fix(e2e): avoid multiline Deep Agents log probes - #5903
Merged
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
📝 WalkthroughWalkthroughRefactors Deep Agents Code secret-boundary log marker refactor
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
PR Review Advisor (Nemotron Ultra) — No blocking findingsMerge posture: No blocking advisor findings Action checklist
Findings index
Review findings by urgency: 0 required fixes, 0 items to resolve/justify, 1 in-scope improvement
|
Contributor
E2E Advisor RecommendationRequired E2E: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 2 items to resolve/justify, 0 in-scope improvements
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/langchain-deepagents-code-image.test.ts`:
- Line 439: The assertion in the `secretBoundaryCheck` test is checking the
`printf` format string instead of the emitted marker value, so update the
expectation to verify the observable output from `sandbox_logs_since_marker` in
`test/langchain-deepagents-code-image.test.ts`. Use the test case around
`secretBoundaryCheck` to assert the rendered result from the public boundary,
such as the actual `LOG_MARKER_FOUND:0/1` value that this path produces, rather
than `LOG_MARKER_FOUND:%s`.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 9c531ebf-ca64-41b1-a891-9053c6c72dc4
📒 Files selected for processing (2)
test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.shtest/langchain-deepagents-code-image.test.ts
| expect(secretBoundaryCheck).toContain("dcode_secret_probe_runtime_env"); | ||
| expect(secretBoundaryCheck).toContain("dcode_secret_probe_env_file"); | ||
| expect(secretBoundaryCheck).toContain("remote_cmd="); | ||
| expect(secretBoundaryCheck).toContain("LOG_MARKER_FOUND:%s"); |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Assert the rendered marker value, not the printf format string.
sandbox_logs_since_marker emits LOG_MARKER_FOUND:0/1, so the literal %s should never appear in secretBoundaryCheck. This should assert the observable output instead, e.g. LOG_MARKER_FOUND:1 if this path is expected to preserve the marker. Based on learnings, “Prefer observable outcomes through the public boundary over source-text, private-shape, or mock-call assertions.”
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/langchain-deepagents-code-image.test.ts` at line 439, The assertion in
the `secretBoundaryCheck` test is checking the `printf` format string instead of
the emitted marker value, so update the expectation to verify the observable
output from `sandbox_logs_since_marker` in
`test/langchain-deepagents-code-image.test.ts`. Use the test case around
`secretBoundaryCheck` to assert the rendered result from the public boundary,
such as the actual `LOG_MARKER_FOUND:0/1` value that this path produces, rather
than `LOG_MARKER_FOUND:%s`.
Source: Path instructions
cv
enabled auto-merge (squash)
June 27, 2026 17:35
cv
disabled auto-merge
June 27, 2026 18:43
21 tasks
cv
added a commit
that referenced
this pull request
Jun 27, 2026
<!-- markdownlint-disable MD041 --> ## Summary Fixes the Deep Agents Code Tavily opt-in check so its Python reachability probe no longer sends a multiline heredoc as a single OpenShell exec argument. The post-#5903 rerun showed the scenario now reaches the Tavily check and fails on the same newline command-shape issue. ## Changes - Encodes the Tavily Python probe source locally with portable `base64 | tr -d '\n'` and decodes it inside a single-line `python3 -c` command. - Adds a self-test mode that proves the command sent through `sandbox_exec` is newline-free. - Updates Deep Agents image contract tests for the new probe shape. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: live E2E harness behavior only. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review; same Python probe, single-line transport only. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Targeted verification: ```bash bash -n test/e2e/e2e-cloud-experimental/checks/09-deepagents-code-tavily-opt-in.sh NEMOCLAW_E2E_TAVILY_SELF_TEST=probe-command-shape bash test/e2e/e2e-cloud-experimental/checks/09-deepagents-code-tavily-opt-in.sh npm test -- --run test/e2e-scenario/support-tests/platform-parity-cloud-experimental.test.ts test/langchain-deepagents-code-image.test.ts npm run typecheck:cli ``` --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved reliability of a cloud-experimental check by verifying a command runs in the expected format and completes successfully. * Strengthened validation around an opt-in workflow so it is less likely to break due to formatting issues in generated commands. * Added broader test coverage for the same behavior to catch regressions earlier. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Compacts the remaining Deep Agents Code secret-boundary log marker probes into single-line OpenShell exec commands. The post-NVIDIA#5902 rerun showed the dcode probes now pass, but the log-marker helpers still used newline-bearing sandbox exec arguments and were rejected by OpenShell. ## Changes - Converts `mark_sandbox_logs` to build and run a single-line remote command. - Converts `sandbox_logs_since_marker` to build and run a single-line remote command. - Updates the Deep Agents image contract test to assert the log marker output remains present. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: live E2E harness behavior only. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review; command-shape-only change preserves existing log assertions. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Targeted verification: ```bash bash -n test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh npm test -- --run test/langchain-deepagents-code-image.test.ts npm run typecheck:cli ``` --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved handling of sandbox log marker checks so secret-boundary detection is more reliable. * **Tests** * Updated end-to-end coverage to verify the expected `LOG_MARKER_FOUND` output in deep agent policy checks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Fixes the Deep Agents Code Tavily opt-in check so its Python reachability probe no longer sends a multiline heredoc as a single OpenShell exec argument. The post-NVIDIA#5903 rerun showed the scenario now reaches the Tavily check and fails on the same newline command-shape issue. ## Changes - Encodes the Tavily Python probe source locally with portable `base64 | tr -d '\n'` and decodes it inside a single-line `python3 -c` command. - Adds a self-test mode that proves the command sent through `sandbox_exec` is newline-free. - Updates Deep Agents image contract tests for the new probe shape. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: live E2E harness behavior only. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: self-review; same Python probe, single-line transport only. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Targeted verification: ```bash bash -n test/e2e/e2e-cloud-experimental/checks/09-deepagents-code-tavily-opt-in.sh NEMOCLAW_E2E_TAVILY_SELF_TEST=probe-command-shape bash test/e2e/e2e-cloud-experimental/checks/09-deepagents-code-tavily-opt-in.sh npm test -- --run test/e2e-scenario/support-tests/platform-parity-cloud-experimental.test.ts test/langchain-deepagents-code-image.test.ts npm run typecheck:cli ``` --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved reliability of a cloud-experimental check by verifying a command runs in the expected format and completes successfully. * Strengthened validation around an opt-in workflow so it is less likely to break due to formatting issues in generated commands. * Added broader test coverage for the same behavior to catch regressions earlier. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Carlos Villela <cvillela@nvidia.com>
wscurran
added
area: ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Compacts the remaining Deep Agents Code secret-boundary log marker probes into single-line OpenShell exec commands. The post-#5902 rerun showed the dcode probes now pass, but the log-marker helpers still used newline-bearing sandbox exec arguments and were rejected by OpenShell.
Changes
mark_sandbox_logsto build and run a single-line remote command.sandbox_logs_since_markerto build and run a single-line remote command.Type of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Targeted verification:
bash -n test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh npm test -- --run test/langchain-deepagents-code-image.test.ts npm run typecheck:cliSigned-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit
Bug Fixes
Tests
LOG_MARKER_FOUNDoutput in deep agent policy checks.