fix(onboard): skip CoreDNS patching on WSL2 to fix sandbox DNS

[jieunl24]

Summary

On WSL2 + Docker Desktop, fix-coredns.sh picks up the host DNS from /etc/resolv.conf which is not routable from k3s pods. This breaks CoreDNS and all DNS resolution inside the gateway - sandbox web tools fail with getaddrinfo EAI_AGAIN, and cloud inference onboarding fails because openshell inference set cannot verify the endpoint (e.g. integrate.api.nvidia.com).

Related Issue

#414 + Cloud inference onboarding failure regression was reported offline and was reproducible

Changes

Skip CoreDNS patching on WSL2 and rely on setup-dns-proxy.sh to handle sandbox DNS resolution instead.

Type of Change

• Code change for a new feature, bug fix, or refactor.
• Code change with doc updates.
• Doc only. Prose changes without code sample modifications.
• Doc only. Includes code sample changes.

Testing

• npx prek run --all-files passes (or equivalently make check).
• npm test passes.
• make docs builds without warnings. (for doc-only changes)
• Cloud inference onboarding -> openclaw tui
• Connect to sandbox -> run node -e "fetch('https://wttr.in/SanFrancisco?format=3').then(r => r.text()).then(t => console.log('OK', t)).catch(e => console.log('FAIL', e.code, e.cause))" with following rule added to policy

  weather:
    name: weather
    endpoints:
      - host: wttr.in
        port: 443
        access: full
      - host: api.open-meteo.com
        port: 443
        access: full
    binaries:
      - { path: /usr/local/bin/node }

Checklist

General

• I have read and followed the contributing guide.
• I have read and followed the style guide. (for doc-only changes)

Code Changes

• Formatters applied — npx prek run --all-files auto-fixes formatting (or make format for targeted runs).
• Tests added or updated for new or changed behavior.
• No secrets, API keys, or credentials committed.
• Doc pages updated for any user-facing behavior changes (new commands, changed defaults, new features, bug fixes that contradict existing docs).

Doc Changes

• Follows the style guide. Try running the update-docs agent skill to draft changes while complying with the style guide. For example, prompt your agent with "/update-docs catch up the docs for the new changes I made in this PR."
• New pages include SPDX license header and frontmatter, if creating a new page.
• Cross-references and links verified.

Summary by CodeRabbit

• Bug Fixes
  • Fixed CoreDNS patching behavior for Windows Subsystem for Linux (WSL) environments to prevent unnecessary modifications.

[coderabbitai]

📝 Walkthrough

Walkthrough

The shouldPatchCoredns function in bin/lib/platform.js was updated to accept an additional options parameter. A control-flow guard was added to detect WSL environments; when WSL is active, the function returns false instead of evaluating the runtime condition. Function comments were adjusted to document this WSL-specific behavior.

Changes

Cohort / File(s)	Summary
WSL Detection Guard bin/lib/platform.js	Updated shouldPatchCoredns function signature to accept opts parameter; added WSL detection guard that returns false for WSL environments, while preserving existing runtime !== "unknown" logic for non-WSL cases.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A WSL guard now shields the way,
No patching happens where Linux at play,
Options flow in, logic gates align,
Coredns knows which path to take—divine!
Our changes run swift, the code so fine! ✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: skipping CoreDNS patching on WSL2 to fix sandbox DNS issues, which aligns with the core problem and solution in the PR.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

bin/lib/platform.js (1)

38-44: Add a unit test for the new WSL short-circuit path.

Line 43 adds a new branch, but existing shouldPatchCoredns tests only validate runtime values. Please add coverage for WSL detection (e.g., Linux + WSL_INTEROP) to lock this regression fix.

Suggested test addition

 describe("shouldPatchCoredns", () => {
   it("patches CoreDNS for all known runtimes", () => {
     expect(shouldPatchCoredns("colima")).toBe(true);
     expect(shouldPatchCoredns("docker-desktop")).toBe(true);
     expect(shouldPatchCoredns("docker")).toBe(true);
     expect(shouldPatchCoredns("podman")).toBe(true);
   });

   it("skips unknown runtimes", () => {
     expect(shouldPatchCoredns("unknown")).toBe(false);
   });
+
+  it("skips patching on WSL even for known runtimes", () => {
+    expect(
+      shouldPatchCoredns("docker", {
+        platform: "linux",
+        env: { WSL_INTEROP: "1" },
+      }),
+    ).toBe(false);
+  });
 });

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@bin/lib/platform.js` around lines 38 - 44, Add a unit test covering the new
WSL short-circuit in shouldPatchCoredns: verify that when isWsl(...) returns
true (simulate WSL by mocking isWsl or by passing opts that include WSL_INTEROP
in the environment), shouldPatchCoredns(...) returns false regardless of
runtime, and include a control case asserting the original runtime-based
behavior when isWsl(...) is false; reference the shouldPatchCoredns function and
the isWsl helper when locating where to mock/simulate.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@bin/lib/platform.js`:
- Around line 38-44: Add a unit test covering the new WSL short-circuit in
shouldPatchCoredns: verify that when isWsl(...) returns true (simulate WSL by
mocking isWsl or by passing opts that include WSL_INTEROP in the environment),
shouldPatchCoredns(...) returns false regardless of runtime, and include a
control case asserting the original runtime-based behavior when isWsl(...) is
false; reference the shouldPatchCoredns function and the isWsl helper when
locating where to mock/simulate.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 317f7da5-9095-4a6f-bb8c-0271c77de426

📥 Commits

Reviewing files that changed from the base of the PR and between 08cccd4 and fe28d2f.

📒 Files selected for processing (1)

• bin/lib/platform.js

[ericksoa]

Nice fix — the WSL2 early return is clean and the comment explaining the delegation to setup-dns-proxy.sh is helpful.

One ask: could you add test coverage for the new branch? Something like:

it("skips patching on WSL2 even for known runtimes", () => {
  expect(shouldPatchCoredns("docker-desktop", {
    platform: "linux",
    env: { WSL_DISTRO_NAME: "Ubuntu" },
    release: "6.6.87.2-microsoft-standard-WSL2",
  })).toBe(false);
});

it("still patches on non-WSL Linux", () => {
  expect(shouldPatchCoredns("docker", {
    platform: "linux",
    env: {},
    release: "6.8.0-generic",
    procVersion: "",
  })).toBe(true);
});

This path is platform-conditional and easy to regress without explicit coverage.

[jieunl24]

Nice fix — the WSL2 early return is clean and the comment explaining the delegation to setup-dns-proxy.sh is helpful.

One ask: could you add test coverage for the new branch? Something like:

it("skips patching on WSL2 even for known runtimes", () => {
  expect(shouldPatchCoredns("docker-desktop", {
    platform: "linux",
    env: { WSL_DISTRO_NAME: "Ubuntu" },
    release: "6.6.87.2-microsoft-standard-WSL2",
  })).toBe(false);
});

it("still patches on non-WSL Linux", () => {
  expect(shouldPatchCoredns("docker", {
    platform: "linux",
    env: {},
    release: "6.8.0-generic",
    procVersion: "",
  })).toBe(true);
});

This path is platform-conditional and easy to regress without explicit coverage.

Ah the PR was already merged by the time I saw this comment! Will do as a follow up.