fix(cli): add sudo hint to debug dmesg-restricted message - #4384
Merged
Conversation
When `kernel.dmesg_restrict=1` and the user runs `nemoclaw debug` as non-root, the Kernel Messages section explained why the section was skipped but did not tell the user how to include kernel logs anyway. Extend `dmesgRestrictedMessage` to append a "Re-run with `sudo nemoclaw debug`" hint so users and triagers see a concrete next step, matching the spec in the bug's Suggested Fix. The TTY-aware `sudo -n dmesg` fallback from the same Suggested Fix is intentionally out of scope for this minimum-viable change. Export `dmesgRestrictedMessage` so the wording can be pinned by a unit test. Fixes #4366. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Jason Ma <jama@nvidia.com>
Contributor
📝 WalkthroughWalkthroughExports a dmesg re-run hint helper and adds buildDmesgRerunCommand; threads DebugOptions through kernel message collection so the hint preserves --quick/--output. Tests verify message text and shell-safe quoting/escaping of the re-run command. Changesdmesg re-run hint + option threading
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint skipped: no ESLint configuration detected in root package.json. To enable, add Comment |
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
E2E Scenario Advisor RecommendationRequired scenario E2E: None Full scenario advisor summaryE2E Scenario AdvisorBase: Required scenario E2E
Optional scenario E2E
Relevant changed files
|
Contributor
PR Review AdvisorFindings: 1 needs attention, 3 worth checking, 0 nice ideas Review findings🛠️ Needs attention
🔎 Worth checking
🌱 Nice ideas
Since last review detailsCurrent findings:
This is an automated advisory review. A human maintainer must make the final merge decision. |
Contributor
Address PR review advisor feedback: the previous hint hardcoded `sudo nemoclaw debug` regardless of the user's invocation, which would nudge a user who ran `debug --quick` into the broader privileged collector. - Make `dmesgRestrictedMessage` accept `DebugOptions` and build the rerun command via new `buildDmesgRerunCommand` helper that preserves `--quick` and `--output` (with shell-safe single-quoting). - Plumb `opts` through `collectKernelMessages` -> `collectDmesg`. - Add a sensitive-data caution to the recovery message so users review privileged diagnostics before sharing. - Add option-aware regression tests covering the rerun-command builder and message wording. Refs: #4366 Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/diagnostics/debug.ts`:
- Around line 157-173: The dmesg rerun hint omits sandbox scoping: update
buildDmesgRerunCommand to append "--sandbox" followed by the sandbox name when
opts.sandboxName is set (use the same single-quote escaping logic as for
opts.output — replace any "'" with "'\\''" and wrap the escaped value in single
quotes), so the generated command preserves sandbox scope; also add/extend unit
tests for buildDmesgRerunCommand to verify a sandboxName results in a "--sandbox
'<name>'" token and that embedded single quotes are correctly escaped.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 686a5741-6dc0-4748-9aff-d00a52eb0703
📒 Files selected for processing (2)
src/lib/diagnostics/debug.test.tssrc/lib/diagnostics/debug.ts
Comment on lines
+157
to
+173
| /** | ||
| * Build the option-aware re-run command for the dmesg-restricted hint. | ||
| * | ||
| * Preserves the user's original invocation flags (`--quick`, `--output`) so the | ||
| * hint nudges them back into the same scoped diagnostic instead of a broader | ||
| * privileged collector. See issue #4366. | ||
| */ | ||
| export function buildDmesgRerunCommand(opts: DebugOptions = {}): string { | ||
| const parts = ["sudo", "nemoclaw", "debug"]; | ||
| if (opts.quick) parts.push("--quick"); | ||
| if (opts.output) { | ||
| // Single-quote the path and escape embedded single quotes for shell safety. | ||
| const escaped = opts.output.replace(/'/g, "'\\''"); | ||
| parts.push("--output", `'${escaped}'`); | ||
| } | ||
| return parts.join(" "); | ||
| } |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if sandbox name affects diagnostic collection behavior
# Find where sandboxName is used in debug collection
rg -n -C3 'sandboxName' src/lib/diagnostics/debug.ts
# Check if there are sandbox-specific collection steps
ast-grep --pattern 'function collect$_($$$, sandboxName, $$$) { $$$ }'Repository: NVIDIA/NemoClaw
Length of output: 3397
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 1) Find where buildDmesgRerunCommand is used (rerun hint path)
rg -n "buildDmesgRerunCommand" -S src/lib/diagnostics/debug.ts src/lib/diagnostics
# 2) Inspect dmesgRestrictedMessage and surrounding logic to see what opts are passed
rg -n "dmesgRestrictedMessage|collectDmesg|debug.*rerun|rerun" -S src/lib/diagnostics/debug.ts
# 3) Check how detectSandboxName determines a default (and whether it depends on registry/home)
rg -n "function detectSandboxName|detectSandboxName\\(" -S src/lib/diagnostics/debug.ts src/lib
# 4) If registry is involved, check where it’s stored/scoped
rg -n "REGISTRY_FILE|sandboxes\\.json|sandbox.*registry|nemoclaw.*sandboxes" -S src/libRepository: NVIDIA/NemoClaw
Length of output: 9589
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show relevant code blocks in debug.ts
sed -n '140,260p' src/lib/diagnostics/debug.ts
echo "----"
sed -n '200,280p' src/lib/diagnostics/debug.ts
echo "----"
sed -n '220,260p' src/lib/diagnostics/debug.ts
echo "----"
sed -n '560,640p' src/lib/diagnostics/debug.ts
echo "----"
# Show relevant tests for buildDmesgRerunCommand
sed -n '160,250p' src/lib/diagnostics/debug.test.ts
echo "----"
rg -n "4366|dmesg-rerun|buildDmesgRerunCommand" -S src/lib/diagnostics/debug.test.tsRepository: NVIDIA/NemoClaw
Length of output: 13189
Preserve --sandbox in the dmesg-restricted rerun hint
buildDmesgRerunCommand() only carries --quick and --output and ignores opts.sandboxName, so dmesgRestrictedMessage() generates a re-run command without --sandbox. Since runDebug() uses opts.sandboxName to scope sandbox-specific collection (e.g., OpenShell fetches/logs use sandboxName), re-running via the hint under sudo can target a different sandbox because auto-detection reads the HOME-scoped registry and otherwise falls back to the first entry from openshell sandbox list.
Add --sandbox '<name>' to the hint when opts.sandboxName is set (using the same single-quote escaping as --output) and extend the existing buildDmesgRerunCommand unit tests.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/lib/diagnostics/debug.ts` around lines 157 - 173, The dmesg rerun hint
omits sandbox scoping: update buildDmesgRerunCommand to append "--sandbox"
followed by the sandbox name when opts.sandboxName is set (use the same
single-quote escaping logic as for opts.output — replace any "'" with "'\\''"
and wrap the escaped value in single quotes), so the generated command preserves
sandbox scope; also add/extend unit tests for buildDmesgRerunCommand to verify a
sandboxName results in a "--sandbox '<name>'" token and that embedded single
quotes are correctly escaped.
cv
approved these changes
May 29, 2026
wscurran
added
area: cli
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nemoclaw debugrunning as a non-root user withkernel.dmesg_restrict=1already explains in the Kernel Messages section thatdmesgis restricted, but it does not tell the user how to include kernel logs. Add a "Re-run withsudo nemoclaw debug" hint to the skipped message so users and triagers see a concrete next step, matching the spec in the issue's Suggested Fix. The optional TTY-awaresudo -n dmesgfallback in the same Suggested Fix is intentionally out of scope for this minimum-viable change.Related Issue
Fixes #4366.
Changes
src/lib/diagnostics/debug.ts: extenddmesgRestrictedMessageto append a second line —Re-run with `sudo nemoclaw debug` to include kernel logs in this report.— to the parenthetical block, and export the function so the wording can be unit-tested.src/lib/diagnostics/debug.test.ts: two new#4366tests asserting the message still explains why kernel messages were skipped and that it contains the sudo re-run hint.Type of Change
Verification
npx prek run --all-filespassesnpm testpassesnpm run docsbuilds without warnings (doc changes only)Signed-off-by: Jason Ma jama@nvidia.com
Summary by CodeRabbit
New Features
Tests