fix(mcp): reject unsafe Deep Agents projections by rsliter · Pull Request #10911 · NVIDIA/NemoClaw

rsliter · 2026-09-02T22:40:00Z

Outcome

mcp status now rejects a dangling symbolic link, a symbolic link to valid content, or a FIFO at the managed Deep Agents MCP projection entry. It prints the unsafe file type, exits with status 2, and emits no healthy server status.

Reason

These unsafe entries previously appeared as an ordinary adapter mismatch and returned exit status 0. That hid a final-path replacement behind credential or adapter status handling, including when a legacy unsupported credential was still attached.

Related issues

Fixes #10754

Changes

Extend the existing no-follow, nonblocking projection descriptor reader with typed final-entry classification. The status command consumes the typed result; a separate path check and read would duplicate the boundary and could follow or block on the replacement.
Propagate only the typed unsafe-entry result through the public mcp status boundary, before credential-observation skips can hide it. Regular files, missing files, parse failures, and the legacy Deep Agents path keep their existing status behavior.
Exercise the three reported filesystem types through the generated sandbox command and the public status dispatch. The tests also prove that symbolic-link targets remain unchanged, unavailable and unsupported credential handling cannot hide the unsafe-path result, the generic non-regular fallback remains typed, and regular and legacy Deep Agents projections keep their existing results.

Verification

After the shared type-contract repair, the final three-file focused CLI suite passed all 42 tests. The narrow #10754 selector previously passed all 3 matching command-boundary tests. The public regressions use GITHUB_TOKEN=Unsafe, a harmless but rejected revision-style persisted credential name, a mode-000 FIFO, and a directory for the generic non-regular fallback.
npm run typecheck:cli passed.
npx vitest run --project integration test/automation/pull-requests/growth-guardrails.test.ts passed all 39 tests.
npm run validate:pr passed for the tree committed as 527e8953d4ccb28969abe449e3fef906269ee61b, with origin/main refreshed to 2b53b3e1bc7a570e4548f9bf508d78de92051c18.
Final managed-image run 33791250463 passed exact all-agent activation, two OpenClaw MCP discovery passes, direct startup, and Deep Agents staging qualification on the final commit.
Canonical main was refreshed again before merge to d836ccb446114c4d93edab7a7bd58fc5f9919a95; its intervening changes do not overlap this PR's six files, and GitHub reports the PR mergeable.
The pre-commit secret scan passed. The diff contains no secrets, API keys, or credentials.

Review notes

npm run review:local was attempted again after the final repair. The sandboxed run could not fetch its pinned dependency. The network-enabled retry installed the dependency, but its temporary OpenShell gateway refused every connection during configuration, so no local specialist analysis ran. Earlier attempts on the preceding repair commits failed at the same boundary. All nine hosted PR Review Advisor reports for commit da6ee529684f89ff79f8427ac36b0f7663c15db4 were reviewed from run 33697632693. Behavior, Code Reduction, Dependency Use, Design and Architecture, Documentation, Migration Completion, and Trust found no issue. The Operations recovery request is explicitly outside #10754. The Test Design request concerns pre-existing source-shape and command-rewrite tests; the new regression exercises the command boundary and unmodified generated status command directly. CodeRabbit reported no actionable finding on that candidate.

The first expanded Advisor run for commit 235be35cb885397087e00ef5b5bd342fb20a730b and its maintainer-authorized full retry both used the original 3509b5a437ed3ec4309669c4121ae5b718895bfd workflow revision. Every specialist failed because the old workflow required each session to preload the complete diff.patch; no specialist report was produced. Canonical main then added fix(review): inspect specialist diffs on demand (#10952), so this branch integrated d4eff54a8d213a3a8fe5650703c8e708eab4dd7d.

All nine expanded Advisor reports for the refreshed commit f8568042723efd24286449af4c12a00b91ca6ec3 were reviewed from successful run 33757287610. Security, Delivery, Reduction, Operability, Migration, Customer Behavior, and Architecture found no issue. Verification requested command-boundary coverage for the existing generic non-regular file branch; commit 460b9e0fb2f449046f4a74ca9a162b96594db856 adds a directory case through the generated command and public dispatch. Documentation requested a recovery procedure, but recovery and lifecycle workflows are explicitly outside #10754 and no supported procedure exists to document in this PR.

All nine Advisor reports for 460b9e0fb2f449046f4a74ca9a162b96594db856 were reviewed from successful run 33759151935. Security, Verification, Delivery, Reduction, Operability, and Customer Behavior found no issue. Migration requested dispatch-level proof that the credential-observation change preserves the legacy Deep Agents result. Architecture found that status duplicated the adapter's unsafe-result grammar. Commit aeef43cec96bfb3b43bd75eab3d42638dd4ad7aa adds the legacy regression and makes the adapter-status module own the strict typed-result parser consumed by status. Documentation repeated the recovery request, which remains outside the accepted scope. CodeRabbit completed against 460b9e0fb2f449046f4a74ca9a162b96594db856 with no actionable comments.

All nine final Advisor reports for 0a6b3bc4a355d25888f315e282638c1412f7f412 were reviewed from run 33761302554. The first Security attempt failed its reviewer evidence-read contract and produced no artifact; its targeted second attempt succeeded and found no issue. Architecture, Customer Behavior, Delivery, Migration, Operability, Reduction, Security, and Verification found no issue. Documentation repeated the out-of-scope recovery request. CodeRabbit reviewed through exact commit 0a6b3bc4a355d25888f315e282638c1412f7f412, reported minimal merge risk, and generated no actionable comment. Its docstring-coverage warning is advisory and concerns existing small helper functions rather than a correctness defect.

All nine Advisor reports for refreshed commit 1b5d57c5e01660447586fa985aea85b3f08f4f21 were reviewed from run 33781865168. Architecture, Customer Behavior, Delivery, Documentation, Migration, Operability, Reduction, and Verification found no issue. Security correctly found that the unsupported-attached-credential shortcut could bypass the Deep Agents projection inspection. Commit 147adef40ce378e526b03dd433c826ff61f8c699 moves the Deep Agents inspection ahead of that skip and adds command-boundary regressions for unsafe and regular projections. Hosted exact-head review is required again for this repair.

The first hosted run for 147adef40ce378e526b03dd433c826ff61f8c699 confirmed the Security repair with no finding. The other eight specialists failed on provider HTTP 429 and produced no artifacts. Its Linux CLI shard also exposed that the regression's LD_PRELOAD example altered the fixture subprocess before the strict marker was emitted. Commit ca279099fba48c1dd995ea1f27ed9787ae13de5d uses an inert but still rejected revision-style credential name, preserving the intended unsupported-credential branch without changing the process under test.

The retried hosted review for ca279099fba48c1dd995ea1f27ed9787ae13de5d produced clean Security, Operability, Delivery, and Customer Behavior reports. Architecture correctly found that the generated classifier and host parser separately owned the accepted unsafe type values. Commit 527e8953d4ccb28969abe449e3fef906269ee61b makes the projection module own both the generated classification table and parser values, with a contract test for every shared type.

All nine Advisor reports for final commit 527e8953d4ccb28969abe449e3fef906269ee61b were reviewed from run 33791246163. Architecture confirmed the shared contract resolves the duplicated authority. Customer Behavior, Delivery, Migration, Reduction, Security, and Verification found no issue. Documentation repeated the request for an unsupported recovery procedure, and Operability repeated the open-to-stat removal interleaving; recovery workflows and removal races are explicitly outside #10754. The first Delivery attempt exhausted provider retries with HTTP 429 and produced no report. Its targeted retry succeeded and found no issue.

cjagwani identified that credential redaction could turn an arbitrary GITHUB_TOKEN=Unsafe value into the unsafe-projection marker. The repair now recognizes only a strict raw typed marker, extracts its path, and redacts only that path before reporting the trusted diagnostic. The regression test covers all three file types with that credential value. The follow-up review found that a permission-denied FIFO could fail the initial open and bypass the symlink-only fallback. The fallback now classifies every non-regular entry with the same type helper, and the public regression uses a mode-000 FIFO. The same comment also describes an entry disappearing between the no-follow open and fallback classification; removal races are explicitly excluded from #10754, so this PR intentionally leaves absent-at-classification behavior unchanged.

The first ready-state self-hosted E2E run failed before reaching this change because the existing blueprint plan smoke rejected nim-service.local as private or reserved. PR #10908 owned and merged the isolated-plan fix. The next candidate passed plan and completed apply, then the unchanged fixture failed with Apply did not use the gateway-pinned base-policy read. PR #10930 owned and merged that isolated fixture repair. After integrating canonical main, Staging QA base permission regression (Deep Agents Code) passed on exact commit 1b5d57c5e01660447586fa985aea85b3f08f4f21.

The ordinary CI run 33781868761 for 1b5d57c5e01660447586fa985aea85b3f08f4f21 passed 1,238 package-contract tests and every CLI shard, but its pre-existing managed-image-registry-transport.test.ts omit-dev install failed when npm itself crashed with Cannot read properties of null (reading 'edgesOut'). The PR changes neither that test nor dependency manifests. Canonical main failed the same test, line, and npm signature; the test also passes intermittently on recent main commits. The maintainer explicitly waived this inherited failure for the exact candidate after reviewing the evidence.

The same candidate's self-hosted gateway-isolation E2E run passed 44 tests and failed only test 27 because the unchanged harness could not find normalize_mutable_config_perms. The same signature reproduced on unrelated PR #10889, and PR #10941 is replacing the obsolete suite. The maintainer explicitly waived this inherited failure.

Final ordinary CI run 33791250645 completed successfully on 527e8953d4ccb28969abe449e3fef906269ee61b, including all 12 CLI shards and build-typecheck; the earlier intermittent npm failure did not recur. Final E2E run 33791252351 passed both image builds, sandbox smoke, non-root smoke, and port overrides. It failed only gateway-isolation job 100769952018 with the exact inherited test 27 normalize_mutable_config_perms: command not found signature, 44 passed and 1 failed. The exact-head waiver is recorded in PR comment #issuecomment-5530656365; it covers no different or candidate-owned failure.

This change is limited to the final managed Deep Agents projection entry and mcp status. Parent-directory descriptor pinning, recovery, cleanup, lifecycle changes, removal races, socket behavior, other agents, and unrelated hardening remain outside #10754.

Signed-off-by: Rebecca Sliter 571084+rsliter@users.noreply.github.com

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

copy-pr-bot · 2026-09-02T22:40:04Z

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

coderabbitai · 2026-09-02T22:40:08Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1e1350be-b067-46e7-8289-eec9730ebc8e

📥 Commits

Reviewing files that changed from the base of the PR and between 460b9e0 and 0a6b3bc.

📒 Files selected for processing (3)

src/lib/actions/sandbox/mcp-bridge-adapter-status.ts
src/lib/actions/sandbox/mcp-bridge-status-resolution.test.ts
src/lib/actions/sandbox/mcp-bridge-status.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Walkthrough

The changes reject unsafe managed projection objects, including symlinks, FIFOs, directories, and other non-regular files. Deep Agents MCP status reports a dedicated error, exits with status 2, and preserves credential-inspection behavior.

Changes

Deep Agents projection safety

Layer / File(s)	Summary
Projection object validation `src/lib/actions/sandbox/mcp-bridge-adapter-deepagents-projection.ts`, `test/helpers/mcp-bridge-adapter-deepagents-fixture.ts`	Managed projection reads classify and reject unsafe filesystem objects. Fixtures create directory projections and avoid reading non-regular paths.
Status error propagation `src/lib/actions/sandbox/mcp-bridge-adapter-status.ts`, `src/lib/actions/sandbox/mcp-bridge-status.ts`	Deep Agents status inspection parses unsafe projection failures, reports the path, and exits with status 2. Non-Deep Agents credential-observation handling remains unchanged.
Safety test coverage `src/lib/actions/sandbox/mcp-bridge-adapter-deepagents-projection.test.ts`, `src/lib/actions/sandbox/mcp-bridge-status-resolution.test.ts`	Tests cover directories, dangling symlinks, valid-content symlinks, and FIFOs. Assertions validate unsafe-path errors, empty output, exit status 2, adapter-mismatch behavior, and legacy inspection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 0a6b3

This change makes unsafe Deep Agents projection entries fail clearly rather than reporting healthy status. No merge-blocking risk remains in the finalized findings.

Sequence Diagram(s)

sequenceDiagram
  participant MCPStatus as Deep Agents MCP status
  participant Projection as Managed projection read helpers
  participant Filesystem
  MCPStatus->>Projection: Inspect managed projection
  Projection->>Filesystem: Open and validate projection path
  Filesystem-->>Projection: Return filesystem metadata or open error
  Projection-->>MCPStatus: Raise UnsafeManagedProjectionError
  MCPStatus-->>MCPStatus: Emit unsafe-path diagnostic and exit 2

Suggested reviewers: ericksoa, brandonpelfrey

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 6 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes address issue `#10754` by rejecting dangling symlinks, symlinks to valid content, FIFOs, and other non-regular projection entries. The status command reports the unsafe projection error, exi…
Out of Scope Changes check	✅ Passed	The changes remain within scope. Production updates implement unsafe projection detection and status propagation. Fixture and test updates support the issue scenarios and verify unchanged credential-h…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: rejecting unsafe Deep Agents projections in MCP.

Full details: Linked Issues check

Explanation

The changes address issue #10754 by rejecting dangling symlinks, symlinks to valid content, FIFOs, and other non-regular projection entries. The status command reports the unsafe projection error, exits with status 2, and avoids healthy-provider reporting. Tests cover the required scenarios and preserve existing behavior.

Full details: Out of Scope Changes check

Explanation

The changes remain within scope. Production updates implement unsafe projection detection and status propagation. Fixture and test updates support the issue scenarios and verify unchanged credential-handling behavior.

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/fix-10754-final-entry

_{Comment @coderabbitai help to get the list of available commands.}

rsliter · 2026-09-02T22:40:14Z

@coderabbitai review

coderabbitai · 2026-09-02T22:40:22Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

github-code-quality · 2026-09-02T22:41:16Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 527e895 in the codex/fix-10754-fina... branch remains at 96%, unchanged from commit d836ccb in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit 527e895 in the codex/fix-10754-fina... branch remains at 83%, unchanged from commit ee8b43f in the main branch.

Show a line coverage summary of the most impacted files.

File	`main` ee8b43f	`codex/fix-10754-fina...` 527e895	+/-
`src/lib/onboard...le-lifecycle.ts`	77%	76%	-1%
`src/lib/state/o...oard-session.ts`	86%	87%	+1%
`src/lib/inference/nim.ts`	75%	76%	+1%
`src/lib/messagi...agent-config.ts`	82%	84%	+2%
`src/lib/state/o...d-checkpoint.ts`	88%	90%	+2%
`src/lib/messagi...est-compiler.ts`	97%	100%	+3%
`src/lib/onboard...press-resume.ts`	76%	80%	+4%
`src/lib/state/p...l-retirement.ts`	79%	85%	+6%
`src/lib/onboard...an-preflight.ts`	86%	92%	+6%
`src/lib/onboard...an-lifecycle.ts`	83%	92%	+9%

_{Updated September 03, 2026 18:49 UTC}

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

…x-10754-final-entry

cjagwani

P0: none.

P1: two fail-open paths can make an unsafe managed projection appear healthy. Both reproduce on exact head b0b7f9537757f627b8990e3a3fea1a1e224b3ad9.

cjagwani · 2026-09-02T23:43:05Z

+  if (!result)
+    return credentialInspectionFailure ?? { registered: null, detail: "sandbox unreachable" };
+  if (result.status !== 0 && adapter === "deepagents-config") {
+    const detail = redactBridgeSecretsForDisplay(


[P1] Classify the fixed marker before redacting display text

The redactor runs before the startsWith check and replaces configured credential values globally. A valid credential that overlaps the protocol marker therefore changes the marker, so this unsafe result is not recognized and status falls through to exit 0. On this exact head, GITHUB_TOKEN=Unsafe makes the dangling-symlink, valid-target-symlink, and FIFO regression cases all return 0; the unset-token control passes. Match a strict marker on the raw bounded command output first, redact only the selected display error, and add this collision case to the public-boundary test.

Fixed in da6ee52. Unsafe projection evidence is now recognized only from the raw strict type marker before credential redaction; only the extracted path is redacted. The command-boundary regression runs all three unsafe entry cases with GITHUB_TOKEN=Unsafe and requires exit 2 with empty stdout.

cjagwani · 2026-09-02T23:43:05Z

  "        assert_managed_source_stable(path, None)",
  "        return b'', None, None",
+  "    except OSError:",
+  "        linked = os.stat(path, follow_symlinks=False)",


[P1] Fail closed if the rejected symlink disappears during classification

After os.open(...O_NOFOLLOW) has already rejected the final symlink, an untrusted sandbox process can unlink it before this follow-up os.stat. That FileNotFoundError escapes into the outer missing-projection handler, which prints absent and exits 0; a deterministic command-level reproduction produced exactly that result. Preserve the original no-follow failure or raise the typed unsafe error when this lookup disappears or changes, and cover the transition with a regression test.

Leaving this unchanged because it is the removal race explicitly excluded from #10754. If the entry disappears between the no-follow open failure and fallback classification, the observable final state is absent and retains the existing exit-0 behavior. Closing that interleaving would require broader race semantics outside this PR.

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

…x-10754-final-entry

cjagwani

P0: none.

P1: one fail-open classification path remains on exact head da6ee529684f89ff79f8427ac36b0f7663c15db4. The earlier credential-redaction finding is fixed.

cjagwani · 2026-09-03T00:26:17Z

  "        assert_managed_source_stable(path, None)",
  "        return b'', None, None",
+  "    except OSError:",
+  "        linked = os.stat(path, follow_symlinks=False)",


[P1] Preserve every unsafe type when the initial open fails

This fallback only converts symlinks to UnsafeManagedProjectionError. On this exact head, a mode-000 FIFO makes os.open fail with EACCES; this os.stat(..., follow_symlinks=False) still sees the FIFO, but line 67 rethrows the generic error. When credential observation is absent, getAdapterRegistration discards that generic adapter error and public mcp status returns exit 0 with the FIFO still present. The unchanged unlink race has the same result: if the rejected symlink disappears before this os.stat, its FileNotFoundError reaches the outer missing-projection handler and returns absent/0. Classify every non-regular linked value with describe_managed_projection_type, preserve a controlled nonzero result if classification disappears or changes, and add public-boundary regressions for the mode-000 FIFO and unlink-between-open/stat cases.

Fixed the in-scope FIFO path in 235be35. The fallback now classifies every non-regular lstat result with describe_managed_projection_type, and the public command-boundary regression uses a mode-000 FIFO while still requiring exit 2, type-specific stderr, and empty stdout. I did not add the unlink-between-open/stat case because removal races are explicitly excluded from #10754.

…fix-10754-final-entry

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

…fix-10754-final-entry

cjagwani

Exact head reviewed: 235be35cb885397087e00ef5b5bd342fb20a730b.

P0

None.

P1

None.

The prior permission-denied FIFO fail-open is fixed: the rejected-open fallback now classifies every non-regular final entry, and the public mode-000 FIFO regression exits 2 without healthy output. Focused exact-head tests passed 30/30; required CI and managed-runtime image checks completed successfully; all eight commits are Verified; CodeRabbit completed with no actionable finding.

Approval is withheld because the repository's trusted checker still returns allPass: false: changes is recorded as skipped and test-e2e-sandbox failed the unchanged blueprint apply smoke. In addition, all nine exact-head Advisor specialists failed before producing review artifacts. I will re-evaluate when the exact-head gate evidence is complete and passing.

…x-10754-final-entry

rsliter · 2026-09-03T12:49:01Z

@coderabbitai review

coderabbitai · 2026-09-03T12:49:07Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-09-03T12:49:16Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

rsliter · 2026-09-03T13:07:07Z

@coderabbitai review

coderabbitai · 2026-09-03T13:07:13Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

…4-final-entry

rsliter · 2026-09-03T13:28:26Z

@coderabbitai review

coderabbitai · 2026-09-03T13:28:31Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Dismissed at the reviewer request to clear prior review state.

rsliter · 2026-09-03T15:51:58Z

Maintainer-authorized inherited-CI waiver for exact head 0a6b3bc4a355d25888f315e282638c1412f7f412:

build-typecheck failed only because npm 10.9.8 crashed in the pre-existing test/package-contract/managed-image-registry-transport.test.ts omit-dev install with Cannot read properties of null (reading 'edgesOut'). The aggregate checks job is red only because it reflects that job.
This PR changes neither that test nor any dependency manifest. The job passed 1,237 other package-contract tests before the npm crash, and every CLI shard passed.
Canonical main at eb3fa2e5097389d7dd8e2643552788ff16d8f14a reproduced the same test, line, and npm signature in run 33761515533. Recent main commits d4eff54a8d213a3a8fe5650703c8e708eab4dd7d and 8b0f617adf362fb2ed373820d02a43a00d9d2304 passed the same job. Current main documents this known npm/cli fix(host-mount): report the real reason a host directory is unusable #9787 failure as unrelated CI.
All other exact-head evidence passed: focused tests and validate:pr; all nine PR Review Advisor specialists; CodeRabbit with no actionable findings; code scanning; all CLI shards; managed-image builds and direct startup for Deep Agents Code, OpenClaw, and Hermes; Deep Agents staging QA; all-agent runtime activation; and both OpenClaw MCP discovery passes.

Per maintainer direction, this inherited npm failure is waived for readiness and merge. The candidate remains unchanged.

rsliter · 2026-09-03T16:54:24Z

Maintainer waiver for the remaining inherited E2E failure on exact head 1b5d57c5e01660447586fa985aea85b3f08f4f21:

test-e2e-gateway-isolation: the model-override fixture cannot call normalize_mutable_config_perms

This is not candidate-owned. This PR does not change the failing shell suite or the managed-image inputs it exercises. The exact signature also reproduced on unrelated PR #10889 in run 33773205634. The obsolete shell suite is being replaced by #10941.

The branch was refreshed with canonical fix #10930, so the gateway-pinned apply-smoke failure is no longer waived. This supplements the earlier npm 10.9.8 package-contract waiver. All focused issue #10754 tests, CLI shards, managed-image builds and runtime activation checks passed. Rebecca Sliter explicitly authorized merging past this inherited E2E failure.

github-actions · 2026-09-03T18:57:40Z

PR Review Advisor finished for commit 527e895. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

All previous runs

rsliter · 2026-09-03T18:59:26Z

Maintainer waiver for exact head 527e8953d4ccb28969abe449e3fef906269ee61b:

Ordinary CI run 33791250645 completed successfully, including all 12 CLI shards and build-typecheck. The earlier intermittent npm edgesOut failure did not recur and is not being waived on this revision.
Self-hosted E2E run 33791252351 passed both image builds, test-e2e-sandbox, test-non-root-sandbox-smoke, and test-e2e-port-overrides.
The run failed only test-e2e-gateway-isolation, job 100769952018. Its exact failure is the inherited test 27 signature: /dev/stdin: line 82: normalize_mutable_config_perms: command not found, with 44 tests passed and 1 failed.
The same unchanged signature reproduced on unrelated PR fix(inference): prevent Windows Ollama DNS rebinding #10889. PR test(e2e): finish sandbox image suite migration #10941 owns replacement of this obsolete suite and remains open.

Per the maintainer's explicit approval, only this exact inherited gateway-isolation failure is waived for this exact head. This waiver does not cover any candidate-owned or different failure. Earlier waiver comments apply to older revisions and are superseded by this exact-head record.

## Outcome Adds the canonical dated documentation entry for v0.0.120 and records the release's material user-facing changes before tag planning. The Hermes rebuild guide now also documents the fail-closed immutable-base requirement for legacy sandboxes without an image hint. ## Reason Release planning requires a merged `docs/changelog/2026-09-04.mdx` containing exactly one `## v0.0.120` heading. The existing automation draft does not contain that required changelog and does not cover the full release scope, so this PR provides a fresh, independently reviewed release-docs update. ### Related issues Relates to #10919 ## Changes - Add three release-note lead paragraphs and detailed, user-facing v0.0.120 changes with canonical documentation routes. - Cover configuration export and doctor (#11015, #11012); Hermes runtime, recovery, and Discord policy (#10595, #11071, #11024, #10927, #10983, #10988, #10999, #11019, #10682); Shields retirement (#10722, #10996); OpenShell forwarding and runtime authority (#10695, #10814, #10815, #10810); onboarding and recovery (#10690, #10900, #11046, #10882, #10864); inference behavior (#10956, #10910, #11070); Deep Agents MCP projection safety (#10911, #10909); and provider-profile validation (#10884, #10895). - Scope the legacy Hermes immutable-base rebuild guidance to the Hermes-rendered recovery page. ## Verification - `npx vitest run --project integration test/generation/check-docs-links.test.ts test/generation/check-docs-published-routes.test.ts test/generation/post-merge-docs.test.ts` — 3 files and 125 tests passed. - `npm run docs` — passed with 0 errors and 5 existing Fern warnings. - Independent documentation audit — reconciled all 71 commits in `v0.0.119..origin/main`, validated all 29 PR links and published routes, and found no unsupported product claims or remaining corrections. - Normal `pre-commit`, `commit-msg`, and `pre-push` hooks — passed. - `git diff --check` — passed. - GitHub commit verification — `a22fe0989fd72c7daaa9b2e7a4734a3edc069aba` is Verified with reason `valid`. - Secret review — the diff contains no secrets, API keys, or credentials. ## Review notes The existing automation draft #10919 is intentionally left untouched. This PR supersedes its release-docs content with the complete canonical changelog and a variant-correct Hermes recovery update. --- Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>  ## Summary by CodeRabbit - **Documentation** - Added release notes covering verified configuration export, host and gateway diagnostics, service forwarding, sandbox recovery, onboarding safeguards, inference retries, MCP projection safety, provider setup, and Discord runtime policy. - Clarified sandbox rebuild behavior, including use of the release-pinned immutable base image when required. - Documented that rebuilds stop before modifying sandbox data when the required image cannot be resolved or validated.

fix(mcp): reject unsafe Deep Agents projections

8f73e9d

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

rsliter self-assigned this Sep 2, 2026

test(mcp): clarify unsafe projection precedence

27e7e58

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

rsliter marked this pull request as ready for review September 2, 2026 23:15

rsliter requested review from cjagwani and cv September 2, 2026 23:15

Merge remote-tracking branch 'refs/remotes/origin/main' into codex/fi…

b0b7f95

…x-10754-final-entry

cjagwani previously requested changes Sep 2, 2026

View reviewed changes

rsliter removed the request for review from cv September 2, 2026 23:54

rsliter added 2 commits September 2, 2026 16:54

fix(mcp): preserve unsafe projection marker

f5ec932

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

Merge remote-tracking branch 'refs/remotes/origin/main' into codex/fi…

da6ee52

…x-10754-final-entry

rsliter requested a review from cjagwani September 3, 2026 00:01

cjagwani previously requested changes Sep 3, 2026

View reviewed changes

rsliter added 3 commits September 2, 2026 18:30

Merge branch 'main' of https://github.com/NVIDIA/NemoClaw into codex/…

7080578

…fix-10754-final-entry

fix(mcp): classify unreadable unsafe projections

abeb166

Signed-off-by: Rebecca Sliter <571084+rsliter@users.noreply.github.com>

Merge branch 'main' of https://github.com/NVIDIA/NemoClaw into codex/…

235be35

…fix-10754-final-entry

rsliter requested a review from cjagwani September 3, 2026 01:45

cjagwani reviewed Sep 3, 2026

View reviewed changes

Merge remote-tracking branch 'refs/remotes/origin/main' into codex/fi…

f856804

…x-10754-final-entry

rsliter marked this pull request as draft September 3, 2026 12:46

test(mcp): cover non-regular projection fallback

460b9e0

rsliter added 2 commits September 3, 2026 06:22

fix(mcp): centralize unsafe projection status parsing

aeef43c

Merge branch 'main' of github.com:NVIDIA/NemoClaw into codex/fix-1075…

0a6b3bc

…4-final-entry

rsliter marked this pull request as ready for review September 3, 2026 15:52

rsliter requested a review from cjagwani September 3, 2026 15:52

cv approved these changes Sep 3, 2026

View reviewed changes

rsliter added 4 commits September 3, 2026 09:55

merge: refresh from canonical main

1b5d57c

fix(mcp): preserve unsafe projection evidence

147adef

test(mcp): keep credential fixture inert

ca27909

fix(mcp): share projection type contract

527e895

rsliter merged commit 699ec51 into main Sep 3, 2026
147 of 149 checks passed

rsliter deleted the codex/fix-10754-final-entry branch September 3, 2026 19:13

github-actions Bot added the v0.0.120 label Sep 3, 2026

cjagwani mentioned this pull request Sep 5, 2026

docs: prepare v0.0.120 release #11100

Merged

Uh oh!

Conversation

rsliter commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Outcome

Reason

Related issues

Changes

Verification

Review notes

Uh oh!

copy-pr-bot Bot commented Sep 2, 2026

Uh oh!

coderabbitai Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

rsliter commented Sep 2, 2026

Uh oh!

coderabbitai Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-code-quality Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

cjagwani left a comment

Choose a reason for hiding this comment

Uh oh!

cjagwani Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

rsliter Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

cjagwani Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

rsliter Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

cjagwani left a comment

Choose a reason for hiding this comment

Uh oh!

cjagwani Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

rsliter Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

cjagwani left a comment

Choose a reason for hiding this comment

P0

P1

Uh oh!

rsliter commented Sep 3, 2026

Uh oh!

coderabbitai Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 3, 2026

Uh oh!

rsliter commented Sep 3, 2026

Uh oh!

coderabbitai Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rsliter commented Sep 3, 2026

Uh oh!

coderabbitai Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rsliter commented Sep 3, 2026

Uh oh!

rsliter commented Sep 2, 2026 •

edited

Loading

coderabbitai Bot commented Sep 2, 2026 •

edited

Loading

coderabbitai Bot commented Sep 2, 2026 •

edited

Loading

github-code-quality Bot commented Sep 2, 2026 •

edited

Loading

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading

rsliter commented Sep 3, 2026 •

edited

Loading