merge(main): incorporate terminal test fix

Author: cv

.github/workflows/codebase-growth-guardrails.yaml

@@ -140,7 +140,7 @@ jobs:
           set -euo pipefail
           node --experimental-strip-types tools/growth-guardrails/test-conditionals.mts
 
-      - name: Require changed test files not to add table-test candidate loops
+      - name: Require changed test files not to increase test-loop counts
         env:
           GH_TOKEN: ${{ github.token }}
           PR_NUMBER: ${{ github.event.pull_request.number }}

nemoclaw/src/onboard/config.test.ts

@@ -105,24 +105,25 @@ describe("onboard/config", () => {
       expect(describeOnboardProvider(config)).toBe("My Custom Provider");
     });
 
-    const endpointCases: [EndpointType, string][] = [
-      ["build", "NVIDIA Endpoints"],
-      ["openai", "OpenAI"],
-      ["anthropic", "Anthropic"],
-      ["gemini", "Google Gemini"],
-      ["ollama", "Local Ollama"],
-      ["vllm", "Local vLLM"],
-      ["nim-local", "Local NVIDIA NIM"],
-      ["ncp", "NVIDIA Cloud Partner"],
-      ["custom", "Other OpenAI-compatible endpoint"],
+    const endpointCases: Array<{ endpointType: EndpointType; expected: string }> = [
+      { endpointType: "build", expected: "NVIDIA Endpoints" },
+      { endpointType: "openai", expected: "OpenAI" },
+      { endpointType: "anthropic", expected: "Anthropic" },
+      { endpointType: "gemini", expected: "Google Gemini" },
+      { endpointType: "ollama", expected: "Local Ollama" },
+      { endpointType: "vllm", expected: "Local vLLM" },
+      { endpointType: "nim-local", expected: "Local NVIDIA NIM" },
+      { endpointType: "ncp", expected: "NVIDIA Cloud Partner" },
+      { endpointType: "custom", expected: "Other OpenAI-compatible endpoint" },
     ];
 
-    for (const [endpointType, expected] of endpointCases) {
-      it(`returns "${expected}" for endpoint type "${endpointType}"`, () => {
+    it.each(endpointCases)(
+      'returns "$expected" for endpoint type "$endpointType"',
+      ({ endpointType, expected }) => {
         const config = makeConfig({ endpointType, providerLabel: undefined });
         expect(describeOnboardProvider(config)).toBe(expected);
-      });
-    }
+      },
+    );
 
     it("returns Unknown for unsupported endpoint types", () => {
       const config = makeConfig({

scripts/growth-guardrails/find-test-loops.mts

@@ -2,10 +2,10 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 //
-// Finds `for` loops that make test cases or generated test definitions
-// iterative. Independent rows should use it.each or test.each so each failure
-// identifies one behavior. Required iteration can stay in a named helper
-// outside the test callback.
+// Finds `for` loops inside test callbacks and loops that generate test
+// definitions. Required iteration can stay in a named helper outside the test
+// callback. Independent rows should use it.each or test.each so each failure
+// identifies one behavior.
 
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import path from "node:path";
@@ -264,14 +264,14 @@ function formatContext(occurrence: TestLoopOccurrence): string {
 
 export function formatReport(report: TestLoopReport, options: Pick<CliOptions, "top">): string {
   const lines = [
-    `Scanned ${report.summary.scannedFiles} test files; found ${report.summary.loopCount} table-test candidate loop(s) in ${report.summary.filesWithLoops} file(s).`,
+    `Scanned ${report.summary.scannedFiles} test files; found ${report.summary.loopCount} test loop(s) in ${report.summary.filesWithLoops} file(s).`,
     "",
     "Top files by loop count:",
   ];
   for (const file of report.files.slice(0, options.top)) {
     lines.push(`- ${file.file}: loops=${file.count}`);
   }
-  lines.push("", "Table-test candidate loops:");
+  lines.push("", "Test loops:");
   for (const occurrence of report.occurrences.slice(0, options.top)) {
     lines.push(
       `- ${occurrence.file}:${occurrence.line}:${occurrence.column} [${formatContext(occurrence)}] ${occurrence.kind}`,

src/lib/actions/sandbox/connect-autopair-budget.ts

@@ -6,7 +6,10 @@
 // so tests can import and assert the invariant on the real values without
 // pulling in connect.ts's heavy transitive requires (#4504).
 
-export const CONNECT_AUTO_PAIR_MAX_APPROVALS = 1;
+// Fresh OpenClaw finalization can observe the initial CLI pairing request and
+// its immediately following operator.write upgrade in the same pass. Keep the
+// budget at those two bounded transitions so neither request is left pending.
+export const CONNECT_AUTO_PAIR_MAX_APPROVALS = 2;
 // `openclaw devices list` budget (seconds), interpolated into the in-sandbox
 // script so the invariant below is asserted on real values, not source text.
 // A cold OpenClaw 2026.6.10 CLI can take just over 2s to load its runtime
@@ -30,4 +33,4 @@ export const CONNECT_AUTO_PAIR_POST_TIMEOUT_OBSERVE_S = 4;
 // sources the proxy environment and launches Python. Keep 10s beyond the longer
 // inner path so the outer timer cannot terminate a legitimate approval before
 // its fixed receipt is returned.
-export const CONNECT_AUTO_PAIR_TIMEOUT_MS = 25_000;
+export const CONNECT_AUTO_PAIR_TIMEOUT_MS = 35_000;

src/lib/actions/sandbox/host-aliases.test.ts

@@ -40,8 +40,9 @@ function expectHostAliasError(action: () => void): HostAliasesCommandError {
 }
 
 describe("host alias legacy gateway support checks", () => {
-  for (const driver of ["docker", "vm"] as const) {
-    it(`rejects ${driver} driver sandboxes before probing Docker`, () => {
+  it.each(["docker", "vm"] as const)(
+    "rejects %s driver sandboxes before probing Docker",
+    (driver) => {
       const probeLegacyGatewayContainer = vi.fn(() => ({ state: "present" as const }));
 
       const error = expectHostAliasError(() =>
@@ -56,8 +57,8 @@ describe("host alias legacy gateway support checks", () => {
       );
       expect(error.message).toContain(`which the ${driver} driver does not run`);
       expect(probeLegacyGatewayContainer).not.toHaveBeenCalled();
-    });
-  }
+    },
+  );
 
   it("reports a missing legacy gateway distinctly from Docker probe failures", () => {
     const error = expectHostAliasError(() =>

src/lib/messaging/channels/slack/hooks/status-health.test.ts

@@ -116,9 +116,9 @@ describe("slack.statusHealth hook", () => {
     expect(execute).not.toHaveBeenCalled();
   });
 
-  for (const [name, account, inputs, expected, signal] of [
+  it.each([
     [
-      "classifies unavailable Slack credentials as terminal (#7383)",
+      "unavailable Slack credentials",
       {
         running: false,
         connected: false,
@@ -130,14 +130,15 @@ describe("slack.statusHealth hook", () => {
       { label: "Account probe", severity: "fail" },
     ],
     [
-      "classifies a Slack plugin probe failure as terminal (#7383)",
+      "a Slack plugin probe failure",
       { probe: { ok: false, error: "plugin failed to load" } },
       {},
       ["terminal", "plugin", "plugin_probe_failed", false],
       { label: "Account probe", severity: "warn" },
     ],
-  ] as const) {
-    it(name, () => {
+  ] as const)(
+    "classifies %s as terminal (#7383)",
+    (_condition, account, inputs, expected, signal) => {
       const [state, category, reason, retryable] = expected;
       const report = runProbe(account, inputs).report;
       expect(report.readiness).toMatchObject({
@@ -147,8 +148,8 @@ describe("slack.statusHealth hook", () => {
         retryable,
       } satisfies Partial<ChannelReadiness>);
       expect(report.signals).toContainEqual(expect.objectContaining(signal));
-    });
-  }
+    },
+  );
 
   it("returns a null transition time for an out-of-range Slack timestamp (#7383)", () => {
     expect(

src/lib/onboard/vllm-menu.test.ts

@@ -36,26 +36,24 @@ describe("buildVllmMenuEntries", () => {
     assert.match(entries[0].label, /running/);
   });
 
-  for (const [platform, hostLabel] of [
-    ["spark", "Spark"],
-    ["station", "Station"],
-  ] as const) {
-    it(`does not mark the running entry experimental on DGX ${hostLabel}`, () => {
-      const entries = buildVllmMenuEntries({
-        vllmRunning: true,
-        vllmProfile: null,
-        experimental: false,
-        platform,
-        hasVllmImage: false,
-        log: () => {},
-        env: {},
-      });
-      assert.equal(entries.length, 1);
-      assert.equal(entries[0].key, "vllm");
-      assert.doesNotMatch(entries[0].label, /experimental/);
-      assert.match(entries[0].label, /running/);
+  it.each([
+    { platform: "spark", hostLabel: "Spark" },
+    { platform: "station", hostLabel: "Station" },
+  ] as const)("does not mark the running entry experimental on DGX $hostLabel", ({ platform }) => {
+    const entries = buildVllmMenuEntries({
+      vllmRunning: true,
+      vllmProfile: null,
+      experimental: false,
+      platform,
+      hasVllmImage: false,
+      log: () => {},
+      env: {},
     });
-  }
+    assert.equal(entries.length, 1);
+    assert.equal(entries[0].key, "vllm");
+    assert.doesNotMatch(entries[0].label, /experimental/);
+    assert.match(entries[0].label, /running/);
+  });
 
   it("returns the install entry when a profile matches and EXPERIMENTAL is set", () => {
     const entries = buildVllmMenuEntries({

src/lib/openshell-sandbox-list.test.ts

@@ -76,22 +76,20 @@ describe("sandbox list gateway preflight and recovery (#6237)", () => {
     vi.restoreAllMocks();
   });
 
-  for (const [name, issue] of [
-    ["gateway image drift", imageDriftIssue],
-    ["host-process gateway drift", hostProcessDriftIssue],
-  ] as const) {
-    it(`exits before querying sandbox state for ${name}`, async () => {
-      mocks.detectPreflightIssue.mockReturnValueOnce(issue);
-
-      await expect(captureSandboxListWithGatewayPreflightOrExit(context)).rejects.toThrow(
-        "process.exit(1)",
-      );
-
-      expect(mocks.printIssue).toHaveBeenCalledWith(issue, context);
-      expect(mocks.captureOpenshell).not.toHaveBeenCalled();
-      expect(mocks.recoverNamedGatewayRuntime).not.toHaveBeenCalled();
-    });
-  }
+  it.each([
+    { name: "gateway image drift", issue: imageDriftIssue },
+    { name: "host-process gateway drift", issue: hostProcessDriftIssue },
+  ])("exits before querying sandbox state for $name", async ({ issue }) => {
+    mocks.detectPreflightIssue.mockReturnValueOnce(issue);
+
+    await expect(captureSandboxListWithGatewayPreflightOrExit(context)).rejects.toThrow(
+      "process.exit(1)",
+    );
+
+    expect(mocks.printIssue).toHaveBeenCalledWith(issue, context);
+    expect(mocks.captureOpenshell).not.toHaveBeenCalled();
+    expect(mocks.recoverNamedGatewayRuntime).not.toHaveBeenCalled();
+  });
 
   it("returns the successful sandbox list without gateway recovery", async () => {
     const result = await captureSandboxListWithGatewayPreflightOrExit(context);

src/lib/policy/host-redaction.test.ts

@@ -88,11 +88,9 @@ describe("isInternalHost", () => {
     "w.localdomain",
   ];
 
-  for (const host of internal) {
-    it(`treats ${host} as internal`, () => {
-      expect(isInternalHost(host)).toBe(true);
-    });
-  }
+  it.each(internal)("treats %s as internal", (host) => {
+    expect(isInternalHost(host)).toBe(true);
+  });
 
   const external = [
     "api.slack.com",
@@ -107,11 +105,9 @@ describe("isInternalHost", () => {
     "fec0::1",
     "2001:db8::1",
   ];
-  for (const host of external) {
-    it(`treats ${host} as external`, () => {
-      expect(isInternalHost(host)).toBe(false);
-    });
-  }
+  it.each(external)("treats %s as external", (host) => {
+    expect(isInternalHost(host)).toBe(false);
+  });
 });
 
 describe("hostStemsFromEndpoints", () => {

src/lib/sandbox/hermes-upstream-header.parity.test.ts

@@ -50,13 +50,11 @@ const FIXTURES: Array<{ name: string; config: Record<string, unknown> }> = [
 ];
 
 describe("buildHermesUpstreamHeader parity", () => {
-  for (const fixture of FIXTURES) {
-    it(`agent and host helpers produce identical output for: ${fixture.name}`, () => {
-      const agent = buildAgentHeader(fixture.config);
-      const host = buildHostHeader(fixture.config);
-      expect(host).toBe(agent);
-    });
-  }
+  it.each(FIXTURES)("agent and host helpers produce identical output for: $name", ({ config }) => {
+    const agent = buildAgentHeader(config);
+    const host = buildHostHeader(config);
+    expect(host).toBe(agent);
+  });
 
   it("strips newlines and control characters so the comment cannot escape into YAML", () => {
     const malicious = {