fix(rebuild): abort when gateway provider is missing - #5831
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughRebuild now verifies the sandbox’s upstream provider is registered in OpenShell before proceeding. If the provider is missing, preflight aborts, leaves the sandbox untouched, and the docs and tests reflect the new behavior. ChangesRebuild preflight provider validation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-5831.docs.buildwithfern.com/nemoclaw |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/lib/actions/sandbox/rebuild.ts (1)
520-545: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winPrioritize the missing-provider abort over the missing-env fallback.
If
hydrateCredentialEnv()returnsnulland the gateway provider is also missing, this branch falls through to the old missing-credential error instead of the new missing-provider abort. That contradicts the new preflight contract and points users at exporting the env var even though rebuild still cannot continue until the OpenShell provider is re-registered.Suggested fix
- if (credentialValue) { - if (shouldVerifyGatewayProvider && !gatewayProviderExists()) { - printMissingRebuildGatewayProvider(rebuildProvider, rebuildCredentialEnv); - bail(`Missing gateway provider: ${rebuildProvider}`); - return false; - } - return true; - } - if (shouldVerifyGatewayProvider && gatewayProviderExists()) { + if (shouldVerifyGatewayProvider && !gatewayProviderExists()) { + printMissingRebuildGatewayProvider(rebuildProvider, rebuildCredentialEnv); + bail(`Missing gateway provider: ${rebuildProvider}`); + return false; + } + if (credentialValue) { + return true; + } + if (shouldVerifyGatewayProvider) { log( `Preflight credential check: provider '${rebuildProvider}' registered in gateway — skipping env check for ${rebuildCredentialEnv}`, ); return true; }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/actions/sandbox/rebuild.ts` around lines 520 - 545, The preflight logic in `hydrateCredentialEnv()`/`rebuild` is letting the missing-env fallback run when both the credential and gateway provider are absent, instead of aborting on the missing provider first. Reorder the checks so the `shouldVerifyGatewayProvider && !gatewayProviderExists()` path is handled before any env-based fallback, and make sure the `bail()`/`printMissingRebuildGatewayProvider()` flow is the first exit when the provider is not registered.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/lib/actions/sandbox/rebuild.ts`:
- Around line 520-545: The preflight logic in `hydrateCredentialEnv()`/`rebuild`
is letting the missing-env fallback run when both the credential and gateway
provider are absent, instead of aborting on the missing provider first. Reorder
the checks so the `shouldVerifyGatewayProvider && !gatewayProviderExists()` path
is handled before any env-based fallback, and make sure the
`bail()`/`printMissingRebuildGatewayProvider()` flow is the first exit when the
provider is not registered.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 992dc251-ea90-4c52-a0b4-0736784ecbe4
📒 Files selected for processing (3)
docs/security/credential-storage.mdxsrc/lib/actions/sandbox/rebuild.tstest/rebuild-credential-preflight.test.ts
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings Action checklist
Test follow-ups to resolve or justifyIf these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.
This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
…sing-provider-preflight
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Stop `nemoclaw <name> rebuild` before backup/delete when the sandbox registry points at a non-local upstream provider that is missing from the OpenShell gateway, even if the matching host credential environment variable is exported. This preserves the existing Hermes API-key self-registration path and local-provider rebuild behavior. ## Related Issue Fixes NVIDIA#5792 ## Changes - Add a rebuild preflight check for missing non-local, non-Hermes OpenShell provider entries before destructive rebuild steps. - Emit a targeted failure explaining that the sandbox is untouched and the provider must be re-registered or onboard rerun. - Add a CLI-boundary regression test proving rebuild does not back up, delete, recreate, or reach the late provider self-heal path when `nvidia-prod` is missing but `NVIDIA_INFERENCE_API_KEY` is present. - Document the day-two rebuild requirement in credential storage docs. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: existing credential-storage page was updated; no new docs page required. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review of fail-closed rebuild preflight; targeted regression covers host credential present + gateway provider missing, and existing Hermes/local-provider tests stay green. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - Commit/push hooks were attempted normally, but the full CLI test hook failed on unrelated existing/environmental failures: `test/dcode-wrapper-empty-prompt.test.ts` positive wrapper cases and resource-limit tests with `fork: Resource temporarily unavailable`. The branch was pushed with `SKIP=test-cli` after targeted checks below passed. - [x] Targeted tests pass for changed behavior - `npm run build:cli` - `npx vitest run test/rebuild-credential-preflight.test.ts` - `npm run typecheck:cli` - `git diff --check` - `SKIP=test-cli npx prek run --files src/lib/actions/sandbox/rebuild.ts test/rebuild-credential-preflight.test.ts docs/security/credential-storage.mdx` - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [x] `npm run docs` builds without warnings (doc changes only) - Fern reported 0 errors and 2 existing global warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Rebuild preflight now aborts when the upstream gateway provider referenced by a sandbox registry entry is missing in OpenShell, even if the matching credential environment variable is set. * Improved failure messaging to name the exact missing provider and clarify that it won’t be recreated; rebuild now leaves the sandbox untouched (no backup/delete/recreate). * **Documentation** * Updated credential storage guidance with the new rebuild constraint for non-local upstream providers. * **Tests** * Added and updated preflight-abort coverage, including scenarios with NVIDIA inference credentials and revised expectations for detailed provider-registration errors. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
wscurran
added
area: cli
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stop
nemoclaw <name> rebuildbefore backup/delete when the sandbox registry points at a non-local upstream provider that is missing from the OpenShell gateway, even if the matching host credential environment variable is exported. This preserves the existing Hermes API-key self-registration path and local-provider rebuild behavior.Related Issue
Fixes #5792
Changes
nvidia-prodis missing butNVIDIA_INFERENCE_API_KEYis present.Type of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassestest/dcode-wrapper-empty-prompt.test.tspositive wrapper cases and resource-limit tests withfork: Resource temporarily unavailable. The branch was pushed withSKIP=test-cliafter targeted checks below passed.npm run build:clinpx vitest run test/rebuild-credential-preflight.test.tsnpm run typecheck:cligit diff --checkSKIP=test-cli npx prek run --files src/lib/actions/sandbox/rebuild.ts test/rebuild-credential-preflight.test.ts docs/security/credential-storage.mdxnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Signed-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit