fix(experimentalist): mirror insights auth handling in experimentalist

[BrianNewsom]

Summary

• discover the target Platform's auth mode before attaching the active local OAuth context
• use direct SDK mode for unauthenticated remote deployments, while preserving config-backed auth for authenticated remotes
• make nemo agents experimentalist doctor construct and close the same Platform client used by run
• report client-bootstrap failures as a required, sanitized doctor check

Reproduction

1. Have a valid ~/.config/nmp/config.yaml OAuth context for one Platform deployment.
2. Run Experimentalist against a different, unauthenticated remote deployment with --base-url.
3. doctor reports the raw health probe as healthy.
4. run unconditionally passes the unrelated config path to AsyncNeMoPlatform, which attempts OAuth token refresh and can fail before the experiment starts (for example, httpx.UnsupportedProtocol from an invalid refresh endpoint).

Root cause

Experimentalist classified all non-loopback remote URLs with a local config file as authenticated. Insights already avoids this by querying /apis/auth/discovery and only supplying config_path when the target reports auth_enabled=true.

Doctor only exercised a raw health URL, so it did not cover the SDK/auth bootstrap path used by a run.

Fix

Experimentalist now mirrors the Insights client policy:

• no explicit URL: use the active context
• loopback or no local config: direct mode
• unauthenticated remote: direct mode, ignoring unrelated local OAuth config
• authenticated remote: combine the explicit URL with the active config credentials

Doctor additionally constructs and closes the same client helper used by run. Initialization and cleanup errors are surfaced without echoing potentially sensitive exception details.

Validation

• pytest plugins/nemo-experimentalist/tests -q — 576 passed
• focused client/CLI suite — 77 passed
• Ruff check and format check for the full Experimentalist plugin — passed
• ty check for changed production files and new client tests — passed
• pre-commit run -a — all hooks passed, including repository type checks
• live read-only doctor against an unauthenticated remote deployment, with the normal cached OAuth context present and no NMP_CONFIG_FILE workaround — passed, including the new client-bootstrap check

Limitations

The new doctor check verifies SDK construction and cleanup through the effective auth path. It does not add a workspace-specific API query; the existing Platform reachability probe remains responsible for network readiness.

Summary by CodeRabbit

• New Features

  • Improved the diagnostic command to verify platform client startup and shutdown, with clear pass or failure results.
  • Added automatic configuration discovery for remote connections.
  • Remote connections without authentication now use direct access; authenticated connections continue using local OAuth settings.

• Bug Fixes

  • Improved handling and sanitization of client initialization errors in diagnostics.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Platform client flow

Layer / File(s)	Summary
Client authentication-mode selection plugins/nemo-experimentalist/src/nemo_experimentalist_plugin/client.py, plugins/nemo-experimentalist/tests/test_client.py	make_client discovers authentication settings for remote URLs. It uses direct mode when authentication is disabled and passes the OAuth configuration for authenticated clients.
Doctor bootstrap validation plugins/nemo-experimentalist/src/nemo_experimentalist_plugin/cli.py, plugins/nemo-experimentalist/tests/test_cli_profile.py	doctor constructs and closes the platform client. It reports structured failures for initialization or cleanup errors and a pass result when both succeed.

Sequence Diagram(s)

sequenceDiagram
  participant Doctor
  participant make_client
  participant AsyncNeMoPlatform
  Doctor->>make_client: construct client with effective base URL
  make_client->>AsyncNeMoPlatform: create direct or authenticated client
  AsyncNeMoPlatform-->>Doctor: initialized client
  Doctor->>AsyncNeMoPlatform: close client
  AsyncNeMoPlatform-->>Doctor: cleanup result
  Doctor-->>Doctor: append bootstrap check to report

Loading

Possibly related PRs

• NVIDIA-NeMo/nemo-platform#718: Modifies platform client construction and doctor/preflight bootstrap error handling.
• NVIDIA-NeMo/nemo-platform#752: Covers overlapping doctor/client bootstrap exception handling.
• NVIDIA-NeMo/nemo-platform#835: Covers remote platform connectivity and authentication configuration discovery.

Suggested reviewers: mckornfield, benmccown

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Experimentalist authentication-handling fix, which matches the pull request's primary change.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-experimentalist-auth-discovery/BrianNewsom

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

plugins/nemo-experimentalist/src/nemo_experimentalist_plugin/client.py (1)

47-52: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Classify the complete loopback range.

127.0.0.2 is loopback but bypasses direct mode. It triggers authentication discovery and can apply local OAuth configuration to a local target. Classify IP addresses with loopback semantics, not fixed literals.

• plugins/nemo-experimentalist/src/nemo_experimentalist_plugin/client.py#L47-L52: detect all loopback IP addresses before authentication discovery.
• plugins/nemo-experimentalist/tests/test_client.py#L25-L26: add 127.0.0.2 to the direct-mode cases.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@plugins/nemo-experimentalist/src/nemo_experimentalist_plugin/client.py`
around lines 47 - 52, Update the client host classification before
discover_nmp_config in client.py lines 47-52 to recognize all loopback IP
addresses, including 127.0.0.2, rather than relying only on fixed LOOPBACK_HOSTS
entries; preserve direct mode for loopback targets. Add 127.0.0.2 to the
direct-mode cases in tests/test_client.py lines 25-26.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@plugins/nemo-experimentalist/src/nemo_experimentalist_plugin/client.py`:
- Around line 47-52: Update the client host classification before
discover_nmp_config in client.py lines 47-52 to recognize all loopback IP
addresses, including 127.0.0.2, rather than relying only on fixed LOOPBACK_HOSTS
entries; preserve direct mode for loopback targets. Add 127.0.0.2 to the
direct-mode cases in tests/test_client.py lines 25-26.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f1940adc-638b-4600-8c47-c39a843f4b71

📥 Commits

Reviewing files that changed from the base of the PR and between 383d8de and 715a2de.

📒 Files selected for processing (4)

• plugins/nemo-experimentalist/src/nemo_experimentalist_plugin/cli.py
• plugins/nemo-experimentalist/src/nemo_experimentalist_plugin/client.py
• plugins/nemo-experimentalist/tests/test_cli_profile.py
• plugins/nemo-experimentalist/tests/test_client.py

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	30235/38242	79.1%	63.7%
Integration Tests	17880/36911	48.4%	20.9%