chore: Make live smoke read-only and fingerprint-pinned for DrayOS

[soulevilx]

Purpose: the live smoke sent echo, which DrayOS does not support, and allowed insecureSkipVerify. Jira: JOODT-14.
Scope: smoke runs the read-only sys version, requires SSH_HOST_FINGERPRINT (no insecure bypass), prints only sizes, timings or error code; unit tests with a fake client; docs and .env.example updated.
Checks: clean npm ci; npm run ci exit 0 (21 files, 233 tests, 100% coverage, 0 vulnerabilities). Live (dev router only): good fingerprint ok (290 bytes), wrong fingerprint fails with code hostkey. Independently re-run by QA.

Summary by CodeRabbit

• Security
  • Live smoke tests now require a host fingerprint and always verify the pinned SSH key; the option to skip verification has been removed.
  • Smoke test output now reports only sanitized metrics and error codes, without command output or connection details.
• Testing
  • Added automated coverage for live smoke test success, verification failures, and error handling. Live connections remain excluded from CI.
• Documentation
  • Updated setup instructions to explain the required fingerprint, command run, output, and failure behavior.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f86dd7dc-b084-4192-b897-c21008dec7c1

📥 Commits

Reviewing files that changed from the base of the PR and between 5ed09f1 and 1401a7d.

📒 Files selected for processing: 5

• .env.example
• docs/usage.md
• tools/live-smoke.mjs
• tools/live-smoke.test.mjs
• vitest.config.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The live-smoke runner now requires a pinned SSH host fingerprint, runs sys version, and reports sanitized metrics or an error code. Tests cover success and failure paths. The example environment file and usage documentation describe the updated requirements and output.

Changes: Live smoke test

Layer / File(s)

Summary

Pinned execution, validation, and usage tools/live-smoke.mjs, tools/live-smoke.test.mjs, vitest.config.ts, .env.example, docs/usage.md

The runner requires SSH credentials and a host fingerprint, connects with key verification enabled, runs sys version, and disconnects. It returns an exit code and logs sanitized metrics or an error code. Tests cover missing fingerprints, success, host-key failures, and unexpected errors. The Vitest configuration includes tool tests, and the example environment file and usage documentation describe the requirements and output.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Environment
  participant LiveSmoke
  participant SSHClient
  Environment->>LiveSmoke: Provide SSH settings
  LiveSmoke->>SSHClient: Connect with pinned fingerprint
  LiveSmoke->>SSHClient: Execute sys version
  LiveSmoke->>SSHClient: Disconnect
  LiveSmoke->>Environment: Return exit code and sanitized log

Loading

Merge Risk: ⚪ Minimal · up to 1401a

No merge-blocking issue remains in the reviewed live-smoke change.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (2 skipped: 2 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely summarizes the main changes: the live smoke is read-only and requires fingerprint-pinned SSH verification.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (2 skipped: 2 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}