ci: auto-update release notes on push to main by ericksoa · Pull Request #1 · NVIDIA/NemoClaw

ericksoa · 2026-03-16T18:25:53Z

Migrated from NVIDIA/openshell-openclaw-plugin#31

Summary

Adds a GitHub Actions workflow that auto-updates docs/about/release-notes.md on every push to main
Categorizes commits into Features / Fixes / Other based on commit message prefixes (case-insensitive)
Filters out noise: reverts, chores, docs-only, test-only, style, and low-signal commits
Scopes to only new commits since last run (uses [release-notes] marker in commit message)
Self-loop prevention: skips if the triggering commit is from this workflow
Commits back with -s (DCO signed-off)

How it works

On push to main, collects non-merge commits since last tag or last [release-notes] commit
Categorizes by prefix: add/feat → Features, fix → Fixes, everything else → Other
Inserts a dated block under the ## 0.1.0 Unreleased heading
Commits and pushes the updated file

Test plan

Merge a commit to main and verify the workflow runs
Check that docs/about/release-notes.md gets a new dated section
Verify the workflow doesn't trigger itself (no infinite loop)
Verify commit messages are correctly categorized

…to main Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Add a preflight check that catches the #1 onboarding blocker on Ubuntu 24.04, DGX Spark, and WSL2. When cgroup v2 is active but Docker's daemon.json lacks "default-cgroupns-mode": "host", onboarding now fails fast with a clear error and fix instructions instead of failing late at gateway startup with a cryptic kubelet error. Closes #16

wscurran · 2026-03-20T23:17:23Z

Thanks for setting up a GitHub Actions workflow that automatically updates the release notes on pushes to the main branch, which could help keep the documentation up to date and reduce manual effort.

cv · 2026-03-21T19:27:31Z

Hi @ericksoa! Thanks for putting this together — auto-updating release notes is something we've been wanting. Since this was opened, the repo has seen a lot of activity: we've added CI checks, new features, and restructured a few things. Would you mind rebasing onto the latest main when you get a chance? That way we can give it a proper review with everything up to date. Appreciate it!

ericksoa · 2026-03-22T16:30:51Z

Superseded — release notes page now points to GitHub native releases/commits/PRs.

- Default model: nvidia/nemotron-3-super-120b-a12b (March 2026 release, 12B active / 120B total MoE, 5x throughput) - Replace meta/llama-3.3-70b-instruct with Nemotron 3 Super in the nvidia provider catalog (Dockerfile sed patch at build time) - All NVIDIA models in provider: Nemotron 70B, Mistral NeMo Minitron, Nemotron 3 Super — no Meta/Llama - Blueprint default profile updated to nemotron-3-super-120b-a12b - Tracked as tech debt: NVIDIA#1 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…IA#62) Add a preflight check that catches the NVIDIA#1 onboarding blocker on Ubuntu 24.04, DGX Spark, and WSL2. When cgroup v2 is active but Docker's daemon.json lacks "default-cgroupns-mode": "host", onboarding now fails fast with a clear error and fix instructions instead of failing late at gateway startup with a cryptic kubelet error. Closes NVIDIA#16

…docs Add two behavioral tests that directly validate cv's blocker NVIDIA#1 fix: - Healthy gateway is preserved (no destroy/forward-stop) on rerun - Stale vs healthy vs active-unnamed states trigger correct cleanup Also add setup-jetson entry to docs/reference/commands.md. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

… (#1305) ## Summary Fixes the four issues reported in #1114 — EACCES permission errors and missing gateway token when running inside the NemoClaw sandbox. ### Issue mapping | # | Reported error | Fix | |---|----------------|-----| | 1 | `EACCES: open '/sandbox/.openclaw/openclaw.json.*.tmp'` | `install_configure_guard` — intercepts `openclaw configure` with a clear error and directs users to `nemoclaw onboard --resume` on the host | | 2 | Same as #1 (different PID) | Same fix | | 3 | `EACCES: mkdir '/sandbox/.openclaw/credentials'` | Already resolved on main via #1519 (credentials symlink to `.openclaw-data/`) | | 4 | No WhatsApp QR code | Consequence of #3, also resolved by #1519 | ### Root cause (issues 1 & 2) OpenClaw's `configure` command performs atomic writes — it creates a temp file (`openclaw.json.PID.UUID.tmp`) in the same directory as the config. Since `/sandbox/.openclaw/` is Landlock read-only at the kernel level, file creation is rejected with EACCES. This is by design: the sandbox config is intentionally immutable at runtime. Rather than weakening Landlock (security regression), we intercept the command in the sandbox shell and guide users to the correct host-side workflow. ### Changes **1. `install_configure_guard()`** — Writes a shell function wrapper to `.bashrc`/`.profile` that intercepts `openclaw configure` and prints: ``` Error: 'openclaw configure' cannot modify config inside the sandbox. The sandbox config is read-only (Landlock enforced) for security. To change your configuration, exit the sandbox and run: nemoclaw onboard --resume This rebuilds the sandbox with your updated settings. ``` All other `openclaw` subcommands pass through to the real binary. **2. `export_gateway_token()`** — Reads `gateway.auth.token` from `openclaw.json` and exports it as `OPENCLAW_GATEWAY_TOKEN`, so interactive sessions (`openshell sandbox connect`) can authenticate with the gateway. Persists to `.bashrc`/`.profile` using idempotent marker blocks and cleans stale tokens on revocation. **3. `_read_gateway_token()` helper** — Shared Python snippet used by both `export_gateway_token` and `print_dashboard_urls` (deduplication, uses `with open()` context manager). All three are called in both root and non-root startup paths. ## Security properties preserved - `/sandbox/.openclaw` remains root-owned, Landlock read-only - `openclaw.json` remains chmod 444 (immutable) - No new attack surface — token is read-only from existing config - `command openclaw` bypass preserves all non-configure functionality Fixes #1114 Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

…IA#1114) (NVIDIA#1305) ## Summary Fixes the four issues reported in NVIDIA#1114 — EACCES permission errors and missing gateway token when running inside the NemoClaw sandbox. ### Issue mapping | # | Reported error | Fix | |---|----------------|-----| | 1 | `EACCES: open '/sandbox/.openclaw/openclaw.json.*.tmp'` | `install_configure_guard` — intercepts `openclaw configure` with a clear error and directs users to `nemoclaw onboard --resume` on the host | | 2 | Same as NVIDIA#1 (different PID) | Same fix | | 3 | `EACCES: mkdir '/sandbox/.openclaw/credentials'` | Already resolved on main via NVIDIA#1519 (credentials symlink to `.openclaw-data/`) | | 4 | No WhatsApp QR code | Consequence of NVIDIA#3, also resolved by NVIDIA#1519 | ### Root cause (issues 1 & 2) OpenClaw's `configure` command performs atomic writes — it creates a temp file (`openclaw.json.PID.UUID.tmp`) in the same directory as the config. Since `/sandbox/.openclaw/` is Landlock read-only at the kernel level, file creation is rejected with EACCES. This is by design: the sandbox config is intentionally immutable at runtime. Rather than weakening Landlock (security regression), we intercept the command in the sandbox shell and guide users to the correct host-side workflow. ### Changes **1. `install_configure_guard()`** — Writes a shell function wrapper to `.bashrc`/`.profile` that intercepts `openclaw configure` and prints: ``` Error: 'openclaw configure' cannot modify config inside the sandbox. The sandbox config is read-only (Landlock enforced) for security. To change your configuration, exit the sandbox and run: nemoclaw onboard --resume This rebuilds the sandbox with your updated settings. ``` All other `openclaw` subcommands pass through to the real binary. **2. `export_gateway_token()`** — Reads `gateway.auth.token` from `openclaw.json` and exports it as `OPENCLAW_GATEWAY_TOKEN`, so interactive sessions (`openshell sandbox connect`) can authenticate with the gateway. Persists to `.bashrc`/`.profile` using idempotent marker blocks and cleans stale tokens on revocation. **3. `_read_gateway_token()` helper** — Shared Python snippet used by both `export_gateway_token` and `print_dashboard_urls` (deduplication, uses `with open()` context manager). All three are called in both root and non-root startup paths. ## Security properties preserved - `/sandbox/.openclaw` remains root-owned, Landlock read-only - `openclaw.json` remains chmod 444 (immutable) - No new attack surface — token is read-only from existing config - `command openclaw` bypass preserves all non-configure functionality Fixes NVIDIA#1114 Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

- Guard runArgv/runArgvCapture against shell:true to prevent security bypass (finding #1) — throws if a caller attempts to re-enable shell interpretation. Added 2 tests. - Document the intentional bash -c exception in getOllamaWarmupCommand explaining why it's safe (finding NVIDIA#2). - Remove dead getOpenshellCommand() from policies.ts (finding NVIDIA#3). - Remove unused shellQuote import from nim.ts (finding NVIDIA#4). - Fix brittle indexOf assertion in onboard-readiness test (finding NVIDIA#5).

…xercised CodeRabbit correctly flagged that the original test swapped the lock file on stat NVIDIA#1 which caused isProcessAlive to see a live PID and exit early — unlinkIfInodeMatches was never called. Move the swap to after stat NVIDIA#1 returns so the stale-cleanup branch is actually reached and the inode comparison is tested. Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

…exercised CodeRabbit correctly flagged that swapping on stat NVIDIA#1 caused readFileSync to see the live PID and exit via isProcessAlive — unlinkIfInodeMatches was never called. Move the swap to just before stat NVIDIA#2 (inside unlinkIfInodeMatches): stat NVIDIA#1 reads the original stale inode, readFileSync sees the dead PID, isProcessAlive returns false, stale-cleanup runs, and stat NVIDIA#2 sees the new inode and skips the unlink. Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

…exercised CodeRabbit correctly flagged that swapping on stat NVIDIA#1 caused readFileSync to see the live PID and exit via isProcessAlive — unlinkIfInodeMatches was never called. Move the swap to just before stat NVIDIA#2 (inside unlinkIfInodeMatches): stat NVIDIA#1 reads the original stale inode, readFileSync sees the dead PID, isProcessAlive returns false, stale-cleanup runs, and stat NVIDIA#2 sees the new inode and skips the unlink. Use write-to-temp + rename instead of unlink + recreate to guarantee a different inode even on tmpfs/overlayfs which can reuse inodes. Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

- Remove unused getForwardList() call from getActiveSandboxSessions — only pgrep/ps is needed for SSH session detection (warning #1) - Consolidate double-prompt in sandboxDestroy into single enriched confirmation prompt (warning #2) - Remove noisy cleanupGatewayAfterLastSandbox forward check that would always fire due to dashboard forward (warning #3) - Use word-boundary regex in parseSshProcesses to prevent false positives when sandbox names share prefixes (warning #4) - Export SessionClassification as named interface (suggestion #1) - Use cross-platform ps -axo instead of Linux-only pgrep -a for macOS compatibility (suggestion #2) - Add forwardCount to SessionClassification for future consumers - Add tests for word-boundary matching edge cases

…, notif bell Driven by reading the actual runs (bug-report / experiments / skill-improve): - FIX the empty-response failure bug-report kept catching: cheap-tier reasoning was ON with a 2048 cap, so "detailed thinking on" ate the whole budget and returned an empty answer (finishReason=length, textLength=0 -> INVALID_OUTPUT). agents.js now defaults cheap reasoning OFF and gives reasoning runs token headroom (8192 cheap / 32768 capable, clamped). The nightly loop now produces real output. - Widen the arena (toward 10x useful trials): 14 seed candidates (6 prompts, 6 models, 2 params); POLICY targetActive 6->10, maxActive 10->16, expandPerRun 1->4, championTopK 2->3 (more champions feed the fusion panel). - Close the value loop: experiments exports the top drafter-prompt champion to state/champion-prompt.json so prod can adopt the winning prompt (skill-improve's NVIDIA#1 proposal) instead of leaving it stranded in the leaderboard. - Schedule more (the timers/crons ask): experiments now runs 3x/day (benchmarks each run; the reporting loop fires once at 05:00 to avoid approval spam). New launchd timers via run-workflow.sh + install-schedules.sh: log-digest (6h), mcp-health (1h), fail-only-report (1h). self-improve added to the nightly. - Notifications: always-visible header bell to enable/test browser approval push, so the channel isn't buried in the launch drawer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…board dcode identity failure (#6343) ## Summary Fixes two E2E-harness problems surfaced by the E2E dispatch on `main`: 1. **e2e-live source require hook** — the `hermes-inference-switch` live suite (added in #6335) failed at collection with `Cannot find module '../runner'` because the `e2e-live` Vitest project never loaded the typed-source require hook. 2. **cloud-onboard observability** — the cloud-experimental check-04 (added in #6332) fails on `main` with `could not read initial dcode identity`, but the real `dcode identity` error is captured into a shell var and discarded, so it can't be diagnosed. ## Changes - `vitest.config.ts`: add `setupFiles: ["test/helpers/onboard-script-mocks.cjs"]` to the `e2e-live` project (mirrors `cli`). Registers the typed-source `.ts` require hook **in-process** — deliberately not via `env.NODE_OPTIONS`, so `--require` never leaks into the real CLI subprocesses live tests spawn. - `test/e2e/e2e-cloud-experimental/checks/04-deepagents-code-fresh-reonboard.sh`: on both `dcode identity` reads, print the captured stdout+stderr to stdout (so it lands in `result.json`) before `fail`. No change to pass/fail logic — only makes the existing failure observable. ### Root cause — #1 (fixed here) `hermes-inference-switch` is the first `e2e-live` suite to import a deep `src` graph — its helpers import `src/lib/inference/config.ts`, which transitively loads `ollama-runtime-context.ts`'s runtime `require("../runner")`. Without the require hook, Node's native CJS resolver can't resolve the extensionless `.ts` → suite throws at collection (`0 tests`, ~37s). Only this suite hit it; others drive the CLI as a subprocess and import only fixtures. `runner.ts` has no circular dependency on the inference graph, so the in-process hook resolves it fully. ### Root cause — #2 (observability only; product root cause pending) `cloud-onboard` was green on `main` through 2026-07-06 00:56 UTC and failed on the first main E2E after #6332 landed (19:50 UTC) — #6332 added check-04, which has never passed on main. `dcode identity` is the NemoClaw wrapper (`agents/langchain-deepagents-code/dcode-wrapper.sh`); its identity path returns 0 in isolation and #6332 did not modify it, so the non-zero exit is a runtime condition in #6332's new "recreate/verify live identity" onboarding flow. That can't be pinned without the swallowed stderr — which this change surfaces. Product root cause is for the #6332 author to fix once the next run shows the real error. ## Type of Change - [x] Code change (feature, bug fix, or refactor) ## Quality Gates - [x] Existing tests cover changed behavior — justification: both changes are E2E-harness config/diagnostics. #1: the `e2e-live` suites exercise the hook — verified the previously-failing `hermes-inference-switch` suite now collects and all `e2e-live` suites report 0 collection errors, and the full `e2e-all` dispatch ran the switch job (hosted) green. #2: pure diagnostic output; no pass/fail change. - [x] Docs not applicable — justification: internal test-harness config/diagnostics; no user-facing behavior. - [x] Sensitive paths changed (onboarding/inference/runner adjacent via test config) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — justification: changes are confined to Vitest test-runner setup (`vitest.config.ts`) and an E2E diagnostic print; no product runtime code path is altered. The require hook is in-process only and does not touch product CLI subprocesses. ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed — note: `pre-push` `tsc-cli` skipped for a pre-existing local-only `noImplicitAny` false-positive in `test/helpers/mcp-lifecycle-lock-properties.ts` and `src/lib/state/mcp-lifecycle-lock-identity.test.ts` (unrelated to this diff); CI `tsc-cli` covers it. Check-04 passed `bash -n` and the `shellcheck`/`shfmt` pre-commit hooks. - [x] Targeted behavior tests pass — command/result: `NEMOCLAW_RUN_LIVE_E2E=1 npx vitest list --project e2e-live` → switch suite collects; whole project 0 collection errors (before the fix it reproduced `Cannot find module '../runner'`). Full `e2e-all` dispatch on this branch ran `hermes-inference-switch (hosted)` green. - [x] No secrets, API keys, or credentials committed --- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>  ## Summary by CodeRabbit * **Bug Fixes** * Improved reliability of live end-to-end test runs by loading the required hook inside the test process, avoiding leakage into real CLI subprocesses. * Made identity checks in sandboxed cloud experimental flows more robust, with clearer diagnostics when identity lookup fails.  --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci: add GitHub Actions workflow to auto-update release notes on push …

c620af8

…to main Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

cluster2600 mentioned this pull request Mar 18, 2026

Mission Control cannot connect to OpenClaw gateway inside NemoClaw sandbox #328

Closed

wscurran added the CI/CD label Mar 20, 2026

wscurran added the Integration: GitHub label Mar 20, 2026

ericksoa closed this Mar 22, 2026

This was referenced Mar 22, 2026

nemoclaw fails to detect GPU on NVIDIA Jetson Thor and Orin #300

Closed

Install issues #360

Closed

zNeill mentioned this pull request Mar 26, 2026

[Linux] nemoclaw deploy fails: Brev CLI does not support --gpu flag #998

Closed

ACCGAGTT mentioned this pull request Mar 27, 2026

Web search tools fail in sandbox: DNS resolution blocked (getaddrinfo EAI_AGAIN) #626

Closed

drmarcopapa mentioned this pull request Mar 31, 2026

npm install inside sandbox extremely slow — 310s timeouts on FETCH_ERROR retries #1043

Closed

2 tasks

prekshivyas mentioned this pull request Apr 6, 2026

fix(preflight): warn when installed OpenShell version differs from tested version #1314

Closed

Dongni-Yang mentioned this pull request Apr 7, 2026

fix(sandbox): guard openclaw configure and export gateway token (#1114) #1305

Merged

ColinM-sys mentioned this pull request Apr 9, 2026

docs(k8s): document evaluation-only patterns and production alternatives (#1442) #1676

Closed

3 tasks

ericksoa mentioned this pull request Apr 12, 2026

feat(vm): add openshell-vm microVM gateway backend (opt-in via NEMOCLAW_GATEWAY_BACKEND=vm) #1791

Closed

10 tasks

prekshivyas mentioned this pull request Apr 16, 2026

fix(cli): close stale-lock cleanup race in acquireOnboardLock (#1281) #1656

Merged

5 tasks

ericksoa mentioned this pull request Apr 17, 2026

fix(onboard): preserve user's policy preset selections across sandbox… #1997

Merged

13 tasks

This was referenced Jun 27, 2026

feat(mcp): add OpenShell-managed MCP servers #5876

Merged

chore(openshell): upgrade supported version to 0.0.71 #5596

Merged

cv deleted the ci/auto-release-notes branch June 28, 2026 00:24

jason-ma-nv mentioned this pull request Jul 3, 2026

fix(onboard): color preflight WARN/ERROR check lines (#6004) #6017

Merged

21 tasks

github-actions Bot mentioned this pull request Jul 3, 2026

perf(ci): reuse production images across runtime E2Es #6242

Merged

22 tasks

yanyunl1991 mentioned this pull request Jul 3, 2026

fix(sessions): route sessions passthrough at the sandbox's own agent binary #6249

Merged

22 tasks

This was referenced Jul 6, 2026

fix(inference): honor compatible-endpoint max_model_len for Hermes context (#6177) #6293

Merged

fix(hermes): append resumed one-shot turns #6303

Merged

perf(test): run policy and messaging tests in-process #6339

Merged

prekshivyas mentioned this pull request Jul 6, 2026

test(e2e): register e2e-live source require hook and surface cloud-onboard dcode identity failure #6343

Merged

9 tasks

sandl99 mentioned this pull request Jul 7, 2026

feat(messaging): add Google Chat channel for OpenClaw #6120

Closed

21 tasks

mill101 mentioned this pull request Jul 26, 2026

[Policy] Bundled claude-code preset denies api.anthropic.com for npm-installed Claude Code: binaries allowlist names the npm shim, not the resolved binary #7579

Closed

2 tasks

zxman0126 mentioned this pull request Aug 8, 2026

Sealed sandbox: no supported path to install memory-plugin dependencies (hindsight-client) - durable lazy-install target not preset, .env is integrity-frozen #8613

Closed

tjbean26 mentioned this pull request Aug 23, 2026

Multiple issues/bugs doing dual hermes to one shared LLM #10039

Open

2 tasks

Navigation Menu

Uh oh!

ci: auto-update release notes on push to main - #1

ci: auto-update release notes on push to main#1
ericksoa wants to merge 1 commit into
mainfrom
ci/auto-release-notes

ericksoa commented Mar 16, 2026

Uh oh!

wscurran commented Mar 20, 2026

Uh oh!

cv commented Mar 21, 2026

Uh oh!

ericksoa commented Mar 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

ericksoa commented Mar 16, 2026

Summary

How it works

Test plan

Uh oh!

wscurran commented Mar 20, 2026

Uh oh!

cv commented Mar 21, 2026

Uh oh!

ericksoa commented Mar 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants