feat(deepagents-code): add dcode status and allow OpenShell TLS key in secret guard - #6202
Merged
Merged
Conversation
…n secret guard Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds dcode identity subcommands, relaxes secret checks for Changesdcode identity and environment handling
Estimated code review effort: 4 (Complex) | ~45 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-6202.docs.buildwithfern.com/nemoclaw |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
|
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
laitingsheng
added
feature
Contributor
PR Review Advisor (Nemotron Ultra) — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings Action checklist
Test follow-ups to resolve or justifyIf these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.
This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (2)
agents/langchain-deepagents-code/dcode-wrapper.sh (2)
311-324: 🎯 Functional Correctness | 🔵 Trivial | 💤 Low value
toml_scalaris not section-scoped, so it can grab a value from the wrong TOML table.
toml_scalarmatches the first line starting with"$key = \""anywhere inDEEPAGENTS_CONFIG_FILE, without regard to which[table]it belongs to. Today's generated config has a single[models.providers.openai]block sobase_urllookup happens to be correct, but if NemoClaw ever writes multiple provider blocks (e.g. NVIDIA + OpenAI),print_identitycould report the endpoint of the wrong provider relative to the selectedmodels.defaultmodel. Consider havingtoml_scalar(or a new helper) track the current[section]while scanning and only match within the section relevant to the active provider.Separately, the trailing-quote strip
${line%\"}only strips a"when the line ends with one; if there's ever trailing whitespace or an inline comment after the closing quote, the value returned will retain the extraneous suffix (including the quote) silently. Since this file is machine-generated per the docs, this is a low-probability edge case, but worth a defensive trim if the generator format ever changes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/langchain-deepagents-code/dcode-wrapper.sh` around lines 311 - 324, The toml_scalar helper is too broad and can return a value from the wrong TOML table, and its quote trimming is fragile. Update toml_scalar (or introduce a section-aware helper) to track the current [section] while reading DEEPAGENTS_CONFIG_FILE and only match the key within the active provider table used by print_identity/base_url lookup. Also make the value extraction robust against trailing whitespace or comments so the returned scalar is clean even if the generated TOML format changes.
252-252: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDuplicated allowlist-check pattern across both rejection paths.
The
has_credential_name_context "$name" && [ ${#value} -ge 10 ] && ! is_openshell_infra_key_name "$name"condition is repeated verbatim inassert_no_secret_runtime_envandassert_no_secret_env_file. Consider extracting a small helper (e.g.is_credential_name_violation) to keep the allowlist logic in one place as more exemptions get added.♻️ Suggested helper extraction
+is_credential_name_violation() { + local name="$1" value="$2" + has_credential_name_context "$name" && [ ${`#value`} -ge 10 ] && ! is_openshell_infra_key_name "$name" +} + assert_no_secret_runtime_env() { ... - if has_credential_name_context "$name" && [ ${`#value`} -ge 10 ] && ! is_openshell_infra_key_name "$name"; then + if is_credential_name_violation "$name" "$value"; then refuse_secret_env "runtime environment variable" "$name" fiAlso applies to: 302-302
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/langchain-deepagents-code/dcode-wrapper.sh` at line 252, The credential-name allowlist/rejection condition is duplicated in both assert_no_secret_runtime_env and assert_no_secret_env_file, so extract it into a shared helper such as is_credential_name_violation and use that helper in both rejection paths. Keep the existing symbols has_credential_name_context and is_openshell_infra_key_name as the basis for the helper logic so the exemption rules stay centralized and easier to extend.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@agents/langchain-deepagents-code/dcode-wrapper.sh`:
- Around line 311-324: The toml_scalar helper is too broad and can return a
value from the wrong TOML table, and its quote trimming is fragile. Update
toml_scalar (or introduce a section-aware helper) to track the current [section]
while reading DEEPAGENTS_CONFIG_FILE and only match the key within the active
provider table used by print_identity/base_url lookup. Also make the value
extraction robust against trailing whitespace or comments so the returned scalar
is clean even if the generated TOML format changes.
- Line 252: The credential-name allowlist/rejection condition is duplicated in
both assert_no_secret_runtime_env and assert_no_secret_env_file, so extract it
into a shared helper such as is_credential_name_violation and use that helper in
both rejection paths. Keep the existing symbols has_credential_name_context and
is_openshell_infra_key_name as the basis for the helper logic so the exemption
rules stay centralized and easier to extend.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c62a5e10-1815-4e24-9c93-fa33a0340560
📒 Files selected for processing (8)
agents/langchain-deepagents-code/dcode-wrapper.shagents/langchain-deepagents-code/start.shdocs/get-started/quickstart-langchain-deepagents-code.mdxsrc/lib/onboard.tssrc/lib/onboard/sandbox-create-launch.test.tssrc/lib/onboard/sandbox-create-launch.tstest/dcode-wrapper-identity.test.tstest/langchain-deepagents-code-image.test.ts
Read the sandbox name back out of the --name flag already present in createArgs instead of threading a new sandboxName field through prepareSandboxCreateLaunch. Keeps src/lib/onboard.ts at net-zero line growth, which codebase-growth-guardrails enforces for that file. Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
…infra-key-allowlist Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
Vitest E2E Target Results — ❌ Some jobs failedRun: 28612082745
|
Contributor
Vitest E2E Target Results — ✅ All selected jobs passedRun: 28612472044
|
Keep PR's new sandbox-name serialization test alongside main's renamed proxy test (#6191). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…env-file secret guard PRA-4: print_identity now reads the provider route from the NemoClaw config comment and emits a Provider: line, satisfying #6186's accepted shape for dcode status. PRA-3: remove is_openshell_infra_key_name exemption from assert_no_secret_env_file. OPENSHELL_TLS_KEY is injected by OpenShell at runtime, not user-set in .deepagents/.env; the exemption only belongs in assert_no_secret_runtime_env. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Collaborator
Resolution for PRA-3 and PRA-4 (96aa3c4)PRA-4 (required) — PRA-3 (resolve/justify) — |
…erns Travily API tokens use the tvly- prefix; add it to both has_non_slack_secret_shape() and is_secret_shaped_value() so they are caught by the runtime and .env secret guards. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Limit the runtime exception to OpenShell's canonical mounted key path, keep mutable .env files fail-closed, and cover Tavily token parity. Co-authored-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Use the validated sandbox name as the identity source, pin provider output and mutable-env rejection, and align the quickstart wording. Co-authored-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Inline the one-use messaging plan while passing the validated sandbox name, keeping the guarded onboard entrypoint net-neutral. Co-authored-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Collaborator
|
@coderabbitai review |
Contributor
✅ Action performedReview finished.
|
Collaborator
Review follow-up (
|
Co-authored-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
Vitest E2E Target Results — ✅ All selected jobs passedRun: 28628187947
|
Co-authored-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
Vitest E2E Target Results — ✅ All selected jobs passedRun: 28628464259
|
Co-authored-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
Vitest E2E Target Results — ✅ All selected jobs passedRun: 28628831873
|
Co-authored-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
Vitest E2E Target Results — ✅ All selected jobs passedRun: 28629125401
|
apurvvkumaria
approved these changes
Jul 3, 2026
apurvvkumaria
left a comment
apurvvkumaria
left a comment
Collaborator
There was a problem hiding this comment.
Re-reviewed at 4d52e7a. The active-agent identity, Route/Provider split, and managed help discoverability requests are resolved with regression coverage. All required checks and the exact-head Deep Agents Code live E2E pass; no blocking review threads remain.
Contributor
Vitest E2E Target Results — ✅ All selected jobs passedRun: 28629952892
|
22 tasks
cv
added a commit
that referenced
this pull request
Jul 3, 2026
## Summary Reverts #6202 from `main` so v0.0.73 retains the release boundary that was already documented and exercised by the release E2E run. PR #6202 remains targeted for v0.0.74. The resulting tree is byte-for-byte identical to commit `2276b2e1373548f9afa95b3a4f4bcd8db244874c` (`967ad0207b591bfc7f3398f37c230f199bb932ed`). ## Related Issue Release-boundary housekeeping for v0.0.73. Reverts #6202 without closing its related issues. ## Changes - Revert the Deep Agents Code `status`/identity wrapper commands introduced by #6202. - Revert the OpenShell TLS-key secret-guard exception introduced by #6202. - Revert the Deep Agents Code sandbox-name propagation and accompanying tests. - Remove the deferred user-facing `dcode status` documentation from the v0.0.73 tree. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior — exact revert restores the previously tested tree. - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes — #6202 documentation is reverted with the code. - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — the index tree exactly matches the pre-#6202 release tree, and no manual edits were made to the revert. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — no CI waiver requested; the local broad `test-cli` pre-commit hook was skipped after seven unrelated environment-sensitive baseline failures in Hermes file modes, managed-gateway trust state, and state-dir permission modes. Changed-area tests pass and PR CI remains required. ## Verification - [x] PR description includes the DCO sign-off declaration and the commit appears as `Verified` in GitHub. - [x] Normal pre-push hooks passed; all pre-commit hooks except the disclosed broad `test-cli` baseline lane passed. - [x] `npx vitest run --project cli src/lib/onboard/sandbox-create-launch.test.ts --silent=false --reporter=default` — 6/6 passed. - [x] `npx vitest run --project integration test/langchain-deepagents-code-image.test.ts --silent=false --reporter=default` — 53/53 passed. - [ ] Full `npm test` passes (broad runtime changes only) — not rerun; the broad hook's unrelated baseline failures are disclosed above. - [x] Quality Gates section completed with required justifications or waivers. - [x] No secrets, API keys, or credentials committed. - [x] `npm run docs` passes with 0 errors and two pre-existing Fern warnings. - [x] Doc pages follow the style guide. - [ ] New doc pages include SPDX header and frontmatter — no new doc pages. --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Additional environment details are now carried into runtime setup for better tracing and project context. * **Bug Fixes** * Tightened secret-detection and runtime-value checks to reduce the chance of sensitive values being accepted. * Improved sandbox launch behavior by simplifying how launch settings are prepared. * **Documentation** * Removed outdated guidance about checking the current sandbox from the quickstart. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Carlos Villela <cvillela@nvidia.com>
22 tasks
21 tasks
21 tasks
21 tasks
cv
added a commit
that referenced
this pull request
Jul 3, 2026
<!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 sentences: what this PR does and why. --> Restores #6202 now that v0.0.73 has been tagged. This reintroduces `dcode status` identity reporting, managed help, the exact OpenShell TLS-key runtime allowance, sandbox-name propagation, and their docs and tests for v0.0.74, with focused follow-ups that suppress private-key-shaped or encoded-credential metadata and fail closed on malformed or unsupported identity config scalars. ## Related Issue <!-- Fixes #NNN or Closes #NNN. Remove this section if none. --> Restores #6202 after the release-boundary revert in #6223. Related to #6189, #6186, and the complementary runtime hardening in #6082. ## Changes <!-- Bullet list of key changes. --> - Restore `dcode status`, `dcode whoami`, and `dcode identity` without launching the interactive UI. - Restore the exact runtime-only `OPENSHELL_TLS_KEY=/etc/openshell/tls/client/tls.key` allowance while keeping arbitrary paths, values, PEM material, and persisted `.env` entries fail-closed. - Restore Tavily and context-shaped secret detection in the managed Deep Agents Code wrapper. - Mirror canonical private-key block detection before mutable config or runtime metadata can reach `dcode status`, including the managed Slack early-allowlist path, and scan the complete mutable `.deepagents/.env` so raw multiline blocks cannot evade per-line classification. - Reject literal, escaped, percent-encoded, and double-encoded query, fragment, and userinfo delimiters before endpoint metadata can reach `dcode status`. - Restrict the informational TOML reader to known generated sections and complete quoted scalars so malformed, commented, array, and unsupported nested values fall back safely instead of being displayed. - Restore Deep Agents Code sandbox-name propagation through onboarding and startup state. - Restore the original #6202 quickstart documentation, identity tests, secret-boundary tests, and shared fixture, then add a composed onboarding → `start.sh` → `dcode status` handoff test. - Record the #6082 rebase contract: #6232's managed-proxy and secret-filtering paths remain authoritative while #6082's runtime upgrade, auth-store, and mutation-command work layers on afterward. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior — restores the original #6202 identity, secret-boundary, image-contract, and onboarding coverage; adds canonical private-key parity, malformed/unsupported config, encoded endpoint, and composed sandbox-name handoff cases. - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes — restores the original `dcode status` quickstart section. - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — the restoration commit exactly matches the previously reviewed #6202 tree; independent reproduction confirmed the advisor-reported private-key status leak, and focused follow-ups mirror the canonical block pattern, reject raw multiline `.env` key blocks and encoded endpoint delimiters, and fail closed on malformed generated scalars with status, parity, managed-Slack, composed-handoff, no-launch, redaction, and secret-scanner coverage. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — no CI waiver requested; required remote checks remain mandatory. ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub. - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes — all commit hooks except the disclosed local `test-cli` environment-sensitive baseline lane passed; normal pre-push CLI typecheck and tag-version synchronization passed. - [x] Targeted tests pass for changed behavior — onboarding 8/8 and Deep Agents Code wrapper/image/composed-handoff tests 77/77 after review follow-ups; CLI typecheck, ShellCheck, Biome, test-size/project-overlap gates, detect-private-key, and gitleaks also pass. - [x] Required exact-head live E2Es pass on attempt 1 — `ubuntu-repo-cloud-langchain-deepagents-code` and `cloud-onboard` at `a503d95a81094cd3415ce933b64a0213a4d3aa2d`. - [ ] Full `npm test` passes (broad runtime changes only) — not rerun; remote CI remains required. - [x] Quality Gates section completed with required justifications or waivers. - [x] No secrets, API keys, or credentials committed. - [ ] `npm run docs` builds without warnings (doc changes only) — build passed with 0 errors and two pre-existing Fern warnings. - [x] Doc pages follow the style guide; independent docs review found no additional changes needed. - [ ] New doc pages include SPDX header and frontmatter — no new doc pages. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
27 tasks
cv
pushed a commit
that referenced
this pull request
Jul 3, 2026
<!-- markdownlint-disable MD041 --> ## Summary NemoClaw `v0.0.74` will ship stable OpenShell `v0.0.72`. This dependency layer advances the supported OpenShell contract from `0.0.71` to `0.0.72`, pins every consumed release artifact, preserves round-trippable policy state, and hardens installer verification so pull-request code cannot authorize its own pins. ## Related Issue Refs #5591. Follow-up to merged #5596. Dependency layer for #5876 and the accepted MCP design in #566. ## Changes - Pin stable OpenShell `0.0.72` across the supported version floor/ceiling, installer, Brev launchable, blueprint, supervisor image, workflow, and live-E2E contracts. OpenShell development builds remain compatibility evidence, not the shipping runtime. - Pin all consumed CLI, gateway, and sandbox archives plus both Brev CLI references to the official `v0.0.72` checksum manifests. - Read mutation input from `openshell policy get --base`, strip reserved `_provider_*` entries before `policy set`, retain `--full` only for read-only diagnostics, and preserve future mapping sections plus MCP/JSON-RPC fields during merges. - Route the CommonJS CLI and ESM plugin through one generated OpenShell policy boundary and exact-pin `yaml` `2.8.3` in both production package graphs. - Normalize that boundary for both compiled CommonJS and source-mode `tsx` loading. A subprocess package-contract test reproduces the live source-loader path that exposed the mismatch. - Run installer verification from base-trusted code. The introducing PR falls back only to immutable commit `cb5e9aefab2b16fedc0995149fc3520da0d5e0c7`, verified as tree `1fdf59efe40b78c407e222fd42043b23a61e199a`, with an enforced expiry at `2026-12-29T19:35:41Z`. - Treat PR-head installer files as data only. The trusted parser rejects symbolic links, a symbolic-link `scripts` parent, non-regular files, changed inode/device identity, and input over 1 MiB; it opens with `O_NOFOLLOW` and performs a bounded descriptor read. - Fail installer verification closed on missing, duplicate, mismatched, incomplete, or unreachable OpenShell/Brev pin data. - Publish the OpenShell `0.0.72` compatibility review and align version, policy, gateway-authentication, and troubleshooting documentation. ### Exact-head evidence - PR head: `2d06fa01b624b63813fe558ce36b29d47ad31e36`, based exactly on current `main` `dc96deb24d67eeeb2cb7b2bb42c7c53f000507f3`. The final signed merge incorporates the release-boundary revert that defers unrelated dcode-status work, so this dependency PR does not reintroduce #6202 outside its scope. - GitHub verifies the new merge commit signature, DCO is green, the prior maintainer approval remains recorded at [review 4611344448](#6020 (review)), and GitHub reports the PR graph as `MERGEABLE`. - Post-restack local validation passes `build:cli`, full and CLI typechecks, repository checks, generated agent-doc synchronization, affected Deep Agents image contracts, and `git diff --check`. - All exact-head ordinary PR checks are terminal green (33 successful, three skipped/neutral, zero failures), including macOS/WSL E2E, every CLI shard and aggregate, static/security scans, DCO, and both PR Review Advisor jobs. GitHub reports `APPROVED` and `MERGEABLE/CLEAN`. - Exact-head selected OpenShell [E2E run 28632123304](https://github.com/NVIDIA/NemoClaw/actions/runs/28632123304) is terminal green: version pin, gateway-auth contract, network policy, gateway upgrade/state restoration, scorecard, and the no-comment reporter all passed from a temporary no-PR ref at the identical commit. The temporary ref was deleted after completion. - Exact-head PR Review [run 28632002111](https://github.com/NVIDIA/NemoClaw/actions/runs/28632002111) and E2E Advisor [run 28632002140](https://github.com/NVIDIA/NemoClaw/actions/runs/28632002140) are green. GPT reports no actionable finding; Nemotron's check passed but both JSON synthesis attempts were unparseable, so that model's artifact is incomplete rather than clearance. E2E Advisor reports high confidence and selects the four live lanes linked above. ### Trust-boundary notes - The immutable bootstrap is intentionally used only while the PR base lacks the trusted action. Once that action exists on the base, executing the newer base-trusted verifier is the stronger boundary; the expiring bootstrap should then be removed rather than run redundantly. - No untrusted PR process executes alongside the parser. GitHub checks out inert PR data, then trusted code validates and reads the already-opened descriptor. The link/type/identity/bounds checks cover repository-controlled redirection and exhaustion inputs without claiming protection from a privileged concurrent host writer. - Stable OpenShell `0.0.72` accepts an unmarked policy root only when it contains `version` or `network_policies`; metadata-only and malformed documents fail closed. Versionless `network_policies` is retained for the supported compatibility contract. ### Advisor disposition - GPT reported no required findings and one warning about the mutable default `BASE_IMAGE` tag. That `ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/sandbox-base:latest` line is unchanged from current `main`; this dependency PR neither introduces nor broadens that repository-wide build default. - Nemotron's bootstrap finding would weaken the intended trust transition: the immutable bootstrap exists only for the introducing PR. Once the action is present on the base, the newer base-trusted action must replace the older bootstrap; both paths are immutable for the current event and are contract-tested. - Nemotron's parser race assumes an untrusted concurrent filesystem writer. PR code is never executed in this job: GitHub checks out inert data, then trusted code rejects links/special files, checks the opened descriptor's device/inode, bounds the read, and closes it. A privileged host writer is outside this PR-input threat model. - Nemotron's checksum finding is not circular. The trusted checker pins the SHA-256 of each upstream checksum manifest, verifies that immutable manifest before reading it, and compares every embedded installer pin with exactly one manifest entry. At install time each named archive must exist and match its pinned digest, so a missing asset still fails closed without downloading all archives during every PR check. - The generated-boundary auditor executes in the Docker builder stage exercised by ordinary `build-sandbox-images` CI. The exact source-mode `.cts` versus generated `.cjs` mismatch found by live proof is now covered directly by the subprocess package-contract test and the compiled runner suites. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: policy mutation, package boundary, installer trust, workflow selection, and runtime upgrade/state-restoration have focused coverage; final selected E2E is linked above. - [ ] Tests not applicable — justification: not applicable; this changes security-sensitive installer, policy, and runtime compatibility behavior. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: not applicable; supported OpenShell versions and policy behavior are user-facing. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: the linked approval predates the current head; exact-head human review or an explicit carried-approval decision remains required, and no waiver is requested. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: no waiver is requested; exact-head ordinary CI is green, and the selected run's comment-only reporter caveat is documented above and is not a required PR check. ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [x] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> Signed-off-by: Preksha Vyas <prekshiv@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
cv
pushed a commit
that referenced
this pull request
Jul 4, 2026
<!-- markdownlint-disable MD041 --> ## Summary Adds a best-effort maintainer advisory when the same GitHub account is both a current PR contributor and an effective approver. The warning is intentionally non-blocking: it does not invalidate approval, require a third reviewer, publish a failing check, or change merge readiness. This replaces the earlier hard-gate draft with the narrow diagnostic behavior accepted in review and hardens it against automated identities, incomplete review timestamps, and truncated commit/review snapshots. ## Related Issue Refs #6222 ## Changes - Compare the PR opener and every paginated current commit author/co-author with each reviewer's latest opinionated review across all review pages. - Ignore automated identities and later `COMMENTED` reviews when determining effective human approvals. - Order valid review timestamps deterministically and surface an uncertainty warning for missing, invalid, or conflicting timestamps. - Warn instead of returning a false clear when complete paginated history cannot be retrieved, including an outer connection-count mismatch or truncated nested co-author list. - Return overlap under `advisories.contributorApprovalOverlap` while leaving `allPass` unchanged. - Document the current-snapshot source boundary, diagnostic-only policy decision, regression scope, and removal condition. - Cover opener, author/co-author, case-normalization, bot, review-transition, dismissal, ordering, incomplete-timestamp, pagination, and incomplete-history scenarios with named tests. - Keep the accepted non-goals: no GitHub App, contributor ledger, reconciler, scheduled workflow, required check, branch-protection change, approval invalidation, or claim that this solves PR #6202's separate merge-authorization boundary. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: no end-user behavior changes; the internal maintainer workflow is documented at its operator surface in `MERGE-GATE.md` and `SKILL.md`, and the documentation-writer pass found no `docs/` impact. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: focused implementation and edge-case audits confirmed the advisory remains separate from hard gates and `allPass`; the source boundary and accepted narrow scope are documented and regression-tested. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes — all changed-file and pre-push hooks passed except the broad local `test-cli` hook, which hit unrelated Node 26/macOS/Python baseline failures; GitHub CI remains authoritative. - [x] Targeted tests pass for changed behavior — 34 tests in `test/skills/check-gates-compliance.test.ts`; `npm run typecheck:cli`, plugin build, test-title check, source-shape check, Biome, and `git diff --check` also pass. - [ ] Full `npm test` passes (broad runtime changes only) — not claimed; this is an internal maintainer-tool change and the unrelated local baseline failures are described above. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added `contributor/approver overlap` as a non-blocking advisory in merge gate results. * Updated merge-maintainer guidance to re-run the gate after approval and include the advisory in the readiness summary (without affecting merge readiness). * **Bug Fixes** * Improved evaluation of contributor approval overlap, including paginated history, automated identities, and ambiguous/malformed review timestamps. * **Tests** * Expanded compliance fixtures and added coverage for clear vs warning advisory outcomes, pagination aggregation, superseding/dismissal logic, and uncertainty handling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
…n secret guard (NVIDIA#6202) ## Summary Adds a `dcode status` identity command to the managed LangChain Deep Agents Code wrapper so a user connected into a sandbox can tell which sandbox the session is in, and fixes the wrapper secret guard falsely refusing to start when OpenShell injects its canonical TLS client-key path after a credential provider is attached. ## Related Issue Fixes NVIDIA#6189 Resolves NVIDIA#6186 ## Changes - `agents/langchain-deepagents-code/dcode-wrapper.sh`: add a `status` / `whoami` / `identity` subcommand that distinguishes the sandbox, NemoClaw harness, active dcode agent, inference route, upstream provider, model, endpoint, and runtime, then exits without launching Deep Agents Code; advertise the managed aliases in `dcode --help`. - `agents/langchain-deepagents-code/dcode-wrapper.sh`: allow only the exact runtime pair `OPENSHELL_TLS_KEY=/etc/openshell/tls/client/tls.key`; alternate paths, opaque values, PEM material, and provider tokens remain rejected. - Keep `.deepagents/.env` fail-closed: the OpenShell runtime exception does not apply to the user-mutable env file. - Add `tvly-` Tavily tokens to the secret-shape detection patterns. - `src/lib/onboard/sandbox-create-launch.ts`, `src/lib/onboard.ts`: forward `NEMOCLAW_SANDBOX_NAME` into the Deep Agents Code sandbox create env (gated to the `langchain-deepagents-code` agent). - `agents/langchain-deepagents-code/start.sh`: persist `NEMOCLAW_SANDBOX_NAME` into the shared runtime env file that connect shells and the wrapper source, so `dcode status` resolves the name. - `docs/get-started/quickstart-langchain-deepagents-code.mdx`: document `dcode status`. - Tests: wrapper identity and agent-preference resolution, managed help, exact runtime-pair acceptance, negative secret/path cases, mutable-env rejection, sandbox-create env injection, and start.sh serialization. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: reviewed against the repository security checklist; the exception is limited to one exact runtime name/value pair, values are never logged, mutable env files remain fail-closed, and Linux tests cover alternate paths, PEM material, opaque values, and provider tokens. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes — pre-push hooks and scoped checks pass; the broad pre-commit test hook encounters unrelated environment-sensitive baseline failures. - [x] Targeted tests pass for changed behavior - [x] Required live Deep Agents Code E2E passes on the PR branch - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — build passes with two pre-existing warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added `dcode status`, `dcode whoami`, and `dcode identity` to show the active sandbox/session identity and exit without launching the interactive UI. * Sandboxes for supported Deep Agents Code runs can now propagate a sandbox name into the runtime environment. * **Bug Fixes** * Strengthened runtime secret/credential checks by allowing only OpenShell’s exact mounted TLS-key keypair, and correctly rejecting additional secret-shaped Tavily token formats. * **Documentation** * Updated the Quickstart “Use the Harness” guide with the new identity/status workflow and command aliases. * **Tests** * Added and expanded coverage for identity/status output, secret gating, TLS-key allowlisting behavior, and sandbox name propagation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Apurv Kumaria <akumaria@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> --------- Signed-off-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Apurv Kumaria <akumaria@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Reverts NVIDIA#6202 from `main` so v0.0.73 retains the release boundary that was already documented and exercised by the release E2E run. PR NVIDIA#6202 remains targeted for v0.0.74. The resulting tree is byte-for-byte identical to commit `2276b2e1373548f9afa95b3a4f4bcd8db244874c` (`967ad0207b591bfc7f3398f37c230f199bb932ed`). ## Related Issue Release-boundary housekeeping for v0.0.73. Reverts NVIDIA#6202 without closing its related issues. ## Changes - Revert the Deep Agents Code `status`/identity wrapper commands introduced by NVIDIA#6202. - Revert the OpenShell TLS-key secret-guard exception introduced by NVIDIA#6202. - Revert the Deep Agents Code sandbox-name propagation and accompanying tests. - Remove the deferred user-facing `dcode status` documentation from the v0.0.73 tree. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior — exact revert restores the previously tested tree. - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes — NVIDIA#6202 documentation is reverted with the code. - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — the index tree exactly matches the pre-NVIDIA#6202 release tree, and no manual edits were made to the revert. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — no CI waiver requested; the local broad `test-cli` pre-commit hook was skipped after seven unrelated environment-sensitive baseline failures in Hermes file modes, managed-gateway trust state, and state-dir permission modes. Changed-area tests pass and PR CI remains required. ## Verification - [x] PR description includes the DCO sign-off declaration and the commit appears as `Verified` in GitHub. - [x] Normal pre-push hooks passed; all pre-commit hooks except the disclosed broad `test-cli` baseline lane passed. - [x] `npx vitest run --project cli src/lib/onboard/sandbox-create-launch.test.ts --silent=false --reporter=default` — 6/6 passed. - [x] `npx vitest run --project integration test/langchain-deepagents-code-image.test.ts --silent=false --reporter=default` — 53/53 passed. - [ ] Full `npm test` passes (broad runtime changes only) — not rerun; the broad hook's unrelated baseline failures are disclosed above. - [x] Quality Gates section completed with required justifications or waivers. - [x] No secrets, API keys, or credentials committed. - [x] `npm run docs` passes with 0 errors and two pre-existing Fern warnings. - [x] Doc pages follow the style guide. - [ ] New doc pages include SPDX header and frontmatter — no new doc pages. --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Additional environment details are now carried into runtime setup for better tracing and project context. * **Bug Fixes** * Tightened secret-detection and runtime-value checks to reduce the chance of sensitive values being accepted. * Improved sandbox launch behavior by simplifying how launch settings are prepared. * **Documentation** * Removed outdated guidance about checking the current sandbox from the quickstart. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 sentences: what this PR does and why. --> Restores NVIDIA#6202 now that v0.0.73 has been tagged. This reintroduces `dcode status` identity reporting, managed help, the exact OpenShell TLS-key runtime allowance, sandbox-name propagation, and their docs and tests for v0.0.74, with focused follow-ups that suppress private-key-shaped or encoded-credential metadata and fail closed on malformed or unsupported identity config scalars. ## Related Issue <!-- Fixes #NNN or Closes #NNN. Remove this section if none. --> Restores NVIDIA#6202 after the release-boundary revert in NVIDIA#6223. Related to NVIDIA#6189, NVIDIA#6186, and the complementary runtime hardening in NVIDIA#6082. ## Changes <!-- Bullet list of key changes. --> - Restore `dcode status`, `dcode whoami`, and `dcode identity` without launching the interactive UI. - Restore the exact runtime-only `OPENSHELL_TLS_KEY=/etc/openshell/tls/client/tls.key` allowance while keeping arbitrary paths, values, PEM material, and persisted `.env` entries fail-closed. - Restore Tavily and context-shaped secret detection in the managed Deep Agents Code wrapper. - Mirror canonical private-key block detection before mutable config or runtime metadata can reach `dcode status`, including the managed Slack early-allowlist path, and scan the complete mutable `.deepagents/.env` so raw multiline blocks cannot evade per-line classification. - Reject literal, escaped, percent-encoded, and double-encoded query, fragment, and userinfo delimiters before endpoint metadata can reach `dcode status`. - Restrict the informational TOML reader to known generated sections and complete quoted scalars so malformed, commented, array, and unsupported nested values fall back safely instead of being displayed. - Restore Deep Agents Code sandbox-name propagation through onboarding and startup state. - Restore the original NVIDIA#6202 quickstart documentation, identity tests, secret-boundary tests, and shared fixture, then add a composed onboarding → `start.sh` → `dcode status` handoff test. - Record the NVIDIA#6082 rebase contract: NVIDIA#6232's managed-proxy and secret-filtering paths remain authoritative while NVIDIA#6082's runtime upgrade, auth-store, and mutation-command work layers on afterward. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check all that apply. For any "covered by existing tests", "not applicable", or waiver entry, add a brief justification on the same line or in the Changes section. --> - [x] Tests added or updated for changed behavior — restores the original NVIDIA#6202 identity, secret-boundary, image-contract, and onboarding coverage; adds canonical private-key parity, malformed/unsupported config, encoded endpoint, and composed sandbox-name handoff cases. - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes — restores the original `dcode status` quickstart section. - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — the restoration commit exactly matches the previously reviewed NVIDIA#6202 tree; independent reproduction confirmed the advisor-reported private-key status leak, and focused follow-ups mirror the canonical block pattern, reject raw multiline `.env` key blocks and encoded endpoint delimiters, and fail closed on malformed generated scalars with status, parity, managed-Slack, composed-handoff, no-launch, redaction, and secret-scanner coverage. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — no CI waiver requested; required remote checks remain mandatory. ## Verification <!-- Check each item you ran and confirmed. Leave unchecked items you skipped. Doc-only changes do not require npm test unless you ran it. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub. - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes — all commit hooks except the disclosed local `test-cli` environment-sensitive baseline lane passed; normal pre-push CLI typecheck and tag-version synchronization passed. - [x] Targeted tests pass for changed behavior — onboarding 8/8 and Deep Agents Code wrapper/image/composed-handoff tests 77/77 after review follow-ups; CLI typecheck, ShellCheck, Biome, test-size/project-overlap gates, detect-private-key, and gitleaks also pass. - [x] Required exact-head live E2Es pass on attempt 1 — `ubuntu-repo-cloud-langchain-deepagents-code` and `cloud-onboard` at `a503d95a81094cd3415ce933b64a0213a4d3aa2d`. - [ ] Full `npm test` passes (broad runtime changes only) — not rerun; remote CI remains required. - [x] Quality Gates section completed with required justifications or waivers. - [x] No secrets, API keys, or credentials committed. - [ ] `npm run docs` builds without warnings (doc changes only) — build passed with 0 errors and two pre-existing Fern warnings. - [x] Doc pages follow the style guide; independent docs review found no additional changes needed. - [ ] New doc pages include SPDX header and frontmatter — no new doc pages. --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Carlos Villela <cvillela@nvidia.com> --------- Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary NemoClaw `v0.0.74` will ship stable OpenShell `v0.0.72`. This dependency layer advances the supported OpenShell contract from `0.0.71` to `0.0.72`, pins every consumed release artifact, preserves round-trippable policy state, and hardens installer verification so pull-request code cannot authorize its own pins. ## Related Issue Refs NVIDIA#5591. Follow-up to merged NVIDIA#5596. Dependency layer for NVIDIA#5876 and the accepted MCP design in NVIDIA#566. ## Changes - Pin stable OpenShell `0.0.72` across the supported version floor/ceiling, installer, Brev launchable, blueprint, supervisor image, workflow, and live-E2E contracts. OpenShell development builds remain compatibility evidence, not the shipping runtime. - Pin all consumed CLI, gateway, and sandbox archives plus both Brev CLI references to the official `v0.0.72` checksum manifests. - Read mutation input from `openshell policy get --base`, strip reserved `_provider_*` entries before `policy set`, retain `--full` only for read-only diagnostics, and preserve future mapping sections plus MCP/JSON-RPC fields during merges. - Route the CommonJS CLI and ESM plugin through one generated OpenShell policy boundary and exact-pin `yaml` `2.8.3` in both production package graphs. - Normalize that boundary for both compiled CommonJS and source-mode `tsx` loading. A subprocess package-contract test reproduces the live source-loader path that exposed the mismatch. - Run installer verification from base-trusted code. The introducing PR falls back only to immutable commit `cb5e9aefab2b16fedc0995149fc3520da0d5e0c7`, verified as tree `1fdf59efe40b78c407e222fd42043b23a61e199a`, with an enforced expiry at `2026-12-29T19:35:41Z`. - Treat PR-head installer files as data only. The trusted parser rejects symbolic links, a symbolic-link `scripts` parent, non-regular files, changed inode/device identity, and input over 1 MiB; it opens with `O_NOFOLLOW` and performs a bounded descriptor read. - Fail installer verification closed on missing, duplicate, mismatched, incomplete, or unreachable OpenShell/Brev pin data. - Publish the OpenShell `0.0.72` compatibility review and align version, policy, gateway-authentication, and troubleshooting documentation. ### Exact-head evidence - PR head: `2d06fa01b624b63813fe558ce36b29d47ad31e36`, based exactly on current `main` `dc96deb24d67eeeb2cb7b2bb42c7c53f000507f3`. The final signed merge incorporates the release-boundary revert that defers unrelated dcode-status work, so this dependency PR does not reintroduce NVIDIA#6202 outside its scope. - GitHub verifies the new merge commit signature, DCO is green, the prior maintainer approval remains recorded at [review 4611344448](NVIDIA#6020 (review)), and GitHub reports the PR graph as `MERGEABLE`. - Post-restack local validation passes `build:cli`, full and CLI typechecks, repository checks, generated agent-doc synchronization, affected Deep Agents image contracts, and `git diff --check`. - All exact-head ordinary PR checks are terminal green (33 successful, three skipped/neutral, zero failures), including macOS/WSL E2E, every CLI shard and aggregate, static/security scans, DCO, and both PR Review Advisor jobs. GitHub reports `APPROVED` and `MERGEABLE/CLEAN`. - Exact-head selected OpenShell [E2E run 28632123304](https://github.com/NVIDIA/NemoClaw/actions/runs/28632123304) is terminal green: version pin, gateway-auth contract, network policy, gateway upgrade/state restoration, scorecard, and the no-comment reporter all passed from a temporary no-PR ref at the identical commit. The temporary ref was deleted after completion. - Exact-head PR Review [run 28632002111](https://github.com/NVIDIA/NemoClaw/actions/runs/28632002111) and E2E Advisor [run 28632002140](https://github.com/NVIDIA/NemoClaw/actions/runs/28632002140) are green. GPT reports no actionable finding; Nemotron's check passed but both JSON synthesis attempts were unparseable, so that model's artifact is incomplete rather than clearance. E2E Advisor reports high confidence and selects the four live lanes linked above. ### Trust-boundary notes - The immutable bootstrap is intentionally used only while the PR base lacks the trusted action. Once that action exists on the base, executing the newer base-trusted verifier is the stronger boundary; the expiring bootstrap should then be removed rather than run redundantly. - No untrusted PR process executes alongside the parser. GitHub checks out inert PR data, then trusted code validates and reads the already-opened descriptor. The link/type/identity/bounds checks cover repository-controlled redirection and exhaustion inputs without claiming protection from a privileged concurrent host writer. - Stable OpenShell `0.0.72` accepts an unmarked policy root only when it contains `version` or `network_policies`; metadata-only and malformed documents fail closed. Versionless `network_policies` is retained for the supported compatibility contract. ### Advisor disposition - GPT reported no required findings and one warning about the mutable default `BASE_IMAGE` tag. That `ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/sandbox-base:latest` line is unchanged from current `main`; this dependency PR neither introduces nor broadens that repository-wide build default. - Nemotron's bootstrap finding would weaken the intended trust transition: the immutable bootstrap exists only for the introducing PR. Once the action is present on the base, the newer base-trusted action must replace the older bootstrap; both paths are immutable for the current event and are contract-tested. - Nemotron's parser race assumes an untrusted concurrent filesystem writer. PR code is never executed in this job: GitHub checks out inert data, then trusted code rejects links/special files, checks the opened descriptor's device/inode, bounds the read, and closes it. A privileged host writer is outside this PR-input threat model. - Nemotron's checksum finding is not circular. The trusted checker pins the SHA-256 of each upstream checksum manifest, verifies that immutable manifest before reading it, and compares every embedded installer pin with exactly one manifest entry. At install time each named archive must exist and match its pinned digest, so a missing asset still fails closed without downloading all archives during every PR check. - The generated-boundary auditor executes in the Docker builder stage exercised by ordinary `build-sandbox-images` CI. The exact source-mode `.cts` versus generated `.cjs` mismatch found by live proof is now covered directly by the subprocess package-contract test and the compiled runner suites. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: policy mutation, package boundary, installer trust, workflow selection, and runtime upgrade/state-restoration have focused coverage; final selected E2E is linked above. - [ ] Tests not applicable — justification: not applicable; this changes security-sensitive installer, policy, and runtime compatibility behavior. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: not applicable; supported OpenShell versions and policy behavior are user-facing. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: the linked approval predates the current head; exact-head human review or an explicit carried-approval decision remains required, and no waiver is requested. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: no waiver is requested; exact-head ordinary CI is green, and the selected run's comment-only reporter caveat is documented above and is not a required PR check. ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [x] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> Signed-off-by: Preksha Vyas <prekshiv@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Adds a best-effort maintainer advisory when the same GitHub account is both a current PR contributor and an effective approver. The warning is intentionally non-blocking: it does not invalidate approval, require a third reviewer, publish a failing check, or change merge readiness. This replaces the earlier hard-gate draft with the narrow diagnostic behavior accepted in review and hardens it against automated identities, incomplete review timestamps, and truncated commit/review snapshots. ## Related Issue Refs NVIDIA#6222 ## Changes - Compare the PR opener and every paginated current commit author/co-author with each reviewer's latest opinionated review across all review pages. - Ignore automated identities and later `COMMENTED` reviews when determining effective human approvals. - Order valid review timestamps deterministically and surface an uncertainty warning for missing, invalid, or conflicting timestamps. - Warn instead of returning a false clear when complete paginated history cannot be retrieved, including an outer connection-count mismatch or truncated nested co-author list. - Return overlap under `advisories.contributorApprovalOverlap` while leaving `allPass` unchanged. - Document the current-snapshot source boundary, diagnostic-only policy decision, regression scope, and removal condition. - Cover opener, author/co-author, case-normalization, bot, review-transition, dismissal, ordering, incomplete-timestamp, pagination, and incomplete-history scenarios with named tests. - Keep the accepted non-goals: no GitHub App, contributor ledger, reconciler, scheduled workflow, required check, branch-protection change, approval invalidation, or claim that this solves PR NVIDIA#6202's separate merge-authorization boundary. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: no end-user behavior changes; the internal maintainer workflow is documented at its operator surface in `MERGE-GATE.md` and `SKILL.md`, and the documentation-writer pass found no `docs/` impact. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: focused implementation and edge-case audits confirmed the advisory remains separate from hard gates and `allPass`; the source boundary and accepted narrow scope are documented and regression-tested. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes — all changed-file and pre-push hooks passed except the broad local `test-cli` hook, which hit unrelated Node 26/macOS/Python baseline failures; GitHub CI remains authoritative. - [x] Targeted tests pass for changed behavior — 34 tests in `test/skills/check-gates-compliance.test.ts`; `npm run typecheck:cli`, plugin build, test-title check, source-shape check, Biome, and `git diff --check` also pass. - [ ] Full `npm test` passes (broad runtime changes only) — not claimed; this is an internal maintainer-tool change and the unrelated local baseline failures are described above. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added `contributor/approver overlap` as a non-blocking advisory in merge gate results. * Updated merge-maintainer guidance to re-run the gate after approval and include the advisory in the readiness summary (without affecting merge readiness). * **Bug Fixes** * Improved evaluation of contributor approval overlap, including paginated history, automated identities, and ambiguous/malformed review timestamps. * **Tests** * Expanded compliance fixtures and added coverage for clear vs warning advisory outcomes, pagination aggregation, superseding/dismissal logic, and uncertainty handling. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
dcode statusidentity command to the managed LangChain Deep Agents Code wrapper so a user connected into a sandbox can tell which sandbox the session is in, and fixes the wrapper secret guard falsely refusing to start when OpenShell injects its canonical TLS client-key path after a credential provider is attached.Related Issue
Fixes #6189
Resolves #6186
Changes
agents/langchain-deepagents-code/dcode-wrapper.sh: add astatus/whoami/identitysubcommand that distinguishes the sandbox, NemoClaw harness, active dcode agent, inference route, upstream provider, model, endpoint, and runtime, then exits without launching Deep Agents Code; advertise the managed aliases indcode --help.agents/langchain-deepagents-code/dcode-wrapper.sh: allow only the exact runtime pairOPENSHELL_TLS_KEY=/etc/openshell/tls/client/tls.key; alternate paths, opaque values, PEM material, and provider tokens remain rejected..deepagents/.envfail-closed: the OpenShell runtime exception does not apply to the user-mutable env file.tvly-Tavily tokens to the secret-shape detection patterns.src/lib/onboard/sandbox-create-launch.ts,src/lib/onboard.ts: forwardNEMOCLAW_SANDBOX_NAMEinto the Deep Agents Code sandbox create env (gated to thelangchain-deepagents-codeagent).agents/langchain-deepagents-code/start.sh: persistNEMOCLAW_SANDBOX_NAMEinto the shared runtime env file that connect shells and the wrapper source, sodcode statusresolves the name.docs/get-started/quickstart-langchain-deepagents-code.mdx: documentdcode status.Type of Change
Quality Gates
Verification
Verifiedin GitHubnpx prek run --from-ref main --to-ref HEADpasses — pre-push hooks and scoped checks pass; the broad pre-commit test hook encounters unrelated environment-sensitive baseline failures.npm testpasses (broad runtime changes only)npm run docsbuilds without warnings (doc changes only) — build passes with two pre-existing warnings.Signed-off-by: Tinson Lai tinsonl@nvidia.com
Signed-off-by: Apurv Kumaria akumaria@nvidia.com
Summary by CodeRabbit
dcode status,dcode whoami, anddcode identityto show the active sandbox/session identity and exit without launching the interactive UI.Co-authored-by: Apurv Kumaria akumaria@nvidia.com
Co-authored-by: Prekshi Vyas prekshiv@nvidia.com