fix(sandbox/sessions): route export by agent kind - #5526
Merged
Conversation
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
📝 WalkthroughWalkthroughAdds Hermes-specific routing to ChangesHermes sessions export routing
Sequence Diagram(s)sequenceDiagram
participant CLI as sessions export CLI
participant registry as registry.getSandbox
participant sandbox as Sandbox (Hermes)
participant host as Host Filesystem
CLI->>registry: getSandbox(sandboxName)
registry-->>CLI: { agent: "hermes", ... }
CLI->>CLI: validate: reject --agent (non-hermes), --include-trajectory, --format tar
CLI->>sandbox: shell "umask 077 && mkdir -p /sandbox/.nemoclaw-staging && hermes sessions export > /sandbox/.nemoclaw-staging/sessions-export-hermes-<rand>.jsonl && chmod 600"
sandbox-->>CLI: exit 0
CLI->>sandbox: sandbox download to host staging
sandbox-->>host: JSONL file transferred
CLI->>host: chmod 600 and rename to final destination
CLI->>sandbox: rm -f /sandbox/.nemoclaw-staging/sessions-export-hermes-<rand>.jsonl (finally)
CLI-->>CLI: return { agent:"hermes", format:"jsonl", resolvedFiles:[...] }
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested labels
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-5526.docs.buildwithfern.com/nemoclaw |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
laitingsheng
added
integration: openclaw
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: None Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings Action checklist
Test follow-ups to resolve or justifyIf these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.
This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
docs/reference/commands.mdx (1)
1355-1361: ⚡ Quick winRemove decorative bold and rewrite the passive sentence in active voice.
Lines 1355 and 1360 use bold for routine section labels, and Line 1361 uses passive voice (“are refused”).
LLM pattern detected.As per coding guidelines, avoid unnecessary bold in prose (reserved for UI labels/real warnings) and require active voice in documentation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/commands.mdx` around lines 1355 - 1361, Remove the bold formatting from the section labels "OpenClaw sandbox" and "Hermes sandbox" on lines 1355 and 1360 respectively, as these are routine section headers and bold should be reserved only for UI labels and real warnings. Additionally, convert the passive voice construction "are refused" on line 1361 to active voice by rewriting it so that the subject (the system or command handler) actively performs the refusal action instead of the options being passively refused.Source: Coding guidelines
docs/reference/commands-nemohermes.mdx (1)
1099-1099: ⚡ Quick winRemove bold lead-ins in routine prose.
Line 1099 and Line 1104 use bold for standard explanatory text, which the style guide flags as an LLM pattern. Use plain prose (or proper headings) instead. LLM pattern detected.
Suggested edit
-**OpenClaw sandbox.** Enumerates the session store through `openclaw sessions list --agent <id> --json` and copies only the matching `<sessionId>.jsonl` (plus optional `<sessionId>.trajectory.jsonl`) files, so the export never picks up `sessions.json`, stale `.jsonl.lock` files, or other store bookkeeping. +For an OpenClaw sandbox, the command enumerates the session store through `openclaw sessions list --agent <id> --json` and copies only the matching `<sessionId>.jsonl` (plus optional `<sessionId>.trajectory.jsonl`) files, so the export never picks up `sessions.json`, stale `.jsonl.lock` files, or other store bookkeeping. @@ -**Hermes sandbox.** Invokes the in-sandbox `hermes sessions export` against a staging path, then downloads the resulting single JSONL stream to the host. +For a Hermes sandbox, the command invokes the in-sandbox `hermes sessions export` against a staging path, then downloads the resulting single JSONL stream to the host.As per coding guidelines, “Unnecessary bold on routine instructions … flag every occurrence.”
Also applies to: 1104-1104
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/commands-nemohermes.mdx` at line 1099, Remove bold formatting from the lead-in text at lines 1099 and 1104 in the documentation file. The phrases marked with double asterisks (like **OpenClaw sandbox.** and the similar bold text at line 1104) should be converted to plain prose without bold formatting. Replace the bold formatting with regular text to comply with the style guide that flags bold lead-ins in routine explanatory prose as an LLM pattern.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/actions/sandbox/sessions/export.test.ts`:
- Around line 471-484: The vi.spyOn call for fs.chmodSync in the test "honours
--out for the host destination on a hermes sandbox" creates a spy that is never
restored, which causes mocked behavior to leak into subsequent tests. Store the
spy result from the vi.spyOn(fs, "chmodSync") call and call .mockRestore() on it
after all the expect statements in the test to ensure the original function
behavior is restored before the next test runs.
---
Nitpick comments:
In `@docs/reference/commands-nemohermes.mdx`:
- Line 1099: Remove bold formatting from the lead-in text at lines 1099 and 1104
in the documentation file. The phrases marked with double asterisks (like
**OpenClaw sandbox.** and the similar bold text at line 1104) should be
converted to plain prose without bold formatting. Replace the bold formatting
with regular text to comply with the style guide that flags bold lead-ins in
routine explanatory prose as an LLM pattern.
In `@docs/reference/commands.mdx`:
- Around line 1355-1361: Remove the bold formatting from the section labels
"OpenClaw sandbox" and "Hermes sandbox" on lines 1355 and 1360 respectively, as
these are routine section headers and bold should be reserved only for UI labels
and real warnings. Additionally, convert the passive voice construction "are
refused" on line 1361 to active voice by rewriting it so that the subject (the
system or command handler) actively performs the refusal action instead of the
options being passively refused.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 458f9bc9-19cf-4c83-a35d-269e1da95595
📒 Files selected for processing (6)
docs/reference/commands-nemohermes.mdxdocs/reference/commands.mdxsrc/commands/sandbox/sessions/export.tssrc/lib/actions/sandbox/sessions/export.test.tssrc/lib/actions/sandbox/sessions/export.tstest/sandbox-sessions-export-cli.test.ts
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/sandbox-sessions-export-cli.test.ts`:
- Around line 272-274: The `home` variable is being interpolated directly into
the RegExp pattern without escaping special regex characters, which can cause
the assertion to be flaky or over-permissive if the path contains regex
operators like dots or brackets. Before embedding the `home` value into the
template string within the RegExp constructor call in the expect statement with
toMatch, escape any special regex characters in the `home` string using a
utility function or by replacing regex metacharacters. This ensures the path is
treated as literal characters in the regex pattern rather than as regex
operators.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fd5db9ca-bffa-4eb7-baff-ac52e832d2ea
📒 Files selected for processing (4)
src/lib/actions/sandbox/sessions/export.test.tssrc/lib/actions/sandbox/sessions/export.tssrc/lib/cli/public-display-sessions.tstest/sandbox-sessions-export-cli.test.ts
✅ Files skipped from review due to trivial changes (1)
- src/lib/cli/public-display-sessions.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- src/lib/actions/sandbox/sessions/export.ts
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/cli/public-display-sessions.ts`:
- Around line 43-44: The flags string for the public-display-sessions command at
line 43-44 is missing the required `<name>` positional argument that represents
the sandbox name. Add `<name>` as the first positional argument before
`[keys...]` in the flags string to match the actual command usage and maintain
consistency with other command entries in this file (such as those at lines 27
and 35) which correctly include their required positionals.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 379d545d-2cb4-43f1-857a-6eff3b60eb3f
📒 Files selected for processing (4)
docs/reference/commands-nemohermes.mdxdocs/reference/commands.mdxsrc/lib/cli/public-display-sessions.tstest/sandbox-sessions-export-cli.test.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- docs/reference/commands-nemohermes.mdx
- docs/reference/commands.mdx
cv
approved these changes
Jun 18, 2026
Collaborator
|
@laitingsheng some interesting findings in #5526 (comment); mind addressing them before we merge? |
prekshivyas
approved these changes
Jun 22, 2026
prekshivyas
left a comment
prekshivyas
left a comment
Collaborator
There was a problem hiding this comment.
Correct and well-structured. Dispatch at the exportSandboxSessions entry point is clean; rejectOpenClawOnlyOptions fires before any sandbox I/O. The umask 077 && hermes sessions export <staging> && chmod 600 <staging> invocation is safe — shellQuote is used on the staging path, and the random hex suffix prevents collisions. Staging cleanup is in a finally block and the chmod-before-rename ordering prevents a world-readable window at the final path.
One minor gap for a follow-up: if registry.getSandbox(name)?.agent is something other than "hermes" or nullish (a future third agent kind), the code silently falls through to the OpenClaw path rather than failing explicitly. Not a blocker for this PR.
Test coverage is solid: six targeted unit cases and the CLI integration test confirm the routing at the call-log level.
Approve.
prekshivyas
requested changes
Jun 22, 2026
prekshivyas
left a comment
prekshivyas
left a comment
Collaborator
There was a problem hiding this comment.
Correcting my earlier approval — I missed the PR Review Advisor status.
The advisor has this PR marked Blocked with two required items that must be resolved before merge:
- PRA-3:
hermesStagingPath()returns/tmp/…, butopenshell sandbox downloadrefuses sources outside/sandbox. The Hermes staging path needs to move to/sandbox/.nemoclaw-staging/sessions-export-hermes-*.jsonl(matching theSTAGING_DIR_IN_SANDBOXcomment at line 100–106), with 0700 perms andumask 077on write. - PRA-4:
rejectOpenClawOnlyOptions()rejects--agent hermesbefore executing anything. Issue #5515 Step 5 expectsnemohermes … sessions export --agent hermesto succeed on a Hermes sandbox — treat it as a no-op alias rather than an error.
Additionally, three items to resolve/justify: PRA-1/PRA-2 (architecture source-of-truth), PRA-5 (silent suppression of cleanup errors for sensitive session artifacts).
cc @cv — this aligns with your comment asking @laitingsheng to address the PRA findings first.
This was referenced Jun 22, 2026
…staging and accepts --agent hermes Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
… + document hermes source boundary Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/actions/sandbox/sessions/export.test.ts`:
- Around line 613-632: The test at lines 613-632 for "warns about a non-zero
in-sandbox cleanup exit" will fail because the mocked download call does not
actually create a file, but the exportSandboxSessions implementation attempts to
call fs.chmodSync on the hostStagingPath which does not exist, causing an ENOENT
error before the test can verify the console warning. Mock the fs.chmodSync
operation (and any other fs operations that interact with the staged file) to
prevent this error and allow the test to proceed to the consoleWarnSpy
assertion, following the same pattern used in the test at line 473 that
addresses this isolation issue.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6cba9bfe-74dd-4895-b655-58fa665d72cc
📒 Files selected for processing (2)
src/lib/actions/sandbox/sessions/export.test.tssrc/lib/actions/sandbox/sessions/export.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- src/lib/actions/sandbox/sessions/export.ts
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
cv
approved these changes
Jun 24, 2026
5 tasks
21 tasks
cv
pushed a commit
that referenced
this pull request
Jun 25, 2026
<!-- markdownlint-disable MD041 --> ## Summary Refreshes the v0.0.68 docs with release notes, Microsoft Teams messaging guidance, and generated support-matrix coverage. Also corrects the Hermes generated command reference so `sessions export` examples match Hermes-only behavior while keeping the shared command heading compatible with CLI parity checks. ## Changes - #5585 -> `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/platform-support.mdx`: Documents experimental Microsoft Teams channel setup, Bot Framework credentials, webhook forwarding, local `MSTEAMS_PORT` conflicts, and the generated integration support row. - #5526 -> `docs/reference/commands.mdx`, `docs/reference/commands-nemohermes.mdx`: Keeps Hermes `sessions export` examples on the supported single-JSONL export path while preserving the canonical shared CLI heading. - #5044 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for installer onboarding failure propagation. - #5641 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for fresh recovery after pre-sandbox installer interruption. - #5673 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for explicit deny-all messaging manifests. - #5743 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for unsupported-agent channel-add rejection. - #5252 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for Hermes `gateway-token` dashboard guidance. - #5659 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for local OpenClaw `agent` wrapper help. - #5661 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for default extra-agent paths. - #5669 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for Deep Agents Code branding. - #5672 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for hosted-compatible default model ID preservation. - #5725 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for Deep Agents Code sandbox liveness. - #5644 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for DGX Spark managed-vLLM express install defaults. - #5712 -> `docs/about/release-notes.mdx`, `docs/reference/platform-support.mdx`: Adds v0.0.68 release-note coverage for the canonical support matrix and updates the matrix source with Teams. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: docs-only release refresh; no runtime code changed. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — `npm run docs` passed with 0 errors; Fern reported the existing light-mode accent contrast warning. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Additional verification: - `python3 scripts/generate-platform-docs.py --check` passed. - `npm run docs:sync-agent-variants` passed. - `bash test/e2e/e2e-cloud-experimental/check-docs.sh --only-cli` passed. - `npm run docs` passed with 0 errors and one Fern theme warning: light-mode accent contrast ratio is 2.41:1 and should be at least 3:1. - `npm run build:cli` refreshed local untracked `dist/` artifacts after rebase; no tracked files changed. - `npm run typecheck:cli` passed. - Normal commit and push hooks passed after the local CLI rebuild. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Miyoung Choi <miyoungc@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added **Microsoft Teams** as an experimental messaging channel, including manifest-first onboarding, local port routing/conflict handling, sandbox delivery controls, and policy preset support. * **Documentation** * Expanded messaging-channel setup for Teams (prerequisites, credential/webhook setup, wizard flow, and add/remove commands). * Updated reference docs for **agent-specific** session export examples (OpenClaw vs Hermes). * Refreshed platform support guidance and added the latest release-notes entry. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
7 tasks
cv
pushed a commit
that referenced
this pull request
Jun 26, 2026
…k-gates.ts (#5601) ## Summary - Adds a fifth gate (`prAdvisor`) to `check-gates.ts` that fetches the PR Review Advisor sticky comment, parses the `recommendation:` field from its embedded HTML metadata, and sets `allPass: false` when the value is `blocked` - Extracts all PRA parsing and provenance logic into a new pure module `pra-gate.ts` (no shell calls) so it can be unit-tested independently - Adds unit tests in `test/skills/check-gates-pra.test.ts` covering trusted comments, spoofed comments, stale head SHA, missing metadata, all recommendation values, NDJSON parsing, `allPass` propagation, run provenance validation, and the fail-closed no-trusted-comment path - Validates comment provenance before trusting any recommendation: requires `user.login === github-actions[bot]`, verifies `comment_id` matches the actual GitHub comment id, and verifies `head_sha` matches the current PR head - Switches from a blocklist (`!== "blocked"`) to an explicit allowlist (`{merge_as_is}`); `merge_after_fixes`, `needs_rework`, `blocked`, and unknown values all fail the gate - Uses `--jq ".[]"` to emit NDJSON instead of relying on `gh --paginate` array concatenation, which is ambiguous on multi-page results - Fails closed on API errors — consistent with the CodeRabbit gate - Updates `triage.ts` with a comment making it explicit that CodeRabbit and PRA are both skipped there for performance, and that a `merge-now` bucket assignment does not mean `check-gates.ts` can be skipped - Updates `MERGE-GATE.md`: removes the "manual review step" caveat and documents the gate as automated ## Motivation PR #5526 was approved despite the PR Review Advisor posting a **Blocked** status with two required fixes. The advisor check was documented as "manual" in `MERGE-GATE.md`, making it easy to skip. Making it a programmatic gate means `allPass` will be `false` on any blocked advisor comment, preventing the approval flow from proceeding. ## Test evidence ``` $ node --experimental-strip-types --no-warnings .agents/skills/nemoclaw-maintainer-day/scripts/check-gates.ts 5526 { "prAdvisor": { "pass": false, "details": "PR Review Advisor: blocked (2 required item(s))", "recommendation": "blocked", "openRequired": 2 }, "allPass": false } $ npx vitest run test/skills/check-gates-pra.test.ts ✓ test/skills/check-gates-pra.test.ts (21 tests) ``` ## Test plan - [ ] Run `check-gates.ts` against a PR where the advisor is blocked — `prAdvisor.pass` should be `false` and `allPass` should be `false` - [ ] Run `check-gates.ts` against a PR with no advisor comment — `prAdvisor.pass` should be `false` (fail-closed) - [ ] Verify a spoofed comment (non-bot user, mismatched `comment_id`, or stale `head_sha`) is rejected Signed-off-by: Preksha Vyas <prekshiv@nvidia.com> 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Preksha Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary `nemohermes <name> sessions export` aborted with exit 127 because the wrapper unconditionally invoked the in-sandbox `openclaw sessions list` regardless of the sandbox's agent kind. The wrapper now reads `sb.agent` from the registry and routes Hermes sandboxes to `hermes sessions export`, downloading the resulting single JSONL stream to the host. ## Related Issue Fixes NVIDIA#5515 ## Changes - `exportSandboxSessions` dispatches on `registry.getSandbox(name)?.agent`; on `hermes`, runs `umask 077 && hermes sessions export <staging> && chmod 600 <staging>` in the sandbox, downloads the JSONL to the host, and best-effort cleans up the staging file. - OpenClaw-only flags (`--agent`, positional keys, `--include-trajectory`, `--format tar`) raise a clear error on a Hermes sandbox instead of producing a misleading half-export. - Host destination on Hermes defaults to `./sessions-<sandbox>.jsonl`; `--out` picks a different path. - Command help text and `docs/reference/commands.mdx` document both branches; the nemohermes docs variant is regenerated. - Unit + CLI E2E tests cover the Hermes wire calls (`exec sh -c`, `download`, `rm -f` cleanup), option-rejection, and the manifest shape. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Tests added or updated for new or changed behavior - [x] No secrets, API keys, or credentials committed - [x] Docs updated for user-facing behavior changes - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Tinson Lai <tinsonl@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Sessions export now routes by sandbox agent kind: OpenClaw exports per-session JSONL files (optionally with trajectories) or a `.tgz`; Hermes exports a single JSONL stream produced inside the sandbox. * Hermes output defaults and option handling are now agent-specific, with stronger input/flag validation. * **Documentation** * Updated `sessions export` reference docs and CLI help to reflect OpenClaw vs Hermes flows and clarified security/permissions (owner-only files) plus staging and cleanup behavior. * **Tests** * Added/expanded Hermes-focused tests for routing, transfer/rename, and failure/cleanup scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Tinson Lai <tinsonl@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Refreshes the v0.0.68 docs with release notes, Microsoft Teams messaging guidance, and generated support-matrix coverage. Also corrects the Hermes generated command reference so `sessions export` examples match Hermes-only behavior while keeping the shared command heading compatible with CLI parity checks. ## Changes - NVIDIA#5585 -> `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/platform-support.mdx`: Documents experimental Microsoft Teams channel setup, Bot Framework credentials, webhook forwarding, local `MSTEAMS_PORT` conflicts, and the generated integration support row. - NVIDIA#5526 -> `docs/reference/commands.mdx`, `docs/reference/commands-nemohermes.mdx`: Keeps Hermes `sessions export` examples on the supported single-JSONL export path while preserving the canonical shared CLI heading. - NVIDIA#5044 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for installer onboarding failure propagation. - NVIDIA#5641 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for fresh recovery after pre-sandbox installer interruption. - NVIDIA#5673 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for explicit deny-all messaging manifests. - NVIDIA#5743 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for unsupported-agent channel-add rejection. - NVIDIA#5252 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for Hermes `gateway-token` dashboard guidance. - NVIDIA#5659 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for local OpenClaw `agent` wrapper help. - NVIDIA#5661 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for default extra-agent paths. - NVIDIA#5669 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for Deep Agents Code branding. - NVIDIA#5672 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for hosted-compatible default model ID preservation. - NVIDIA#5725 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for Deep Agents Code sandbox liveness. - NVIDIA#5644 -> `docs/about/release-notes.mdx`: Adds v0.0.68 release-note coverage for DGX Spark managed-vLLM express install defaults. - NVIDIA#5712 -> `docs/about/release-notes.mdx`, `docs/reference/platform-support.mdx`: Adds v0.0.68 release-note coverage for the canonical support matrix and updates the matrix source with Teams. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: docs-only release refresh; no runtime code changed. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — `npm run docs` passed with 0 errors; Fern reported the existing light-mode accent contrast warning. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Additional verification: - `python3 scripts/generate-platform-docs.py --check` passed. - `npm run docs:sync-agent-variants` passed. - `bash test/e2e/e2e-cloud-experimental/check-docs.sh --only-cli` passed. - `npm run docs` passed with 0 errors and one Fern theme warning: light-mode accent contrast ratio is 2.41:1 and should be at least 3:1. - `npm run build:cli` refreshed local untracked `dist/` artifacts after rebase; no tracked files changed. - `npm run typecheck:cli` passed. - Normal commit and push hooks passed after the local CLI rebuild. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Miyoung Choi <miyoungc@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added **Microsoft Teams** as an experimental messaging channel, including manifest-first onboarding, local port routing/conflict handling, sandbox delivery controls, and policy preset support. * **Documentation** * Expanded messaging-channel setup for Teams (prerequisites, credential/webhook setup, wizard flow, and add/remove commands). * Updated reference docs for **agent-specific** session export examples (OpenClaw vs Hermes). * Refreshed platform support guidance and added the latest release-notes entry. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
…k-gates.ts (NVIDIA#5601) ## Summary - Adds a fifth gate (`prAdvisor`) to `check-gates.ts` that fetches the PR Review Advisor sticky comment, parses the `recommendation:` field from its embedded HTML metadata, and sets `allPass: false` when the value is `blocked` - Extracts all PRA parsing and provenance logic into a new pure module `pra-gate.ts` (no shell calls) so it can be unit-tested independently - Adds unit tests in `test/skills/check-gates-pra.test.ts` covering trusted comments, spoofed comments, stale head SHA, missing metadata, all recommendation values, NDJSON parsing, `allPass` propagation, run provenance validation, and the fail-closed no-trusted-comment path - Validates comment provenance before trusting any recommendation: requires `user.login === github-actions[bot]`, verifies `comment_id` matches the actual GitHub comment id, and verifies `head_sha` matches the current PR head - Switches from a blocklist (`!== "blocked"`) to an explicit allowlist (`{merge_as_is}`); `merge_after_fixes`, `needs_rework`, `blocked`, and unknown values all fail the gate - Uses `--jq ".[]"` to emit NDJSON instead of relying on `gh --paginate` array concatenation, which is ambiguous on multi-page results - Fails closed on API errors — consistent with the CodeRabbit gate - Updates `triage.ts` with a comment making it explicit that CodeRabbit and PRA are both skipped there for performance, and that a `merge-now` bucket assignment does not mean `check-gates.ts` can be skipped - Updates `MERGE-GATE.md`: removes the "manual review step" caveat and documents the gate as automated ## Motivation PR NVIDIA#5526 was approved despite the PR Review Advisor posting a **Blocked** status with two required fixes. The advisor check was documented as "manual" in `MERGE-GATE.md`, making it easy to skip. Making it a programmatic gate means `allPass` will be `false` on any blocked advisor comment, preventing the approval flow from proceeding. ## Test evidence ``` $ node --experimental-strip-types --no-warnings .agents/skills/nemoclaw-maintainer-day/scripts/check-gates.ts 5526 { "prAdvisor": { "pass": false, "details": "PR Review Advisor: blocked (2 required item(s))", "recommendation": "blocked", "openRequired": 2 }, "allPass": false } $ npx vitest run test/skills/check-gates-pra.test.ts ✓ test/skills/check-gates-pra.test.ts (21 tests) ``` ## Test plan - [ ] Run `check-gates.ts` against a PR where the advisor is blocked — `prAdvisor.pass` should be `false` and `allPass` should be `false` - [ ] Run `check-gates.ts` against a PR with no advisor comment — `prAdvisor.pass` should be `false` (fail-closed) - [ ] Verify a spoofed comment (non-bot user, mismatched `comment_id`, or stale `head_sha`) is rejected Signed-off-by: Preksha Vyas <prekshiv@nvidia.com> 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Preksha Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2 tasks
23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nemohermes <name> sessions exportaborted with exit 127 because the wrapper unconditionally invoked the in-sandboxopenclaw sessions listregardless of the sandbox's agent kind. The wrapper now readssb.agentfrom the registry and routes Hermes sandboxes tohermes sessions export, downloading the resulting single JSONL stream to the host.Related Issue
Fixes #5515
Changes
exportSandboxSessionsdispatches onregistry.getSandbox(name)?.agent; onhermes, runsumask 077 && hermes sessions export <staging> && chmod 600 <staging>in the sandbox, downloads the JSONL to the host, and best-effort cleans up the staging file.--agent, positional keys,--include-trajectory,--format tar) raise a clear error on a Hermes sandbox instead of producing a misleading half-export../sessions-<sandbox>.jsonl;--outpicks a different path.docs/reference/commands.mdxdocument both branches; the nemohermes docs variant is regenerated.exec sh -c,download,rm -fcleanup), option-rejection, and the manifest shape.Type of Change
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Signed-off-by: Tinson Lai tinsonl@nvidia.com
Summary by CodeRabbit
New Features
.tgz; Hermes exports a single JSONL stream produced inside the sandbox.Documentation
sessions exportreference docs and CLI help to reflect OpenClaw vs Hermes flows and clarified security/permissions (owner-only files) plus staging and cleanup behavior.Tests