fix(hermes): install safety-net + ciao NODE_OPTIONS preloads so recover can relaunch - #5416
Closed
hizrianraz wants to merge 4 commits into
Closed
fix(hermes): install safety-net + ciao NODE_OPTIONS preloads so recover can relaunch#5416hizrianraz wants to merge 4 commits into
hizrianraz wants to merge 4 commits into
Conversation
Contributor
📝 WalkthroughWalkthroughAdds Hermes Node guard staging in ChangesHermes Node Preload Guard Installation and Runtime Env Wiring
Estimated code review effort: 3 (Moderate) | ~20 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@agents/hermes/start.sh`:
- Around line 767-770: Remove the sandbox path
`/sandbox/.nemoclaw/blueprints/*/scripts` from the default search list in the
NEMOCLAW_GUARD_DIRS parameter expansion. The for loop iterating over _gd should
only default to image-owned preload directories
(`/opt/nemoclaw-blueprint/scripts` and `/usr/local/lib/nemoclaw/preloads`) when
NEMOCLAW_GUARD_DIRS is not explicitly set, allowing users to add sandbox paths
only through explicit environment variable overrides for test/dev purposes
rather than by default.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fdeffcd8-d465-4534-8380-0d54923f18db
📒 Files selected for processing (1)
agents/hermes/start.sh
…er can relaunch
The OpenClaw entrypoint (scripts/nemoclaw-start.sh) installs the
sandbox-safety-net and ciao-network-guard NODE_OPTIONS preloads, but the
Hermes entrypoint (agents/hermes/start.sh) did not. The gateway-recovery path
refuses to relaunch unless NODE_OPTIONS advertises both guards ("proxy-env
present but NODE_OPTIONS missing safety-net preload or ciao preload - refusing
unguarded gateway relaunch"), so a stopped Hermes gateway can never be brought
back with `recover`. The ciao guard is also what prevents the @homebridge/ciao
networkInterfaces() crash (#2478) on Hermes sandboxes.
Port the guard install to the Hermes entrypoint. Hardened so a guard-install
failure can never abort the `set -euo pipefail` entrypoint (an unguarded version
left the gateway dead): the install runs as `... || true` (errexit suppressed
through the whole function), every fallible command sits inside an `if`, all
vars are `${x:-}`-safe, and a guard is only added to NODE_OPTIONS once its /tmp
copy exists and is non-empty. Worst case it warns and the gateway still starts.
The guards are also re-exported into the sourced proxy-env so connect/recovery
sessions see them.
Signed-off-by: Hizrian Raz <hizrian@ainfera.ai>
hizrianraz
force-pushed
the
fix/hermes-recover-node-guards-2478
branch
from
June 14, 2026 16:09
0ccc925 to
8c9a3f7
Compare
Author
|
Thanks @coderabbitai — good catch. Removed the sandbox-writable |
Contributor
|
Tip For best results, initiate chat on the files or code changes.
(ᵔᴥᵔ)🐇 |
wscurran
added
bug-fix
Contributor
|
✨ Thanks for porting the Related open issues: |
Contributor
|
Thanks for this. Putting the guard install in the Hermes entrypoint is the right call, and it lines up with what we landed on in #5525. The #2478 side (loading the ciao guard at startup) looks good. I don't think recover works on Hermes yet though, even with this change. I built the Hermes image layers locally and there's no That's the catch. The recover code from #5321 only reads guards from Adding the same COPY the OpenClaw image already has would fix it: in Easy to confirm on a built image: It would also be good to add a regression test. The advisor flagged the same gap on #5265, and the |
21 tasks
jyaunches
pushed a commit
that referenced
this pull request
Jun 30, 2026
<!-- markdownlint-disable MD041 --> ## Summary Adds a supported host-mediated `gateway restart` command for NemoClaw-managed OpenClaw and Hermes gateways and routes automatic recovery through the same topology-specific authenticated controller or supervisor path. The lifecycle acts only on proven process and listener identity, applies configuration and state changes transactionally, and fails closed when privileged execution or built-in health probes are ambiguous. ## Related Issue Fixes #2426 Fixes #5253 Supersedes #5416 ## Changes - Added `sandbox:gateway:restart` plus public `nemoclaw <name> gateway restart` and `nemohermes <name> gateway restart` routing while keeping healthy `recover` idempotent. - Added managed gateway control for both supported topologies: a root PID 1 request channel for direct-root entrypoints and an authenticated root-owned controller paired with the nonroot supervisor in OpenShell-managed sandboxes. - Enforced exact PID and process-start identity checks, listener ownership validation, post-stop absence proof, exact reaping or respawn proof, health waits, and port-forward recovery. - Added descriptor-based, no-follow, atomic configuration and state guards, including bounded Hermes secret-boundary and configuration-hash validation. - Serialized shields mutations and recovery timers, and ordered snapshot, destroy, and inference transitions so stale callbacks cannot reapply state. - Made built-in OpenClaw and Hermes probes fail closed after trusted execution failure or timeout; unsupported privileged-exec drivers and ambiguous container selection are rejected while explicit custom gateway agents retain their compatibility path. - Wired runtime helpers into optimized build contexts with root-owned, non-writable permissions and preserved root PID 1 access to mutable sandbox-group state when hardened runtimes drop `CAP_DAC_OVERRIDE`. - Published a Trusted Computing Base page in both guide variants covering the direct-root and OpenShell-managed boundaries, shared-UID and mutable-config limits, JSON5 read compatibility, root group membership, and compatibility-removal conditions. - Restricted managed-controller procfs and filesystem overrides to source execution with the explicit test flag, and verified the pinned Node/JSON5 installation is root-owned and non-writable. - Added final-image proof for both built-in images covering root-only helper modes, required supplementary groups, root probe access, and sandbox-user refusal; made sandbox-operations assertions topology-aware for direct-root and OpenShell-managed runs. - Excluded authenticated, exact-identity Hermes controller replacements from crash quarantine with a root-only `0600` lifecycle lock and root-owned `0444` authorization bound to the live root controller; all orphaned, mismatched, unexpected, and failed replacement exits still count. - Tightened the OpenClaw image health fallback to read the tracked PID start identity before and after an exact installed gateway command line, while retaining known rewritten process-title compatibility. - Preserved the injected managed supervisor through the post-restart settle probe and locked the built-in completion protocol to `GATEWAY_PID=` rather than accepting the legacy custom-script `ALREADY_RUNNING` marker. - Migrated the branch's live recovery coverage onto the typed E2E workflow and removed the legacy shell lanes deleted on `main`. - Updated lifecycle, runtime-control, command, troubleshooting, security, and Hermes documentation. - Review scope: the existing OpenShell bridge-host allowance is preserved while adjacent private or internal endpoint shapes are DNS-validated and rejected. Broad module splitting and consumer-wide HTTPS binding remain separate architecture work rather than widening this security-sensitive recovery fix. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent security review found no blocking findings across privilege, process identity, filesystem, network, fail-closed, and regression-coverage boundaries; human security acceptance remains pending and required before merge. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [x] New doc pages include SPDX header and frontmatter (new pages only) Exact-head evidence for `8dbe420d3d835546683cbfa67fec0537791ad7c1`: - Signed, DCO-compliant commit `d86c60c325a3dbc74fc42f74447bc00f89be4400` addresses the current CodeRabbit correctness and documentation findings. Signed merge commit `c9061c68fd82b1b73044383bc4e8962808644744` incorporates `main` at `e10462ff3e2e0727350a2532fc7bb7edc64116b2` without rebasing or rewriting the verified history. Signed cleanup commit `8dbe420d3d835546683cbfa67fec0537791ad7c1` addresses the resulting CodeQL/code-quality diagnostics. - Post-merge controller, trust-contract, provisioning, managed-exit authorization, OpenClaw/Hermes config-guard, state-dir guard, endpoint-security, restart/boundary, and workflow-boundary suites pass: 15 files, 258 tests. - `npm run build:cli`, `npm run typecheck:cli`, Biome, ShellCheck, Python compilation, branch diff checks, test-size/project/title guards, and `npm run docs:check-agent-variants` pass. - `npm run docs` completes with 0 errors and two existing Fern warnings; the warning-free checkbox remains unchecked. - All 80 PR commits appear as GitHub `Verified`; all three new commits contain the DCO sign-off declaration. - The review-fix commit's normal formatting, lint, repository, secret-scan, commitlint, source-shape, and test-size hooks pass. The normal pre-push CLI typecheck and version-sync hooks pass. The full local `test-cli` hook and full-`npm test` boxes remain unchecked; exact-head CI is required for those broader platform lanes. - Standard CI, automated current-head review, human security acceptance, and exact-head E2E evidence are pending on this head and must settle before merge. --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a `gateway restart` command for sandboxes with forced reload and post-restart health/forward verification. * **Bug Fixes** * Improved recovery so host forwards and supervised gateway processes are repaired more reliably. * Strengthened failure handling to be fail-closed when required Hermes secret-boundary validation or supervisor control is unavailable. * Corrected forward-health classification so stopped/occupied forwards are handled consistently. * **Documentation** * Expanded lifecycle, runtime-controls, command reference, and troubleshooting guidance for `recover`, `gateway restart`, shields windows, and Hermes recovery constraints. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
21 tasks
Signed-off-by: cjagwani <cjagwani@nvidia.com>
Signed-off-by: cjagwani <cjagwani@nvidia.com>
Collaborator
|
Maintainer salvage pushed at exact head
Local verification on Node 22:
Security disposition: no hardcoded secrets or new dependencies; sources are image-owned and no longer environment-selectable in production; staging remains atomic through |
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
agents/hermes/start.sh (1)
762-796: 🩺 Stability & Availability | 🔵 TrivialRun the Hermes recovery E2E lanes for this change.
This touches Hermes gateway recovery relaunch behavior. As per path instructions, changes here should exercise
hermes-e2e,hermes-inference-switch-e2e, andrebuild-hermes-e2e(and related lanes) before merge:gh workflow run nightly-e2e.yaml --ref <branch> -f jobs=hermes-e2e,hermes-inference-switch-e2e,hermes-discord-e2e,hermes-slack-e2e,hermes-onboard-security-posture-e2e,rebuild-hermes-e2e,rebuild-hermes-stale-base-e2e🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/hermes/start.sh` around lines 762 - 796, This change affects Hermes gateway recovery relaunch behavior, so validate it by running the recovery-focused E2E lanes before merging. Exercise the relevant workflows that cover install_nemoclaw_node_guards and related relaunch paths, including hermes-e2e, hermes-inference-switch-e2e, hermes-discord-e2e, hermes-slack-e2e, hermes-onboard-security-posture-e2e, rebuild-hermes-e2e, and rebuild-hermes-stale-base-e2e.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/hermes-node-guard-install.test.ts`:
- Line 51: Update the affected test titles in the `hermes-node-guard-install`
suite to follow the `**/*.test.ts` guideline by appending the local issue
reference suffix `(`#2478`)`. Specifically, adjust the `it(...)` descriptions in
the test cases covering the guard-preload and recovery-refusal behavior so they
remain behavior-oriented but end with the required `(`#2478`)` tag. Use the
existing test title strings in `hermes-node-guard-install.test.ts` as the unique
anchors for the change.
---
Nitpick comments:
In `@agents/hermes/start.sh`:
- Around line 762-796: This change affects Hermes gateway recovery relaunch
behavior, so validate it by running the recovery-focused E2E lanes before
merging. Exercise the relevant workflows that cover install_nemoclaw_node_guards
and related relaunch paths, including hermes-e2e, hermes-inference-switch-e2e,
hermes-discord-e2e, hermes-slack-e2e, hermes-onboard-security-posture-e2e,
rebuild-hermes-e2e, and rebuild-hermes-stale-base-e2e.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 014e17da-7305-4e33-98a8-be7497e61eaf
📒 Files selected for processing (3)
agents/hermes/Dockerfileagents/hermes/start.shtest/hermes-node-guard-install.test.ts
| } | ||
|
|
||
| describe("Hermes Node guard installation", () => { | ||
| it("stages both image-owned guards and exports them through NODE_OPTIONS", () => { |
Contributor
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add (#2478) suffix to test titles per guideline.
These tests directly cover the recovery-refusal / guard-preload behavior for issue #2478 (as referenced in the start.sh warning strings), but their titles lack the local issue-reference suffix required for **/*.test.ts files.
📝 Proposed fix
- it("stages both image-owned guards and exports them through NODE_OPTIONS", () => {
+ it("stages both image-owned guards and exports them through NODE_OPTIONS (`#2478`)", () => {
...
- it("keeps startup alive when guard staging fails", () => {
+ it("keeps startup alive when guard staging fails (`#2478`)", () => {
...
- it("keeps startup alive when the image guard directory is missing", () => {
+ it("keeps startup alive when the image guard directory is missing (`#2478`)", () => {As per coding guidelines, "**/*.test.ts: Write behavior-oriented test titles, and put local issue references in a final (#1234) suffix."
Also applies to: 68-68, 84-84
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/hermes-node-guard-install.test.ts` at line 51, Update the affected test
titles in the `hermes-node-guard-install` suite to follow the `**/*.test.ts`
guideline by appending the local issue reference suffix `(`#2478`)`. Specifically,
adjust the `it(...)` descriptions in the test cases covering the guard-preload
and recovery-refusal behavior so they remain behavior-oriented but end with the
required `(`#2478`)` tag. Use the existing test title strings in
`hermes-node-guard-install.test.ts` as the unique anchors for the change.
Source: Coding guidelines
Collaborator
|
Closed as superseded by #5874, which explicitly names this PR in its merged scope and landed the complete host-mediated OpenClaw/Hermes restart design. Current
Rebasing this branch would therefore retain only the |
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Adds a supported host-mediated `gateway restart` command for NemoClaw-managed OpenClaw and Hermes gateways and routes automatic recovery through the same topology-specific authenticated controller or supervisor path. The lifecycle acts only on proven process and listener identity, applies configuration and state changes transactionally, and fails closed when privileged execution or built-in health probes are ambiguous. ## Related Issue Fixes NVIDIA#2426 Fixes NVIDIA#5253 Supersedes NVIDIA#5416 ## Changes - Added `sandbox:gateway:restart` plus public `nemoclaw <name> gateway restart` and `nemohermes <name> gateway restart` routing while keeping healthy `recover` idempotent. - Added managed gateway control for both supported topologies: a root PID 1 request channel for direct-root entrypoints and an authenticated root-owned controller paired with the nonroot supervisor in OpenShell-managed sandboxes. - Enforced exact PID and process-start identity checks, listener ownership validation, post-stop absence proof, exact reaping or respawn proof, health waits, and port-forward recovery. - Added descriptor-based, no-follow, atomic configuration and state guards, including bounded Hermes secret-boundary and configuration-hash validation. - Serialized shields mutations and recovery timers, and ordered snapshot, destroy, and inference transitions so stale callbacks cannot reapply state. - Made built-in OpenClaw and Hermes probes fail closed after trusted execution failure or timeout; unsupported privileged-exec drivers and ambiguous container selection are rejected while explicit custom gateway agents retain their compatibility path. - Wired runtime helpers into optimized build contexts with root-owned, non-writable permissions and preserved root PID 1 access to mutable sandbox-group state when hardened runtimes drop `CAP_DAC_OVERRIDE`. - Published a Trusted Computing Base page in both guide variants covering the direct-root and OpenShell-managed boundaries, shared-UID and mutable-config limits, JSON5 read compatibility, root group membership, and compatibility-removal conditions. - Restricted managed-controller procfs and filesystem overrides to source execution with the explicit test flag, and verified the pinned Node/JSON5 installation is root-owned and non-writable. - Added final-image proof for both built-in images covering root-only helper modes, required supplementary groups, root probe access, and sandbox-user refusal; made sandbox-operations assertions topology-aware for direct-root and OpenShell-managed runs. - Excluded authenticated, exact-identity Hermes controller replacements from crash quarantine with a root-only `0600` lifecycle lock and root-owned `0444` authorization bound to the live root controller; all orphaned, mismatched, unexpected, and failed replacement exits still count. - Tightened the OpenClaw image health fallback to read the tracked PID start identity before and after an exact installed gateway command line, while retaining known rewritten process-title compatibility. - Preserved the injected managed supervisor through the post-restart settle probe and locked the built-in completion protocol to `GATEWAY_PID=` rather than accepting the legacy custom-script `ALREADY_RUNNING` marker. - Migrated the branch's live recovery coverage onto the typed E2E workflow and removed the legacy shell lanes deleted on `main`. - Updated lifecycle, runtime-control, command, troubleshooting, security, and Hermes documentation. - Review scope: the existing OpenShell bridge-host allowance is preserved while adjacent private or internal endpoint shapes are DNS-validated and rejected. Broad module splitting and consumer-wide HTTPS binding remain separate architecture work rather than widening this security-sensitive recovery fix. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent security review found no blocking findings across privilege, process identity, filesystem, network, fail-closed, and regression-coverage boundaries; human security acceptance remains pending and required before merge. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [x] New doc pages include SPDX header and frontmatter (new pages only) Exact-head evidence for `8dbe420d3d835546683cbfa67fec0537791ad7c1`: - Signed, DCO-compliant commit `d86c60c325a3dbc74fc42f74447bc00f89be4400` addresses the current CodeRabbit correctness and documentation findings. Signed merge commit `c9061c68fd82b1b73044383bc4e8962808644744` incorporates `main` at `e10462ff3e2e0727350a2532fc7bb7edc64116b2` without rebasing or rewriting the verified history. Signed cleanup commit `8dbe420d3d835546683cbfa67fec0537791ad7c1` addresses the resulting CodeQL/code-quality diagnostics. - Post-merge controller, trust-contract, provisioning, managed-exit authorization, OpenClaw/Hermes config-guard, state-dir guard, endpoint-security, restart/boundary, and workflow-boundary suites pass: 15 files, 258 tests. - `npm run build:cli`, `npm run typecheck:cli`, Biome, ShellCheck, Python compilation, branch diff checks, test-size/project/title guards, and `npm run docs:check-agent-variants` pass. - `npm run docs` completes with 0 errors and two existing Fern warnings; the warning-free checkbox remains unchecked. - All 80 PR commits appear as GitHub `Verified`; all three new commits contain the DCO sign-off declaration. - The review-fix commit's normal formatting, lint, repository, secret-scan, commitlint, source-shape, and test-size hooks pass. The normal pre-push CLI typecheck and version-sync hooks pass. The full local `test-cli` hook and full-`npm test` boxes remain unchecked; exact-head CI is required for those broader platform lanes. - Standard CI, automated current-head review, human security acceptance, and exact-head E2E evidence are pending on this head and must settle before merge. --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a `gateway restart` command for sandboxes with forced reload and post-restart health/forward verification. * **Bug Fixes** * Improved recovery so host forwards and supervised gateway processes are repaired more reliably. * Strengthened failure handling to be fail-closed when required Hermes secret-boundary validation or supervisor control is unavailable. * Corrected forward-health classification so stopped/occupied forwards are handled consistently. * **Documentation** * Expanded lifecycle, runtime-controls, command reference, and troubleshooting guidance for `recover`, `gateway restart`, shields windows, and Hermes recovery constraints. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Hermes entrypoint (
agents/hermes/start.sh) never installed thesandbox-safety-netandciao-network-guardNODE_OPTIONS preloads that the OpenClaw entrypoint (scripts/nemoclaw-start.sh) installs. As a result the gateway-recovery path refuses to relaunch a stopped Hermes gateway ("proxy-env present but NODE_OPTIONS missing safety-net preload or ciao preload — refusing unguarded gateway relaunch"), and the@homebridge/ciaonetworkInterfaces()crash (#2478) can hit Hermes sandboxes. This ports the guard install to the Hermes entrypoint, hardened so it can never abort the entrypoint.Related Issue
Relates to #2478 — the
ciao-network-guardpreload this ports to the Hermes entrypoint.Changes
agents/hermes/start.sh: addinstall_nemoclaw_node_guards()— copiessandbox-safety-net.js+ciao-network-guard.jsto/tmp/nemoclaw-*.jsand adds them toNODE_OPTIONS(mirrorsscripts/nemoclaw-start.sh, sourcing from the Hermes image's/opt/nemoclaw-blueprint/scripts)./tmp/nemoclaw-proxy-env.sh) so connect/recovery sessions see them — this is what satisfies the recovery guard-check.set -euo pipefailentrypoint: invoked… || true(errexit suppressed through the whole function), every fallible step inside anif, all vars${x:-}-safe, and a guard added toNODE_OPTIONSonly after its/tmpcopy exists and is non-empty ([ -s ]). Worst case it logs a warning and the gateway still starts.Type of Change
Verification
npx prek run --all-filespassesnpm testpassesnpm run docsbuilds without warnings (doc changes only)Signed-off-by: Hizrian Raz hizrian@ainfera.ai
Summary by CodeRabbit
Chores
NODE_OPTIONSpreload directives for both connect and recovery flows when guards are available.Tests