fix(snapshot): strip OpenShell exec framing in dcode idleness probe - #6190
Closed
laitingsheng wants to merge 5 commits into
Closed
fix(snapshot): strip OpenShell exec framing in dcode idleness probe#6190laitingsheng wants to merge 5 commits into
laitingsheng wants to merge 5 commits into
Conversation
The dcode snapshot-create guard matched the raw `openshell sandbox exec` output with an anchored sentinel regex, so an OpenShell build that frames child stdout as `stdout: <line>` never matched and every idle terminal runtime sandbox was refused with "cannot verify". Route the probe through the shared marked-command and stdout-frame-stripping helpers, and decide on the extracted sentinel instead of the exec wrapper's exit status. Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
📝 WalkthroughWalkthroughThe dcode snapshot preflight now uses marked OpenShell exec output extraction to detect dcode activity from framed stdout, and the parser rejects ambiguous sentinel boundaries. Tests cover framed probe output and non-zero exec status handling. ChangesSnapshot probe fix
Estimated code review effort: 2 (Simple) | ~15 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
Contributor
PR Review Advisor (Nemotron Ultra) — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
laitingsheng
added
NV QA
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/lib/actions/sandbox/sandbox-exec-output.ts (1)
1-65: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winFile location conflicts with documented layering map.
This file contains pure parsing/decision helpers (
parseSandboxExecStdoutFrame,extractSandboxExecCommandStdout,buildSandboxExecMarkedCommand) with no host/process/OpenShell calls. Per thesrc/lib/README.mdlayering map, sandbox command/output framing & execution helpers should live undersrc/lib/sandbox/**, and the stack description itself refers to this file assandbox/sandbox-exec-output.ts(implyingsrc/lib/sandbox/), yet it's actually placed atsrc/lib/actions/sandbox/sandbox-exec-output.ts. Actions should orchestrate, not own parsing/policy logic.Consider moving this file to
src/lib/sandbox/sandbox-exec-output.tsand updating the import insnapshot.tsaccordingly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/actions/sandbox/sandbox-exec-output.ts` around lines 1 - 65, The sandbox exec parsing/command-framing helpers are in the wrong layer: `buildSandboxExecMarkedCommand`, `parseSandboxExecStdoutFrame`, and `extractSandboxExecCommandStdout` are pure sandbox utilities and should live under `src/lib/sandbox/**` instead of the `actions` tree. Move `sandbox-exec-output.ts` to the sandbox layer, then update the `snapshot.ts` import to the new location so the layering map stays consistent and actions remain orchestration-only.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/lib/actions/sandbox/sandbox-exec-output.ts`:
- Around line 1-65: The sandbox exec parsing/command-framing helpers are in the
wrong layer: `buildSandboxExecMarkedCommand`, `parseSandboxExecStdoutFrame`, and
`extractSandboxExecCommandStdout` are pure sandbox utilities and should live
under `src/lib/sandbox/**` instead of the `actions` tree. Move
`sandbox-exec-output.ts` to the sandbox layer, then update the `snapshot.ts`
import to the new location so the layering map stays consistent and actions
remain orchestration-only.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 2b06c1c3-e654-46d3-989e-c705859225e7
📒 Files selected for processing (4)
src/lib/actions/sandbox/sandbox-exec-output.test.tssrc/lib/actions/sandbox/sandbox-exec-output.tssrc/lib/actions/sandbox/snapshot.test.tssrc/lib/actions/sandbox/snapshot.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- src/lib/actions/sandbox/snapshot.ts
Contributor
Vitest E2E Target Results — ✅ All requested jobs passedRun: 28592106601
|
wscurran
added
integration: dcode
21 tasks
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
Vitest E2E Target Results — ✅ All selected jobs passedRun: 28641617259
|
cv
approved these changes
Jul 3, 2026
Contributor
Vitest E2E Target Results — ✅ All requested jobs passedRun: 28641754179
|
cv
added a commit
that referenced
this pull request
Jul 3, 2026
<!-- markdownlint-disable MD041 --> ## Summary This PR fixes the dcode snapshot idle-probe regression caused by OpenShell output framing and hardens the exec-output trust boundary against injected, duplicated, or conflicting marker/state output. It builds on and supersedes Tinson Lai's original implementation in #6190, with Tinson retained as a co-author on the hardening commit. ## Related Issue Fixes #6180 Supersedes #6190. ## Changes - Preserve stdout and stderr separately while accepting OpenShell-framed child output from either stream. - Generate a fresh marker per exec and require exactly one marker and one valid dcode probe state across both streams. - Use a non-login shell so profile startup output cannot influence the probe. - Fail closed on duplicate markers, duplicate/conflicting states, nonzero status, signals, or exec errors. - Add focused parser and snapshot tests for framing, cross-stream output, injection, ambiguity, and failure cases. - Credit Tinson Lai for the original fix: the #6190 commits remain intact and the new hardening commit includes `Co-authored-by: Tinson Lai <tinsonl@nvidia.com>`. Validation performed locally: - 37 focused snapshot/parser tests passed. - 23 process-recovery unit tests passed. - 23 process-recovery integration/primitives tests passed. - CLI type checking, Biome, diff checks, commit lint, and pre-push checks passed. - The broad CLI hook was attempted but encountered 105 unrelated local environment/baseline failures (including Node 26 deprecation stderr and missing packaged JSON5 tooling); none were in the four changed files. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: this restores the existing documented snapshot contract and changes only internal probe parsing and validation. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: local security-focused review covered marker ambiguity, cross-stream parsing, duplicate/conflicting states, login-shell startup output, and fail-closed outcomes; no blocking findings. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Apurv Kumaria <36614+apurvvkumaria@users.noreply.github.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added randomized execution markers for sandbox command wrapping and improved boundary validation during output detection. * Snapshot runtime checks now use marker-aware probing across captured streams to determine idle vs active more accurately. * **Bug Fixes** * Reduced false positives by requiring an exact single marker occurrence and rejecting missing, duplicate, or ambiguous matches. * Improved handling of framed stdout/stderr output, including correct extraction even when content spans streams. * **Tests** * Expanded sandbox execution output, stream parsing, and snapshot probe coverage with additional edge cases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Apurv Kumaria <36614+apurvvkumaria@users.noreply.github.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Tinson Lai <tinsonl@nvidia.com> Co-authored-by: Apurv Kumaria <36614+apurvvkumaria@users.noreply.github.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary This PR fixes the dcode snapshot idle-probe regression caused by OpenShell output framing and hardens the exec-output trust boundary against injected, duplicated, or conflicting marker/state output. It builds on and supersedes Tinson Lai's original implementation in NVIDIA#6190, with Tinson retained as a co-author on the hardening commit. ## Related Issue Fixes NVIDIA#6180 Supersedes NVIDIA#6190. ## Changes - Preserve stdout and stderr separately while accepting OpenShell-framed child output from either stream. - Generate a fresh marker per exec and require exactly one marker and one valid dcode probe state across both streams. - Use a non-login shell so profile startup output cannot influence the probe. - Fail closed on duplicate markers, duplicate/conflicting states, nonzero status, signals, or exec errors. - Add focused parser and snapshot tests for framing, cross-stream output, injection, ambiguity, and failure cases. - Credit Tinson Lai for the original fix: the NVIDIA#6190 commits remain intact and the new hardening commit includes `Co-authored-by: Tinson Lai <tinsonl@nvidia.com>`. Validation performed locally: - 37 focused snapshot/parser tests passed. - 23 process-recovery unit tests passed. - 23 process-recovery integration/primitives tests passed. - CLI type checking, Biome, diff checks, commit lint, and pre-push checks passed. - The broad CLI hook was attempted but encountered 105 unrelated local environment/baseline failures (including Node 26 deprecation stderr and missing packaged JSON5 tooling); none were in the four changed files. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: this restores the existing documented snapshot contract and changes only internal probe parsing and validation. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: local security-focused review covered marker ambiguity, cross-stream parsing, duplicate/conflicting states, login-shell startup output, and fail-closed outcomes; no blocking findings. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Apurv Kumaria <36614+apurvvkumaria@users.noreply.github.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added randomized execution markers for sandbox command wrapping and improved boundary validation during output detection. * Snapshot runtime checks now use marker-aware probing across captured streams to determine idle vs active more accurately. * **Bug Fixes** * Reduced false positives by requiring an exact single marker occurrence and rejecting missing, duplicate, or ambiguous matches. * Improved handling of framed stdout/stderr output, including correct extraction even when content spans streams. * **Tests** * Expanded sandbox execution output, stream parsing, and snapshot probe coverage with additional edge cases. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Apurv Kumaria <36614+apurvvkumaria@users.noreply.github.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Tinson Lai <tinsonl@nvidia.com> Co-authored-by: Apurv Kumaria <36614+apurvvkumaria@users.noreply.github.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
On OpenShell 0.0.71 the
nemoclaw <name> snapshot createpreflight refused every idle LangChain Deep Agents Code sandbox withCannot verify whether sandbox '<name>' is actively running a dcode task, blocking snapshot creation entirely. The dcode idleness guard parsed the rawopenshell sandbox execoutput with an anchored sentinel regex, but this OpenShell build frames child stdout asstdout: <line>, so the sentinel never matched and the guard failed closed on an idle sandbox.Related Issue
Fixes #6180
Changes
Type of Change
Quality Gates
snapshot createbehaviour for idle dcode sandboxes; no new command, flag, default, or output.Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpassesnpm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only)Signed-off-by: Tinson Lai tinsonl@nvidia.com
Summary by CodeRabbit