
        sandbox-survival-vitest,
        diagnostics-vitest,
        snapshot-commands-vitest,
        gateway-drift-preflight-vitest,
        openclaw-tui-chat-correlation-vitest,
        gateway-guard-recovery,
        issue-4434-tui-unreachable-inference-vitest,
        openclaw-inference-switch-vitest,
        bedrock-runtime-compatible-anthropic-vitest,
        issue-2478-crash-loop-recovery-vitest,
        gateway-health-honest-vitest,
        channels-add-remove-vitest,
      ]
    if: ${{ always() && github.event_name == 'workflow_dispatch' }}
    permissions:
      issues: write
      pull-requests: write
    steps:
      - name: Post Vitest scenario results to PR
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          JOB_PR_NUMBER: ${{ inputs.pr_number }}
          JOB_SCENARIOS: ${{ inputs.scenarios }}
          JOBS: ${{ inputs.jobs }}
        with:
          script: |
            const needs = ${{ toJSON(needs) }};
            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
            const workflowBranch = context.ref.replace('refs/heads/', '');
            const prNumberInput = process.env.JOB_PR_NUMBER || '';
            const rawRequestedScenarios = process.env.JOB_SCENARIOS || '';
            const rawRequestedJobs = process.env.JOBS || '';
            const selectorValidationPassed = needs['generate-matrix']?.result === 'success';
            const requestedScenarios = selectorValidationPassed ? rawRequestedScenarios : '';
            const requestedJobs = selectorValidationPassed ? rawRequestedJobs : '';
            const scenariosRejected = rawRequestedScenarios && !selectorValidationPassed;
            const jobsRejected = rawRequestedJobs && !selectorValidationPassed;

            let prNumber = prNumberInput ? Number.parseInt(prNumberInput, 10) : undefined;
            if (!prNumber) {
              const { data: prs } = await github.rest.pulls.list({
                owner: context.repo.owner,
                repo: context.repo.repo,
                head: `${context.repo.owner}:${workflowBranch}`,
                state: 'open',
              });
              if (prs.length === 0) {
                core.info(`No open PR found for branch ${workflowBranch} — skipping comment.`);
                return;
              }
              prNumber = prs[0].number;
            }

            const emoji = { success: '✅', failure: '❌', cancelled: '⚠️', skipped: '⏭️' };
            const entries = Object.entries(needs).sort(([a], [b]) => a.localeCompare(b));
            const rows = entries.map(
              ([name, { result }]) => `| ${name} | ${emoji[result] || '❓'} ${result} |`,
            );
            const ran = entries.filter(([, v]) => v.result !== 'skipped');
            const passed = ran.filter(([, v]) => v.result === 'success');
            const failed = ran.filter(([, v]) => v.result === 'failure');
            const skipped = entries.filter(([, v]) => v.result === 'skipped');
            const status =
              failed.length > 0
                ? '❌ Some jobs failed'
                : skipped.length > 0 && passed.length === 0
                  ? '⚠️ No jobs ran'
                  : '✅ All jobs passed';

            const lines = [
              `### Vitest E2E Scenario Results — ${status}`,
              '',
              `**Run:** [${context.runId}](${runUrl})`,
              `**Workflow ref:** \`${workflowBranch}\``,
              scenariosRejected
                ? '**Requested scenarios:** _(selector rejected by workflow validation)_'
                : requestedScenarios
                  ? `**Requested scenarios:** \`${requestedScenarios}\``
                  : '**Requested scenarios:** _(default — all supported)_',
              jobsRejected
                ? '**Requested jobs:** _(selector rejected by workflow validation)_'
                : requestedJobs
                  ? `**Requested jobs:** \`${requestedJobs}\``
                  : '**Requested jobs:** _(default — all free-standing when no scenarios are requested)_',
              `**Summary:** ${passed.length} passed, ${failed.length} failed, ${skipped.length} skipped`,
              '',
              '| Job | Result |',
              '|-----|--------|',
              ...rows,
            ];
            if (failed.length > 0) {
              const failedNames = failed.map(([name]) => name).join(', ');
              lines.push('', `> **Failed jobs:** ${failedNames}. Check [run artifacts](${runUrl}) for logs.`);
            }

            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: prNumber,
              body: lines.join('\n'),
            });