fix(telegram): honor DM allowlist aliases by ericksoa · Pull Request #4554 · NVIDIA/NemoClaw

ericksoa · 2026-05-30T00:08:24Z

Summary

Treat TELEGRAM_AUTHORIZED_CHAT_IDS and TELEGRAM_CHAT_ID as compatibility aliases for TELEGRAM_ALLOWED_IDS, while persisting and baking only the canonical TELEGRAM_ALLOWED_IDS value.
Preserve alias handling across fresh onboard, channels add telegram, resume/rebuild, and OpenClaw config generation so Telegram DMs get dmPolicy: allowlist / allowFrom when QA-style env vars are used.
Add Telegram runtime breadcrumbs for DM allowlist state, inbound getUpdates metadata, and outbound sendMessage attempts without logging tokens, IDs, or message text.
Add an opt-in live Telegram inbound reply validation surface that uses an allowlist alias, waits for a real Telegram-client DM, and verifies both inbound and outbound gateway breadcrumbs.
Update messaging docs and generated skill references with the alias and inbound-test guidance.

Related Issue

Problem

The #4553 repro exported TELEGRAM_CHAT_ID and TELEGRAM_AUTHORIZED_CHAT_IDS, but NemoClaw only consumed TELEGRAM_ALLOWED_IDS when constructing the OpenClaw allowFrom map. That made the bridge look healthy because polling started, while the rebuilt sandbox could still have no explicit DM allowlist. The repro also used Telegram Bot API sendMessage, which sends from the bot to the chat and therefore proves outbound API access, not inbound user-to-agent routing.

Live Inbound Validation Surface

To reproduce the user-visible acceptance path with a real Telegram client and an alias-derived allowlist:

TELEGRAM_BOT_TOKEN_REAL=<real-bot-token> \
TELEGRAM_AUTHORIZED_CHAT_IDS=<allowed-telegram-user-or-private-chat-id> \
NEMOCLAW_TELEGRAM_INBOUND_REPLY_E2E=1 \
NEMOCLAW_NON_INTERACTIVE=1 \
NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1 \
NVIDIA_API_KEY=<key> \
bash test/e2e/test-messaging-providers.sh

When the script prompts, send a fresh direct message from the allowed Telegram client to the bot. The check then waits for both [telegram] [default] inbound update received and [telegram] [default] outbound sendMessage attempted in /tmp/gateway.log.

Verification

Nightly E2E

Current head: fb394dd95129022d0835ce024c2f4573db74bc1f.

Selected PR-head nightly passed: https://github.com/NVIDIA/NemoClaw/actions/runs/26669565696

Required jobs passed:

messaging-providers-e2e
channels-add-remove-e2e
messaging-compatible-endpoint-e2e

Older selected runs at 66be908cc2efdd37b9a6ae4ad6668409a6a2d673, fdec626e8ddfed3f1de1a9000fbfcaf18ad9fc8b, and c08a458ccf970c0f35bb9ea4e5f2fd1809be573b are superseded.

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

coderabbitai · 2026-05-30T00:08:36Z

📝 Walkthrough

Walkthrough

Adds alias-aware Telegram messaging config resolution (canonicalizes legacy keys into TELEGRAM_ALLOWED_IDS), backfills and warns in onboarding/post-rebuild flows, emits runtime diagnostics for Bot API sendMessage/getUpdates and config state, updates e2e scripts for alias handling and optional inbound-reply probes, expands tests, and updates docs.

Changes

Telegram messaging DM allowlist aliases and diagnostics

Layer / File(s)	Summary
Messaging config aliasing infrastructure `src/lib/messaging-channel-config.ts`, `src/lib/messaging-channel-config.test.ts`	Introduce `CONFIG_ALIASES`, alias->canonical lookup, `resolveMessagingChannelConfigEnvValue`, and make sanitize/read/hydrate alias-aware. Tests verify canonical precedence, canonicalization from aliases, and hydration into `TELEGRAM_ALLOWED_IDS`.
Config resolution in onboarding flows `src/lib/onboard/messaging-channel-setup.ts`, `src/lib/onboard/messaging-config.ts`, `src/lib/onboard/messaging-channel-setup.test.ts`, `src/lib/onboard/messaging-config.test.ts`	Use alias-aware resolver in onboarding/build flows, backfill canonical env keys when aliases are used, and warn when legacy keys are detected. Tests assert non-interactive setup accepts aliases and build config prefers canonical values.
Runtime diagnostics and telemetry `nemoclaw-blueprint/scripts/telegram-diagnostics.js`, `test/telegram-diagnostics.test.ts`, `test/generate-openclaw-config.test.ts`	Add runtime breadcrumbs to log DM allowlist state (without exposing IDs), outbound `sendMessage` response status, and inbound `getUpdates` observations once per process. Tests verify diagnostics output and safe logging.
Post-rebuild bridge verification `src/lib/actions/sandbox/telegram-channel-bridge-verification.ts`, `src/lib/actions/sandbox/telegram-channel-bridge-verification.test.ts`, `src/lib/actions/sandbox/policy-channel.ts`	New helpers to select default Telegram account and print an allowlist-empty warning; wire the warning into `verifyChannelBridgeAfterRebuild` to emit targeted guidance after bridge startup. Tests cover selection and conditional warning emission.
E2E script normalization and gating `test/e2e/test-messaging-providers.sh`	Accept `TELEGRAM_AUTHORIZED_CHAT_IDS` and `TELEGRAM_CHAT_ID` as compatibility aliases, choose a single allowlist source and export normalized env, count and report parsed IDs, skip onboarding reachability when using fake tokens, and add an optional live inbound-reply probe gated to real tokens and alias-path usage.
User documentation for aliases and troubleshooting `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/troubleshooting.mdx`, `skills/.../messaging-channels.md`, `skills/.../troubleshooting.md`	Document `TELEGRAM_ALLOWED_IDS` as canonical, list legacy aliases, and clarify that outbound `sendMessage` only validates API delivery while inbound agent reply testing requires messaging from an allowed user and checking gateway logs.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

NVIDIA/NemoClaw#4288: Related Telegram diagnostics changes and test expectations.
NVIDIA/NemoClaw#4403: Related telemetry/startup probe improvements in telegram-diagnostics.js.

Suggested labels

Integration: Telegram, documentation

"🐰 I hopped through configs, tidy and bright,
Aliases folded to one shining light,
Warnings whispered when lists are bare,
Breadcrumbs trace the outbound air,
Now chats and docs spring clearer, day and night."

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 6.06% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix(telegram): honor DM allowlist aliases' accurately summarizes the main change: adding support for Telegram DM allowlist aliases (TELEGRAM_AUTHORIZED_CHAT_IDS and TELEGRAM_CHAT_ID) to work alongside the canonical TELEGRAM_ALLOWED_IDS key.
Linked Issues check	✅ Passed	The PR comprehensively addresses all coding requirements from issue `#4553`: accepting alias env vars (TELEGRAM_CHAT_ID, TELEGRAM_AUTHORIZED_CHAT_IDS) so allowFrom DM allowlist is correctly populated, adding runtime breadcrumbs for inbound/outbound diagnostics, implementing allowlist verification, and providing E2E validation for inbound routing.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to Telegram DM allowlist alias support and inbound routing diagnostics as specified in `#4553`, including config normalization, documentation updates, diagnostics instrumentation, and E2E testing.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/telegram-allowed-id-aliases

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-05-30T00:08:55Z

🌿 Preview your docs: https://nvidia-preview-pr-4554.docs.buildwithfern.com/nemoclaw

github-actions · 2026-05-30T00:12:27Z

E2E Advisor Recommendation

Required E2E: messaging-providers-e2e, channels-add-remove-e2e, messaging-compatible-endpoint-e2e
Optional E2E: ubuntu-repo-cloud-openclaw-telegram, token-rotation-e2e

Dispatch hint: messaging-providers-e2e,channels-add-remove-e2e,messaging-compatible-endpoint-e2e

Auto-dispatched E2E: messaging-providers-e2e, channels-add-remove-e2e, messaging-compatible-endpoint-e2e via nightly-e2e.yaml at fb394dd95129022d0835ce024c2f4573db74bc1f — nightly run

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

messaging-providers-e2e (high (~75 min timeout; creates a real sandbox and exercises multiple messaging providers)): Directly covers the changed messaging provider/onboarding path: Telegram allowlist alias handling, provider/placeholder/L7 rewrite, baked openclaw.json channel config, Telegram diagnostics, and the modified test/e2e/test-messaging-providers.sh script.
channels-add-remove-e2e (high (~75 min timeout; real sandbox lifecycle)): Required because policy-channel.ts changed the channels add post-rebuild verification path for Telegram. This job validates host-side channels add/remove, automatic policy preset application, rebuild, provider attachment, and Telegram bridge egress after lifecycle mutations.
messaging-compatible-endpoint-e2e (medium (single sandbox with hermetic compatible endpoint)): Required because telegram-diagnostics.js now emits breadcrumbs around Telegram inbound/outbound traffic and inference.local failures. This job is the existing hermetic Telegram + OpenAI-compatible endpoint routing check for the bridge-to-inference user flow.

Optional E2E

ubuntu-repo-cloud-openclaw-telegram (high (scenario E2E with cloud OpenClaw and Telegram secret requirements)): Useful real-flow confidence for OpenClaw with Telegram messaging enabled through the typed scenario runner. It is adjacent to the changed Telegram DM allowlist and diagnostics behavior, but may require real Telegram secrets and is less targeted than messaging-providers-e2e.
token-rotation-e2e (high (real sandbox and multiple messaging providers)): Optional adjacent coverage for persisted messaging configuration and provider credential hash behavior across repeated onboarding/rebuilds. The PR changes config sanitization/hydration but does not directly change token rotation logic.

New E2E recommendations

Telegram inbound reply diagnostics (high): The PR adds runtime diagnostics for inbound getUpdates and outbound sendMessage breadcrumbs, but the existing live inbound proof in test/e2e/test-messaging-providers.sh is optional and human-prompted via NEMOCLAW_TELEGRAM_INBOUND_REPLY_E2E. A hermetic fake Telegram getUpdates/sendMessage loop would make this merge-blocking without requiring a human Telegram client.
- Suggested test: Add a hermetic Telegram inbound-reply E2E that drives a controlled Bot API mock returning getUpdates payloads and asserts the gateway logs both inbound update received and outbound sendMessage attempted.

Dispatch hint

Workflow: nightly-e2e.yaml
jobs input: messaging-providers-e2e,channels-add-remove-e2e,messaging-compatible-endpoint-e2e

github-actions · 2026-05-30T00:12:28Z

E2E Scenario Advisor Recommendation

Required scenario E2E: ubuntu-repo-cloud-openclaw-telegram
Optional scenario E2E: None

Dispatch required scenario E2E:

gh workflow run e2e-scenarios.yaml --ref <pr-head-ref> --field scenarios=ubuntu-repo-cloud-openclaw-telegram

Workflow run

Full scenario advisor summary

E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required scenario E2E

ubuntu-repo-cloud-openclaw-telegram: Changes affect Telegram messaging onboarding/config canonicalization, baked OpenClaw Telegram bridge diagnostics, and post-rebuild Telegram bridge verification. The routed Telegram OpenClaw scenario is the smallest scenario ID that exercises the affected messaging onboarding and messaging-telegram validation surface.
- Dispatch: gh workflow run e2e-scenarios.yaml --ref <pr-head-ref> --field scenarios=ubuntu-repo-cloud-openclaw-telegram

Optional scenario E2E

None.

Relevant changed files

nemoclaw-blueprint/scripts/telegram-diagnostics.js
src/lib/actions/sandbox/policy-channel.ts
src/lib/actions/sandbox/telegram-channel-bridge-verification.ts
src/lib/messaging-channel-config.ts
src/lib/onboard/messaging-channel-setup.ts
src/lib/onboard/messaging-config.ts

github-actions · 2026-05-30T00:12:44Z

Selective E2E Results — ✅ All requested jobs passed

Run: 26668622469
Target ref: 66be908cc2efdd37b9a6ae4ad6668409a6a2d673
Workflow ref: main
Requested jobs: messaging-providers-e2e,telegram-injection-e2e,network-policy-e2e
Summary: 0 passed, 0 failed, 0 skipped

Job	Result
messaging-providers-e2e	⚠️ cancelled
network-policy-e2e	⚠️ cancelled
telegram-injection-e2e	⚠️ cancelled

github-actions · 2026-05-30T00:13:15Z

PR Review Advisor

Findings: 0 needs attention, 3 worth checking, 0 nice ideas
Since last review: 1 prior item resolved, 2 still apply, 0 new items found

Review findings

🛠️ Needs attention

None.

🔎 Worth checking

Source-of-truth review needed: Telegram runtime diagnostics preload: The advisor marked localized patch analysis as needs_followup.
- Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
- Evidence: nemoclaw-blueprint/scripts/telegram-diagnostics.js wraps http/https request methods and stderr; the comments describe diagnostic purpose but not the removal condition.
Telegram live inbound proof still does not correlate the DM to the agent reply (test/e2e/test-messaging-providers.sh:555): The optional live proof improves coverage by requiring an alias-derived allowlist and waiting for both an inbound getUpdates breadcrumb and an outbound sendMessage breadcrumb after a log baseline. It still accepts any inbound breadcrumb and any outbound sendMessage breadcrumb after that baseline, without proving the outbound send was caused by the fresh Telegram-client DM, passed through an agent turn, or reached the client as a visible reply. That leaves the linked issue's acceptance clauses about routing the message to the agent and receiving a client-visible reply only partially evidenced.
- Recommendation: Strengthen M19b by correlating the fresh DM to the reply. For example, use a sanitized/generated nonce or non-sensitive correlation token, assert an agent-turn breadcrumb between inbound and outbound, or otherwise bind the observed sendMessage to the specific update being tested.
- Evidence: run_telegram_inbound_reply_probe records log_before_lines, then sets saw_inbound when delta logs contain "[telegram] [default] inbound update received" and saw_outbound when they contain "[telegram] [default] outbound sendMessage attempted"; the pass at line 563 requires only both booleans.
Telegram diagnostics monkeypatch still lacks an explicit source-of-truth lifecycle (nemoclaw-blueprint/scripts/telegram-diagnostics.js:244): The PR expands a NODE_OPTIONS preload that globally wraps http/https request methods and stderr to observe Telegram runtime traffic. The implementation has useful mitigations: it filters to api.telegram.org, caps getUpdates buffering, emits one-shot sanitized breadcrumbs, and tests token/ID/message redaction. However, this remains a sensitive sandbox-runtime monkeypatch, and the code/docs still do not state when the workaround should move to provider-native diagnostics or be removed.
- Recommendation: Document the source boundary and removal condition near the preload, such as keeping this only until OpenClaw emits provider-native sanitized inbound/outbound/allowlist breadcrumbs, then removing or narrowing the monkeypatch. If the diagnostic read paths continue to grow, also add a malformed-config/no-crash regression test for the new best-effort config reads.
- Evidence: telegram-diagnostics.js installs wrapHttp(http, "request"), wrapHttp(http, "get"), wrapHttp(https, "request"), and wrapHttp(https, "get") before the gateway-specific startup timer gate; tests cover redaction but no explicit removal condition is present.

🌱 Nice ideas

None.

Since last review details

Current findings:

Source-of-truth review needed: Telegram runtime diagnostics preload: The advisor marked localized patch analysis as needs_followup.
- Recommendation: Identify the invalid state, source boundary, source-fix constraint, regression test, and removal condition before merging the localized behavior.
- Evidence: nemoclaw-blueprint/scripts/telegram-diagnostics.js wraps http/https request methods and stderr; the comments describe diagnostic purpose but not the removal condition.
Telegram live inbound proof still does not correlate the DM to the agent reply (test/e2e/test-messaging-providers.sh:555): The optional live proof improves coverage by requiring an alias-derived allowlist and waiting for both an inbound getUpdates breadcrumb and an outbound sendMessage breadcrumb after a log baseline. It still accepts any inbound breadcrumb and any outbound sendMessage breadcrumb after that baseline, without proving the outbound send was caused by the fresh Telegram-client DM, passed through an agent turn, or reached the client as a visible reply. That leaves the linked issue's acceptance clauses about routing the message to the agent and receiving a client-visible reply only partially evidenced.
- Recommendation: Strengthen M19b by correlating the fresh DM to the reply. For example, use a sanitized/generated nonce or non-sensitive correlation token, assert an agent-turn breadcrumb between inbound and outbound, or otherwise bind the observed sendMessage to the specific update being tested.
- Evidence: run_telegram_inbound_reply_probe records log_before_lines, then sets saw_inbound when delta logs contain "[telegram] [default] inbound update received" and saw_outbound when they contain "[telegram] [default] outbound sendMessage attempted"; the pass at line 563 requires only both booleans.
Telegram diagnostics monkeypatch still lacks an explicit source-of-truth lifecycle (nemoclaw-blueprint/scripts/telegram-diagnostics.js:244): The PR expands a NODE_OPTIONS preload that globally wraps http/https request methods and stderr to observe Telegram runtime traffic. The implementation has useful mitigations: it filters to api.telegram.org, caps getUpdates buffering, emits one-shot sanitized breadcrumbs, and tests token/ID/message redaction. However, this remains a sensitive sandbox-runtime monkeypatch, and the code/docs still do not state when the workaround should move to provider-native diagnostics or be removed.
- Recommendation: Document the source boundary and removal condition near the preload, such as keeping this only until OpenClaw emits provider-native sanitized inbound/outbound/allowlist breadcrumbs, then removing or narrowing the monkeypatch. If the diagnostic read paths continue to grow, also add a malformed-config/no-crash regression test for the new best-effort config reads.
- Evidence: telegram-diagnostics.js installs wrapHttp(http, "request"), wrapHttp(http, "get"), wrapHttp(https, "request"), and wrapHttp(https, "get") before the gateway-specific startup timer gate; tests cover redaction but no explicit removal condition is present.

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nemoclaw-blueprint/scripts/telegram-diagnostics.js`:
- Around line 159-164: The current logic emits the "DM allowlist is empty"
warning unconditionally; restrict that warning to only run when account.dmPolicy
=== 'allowlist'. Change the block around account.dmPolicy and allowFrom so that
you check account.dmPolicy === 'allowlist' first, then inside that branch emit
the configured message when allowFrom.length > 0 and emit the "allowlist is
empty" warning only when allowFrom.length === 0; keep the existing emit messages
and the allowFrom length pluralization logic intact (refer to account.dmPolicy,
allowFrom and the emit calls).

In `@src/lib/actions/sandbox/policy-channel.ts`:
- Around line 599-603: The warning currently triggers when account?.dmPolicy !==
"allowlist" or allowFrom.length === 0, causing false positives; update the
condition in the block that logs the Telegram allowlist warning (where
account?.dmPolicy and allowFrom are referenced in policy-channel.ts) to only run
when account?.dmPolicy === "allowlist" && allowFrom.length === 0 so the message
about an empty allowlist is emitted only when allowlist mode is active and there
are no allowed senders.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 14be2789-68ba-4da2-8047-83a9cc901e02

📥 Commits

Reviewing files that changed from the base of the PR and between a5e7e63 and 66be908.

📒 Files selected for processing (14)

docs/manage-sandboxes/messaging-channels.mdx
docs/reference/troubleshooting.mdx
nemoclaw-blueprint/scripts/telegram-diagnostics.js
skills/nemoclaw-user-manage-sandboxes/references/messaging-channels.md
skills/nemoclaw-user-reference/references/troubleshooting.md
src/lib/actions/sandbox/policy-channel.ts
src/lib/messaging-channel-config.test.ts
src/lib/messaging-channel-config.ts
src/lib/onboard/messaging-channel-setup.test.ts
src/lib/onboard/messaging-channel-setup.ts
src/lib/onboard/messaging-config.test.ts
src/lib/onboard/messaging-config.ts
test/generate-openclaw-config.test.ts
test/telegram-diagnostics.test.ts

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

github-actions · 2026-05-30T00:23:04Z

Selective E2E Results — ✅ All requested jobs passed

Run: 26668726735
Target ref: 66be908cc2efdd37b9a6ae4ad6668409a6a2d673
Workflow ref: main
Requested jobs: messaging-providers-e2e,channels-add-remove-e2e
Summary: 0 passed, 0 failed, 0 skipped

Job	Result
channels-add-remove-e2e	⚠️ cancelled
messaging-providers-e2e	⚠️ cancelled

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

github-actions · 2026-05-30T00:34:38Z

Selective E2E Results — ✅ All requested jobs passed

Run: 26669016534
Target ref: fdec626e8ddfed3f1de1a9000fbfcaf18ad9fc8b
Workflow ref: main
Requested jobs: messaging-providers-e2e,channels-add-remove-e2e
Summary: 0 passed, 0 failed, 0 skipped

Job	Result
channels-add-remove-e2e	⚠️ cancelled
messaging-providers-e2e	⚠️ cancelled

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

github-actions · 2026-05-30T00:43:23Z

Selective E2E Results — ✅ All requested jobs passed

Run: 26669332308
Target ref: c08a458ccf970c0f35bb9ea4e5f2fd1809be573b
Workflow ref: main
Requested jobs: messaging-providers-e2e,channels-add-remove-e2e
Summary: 0 passed, 0 failed, 0 skipped

Job	Result
channels-add-remove-e2e	⚠️ cancelled
messaging-providers-e2e	⚠️ cancelled

github-actions · 2026-05-30T00:58:47Z

Selective E2E Results — ✅ All requested jobs passed

Run: 26669565696
Target ref: fb394dd95129022d0835ce024c2f4573db74bc1f
Workflow ref: main
Requested jobs: messaging-providers-e2e,channels-add-remove-e2e,messaging-compatible-endpoint-e2e
Summary: 3 passed, 0 failed, 0 skipped

Job	Result
channels-add-remove-e2e	✅ success
messaging-compatible-endpoint-e2e	✅ success
messaging-providers-e2e	✅ success

## Summary - Adds the v0.0.56 release notes section with links to the deeper docs pages for installer, status, inference, messaging, policy, and lifecycle changes. - Updates source docs for the remaining release-prep gaps around `uv` in the PyPI preset, compact WhatsApp pairing guidance, and `nemoclaw inference set` command boundaries. - Refreshes generated `nemoclaw-user-*` skills and removes skipped experimental command terms from generated skill surfaces. ## Source summary - #4613 -> `docs/manage-sandboxes/lifecycle.mdx`, `docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Documents that public installs and `nemoclaw update` follow the maintained `lkg` tag by default. - #4419 -> `docs/about/release-notes.mdx`: Notes that non-interactive Linux installs can reactivate Docker group membership and continue in one installer run when `sg docker` is available. - #4550 -> `docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Captures live sandbox agent-version probing for status, connect, and upgrade checks. - #4609 -> `docs/inference/use-local-inference.mdx`, `docs/about/release-notes.mdx`: Captures the GPU Docker-driver host-network local-inference reachability gate. - #4607 -> `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Documents compact WhatsApp QR pairing guidance and gateway/session diagnostics. - #4582 -> `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Reflects Slack credential validation before enabling the channel. - #4554 -> `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/troubleshooting.mdx`, `docs/about/release-notes.mdx`: Keeps Telegram allowlist alias guidance in the generated user skills and release notes. - #4563 -> `docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Includes the new `nemoclaw <name> skill remove <skill>` command in command docs and release notes. - #4566 -> `docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Documents the `nemoclaw inference set` redirect boundary when `--provider` or `--model` is missing. - #4323 -> `docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Captures per-sandbox status JSON support. - #4506 -> `docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Captures debug command sandbox-name validation and safer tarball writing. - #4569 -> `docs/network-policy/integration-policy-examples.mdx`, `docs/about/release-notes.mdx`: Documents that the `pypi` preset allows `/usr/local/bin/uv`. - #4579 -> `docs/network-policy/integration-policy-examples.mdx`, `docs/about/release-notes.mdx`: Captures observable Jira preset validation guidance. - #4229 -> `docs/manage-sandboxes/lifecycle.mdx`, `docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Documents user-data preservation defaults for uninstall. - #4399 -> `docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Captures CPU-only sandbox intent preservation across rebuilds. - #4058 -> `docs/reference/commands.mdx`, `docs/about/release-notes.mdx`: Captures safer snapshot restore behavior around existing destinations. - #4155 and #4460 -> skipped by `docs/.docs-skip`: Removed skipped experimental command terms from source docs and generated skill evals instead of documenting those features. ## Verification - `python3 scripts/docs-to-skills.py docs/ .agents/skills/ --prefix nemoclaw-user --doc-platform fern-mdx` - `npm run docs` (passes; Fern reports the pre-existing light-mode accent contrast warning) - `rg "permissive mode|shields down|shields up|shields status|config rotate-token|rotate-token" .agents/skills` (no matches) - `npm run build:cli` (run to refresh local CLI artifacts for the pre-push TypeScript hook) - Commit hooks passed, including `NEMOCLAW_* env-var documentation gate`, `Verify docs-to-skills output`, `markdownlint-cli2`, `gitleaks`, and `Test (skills YAML)`.  ## Summary by CodeRabbit * **Documentation** * Expanded Model Router setup with YAML examples, flow diagrams, and credential handling; strengthened agent-config immutability and integrity guidance; messaging channels updated (Telegram aliases, WhatsApp pairing/diagnostics); CLI docs revised (GPU detection, inference set behavior, uninstall/rebuild preservation); overview rebranded to NemoClaw and added v0.0.56 release notes. * **New Features** * Added `nemoclaw <name> channels status` (messaging diagnostics, JSON); added `nemoclaw <name> skill remove`; Hermes no longer marked experimental; DGX Spark quickstart sandbox-name note.

## Summary Updates LangChain Deep Agents Code from 0.1.34 to 0.1.55 using the sealed NemoPin migration evidence. The implementation and requested-review fixes are complete; the PR is ready for maintainer re-review.  ## Related Issue No issue closure is claimed.  ## Changes\n\n- Keeps the dependency migration scoped to LangChain Deep Agents Code and its onboarding, validation, documentation, and managed-image checks.\n- Migrates the exact base `5bb69ed66947fbd2fab6133748866567eb520692` across 21 adjacent release ranges.\n- Changed paths: `.github/workflows/managed-images.yaml`, `agents/langchain-deepagents-code/Dockerfile`, `agents/langchain-deepagents-code/Dockerfile.base`, `agents/langchain-deepagents-code/dcode-wrapper.sh`, `agents/langchain-deepagents-code/dependency-review.md`, `agents/langchain-deepagents-code/manifest.yaml`, `agents/langchain-deepagents-code/patch-managed-deepagents-code.py`, `agents/langchain-deepagents-code/profile-plugin/pyproject.toml`, `agents/langchain-deepagents-code/profile-plugin/src/nemoclaw_deepagents_profile/__init__.py`, `agents/langchain-deepagents-code/progressive_tool_disclosure.py`, `agents/langchain-deepagents-code/requirements.in`, `agents/langchain-deepagents-code/requirements.lock`, `agents/langchain-deepagents-code/start.sh`, `agents/langchain-deepagents-code/validate-nemotron-ultra-profile.py`, `agents/langchain-deepagents-code/validate-observability.py`, `agents/langchain-deepagents-code/validate-progressive-tool-disclosure.py`, `docs/deployment/set-up-mcp-bridge.mdx`, `docs/get-started/quickstart-langchain-deepagents-code.mdx`, `src/lib/actions/sandbox/rebuild-flow-helpers.test.ts`, `src/lib/agent/base-image.test.ts`, `src/lib/agent/deep-agents-code-base-image.test.ts`, `src/lib/agent/onboard-terminal-fixtures.test.ts`, `src/lib/agent/onboard-terminal-fixtures.ts`, `src/lib/agent/onboard-terminal.test.ts`, `src/lib/inference/onboard-probes.test.ts`, `src/lib/inference/onboard-probes.ts`, `src/lib/inference/openai-validation-session.ts`, `src/lib/onboard.ts`, `src/lib/onboard/created-sandbox-finalization.test.ts`, `src/lib/onboard/created-sandbox-finalization.ts`, `src/lib/onboard/dcode-selection-drift.test.ts`, `src/lib/onboard/dcode-selection-drift.ts`, `src/lib/onboard/inference-selection-validation.test.ts`, `src/lib/onboard/machine/handlers/sandbox-checkpoint-crash-recovery.test.ts`, `src/lib/onboard/machine/handlers/sandbox.ts`, `src/lib/onboard/sandbox-lifecycle.test.ts`, `src/lib/onboard/sandbox-lifecycle.ts`, `src/lib/sandbox-base-image-agent-resolution.test.ts`, `src/lib/sandbox-base-image-release-resolution.test.ts`, `src/lib/sandbox-base-image/resolution-key.test.ts`, `test/Dockerfile.dcode-profile-missing-dependencies`, `test/cli/connect-terminal-agent.test.ts`, `test/deepagents-code-tui-startup-check.test.ts`, `test/e2e/e2e-cloud-experimental/checks/03-deepagents-code-nemotron-ultra-profile.sh`, `test/e2e/e2e-cloud-experimental/checks/04-deepagents-code-fresh-reonboard.sh`, `test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh`, `test/e2e/e2e-cloud-experimental/checks/12-deepagents-code-thread-auto-approval.sh`, `test/e2e/lib/select-authorized-chat-model.mts`, `test/e2e/live/mcp-bridge-servers.ts`, `test/e2e/support/authorized-chat-model-selection.test.ts`, `test/fixtures/deepagents-progressive-disclosure-harness.py`, `test/fixtures/langchain-deepagents-code/server.py`, `test/helpers/langchain-deepagents-code-patch-fixture.ts`, `test/helpers/managed-image-buildless-e2e.ts`, `test/issue-5667-hosted-inference-model-namespace.test.ts`, `test/langchain-deepagents-code-direct-module-patch.test.ts`, `test/langchain-deepagents-code-image.test.ts`, `test/langchain-deepagents-code-nemotron-profile-plugin.test.ts`, `test/langchain-deepagents-code-progressive-tool-disclosure.test.ts`, `test/managed-image-publication-workflow.test.ts`, `test/managed-image-staging-qa-workflow.test.ts`, `test/mcp-bridge-servers.test.ts`, `test/onboard-mcp-observability-redirect.test.ts`, `test/onboard-prepared-build-context.test.ts`, `test/onboard-terminal-dashboard.test.ts`\n\n### Release ranges | Range | Commits | State | Concerns | |---|---|---|---| | 0.1.34 → 0.1.35 | `bd9bafaad3f5` → `09daab5772ff` | published | 1 | | 0.1.35 → 0.1.36 | `09daab5772ff` → `2f56309d821d` | published | 1 | | 0.1.36 → 0.1.37 | `2f56309d821d` → `def6369aed1a` | published | 2 | | 0.1.37 → 0.1.38 | `def6369aed1a` → `4338671aa1d9` | published | 4 | | 0.1.38 → 0.1.39 | `4338671aa1d9` → `8eb909a59b82` | published | 1 | | 0.1.39 → 0.1.40 | `8eb909a59b82` → `019489edb9c0` | published | 6 | | 0.1.40 → 0.1.41 | `019489edb9c0` → `d46a2cb033b8` | published | 4 | | 0.1.41 → 0.1.42 | `d46a2cb033b8` → `18679a1a88a3` | published | 3 | | 0.1.42 → 0.1.43 | `18679a1a88a3` → `e14e0adcbe78` | published | 2 | | 0.1.43 → 0.1.44 | `e14e0adcbe78` → `2b9cd08f0492` | published | 5 | | 0.1.44 → 0.1.45 | `2b9cd08f0492` → `7794b61a6e76` | published | 4 | | 0.1.45 → 0.1.46 | `7794b61a6e76` → `efa86c51fedd` | published | 1 | | 0.1.46 → 0.1.47 | `efa86c51fedd` → `8aa29ddc2833` | published | 3 | | 0.1.47 → 0.1.48 | `8aa29ddc2833` → `803b8329db7d` | published | 3 | | 0.1.48 → 0.1.49 | `803b8329db7d` → `44910bc2ef3f` | published | 0 | | 0.1.49 → 0.1.50 | `44910bc2ef3f` → `63adb9645687` | published | 2 | | 0.1.50 → 0.1.51 | `63adb9645687` → `d2b663fca277` | published | 0 | | 0.1.51 → 0.1.52 | `d2b663fca277` → `b428644d31dd` | published | 3 | | 0.1.52 → 0.1.53 | `b428644d31dd` → `0bd15dc0e1c5` | published | 2 | | 0.1.53 → 0.1.54 | `0bd15dc0e1c5` → `81258067f4c7` | published | 0 | | 0.1.54 → 0.1.55 | `81258067f4c7` → `80fe3d3cbcd2` | published | 9 | ### Concern dispositions | Concern | Surface | Planned disposition | Failure prevented | Remaining gate | |---|---|---|---|---| | `langchain-deep-agents-code-0.1.34..0.1.35-lifecycle-state-1` | lifecycle state | test | 0.1.55 reports lifecycle state: ### Features - Added a `/context` usage report for inspecting context consumption ([#5407](langchain-ai/deepagents#5407... | none | | `langchain-deep-agents-code-0.1.35..0.1.36-lifecycle-state-1` | lifecycle state | test | 0.1.54 reports lifecycle state: ### Features - Added Meta `muse-spark-1.2` to the model switcher ([#5389](langchain-ai/deepagents#5389)). - Improved di... | none | | `langchain-deep-agents-code-0.1.36..0.1.37-lifecycle-state-1` | lifecycle state | test | 0.1.53 reports lifecycle state: ### Features - Added pricing coverage with Baseten built-in overrides and local fallback overrides when `genai-prices` is missing data ([#5312](h... | none | | `langchain-deep-agents-code-0.1.36..0.1.37-runtime-topology-2` | runtime topology | test | 0.1.53 reports runtime topology: ### Features - Added pricing coverage with Baseten built-in overrides and local fallback overrides when `genai-prices` is missing data ([#5312](... | none | | `langchain-deep-agents-code-0.1.37..0.1.38-compatibility-change-1` | compatibility change | test | 0.1.52 reports compatibility change: ### Features - Hooks v2 is now generally available, with support for loading hooks from installed plugins. ([#5307](https://github.com/langc... | none | | `langchain-deep-agents-code-0.1.37..0.1.38-configuration-2` | configuration | test | 0.1.52 reports configuration: ### Features - Hooks v2 is now generally available, with support for loading hooks from installed plugins. ([#5307](https://github.com/langchain-ai... | none | | `langchain-deep-agents-code-0.1.37..0.1.38-execution-control-3` | execution control | guard | 0.1.52 reports execution control: ### Features - Hooks v2 is now generally available, with support for loading hooks from installed plugins. ([#5307](https://github.com/langchai... | none | | `langchain-deep-agents-code-0.1.37..0.1.38-lifecycle-state-4` | lifecycle state | test | 0.1.52 reports lifecycle state: ### Features - Hooks v2 is now generally available, with support for loading hooks from installed plugins. ([#5307](https://github.com/langchain-... | none | | `langchain-deep-agents-code-0.1.38..0.1.39-configuration-1` | configuration | test | 0.1.51 reports configuration: ### Features - The status bar and usage view now show the running session cost. ([#5036](langchain-ai/deepagents#5036)) -... | none | | `langchain-deep-agents-code-0.1.39..0.1.40-compatibility-change-1` | compatibility change | test | 0.1.50 reports compatibility change: ### Highlights - Added project hooks workspace trust and expanded Hooks v2 support with client and server lifecycle events plus runtime feed... | none | | `langchain-deep-agents-code-0.1.39..0.1.40-execution-control-2` | execution control | guard | 0.1.50 reports execution control: ### Highlights - Added project hooks workspace trust and expanded Hooks v2 support with client and server lifecycle events plus runtime feedbac... | none | | `langchain-deep-agents-code-0.1.39..0.1.40-lifecycle-state-3` | lifecycle state | test | 0.1.50 reports lifecycle state: ### Highlights - Added project hooks workspace trust and expanded Hooks v2 support with client and server lifecycle events plus runtime feedback ... | none | | `langchain-deep-agents-code-0.1.39..0.1.40-packaging-artifact-4` | packaging artifact | test | 0.1.50 reports packaging artifact: ### Highlights - Added project hooks workspace trust and expanded Hooks v2 support with client and server lifecycle events plus runtime feedba... | none | | `langchain-deep-agents-code-0.1.39..0.1.40-runtime-topology-5` | runtime topology | test | 0.1.50 reports runtime topology: ### Highlights - Added project hooks workspace trust and expanded Hooks v2 support with client and server lifecycle events plus runtime feedback... | none | | `langchain-deep-agents-code-0.1.39..0.1.40-security-identity-6` | security identity | guard | 0.1.50 reports security identity: ### Highlights - Added project hooks workspace trust and expanded Hooks v2 support with client and server lifecycle events plus runtime feedbac... | none | | `langchain-deep-agents-code-0.1.40..0.1.41-compatibility-change-1` | compatibility change | test | 0.1.49 reports compatibility change: ### Features - Added recognition for LangSmith Gateway credentials. ([#5042](langchain-ai/deepagents#5042)) - Adde... | none | | `langchain-deep-agents-code-0.1.40..0.1.41-execution-control-2` | execution control | guard | 0.1.49 reports execution control: ### Features - Added recognition for LangSmith Gateway credentials. ([#5042](langchain-ai/deepagents#5042)) - Added s... | none | | `langchain-deep-agents-code-0.1.40..0.1.41-lifecycle-state-3` | lifecycle state | test | 0.1.49 reports lifecycle state: ### Features - Added recognition for LangSmith Gateway credentials. ([#5042](langchain-ai/deepagents#5042)) - Added sla... | none | | `langchain-deep-agents-code-0.1.40..0.1.41-runtime-topology-4` | runtime topology | test | 0.1.49 reports runtime topology: ### Features - Added recognition for LangSmith Gateway credentials. ([#5042](langchain-ai/deepagents#5042)) - Added sl... | none | | `langchain-deep-agents-code-0.1.41..0.1.42-compatibility-change-1` | compatibility change | test | 0.1.48 reports compatibility change: ### Features - Added Fireworks `kimi-k3`, GLM-5.2-Fast, and Kimi-K3 to model selection and recommended models. ([#5082](https://github.com/l... | none | | `langchain-deep-agents-code-0.1.41..0.1.42-execution-control-2` | execution control | guard | 0.1.48 reports execution control: ### Features - Added Fireworks `kimi-k3`, GLM-5.2-Fast, and Kimi-K3 to model selection and recommended models. ([#5082](https://github.com/lang... | none | | `langchain-deep-agents-code-0.1.41..0.1.42-lifecycle-state-3` | lifecycle state | test | 0.1.48 reports lifecycle state: ### Features - Added Fireworks `kimi-k3`, GLM-5.2-Fast, and Kimi-K3 to model selection and recommended models. ([#5082](https://github.com/langch... | none | | `langchain-deep-agents-code-0.1.42..0.1.43-compatibility-change-1` | compatibility change | test | 0.1.47 reports compatibility change: ### Features - Added `yolo` mode to the `Shift+Tab` approval cycle ([#5035](langchain-ai/deepagents#5035)). - Show... | none | | `langchain-deep-agents-code-0.1.42..0.1.43-execution-control-2` | execution control | guard | 0.1.47 reports execution control: ### Features - Added `yolo` mode to the `Shift+Tab` approval cycle ([#5035](langchain-ai/deepagents#5035)). - Show th... | none | | `langchain-deep-agents-code-0.1.43..0.1.44-compatibility-change-1` | compatibility change | test | 0.1.46 reports compatibility change: ### Highlights - Auto mode is now generally available. [#4957](langchain-ai/deepagents#4957) - Added configurable ... | none | | `langchain-deep-agents-code-0.1.43..0.1.44-configuration-2` | configuration | test | 0.1.46 reports configuration: ### Highlights - Auto mode is now generally available. [#4957](langchain-ai/deepagents#4957) - Added configurable Auto go... | none | | `langchain-deep-agents-code-0.1.43..0.1.44-execution-control-3` | execution control | guard | 0.1.46 reports execution control: ### Highlights - Auto mode is now generally available. [#4957](langchain-ai/deepagents#4957) - Added configurable Aut... | none | | `langchain-deep-agents-code-0.1.43..0.1.44-protocol-schema-4` | protocol schema | test | 0.1.46 reports protocol schema: ### Highlights - Auto mode is now generally available. [#4957](langchain-ai/deepagents#4957) - Added configurable Auto ... | none | | `langchain-deep-agents-code-0.1.43..0.1.44-security-identity-5` | security identity | guard | 0.1.46 reports security identity: ### Highlights - Auto mode is now generally available. [#4957](langchain-ai/deepagents#4957) - Added configurable Aut... | none | | `langchain-deep-agents-code-0.1.44..0.1.45-compatibility-change-1` | compatibility change | test | 0.1.45 reports compatibility change: ### Features - Added the Hooks v2 execution engine and typed hooks data models ([#4880](langchain-ai/deepagents#48... | none | | `langchain-deep-agents-code-0.1.44..0.1.45-execution-control-2` | execution control | guard | 0.1.45 reports execution control: ### Features - Added the Hooks v2 execution engine and typed hooks data models ([#4880](langchain-ai/deepagents#4880)... | none | | `langchain-deep-agents-code-0.1.44..0.1.45-lifecycle-state-3` | lifecycle state | test | 0.1.45 reports lifecycle state: ### Features - Added the Hooks v2 execution engine and typed hooks data models ([#4880](langchain-ai/deepagents#4880), ... | none | | `langchain-deep-agents-code-0.1.44..0.1.45-packaging-artifact-4` | packaging artifact | test | 0.1.45 reports packaging artifact: ### Features - Added the Hooks v2 execution engine and typed hooks data models ([#4880](langchain-ai/deepagents#4880... | none | | `langchain-deep-agents-code-0.1.45..0.1.46-runtime-topology-1` | runtime topology | test | 0.1.44 reports runtime topology: ### Bug Fixes - Improved approval handling by hiding the `Auto` option when it isn't eligible and moving Auto mode path checks off the event loo... | none | | `langchain-deep-agents-code-0.1.46..0.1.47-compatibility-change-1` | compatibility change | test | 0.1.43 reports compatibility change: ### Features - Added classifier-backed Auto approval mode behind `DEEPAGENTS_CODE_EXPERIMENTAL=1` ([#4804](https://github.com/langchain-ai/d... | none | | `langchain-deep-agents-code-0.1.46..0.1.47-execution-control-2` | execution control | guard | 0.1.43 reports execution control: ### Features - Added classifier-backed Auto approval mode behind `DEEPAGENTS_CODE_EXPERIMENTAL=1` ([#4804](https://github.com/langchain-ai/deep... | none | | `langchain-deep-agents-code-0.1.46..0.1.47-lifecycle-state-3` | lifecycle state | test | 0.1.43 reports lifecycle state: ### Features - Added classifier-backed Auto approval mode behind `DEEPAGENTS_CODE_EXPERIMENTAL=1` ([#4804](https://github.com/langchain-ai/deepag... | none | | `langchain-deep-agents-code-0.1.47..0.1.48-compatibility-change-1` | compatibility change | test | 0.1.42 reports compatibility change: ### Features - Plugins are now generally available. ([#4797](langchain-ai/deepagents#4797)) - Added search to the ... | none | | `langchain-deep-agents-code-0.1.47..0.1.48-execution-control-2` | execution control | guard | 0.1.42 reports execution control: ### Features - Plugins are now generally available. ([#4797](langchain-ai/deepagents#4797)) - Added search to the plu... | none | | `langchain-deep-agents-code-0.1.47..0.1.48-lifecycle-state-3` | lifecycle state | test | 0.1.42 reports lifecycle state: ### Features - Plugins are now generally available. ([#4797](langchain-ai/deepagents#4797)) - Added search to the plugi... | none | | `langchain-deep-agents-code-0.1.49..0.1.50-compatibility-change-1` | compatibility change | test | 0.1.40 reports compatibility change: ### Features - Added plugin marketplace support ([#4554](langchain-ai/deepagents#4554)). - Added an “always allow”... | none | | `langchain-deep-agents-code-0.1.49..0.1.50-execution-control-2` | execution control | guard | 0.1.40 reports execution control: ### Features - Added plugin marketplace support ([#4554](langchain-ai/deepagents#4554)). - Added an “always allow” op... | none | | `langchain-deep-agents-code-0.1.51..0.1.52-compatibility-change-1` | compatibility change | test | 0.1.38 reports compatibility change: ### Features * Improve `/goal` criteria UX ([#4694](langchain-ai/deepagents#4694)) ([06f46ff](https://github.com/l... | none | | `langchain-deep-agents-code-0.1.51..0.1.52-configuration-2` | configuration | test | 0.1.38 reports configuration: ### Features * Improve `/goal` criteria UX ([#4694](langchain-ai/deepagents#4694)) ([06f46ff](https://github.com/langchai... | none | | `langchain-deep-agents-code-0.1.51..0.1.52-lifecycle-state-3` | lifecycle state | test | 0.1.38 reports lifecycle state: ### Features * Improve `/goal` criteria UX ([#4694](langchain-ai/deepagents#4694)) ([06f46ff](https://github.com/langch... | none | | `langchain-deep-agents-code-0.1.52..0.1.53-configuration-1` | configuration | test | 0.1.37 reports configuration: ### Features * Add Meta model provider ([#4650](langchain-ai/deepagents#4650)) ([70829c5](https://github.com/langchain-ai... | none | | `langchain-deep-agents-code-0.1.52..0.1.53-security-identity-2` | security identity | guard | 0.1.37 reports security identity: ### Features * Add Meta model provider ([#4650](langchain-ai/deepagents#4650)) ([70829c5](https://github.com/langchai... | none | | `langchain-deep-agents-code-0.1.54..0.1.55-compatibility-change-1` | compatibility change | test | 0.1.35 reports compatibility change: ### Features * Restore interrupted prompt to input on ESC ([#4544](langchain-ai/deepagents#4544)) ([fccf037](https... | none | | `langchain-deep-agents-code-0.1.54..0.1.55-configuration-2` | configuration | test | 0.1.35 reports configuration: ### Features * Restore interrupted prompt to input on ESC ([#4544](langchain-ai/deepagents#4544)) ([fccf037](https://gith... | none | | `langchain-deep-agents-code-0.1.54..0.1.55-execution-control-3` | execution control | guard | 0.1.35 reports execution control: ### Features * Restore interrupted prompt to input on ESC ([#4544](langchain-ai/deepagents#4544)) ([fccf037](https://... | none | | `langchain-deep-agents-code-0.1.54..0.1.55-lifecycle-state-4` | lifecycle state | test | 0.1.35 reports lifecycle state: ### Features * Restore interrupted prompt to input on ESC ([#4544](langchain-ai/deepagents#4544)) ([fccf037](https://gi... | none | | `langchain-deep-agents-code-0.1.54..0.1.55-protocol-schema-5` | protocol schema | test | 0.1.35 reports protocol schema: ### Features * Restore interrupted prompt to input on ESC ([#4544](langchain-ai/deepagents#4544)) ([fccf037](https://gi... | none | | `langchain-deep-agents-code-0.1.54..0.1.55-code-impact-configuration-1` | mapped configuration | test | The exact-ref diff reports configuration changes in .pre-commit-config.yaml, libs/acp/deepagents_acp/server.py, libs/acp/tests/test_agent.py. Mapped NemoClaw examples: src/lib/a... | none | | `langchain-deep-agents-code-0.1.54..0.1.55-code-impact-contract-or-schema-2` | mapped contract or schema | test | The exact-ref diff reports contract or schema changes in libs/acp/deepagents_acp/_version.py, libs/acp/deepagents_acp/server.py, libs/code/deepagents_code/_ask_user_types.py. Ma... | none | | `langchain-deep-agents-code-0.1.54..0.1.55-code-impact-security-3` | mapped security | test | The exact-ref diff reports security changes in libs/code/deepagents_code/_cli_context.py, libs/code/deepagents_code/_env_vars.py, libs/code/deepagents_code/_repository_bounds.py... | none | | `langchain-deep-agents-code-0.1.54..0.1.55-code-impact-test-4` | mapped test | test | The exact-ref diff reports test changes in libs/acp/tests/chat_model.py, libs/acp/tests/test_agent.py, libs/code/tests/integration_tests/benchmarks/test_local_context_benchmarks... | none | ### Immutable artifacts | Artifact | SHA-256 | |---|---| | deepagents_code-0.1.55-py3-none-any.whl | `3a0d3e332f132d0e…` | | deepagents_code-0.1.55.tar.gz | `91c30b62cb96d5e8…` | ### Validation receipt | Gate | Current result | |---|---| | targeted | Pass — 130 affected local tests, commit hooks, growth guardrails, and pre-push typechecks passed on the unchanged PR patch now at `78268b19e` | | full-e2e | In progress on the latest PR commit — all required checks pass; three non-required managed-image jobs are still running |  ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — CodeRabbit completed successfully on the unchanged PR patch and all inline review threads are resolved; human re-review remains requested. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/deployment/set-up-mcp-bridge.mdx` and `docs/get-started/quickstart-langchain-deepagents-code.mdx` accurately document the changed Deep Agents Code behavior and versions. The documented deepagents-code 0.1.55 and deepagents 0.7.5 versions match the manifest, inputs, lockfile, and profile plugin. `npm run docs` passed with 0 errors and two pre-existing Fern warnings. - Agent: Codex Desktop   ## DGX Station Hardware Evidence  - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification  - [x] PR description includes a `Signed-off-by:` line and all 81 commits appear as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed on the unchanged PR patch now at `78268b19e` - [x] Targeted behavior tests pass for the current change set — affected local suites: 130/130; growth guardrails passed - [ ] Applicable broad gate passed — all required GitHub checks pass; non-required managed-image validation is still in progress - [x] Quality Gates section completed with required justifications - [x] No secrets, API keys, or credentials committed; gitleaks passed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) ---  Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>  ## NemoPatch latest PR commit status - Status: **ready for maintainer re-review** - Latest PR commit: `78268b19e8229ffbc2a0591ad310caf96aab7fa6` - Checked: 2026-08-19T19:39:34Z - Merge: GitHub reports **MERGEABLE**; the local patch check against current `upstream/main` is clean. - Review: all 8 inline review threads are resolved and no new review finding was posted for the unchanged patch. Human approval remains required. - CI: all required checks pass. Three broader non-required managed-image jobs are still running with no deterministic failure at this check. - External advisor infrastructure: GPT-5.6 Terra and Nemotron 3 Ultra failed with `investigate omitted required analysis`; the trusted publisher reports 0 blockers, 0 warnings, 0 suggestions, and no follow-up needed.   ## Summary by CodeRabbit * **New Features** * Upgraded Deep Agents Code support to 0.1.55 and Deep Agents to 0.7.5. * Expanded approval controls with manual, automatic, startup, and YOLO modes. * Tool search and discovery now include registered tools across agents and subagents. * Added gateway-aware sandbox operations and authorized chat-model selection during onboarding. * **Bug Fixes** * Improved sandbox crash recovery and identity detection. * Strengthened MCP result validation and protected private inference endpoints. * **Documentation** * Updated setup and quickstart guidance for supported versions.  --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Signed-off-by: Prekshiv <prekshiv@nvidia.com>

fix(telegram): honor DM allowlist aliases

66be908

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa added bug integration: openclaw OpenClaw integration behavior NV QA Bugs found by the NVIDIA QA Team nightly-e2e Nightly E2E test failures labels May 30, 2026

ericksoa self-assigned this May 30, 2026

coderabbitai Bot reviewed May 30, 2026

View reviewed changes

Comment thread nemoclaw-blueprint/scripts/telegram-diagnostics.js Outdated

Comment thread src/lib/actions/sandbox/policy-channel.ts Outdated

fix(telegram): tighten allowlist diagnostics

fdec626

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

test(telegram): add inbound reply validation surface

c08a458

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

style(e2e): format telegram inbound probe

fb394dd

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

cv approved these changes May 30, 2026

View reviewed changes

cv merged commit 0f91681 into main May 30, 2026
36 checks passed

cv deleted the fix/telegram-allowed-id-aliases branch May 30, 2026 01:09

coderabbitai Bot mentioned this pull request May 30, 2026

docs: fill manage sandbox command gaps (Fixes #3680) #4338

Closed

coderabbitai Bot mentioned this pull request May 30, 2026

fix(e2e): unconditionally skip Telegram reachability probe for fake-token tests #4555

Merged

5 tasks

miyoungc mentioned this pull request Jun 1, 2026

docs: refresh 0.0.56 release documentation #4618

Merged

cv mentioned this pull request Jun 5, 2026

[Ubuntu 24.04][Onboard] WeChat plugin (openclaw-weixin) absent from openclaw.json after non-interactive onboard — regression of 6222825 #4826

Closed

wscurran removed bug needs: review PR is conflict-free and awaiting maintainer review nightly-e2e Nightly E2E test failures feature PR adds or expands user-visible functionality labels Jun 8, 2026

Uh oh!

Conversation

ericksoa commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Problem

Live Inbound Validation Surface

Verification

Nightly E2E

Uh oh!

coderabbitai Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented May 30, 2026

Uh oh!

github-actions Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Advisor Recommendation

E2E Recommendation Advisor

Required E2E

Optional E2E

New E2E recommendations

Dispatch hint

Uh oh!

github-actions Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Scenario Advisor Recommendation

E2E Scenario Advisor

Required scenario E2E

Optional scenario E2E

Relevant changed files

Uh oh!

github-actions Bot commented May 30, 2026

Selective E2E Results — ✅ All requested jobs passed

Uh oh!

github-actions Bot commented May 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor

🛠️ Needs attention

🔎 Worth checking

🌱 Nice ideas

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented May 30, 2026

Selective E2E Results — ✅ All requested jobs passed

Uh oh!

github-actions Bot commented May 30, 2026

Selective E2E Results — ✅ All requested jobs passed

Uh oh!

github-actions Bot commented May 30, 2026

Selective E2E Results — ✅ All requested jobs passed

Uh oh!

github-actions Bot commented May 30, 2026

Selective E2E Results — ✅ All requested jobs passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ericksoa commented May 30, 2026 •

edited

Loading

coderabbitai Bot commented May 30, 2026 •

edited

Loading

github-actions Bot commented May 30, 2026 •

edited

Loading

github-actions Bot commented May 30, 2026 •

edited

Loading

github-actions Bot commented May 30, 2026 •

edited

Loading