NVIDIA
diff --git a/‎test/e2e/fixtures/clients/gateway.ts‎
Lines changed: 53 additions & 13 deletions b/‎test/e2e/fixtures/clients/gateway.ts‎
Lines changed: 53 additions & 13 deletions
diff --git a/‎test/e2e/support/e2e-recovery-helpers.test.ts‎
Lines changed: 196 additions & 17 deletions b/‎test/e2e/support/e2e-recovery-helpers.test.ts‎
Lines changed: 196 additions & 17 deletions
@@ -42,6 +42,10 @@ const DEFAULT_GUARD_MARKERS: ReadonlyArray<string> = [
   "nemoclaw-sandbox-safety-net",
   "nemoclaw-ciao-network-guard",
 ];
+const GUARD_CHAIN_PROXY_ENV_PATH = "/tmp/nemoclaw-proxy-env.sh";
+const GUARD_CHAIN_ACTIVE_SENTINEL = "NEMOCLAW_GUARD_CHAIN_ACTIVE";
+const GUARD_CHAIN_FILE_UNAVAILABLE_EXIT_CODE = 20;
+const GUARD_CHAIN_MARKER_MISSING_EXIT_CODE = 21;
 
 /** Default gateway log path inside the sandbox. */
 const GATEWAY_LOG_PATH = "/tmp/gateway.log";
@@ -302,46 +306,82 @@ export class GatewayClient {
   }
 
   /**
-   * Assert that the NODE_OPTIONS guard chain is active for the gateway by
-   * reading `/tmp/nemoclaw-proxy-env.sh` and verifying it contains the
-   * expected preload markers (`--require` paths). The proxy-env file is
-   * the single source of truth — when recovery sources it, the gateway
-   * inherits the chain.
+   * Assert that the NODE_OPTIONS guard chain is active for the gateway. The
+   * sandbox command checks `/tmp/nemoclaw-proxy-env.sh` for every expected
+   * preload marker and returns only a fixed credential-free sentinel. It does
+   * not return the proxy environment file contents to the host or store them
+   * in evidence artifacts.
    *
    * We deliberately read the file rather than `/proc/<pid>/environ`:
    * `kernel.yama.ptrace_scope=1` blocks reads of /proc/.../environ across
    * non-ancestor process trees. This matches the legacy 2478 bash test's
    * approach (`gateway_guards_active` -> `proxy_env_contents`).
    *
-   * @throws if the file is missing or any expected marker is absent.
+   * @throws if the expected marker list is empty or a marker is empty or
+   * contains a carriage return or line feed; the file is missing, unreadable,
+   * or empty; an expected marker is absent; or the sentinel response is invalid.
    */
   async expectGuardChainActive(
     instance: NemoClawInstance,
     options: ExpectGuardChainOptions = {},
   ): Promise<void> {
     const expected = options.expectedMarkers ?? DEFAULT_GUARD_MARKERS;
+    if (
+      expected.length === 0 ||
+      expected.some((marker) => marker.length === 0 || /[\r\n]/u.test(marker))
+    ) {
+      throw new Error(
+        "expectGuardChainActive: expectedMarkers must be a non-empty list of non-empty single-line markers",
+      );
+    }
+    const script =
+      'set -eu; proxy_env="$1"; sentinel="$2"; shift 2; ' +
+      '[ -r "$proxy_env" ] && [ -s "$proxy_env" ] || exit 20; ' +
+      'for marker do grep -Fq -- "$marker" "$proxy_env" 2>/dev/null || exit 21; done; ' +
+      'printf "%s\\n" "$sentinel"';
     const result = await this.sandbox.exec(
       instance.sandboxName,
-      ["sh", "-c", "cat /tmp/nemoclaw-proxy-env.sh 2>/dev/null"],
+      [
+        "sh",
+        "-c",
+        script,
+        "nemoclaw-guard-chain-proof",
+        GUARD_CHAIN_PROXY_ENV_PATH,
+        GUARD_CHAIN_ACTIVE_SENTINEL,
+        ...expected,
+      ],
       {
         artifactName: `gateway-guard-chain-${instance.sandboxName}`,
         env: probeEnv(),
         ...options,
       },
     );
 
-    if (result.exitCode !== 0 || result.stdout.trim() === "") {
+    if (
+      result.exitCode === 0 &&
+      result.signal === null &&
+      !result.timedOut &&
+      result.stdout === `${GUARD_CHAIN_ACTIVE_SENTINEL}\n` &&
+      result.stderr === ""
+    ) {
+      return;
+    }
+
+    const quietFailure =
+      result.signal === null && !result.timedOut && result.stdout === "" && result.stderr === "";
+    if (quietFailure && result.exitCode === GUARD_CHAIN_FILE_UNAVAILABLE_EXIT_CODE) {
       throw new Error(
-        `expectGuardChainActive: /tmp/nemoclaw-proxy-env.sh missing or empty in ${instance.sandboxName}`,
+        `expectGuardChainActive: /tmp/nemoclaw-proxy-env.sh missing, unreadable, or empty in ${instance.sandboxName}`,
       );
     }
-
-    const missing = expected.filter((marker) => !result.stdout.includes(marker));
-    if (missing.length > 0) {
+    if (quietFailure && result.exitCode === GUARD_CHAIN_MARKER_MISSING_EXIT_CODE) {
       throw new Error(
-        `expectGuardChainActive: /tmp/nemoclaw-proxy-env.sh missing markers ${JSON.stringify(missing)} in ${instance.sandboxName}`,
+        `expectGuardChainActive: /tmp/nemoclaw-proxy-env.sh missing an expected marker in ${instance.sandboxName}`,
       );
     }
+    throw new Error(
+      `expectGuardChainActive: guard-chain check was invalid in ${instance.sandboxName}`,
+    );
   }
 
   /**
 
@@ -1,15 +1,24 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { ArtifactSink } from "../fixtures/artifacts.ts";
 import type { CommandRunner } from "../fixtures/clients/index.ts";
 import { GatewayClient, HostCliClient, SandboxClient } from "../fixtures/clients/index.ts";
 import type { NemoClawInstance } from "../fixtures/phases/onboarding.ts";
+import { startTestProgress, type TestProgress } from "../fixtures/progress.ts";
+import { redactString } from "../fixtures/redaction.ts";
 import type {
   ShellProbeResult,
   ShellProbeRunOptions,
   TrustedShellCommand,
 } from "../fixtures/shell-probe.ts";
+import { ShellProbe, trustedShellCommand } from "../fixtures/shell-probe.ts";
 
 interface RunnerCall {
   command: string;
@@ -67,6 +76,59 @@ class ScriptedRunner implements CommandRunner {
   }
 }
 
+class LocalGuardChainRunner implements CommandRunner {
+  readonly calls: RunnerCall[] = [];
+  readonly results: ShellProbeResult[] = [];
+  private readonly probe: ShellProbe;
+  private readonly progress: TestProgress;
+
+  constructor(
+    private readonly proxyEnvPath: string,
+    artifactRoot: string,
+  ) {
+    this.progress = startTestProgress(
+      "Guard-chain extraction support",
+      ["run guard-chain marker check", "verify guard-chain sentinel"],
+      { logLine: () => undefined },
+    );
+    this.probe = new ShellProbe({
+      artifacts: new ArtifactSink(artifactRoot),
+      progress: this.progress,
+      redact: redactString,
+      signal: new AbortController().signal,
+    });
+  }
+
+  async run(
+    command: TrustedShellCommand,
+    options?: ShellProbeRunOptions,
+  ): Promise<ShellProbeResult> {
+    const call = { command: command.command, args: [...command.args], options };
+    this.calls.push(call);
+    const separator = command.args.indexOf("--");
+    expect(separator).toBeGreaterThanOrEqual(0);
+    const [innerCommand, ...innerArgs] = command.args.slice(separator + 1);
+    expect(innerCommand).toBeTruthy();
+    const localArgs = innerArgs.map((argument) =>
+      argument.replaceAll("/tmp/nemoclaw-proxy-env.sh", this.proxyEnvPath),
+    );
+    const result = await this.probe.run(
+      trustedShellCommand({
+        command: innerCommand!,
+        args: localArgs,
+        reason: "exercise the generated guard-chain marker check",
+      }),
+      options,
+    );
+    this.results.push(result);
+    return result;
+  }
+
+  stop(): void {
+    this.progress.stop();
+  }
+}
+
 function fakeInstance(sandboxName = "e2e-2701"): NemoClawInstance {
   return {
     onboarding: "openclaw-nvidia",
@@ -88,7 +150,7 @@ function fakeInstance(sandboxName = "e2e-2701"): NemoClawInstance {
   };
 }
 
-function buildGateway(runner: ScriptedRunner): GatewayClient {
+function buildGateway(runner: CommandRunner): GatewayClient {
   const host = new HostCliClient(runner, { cliPath: "nemoclaw" });
   const sandbox = new SandboxClient(runner);
   return new GatewayClient(host, sandbox);
@@ -235,52 +297,169 @@ describe("GatewayClient recovery helpers (#2701)", () => {
   });
 
   describe("expectGuardChainActive", () => {
-    it("passes when proxy-env.sh contains the default safety-net + ciao markers", async () => {
+    it("returns only the fixed sentinel and excludes an opaque credential from results and artifacts", async () => {
+      const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-guard-chain-proof-"));
+      const proxyEnvPath = path.join(tmp, "proxy-env.sh");
+      const opaqueValue = "opaqueMintedGatewayMaterial_7qR2v9XcL4n8";
+      const expectedMarkers = [
+        "nemoclaw-sandbox-safety-net",
+        "nemoclaw-ciao-network-guard",
+        "-leading",
+        "literal;$(false)",
+      ];
+      const proxyEnv =
+        'export NODE_OPTIONS="--require /tmp/nemoclaw-sandbox-safety-net.js ' +
+        '--require /tmp/nemoclaw-ciao-network-guard.js -leading literal;$(false)"\n' +
+        `export HTTPS_PROXY="http://gateway-user:${opaqueValue}@127.0.0.1:3128"\n`;
+      expect(redactString(proxyEnv)).toBe(proxyEnv);
+      fs.writeFileSync(proxyEnvPath, proxyEnv, { mode: 0o600 });
+      const runner = new LocalGuardChainRunner(proxyEnvPath, path.join(tmp, "artifacts"));
+      const gateway = buildGateway(runner);
+
+      try {
+        await gateway.expectGuardChainActive(fakeInstance(), { expectedMarkers });
+
+        const result = runner.results.at(-1);
+        expect(result).toMatchObject({
+          exitCode: 0,
+          signal: null,
+          timedOut: false,
+          stdout: "NEMOCLAW_GUARD_CHAIN_ACTIVE\n",
+          stderr: "",
+        });
+        const call = runner.calls.at(-1);
+        const separator = call?.args.indexOf("--") ?? -1;
+        const innerArgs = call?.args.slice(separator + 1) ?? [];
+        expect(innerArgs.slice(0, 2)).toEqual(["sh", "-c"]);
+        expect(innerArgs.slice(4)).toEqual([
+          "/tmp/nemoclaw-proxy-env.sh",
+          "NEMOCLAW_GUARD_CHAIN_ACTIVE",
+          ...expectedMarkers,
+        ]);
+        expect(JSON.stringify(result)).not.toContain(opaqueValue);
+        expect(JSON.stringify(result)).not.toMatch(/<REDACTED>|\[REDACTED\]/u);
+        const artifacts = result!.artifacts;
+        const artifactContents =
+          fs.readFileSync(artifacts.stdout, "utf8") +
+          fs.readFileSync(artifacts.stderr, "utf8") +
+          fs.readFileSync(artifacts.result, "utf8");
+        expect(artifactContents).not.toContain(opaqueValue);
+        expect(artifactContents).not.toMatch(/<REDACTED>|\[REDACTED\]/u);
+
+        fs.writeFileSync(
+          proxyEnvPath,
+          proxyEnv.replace("literal;$(false)", "missing-custom-marker"),
+        );
+        await expect(
+          gateway.expectGuardChainActive(fakeInstance(), { expectedMarkers }),
+        ).rejects.toThrow(/missing an expected marker/);
+        const failedResult = runner.results.at(-1);
+        expect(failedResult).toMatchObject({ stdout: "", stderr: "" });
+        expect(JSON.stringify(failedResult)).not.toContain(opaqueValue);
+        expect(JSON.stringify(failedResult)).not.toMatch(/<REDACTED>|\[REDACTED\]/u);
+        const failedArtifacts = failedResult!.artifacts;
+        const failedArtifactContents =
+          fs.readFileSync(failedArtifacts.stdout, "utf8") +
+          fs.readFileSync(failedArtifacts.stderr, "utf8") +
+          fs.readFileSync(failedArtifacts.result, "utf8");
+        expect(failedArtifactContents).not.toContain(opaqueValue);
+        expect(failedArtifactContents).not.toMatch(/<REDACTED>|\[REDACTED\]/u);
+      } finally {
+        runner.stop();
+        fs.rmSync(tmp, { recursive: true, force: true });
+      }
+    });
+
+    it("passes only when the sandbox returns the fixed guard-chain sentinel", async () => {
       const runner = new ScriptedRunner();
-      runner.queue({
-        stdout:
-          'export NODE_OPTIONS="--require /tmp/nemoclaw-sandbox-safety-net.js ' +
-          '--require /tmp/nemoclaw-ciao-network-guard.js"\n',
-      });
+      runner.queue({ stdout: "NEMOCLAW_GUARD_CHAIN_ACTIVE\n" });
       const gateway = buildGateway(runner);
 
       await gateway.expectGuardChainActive(fakeInstance());
 
-      expect(runner.calls[0]?.args.slice(-1)[0]).toContain("cat /tmp/nemoclaw-proxy-env.sh");
+      const separator = runner.calls[0]?.args.indexOf("--") ?? -1;
+      expect(runner.calls[0]?.args.slice(separator + 4)).toEqual([
+        "nemoclaw-guard-chain-proof",
+        "/tmp/nemoclaw-proxy-env.sh",
+        "NEMOCLAW_GUARD_CHAIN_ACTIVE",
+        "nemoclaw-sandbox-safety-net",
+        "nemoclaw-ciao-network-guard",
+      ]);
     });
 
     it("fails when proxy-env.sh is empty (post pod-recreate target)", async () => {
       const runner = new ScriptedRunner();
-      runner.queue({ stdout: "" });
+      runner.queue({ exitCode: 20 });
       const gateway = buildGateway(runner);
 
       await expect(gateway.expectGuardChainActive(fakeInstance())).rejects.toThrow(
-        /missing or empty/,
+        /missing, unreadable, or empty/,
       );
     });
 
     it("fails when proxy-env.sh exists but a marker is absent", async () => {
       const runner = new ScriptedRunner();
-      runner.queue({
-        stdout: 'export NODE_OPTIONS="--require /tmp/nemoclaw-sandbox-safety-net.js"\n',
-      });
+      runner.queue({ exitCode: 21 });
       const gateway = buildGateway(runner);
 
       await expect(gateway.expectGuardChainActive(fakeInstance())).rejects.toThrow(
-        /missing markers.*nemoclaw-ciao-network-guard/,
+        /missing an expected marker/,
       );
     });
 
     it("honors a caller-supplied marker list", async () => {
       const runner = new ScriptedRunner();
-      runner.queue({
-        stdout: 'export NODE_OPTIONS="--require /tmp/nemoclaw-slack-channel-guard.js"\n',
-      });
+      runner.queue({ stdout: "NEMOCLAW_GUARD_CHAIN_ACTIVE\n" });
       const gateway = buildGateway(runner);
 
       await gateway.expectGuardChainActive(fakeInstance(), {
         expectedMarkers: ["nemoclaw-slack-channel-guard"],
       });
+
+      expect(runner.calls[0]?.args.at(-1)).toBe("nemoclaw-slack-channel-guard");
+    });
+
+    it.each([
+      { condition: "an empty marker list", expectedMarkers: [] },
+      { condition: "an empty marker value", expectedMarkers: [""] },
+      {
+        condition: "a marker with a line feed",
+        expectedMarkers: ["nemoclaw-sandbox-safety-net\n"],
+      },
+      {
+        condition: "a marker with a carriage return",
+        expectedMarkers: ["nemoclaw-sandbox-safety-net\r"],
+      },
+    ])("rejects $condition before running a sandbox command", async ({ expectedMarkers }) => {
+      const runner = new ScriptedRunner();
+      const gateway = buildGateway(runner);
+
+      await expect(
+        gateway.expectGuardChainActive(fakeInstance(), { expectedMarkers }),
+      ).rejects.toThrow(
+        /expectedMarkers must be a non-empty list of non-empty single-line markers/,
+      );
+      expect(runner.calls).toHaveLength(0);
+    });
+
+    it.each([
+      { condition: "returns a nonzero exit", reply: { exitCode: 1 } },
+      { condition: "times out", reply: { timedOut: true } },
+      { condition: "is terminated", reply: { signal: "SIGTERM" as const } },
+      { condition: "omits stdout", reply: { stdout: "" } },
+      { condition: "adds stdout", reply: { stdout: "NEMOCLAW_GUARD_CHAIN_ACTIVE\nextra\n" } },
+      {
+        condition: "adds stderr",
+        reply: { stdout: "NEMOCLAW_GUARD_CHAIN_ACTIVE\n", stderr: "unexpected\n" },
+      },
+    ])("rejects a guard-chain check that $condition", async ({ reply }) => {
+      const runner = new ScriptedRunner();
+      runner.queue({ stdout: "NEMOCLAW_GUARD_CHAIN_ACTIVE\n", ...reply });
+      const gateway = buildGateway(runner);
+
+      await expect(gateway.expectGuardChainActive(fakeInstance())).rejects.toThrow(
+        /guard-chain check was invalid/,
+      );
     });
   });