fix: resolve rebase conflicts and fix flaky tests on Mac

Author: dumko2001

nemoclaw/src/commands/migration-state.test.ts

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { describe, it, expect, beforeEach, vi } from "vitest";
+import path from "node:path";
 import type { PluginLogger } from "../index.js";
 
 // ---------------------------------------------------------------------------
@@ -28,12 +29,28 @@ function addSymlink(p: string): void {
 }
 
 vi.mock("node:fs", async (importOriginal) => {
-  const original = await importOriginal();
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const original = (await importOriginal()) as any;
   return {
     ...original,
     existsSync: (p: string) => store.has(p),
-    mkdirSync: vi.fn((p: string) => {
-      addDir(p);
+    mkdirSync: vi.fn((p: string, options?: { recursive?: boolean }) => {
+      if (options?.recursive) {
+        let current = "";
+        const parts = p.split("/");
+        for (const part of parts) {
+          if (!part && !current) {
+            current = "/";
+            continue;
+          }
+          current = path.join(current, part);
+          if (!store.has(current)) {
+            addDir(current);
+          }
+        }
+      } else {
+        addDir(p);
+      }
     }),
     readFileSync: (p: string) => {
       const entry = store.get(p);
@@ -43,14 +60,16 @@ vi.mock("node:fs", async (importOriginal) => {
     writeFileSync: vi.fn((p: string, data: string) => {
       store.set(p, { type: "file", content: data });
     }),
+    chmodSync: vi.fn(),
     copyFileSync: vi.fn((src: string, dest: string) => {
       const entry = store.get(src);
       if (!entry) throw new Error(`ENOENT: ${src}`);
       store.set(dest, { ...entry });
     }),
     cpSync: vi.fn((src: string, dest: string) => {
-      // Shallow copy: copy all entries whose path starts with src
-      for (const [k, v] of store) {
+      // Recursive copy: find all entries starting with src
+      const entries = [...store.entries()];
+      for (const [k, v] of entries) {
         if (k === src || k.startsWith(src + "/")) {
           const relative = k.slice(src.length);
           store.set(dest + relative, { ...v });
@@ -59,7 +78,8 @@ vi.mock("node:fs", async (importOriginal) => {
     }),
     rmSync: vi.fn(),
     renameSync: vi.fn((oldPath: string, newPath: string) => {
-      for (const [k, v] of store) {
+      const entries = [...store.entries()];
+      for (const [k, v] of entries) {
         if (k === oldPath || k.startsWith(oldPath + "/")) {
           const relative = k.slice(oldPath.length);
           store.set(newPath + relative, v);

test/cli.test.js

@@ -76,7 +76,7 @@ describe("CLI dispatch", () => {
     expect(r.out.includes("Collecting diagnostics")).toBeTruthy();
     expect(r.out.includes("System")).toBeTruthy();
     expect(r.out.includes("Done")).toBeTruthy();
-  });
+  }, 15000);
 
   it("debug exits 1 on unknown option", () => {
     const r = run("debug --quik");

test/credential-isolation.test.js

@@ -0,0 +1,37 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { describe, it, expect } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+
+const ROOT = path.resolve(__dirname, "..");
+const CLI_PATH = path.join(ROOT, "bin/nemoclaw.js");
+
+describe("credential-isolation (static analysis)", () => {
+  const content = fs.readFileSync(CLI_PATH, "utf-8");
+
+  it("ensures setup() spreads process.env when passing NVIDIA_API_KEY", () => {
+    // Look for: run(`bash "${SCRIPTS}/setup.sh" ${shellQuote(safeName)}`, { env: { ...process.env, NVIDIA_API_KEY: key } });
+    const match = content.match(/async function setup\(\) \{[\s\S]*?run\(`bash "\$\{SCRIPTS\}\/setup\.sh" \$\{shellQuote\(safeName\)\}`, \{ env: \{ \.\.\.process\.env, NVIDIA_API_KEY: key \} \}\);/);
+    expect(match, "setup() should spread process.env and pass NVIDIA_API_KEY").not.toBeNull();
+  });
+
+  it("ensures setupSpark() spreads process.env when passing NVIDIA_API_KEY", () => {
+    // Look for: run(`sudo -E bash "${SCRIPTS}/setup-spark.sh"`, { env: { ...process.env, NVIDIA_API_KEY: key } });
+    const match = content.match(/async function setupSpark\(\) \{[\s\S]*?run\(`sudo -E bash "\$\{SCRIPTS\}\/setup-spark\.sh"`, \{ env: \{ \.\.\.process\.env, NVIDIA_API_KEY: key \} \}\);/);
+    expect(match, "setupSpark() should spread process.env and pass NVIDIA_API_KEY").not.toBeNull();
+  });
+
+  it("ensures deploy() reads NVIDIA_API_KEY from local env object", () => {
+    // Look for: const envLines = [`NVIDIA_API_KEY=${shellQuote(env.NVIDIA_API_KEY || "")}`];
+    const match = content.match(/const envLines = \[`NVIDIA_API_KEY=\$\{shellQuote\(env\.NVIDIA_API_KEY \|\| ""\)\}`\];/);
+    expect(match, "deploy() should read NVIDIA_API_KEY from env.NVIDIA_API_KEY").not.toBeNull();
+  });
+
+  it("ensures deploy() reads GITHUB_TOKEN from local env object", () => {
+    // Look for: const ghToken = env.GITHUB_TOKEN;
+    const match = content.match(/const ghToken = env\.GITHUB_TOKEN;/);
+    expect(match, "deploy() should read GITHUB_TOKEN from env.GITHUB_TOKEN").not.toBeNull();
+  });
+});