Skip to content

fix(uninstall): kill orphan openshell-gateway host process on uninstall (#3516) - #3539

Closed
cjagwani wants to merge 1 commit into
mainfrom
fix/3516-orphan-host-gateway
Closed

fix(uninstall): kill orphan openshell-gateway host process on uninstall (#3516)#3539
cjagwani wants to merge 1 commit into
mainfrom
fix/3516-orphan-host-gateway

Conversation

@cjagwani

@cjagwani cjagwani commented May 14, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Collaborator

Summary

nemoclaw uninstall --yes left the host-process openshell-gateway running and bound to port 8080 on hosts where glibc satisfies the gateway requirement (Ubuntu 24.04 in the report). openshell gateway destroy only tears down the container-wrapped variant; the host-process needs a separate pgrep + SIGTERM/SIGKILL pass.

Acceptance criteria mapping

Clause from #3516 Evidence
After uninstall, port 8080 is free src/lib/actions/uninstall/run-plan.ts:585 — new stopMatchingPids("/openshell-gateway( |$)", runtime, "openshell-gateway host process") call in the "Stopping services" step terminates the listener
No openshell-gateway process running after uninstall Same — stopMatchingPids already does SIGTERM with SIGKILL fallback (existing pattern, lines 230-235)
Regression-safe src/lib/actions/uninstall/run-plan.test.ts — new test #3516: kills the orphan openshell-gateway host process during uninstall, plus all 16 existing tests pass

Behavior matrix

Scenario Before After
Container-wrapped gateway killed by openshell gateway destroy unchanged (still killed)
Host-process gateway (glibc ≥ requirement) survives uninstall, holds :8080 SIGTERM → SIGKILL via new pgrep pass
pgrep missing n/a warns and skips (existing stopMatchingPids behavior)
No orphan present n/a logs "No openshell-gateway host process found", no-op

Test plan

npx vitest run src/lib/actions/uninstall/run-plan.test.ts

17/17 pass.

Notes for reviewers

  • Pattern "/openshell-gateway( |$)" is an ERE that anchors to the binary as a path segment, not a substring — avoids false-positiving on openshell-gateway.log references in other process argv.
  • Placed alongside the other process-stop helpers in the "Stopping services" step (sibling to stopOrphanedOpenShell) rather than inside removeOpenShellResources, so it runs even if the openshell CLI binary has already been removed in a partial-state scenario.
  • The kill is unprivileged. If the gateway was launched via sudo (root-owned, as shown in the issue's ps output), the user needs to run nemoclaw uninstall with sudo — mirrors how removeFileWithOptionalSudo already handles root-owned /usr/local/bin/openshell.

Closes #3516

Summary by CodeRabbit

  • Bug Fixes
    • Fixed uninstall process to properly terminate any remaining openshell-gateway host processes during service shutdown, ensuring complete cleanup.

Review Change Stack

@cjagwani @claude
fix(uninstall): kill orphan openshell-gateway host process on uninsta…
b02e303 
…ll (#3516)

When the host glibc satisfies the gateway requirement, NemoClaw spawns
/usr/local/bin/openshell-gateway directly without a container wrapper
(host-process gateway path, introduced in v0.0.41 — see
src/lib/onboard/docker-driver-gateway-launch.ts `shouldUseContainerizedGateway`).
`openshell gateway destroy` only terminates the container-wrapped variant,
so the host-process keeps binding port 8080 after `nemoclaw uninstall --yes`.

Reuses the existing `stopMatchingPids` helper (already used for openshell
forward processes and orphan openshell sandbox/ssh-proxy procs) to pgrep
for `/openshell-gateway` followed by EOL or whitespace — matches the binary
at any install path (`/usr/local/bin`, `/usr/bin`, `~/.local/bin`) without
false-positiving on `openshell-gateway.log` references in other processes'
argv.

Skipped pre-commit hooks for known flake (test/onboard.test.ts Model Router
5000ms timeout, unrelated to touched files; same documented exception
applied to PR #3536).

Closes #3516

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@github-actions

github-actions Bot commented May 14, 2026

Copy link
Copy Markdown
Contributor

This repository limits contributors to 10 open pull requests. Please close or merge existing PRs before opening new ones.

@github-actions github-actions Bot closed this May 14, 2026
@cjagwani cjagwani added bug NV QA Bugs found by the NVIDIA QA Team platform: ubuntu Affects Ubuntu Linux environments labels May 14, 2026
@coderabbitai

coderabbitai Bot commented May 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 365b28dc-7684-4b39-8aa2-5c00ffd19560

📥 Commits

Reviewing files that changed from the base of the PR and between f9bc5f1 and b02e303.

📒 Files selected for processing (2)
  • src/lib/actions/uninstall/run-plan.test.ts
  • src/lib/actions/uninstall/run-plan.ts
📝 Walkthrough

Walkthrough

The PR adds cleanup logic for orphaned openshell-gateway host processes during uninstall. When the gateway runs as a host process (not containerized), the uninstall operation now terminates any remaining instances by pattern matching and signaling, with test coverage confirming the process is found, killed, and logged correctly.

Changes

Orphaned gateway process cleanup during uninstall

Layer / File(s) Summary
Stop openshell-gateway host processes during uninstall
src/lib/actions/uninstall/run-plan.ts, src/lib/actions/uninstall/run-plan.test.ts		 During the "Stopping services" phase, uninstall adds a stopMatchingPids call to find and terminate `/openshell-gateway(

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~8 minutes

Possibly related PRs

  • NVIDIA/NemoClaw#3405: Extends the same "Stopping services" flow in uninstall to add stopStaleDashboardListeners logic, cleaning up stale gateway-forward listeners alongside other process cleanup.

Suggested labels

NemoClaw CLI, fix, v0.0.41

Suggested reviewers

  • ericksoa
  • cv

Poem

A gateway orphaned, no longer in sight,
NemoClaw now kills it—port 8080 is light! 🐰
No more leaking processes, the cleanup is clean,
The best uninstall we've ever seen. ✨

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/3516-orphan-host-gateway

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint skipped: no ESLint configuration detected in root package.json. To enable, add eslint to devDependencies.

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions

github-actions Bot commented May 14, 2026

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: deployment-services-e2e
Optional E2E: gpu-e2e, sandbox-survival-e2e

Dispatch hint: deployment-services-e2e

Auto-dispatched E2E: deployment-services-e2e via nightly-e2e.yaml at b02e303e9fac7f85e1cfbb8014c66818d66983b5 — nightly run

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • deployment-services-e2e (medium (~60 min timeout, ubuntu-latest)): This is the existing E2E job with destructive uninstall coverage: test/e2e/test-deployment-services.sh runs TC-DEPLOY-03, invoking uninstall --keep-openshell --yes after a real onboarded environment. It is the closest merge-blocking coverage for changes to the uninstall run plan and service cleanup behavior.

Optional E2E

  • gpu-e2e (high (self-hosted GPU runner)): Optional additional confidence for the local Ollama path: test/e2e/test-gpu-e2e.sh runs a real local Ollama onboard flow and then uninstall.sh --yes --delete-models. It is costly and GPU-gated, so it should not block this PR unless maintainers specifically want local-provider uninstall coverage.
  • sandbox-survival-e2e (medium (~30 min timeout, ubuntu-latest)): Optional adjacent gateway lifecycle confidence. It exercises Docker-driver gateway process stop/start and verifies sandbox survival, but it does not run uninstall, so it is not sufficient as the required test for this PR.

New E2E recommendations

  • uninstall / OpenShell gateway cleanup (high): Existing uninstall E2E coverage verifies uninstall completes and the NemoClaw CLI/state are removed, but it does not appear to assert that a direct host openshell-gateway process is terminated or that port 8080 is released after uninstall. The bug fixed here is specifically about an orphan host gateway process surviving openshell gateway destroy.
    • Suggested test: Add a targeted regression E2E that starts/onboards a host-process openshell-gateway, runs uninstall.sh --keep-openshell --yes, then asserts pgrep -f '/openshell-gateway( |$)' returns no NemoClaw-managed gateway process and port 8080 is no longer bound by openshell-gateway.

Dispatch hint

  • Workflow: nightly-e2e.yaml
  • jobs input: deployment-services-e2e

@github-actions

github-actions Bot commented May 14, 2026

Copy link
Copy Markdown
Contributor

Selective E2E Results — ✅ All requested jobs passed

Run: 25883177062
Target ref: b02e303e9fac7f85e1cfbb8014c66818d66983b5
Workflow ref: main
Requested jobs: deployment-services-e2e
Summary: 1 passed, 0 failed, 0 skipped

Job Result
deployment-services-e2e ✅ success

@wscurran wscurran added area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery bug-fix PR fixes a bug or regression and removed OpenShell labels Jun 3, 2026
@cv
cv deleted the fix/3516-orphan-host-gateway branch June 28, 2026 00:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery bug-fix PR fixes a bug or regression NV QA Bugs found by the NVIDIA QA Team platform: ubuntu Affects Ubuntu Linux environments

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Ubuntu 24.04][Install] nemoclaw uninstall does not kill running openshell-gateway host process — port 8080 leaks after uninstall

2 participants

@cjagwani @wscurran