fix(cli): dispatch sandbox agent to terminal runtimes by cv · Pull Request #5815 · NVIDIA/NemoClaw

cv · 2026-06-25T19:18:35Z

Summary

Fixes the nemoclaw <name> agent host wrapper so registered terminal-runtime sandboxes dispatch through their manifest command instead of being short-circuited by OpenClaw-only help handling. This lets LangChain Deep Agents Code sandboxes receive bare dcode and dcode --help invocations while preserving local wrapper help for OpenClaw fallback cases.

Related Issue

Fixes #5790

Changes

Route terminal-runtime sandboxes through their manifest interactive_command/headless_command in runAgentPassthrough.
Keep bare and help invocations local only for OpenClaw sandboxes or registry fallbacks.
Update command parsing tests and passthrough tests for Deep Agents Code bare/help dispatch.
Update the command reference and generated Hermes command reference wording for the broader agent wrapper behavior.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification:
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review completed; the change remains registry-gated, keeps registry read errors fail-closed, preserves OpenClaw fallback behavior, and keeps Hermes rejected with API guidance.
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes
Targeted tests pass for changed behavior
Full npm test passes (broad runtime changes only)
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Verification notes:

npx vitest run src/commands/sandbox/agent.test.ts src/lib/actions/sandbox/agent/passthrough.test.ts src/lib/actions/sandbox/agent/passthrough-help.test.ts --project cli passed.
npm run typecheck:cli passed.
npm run docs completed with 0 errors and 2 pre-existing Fern warnings about an available Fern upgrade.
Local test-cli hook failed in unrelated rlimit tests with fork: Resource temporarily unavailable; reproduced with npx vitest run test/sandbox-init.test.ts test/sandbox-rlimit-hooks.test.ts --project cli.

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

New Features
- The sandbox agent command runs a single non-interactive “agent turn” and forwards agent flags to the in-sandbox target; Deep Agents Code sandboxes route to the configured terminal-runtime command, including --help forwarding.
Bug Fixes
- Corrected --help and bare invocation dispatch behavior.
- Improved fail-closed validation and safer manifest command parsing; invalid quoted/escaped commands are refused with clearer Hermes HTTP API guidance.
Documentation
- Updated sandbox-agent reference and passthrough help wording and examples (including Hermes HTTP API notes).
Tests
- Expanded coverage for routing, guard semantics, exit codes, and help/forwarding parity.

coderabbitai · 2026-06-25T19:18:56Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

The agent wrapper docs and CLI behavior now dispatch agent invocations into sandbox runtime commands instead of local wrapper help. Passthrough selects OpenClaw or terminal-runtime commands from the sandbox registry, rejects unsupported paths, and updates help and tests accordingly.

Changes

Sandbox agent command flow

Layer / File(s)	Summary
Command wording and entrypoint `docs/reference/commands*.mdx`, `src/commands/sandbox/agent.ts`, `src/commands/sandbox/agent.test.ts`	The agent command docs and CLI metadata now describe a single non-interactive turn, forwarding behavior, and Hermes rejection wording; the entrypoint now forwards bare and `--help` invocations to passthrough, and the command tests expect that dispatch.
Passthrough help text `src/lib/actions/sandbox/agent/passthrough-help.ts`, `src/lib/actions/sandbox/agent/passthrough-help.test.ts`	The passthrough help output is rewritten to describe OpenClaw and terminal-runtime forwarding, and the help tests verify the new sections and wording.
Passthrough routing and execution `src/lib/actions/sandbox/agent/passthrough.ts`	Passthrough now resolves the sandbox agent from the registry, routes terminal runtimes through their manifest command, falls back to OpenClaw when needed, and runs the selected command with `tty: false`.
Dispatch and validation tests `src/lib/actions/sandbox/agent/passthrough.test.ts`	The sandbox-agent tests cover wrapper dispatch changes, passthrough help output, OpenClaw validation, terminal-runtime routing, and fail-closed rejection cases.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

NVIDIA/NemoClaw#5197: Introduces terminal runtime metadata and helpers that this PR uses to route agent invocations to the sandbox’s interactive command.
NVIDIA/NemoClaw#5659: Adds the earlier local-help behavior for empty extraArgs, which this PR changes at the agent wrapper entrypoint.
NVIDIA/NemoClaw#5671: Also updates the passthrough command path and its tests around selector handling and rejection behavior.

Suggested labels

area: cli, bug-fix, integration: dcode, v0.0.69

Suggested reviewers

jyaunches
prekshivyas

Poem

A bunny hopped through sandbox lanes,
To dcode songs and agent gains.
No wrapper lull, just flags sent through,
And exit codes that now ring true.
🐇✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: dispatching sandbox agent commands to terminal runtimes.
Linked Issues check	✅ Passed	The changes address `#5790` by dispatching agent --help and bare agent invocations into terminal-runtime sandboxes and preserving non-zero rejection behavior.
Out of Scope Changes check	✅ Passed	The modified docs, tests, and helper text all support the sandbox agent dispatch fix and do not appear unrelated to the issue scope.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch codex/fix-dcode-agent-passthrough

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-06-25T19:19:18Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the codex/fix-dcode-agen... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	`main`	`codex/fix-dcode-agen...` 9ccaf70	+/-
`nemoclaw/src/se...cret-scanner.ts`	—	100%	—
`nemoclaw/src/commands/slash.ts`	—	100%	—
`nemoclaw/src/li...bprocess-env.ts`	—	100%	—
`nemoclaw/src/bl...eprint/state.ts`	—	98%	—
`nemoclaw/src/onboard/config.ts`	—	98%	—
`nemoclaw/src/bl...int/snapshot.ts`	—	97%	—
`nemoclaw/src/bl...print/runner.ts`	—	95%	—
`nemoclaw/src/co...ration-state.ts`	—	94%	—
`nemoclaw/src/bl...ate-networks.ts`	—	94%	—
`nemoclaw/src/index.ts`	—	94%	—

TypeScript / code-coverage/cli

The overall coverage in the codex/fix-dcode-agen... branch is 47%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	`main`	`codex/fix-dcode-agen...` 9ccaf70	+/-
`src/lib/state/o...oard-session.ts`	—	91%	—
`src/lib/inference/local.ts`	—	76%	—
`src/lib/sandbox/config.ts`	—	72%	—
`src/lib/actions...dbox/rebuild.ts`	—	71%	—
`src/lib/onboard/preflight.ts`	—	64%	—
`src/lib/actions...licy-channel.ts`	—	60%	—
`src/lib/state/sandbox.ts`	—	56%	—
`src/lib/policy/index.ts`	—	49%	—
`src/lib/onboard...er-gpu-patch.ts`	—	44%	—
`src/lib/onboard.ts`	—	19%	—

_{Updated June 25, 2026 22:00 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

github-actions · 2026-06-25T19:19:23Z

🌿 Preview your docs: https://nvidia-preview-pr-5815.docs.buildwithfern.com/nemoclaw

github-actions · 2026-06-25T19:22:16Z

PR Review Advisor — Changes requested

Merge posture: Do not merge yet
Primary next action: Resolve or justify PRA-1: Issue #5790 output and bare-exit acceptance still stops at mocked exec coverage.
Open items: 0 required · 1 warning · 0 suggestions · 8 test follow-ups
Since last review: 0 prior items resolved · 1 still applies · 0 new items found

Action checklist

PRA-1 Resolve or justify: Issue [All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790 output and bare-exit acceptance still stops at mocked exec coverage in src/lib/actions/sandbox/agent/passthrough.test.ts:96
PRA-T1 Add or justify test follow-up: Runtime validation
PRA-T2 Add or justify test follow-up: Runtime validation
PRA-T3 Add or justify test follow-up: Runtime validation
PRA-T4 Add or justify test follow-up: Issue [All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790 output and bare-exit acceptance still stops at mocked exec coverage
PRA-T5 Add or justify test follow-up: Acceptance clause
PRA-T6 Add or justify test follow-up: Acceptance clause
PRA-T7 Add or justify test follow-up: Acceptance clause
PRA-T8 Add or justify test follow-up: Acceptance clause

Findings index

ID	Severity	Category	Location	Required action
`PRA-1`	Resolve/justify	tests	`src/lib/actions/sandbox/agent/passthrough.test.ts:96`	Add or identify a targeted runtime/integration validation for a registered `langchain-deepagents-code` sandbox that compares `nemoclaw <name> agent --help` with `nemoclaw <name> exec -- dcode --help` and verifies bare `nemoclaw <name> agent` surfaces dcode's missing-prompt failure with a non-zero exit.

Review findings by urgency: 0 required fixes, 1 item to resolve/justify, 0 in-scope improvements

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

`PRA-1` Resolve/justify — Issue #5790 output and bare-exit acceptance still stops at mocked exec coverage

Location: src/lib/actions/sandbox/agent/passthrough.test.ts:96
Category: tests
Problem: The changed tests prove that a registered `langchain-deepagents-code` sandbox selects `execSandbox` argv `['dcode', '--help']`, selects `['dcode']` for a bare invocation, and propagates a mocked `execSandbox` rejection. They still do not exercise the real CLI/OpenShell/dcode boundary required by the linked issue: actual dcode help output, equality with `nemoclaw <name> exec -- dcode --help`, the no-args missing-prompt diagnostic, and real process exit statuses.
Impact: A regression in oclif argument handling, `execSandbox` argument translation, stdio forwarding, OpenShell exit-code handling, or dcode's actual no-prompt behavior could leave the user-visible [All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790 bug unresolved while these unit tests pass.
Recommended action: Add or identify a targeted runtime/integration validation for a registered `langchain-deepagents-code` sandbox that compares `nemoclaw <name> agent --help` with `nemoclaw <name> exec -- dcode --help` and verifies bare `nemoclaw <name> agent` surfaces dcode's missing-prompt failure with a non-zero exit.
Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
Verification: Read `src/lib/actions/sandbox/agent/passthrough.test.ts` around the `[All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790` tests and confirm the assertions stop at `execMock` calls or `execMock.mockRejectedValueOnce(...)`, without capturing real command output or exit codes from dcode.
Missing regression test: Add behavior tests named `registered Deep Agents Code agent --help output and exit match exec -- dcode --help` and `registered Deep Agents Code bare agent surfaces dcode missing-prompt error and non-zero exit`, or point to existing targeted runtime validation that checks those exact outputs and exit codes.
Done when: The risk is fixed or explicitly justified in the PR. Verification: Read `src/lib/actions/sandbox/agent/passthrough.test.ts` around the `[All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790` tests and confirm the assertions stop at `execMock` calls or `execMock.mockRejectedValueOnce(...)`, without capturing real command output or exit codes from dcode.
Evidence: `dispatches Deep Agents Code help to dcode instead of local wrapper help ([All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790)` asserts `execMock` received `["dcode", "--help"]`; `dispatches bare Deep Agents Code invocations to dcode so upstream owns exit code ([All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790)` asserts `["dcode"]`; `propagates bare Deep Agents Code non-zero exits from the sandbox exec path ([All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790)` injects `execMock.mockRejectedValueOnce(new Error("__exit:42"))` rather than invoking dcode.

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

None.

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

PRA-T1 Runtime validation — registered Deep Agents Code agent --help output and exit match exec -- dcode --help. Focused unit coverage is strong for parser delegation, command selection, fail-closed registry/manifest branches, quoted manifest command rejection, phase handling, OpenClaw selector validation, and OpenClaw/registry-miss help preservation. The remaining linked-issue acceptance depends on real CLI/OpenShell/dcode stdout/stderr and exit-code behavior, which mocked `execSandbox` tests cannot prove.
PRA-T2 Runtime validation — registered Deep Agents Code bare agent surfaces dcode missing-prompt error and non-zero exit. Focused unit coverage is strong for parser delegation, command selection, fail-closed registry/manifest branches, quoted manifest command rejection, phase handling, OpenClaw selector validation, and OpenClaw/registry-miss help preservation. The remaining linked-issue acceptance depends on real CLI/OpenShell/dcode stdout/stderr and exit-code behavior, which mocked `execSandbox` tests cannot prove.
PRA-T3 Runtime validation — terminal-runtime passthrough preserves remote exit code through nemoclaw sandbox agent. Focused unit coverage is strong for parser delegation, command selection, fail-closed registry/manifest branches, quoted manifest command rejection, phase handling, OpenClaw selector validation, and OpenClaw/registry-miss help preservation. The remaining linked-issue acceptance depends on real CLI/OpenShell/dcode stdout/stderr and exit-code behavior, which mocked `execSandbox` tests cannot prove.
PRA-T4 Issue [All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790 output and bare-exit acceptance still stops at mocked exec coverage — Add or identify a targeted runtime/integration validation for a registered `langchain-deepagents-code` sandbox that compares `nemoclaw <name> agent --help` with `nemoclaw <name> exec -- dcode --help` and verifies bare `nemoclaw <name> agent` surfaces dcode's missing-prompt failure with a non-zero exit.
PRA-T5 Acceptance clause — Instead, they return NemoClaw's own wrapper help (saying "OpenClaw only") and exit 0 even when rejecting the command. — add test evidence or identify existing coverage. Wrapper help is now local only for OpenClaw/registry fallback paths, and `passthrough-help.test.ts` asserts the help no longer contains `OpenClaw sandboxes only`. The real terminal-runtime rejection/output exit behavior is still covered only through mocked `execSandbox` calls.
PRA-T6 Acceptance clause — 1. `agent --help` shows NemoClaw wrapper help instead of dcode's usage block. — add test evidence or identify existing coverage. `passthrough.test.ts` asserts Deep Agents Code help dispatches as `["dcode", "--help"]`, but no changed test captures dcode's actual usage block from a real sandbox invocation.
PRA-T7 Acceptance clause — 2. `agent` with no args rejects with a correct error message but `EXIT:0` instead of non-zero. — add test evidence or identify existing coverage. `passthrough.test.ts` asserts bare Deep Agents Code dispatches as `["dcode"]` and propagates a mocked non-zero rejection. No test invokes real dcode to verify the actual missing-prompt diagnostic and non-zero exit.
PRA-T8 Acceptance clause — **`agent --help`:** Dispatches into sandbox and prints dcode's usage block (same as `dcode --help`). `EXIT:0`. — add test evidence or identify existing coverage. Dispatch into the sandbox is covered by the `execMock` argv assertion for `["dcode", "--help"]`; output equality with `dcode --help` and real `EXIT:0` are not covered by the changed tests.

Since last review details

Current findings, using the urgency labels above:

`PRA-1` Resolve/justify — Issue #5790 output and bare-exit acceptance still stops at mocked exec coverage

Location: src/lib/actions/sandbox/agent/passthrough.test.ts:96
Category: tests
Problem: The changed tests prove that a registered `langchain-deepagents-code` sandbox selects `execSandbox` argv `['dcode', '--help']`, selects `['dcode']` for a bare invocation, and propagates a mocked `execSandbox` rejection. They still do not exercise the real CLI/OpenShell/dcode boundary required by the linked issue: actual dcode help output, equality with `nemoclaw <name> exec -- dcode --help`, the no-args missing-prompt diagnostic, and real process exit statuses.
Impact: A regression in oclif argument handling, `execSandbox` argument translation, stdio forwarding, OpenShell exit-code handling, or dcode's actual no-prompt behavior could leave the user-visible [All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790 bug unresolved while these unit tests pass.
Recommended action: Add or identify a targeted runtime/integration validation for a registered `langchain-deepagents-code` sandbox that compares `nemoclaw <name> agent --help` with `nemoclaw <name> exec -- dcode --help` and verifies bare `nemoclaw <name> agent` surfaces dcode's missing-prompt failure with a non-zero exit.
Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
Verification: Read `src/lib/actions/sandbox/agent/passthrough.test.ts` around the `[All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790` tests and confirm the assertions stop at `execMock` calls or `execMock.mockRejectedValueOnce(...)`, without capturing real command output or exit codes from dcode.
Missing regression test: Add behavior tests named `registered Deep Agents Code agent --help output and exit match exec -- dcode --help` and `registered Deep Agents Code bare agent surfaces dcode missing-prompt error and non-zero exit`, or point to existing targeted runtime validation that checks those exact outputs and exit codes.
Done when: The risk is fixed or explicitly justified in the PR. Verification: Read `src/lib/actions/sandbox/agent/passthrough.test.ts` around the `[All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790` tests and confirm the assertions stop at `execMock` calls or `execMock.mockRejectedValueOnce(...)`, without capturing real command output or exit codes from dcode.
Evidence: `dispatches Deep Agents Code help to dcode instead of local wrapper help ([All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790)` asserts `execMock` received `["dcode", "--help"]`; `dispatches bare Deep Agents Code invocations to dcode so upstream owns exit code ([All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790)` asserts `["dcode"]`; `propagates bare Deep Agents Code non-zero exits from the sandbox exec path ([All Platforms][CLI&UX] nemoclaw agent command does not dispatch to dcode for LangChain Deep Agents Code sandboxes — returns wrapper help and EXIT:0 on rejection #5790)` injects `execMock.mockRejectedValueOnce(new Error("__exit:42"))` rather than invoking dcode.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

github-actions · 2026-06-25T19:24:18Z

E2E Advisor Recommendation

Required E2E: sessions-agents-cli-vitest
Optional E2E: agent-turn-latency-vitest, runtime-overrides-vitest

Dispatch hint: sessions-agents-cli-vitest

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: medium

Required E2E

sessions-agents-cli-vitest (medium, timeout 70 minutes): Closest existing live host-CLI coverage for agent-related sandbox commands. It onboards a real OpenClaw sandbox and validates host CLI argv translation, OpenClaw gateway dispatch, and in-sandbox agent command behavior, which is adjacent to the changed sandbox agent passthrough and can catch regressions in CLI-to-sandbox dispatch assumptions.

Optional E2E

agent-turn-latency-vitest (high, timeout 110 minutes): Useful confidence check for the live OpenClaw assistant-turn path through a real sandbox and hosted inference after changes to host-side agent invocation semantics, although it does not directly exercise the nemoclaw <name> agent wrapper.
runtime-overrides-vitest (medium, timeout 45 minutes): Optional adjacent coverage for runtime manifest/ENTRYPOINT behavior because this PR adds terminal-runtime passthrough handling based on manifest-declared commands.

New E2E recommendations

sandbox agent passthrough (high): No existing live E2E appears to directly exercise nemoclaw <name> agent / nemoclaw sandbox agent <name> itself. The changed code path needs live coverage for OpenClaw selector enforcement, OpenClaw local --help, Hermes rejection, non-ready phase recovery guidance, and successful forwarding through openshell sandbox exec.
- Suggested test: Add a focused live Vitest scenario, e.g. sandbox-agent-passthrough-vitest, that onboards/uses a real OpenClaw sandbox and runs nemoclaw <name> agent --agent main -m ..., validates no-selector exit 2, validates --help behavior, and verifies Hermes rejection without dispatch.
terminal-runtime agent passthrough (high): The new terminal-runtime branch for manifest-declared commands such as dcode is primarily covered by unit tests; existing live E2E checks for Deep Agents Code focus on sandbox policy/egress and do not validate host wrapper dispatch.
- Suggested test: Extend or add live coverage for a registered langchain-deepagents-code sandbox that verifies nemoclaw <name> agent --help forwards to dcode --help and a bare invocation reaches the manifest command with the sandbox exec exit code preserved.

Dispatch hint

Workflow: .github/workflows/e2e-vitest-scenarios.yaml
jobs input: sessions-agents-cli-vitest

github-actions · 2026-06-25T19:24:20Z

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: None
Optional Vitest E2E scenarios: None

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required Vitest E2E scenarios

None. No live-supported typed Vitest scenario or wired free-standing Vitest job in e2e-vitest-scenarios.yaml currently exercises the changed nemoclaw <name> agent / sandbox agent wrapper path. Existing live agent coverage primarily invokes in-sandbox openclaw agent directly or the plural sessions/agents CLI paths, and the typed LangChain Deep Agents Code terminal-runtime scenario is not live-supported by runtime-support.ts on trusted main, so there is no dispatchable Vitest E2E scenario that would prove this change.

Optional Vitest E2E scenarios

None.

Relevant changed files

src/commands/sandbox/agent.ts
src/lib/actions/sandbox/agent/passthrough-help.ts
src/lib/actions/sandbox/agent/passthrough.ts

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/reference/commands.mdx`:
- Line 565: Split the combined documentation line into separate source lines so
each sentence appears on its own line; update the relevant prose in commands.mdx
around the remote command exit code and stdout streaming text so the wrapper
exit-code sentence and the streaming-buffering sentence are each standalone,
preserving the existing meaning while matching the one-sentence-per-line style
guide.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9b9987af-4668-48e0-81a3-3fd04397c554

📥 Commits

Reviewing files that changed from the base of the PR and between 596c63e and 6f41245.

📒 Files selected for processing (6)

docs/reference/commands-nemohermes.mdx
docs/reference/commands.mdx
src/commands/sandbox/agent.test.ts
src/commands/sandbox/agent.ts
src/lib/actions/sandbox/agent/passthrough.test.ts
src/lib/actions/sandbox/agent/passthrough.ts

…-passthrough # Conflicts: # docs/reference/commands.mdx # src/lib/actions/sandbox/agent/passthrough-help.ts # src/lib/actions/sandbox/agent/passthrough.test.ts # src/lib/actions/sandbox/agent/passthrough.ts

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/actions/sandbox/agent/passthrough.ts`:
- Around line 332-345: The passthrough flow in
getPassthroughCommand/ensureLiveSandboxOrExit currently lets OpenClaw help
tokens fall through to rejectNoTargetSelector, breaking local wrapper help
behavior. Update the logic in passthrough.ts so
isOpenClawPassthroughCommand(command) with extraArgs like --help or -h
short-circuits before phase/selector validation, while still leaving
terminal-runtime commands free to handle their own help path.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 681a3e10-3170-4cb7-be53-2facd755cb99

📥 Commits

Reviewing files that changed from the base of the PR and between 73a3198 and 5fd66e2.

📒 Files selected for processing (5)

docs/reference/commands.mdx
src/commands/sandbox/agent.ts
src/lib/actions/sandbox/agent/passthrough-help.ts
src/lib/actions/sandbox/agent/passthrough.test.ts
src/lib/actions/sandbox/agent/passthrough.ts

✅ Files skipped from review due to trivial changes (1)

src/lib/actions/sandbox/agent/passthrough-help.ts

🚧 Files skipped from review as they are similar to previous changes (2)

src/commands/sandbox/agent.ts
docs/reference/commands.mdx

## Summary Fixes the `nemoclaw <name> agent` host wrapper so registered terminal-runtime sandboxes dispatch through their manifest command instead of being short-circuited by OpenClaw-only help handling. This lets LangChain Deep Agents Code sandboxes receive bare `dcode` and `dcode --help` invocations while preserving local wrapper help for OpenClaw fallback cases. ## Related Issue Fixes NVIDIA#5790 ## Changes - Route terminal-runtime sandboxes through their manifest `interactive_command`/`headless_command` in `runAgentPassthrough`. - Keep bare and help invocations local only for OpenClaw sandboxes or registry fallbacks. - Update command parsing tests and passthrough tests for Deep Agents Code bare/help dispatch. - Update the command reference and generated Hermes command reference wording for the broader agent wrapper behavior. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates  - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review completed; the change remains registry-gated, keeps registry read errors fail-closed, preserves OpenClaw fallback behavior, and keeps Hermes rejected with API guidance. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification  - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification notes: - `npx vitest run src/commands/sandbox/agent.test.ts src/lib/actions/sandbox/agent/passthrough.test.ts src/lib/actions/sandbox/agent/passthrough-help.test.ts --project cli` passed. - `npm run typecheck:cli` passed. - `npm run docs` completed with 0 errors and 2 pre-existing Fern warnings about an available Fern upgrade. - Local `test-cli` hook failed in unrelated rlimit tests with `fork: Resource temporarily unavailable`; reproduced with `npx vitest run test/sandbox-init.test.ts test/sandbox-rlimit-hooks.test.ts --project cli`. ---  Signed-off-by: Carlos Villela <cvillela@nvidia.com>  ## Summary by CodeRabbit * **New Features** * The sandbox agent command runs a single non-interactive “agent turn” and forwards agent flags to the in-sandbox target; Deep Agents Code sandboxes route to the configured terminal-runtime command, including `--help` forwarding. * **Bug Fixes** * Corrected `--help` and bare invocation dispatch behavior. * Improved fail-closed validation and safer manifest command parsing; invalid quoted/escaped commands are refused with clearer Hermes HTTP API guidance. * **Documentation** * Updated sandbox-agent reference and passthrough help wording and examples (including Hermes HTTP API notes). * **Tests** * Expanded coverage for routing, guard semantics, exit codes, and help/forwarding parity.

fix(cli): dispatch sandbox agent to terminal runtimes

6f41245

cv added the documentation label Jun 25, 2026

cv self-assigned this Jun 25, 2026

coderabbitai Bot reviewed Jun 25, 2026

View reviewed changes

Comment thread docs/reference/commands.mdx Outdated

fix(cli): fail closed on invalid agent passthrough manifests

bb0f3a4

wscurran added area: docs Documentation, examples, guides, or docs build and removed documentation labels Jun 25, 2026

cv added 2 commits June 25, 2026 12:54

test(cli): cover dcode passthrough help semantics

73a3198

Merge remote-tracking branch 'origin/main' into codex/fix-dcode-agent…

5fd66e2

…-passthrough # Conflicts: # docs/reference/commands.mdx # src/lib/actions/sandbox/agent/passthrough-help.ts # src/lib/actions/sandbox/agent/passthrough.test.ts # src/lib/actions/sandbox/agent/passthrough.ts

coderabbitai Bot reviewed Jun 25, 2026

View reviewed changes

Comment thread src/lib/actions/sandbox/agent/passthrough.ts

fix(cli): keep OpenClaw agent help offline

bf93aa7

cv added the v0.0.69 label Jun 25, 2026

Merge branch 'main' into codex/fix-dcode-agent-passthrough

9ccaf70

wscurran added NV QA Bugs found by the NVIDIA QA Team UAT Issues flagged for User Acceptance Testing. labels Jun 26, 2026

cv merged commit 0903d0c into main Jun 26, 2026
41 checks passed

cv deleted the codex/fix-dcode-agent-passthrough branch June 26, 2026 05:00

coderabbitai Bot mentioned this pull request Jun 26, 2026

docs: refresh Deep Agents Code guidance #5870

Closed

wscurran added the integration: dcode LangChain Deep Code integration behavior label Jun 26, 2026

Uh oh!

Conversation

cv commented Jun 25, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Quality Gates

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

❌ Failed checks (1 warning)

Uh oh!

github-code-quality Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

github-actions Bot commented Jun 25, 2026

Uh oh!

github-actions Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — Changes requested

Action checklist

Findings index

⚠️ Resolve or justify before merge

PRA-1 Resolve/justify — Issue #5790 output and bare-exit acceptance still stops at mocked exec coverage

💡 In-scope improvements

PRA-1 Resolve/justify — Issue #5790 output and bare-exit acceptance still stops at mocked exec coverage

Uh oh!

github-actions Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Advisor Recommendation

E2E Recommendation Advisor

Required E2E

Optional E2E

New E2E recommendations

Dispatch hint

Uh oh!

github-actions Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vitest E2E Scenario Recommendation

Vitest E2E Scenario Advisor

Required Vitest E2E scenarios

Optional Vitest E2E scenarios

Relevant changed files

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cv commented Jun 25, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 25, 2026 •

edited

Loading

github-code-quality Bot commented Jun 25, 2026 •

edited

Loading

github-actions Bot commented Jun 25, 2026 •

edited

Loading

`PRA-1` Resolve/justify — Issue #5790 output and bare-exit acceptance still stops at mocked exec coverage

`PRA-1` Resolve/justify — Issue #5790 output and bare-exit acceptance still stops at mocked exec coverage

github-actions Bot commented Jun 25, 2026 •

edited

Loading

github-actions Bot commented Jun 25, 2026 •

edited

Loading