fix(inference): keep /v1 base URL for OpenAI-only agents on Anthropic-compatible endpoints - #6298
Merged
Merged
Conversation
… endpoints Onboarding a Deep Agents (langchain-deepagents-code / dcode) sandbox with the Custom Anthropic-compatible provider probes the endpoint, resolves the inference API to anthropic-messages, and routes getSandboxInferenceConfig() through the raw Anthropic branch. That branch drops the /v1 suffix from the baked config.toml base_url and wires the sandbox for a contract the OpenAI-/chat/completions-only dcode client cannot speak. The sandbox egress policy then rejects every /chat/completions request (no /v1 path) with a 403, surfaced by langgraph as PermissionDeniedError. Coerce the resolved inference API to openai-completions at setupNim's return for agents whose manifest declares provider_type: openai_compatible, mirroring the existing Bedrock Runtime custom-Anthropic route. The managed sub-branch keeps the /v1 base URL, so dcode onboards against an Anthropic-compatible endpoint exactly like the already-working openai-type path. OpenClaw (gateway_managed) and Hermes (custom) still negotiate Anthropic Messages natively; endpoint validation still probes the real Anthropic API before the coercion applies. Fixes #6294 Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A session persisted before the #6294 fix can carry anthropic-messages for an agent whose manifest declares provider_type: openai_compatible. The resume shortcut in handleProviderInferenceState skips setupNim — the fresh-onboard coercion point — so a resume or rebuild would re-bake the sandbox base_url without its /v1 suffix. Coerce the persisted seed at the handler too, so pre-fix sessions self-heal on resume. Refs #6294 Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds routing coercion for OpenAI-compatible agents, applies it in onboarding and resume handling, and extends remote provider setup and credential reuse logic for OpenAI-surface probing and stale provider replacement. ChangesInference route coercion and onboarding
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 3 items to resolve/justify, 0 in-scope improvements
|
Contributor
PR Review Advisor (Nemotron Ultra) — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
cv
approved these changes
Jul 6, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/lib/onboard.ts (1)
4141-4154: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winFresh-onboard integration point lacks direct test coverage.
The PR adds tests for the
coerceAgentInferenceApihelper (config.test.ts) and the resume bridge (provider-inference.test.ts), but no test appears to exercisesetupNim's own wiring of the coercion for aopenai_compatibleagent on the fresh path. As per path instructions ("When updating behavior across onboarding “fresh” vs “resume” paths, use targeted mechanical changes rather than broad refactors, and add/extend tests near the helper/handler you changed"), consider adding a focused test assertingsetupNim(...).preferredInferenceApiis coerced for this scenario, mirroring the resume-path tests already added.#!/bin/bash # Description: Check whether an existing test already covers setupNim's coercion wiring. fd -e test.ts -e test.mts . src/lib | xargs rg -l "setupNim" rg -n "setupNim" src/lib/onboard.test.ts 2>/dev/null | head -30🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard.ts` around lines 4141 - 4154, The fresh onboarding path in setupNim is missing direct test coverage for preferredInferenceApi coercion. Add a focused test near setupNim in onboard tests that exercises an openai_compatible agent on the fresh path and asserts setupNim(...).preferredInferenceApi is coerced via inferenceConfig.coerceAgentInferenceApi, mirroring the resume-path coverage already added.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/onboard/machine/handlers/provider-inference.ts`:
- Around line 245-250: Persist the coerced inference API for resumed sessions,
because `preferredInferenceApi` is currently only updated in memory in
`onboard/machine/handlers/provider-inference.ts` and never written back to
session state. Update the resume path around `coerceAgentInferenceApi` and the
subsequent `provider_selection`/`inference` persistence so
`session.preferredInferenceApi` is saved after coercion. Make sure
`resolveRuntimeInferenceApi()` sees the stored value, not the stale pre-resume
one, when later config is generated.
---
Outside diff comments:
In `@src/lib/onboard.ts`:
- Around line 4141-4154: The fresh onboarding path in setupNim is missing direct
test coverage for preferredInferenceApi coercion. Add a focused test near
setupNim in onboard tests that exercises an openai_compatible agent on the fresh
path and asserts setupNim(...).preferredInferenceApi is coerced via
inferenceConfig.coerceAgentInferenceApi, mirroring the resume-path coverage
already added.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ec886770-b313-49cb-bfc3-aca84a37afa8
📒 Files selected for processing (5)
src/lib/inference/config.test.tssrc/lib/inference/config.tssrc/lib/onboard.tssrc/lib/onboard/machine/handlers/provider-inference.test.tssrc/lib/onboard/machine/handlers/provider-inference.ts
Contributor
E2E Target Results — ✅ All selected jobs passedRun: 28772424828
|
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28772422788
|
The resume-seed coercion kept the corrected openai-completions value in memory only: on a plain resume the provider_selection step write is skipped, so session.preferredInferenceApi stayed anthropic-messages and later readers such as resolveRuntimeInferenceApi kept feeding the stale value into config generation. Re-record the provider selection when the coercion changed the persisted seed, reusing the existing step write; an unchanged seed keeps the plain-resume shortcut with no extra write. Refs #6294 Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add an integration-style test that wires the real fresh-onboard chain for issue #6294: the langchain-deepagents-code manifest loader, the anthropic-messages coercion, getSandboxInferenceConfig's managed route, and the actual config generator subprocess — asserting the baked config.toml carries base_url "https://inference.local/v1" with the inference/openai-completions route metadata (PRA-1). Also refresh the platform-matrix citation into src/lib/inference/config.test.ts, which the new #6294 tests shifted by one line, and regenerate the synced docs tables. Refs #6294 Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-6298.docs.buildwithfern.com/nemoclaw |
Contributor
Author
PRA-1 / test follow-ups — resolutionPRA-1 (runtime validation for the fresh dcode Anthropic-compatible path):
CodeRabbit (persist coerced value on resume): fixed in 3a08e8b — the resume branch re-records cli-test-shards (5) failure: root-caused and fixed in 8e2198a — the new #6294 tests shifted Advisor-noted coverage gap (follow-up): no live E2E target exists today for exactly openai_compatible agent + compatible-anthropic-endpoint; the advisor suggests adding one covering fresh onboard and --resume/rebuild. Happy to file a follow-up issue for the new target after this PR lands. Signed-off-by: Dongni Yang dongniy@nvidia.com |
Contributor
Author
PRA-2 — acknowledged as justifiedFinding: Justification (per the finding's own required action): the growth is exactly the regression coverage for the #6294 fix — a new Verification: No code change required; recording this as the explicit justification for the merge gate. Signed-off-by: Dongni Yang dongniy@nvidia.com |
The coerceAgentInferenceApi comment attributed the pre-fix 403 to the egress policy and implied the coercion fully restores the route. The OpenShell sandbox L7 proxy's fixed /v1 path patterns produce that 403, and the coercion fixes the sandbox-side wiring only — the gateway provider is still registered type=anthropic, whose route accepts only the anthropic_messages protocol. State both accurately so the remaining gateway-side work on #6294 is visible from the code. Refs #6294 Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Author
Scope correction:
|
…outes The #6294 coercion fixed the sandbox-side config, but the gateway provider for compatible-anthropic-endpoint was still registered type=anthropic, whose OpenShell route serves only the anthropic_messages protocol — so a Deep Agents sandbox's /v1/chat/completions requests were rejected with 400 no-compatible-route instead of the old 403. Thread the coerced inference API through setupInference into the remote provider registration. When it resolves openai-completions for compatible-anthropic-endpoint (only the openai_compatible-agent coercion produces that combination; Bedrock short-circuits earlier), the branch: - probes the endpoint's OpenAI surface on <origin>/v1 with the same Bearer credential the gateway will use — the anthropic-flavor normalization strips a trailing /v1 while OpenShell appends the /v1 protocol path with dedup, so re-adding the suffix keeps the probe and the runtime route on the identical URL; endpoints that answer only the Anthropic Messages API fail onboarding with an actionable message instead of a sandbox that cannot infer, - replaces a stale anthropic-type registration (provider update cannot change --type), failing closed when the provider is attached to other live sandboxes so their Anthropic routing is never silently broken, and - registers type=openai so the route carries openai_chat_completions. Resumed pre-fix sessions self-heal: the coerced seed forces one inference setup pass, and the coerced value is persisted only after that setup succeeds, so a failed heal (e.g. keyless resume) re-arms on the next attempt instead of stranding the sandbox. The keyless credential-reuse identity gate now expects the OpenAI surface for coerced routes (Bedrock endpoints excluded) and names the export needed to heal when it rejects a stale Anthropic-surface registration. Fixes #6294 Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Author
Gateway-layer gap closed — back to
|
The test-conditionals gate rejects if statements added to changed test files. Replace the branching openshell stub runners with a declarative lookup-table helper keyed on the first two argv tokens. Refs #6294 Signed-off-by: Dongni Yang <dongniy@nvidia.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
E2E Target Results — ✅ All selected jobs passedRun: 28778686708
|
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28778671576
|
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/lib/onboard/machine/handlers/provider-inference.ts (1)
277-297: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftDelay
provider_selectionpersistence until the heal succeedssrc/lib/onboard/machine/handlers/provider-inference.ts:287-408In the authoritative rebuild path, the coerced
preferredInferenceApiis written withprovider_selectionbefore the forced inference setup runs. If that setup fails or is aborted, a later resume will see the already-coerced seed and won’t re-arm the refresh, while the route check only looks at provider/model. Keep this write behind the successful inference step, or gate it the same way as the heal path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/machine/handlers/provider-inference.ts` around lines 277 - 297, The authoritative rebuild path in provider-inference.ts is persisting the coerced preferredInferenceApi to provider_selection too early, before the forced inference setup/heal succeeds. Move or gate the provider_selection write so it only happens after the inference step completes successfully, matching the heal path behavior in provider-inference and preserving re-arm on failed or aborted resumes.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/lib/onboard/machine/handlers/provider-inference.ts`:
- Around line 277-297: The authoritative rebuild path in provider-inference.ts
is persisting the coerced preferredInferenceApi to provider_selection too early,
before the forced inference setup/heal succeeds. Move or gate the
provider_selection write so it only happens after the inference step completes
successfully, matching the heal path behavior in provider-inference and
preserving re-arm on failed or aborted resumes.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 85add59a-c9d7-4b7b-b16d-5cc1048828a8
📒 Files selected for processing (8)
src/lib/onboard/inference-providers/remote.tssrc/lib/onboard/inference-providers/types.tssrc/lib/onboard/machine/handlers/provider-inference.test.tssrc/lib/onboard/machine/handlers/provider-inference.tssrc/lib/onboard/recovered-provider-reuse.test.tssrc/lib/onboard/recovered-provider-reuse.tssrc/lib/onboard/setup-inference.tstest/onboard-anthropic-compatible-openai-agent.test.ts
…et (#6298) Address PR-advisor items on the #6294 dcode Anthropic-base-url fix. PRA-2 (security): deleteProviderWithRecovery gains an allowedSandboxes option. When supplied, the parsed attachment list is revalidated against the authorized set before any detach and fails closed if a sandbox outside the set appears, so a stale/racing/mis-parsed diagnostic cannot force-detach an unrelated sandbox. The stale-provider replacement path is extracted into replaceStaleAnthropicProviderForOpenAiSurface, which passes the confirmed sandbox as the sole authorized entry and refuses force-detach recovery entirely when no target sandbox is confirmed (sandboxName === null), surfacing an actionable error instead. PRA-2/acceptance: add source-of-truth review JSDoc to coerceAgentInferenceApi documenting the invalid state, source boundary, gateway-side real fix (#6294), regression tests, and removal condition. PRA-3 (tests): cover the no-provider_type no-coerce case and the allowed-set force-detach / fail-closed recovery paths. Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/sandbox-provider-cleanup.test.ts`:
- Line 440: Update the affected root-level integration test titles in
sandbox-provider-cleanup.test.ts so they end with the required local issue
reference suffix. Rename the behavior-oriented titles in the relevant it()
blocks to include a trailing “(`#1234`)” while keeping the existing behavior
description intact, and apply the same change to the other affected title
mentioned in the review.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 72103ed3-f57f-4ea6-9070-f6e3b6dcb838
📒 Files selected for processing (6)
src/lib/inference/config.test.tssrc/lib/inference/config.tssrc/lib/onboard/inference-providers/remote.tssrc/lib/onboard/inference-providers/types.tssrc/lib/onboard/sandbox-provider-cleanup.tstest/sandbox-provider-cleanup.test.ts
🚧 Files skipped from review as they are similar to previous changes (4)
- src/lib/inference/config.ts
- src/lib/onboard/inference-providers/types.ts
- src/lib/inference/config.test.ts
- src/lib/onboard/inference-providers/remote.ts
| ]); | ||
| }); | ||
|
|
||
| it("force-detaches when every attached sandbox is inside the allowed set", () => { |
Contributor
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Test titles missing local issue-ref suffix.
Both new test titles are behavior-oriented but don't include a trailing (#1234) issue reference.
As per coding guidelines, "Root-level integration tests under test/ should import source code, use ESM imports, and use behavior-oriented titles with local issue refs in a final (#1234) suffix."
Also applies to: 467-467
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@test/sandbox-provider-cleanup.test.ts` at line 440, Update the affected
root-level integration test titles in sandbox-provider-cleanup.test.ts so they
end with the required local issue reference suffix. Rename the behavior-oriented
titles in the relevant it() blocks to include a trailing “(`#1234`)” while keeping
the existing behavior description intact, and apply the same change to the other
affected title mentioned in the review.
Source: Coding guidelines
20 tasks
prekshivyas
approved these changes
Jul 6, 2026
prekshivyas
left a comment
prekshivyas
left a comment
Collaborator
There was a problem hiding this comment.
Approving on current head 31ab337. The security fix from PR review is landed — deleteProviderWithRecovery is now constrained by an allowedSandboxes allowlist (default = confirmed sandbox, fail-closed if null), and replaceStaleAnthropicProviderForOpenAiSurface is extracted with the reuse-gate JSDoc. All required CI is green. The advisor's two remaining Required items (PRA-4 keyless-recovery integration test, PRA-5/6 delete-ok/create-fail negative test) are non-binding test-coverage additions, not correctness gaps; a follow-up can add them. Signed-off-by: Prekshi Vyas prekshiv@nvidia.com
21 tasks
cv
pushed a commit
that referenced
this pull request
Jul 6, 2026
## Summary Fix Hermes custom Anthropic routing by using the endpoint's verified OpenAI Chat Completions surface end to end. NemoClaw selects `https://inference.local/v1`, verifies `/v1/chat/completions`, and aligns the OpenShell provider to `type=openai` with `OPENAI_BASE_URL`, avoiding the duplicate Anthropic SSE `message_start` sequence that caused `hermes -z` to finish with `no final response`. The core managed-frontend direction was first proposed by @chengjiew in #6295, and Chengjie Wang is included as a commit co-author. @TonyLuo-NV's #6297 contributed streaming-failure investigation and regression analysis. Thanks to @hulynn for the reproducible managed-proxy report. ## Related Issue Fixes #6289 ## Changes - Resolve Hermes `compatible-anthropic-endpoint` routes to the managed `openai-completions` frontend and reuse #6298's verified OpenAI-surface provider registration while retaining `COMPATIBLE_ANTHROPIC_API_KEY` as the credential binding. - Persist the normalized frontend during fresh onboarding; repair stale provider identity, registry metadata, and sandbox configuration during rebuild or resume. - Reject conflicting explicit API choices and legacy `type=anthropic` runtime switches before mutating OpenShell, registry, or in-sandbox state. - Preserve native Anthropic Messages routing for OpenClaw custom endpoints and first-party Anthropic routes; preserve the existing AWS Bedrock adapter behavior. - Extend unit, integration, command-shape, and live E2E coverage, including the reported `hermes -z` path; document the verified-surface requirement and rebuild migration. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent final review found no blockers. Endpoint probing and provider replacement reuse the fail-closed #6298 boundary; this PR adds exact non-secret provider identity checks and introduces no credential values. Human maintainer approval remains required. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 289 CLI tests, 7 OpenAI-surface onboarding integration tests, 1 focused Hermes config integration test, and 18 E2E support tests passed - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — required GitHub Actions checks pending - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — completed with 0 errors and 2 existing Fern warnings - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Additional local verification: - `npm run build:cli` - `npm run typecheck:cli` - `npm run checks` - `npm run test-size:check` - `npm run test:titles:check` - `npm run source-shape:check` - `npm run test:projects:check` - `npm run test:imports:check` - `npm run docs` (0 errors; 2 existing warnings) --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Signed-off-by: Chengjie Wang <chengjiew@nvidia.com> Co-authored-by: Chengjie Wang <chengjiew@nvidia.com>
7 tasks
cv
pushed a commit
that referenced
this pull request
Jul 7, 2026
## Summary Add the v0.0.75 release-notes entry for the release train, summarizing the user-facing fixes merged since v0.0.74. Release-prep docs for the `nemoclaw-maintainer-cut-release-tag` gate. ## Related Issue Release prep for v0.0.75. Remove this section if none. ## Changes - `docs/about/release-notes.mdx`: add the `## v0.0.75` section (themed intro + grouped bullets with source-page links), matching the existing v0.0.74 style. ### Source summary (doc-impacting PRs → doc page) - #6370 -> `docs/about/release-notes.mdx`: prepared-backup recovery restores gateway state and defers the live route check to onboarding, so upgrade recovery no longer fails on an unset gateway route. - #6305 -> `docs/about/release-notes.mdx`: in-place upgrades recover gateway-orphaned sandboxes. - #6332 -> `docs/about/release-notes.mdx`: same-name `--fresh` re-onboard preserves fresh LangChain Deep Agents Code routing. - #6335 -> `docs/about/release-notes.mdx`: custom Anthropic-compatible inference uses the OpenAI frontend. - #6298 -> `docs/about/release-notes.mdx`: OpenAI-only agents keep the `/v1` base URL on Anthropic-compatible endpoints. - #6304 -> `docs/about/release-notes.mdx`: local docker-driver gateway credentials no longer expire. - #6261 -> `docs/about/release-notes.mdx`: Hermes runtime and managed MCP state reconcile after a runtime change. - #6318 -> `docs/about/release-notes.mdx`: Hermes installs accept a pinned base platform digest. - #6291 -> `docs/about/release-notes.mdx`: OpenClaw local CLI pairing restores its previous connection path. Test-performance, CI, and chore commits since v0.0.74 are excluded as non-user-facing. ## Type of Change - [x] Doc only (prose changes, no code sample modifications) ## Quality Gates - [x] Tests not applicable — justification: documentation-only change (release notes prose). - [x] Docs updated for user-facing behavior changes ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] `npm run docs` builds without warnings introduced by this change — command/result: "Found 0 errors and 2 warnings" (the 2 warnings pre-exist this change). - [x] Doc pages follow the style guide (active voice, no numbered/colon titles, correct NVIDIA/NemoClaw/OpenShell capitalization; skip-terms avoided). - [x] No secrets, API keys, or credentials committed --- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new **v0.0.75** section to the release notes, highlighting improved sandbox upgrade hardening and prepared-backup recovery, updated inference routing for Anthropic-compatible endpoints, longer-lasting local gateway credential handling, and restored CLI pairing reconnection without re-pairing. Also includes cross-links to related NemoClaw CLI and documentation pages. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
21 tasks
ericksoa
added a commit
that referenced
this pull request
Jul 7, 2026
<!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 sentences: what this PR does and why. --> Correct the v0.0.75 release-note entry merged in #6371 before the release tag is cut. This follow-up restores the omitted OpenClaw `2026.6.10` upgrade and narrows three claims to the runtime contracts that actually shipped. ## Changes <!-- Bullet list of key changes. --> - #5595 -> `docs/about/release-notes.mdx`: add the bundled OpenClaw `2026.6.10` upgrade and its reviewed package, pairing, and recovery boundaries. - #6370 -> `docs/about/release-notes.mdx`: state that authoritative onboarding restores the gateway provider and inference route during rebuild, before sandbox recreation. - #6335 and #6298 -> `docs/about/release-notes.mdx`: scope the OpenAI frontend to Hermes while retaining the separate OpenAI-only-agent behavior. - #6304 -> `docs/about/release-notes.mdx`: name the non-expiring local Docker-driver sandbox JWT contract precisely and link its gateway-auth review. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check exactly one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: prose-only release-note corrections with no runtime behavior or code samples. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: tests are not applicable; `npm run docs` passed with 0 errors and 2 pre-existing warnings. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — result: 0 errors and 2 pre-existing warnings (missing authenticated redirects check and existing light-theme accent contrast). - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the `v0.0.75` release notes with clearer wording and expanded details. * Added more specific notes about the runtime upgrade, sandbox recovery behavior, and routing safeguards. * Refined the description of inference routing behavior and local Docker-driver sandbox authentication handling. * Adjusted the linked references and final release-note wording for consistency. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
wscurran
added
area: inference
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
…-compatible endpoints (NVIDIA#6298) <!-- markdownlint-disable MD041 --> ## Summary Onboarding a Deep Agents (`dcode` / `langchain-deepagents-code`) sandbox with the Custom Anthropic-compatible provider resolved the probed inference API to `anthropic-messages`, baking `config.toml` `base_url` without the `/v1` suffix **and** registering a gateway provider whose OpenShell route cannot serve dcode's OpenAI-protocol traffic. This PR fixes both halves: agents whose manifest declares `provider_type: openai_compatible` are coerced onto the managed `openai-completions` route (config.toml keeps `base_url = "https://inference.local/v1"`), and the gateway provider is registered `--type openai` on the endpoint's verified `/v1` OpenAI surface so OpenShell routes `openai_chat_completions` end to end. Endpoints that serve only the Anthropic Messages API fail onboarding with an actionable error instead of producing a sandbox that cannot infer. ## Related Issue Fixes NVIDIA#6294 ## Changes **Sandbox-side route coercion** - Add pure helper `coerceAgentInferenceApi()` in `src/lib/inference/config.ts`: returns `openai-completions` when the agent's manifest `provider_type` is `openai_compatible` and the resolved API is `anthropic-messages`; pass-through otherwise. Applied at `setupNim`'s return (net-neutral +1/−1 in `onboard.ts`) and at the resumed session seed, so `config.toml` bakes `base_url = "https://inference.local/v1"` with `inference`/`openai-completions` metadata. - OpenClaw (`gateway_managed`) and Hermes (`custom`) keep negotiating Anthropic Messages natively; the Anthropic endpoint probe still validates the real endpoint before the coercion applies. **Gateway-side OpenAI-surface registration** (closes the runtime gap: OpenShell routes protocols per provider *type* — anthropic-type routes serve only `anthropic_messages`, and no OpenAI↔Anthropic translation exists) - Thread the coerced inference API through `setupInference` into `setupRemoteProviderInference`; when it resolves `openai-completions` for `compatible-anthropic-endpoint` (only the agent coercion produces this; Bedrock short-circuits earlier), register the provider `--type openai`. - Probe the endpoint's OpenAI surface first, on `<origin>/v1` with the same Bearer credential the gateway will use — the anthropic-flavor URL normalization strips a trailing `/v1` while OpenShell appends the `/v1` protocol path (with dedup), so re-adding the suffix keeps the probed URL identical to the runtime URL. Anthropic-only endpoints fail onboarding with an actionable message. - Replace a stale anthropic-type registration (`provider update` cannot change `--type`), failing closed with a named-sandbox message when the provider is attached to *other* live sandboxes, so their Anthropic routing is never silently broken. - Resumed pre-fix sessions self-heal: the coerced seed forces one inference-setup pass; the coerced value is persisted only after that setup succeeds, so a failed heal (e.g. keyless resume) re-arms next time instead of stranding the sandbox. - The keyless credential-reuse identity gate expects the OpenAI surface for coerced routes (Bedrock endpoints excluded, legacy behavior pinned by test) and names the exact export needed to heal when rejecting a stale registration. **Test & CI hygiene** - Integration test wiring the real fresh-onboard chain (real dcode manifest → coercion → managed route → real config generator subprocess) asserting the issue's expected `base_url`; registration tests covering type=openai argv, the `/v1` surface, stale-flip containment (unattached / own-sandbox / foreign-sandbox), actionable probe failure, native-Anthropic and keyless-reuse pass-throughs; resume heal/re-arm tests; reuse-gate matrix. - Refresh the `ci/platform-matrix.json` file:line citation shifted by the new tests and regenerate the two synced docs tables (fixes the earlier `cli-test-shards (5)` failure). ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: no user-facing behavior contract change to document (the fix makes the documented Deep Agents + Anthropic-compatible flow work); the two mdx table diffs are mechanical regenerations of a `ci/platform-matrix.json` citation line-number refresh via `scripts/generate-platform-docs.py`. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: the coercion is a pure function gated on the agent manifest `provider_type` and the exact probed API value; the gateway registration switch is double-gated (provider name + coerced API), verified against the endpoint's real `/v1` OpenAI surface with the same credential binding before registering, cannot loosen egress policy, and fails closed (named-sandbox message) rather than force-detaching a provider other live sandboxes use. Credential handling is unchanged (`--credential COMPATIBLE_ANTHROPIC_API_KEY`, value never in argv). OpenClaw/Hermes/Bedrock/nim/ollama/vllm paths verified untouched by tests. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result: `npx vitest run test/onboard-anthropic-compatible-openai-agent.test.ts src/lib/onboard/machine/handlers/provider-inference.test.ts src/lib/onboard/recovered-provider-reuse.test.ts src/lib/actions/sandbox/rebuild-provider-preflight.test.ts test/onboard-inference-failure-paths.test.ts src/lib/inference/config.test.ts src/lib/onboard/setup-nim-selection.test.ts test/langchain-deepagents-code-config.test.ts test/generate-platform-docs.test.ts` → 9 files, 176/176 passed; `npm run typecheck:cli` → clean. Advisor-required live E2E green on the config-fix head: `onboard-resume`, `onboard-repair` (run 28772422788), `ubuntu-repo-cloud-langchain-deepagents-code` (run 28772424828); re-dispatched against the current head (see PR comments for scorecards). - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [x] `npm run docs` builds without warnings (doc changes only) — 0 errors; the 2 reported warnings are pre-existing and environmental (fern auth-gated redirects check, theme accent-contrast ratio), unrelated to the regenerated tables - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) — generated tables only, emitted by `scripts/generate-platform-docs.py` - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Dongni Yang <dongniy@nvidia.com> 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Enhanced onboarding for OpenAI-compatible agents with automatic inference API coercion and consistent sandbox inference routing. * Added probing-driven registration for OpenAI-surface compatible endpoints, including safer gateway provider replacement. * **Bug Fixes** * Fixed resume/onboarding recovery so coerced inference preferences are honored and persisted only when appropriate. * Improved stale provider credential recovery across inference surfaces. * **Documentation** * Updated provider support references to the latest validation examples. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Dongni Yang <dongniy@nvidia.com> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Fix Hermes custom Anthropic routing by using the endpoint's verified OpenAI Chat Completions surface end to end. NemoClaw selects `https://inference.local/v1`, verifies `/v1/chat/completions`, and aligns the OpenShell provider to `type=openai` with `OPENAI_BASE_URL`, avoiding the duplicate Anthropic SSE `message_start` sequence that caused `hermes -z` to finish with `no final response`. The core managed-frontend direction was first proposed by @chengjiew in NVIDIA#6295, and Chengjie Wang is included as a commit co-author. @TonyLuo-NV's NVIDIA#6297 contributed streaming-failure investigation and regression analysis. Thanks to @hulynn for the reproducible managed-proxy report. ## Related Issue Fixes NVIDIA#6289 ## Changes - Resolve Hermes `compatible-anthropic-endpoint` routes to the managed `openai-completions` frontend and reuse NVIDIA#6298's verified OpenAI-surface provider registration while retaining `COMPATIBLE_ANTHROPIC_API_KEY` as the credential binding. - Persist the normalized frontend during fresh onboarding; repair stale provider identity, registry metadata, and sandbox configuration during rebuild or resume. - Reject conflicting explicit API choices and legacy `type=anthropic` runtime switches before mutating OpenShell, registry, or in-sandbox state. - Preserve native Anthropic Messages routing for OpenClaw custom endpoints and first-party Anthropic routes; preserve the existing AWS Bedrock adapter behavior. - Extend unit, integration, command-shape, and live E2E coverage, including the reported `hermes -z` path; document the verified-surface requirement and rebuild migration. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent final review found no blockers. Endpoint probing and provider replacement reuse the fail-closed NVIDIA#6298 boundary; this PR adds exact non-secret provider identity checks and introduces no credential values. Human maintainer approval remains required. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — 289 CLI tests, 7 OpenAI-surface onboarding integration tests, 1 focused Hermes config integration test, and 18 E2E support tests passed - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — required GitHub Actions checks pending - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — completed with 0 errors and 2 existing Fern warnings - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Additional local verification: - `npm run build:cli` - `npm run typecheck:cli` - `npm run checks` - `npm run test-size:check` - `npm run test:titles:check` - `npm run source-shape:check` - `npm run test:projects:check` - `npm run test:imports:check` - `npm run docs` (0 errors; 2 existing warnings) --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Signed-off-by: Chengjie Wang <chengjiew@nvidia.com> Co-authored-by: Chengjie Wang <chengjiew@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Add the v0.0.75 release-notes entry for the release train, summarizing the user-facing fixes merged since v0.0.74. Release-prep docs for the `nemoclaw-maintainer-cut-release-tag` gate. ## Related Issue Release prep for v0.0.75. Remove this section if none. ## Changes - `docs/about/release-notes.mdx`: add the `## v0.0.75` section (themed intro + grouped bullets with source-page links), matching the existing v0.0.74 style. ### Source summary (doc-impacting PRs → doc page) - NVIDIA#6370 -> `docs/about/release-notes.mdx`: prepared-backup recovery restores gateway state and defers the live route check to onboarding, so upgrade recovery no longer fails on an unset gateway route. - NVIDIA#6305 -> `docs/about/release-notes.mdx`: in-place upgrades recover gateway-orphaned sandboxes. - NVIDIA#6332 -> `docs/about/release-notes.mdx`: same-name `--fresh` re-onboard preserves fresh LangChain Deep Agents Code routing. - NVIDIA#6335 -> `docs/about/release-notes.mdx`: custom Anthropic-compatible inference uses the OpenAI frontend. - NVIDIA#6298 -> `docs/about/release-notes.mdx`: OpenAI-only agents keep the `/v1` base URL on Anthropic-compatible endpoints. - NVIDIA#6304 -> `docs/about/release-notes.mdx`: local docker-driver gateway credentials no longer expire. - NVIDIA#6261 -> `docs/about/release-notes.mdx`: Hermes runtime and managed MCP state reconcile after a runtime change. - NVIDIA#6318 -> `docs/about/release-notes.mdx`: Hermes installs accept a pinned base platform digest. - NVIDIA#6291 -> `docs/about/release-notes.mdx`: OpenClaw local CLI pairing restores its previous connection path. Test-performance, CI, and chore commits since v0.0.74 are excluded as non-user-facing. ## Type of Change - [x] Doc only (prose changes, no code sample modifications) ## Quality Gates - [x] Tests not applicable — justification: documentation-only change (release notes prose). - [x] Docs updated for user-facing behavior changes ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] `npm run docs` builds without warnings introduced by this change — command/result: "Found 0 errors and 2 warnings" (the 2 warnings pre-exist this change). - [x] Doc pages follow the style guide (active voice, no numbered/colon titles, correct NVIDIA/NemoClaw/OpenShell capitalization; skip-terms avoided). - [x] No secrets, API keys, or credentials committed --- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new **v0.0.75** section to the release notes, highlighting improved sandbox upgrade hardening and prepared-backup recovery, updated inference routing for Anthropic-compatible endpoints, longer-lasting local gateway credential handling, and restored CLI pairing reconnection without re-pairing. Also includes cross-links to related NemoClaw CLI and documentation pages. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 sentences: what this PR does and why. --> Correct the v0.0.75 release-note entry merged in NVIDIA#6371 before the release tag is cut. This follow-up restores the omitted OpenClaw `2026.6.10` upgrade and narrows three claims to the runtime contracts that actually shipped. ## Changes <!-- Bullet list of key changes. --> - NVIDIA#5595 -> `docs/about/release-notes.mdx`: add the bundled OpenClaw `2026.6.10` upgrade and its reviewed package, pairing, and recovery boundaries. - NVIDIA#6370 -> `docs/about/release-notes.mdx`: state that authoritative onboarding restores the gateway provider and inference route during rebuild, before sandbox recreation. - NVIDIA#6335 and NVIDIA#6298 -> `docs/about/release-notes.mdx`: scope the OpenAI frontend to Hermes while retaining the separate OpenAI-only-agent behavior. - NVIDIA#6304 -> `docs/about/release-notes.mdx`: name the non-expiring local Docker-driver sandbox JWT contract precisely and link its gateway-auth review. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check exactly one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: prose-only release-note corrections with no runtime behavior or code samples. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: tests are not applicable; `npm run docs` passed with 0 errors and 2 pre-existing warnings. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — result: 0 errors and 2 pre-existing warnings (missing authenticated redirects check and existing light-theme accent contrast). - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the `v0.0.75` release notes with clearer wording and expanded details. * Added more specific notes about the runtime upgrade, sandbox recovery behavior, and routing safeguards. * Refined the description of inference routing behavior and local Docker-driver sandbox authentication handling. * Adjusted the linked references and final release-note wording for consistency. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Onboarding a Deep Agents (
dcode/langchain-deepagents-code) sandbox with the Custom Anthropic-compatible provider resolved the probed inference API toanthropic-messages, bakingconfig.tomlbase_urlwithout the/v1suffix and registering a gateway provider whose OpenShell route cannot serve dcode's OpenAI-protocol traffic. This PR fixes both halves: agents whose manifest declaresprovider_type: openai_compatibleare coerced onto the managedopenai-completionsroute (config.toml keepsbase_url = "https://inference.local/v1"), and the gateway provider is registered--type openaion the endpoint's verified/v1OpenAI surface so OpenShell routesopenai_chat_completionsend to end. Endpoints that serve only the Anthropic Messages API fail onboarding with an actionable error instead of producing a sandbox that cannot infer.Related Issue
Fixes #6294
Changes
Sandbox-side route coercion
coerceAgentInferenceApi()insrc/lib/inference/config.ts: returnsopenai-completionswhen the agent's manifestprovider_typeisopenai_compatibleand the resolved API isanthropic-messages; pass-through otherwise. Applied atsetupNim's return (net-neutral +1/−1 inonboard.ts) and at the resumed session seed, soconfig.tomlbakesbase_url = "https://inference.local/v1"withinference/openai-completionsmetadata.gateway_managed) and Hermes (custom) keep negotiating Anthropic Messages natively; the Anthropic endpoint probe still validates the real endpoint before the coercion applies.Gateway-side OpenAI-surface registration (closes the runtime gap: OpenShell routes protocols per provider type — anthropic-type routes serve only
anthropic_messages, and no OpenAI↔Anthropic translation exists)setupInferenceintosetupRemoteProviderInference; when it resolvesopenai-completionsforcompatible-anthropic-endpoint(only the agent coercion produces this; Bedrock short-circuits earlier), register the provider--type openai.<origin>/v1with the same Bearer credential the gateway will use — the anthropic-flavor URL normalization strips a trailing/v1while OpenShell appends the/v1protocol path (with dedup), so re-adding the suffix keeps the probed URL identical to the runtime URL. Anthropic-only endpoints fail onboarding with an actionable message.provider updatecannot change--type), failing closed with a named-sandbox message when the provider is attached to other live sandboxes, so their Anthropic routing is never silently broken.Test & CI hygiene
base_url; registration tests covering type=openai argv, the/v1surface, stale-flip containment (unattached / own-sandbox / foreign-sandbox), actionable probe failure, native-Anthropic and keyless-reuse pass-throughs; resume heal/re-arm tests; reuse-gate matrix.ci/platform-matrix.jsonfile:line citation shifted by the new tests and regenerate the two synced docs tables (fixes the earliercli-test-shards (5)failure).Type of Change
Quality Gates
ci/platform-matrix.jsoncitation line-number refresh viascripts/generate-platform-docs.py.provider_typeand the exact probed API value; the gateway registration switch is double-gated (provider name + coerced API), verified against the endpoint's real/v1OpenAI surface with the same credential binding before registering, cannot loosen egress policy, and fails closed (named-sandbox message) rather than force-detaching a provider other live sandboxes use. Credential handling is unchanged (--credential COMPATIBLE_ANTHROPIC_API_KEY, value never in argv). OpenClaw/Hermes/Bedrock/nim/ollama/vllm paths verified untouched by tests.Verification
Verifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpx vitest run test/onboard-anthropic-compatible-openai-agent.test.ts src/lib/onboard/machine/handlers/provider-inference.test.ts src/lib/onboard/recovered-provider-reuse.test.ts src/lib/actions/sandbox/rebuild-provider-preflight.test.ts test/onboard-inference-failure-paths.test.ts src/lib/inference/config.test.ts src/lib/onboard/setup-nim-selection.test.ts test/langchain-deepagents-code-config.test.ts test/generate-platform-docs.test.ts→ 9 files, 176/176 passed;npm run typecheck:cli→ clean. Advisor-required live E2E green on the config-fix head:onboard-resume,onboard-repair(run 28772422788),ubuntu-repo-cloud-langchain-deepagents-code(run 28772424828); re-dispatched against the current head (see PR comments for scorecards).npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm run docsbuilds without warnings (doc changes only) — 0 errors; the 2 reported warnings are pre-existing and environmental (fern auth-gated redirects check, theme accent-contrast ratio), unrelated to the regenerated tablesscripts/generate-platform-docs.pySigned-off-by: Dongni Yang dongniy@nvidia.com
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Bug Fixes
Documentation