fix(dcode): stop persisting LangSmith variables by ericksoa · Pull Request #6219 · NVIDIA/NemoClaw

ericksoa · 2026-07-03T00:04:28Z

Summary

Stops Deep Agents Code startup from copying inherited LangSmith tracing and project values into the sandbox-readable runtime shell environment. This closes the final review gap from #6206 while preserving the managed proxy and trust-store contract.

Related Issue

Follow-up to #6206 and #6191.

Changes

Exclude LangSmith tracing and both project variables from /tmp/nemoclaw-proxy-env.sh.
Extend the real start.sh fixture with valid-shape lsv2_pt_... and lsv2_sk_... tracing and project values and prove none reaches the emitted file.
Align the documented 0444 risk acceptance and Deep Agents Code quickstart with the narrowed persisted environment.
Require existing Deep Agents Code sandboxes to rebuild after upgrading because start.sh is baked into the image.
Local verification: 54 focused tests, CLI build/typecheck, Bash syntax, ShellCheck, shfmt, Biome, test-title/source-shape/test-size guards, conditional scan, secret scan, and docs validation passed. The broad macOS test-cli hook remains non-green on unrelated Linux-only PTY tests because BSD script rejects -qec; exact-head Linux CI is authoritative.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification:
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification:
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes
Targeted tests pass for changed behavior
Full npm test passes (broad runtime changes only)
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Aaron Erickson aerickson@nvidia.com

Summary by CodeRabbit

Bug Fixes
- Improved shared runtime environment generation to exclude LangSmith “project” settings and avoid persisting any token-shaped/secret-shaped values.
- Updated proxy environment handling to use normalized proxy configuration while inheriting safe trust-store paths only.
Documentation
- Refreshed security and quickstart guidance to clarify what tracing-related values are intentionally not saved.
- Added upgrade note: rebuild existing sandboxes from older releases to pick up the fix.
Tests
- Strengthened CI to fail if any secret-shaped values appear in emitted environment output, and to verify the forbidden LangSmith project variables are not present.

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

coderabbitai · 2026-07-03T00:04:52Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 26968283-0e24-4354-8851-0586fdccabc5

📥 Commits

Reviewing files that changed from the base of the PR and between 3740a3e and ca25927.

📒 Files selected for processing (3)

agents/langchain-deepagents-code/start.sh
docs/get-started/quickstart-langchain-deepagents-code.mdx
test/langchain-deepagents-code-image.test.ts

✅ Files skipped from review due to trivial changes (1)

agents/langchain-deepagents-code/start.sh

🚧 Files skipped from review as they are similar to previous changes (1)

docs/get-started/quickstart-langchain-deepagents-code.mdx

📝 Walkthrough

Walkthrough

Excludes LangSmith project-scoped variables from the generated shared proxy env file in start.sh, updates SECURITY.md and quickstart docs to match the new behavior, and extends tests to verify the excluded values are not emitted.

Changes

LangSmith value exclusion

Layer / File(s)	Summary
Exclude LangSmith values in start.sh `agents/langchain-deepagents-code/start.sh`	`prepare_runtime_env` removes LangSmith export writes and leaves an explanatory comment in the generated env script.
Update security and quickstart docs `SECURITY.md`, `docs/get-started/quickstart-langchain-deepagents-code.mdx`	The compensating-control note, tracing section, and upgrade guidance describe the revised env-file contents and rebuild requirement.
Extend env-file sanitization tests `test/langchain-deepagents-code-image.test.ts`	The secret-shape assertion and inherited-secret fixture now include the LangSmith project variables.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: chore

Suggested reviewers: cv

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: stopping LangSmith variables from being persisted in the runtime env file.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/dcode-langsmith-project-persistence

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-07-03T00:05:08Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the fix/dcode-langsmith-... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	`main`	`fix/dcode-langsmith-...` ca25927	+/-
`nemoclaw/src/se...cret-scanner.ts`	—	100%	—
`nemoclaw/src/commands/slash.ts`	—	100%	—
`nemoclaw/src/bl...eprint/state.ts`	—	98%	—
`nemoclaw/src/onboard/config.ts`	—	98%	—
`nemoclaw/src/bl...int/snapshot.ts`	—	97%	—
`nemoclaw/src/blueprint/ssrf.ts`	—	97%	—
`nemoclaw/src/bl...print/runner.ts`	—	95%	—
`nemoclaw/src/co...ration-state.ts`	—	94%	—
`nemoclaw/src/bl...ate-networks.ts`	—	94%	—
`nemoclaw/src/index.ts`	—	94%	—

TypeScript / code-coverage/cli

The overall coverage in the fix/dcode-langsmith-... branch is 69%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	`main`	`fix/dcode-langsmith-...` ca25927	+/-
`src/lib/actions...dbox/rebuild.ts`	—	82%	—
`src/lib/actions...all/run-plan.ts`	—	80%	—
`src/lib/state/o...oard-session.ts`	—	80%	—
`src/lib/shields/index.ts`	—	75%	—
`src/lib/state/sandbox.ts`	—	73%	—
`src/lib/onboard...er-gpu-patch.ts`	—	69%	—
`src/lib/onboard/preflight.ts`	—	69%	—
`src/lib/actions...licy-channel.ts`	—	59%	—
`src/lib/policy/index.ts`	—	56%	—
`src/lib/onboard.ts`	—	20%	—

_{Updated July 03, 2026 02:58 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

github-actions · 2026-07-03T00:05:11Z

🌿 Preview your docs: https://nvidia-preview-pr-6219.docs.buildwithfern.com/nemoclaw

github-actions · 2026-07-03T00:06:00Z

PR Review Advisor (Nemotron Ultra) — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: No advisor follow-up required beyond maintainer review.
Open items: 0 required · 0 warnings · 0 suggestions · 0 test follow-ups
Since last review: 4 prior items resolved · 0 still apply · 0 new items found

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

github-actions · 2026-07-03T00:06:18Z

E2E Advisor Recommendation

Required E2E: ubuntu-repo-cloud-langchain-deepagents-code
Optional E2E: None

Dispatch hint: targets=ubuntu-repo-cloud-langchain-deepagents-code

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

ubuntu-repo-cloud-langchain-deepagents-code (high): Required because this PR changes the Deep Agents Code sandbox startup script and credential-free shared env-file boundary. The existing live target builds/onboards a real langchain-deepagents-code sandbox and runs smoke, inference, terminal-agent, and deepagents-code-policy checks, including /tmp/nemoclaw-proxy-env.sh metadata/secret scanning and dcode headless routing.

Optional E2E

None.

New E2E recommendations

Deep Agents Code inherited optional-service environment leakage (medium): Existing live Deep Agents Code policy checks scan the real sandbox env file, but the PR-specific regression injects token-shaped LANGSMITH_TRACING, LANGSMITH_PROJECT, and DEEPAGENTS_CODE_LANGSMITH_PROJECT only in a focused non-live image-contract test. Add live coverage that starts/onboards a Deep Agents Code sandbox with token-shaped inherited LangSmith variables and verifies /tmp/nemoclaw-proxy-env.sh and dcode captures remain secret-free.
- Suggested test: Add a Deep Agents Code live secret-boundary scenario for inherited LangSmith tracing/project variables in the ubuntu-repo-cloud-langchain-deepagents-code target.

Dispatch hint

Workflow: e2e.yaml
jobs input: targets=ubuntu-repo-cloud-langchain-deepagents-code

github-actions · 2026-07-03T00:06:19Z

E2E Target Recommendation

Required E2E targets: ubuntu-repo-cloud-langchain-deepagents-code
Optional E2E targets: None

Dispatch required E2E targets:

gh workflow run e2e.yaml --ref <pr-head-ref> --field targets=ubuntu-repo-cloud-langchain-deepagents-code

Workflow run

Full E2E target advisor summary

E2E Target Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E targets

ubuntu-repo-cloud-langchain-deepagents-code: The PR changes the LangChain Deep Agents Code sandbox startup script that is baked into and exercised by the live cloud-langchain-deepagents-code target, including runtime environment serialization and policy-sensitive secret handling.
- Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field targets=ubuntu-repo-cloud-langchain-deepagents-code

Optional E2E targets

None.

Relevant changed files

agents/langchain-deepagents-code/start.sh

github-actions · 2026-07-03T00:06:57Z

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: No advisor follow-up required beyond maintainer review.
Open items: 0 required · 0 warnings · 0 suggestions · 0 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

github-actions · 2026-07-03T00:09:01Z

Vitest E2E Target Results — ✅ All selected jobs passed

Run: 28629432243
Workflow ref: fix/dcode-langsmith-project-persistence
Requested targets: ubuntu-repo-cloud-langchain-deepagents-code
Requested jobs: (default — all default-enabled free-standing jobs; explicit-only jobs hermes-gpu-startup, openshell-gateway-auth-contract, jetson-nvmap-gpu, and sandbox-rlimits-connect are skipped unless selected)
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
live	✅ success

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

github-actions · 2026-07-03T00:15:02Z

Vitest E2E Target Results — ✅ All selected jobs passed

Run: 28629669382
Workflow ref: fix/dcode-langsmith-project-persistence
Requested targets: ubuntu-repo-cloud-langchain-deepagents-code
Requested jobs: (default — all default-enabled free-standing jobs; explicit-only jobs hermes-gpu-startup, openshell-gateway-auth-contract, jetson-nvmap-gpu, and sandbox-rlimits-connect are skipped unless selected)
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
live	✅ success

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

github-actions · 2026-07-03T02:54:44Z

Vitest E2E Target Results — ✅ All selected jobs passed

Run: 28635168665
Workflow ref: fix/dcode-langsmith-project-persistence
Requested targets: ubuntu-repo-cloud-langchain-deepagents-code
Requested jobs: (default — all default-enabled free-standing jobs; explicit-only jobs hermes-gpu-startup, openshell-gateway-auth-contract, jetson-nvmap-gpu, and sandbox-rlimits-connect are skipped unless selected)
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
live	✅ success

cv

Reviewed the focused runtime-env hardening, regression coverage, docs, clean automated review, and exact-head Deep Agents Code E2E result. Approved for the v0.0.74 train.

## Summary This PR prepares the user-facing documentation for v0.0.74 before the release plan is frozen. It expands the release notes across the 56-commit train and closes durable documentation gaps found during the pre-tag commit scan. ## Changes - Expand the `v0.0.74` release notes to cover OpenShell 0.0.72, managed MCP, progressive tool disclosure, LangChain Deep Agents Code, onboarding, local inference, messaging, recovery, and contributor workflows. - Correct the `destroy` contract for retained per-name volumes, gateway-unreachable `--force` cleanup, managed MCP ownership, and same-name recovery. - Document separate remediation for an unreachable container DNS resolver versus one that answers with `NXDOMAIN` or `REFUSED`. - Document the Windows on Arm N1X automatic Ollama safeguard and its remaining large-model limitations. - State that messaging conflicts abort rebuild before backup or deletion, leaving the original sandbox intact. - Link the agent-runnable value benchmark from the contributor task index. - Synchronize generated agent command variants. - Validate with `npm run docs:sync-agent-variants` and `npm run docs`; Fern completed with 0 errors and 2 existing warnings. - Source summary: - [#6020](#6020) and [#5876](#5876) -> `docs/about/release-notes.mdx`: Consolidate the OpenShell 0.0.72 policy boundary and managed MCP lifecycle. - [#6251](#6251) and [#5989](#5989) -> `docs/about/release-notes.mdx`: Summarize progressive tool disclosure and sandbox-first inference controls. - [#6232](#6232), [#6082](#6082), [#6219](#6219), [#6214](#6214), [#6215](#6215), [#6230](#6230), and [#6260](#6260) -> `docs/about/release-notes.mdx`: Summarize the experimental LangChain Deep Agents Code status, secret, version, rebuild, snapshot, and MCP boundaries. - [#6166](#6166), [#6254](#6254), [#6265](#6265), [#6164](#6164), and [#6017](#6017) -> `docs/about/release-notes.mdx`: Summarize BuildKit prebuild, validated image reuse, bounded readiness, and preflight improvements. - [#6150](#6150) -> `docs/about/release-notes.mdx` and `docs/reference/troubleshooting.mdx`: Separate unreachable-resolver remediation from reachable-but-rejected DNS responses. - [#6234](#6234) -> `docs/about/release-notes.mdx`, `docs/inference/use-local-inference.mdx`, and `docs/get-started/windows-preparation.mdx`: Document N1X automatic 9B selection and the remaining explicit-large-model boundary. - [#6129](#6129), [#5987](#5987), [#5955](#5955), and [#6220](#6220) -> `docs/about/release-notes.mdx`, `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/commands.mdx`, and `docs/reference/commands-nemohermes.mdx`: Document messaging policy persistence, status, and the pre-destructive conflict check. - [#5963](#5963), [#6050](#6050), [#6094](#6094), [#6238](#6238), [#5988](#5988), [#6235](#6235), [#6181](#6181), and [#5986](#5986) -> `docs/about/release-notes.mdx`, `docs/reference/commands.mdx`, and `docs/reference/commands-nemohermes.mdx`: Summarize day-two recovery and clarify retained-volume and local-only destroy semantics. - [#6200](#6200), [#6248](#6248), [#6168](#6168), [#6270](#6270), and [#5649](#5649) -> `docs/about/release-notes.mdx` and `CONTRIBUTING.md`: Summarize contributor setup and verification improvements and expose the advisory value benchmark. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates  - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: documentation-only release preparation; generated-variant synchronization and the Fern docs build validate the changed pages and routes. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification  - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: tests are not applicable to this documentation-only change; `npm run docs` validates the source and generated routes. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) ---  Signed-off-by: Aaron Erickson <aerickson@nvidia.com>  ## Summary by CodeRabbit * **Documentation** * Expanded setup guidance for Windows on Arm devices with safer default local model selection. * Clarified local inference and sandbox messaging behavior, including conflict checks before rebuilds and safer recovery steps. * Updated destroy/rebuild/reference docs with more detailed warnings, failure handling, and volume-retention guidance. * Improved troubleshooting instructions for Docker DNS issues with clearer paths for unreachable vs. blocked resolvers.  --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

## Summary  Stops Deep Agents Code startup from copying inherited LangSmith tracing and project values into the sandbox-readable runtime shell environment. This closes the final review gap from NVIDIA#6206 while preserving the managed proxy and trust-store contract. ## Related Issue  Follow-up to NVIDIA#6206 and NVIDIA#6191. ## Changes  - Exclude LangSmith tracing and both project variables from `/tmp/nemoclaw-proxy-env.sh`. - Extend the real `start.sh` fixture with valid-shape `lsv2_pt_...` and `lsv2_sk_...` tracing and project values and prove none reaches the emitted file. - Align the documented `0444` risk acceptance and Deep Agents Code quickstart with the narrowed persisted environment. - Require existing Deep Agents Code sandboxes to rebuild after upgrading because `start.sh` is baked into the image. - Local verification: 54 focused tests, CLI build/typecheck, Bash syntax, ShellCheck, shfmt, Biome, test-title/source-shape/test-size guards, conditional scan, secret scan, and docs validation passed. The broad macOS `test-cli` hook remains non-green on unrelated Linux-only PTY tests because BSD `script` rejects `-qec`; exact-head Linux CI is authoritative. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates  - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification  - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [ ] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [x] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) ---  Signed-off-by: Aaron Erickson <aerickson@nvidia.com>  ## Summary by CodeRabbit * **Bug Fixes** * Improved shared runtime environment generation to exclude LangSmith “project” settings and avoid persisting any token-shaped/secret-shaped values. * Updated proxy environment handling to use normalized proxy configuration while inheriting safe trust-store paths only. * **Documentation** * Refreshed security and quickstart guidance to clarify what tracing-related values are intentionally not saved. * Added upgrade note: rebuild existing sandboxes from older releases to pick up the fix. * **Tests** * Strengthened CI to fail if any secret-shaped values appear in emitted environment output, and to verify the forbidden LangSmith project variables are not present.  --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

## Summary This PR prepares the user-facing documentation for v0.0.74 before the release plan is frozen. It expands the release notes across the 56-commit train and closes durable documentation gaps found during the pre-tag commit scan. ## Changes - Expand the `v0.0.74` release notes to cover OpenShell 0.0.72, managed MCP, progressive tool disclosure, LangChain Deep Agents Code, onboarding, local inference, messaging, recovery, and contributor workflows. - Correct the `destroy` contract for retained per-name volumes, gateway-unreachable `--force` cleanup, managed MCP ownership, and same-name recovery. - Document separate remediation for an unreachable container DNS resolver versus one that answers with `NXDOMAIN` or `REFUSED`. - Document the Windows on Arm N1X automatic Ollama safeguard and its remaining large-model limitations. - State that messaging conflicts abort rebuild before backup or deletion, leaving the original sandbox intact. - Link the agent-runnable value benchmark from the contributor task index. - Synchronize generated agent command variants. - Validate with `npm run docs:sync-agent-variants` and `npm run docs`; Fern completed with 0 errors and 2 existing warnings. - Source summary: - [NVIDIA#6020](NVIDIA#6020) and [NVIDIA#5876](NVIDIA#5876) -> `docs/about/release-notes.mdx`: Consolidate the OpenShell 0.0.72 policy boundary and managed MCP lifecycle. - [NVIDIA#6251](NVIDIA#6251) and [NVIDIA#5989](NVIDIA#5989) -> `docs/about/release-notes.mdx`: Summarize progressive tool disclosure and sandbox-first inference controls. - [NVIDIA#6232](NVIDIA#6232), [NVIDIA#6082](NVIDIA#6082), [NVIDIA#6219](NVIDIA#6219), [NVIDIA#6214](NVIDIA#6214), [NVIDIA#6215](NVIDIA#6215), [NVIDIA#6230](NVIDIA#6230), and [NVIDIA#6260](NVIDIA#6260) -> `docs/about/release-notes.mdx`: Summarize the experimental LangChain Deep Agents Code status, secret, version, rebuild, snapshot, and MCP boundaries. - [NVIDIA#6166](NVIDIA#6166), [NVIDIA#6254](NVIDIA#6254), [NVIDIA#6265](NVIDIA#6265), [NVIDIA#6164](NVIDIA#6164), and [NVIDIA#6017](NVIDIA#6017) -> `docs/about/release-notes.mdx`: Summarize BuildKit prebuild, validated image reuse, bounded readiness, and preflight improvements. - [NVIDIA#6150](NVIDIA#6150) -> `docs/about/release-notes.mdx` and `docs/reference/troubleshooting.mdx`: Separate unreachable-resolver remediation from reachable-but-rejected DNS responses. - [NVIDIA#6234](NVIDIA#6234) -> `docs/about/release-notes.mdx`, `docs/inference/use-local-inference.mdx`, and `docs/get-started/windows-preparation.mdx`: Document N1X automatic 9B selection and the remaining explicit-large-model boundary. - [NVIDIA#6129](NVIDIA#6129), [NVIDIA#5987](NVIDIA#5987), [NVIDIA#5955](NVIDIA#5955), and [NVIDIA#6220](NVIDIA#6220) -> `docs/about/release-notes.mdx`, `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/commands.mdx`, and `docs/reference/commands-nemohermes.mdx`: Document messaging policy persistence, status, and the pre-destructive conflict check. - [NVIDIA#5963](NVIDIA#5963), [NVIDIA#6050](NVIDIA#6050), [NVIDIA#6094](NVIDIA#6094), [NVIDIA#6238](NVIDIA#6238), [NVIDIA#5988](NVIDIA#5988), [NVIDIA#6235](NVIDIA#6235), [NVIDIA#6181](NVIDIA#6181), and [NVIDIA#5986](NVIDIA#5986) -> `docs/about/release-notes.mdx`, `docs/reference/commands.mdx`, and `docs/reference/commands-nemohermes.mdx`: Summarize day-two recovery and clarify retained-volume and local-only destroy semantics. - [NVIDIA#6200](NVIDIA#6200), [NVIDIA#6248](NVIDIA#6248), [NVIDIA#6168](NVIDIA#6168), [NVIDIA#6270](NVIDIA#6270), and [NVIDIA#5649](NVIDIA#5649) -> `docs/about/release-notes.mdx` and `CONTRIBUTING.md`: Summarize contributor setup and verification improvements and expose the advisory value benchmark. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates  - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: documentation-only release preparation; generated-variant synchronization and the Fern docs build validate the changed pages and routes. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification  - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: tests are not applicable to this documentation-only change; `npm run docs` validates the source and generated routes. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) ---  Signed-off-by: Aaron Erickson <aerickson@nvidia.com>  ## Summary by CodeRabbit * **Documentation** * Expanded setup guidance for Windows on Arm devices with safer default local model selection. * Clarified local inference and sandbox messaging behavior, including conflict checks before rebuilds and safer recovery steps. * Updated destroy/rebuild/reference docs with more detailed warnings, failure handling, and volume-retention guidance. * Improved troubleshooting instructions for Docker DNS issues with clearer paths for unreachable vs. blocked resolvers.  --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

fix(dcode): stop persisting LangSmith project values

cf93978

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa added area: security Security controls, permissions, secrets, or hardening bug-fix PR fixes a bug or regression integration: dcode LangChain Deep Code integration behavior v0.0.74 labels Jul 3, 2026

ericksoa self-assigned this Jul 3, 2026

ericksoa added 2 commits July 2, 2026 17:09

fix(dcode): exclude tracing from shared env

d34e5ea

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

docs(dcode): clarify sandbox rebuild guidance

3740a3e

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa changed the title ~~fix(dcode): stop persisting LangSmith project values~~ fix(dcode): stop persisting LangSmith variables Jul 3, 2026

merge: refresh main for dcode follow-up

ca25927

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

cv approved these changes Jul 3, 2026

View reviewed changes

cv merged commit 8b307c0 into main Jul 3, 2026
124 checks passed

cv deleted the fix/dcode-langsmith-project-persistence branch July 3, 2026 03:29

This was referenced Jul 3, 2026

chore(openshell): upgrade supported version to 0.0.72 #6020

Merged

feat(mcp): add OpenShell-managed MCP servers #5876

Merged

ericksoa added the security label Jul 3, 2026

ericksoa mentioned this pull request Jul 4, 2026

docs: prepare v0.0.74 release notes #6274

Merged

21 tasks

Uh oh!

Conversation

ericksoa commented Jul 3, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Quality Gates

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-code-quality Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

github-actions Bot commented Jul 3, 2026

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor (Nemotron Ultra) — No blocking findings

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Advisor Recommendation

E2E Recommendation Advisor

Required E2E

Optional E2E

New E2E recommendations

Dispatch hint

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Target Recommendation

E2E Target Advisor

Required E2E targets

Optional E2E targets

Relevant changed files

Uh oh!

github-actions Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — No blocking findings

Uh oh!

github-actions Bot commented Jul 3, 2026

Vitest E2E Target Results — ✅ All selected jobs passed

Uh oh!

github-actions Bot commented Jul 3, 2026

Vitest E2E Target Results — ✅ All selected jobs passed

Uh oh!

github-actions Bot commented Jul 3, 2026

Vitest E2E Target Results — ✅ All selected jobs passed

Uh oh!

cv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ericksoa commented Jul 3, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

github-code-quality Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading

github-actions Bot commented Jul 3, 2026 •

edited

Loading