feat(worker): add grpc-v1 protocol and Rust worker SDK - #308
Conversation
WalkthroughThis PR adds new workspace crates for a gRPC worker protocol and Rust worker SDK, switches worker manifest protocol values to ChangesOut-of-process worker protocol and SDK
Estimated code review effort🎯 5 (Critical) | ⏱️ ~90+ minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 OpenGrep (1.23.0)crates/worker-proto/tests/proto_tests.rs┌──────────────┐ �[32m✔�[39m �[1mOpengrep OSS�[0m [00.12][ERROR]: unable to find a config; path crates/worker/tests/worker_sdk_tests.rs┌──────────────┐ �[32m✔�[39m �[1mOpengrep OSS�[0m [00.12][ERROR]: unable to find a config; path crates/worker/src/lib.rs┌──────────────┐ �[32m✔�[39m �[1mOpengrep OSS�[0m [00.12][ERROR]: unable to find a config; path Comment |
fe41e75 to
b65a8b0
Compare
b65a8b0 to
e1822df
Compare
e1822df to
3997008
Compare
3997008 to
1852cb5
Compare
1852cb5 to
0f85df6
Compare
0f85df6 to
fc2436e
Compare
fc2436e to
1e4251c
Compare
1e4251c to
ff285ce
Compare
coderabbitai
Bot
added
the
DO NOT MERGE
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/core/src/plugin/dynamic/manifest.rs`:
- Around line 575-583: Keep the whitespace normalization in the worker protocol
check inside manifest parsing: required_trimmed_string in the dynamic manifest
flow still returns the original string slice after only rejecting all-whitespace
input, so worker_protocol must continue to be compared using trim() against
SUPPORTED_WORKER_PROTOCOL. If you touch this area, either preserve the trim() in
the compat.worker_protocol validation or update/document
required_trimmed_string’s contract so the behavior remains explicit.
In `@crates/core/tests/unit/plugin_dynamic_tests.rs`:
- Around line 664-697: The current manifest tests only cover the rejected worker
protocol path and still use runtime = "python", so the new WorkerRuntime::Rust
and WorkerRuntime::Command cases in validate_load_shape are untested. Add
parse/validation coverage in plugin_dynamic_tests.rs with at least one manifest
for each of rust and command, and assert DynamicPluginManifest::parse_toml
accepts them and maps them successfully through the load/runtime validation
path. Keep the existing unsupported grpc-v2 rejection test intact while
extending coverage to the newly accepted runtime variants.
In `@crates/worker-proto/proto/nemo/relay/worker/v1/plugin_worker.proto`:
- Line 6: The Buf lint error comes from a package-directory mismatch in the
proto module. Update the Buf module root so it points to
crates/worker-proto/proto, or relocate the plugin_worker.proto file so the
package path rooted at nemo/relay/worker/v1 matches the lint root. Use the
existing package declaration in plugin_worker.proto and the Buf configuration
for the worker-proto module to make the directory structure and package name
align.
- Around line 117-124: Add authentication to the InvokeRequest protocol so
plugin invocations cannot be triggered over the local socket without
credentials. Update the InvokeRequest message in plugin_worker.proto to include
an auth_token field consistent with HandshakeRequest, ValidateRequest,
RegisterRequest, CancelInvocationRequest, and ShutdownRequest, then update the
worker server-side handling of InvokeRequest to require and verify that token
before dispatching callbacks. Use the existing auth-token flow and shared
request validation patterns in the worker protocol code to keep behavior
consistent.
In `@crates/worker-proto/tests/proto_tests.rs`:
- Around line 58-86: The protobuf stability test in
request_field_numbers_are_stable only checks for non-empty output and a string
match, so it can miss field renumbering. Update the test to assert the actual
wire tags/encoded field sequences for HandshakeRequest and InvokeRequest, or
decode explicit hand-built protobuf bytes back into those types, using the
existing request structs and encode_to_vec so any tag changes fail the test.
Keep the assertions tied to the specific fields in HandshakeRequest and
InvokeRequest rather than just overall byte presence.
In `@crates/worker/src/lib.rs`:
- Around line 184-206: The tool sanitizer registration methods are overwriting
each other because both register into the same tool_sanitizers map keyed only by
name. Update the Worker registration path, especially
register_tool_sanitize_request_guardrail and
register_tool_sanitize_response_guardrail, so request and response guardrails
are stored separately or keyed by both RegistrationSurface and name. Ensure
push_registration still advertises both surfaces, but the callback lookup/insert
in handlers does not collide when the same local name is used.
- Around line 802-824: The stream returned from the handler is only created
inside TASK_SCOPE_STACK_ID.scope, but it is polled after that scope ends, so
lazy chunk generation can lose the invocation context. Update the stream
handling in crates/worker/src/lib.rs around the handler invocation and mapped
stream creation so each poll of the JsonStream runs under the same
TASK_SCOPE_STACK_ID scope, preserving callback/future lifetimes and restoring
the scope for every poll before yielding StreamChunk items.
- Around line 1272-1316: The scope propagation helpers currently only carry
`scope_stack_id`, and `scope_context()` rebuilds a `ScopeContext` with an empty
`parent_scope_id`, which breaks parent-child relationships. Update
`TASK_SCOPE_STACK_ID`, `THREAD_SCOPE_STACK_ID`, `current_scope_stack_id`,
`with_thread_scope`, and `ThreadScopeBinding` to store and restore the full
`ScopeContext` instead of just the stack id. Make `scope_context()` preserve
both fields so host calls like `emit_mark` and `push_scope` keep the correct
parent scope.
- Around line 708-779: Ensure every RPC in the worker enforces the worker auth
token consistently: only handshake currently checks auth_token, while validate,
register, cancel_invocation, and shutdown ignore their token fields and invoke
lacks any token check. Add a shared auth/activation helper used by validate,
register, invoke, invoke_stream, cancel_invocation, and shutdown, and extend
InvokeRequest so callback dispatch is also authenticated before calling methods
like validate, register, and invoke_inner.
- Around line 827-845: The lifecycle RPC handlers in WorkerServiceImpl currently
ACK requests they do not actually تنفيذ, which is misleading. Update
cancel_invocation and shutdown so they do not return accepted: true until real
cancellation and graceful shutdown are wired through; instead, return an
unimplemented-style response or accepted: false with a clear message. Use the
existing WorkerServiceImpl methods cancel_invocation and shutdown as the entry
points for this change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: a7b847ae-6ecb-4afd-864b-25743c1a555a
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (16)
ATTRIBUTIONS-Rust.mdCargo.tomlabout.tomlcrates/cli/tests/cli_tests.rscrates/cli/tests/coverage/config_tests.rscrates/core/src/plugin/dynamic.rscrates/core/src/plugin/dynamic/manifest.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker-proto/Cargo.tomlcrates/worker-proto/build.rscrates/worker-proto/proto/nemo/relay/worker/v1/plugin_worker.protocrates/worker-proto/src/lib.rscrates/worker-proto/tests/proto_tests.rscrates/worker/Cargo.tomlcrates/worker/src/lib.rsdeny.toml
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: Check / Run
- GitHub Check: Preview docs
🧰 Additional context used
📓 Path-based instructions (21)
**/*.rs
📄 CodeRabbit inference engine (.agents/skills/add-binding-feature/SKILL.md)
Use
snake_casenaming convention for Rust identifiers (e.g.,nemo_relay_tool_call)
**/*.rs: Any Rust change must runjust test-rust
Any Rust change must runcargo fmt --all
Any Rust change must runcargo clippy --workspace --all-targets -- -D warnings
**/*.rs: Runcargo fmt --allfor all FFI work since it is Rust work
Runjust test-rustto validate FFI changes
Runcargo clippy --workspace --all-targets -- -D warningsto enforce strict linting on FFI workWhen Rust files changed as part of Go work, also run
cargo fmt --all,just test-rust, andcargo clippy --workspace --all-targets -- -D warnings
**/*.rs: Runcargo fmt --allwhen Rust files are changed as part of Node work
Runcargo clippy --workspace --all-targets -- -D warningswhen Rust files are changed as part of Node work
Runjust test-rustwhen Rust files are changed as part of Node work
**/*.rs: Runcargo fmt --allto format all Rust code
Runcargo clippy --workspace --all-targets -- -D warningsto enforce all clippy lints as errors
**/*.rs: Runcargo fmt --allwhen Rust files changed as part of WebAssembly work
Runcargo clippy --workspace --all-targets -- -D warningswhen Rust files changed as part of WebAssembly work
**/*.rs: If any Rust code changed, always runjust test-rust
If any Rust code changed, also runcargo fmt --all
If any Rust code changed, also runcargo clippy --workspace --all-targets -- -D warnings
Run Rust formatting withcargo fmt --all
Run Rust linting withcargo clippy --workspace --all-targets -- -D warnings
**/*.rs: Usecargo fmtfor Rust code formatting
Runcargo clippy -- -D warningsto lint Rust code and treat all warnings as errors
Use Rust snake_case naming convention for Rust identifiers
Include SPDX license header in all Rust source files using double-slash comment syntax
Validate Rust code withuv run pre-commit run --all-filesto enforce cargo fmt formatting check, cargo clippy lints, and cargo deny aud...
Files:
crates/worker-proto/build.rscrates/core/src/plugin/dynamic/manifest.rscrates/cli/tests/cli_tests.rscrates/cli/tests/coverage/config_tests.rscrates/worker-proto/tests/proto_tests.rscrates/worker-proto/src/lib.rscrates/core/src/plugin/dynamic.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
**/{Cargo.toml,**/*.rs}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Maintain consistency between Rust package names in
Cargo.tomland their actual usage across the codebase
Files:
crates/worker-proto/build.rscrates/worker-proto/Cargo.tomlcrates/core/src/plugin/dynamic/manifest.rscrates/cli/tests/cli_tests.rscrates/worker/Cargo.tomlCargo.tomlcrates/cli/tests/coverage/config_tests.rscrates/worker-proto/tests/proto_tests.rscrates/worker-proto/src/lib.rscrates/core/src/plugin/dynamic.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
**/*.{h,hpp,c,cpp,rs}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Ensure FFI header and library naming follows consistent conventions across platform-specific builds
Files:
crates/worker-proto/build.rscrates/core/src/plugin/dynamic/manifest.rscrates/cli/tests/cli_tests.rscrates/cli/tests/coverage/config_tests.rscrates/worker-proto/tests/proto_tests.rscrates/worker-proto/src/lib.rscrates/core/src/plugin/dynamic.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
**/*.{rs,toml}
📄 CodeRabbit inference engine (.agents/skills/rename-surfaces/SKILL.md)
Update Rust crate names and module prefixes during coordinated rename operations
Files:
crates/worker-proto/build.rscrates/worker-proto/Cargo.tomlabout.tomlcrates/core/src/plugin/dynamic/manifest.rsdeny.tomlcrates/cli/tests/cli_tests.rscrates/worker/Cargo.tomlCargo.tomlcrates/cli/tests/coverage/config_tests.rscrates/worker-proto/tests/proto_tests.rscrates/worker-proto/src/lib.rscrates/core/src/plugin/dynamic.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
**/*.{rs,py,js,ts,tsx,jsx,go,sh,toml,yaml,yml,md}
📄 CodeRabbit inference engine (AGENTS.md)
Keep SPDX headers on source, docs, scripts, and configuration files. The project is Apache-2.0.
Files:
crates/worker-proto/build.rscrates/worker-proto/Cargo.tomlabout.tomlcrates/core/src/plugin/dynamic/manifest.rsdeny.tomlcrates/cli/tests/cli_tests.rscrates/worker/Cargo.tomlCargo.tomlcrates/cli/tests/coverage/config_tests.rscrates/worker-proto/tests/proto_tests.rscrates/worker-proto/src/lib.rscrates/core/src/plugin/dynamic.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
**/*.{rs,py,go,js,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Follow binding naming conventions: Rust and Python use
snake_case, C FFI exports prefixednemo_relay_, Go usesPascalCasefor public APIs, Node.js usescamelCase.
Files:
crates/worker-proto/build.rscrates/core/src/plugin/dynamic/manifest.rscrates/cli/tests/cli_tests.rscrates/cli/tests/coverage/config_tests.rscrates/worker-proto/tests/proto_tests.rscrates/worker-proto/src/lib.rscrates/core/src/plugin/dynamic.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
crates/**/*.rs
📄 CodeRabbit inference engine (AGENTS.md)
crates/**/*.rs: Keep async behavior on the existing tokio-based model. Bindings should preserve callback and future lifetimes rather than blocking or hiding async work unexpectedly.
UseJson = serde_json::Valuein Rust-facing runtime APIs for JSON payload handling.
Files:
crates/worker-proto/build.rscrates/core/src/plugin/dynamic/manifest.rscrates/cli/tests/cli_tests.rscrates/cli/tests/coverage/config_tests.rscrates/worker-proto/tests/proto_tests.rscrates/worker-proto/src/lib.rscrates/core/src/plugin/dynamic.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
**
⚙️ CodeRabbit configuration file
**:AGENTS.md
This file provides guidance to agents, including Claude Code and OpenAI Codex, when working in this repository.
Project Overview
NeMo Relay is a multi-language agent runtime framework for execution scopes, lifecycle events, middleware, plugins, and observability around tool and LLM calls. The core runtime is Rust. Primary supported bindings are Rust, Python, and Node.js. Go, WebAssembly, and the raw C FFI are experimental and source-first.
The shared runtime model is:
- Scope stacks decide where work belongs and which scope-local behavior is visible.
- Middleware registries decide what guardrails and intercepts run around managed calls.
- Plugins install reusable runtime behavior from configuration.
- Events record runtime behavior in ATOF form.
- Subscribers and exporters consume events in-process or export them to ATIF, OpenTelemetry, OpenInference, or other backends.
Repository Structure
The repository layout separates the Rust runtime, language bindings, documentation,
integration patches, and agent-facing skills.crates/ core/ # Rust core runtime crate, published as nemo-relay adaptive/ # Adaptive runtime primitives and plugin components python/ # PyO3 native extension for the Python package ffi/ # Raw C ABI layer used by downstream bindings such as Go node/ # NAPI Node.js binding and JavaScript/TypeScript entry points wasm/ # wasm-bindgen WebAssembly binding and JS wrappers python/ nemo_relay/ # Python wrapper package: scopes, tools, LLM, middleware, typed helpers, plugins, adaptive helpers tests/ # Python tests go/ nemo_relay/ # Experimental Go CGo binding and tests fern/ # Fern documentation site scripts/ # Stable wrappers and helper scripts; build/test/docs entry points live in justfile third_party/ # P...
Files:
crates/worker-proto/build.rscrates/worker-proto/Cargo.tomlabout.tomlcrates/core/src/plugin/dynamic/manifest.rsdeny.tomlcrates/cli/tests/cli_tests.rscrates/worker/Cargo.tomlCargo.tomlcrates/cli/tests/coverage/config_tests.rscrates/worker-proto/tests/proto_tests.rscrates/worker-proto/src/lib.rscrates/worker-proto/proto/nemo/relay/worker/v1/plugin_worker.protocrates/core/src/plugin/dynamic.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
**/*.{py,txt,toml,cfg,yaml,yml}
📄 CodeRabbit inference engine (.agents/skills/rename-surfaces/SKILL.md)
Update Python package names and top-level module imports during coordinated rename operations
Files:
crates/worker-proto/Cargo.tomlabout.tomldeny.tomlcrates/worker/Cargo.tomlCargo.toml
**/Cargo.toml
📄 CodeRabbit inference engine (.agents/skills/rename-surfaces/SKILL.md)
Update WebAssembly crate names and generated package names during coordinated rename operations
Confirm or infer the target release version from
upstream/main:Cargo.toml. Derive the release branch asrelease/<major>.<minor>.
**/Cargo.toml: MaintainCargo.toml[workspace.package].versionas the source of truth for the Rust workspace and Python build versioning
KeepCargo.toml[workspace.dependencies]self-references aligned with the workspace version when the workspace version changes
After updating workspace package entries, runcargo check --workspaceto refreshCargo.lock
Files:
crates/worker-proto/Cargo.tomlcrates/worker/Cargo.tomlCargo.toml
{docs/**,README.md,**/Cargo.toml,**/package.json,**/*.md}
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
Ensure renamed public surfaces are reflected consistently in manifests and docs for large or public-facing changes
Files:
crates/worker-proto/Cargo.tomlcrates/worker/Cargo.tomlCargo.toml
**/*.{md,mdx,py,sh,yaml,yml,toml,json}
📄 CodeRabbit inference engine (.agents/skills/contribute-docs/SKILL.md)
Keep package names, repo references, and build commands current
Files:
crates/worker-proto/Cargo.tomlabout.tomldeny.tomlcrates/worker/Cargo.tomlCargo.toml
**/*.toml
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Include SPDX license header in TOML configuration files using hash comment syntax
Files:
crates/worker-proto/Cargo.tomlabout.tomldeny.tomlcrates/worker/Cargo.tomlCargo.toml
{crates/core,crates/adaptive}/**/*
📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)
Changes to
crates/coreorcrates/adaptivemust run the full language matrix
Files:
crates/core/src/plugin/dynamic/manifest.rscrates/core/src/plugin/dynamic.rscrates/core/tests/unit/plugin_dynamic_tests.rs
crates/core/**/*.rs
📄 CodeRabbit inference engine (.agents/skills/test-go-binding/SKILL.md)
If the change touched
crates/coreor shared runtime semantics, also usevalidate-changefor broader validation
crates/core/**/*.rs: UseJson = serde_json::Valuein Rust-facing runtime APIs where the existing code expects JSON payloads.
UseResult<T>withFlowErrorin core runtime paths. Keep errors explicit and binding-appropriate at the wrapper layer.
Files:
crates/core/src/plugin/dynamic/manifest.rscrates/core/src/plugin/dynamic.rscrates/core/tests/unit/plugin_dynamic_tests.rs
crates/{core,adaptive}/**
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
If
crates/coreorcrates/adaptivechanged, run the full matrix across Rust, Python, Go, Node.js, and WebAssembly
Files:
crates/core/src/plugin/dynamic/manifest.rscrates/core/src/plugin/dynamic.rscrates/core/tests/unit/plugin_dynamic_tests.rs
crates/{core,adaptive}/**/*.rs
⚙️ CodeRabbit configuration file
crates/{core,adaptive}/**/*.rs: Review the Rust runtime for async correctness, scope isolation, middleware ordering, and event lifecycle regressions.
Pay close attention to task-local/thread-local scope propagation, callback lifetimes, stream finalization, and root_uuid isolation.
Public API changes should preserve existing behavior unless tests and docs show the intended migration path.
Files:
crates/core/src/plugin/dynamic/manifest.rscrates/core/src/plugin/dynamic.rscrates/core/tests/unit/plugin_dynamic_tests.rs
deny.toml
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Run
cargo deny checkfor Rust dependency auditing as configured indeny.toml
Files:
deny.toml
{crates/adaptive/**/*.rs,**/*test*.{rs,py,go,ts,js},**/*adaptive*test*.{rs,py,go,ts,js},docs/plugins/adaptive/**}
📄 CodeRabbit inference engine (.agents/skills/maintain-optimizer/SKILL.md)
Maintain documented and tested validation and report behavior for adaptive surfaces
Files:
crates/cli/tests/cli_tests.rscrates/cli/tests/coverage/config_tests.rscrates/worker-proto/tests/proto_tests.rscrates/core/tests/unit/plugin_dynamic_tests.rs
{crates/**/tests/**,python/tests/**,go/nemo_relay/**/*_test.go}
⚙️ CodeRabbit configuration file
{crates/**/tests/**,python/tests/**,go/nemo_relay/**/*_test.go}: Tests should cover the behavior promised by the changed API surface, including error paths and cross-request isolation where relevant.
Prefer assertions on lifecycle events, scope stacks, middleware ordering, and binding parity over shallow smoke tests.
Files:
crates/cli/tests/cli_tests.rscrates/cli/tests/coverage/config_tests.rscrates/worker-proto/tests/proto_tests.rscrates/core/tests/unit/plugin_dynamic_tests.rs
**/*config*.{rs,ts,py,go,js,json,yaml,yml}
📄 CodeRabbit inference engine (.agents/skills/maintain-optimizer/SKILL.md)
Ensure dynamic config shape still matches the documented canonical model
Files:
crates/cli/tests/coverage/config_tests.rs
🪛 Buf (1.71.0)
crates/worker-proto/proto/nemo/relay/worker/v1/plugin_worker.proto
[error] 6-6: Files with package "nemo.relay.worker.v1" must be within a directory "nemo/relay/worker/v1" relative to root but were in directory "crates/worker-proto/proto/nemo/relay/worker/v1".
(PACKAGE_DIRECTORY_MATCH)
🔇 Additional comments (13)
crates/core/src/plugin/dynamic/manifest.rs (1)
513-523: LGTM!crates/cli/tests/cli_tests.rs (1)
80-80: LGTM!crates/cli/tests/coverage/config_tests.rs (1)
78-78: LGTM!crates/core/tests/unit/plugin_dynamic_tests.rs (1)
46-46: LGTM!Also applies to: 268-268, 289-289, 302-302, 481-481, 590-590, 629-629, 652-652, 806-806, 1019-1019, 1054-1054, 1188-1188, 1223-1223, 1261-1261
crates/core/src/plugin/dynamic.rs (1)
51-54: 🩺 Stability & AvailabilityNo change needed:
WorkerRuntimealready uses#[serde(rename_all = "snake_case")], sorustandcommandmap toWorkerRuntime::RustandWorkerRuntime::Command.Cargo.toml (1)
9-10: 📐 Maintainability & Code QualityRun the required Rust validation before merge.
The workspace wiring itself looks consistent, but the PR summary only reports targeted package tests/checks. Because this PR adds Rust crates, repo policy requires
just test-rust,cargo fmt --all, andcargo clippy --workspace --all-targets -- -D warningsbefore review. Please add those results as well. As per coding guidelines, "Any Rust change must runjust test-rust", "Any Rust change must runcargo fmt --all", and "Any Rust change must runcargo clippy --workspace --all-targets -- -D warnings".Also applies to: 33-34
Source: Coding guidelines
about.toml (1)
16-16: LGTM!crates/worker-proto/Cargo.toml (1)
1-26: LGTM!crates/worker-proto/src/lib.rs (1)
1-43: LGTM!crates/worker/Cargo.toml (1)
1-27: LGTM!deny.toml (1)
27-27: 🔒 Security & PrivacyVerify the deny audit after expanding the license allowlist.
Please confirm
cargo deny checkwas run after addingZlibso the new transitive license path is audited against the configured policy. As per coding guidelines, "deny.toml: Runcargo deny checkfor Rust dependency auditing as configured indeny.toml."Source: Coding guidelines
crates/worker-proto/build.rs (1)
1-14: 📐 Maintainability & Code QualityConfirm the required Rust validation commands.
This new Rust build script should be covered by
just test-rust,cargo fmt --all, andcargo clippy --workspace --all-targets -- -D warnings; the PR validation list only shows targetedcargo test/cargo checkcommands. As per coding guidelines, any Rust change must run these Rust validation commands.Source: Coding guidelines
crates/worker-proto/tests/proto_tests.rs (1)
88-108: LGTM!
Signed-off-by: Will Killian <wkillian@nvidia.com>
github-actions
Bot
added
size:XXL
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
crates/worker/src/lib.rs (1)
757-760: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winReturn the real plugin kind in the handshake.
Line 759 copies
plugin_idintoplugin_kind, so the handshake never reports the plugin's actual kind. That breaks the protocol metadata contract for any host logic that branches onplugin_kind.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@crates/worker/src/lib.rs` around lines 757 - 760, The handshake response in HandshakeHandler is copying plugin_id into plugin_kind instead of reporting the plugin’s real kind. Update the HandshakeResponse construction to use the plugin’s actual kind accessor from self.plugin for plugin_kind, while keeping plugin_id unchanged, so the metadata returned by handshake matches the protocol contract.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/worker/src/lib.rs`:
- Around line 709-713: The Unix socket setup in worker endpoint binding is
deleting whatever exists at the configured path before binding, which is unsafe
for caller-controlled paths. Update the endpoint handling in the unix:// branch
to inspect the existing filesystem entry first and only call remove_file when
the path already exists and is a socket, otherwise fail fast; keep the change
localized around parse_unix_endpoint and the UnixListener::bind flow in worker
server setup.
- Around line 555-559: Reuse the existing host gRPC connection instead of
dialing a new one in host_client(); the current RelayHostRuntimeClient::new path
reconnects on every runtime call. Update the surrounding Worker/host runtime
state to cache or share a Channel established from connect_host_endpoint, then
have host_client() return a client built from that stored channel so repeated
marks, scope operations, and continuations use the same connection.
In `@crates/worker/tests/worker_sdk_tests.rs`:
- Around line 339-355: Add a regression test for streaming auth in the existing
worker SDK stream test flow: `InvokeRequest.auth_token` is now enforced for both
`invoke` and `invoke_stream` in `worker::lib`, but this suite only checks the
unary path. Extend the `worker_sdk_tests` coverage by adding a bad-token
`invoke_stream` case alongside the current `llm-stream` assertions, and verify
it is rejected just like the unary RPC; use the existing `llm_invoke`,
`invoke_stream`, and `stream_json` helpers to keep the test aligned with the
changed API surface.
- Around line 194-200: The subscriber test only verifies the RPC returns Empty
and does not confirm the callback actually ran. Keep a clone of SurfacePlugin in
the test, invoke the subscriber through
client.invoke(Request::new(event_invoke("subscriber"))), and then assert that
the plugin recorded "subscriber-event" via the state tracked by
SurfacePlugin::register_subscriber. This ensures a no-op subscriber cannot
satisfy the test and the changed API behavior is covered.
---
Outside diff comments:
In `@crates/worker/src/lib.rs`:
- Around line 757-760: The handshake response in HandshakeHandler is copying
plugin_id into plugin_kind instead of reporting the plugin’s real kind. Update
the HandshakeResponse construction to use the plugin’s actual kind accessor from
self.plugin for plugin_kind, while keeping plugin_id unchanged, so the metadata
returned by handshake matches the protocol contract.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 55f3ec9c-00bb-48ba-8b3b-7bad512d3f12
📒 Files selected for processing (14)
.github/ci-path-filters.yml.github/workflows/ci.yaml.gitlab-ci.ymlRELEASING.mdbuf.yamlcodecov.ymlcrates/cli/tests/coverage/doctor_tests.rscrates/core/src/plugin/dynamic/manifest.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker-proto/proto/nemo/relay/worker/v1/plugin_worker.protocrates/worker-proto/tests/proto_tests.rscrates/worker/src/lib.rscrates/worker/tests/worker_sdk_tests.rsjustfile
📜 Review details
🧰 Additional context used
📓 Path-based instructions (32)
.{github/workflows/*.{yml,yaml},gitlab-ci.yml}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Ensure CI workflows reference the same package names, install commands, and build commands as local development workflows
Files:
.gitlab-ci.yml.github/workflows/ci.yaml
{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}
⚙️ CodeRabbit configuration file
{.github/**,.gitlab-ci.yml,.pre-commit-config.yaml,justfile,scripts/**}: Review automation changes for reproducibility, pinned versions where appropriate, secret handling, and consistency with the documented validation matrix.
Pay attention to commands that need generated native artifacts, FFI libraries, or platform-specific environment variables.
Files:
.gitlab-ci.yml.github/workflows/ci.yaml.github/ci-path-filters.ymljustfile
**/*.{py,txt,toml,cfg,yaml,yml}
📄 CodeRabbit inference engine (.agents/skills/rename-surfaces/SKILL.md)
Update Python package names and top-level module imports during coordinated rename operations
Files:
buf.yamlcodecov.yml
**/{docs,examples,**/*.md,*.patch,*.diff,.github,*.sh,*.yaml,*.yml}
📄 CodeRabbit inference engine (.agents/skills/rename-surfaces/SKILL.md)
Update documentation, examples, CI configuration, and patch artifacts when performing rename operations
Files:
buf.yamlcodecov.ymlRELEASING.md
**/*.{md,mdx,py,sh,yaml,yml,toml,json}
📄 CodeRabbit inference engine (.agents/skills/contribute-docs/SKILL.md)
Keep package names, repo references, and build commands current
Files:
buf.yamlcodecov.ymlRELEASING.md
**/*.{rs,py,js,ts,tsx,jsx,go,sh,toml,yaml,yml,md}
📄 CodeRabbit inference engine (AGENTS.md)
Keep SPDX headers on source, docs, scripts, and configuration files. The project is Apache-2.0.
Files:
buf.yamlcodecov.ymlcrates/worker-proto/tests/proto_tests.rscrates/cli/tests/coverage/doctor_tests.rscrates/core/src/plugin/dynamic/manifest.rsRELEASING.mdcrates/worker/tests/worker_sdk_tests.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
**
⚙️ CodeRabbit configuration file
**:AGENTS.md
This file provides guidance to agents, including Claude Code and OpenAI Codex, when working in this repository.
Project Overview
NeMo Relay is a multi-language agent runtime framework for execution scopes, lifecycle events, middleware, plugins, and observability around tool and LLM calls. The core runtime is Rust. Primary supported bindings are Rust, Python, and Node.js. Go, WebAssembly, and the raw C FFI are experimental and source-first.
The shared runtime model is:
- Scope stacks decide where work belongs and which scope-local behavior is visible.
- Middleware registries decide what guardrails and intercepts run around managed calls.
- Plugins install reusable runtime behavior from configuration.
- Events record runtime behavior in ATOF form.
- Subscribers and exporters consume events in-process or export them to ATIF, OpenTelemetry, OpenInference, or other backends.
Repository Structure
The repository layout separates the Rust runtime, language bindings, documentation,
integration patches, and agent-facing skills.crates/ core/ # Rust core runtime crate, published as nemo-relay adaptive/ # Adaptive runtime primitives and plugin components python/ # PyO3 native extension for the Python package ffi/ # Raw C ABI layer used by downstream bindings such as Go node/ # NAPI Node.js binding and JavaScript/TypeScript entry points wasm/ # wasm-bindgen WebAssembly binding and JS wrappers python/ nemo_relay/ # Python wrapper package: scopes, tools, LLM, middleware, typed helpers, plugins, adaptive helpers tests/ # Python tests go/ nemo_relay/ # Experimental Go CGo binding and tests fern/ # Fern documentation site scripts/ # Stable wrappers and helper scripts; build/test/docs entry points live in justfile third_party/ # P...
Files:
buf.yamlcodecov.ymlcrates/worker-proto/tests/proto_tests.rscrates/cli/tests/coverage/doctor_tests.rscrates/core/src/plugin/dynamic/manifest.rscrates/worker-proto/proto/nemo/relay/worker/v1/plugin_worker.protoRELEASING.mdcrates/worker/tests/worker_sdk_tests.rscrates/core/tests/unit/plugin_dynamic_tests.rsjustfilecrates/worker/src/lib.rs
**/*.rs
📄 CodeRabbit inference engine (.agents/skills/add-binding-feature/SKILL.md)
Use
snake_casenaming convention for Rust identifiers (e.g.,nemo_relay_tool_call)
**/*.rs: Any Rust change must runjust test-rust
Any Rust change must runcargo fmt --all
Any Rust change must runcargo clippy --workspace --all-targets -- -D warnings
**/*.rs: Runcargo fmt --allfor all FFI work since it is Rust work
Runjust test-rustto validate FFI changes
Runcargo clippy --workspace --all-targets -- -D warningsto enforce strict linting on FFI workWhen Rust files changed as part of Go work, also run
cargo fmt --all,just test-rust, andcargo clippy --workspace --all-targets -- -D warnings
**/*.rs: Runcargo fmt --allwhen Rust files are changed as part of Node work
Runcargo clippy --workspace --all-targets -- -D warningswhen Rust files are changed as part of Node work
Runjust test-rustwhen Rust files are changed as part of Node work
**/*.rs: Runcargo fmt --allto format all Rust code
Runcargo clippy --workspace --all-targets -- -D warningsto enforce all clippy lints as errors
**/*.rs: Runcargo fmt --allwhen Rust files changed as part of WebAssembly work
Runcargo clippy --workspace --all-targets -- -D warningswhen Rust files changed as part of WebAssembly work
**/*.rs: If any Rust code changed, always runjust test-rust
If any Rust code changed, also runcargo fmt --all
If any Rust code changed, also runcargo clippy --workspace --all-targets -- -D warnings
Run Rust formatting withcargo fmt --all
Run Rust linting withcargo clippy --workspace --all-targets -- -D warnings
**/*.rs: Usecargo fmtfor Rust code formatting
Runcargo clippy -- -D warningsto lint Rust code and treat all warnings as errors
Use Rust snake_case naming convention for Rust identifiers
Include SPDX license header in all Rust source files using double-slash comment syntax
Validate Rust code withuv run pre-commit run --all-filesto enforce cargo fmt formatting check, cargo clippy lints, and cargo deny aud...
Files:
crates/worker-proto/tests/proto_tests.rscrates/cli/tests/coverage/doctor_tests.rscrates/core/src/plugin/dynamic/manifest.rscrates/worker/tests/worker_sdk_tests.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
{crates/adaptive/**/*.rs,**/*test*.{rs,py,go,ts,js},**/*adaptive*test*.{rs,py,go,ts,js},docs/plugins/adaptive/**}
📄 CodeRabbit inference engine (.agents/skills/maintain-optimizer/SKILL.md)
Maintain documented and tested validation and report behavior for adaptive surfaces
Files:
crates/worker-proto/tests/proto_tests.rscrates/cli/tests/coverage/doctor_tests.rscrates/worker/tests/worker_sdk_tests.rscrates/core/tests/unit/plugin_dynamic_tests.rs
**/{Cargo.toml,**/*.rs}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Maintain consistency between Rust package names in
Cargo.tomland their actual usage across the codebase
Files:
crates/worker-proto/tests/proto_tests.rscrates/cli/tests/coverage/doctor_tests.rscrates/core/src/plugin/dynamic/manifest.rscrates/worker/tests/worker_sdk_tests.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
**/*.{h,hpp,c,cpp,rs}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Ensure FFI header and library naming follows consistent conventions across platform-specific builds
Files:
crates/worker-proto/tests/proto_tests.rscrates/cli/tests/coverage/doctor_tests.rscrates/core/src/plugin/dynamic/manifest.rscrates/worker/tests/worker_sdk_tests.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
**/*.{rs,toml}
📄 CodeRabbit inference engine (.agents/skills/rename-surfaces/SKILL.md)
Update Rust crate names and module prefixes during coordinated rename operations
Files:
crates/worker-proto/tests/proto_tests.rscrates/cli/tests/coverage/doctor_tests.rscrates/core/src/plugin/dynamic/manifest.rscrates/worker/tests/worker_sdk_tests.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
**/*.{rs,py,go,js,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Follow binding naming conventions: Rust and Python use
snake_case, C FFI exports prefixednemo_relay_, Go usesPascalCasefor public APIs, Node.js usescamelCase.
Files:
crates/worker-proto/tests/proto_tests.rscrates/cli/tests/coverage/doctor_tests.rscrates/core/src/plugin/dynamic/manifest.rscrates/worker/tests/worker_sdk_tests.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
crates/**/*.rs
📄 CodeRabbit inference engine (AGENTS.md)
crates/**/*.rs: Keep async behavior on the existing tokio-based model. Bindings should preserve callback and future lifetimes rather than blocking or hiding async work unexpectedly.
UseJson = serde_json::Valuein Rust-facing runtime APIs for JSON payload handling.
Files:
crates/worker-proto/tests/proto_tests.rscrates/cli/tests/coverage/doctor_tests.rscrates/core/src/plugin/dynamic/manifest.rscrates/worker/tests/worker_sdk_tests.rscrates/core/tests/unit/plugin_dynamic_tests.rscrates/worker/src/lib.rs
{crates/**/tests/**,python/tests/**,go/nemo_relay/**/*_test.go}
⚙️ CodeRabbit configuration file
{crates/**/tests/**,python/tests/**,go/nemo_relay/**/*_test.go}: Tests should cover the behavior promised by the changed API surface, including error paths and cross-request isolation where relevant.
Prefer assertions on lifecycle events, scope stacks, middleware ordering, and binding parity over shallow smoke tests.
Files:
crates/worker-proto/tests/proto_tests.rscrates/cli/tests/coverage/doctor_tests.rscrates/worker/tests/worker_sdk_tests.rscrates/core/tests/unit/plugin_dynamic_tests.rs
{crates/core,crates/adaptive}/**/*
📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)
Changes to
crates/coreorcrates/adaptivemust run the full language matrix
Files:
crates/core/src/plugin/dynamic/manifest.rscrates/core/tests/unit/plugin_dynamic_tests.rs
crates/core/**/*.rs
📄 CodeRabbit inference engine (.agents/skills/test-go-binding/SKILL.md)
If the change touched
crates/coreor shared runtime semantics, also usevalidate-changefor broader validation
crates/core/**/*.rs: UseJson = serde_json::Valuein Rust-facing runtime APIs where the existing code expects JSON payloads.
UseResult<T>withFlowErrorin core runtime paths. Keep errors explicit and binding-appropriate at the wrapper layer.
Files:
crates/core/src/plugin/dynamic/manifest.rscrates/core/tests/unit/plugin_dynamic_tests.rs
crates/{core,adaptive}/**
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
If
crates/coreorcrates/adaptivechanged, run the full matrix across Rust, Python, Go, Node.js, and WebAssembly
Files:
crates/core/src/plugin/dynamic/manifest.rscrates/core/tests/unit/plugin_dynamic_tests.rs
crates/{core,adaptive}/**/*.rs
⚙️ CodeRabbit configuration file
crates/{core,adaptive}/**/*.rs: Review the Rust runtime for async correctness, scope isolation, middleware ordering, and event lifecycle regressions.
Pay close attention to task-local/thread-local scope propagation, callback lifetimes, stream finalization, and root_uuid isolation.
Public API changes should preserve existing behavior unless tests and docs show the intended migration path.
Files:
crates/core/src/plugin/dynamic/manifest.rscrates/core/tests/unit/plugin_dynamic_tests.rs
**/*.{md,rst,html,txt}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-brand-terminology.md)
**/*.{md,rst,html,txt}: Always spellNVIDIAin all caps. Do not useNvidia,nvidia,nVidia,nVIDIA, orNV.
Usean NVIDIAbefore a noun because the name starts with an 'en' sound.
Do not add a registered trademark symbol afterNVIDIAwhen referring to the company.
Use trademark symbols with product names only when the document type or legal guidance requires them.
Verify official capitalization, spacing, and hyphenation for product names.
Precede NVIDIA product names withNVIDIAon first mention when it is natural and accurate.
Do not rewrite product names for grammar or title-case rules.
Preserve third-party product names according to the owner's spelling.
Include the company name and full model qualifier on first use when it helps identify the model.
Preserve the official capitalization and punctuation of model names.
Use shorter family names only after the full name is established.
Spell out a term on first use and put the acronym in parentheses unless the acronym is widely understood by the intended audience.
Use the acronym on later mentions after it has been defined.
For long documents, reintroduce the full term if readers might lose context.
Form plurals of acronyms withs, not an apostrophe, such asGPUs.
In headings, common acronyms can remain abbreviated. Spell out the term in the first or second sentence of the body.
Common terms such asCPU,GPU,PC,API, andUIusually do not need to be spelled out for developer audiences.
Files:
RELEASING.md
**/*.{md,rst,html}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-brand-terminology.md)
Link the first mention of a product name when the destination helps the reader.
Files:
RELEASING.md
**/*.md
📄 CodeRabbit inference engine (.agents/skills/contribute-integration/SKILL.md)
Documentation must be updated if activation or usage changed
**/*.md: Use title case consistently in technical documentation headings
Avoid quotation marks, ampersands, and exclamation marks in headings
Keep product, event, research, and whitepaper names in their official title case
Use title case for table headers
Do not force social-media sentence case into technical docs
Format code elements, commands, parameters, package names, and expressions in monospace
Format directories, file names, and paths in monospace using backticks
Use angle brackets inside monospace for variables inside paths, such as/home/<username>/.login
Format error messages and strings in quotation marks, keeping literal code strings in code formatting when clearer
Format UI buttons, menus, fields, and labels in bold
Use angle brackets between UI labels for menu paths, such as File > Save As
Use italics for new terms on first use, sparingly and only when introducing the term
Use italics for publication titles
Format keyboard shortcuts in plain text, such as Press Ctrl+Alt+Delete
Use owner/repo link text for GitHub repositories, preferring[NVIDIA/NeMo](link)over prose references like 'the GitHub repo'
Introduce every code block with a complete sentence
Do not make a code block complete the grammar of the previous sentence
Do not continue a sentence after a code block
Use syntax highlighting when the format supports it for code blocks
Avoid the word 'snippet' unless the surrounding docs already use it as a term of art
Keep inline method, function, and class references consistent with nearby docs, omitting empty parentheses for prose readability when no call is shown
Use descriptive anchor text that matches the destination title when possible for links
Avoid raw URLs in running text
Avoid generic anchor text such as 'here,' 'this page,' and 'read more'
Include acronyms in link text when a linked term includes an acronym
Do not link long sentences or multiple sentences
Avoid links ...
Files:
RELEASING.md
RELEASING.md
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Ensure public packaging changes are reflected in release-facing documentation and RELEASING.md
Files:
RELEASING.md
{CHANGELOG.md,RELEASING.md,docs/**/*.md}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Release history and release notes must reference GitHub Releases, not CHANGELOG.md or docs pages
Files:
RELEASING.md
**/*.{md,rst,txt}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-guide.md)
Spell
NVIDIAin all caps. Do not useNvidia,nvidia, orNV.
Files:
RELEASING.md
**/*.{md,rst}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-guide.md)
**/*.{md,rst}: Format commands, code elements, expressions, package names, file names, and paths as inline code.
Use descriptive link text. Avoid raw URLs and weak anchors such as "here" or "read more."
Use title case consistently for technical documentation headings.
Introduce code blocks, lists, tables, and images with complete sentences.
Write procedures as imperative steps. Keep steps parallel and split long procedures into smaller tasks.
Prefer active voice, present tense, short sentences, contractions, and plain English.
Usecanfor possibility and reservemayfor permission.
Useafterfor temporal relationships instead ofonce.
Preferrefer tooverseewhen the wording points readers to another resource.
Avoid culture-specific idioms, unnecessary Latinisms, jokes, and marketing exaggeration in technical docs.
Spell out months in body text, avoid ordinal dates, and use clear time zones.
Spell out whole numbers from zero through nine unless they are technical values, parameters, versions, or UI values.
Use numerals for 10 or greater and include commas in thousands.
Do not add trademark symbols to learning-oriented docs unless the source, platform, or legal guidance explicitly requires them.
Files:
RELEASING.md
{docs/**,README.md,CONTRIBUTING.md,**/*.md}
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
Run docs link validation with
just docs-linkcheckwhen links change
Files:
RELEASING.md
{docs/**,README.md,**/Cargo.toml,**/package.json,**/*.md}
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
Ensure renamed public surfaces are reflected consistently in manifests and docs for large or public-facing changes
Files:
RELEASING.md
**/*.{html,md,mdx}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Include SPDX license header in HTML and Markdown files using HTML comment syntax
Files:
RELEASING.md
{docs/**,README.md,CONTRIBUTING.md,RELEASING.md,SECURITY.md}
⚙️ CodeRabbit configuration file
{docs/**,README.md,CONTRIBUTING.md,RELEASING.md,SECURITY.md}: Review documentation for technical accuracy against the current API, command correctness, and consistency across language bindings.
Flag stale examples, missing SPDX headers where required, and instructions that no longer match CI or pre-commit behavior.
Files:
RELEASING.md
.github/workflows/*.{yml,yaml}
📄 CodeRabbit inference engine (.agents/skills/maintain-ci/SKILL.md)
.github/workflows/*.{yml,yaml}: Putpermissions:on each job that needs token access in GitHub Actions workflows
Avoid workflow-level permissions unless the repository intentionally centralizes them and the inheritance tradeoff is documented
Keep third-party actions pinned to full commit SHAs and preserve the readable version comment after the SHA
Prefer action-native or ecosystem-native caching over genericactions/cache
Use lockfiles or dependency manifests to drive cache invalidation in GitHub Actions workflows
Keep deploy and publish permissions isolated to the jobs that need them in GitHub Actions
Read both caller and callee when a workflow usesworkflow_callin GitHub Actions
Put release-tag validation in the earliest practical caller job when the pipeline has tag-based publish behavior
Keep release-tag policy aligned withRELEASING.md: raw SemVer tags only, no leadingv
contents: readis the default minimum permission for checkout-based build, test, docs, and packaging jobs
pull-requests: readis required for PR metadata lookup jobs in GitHub Actions workflows
pages: writeandid-token: writeshould be limited to Pages deployment jobs and callers that invoke them through reusable workflows
For reusable workflows, the caller must grant every permission the called jobs require; the callee cannot elevate beyond what the caller provides
Preferastral-sh/setup-uvcache support withcache-dependency-globanchored touv.lock
PreferSwatinem/rust-cachewith explicitshared-keyandworkspacesinstead of ad hoc target-directory caching
Avoid caching generated outputs that can hide stale behavior unless the repo already relies on them deliberately
Files:
.github/workflows/ci.yaml
justfile
📄 CodeRabbit inference engine (.agents/skills/update-project-version/SKILL.md)
justfile: Keep helper function inputs aligned when editing version helpers:set_project_versionshould call Cargo, Node, and coding-agent plugin version helpers for the same target version
Ensureset_cargo_workspace_versionhelper updates[workspace.package].versionplus all workspace.dependencies references (nemo-relay, nemo-relay-adaptive, nemo-relay-pii-redaction, nemo-relay-ffi, nemo-relay-cli)
Ensureset_node_package_versionshelper updates crates/node/package.json, integrations/openclaw/package.json, corresponding package-lock.json entries, and OpenClaw nemo-relay-node dependency entries
Files:
justfile
🧠 Learnings (2)
📚 Learning: 2026-04-15T18:16:52.951Z
Learnt from: bbednarski9
Repo: NVIDIA/NeMo-Flow PR: 1
File: docs/atof-event-format.md:381-381
Timestamp: 2026-04-15T18:16:52.951Z
Learning: In docs/atof-event-format.md (and when reviewing references to this format across the NeMo-Flow repo), treat `AtifExporter.events_to_steps()` as the intended public/API method name. Do not flag it as inconsistent with internal Rust symbol names (e.g., `event_to_steps` in `crates/core/src/atif.rs`)—the documentation’s public-facing naming may differ intentionally from internal implementation details.
Applied to files:
.gitlab-ci.yml
📚 Learning: 2026-05-01T13:41:07.485Z
Learnt from: willkill07
Repo: NVIDIA/NeMo-Flow PR: 34
File: .gitlab-ci.yml:95-103
Timestamp: 2026-05-01T13:41:07.485Z
Learning: In NVIDIA/NeMo-Flow’s .gitlab-ci.yml, when listing GitHub Actions runs for a tag-triggered workflow, use `gh run list --branch "$tag"` to filter runs by the tag name. For annotated tag pushes in this repo, GitHub sets `headBranch` to the tag (e.g., `0.1.0-rc.5`), so `--branch "$tag"` returns only the tag-triggered run. Prefer this over `--commit <sha>`, which can be less precise because it may include both the tag run and a main-branch run that share the same commit SHA.
Applied to files:
.gitlab-ci.yml
🔇 Additional comments (13)
crates/cli/tests/coverage/doctor_tests.rs (1)
536-543: 📐 Maintainability & Code QualityRun the required Rust validation commands before merge.
The recorded validation only shows package-scoped
cargo testruns andcargo check -p nemo-relay-cli. For a Rust change in this repo, please also confirmjust test-rust,cargo fmt --all, andcargo clippy --workspace --all-targets -- -D warningsran successfully. As per coding guidelines, "Any Rust change must runjust test-rust", "cargo fmt --all", and "cargo clippy --workspace --all-targets -- -D warnings".Source: Coding guidelines
.github/workflows/ci.yaml (1)
377-380: LGTM!.gitlab-ci.yml (1)
265-265: LGTM!RELEASING.md (1)
33-33: LGTM!Also applies to: 54-57, 137-139, 160-162, 252-254, 321-324
justfile (2)
457-458: LGTM!Also applies to: 659-663
1172-1175: 🩺 Stability & AvailabilityNo extra
nemo-relay-workerpatch entries are needed.crates/worker/Cargo.tomlonly usesnemo-relay-typesandnemo-relay-worker-proto, and both are already patched injustfile.> Likely an incorrect or invalid review comment.buf.yaml (1)
1-9: LGTM!.github/ci-path-filters.yml (1)
17-22: LGTM!Also applies to: 39-44, 127-127, 165-165
crates/core/src/plugin/dynamic/manifest.rs (1)
436-437: LGTM!crates/worker-proto/tests/proto_tests.rs (1)
59-97: LGTM!crates/worker-proto/proto/nemo/relay/worker/v1/plugin_worker.proto (1)
117-125: LGTM!crates/core/tests/unit/plugin_dynamic_tests.rs (1)
664-706: LGTM!codecov.yml (1)
57-69: LGTM!
Signed-off-by: Will Killian <wkillian@nvidia.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/worker/tests/worker_sdk_tests.rs`:
- Around line 104-117: The worker SDK health test only verifies the name
metadata, so update the existing health assertions to also check the returned
sdk_version and runtime_version fields from the health response. Use the current
health test in worker_sdk_tests and the HealthRequest/client.health flow to
locate the assertion block, and add coverage that matches the new health
contract so these version fields cannot regress unnoticed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: e2459867-c2ce-42f8-ba0c-36d6d761aec7
📒 Files selected for processing (4)
crates/worker-proto/proto/nemo/relay/worker/v1/plugin_worker.protocrates/worker-proto/tests/proto_tests.rscrates/worker/src/lib.rscrates/worker/tests/worker_sdk_tests.rs
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: Check / Run
- GitHub Check: Preview docs
🧰 Additional context used
📓 Path-based instructions (10)
**/*.rs
📄 CodeRabbit inference engine (.agents/skills/add-binding-feature/SKILL.md)
Use
snake_casenaming convention for Rust identifiers (e.g.,nemo_relay_tool_call)
**/*.rs: Any Rust change must runjust test-rust
Any Rust change must runcargo fmt --all
Any Rust change must runcargo clippy --workspace --all-targets -- -D warnings
**/*.rs: Runcargo fmt --allfor all FFI work since it is Rust work
Runjust test-rustto validate FFI changes
Runcargo clippy --workspace --all-targets -- -D warningsto enforce strict linting on FFI workWhen Rust files changed as part of Go work, also run
cargo fmt --all,just test-rust, andcargo clippy --workspace --all-targets -- -D warnings
**/*.rs: Runcargo fmt --allwhen Rust files are changed as part of Node work
Runcargo clippy --workspace --all-targets -- -D warningswhen Rust files are changed as part of Node work
Runjust test-rustwhen Rust files are changed as part of Node work
**/*.rs: Runcargo fmt --allto format all Rust code
Runcargo clippy --workspace --all-targets -- -D warningsto enforce all clippy lints as errors
**/*.rs: Runcargo fmt --allwhen Rust files changed as part of WebAssembly work
Runcargo clippy --workspace --all-targets -- -D warningswhen Rust files changed as part of WebAssembly work
**/*.rs: If any Rust code changed, always runjust test-rust
If any Rust code changed, also runcargo fmt --all
If any Rust code changed, also runcargo clippy --workspace --all-targets -- -D warnings
Run Rust formatting withcargo fmt --all
Run Rust linting withcargo clippy --workspace --all-targets -- -D warnings
**/*.rs: Usecargo fmtfor Rust code formatting
Runcargo clippy -- -D warningsto lint Rust code and treat all warnings as errors
Use Rust snake_case naming convention for Rust identifiers
Include SPDX license header in all Rust source files using double-slash comment syntax
Validate Rust code withuv run pre-commit run --all-filesto enforce cargo fmt formatting check, cargo clippy lints, and cargo deny aud...
Files:
crates/worker-proto/tests/proto_tests.rscrates/worker/tests/worker_sdk_tests.rscrates/worker/src/lib.rs
{crates/adaptive/**/*.rs,**/*test*.{rs,py,go,ts,js},**/*adaptive*test*.{rs,py,go,ts,js},docs/plugins/adaptive/**}
📄 CodeRabbit inference engine (.agents/skills/maintain-optimizer/SKILL.md)
Maintain documented and tested validation and report behavior for adaptive surfaces
Files:
crates/worker-proto/tests/proto_tests.rscrates/worker/tests/worker_sdk_tests.rs
**/{Cargo.toml,**/*.rs}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Maintain consistency between Rust package names in
Cargo.tomland their actual usage across the codebase
Files:
crates/worker-proto/tests/proto_tests.rscrates/worker/tests/worker_sdk_tests.rscrates/worker/src/lib.rs
**/*.{h,hpp,c,cpp,rs}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Ensure FFI header and library naming follows consistent conventions across platform-specific builds
Files:
crates/worker-proto/tests/proto_tests.rscrates/worker/tests/worker_sdk_tests.rscrates/worker/src/lib.rs
**/*.{rs,toml}
📄 CodeRabbit inference engine (.agents/skills/rename-surfaces/SKILL.md)
Update Rust crate names and module prefixes during coordinated rename operations
Files:
crates/worker-proto/tests/proto_tests.rscrates/worker/tests/worker_sdk_tests.rscrates/worker/src/lib.rs
**/*.{rs,py,js,ts,tsx,jsx,go,sh,toml,yaml,yml,md}
📄 CodeRabbit inference engine (AGENTS.md)
Keep SPDX headers on source, docs, scripts, and configuration files. The project is Apache-2.0.
Files:
crates/worker-proto/tests/proto_tests.rscrates/worker/tests/worker_sdk_tests.rscrates/worker/src/lib.rs
**/*.{rs,py,go,js,ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Follow binding naming conventions: Rust and Python use
snake_case, C FFI exports prefixednemo_relay_, Go usesPascalCasefor public APIs, Node.js usescamelCase.
Files:
crates/worker-proto/tests/proto_tests.rscrates/worker/tests/worker_sdk_tests.rscrates/worker/src/lib.rs
crates/**/*.rs
📄 CodeRabbit inference engine (AGENTS.md)
crates/**/*.rs: Keep async behavior on the existing tokio-based model. Bindings should preserve callback and future lifetimes rather than blocking or hiding async work unexpectedly.
UseJson = serde_json::Valuein Rust-facing runtime APIs for JSON payload handling.
Files:
crates/worker-proto/tests/proto_tests.rscrates/worker/tests/worker_sdk_tests.rscrates/worker/src/lib.rs
**
⚙️ CodeRabbit configuration file
**:AGENTS.md
This file provides guidance to agents, including Claude Code and OpenAI Codex, when working in this repository.
Project Overview
NeMo Relay is a multi-language agent runtime framework for execution scopes, lifecycle events, middleware, plugins, and observability around tool and LLM calls. The core runtime is Rust. Primary supported bindings are Rust, Python, and Node.js. Go, WebAssembly, and the raw C FFI are experimental and source-first.
The shared runtime model is:
- Scope stacks decide where work belongs and which scope-local behavior is visible.
- Middleware registries decide what guardrails and intercepts run around managed calls.
- Plugins install reusable runtime behavior from configuration.
- Events record runtime behavior in ATOF form.
- Subscribers and exporters consume events in-process or export them to ATIF, OpenTelemetry, OpenInference, or other backends.
Repository Structure
The repository layout separates the Rust runtime, language bindings, documentation,
integration patches, and agent-facing skills.crates/ core/ # Rust core runtime crate, published as nemo-relay adaptive/ # Adaptive runtime primitives and plugin components python/ # PyO3 native extension for the Python package ffi/ # Raw C ABI layer used by downstream bindings such as Go node/ # NAPI Node.js binding and JavaScript/TypeScript entry points wasm/ # wasm-bindgen WebAssembly binding and JS wrappers python/ nemo_relay/ # Python wrapper package: scopes, tools, LLM, middleware, typed helpers, plugins, adaptive helpers tests/ # Python tests go/ nemo_relay/ # Experimental Go CGo binding and tests fern/ # Fern documentation site scripts/ # Stable wrappers and helper scripts; build/test/docs entry points live in justfile third_party/ # P...
Files:
crates/worker-proto/tests/proto_tests.rscrates/worker-proto/proto/nemo/relay/worker/v1/plugin_worker.protocrates/worker/tests/worker_sdk_tests.rscrates/worker/src/lib.rs
{crates/**/tests/**,python/tests/**,go/nemo_relay/**/*_test.go}
⚙️ CodeRabbit configuration file
{crates/**/tests/**,python/tests/**,go/nemo_relay/**/*_test.go}: Tests should cover the behavior promised by the changed API surface, including error paths and cross-request isolation where relevant.
Prefer assertions on lifecycle events, scope stacks, middleware ordering, and binding parity over shallow smoke tests.
Files:
crates/worker-proto/tests/proto_tests.rscrates/worker/tests/worker_sdk_tests.rs
🔇 Additional comments (4)
crates/worker-proto/proto/nemo/relay/worker/v1/plugin_worker.proto (1)
10-10: LGTM!Also applies to: 87-101
crates/worker-proto/tests/proto_tests.rs (1)
7-7: LGTM!Also applies to: 79-88
crates/worker/src/lib.rs (2)
774-790: LGTM!
31-36: 📐 Maintainability & Code QualityRun the Rust gate set for this change.
crates/worker/src/lib.rsis a Rust edit, socargo fmt --all,cargo clippy --workspace --all-targets -- -D warnings, andjust test-rustshould be included in the validation.
Signed-off-by: Will Killian <wkillian@nvidia.com>
License DiffCompared against Lockfile license changesLockfile License ChangesRustAdded
Removed
Updated/Changed
|
Salonijain27
left a comment
Salonijain27
left a comment
There was a problem hiding this comment.
Approved from a dependency point of view
|
/merge |
#### Overview Add the host activation and proxy layer for `grpc-v1` worker dynamic plugins. Stack dependency: this PR cannot be merged until parent stacked PR #308 is merged: #308 - [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license. - [x] I searched existing issues and open pull requests, and this does not duplicate existing work. #### Details - Add the core worker plugin activation/proxy implementation behind `worker-grpc`. - Start local workers, perform handshake/validation/registration, and proxy every supported registration surface. - Add worker fixture and integration tests for callbacks, continuations, streaming, cancellation, marks, scopes, and teardown. Validation run across the completed stack: - `cargo test -p nemo-relay-types` - `cargo test -p nemo-relay-plugin` - `cargo test -p nemo-relay-worker-proto` - `cargo test -p nemo-relay-worker` - `cargo check -p nemo-relay-cli` #### Where should the reviewer start? Start with `crates/core/src/plugin/dynamic/worker.rs`, then review `crates/core/tests/integration/worker_plugin_tests.rs`. #### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to) - Relates to: #302 - Relates to: #230 ## Summary by CodeRabbit * **New Features** * Added dynamic worker plugin support over gRPC (**worker-grpc**) and enabled it in both core and the CLI. * Worker plugins can now be dynamically loaded and participate in tool, LLM, and streaming request handling. * Added a worker runtime helper to run code within a specific scope stack. * **Bug Fixes** * Improved worker plugin activation/teardown, including clearer validation and compatibility handling. * Enhanced tool execution marking to reflect isolated and restored scope-stack phases. * **Tests** * Added comprehensive unit and integration coverage, including a dedicated worker plugin fixture and streaming/error scenarios. Authors: - Will Killian (https://github.com/willkill07) Approvers: - Alex Fournier (https://github.com/afourniernv) URL: #309
3 participants
Overview
Add the out-of-process worker protocol and Rust worker SDK layer.
Stack dependency: this PR cannot be merged until parent stacked PR #307 is merged: #307
Details
nemo-relay-worker-protowithnemo.relay.worker.v1protobuf services and messages.nemo-relay-workeras the Rust SDK for gRPC worker plugins.Validation run across the completed stack:
cargo test -p nemo-relay-typescargo test -p nemo-relay-plugincargo test -p nemo-relay-worker-protocargo test -p nemo-relay-workercargo check -p nemo-relay-cliWhere should the reviewer start?
Start with
crates/worker-proto/proto/nemo/relay/worker/v1/plugin_worker.proto, then reviewcrates/worker/src/lib.rs.Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)
Summary by CodeRabbit
grpc-v1worker protocol and improved rejection messaging for unsupported values.