Skip to content

fix(hermes): append resumed one-shot turns - #6303

Merged
cv merged 36 commits into
mainfrom
fix/5254_hermes_resume_session
Jul 7, 2026
Merged

fix(hermes): append resumed one-shot turns#6303
cv merged 36 commits into
mainfrom
fix/5254_hermes_resume_session

Conversation

@chengjiew

@chengjiew chengjiew commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Summary

Translate Hermes top-level resumed one-shot invocations through the native non-interactive chat resume path so the new turn appends to the selected session instead of fragmenting into a fresh session.

Related Issue

Fixes #5254

Changes

  • Detect top-level --resume/--continue combined with -z/--oneshot in the installed Hermes wrapper.
  • Rewrite only that composed form to hermes chat --query ... --quiet --resume/--continue ..., preserving model/tool/config flags and leaving plain one-shot invocations untouched.
  • Add wrapper regression coverage for resumed one-shot, continued one-shot, and unchanged plain one-shot behavior.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: fixes existing documented flag composition without changing user-facing syntax.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: scoped wrapper argument rewrite only; existing gateway guard and config show masker branches remain first and unchanged, and the new path delegates to Hermes' native chat --query --quiet --resume/--continue implementation instead of directly editing session storage.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: local npx vitest run test/hermes-gateway-wrapper.test.ts is skipped by the existing Linux+python3 canRun gate on macOS; CI Linux should execute it.

Verification

  • PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: python3 -m py_compile agents/hermes/hermes-wrapper.py passed; direct Python assertions for _translate_resumed_oneshot passed; NPM_CONFIG_CACHE=/tmp/nemoclaw-5254-npm-cache npx biome check test/hermes-gateway-wrapper.test.ts passed; NPM_CONFIG_CACHE=/tmp/nemoclaw-5254-npm-cache npx vitest run test/hermes-gateway-wrapper.test.ts loaded but skipped all 45 tests due the existing macOS gate.
  • Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Chengjie Wang chengjiew@nvidia.com

Summary by CodeRabbit

  • New Features

    • Added automatic routing that rewrites resumed/continued one-shot agent invocations into Hermes’ non-interactive chat --query resume flow.
  • Bug Fixes

    • Fail-closed argv translation: only rewrites when inputs match supported resume/continue patterns; otherwise runs the original command unchanged.
    • Preserves supported arguments while safely handling unsupported/ambiguous forms (including -- termination and conflicting usage).
  • Tests

    • Expanded Hermes one-shot/resume/continue routing assertions, including updated argv recording (realArgv).
    • Added Hermes e2e regression to verify resume/continue don’t create extra sessions and export content matches the seeded marker.
    • Updated sandbox rebuild recovery test harness to use shared environment helpers.
  • Chores

    • Updated Hermes wrapper integrity pin and added build-time verification to detect flag allowlist drift.

@github-code-quality

github-code-quality Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the fix/5254_hermes_resu... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main fix/5254_hermes_resu... a071804 +/-
nemoclaw/src/se...cret-scanner.ts 100%
nemoclaw/src/commands/slash.ts 100%
nemoclaw/src/li...bprocess-env.ts 100%
nemoclaw/src/bl...eprint/state.ts 98%
nemoclaw/src/onboard/config.ts 98%
nemoclaw/src/bl...int/snapshot.ts 97%
nemoclaw/src/bl...print/runner.ts 95%
nemoclaw/src/co...ration-state.ts 94%
nemoclaw/src/bl...ate-networks.ts 94%
nemoclaw/src/index.ts 94%

TypeScript / code-coverage/cli

The overall coverage in the fix/5254_hermes_resu... branch is 74%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.
File main fix/5254_hermes_resu... a071804 +/-
src/lib/shields...nsition-lock.ts 85%
src/lib/onboard/preflight.ts 83%
src/lib/actions...all/run-plan.ts 81%
src/lib/state/o...oard-session.ts 81%
src/lib/actions...licy-channel.ts 79%
src/lib/state/sandbox.ts 75%
src/lib/onboard...er-gpu-patch.ts 69%
src/lib/shields/index.ts 68%
src/lib/policy/index.ts 66%
src/lib/onboard.ts 28%

Updated July 07, 2026 03:43 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@coderabbitai

coderabbitai Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Hermes wrapper support now rewrites approved resumed or continued one-shot invocations into native chat --query calls, with build-time flag drift checks and expanded wrapper/live regression coverage. One sandbox recovery test now uses shared environment reset and restore helpers.

Changes

Hermes resume routing and validation

Layer / File(s) Summary
Translation logic and argv rewriting
agents/hermes/hermes-wrapper.py
Adds allowlisted flag mappings and a strict translation function for resumed or continued one-shot argv, then wires the translation attempt into main() with fallback to the original argv and updates the intercepted-commands comment.
Wrapper test harness and routing assertions
test/hermes-gateway-wrapper.test.ts
Changes the wrapper test harness to record structured argv and adds assertions for resumed and continued one-shot routing, passthrough flags, and malformed or ambiguous argv shapes that skip translation.
Live resume regression
test/e2e/live/hermes-e2e.test.ts
Adds helpers for parsing Hermes session IDs from CLI output and a live regression that seeds, resumes, continues, and exports a session while checking session counts and exported prompts.
Build pin and flag check
agents/hermes/Dockerfile
Updates the Hermes wrapper SHA-256 build pin and adds a Dockerfile verification step that compares the wrapper’s expected Hermes flags against hermes --help output.

Sandbox recovery test harness

Layer / File(s) Summary
Shared test environment hooks
src/lib/actions/sandbox/rebuild-prepared-recovery.test.ts
Replaces local environment snapshotting and manual mock cleanup with shared rebuild-flow reset and restore helpers in the prepared rebuild recovery test.

Estimated code review effort: 4 (Complex) | ~45 minutes

Suggested labels: bug-fix

Suggested reviewers: ericksoa, brandonpelfrey

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Out of Scope Changes check ⚠️ Warning The PR includes an unrelated rebuild-prepared-recovery test harness refactor that is not tied to the Hermes resume-one-shot fix. Move the rebuild-prepared-recovery test harness cleanup into a separate PR unless it is required for the Hermes regression coverage.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: fixing resumed Hermes one-shot turns to append correctly.
Linked Issues check ✅ Passed The wrapper rewrite and regression coverage directly address #5254 by routing resumed one-shot calls through Hermes' native resume path.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/5254_hermes_resume_session

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor (Nemotron Ultra) — Changes requested

Merge posture: Do not merge yet
Primary next action: Resolve or justify PRA-1: Missing follow-up issue for upstream Hermes flag monitoring.
Open items: 0 required · 3 warnings · 3 suggestions · 3 test follow-ups
Since last review: 8 prior items resolved · 3 still apply · 2 new items found

Action checklist

Findings index

ID Severity Category Location Required action
PRA-1 Resolve/justify security agents/hermes/hermes-wrapper.py:75 Create a GitHub issue to track upstream Hermes flag stability monitoring and reference it in the wrapper's source-of-truth note (lines 65-75).
PRA-2 Resolve/justify architecture agents/hermes/Dockerfile:1 Coordinate with authors of PRs #6293 and #6292 to resolve Dockerfile conflicts before merging this PR.
PRA-3 Resolve/justify architecture test/e2e/live/hermes-e2e.test.ts:1 Coordinate with authors of PRs #6357, #6358, #6359 to sequence merges or rebase this PR on top of theirs.
PRA-4 Improvement tests test/e2e/live/hermes-e2e.test.ts:130 Move hermesSessionIds, onlyNewHermesSessionId, expectNoNewHermesSessions, runHermesCli, listHermesSessionsText, listHermesSessions, sessionLastActive to test/e2e/fixtures/hermes-session.ts and import them.
PRA-5 Improvement correctness agents/hermes/Dockerfile:135 Accept current defense-in-depth since patch script fails closed on drift, or derive grep pattern from patch script at build time (e.g., python3 -c 'import patch_hermes_session_list_preview; print(patch_hermes_session_list_preview.NEW)').
PRA-6 Improvement correctness agents/hermes/patch-session-list-preview.py:25 Accept as-is (defense-in-depth adequate) or define in shared JSON manifest imported by both patch script and Dockerfile for consistency.
Review findings by urgency: 0 required fixes, 3 items to resolve/justify, 3 in-scope improvements

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

PRA-1 Resolve/justify — Missing follow-up issue for upstream Hermes flag monitoring

  • Location: agents/hermes/hermes-wrapper.py:75
  • Category: security
  • Problem: Wrapper source-of-truth note states 'Tracking: keep monitoring upstream Hermes flag stability' but does not reference a specific GitHub issue number for this tracking.
  • Impact: Maintainers may forget to monitor upstream flag changes; when Hermes adds/removes flags, the wrapper's allowlist could drift silently until build-time AST validation catches it.
  • Recommended action: Create a GitHub issue to track upstream Hermes flag stability monitoring and reference it in the wrapper's source-of-truth note (lines 65-75).
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Check agents/hermes/hermes-wrapper.py lines 65-75 for source-of-truth note; verify a follow-up issue exists and its number is referenced in the comment.
  • Missing regression test: Process follow-up: create GitHub issue for upstream Hermes flag monitoring and add issue reference to wrapper comment.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Check agents/hermes/hermes-wrapper.py lines 65-75 for source-of-truth note; verify a follow-up issue exists and its number is referenced in the comment.
  • Evidence: Source-of-truth note lines 65-75 mention 'Tracking: keep monitoring upstream Hermes flag stability while this localized compatibility layer exists' with no issue link.

PRA-2 Resolve/justify — Merge conflict with open PRs #6293 and #6292 on agents/hermes/Dockerfile

PRA-3 Resolve/justify — High merge conflict risk with PRs #6357, #6358, #6359 on hermes-e2e.test.ts

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

PRA-4 Improvement — E2E inline helpers should move to fixture module

  • Location: test/e2e/live/hermes-e2e.test.ts:130
  • Category: tests
  • Problem: The E2E test defines 7 helper functions inline (hermesSessionIds, onlyNewHermesSessionId, expectNoNewHermesSessions, runHermesCli, listHermesSessionsText, listHermesSessions, sessionLastActive) that duplicate or complement utilities in test/e2e/fixtures/hermes-session.ts.
  • Impact: Reduced maintainability; helpers cannot be reused across E2E tests; test file grows beyond focused scope.
  • Suggested action: Move hermesSessionIds, onlyNewHermesSessionId, expectNoNewHermesSessions, runHermesCli, listHermesSessionsText, listHermesSessions, sessionLastActive to test/e2e/fixtures/hermes-session.ts and import them.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Inspect test/e2e/live/hermes-e2e.test.ts lines 130-200 for inline helpers; check test/e2e/fixtures/hermes-session.ts for existing exports (hermesSessionRow, hermesLastActive, exportHermesSession).
  • Missing regression test: Refactor helpers to fixture module; ensure all usages in hermes-e2e.test.ts import from fixture; verify tests still pass.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: E2E test lines 130-200 define hermesSessionIds, onlyNewHermesSessionId, expectNoNewHermesSessions, runHermesCli, listHermesSessionsText, listHermesSessions, sessionLastActive inline.

PRA-5 Improvement — Dockerfile grep pattern duplicates patch script NEW constant

  • Location: agents/hermes/Dockerfile:135
  • Category: correctness
  • Problem: Dockerfile line 135 hardcodes 'ORDER BY m.timestamp DESC, m.id DESC LIMIT 1' which duplicates patch-session-list-preview.py line 19 NEW constant. If patch constant changes, grep won't match (though patch script fails closed on occurrence mismatch).
  • Impact: Minor maintenance burden; defense-in-depth layer could drift from source of truth. Patch script's occurrence-count check remains primary guard.
  • Suggested action: Accept current defense-in-depth since patch script fails closed on drift, or derive grep pattern from patch script at build time (e.g., python3 -c 'import patch_hermes_session_list_preview; print(patch_hermes_session_list_preview.NEW)').
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Compare agents/hermes/patch-session-list-preview.py line 19 (NEW constant) with agents/hermes/Dockerfile line 135 (grep pattern).
  • Missing regression test: No automated cross-check; patch script occurrence count + Dockerfile grep provide layered verification.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Patch script line 19: NEW = 'ORDER BY m.timestamp DESC, m.id DESC LIMIT 1'; Dockerfile line 135: grep -q 'ORDER BY m.timestamp DESC, m.id DESC LIMIT 1' /opt/hermes/hermes_state.py

PRA-6 Improvement — EXPECTED_OCCURRENCES hardcoded without shared constant

  • Location: agents/hermes/patch-session-list-preview.py:25
  • Category: correctness
  • Problem: EXPECTED_OCCURRENCES = 6 is hardcoded in patch script. Acceptable since script is single source of truth and Dockerfile RUN step executes it (fails closed on mismatch), but could be derived from source analysis or shared manifest.
  • Impact: If Hermes source adds/removes query occurrences, the constant must be manually updated. Low risk since patch script fails closed and Dockerfile grep provides secondary verification.
  • Suggested action: Accept as-is (defense-in-depth adequate) or define in shared JSON manifest imported by both patch script and Dockerfile for consistency.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Check agents/hermes/patch-session-list-preview.py line 25 and Dockerfile lines 130-140 for occurrence count usage.
  • Missing regression test: Patch script fails closed on occurrence mismatch; Dockerfile grep verifies patched pattern exists.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Patch script line 25: EXPECTED_OCCURRENCES = 6; Dockerfile runs patch script which validates count; grep on line 135 verifies rewrite.
Simplification opportunities: 1 possible cut, net -1 lines possible

These are safe simplification checks only. Do not remove validation, security controls, data-loss prevention, or required tests.

  • PRA-5 shrink (agents/hermes/Dockerfile:135): Hardcoded grep pattern 'ORDER BY m.timestamp DESC, m.id DESC LIMIT 1' in Dockerfile line 135
    • Replacement: Derive pattern from patch script: python3 -c 'import sys; sys.path.insert(0, "/usr/local/lib/nemoclaw"); from patch_hermes_session_list_preview import NEW; print(NEW)'
    • Net: -1 lines
    • Safety boundary: Patch script occurrence-count verification remains primary drift detection; grep is defense-in-depth only.
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

  • PRA-T1 Runtime validation — _split_flag_value handles short flag equals form (-f=value) — not currently used but possible future flag. Runtime/sandbox/infrastructure paths need behavioral runtime validation: agents/hermes/Dockerfile, agents/hermes/hermes-wrapper.py, agents/hermes/patch-session-list-preview.py, scripts/update-hermes-agent.sh. E2E test provides live validation; Dockerfile smoke test provides build-time validation; AST validation provides flag drift detection.
  • PRA-T2 Runtime validation — wrapper exec failure (hermes.real not executable) returns 126 with generic error — partially covered by stubMode test. Runtime/sandbox/infrastructure paths need behavioral runtime validation: agents/hermes/Dockerfile, agents/hermes/hermes-wrapper.py, agents/hermes/patch-session-list-preview.py, scripts/update-hermes-agent.sh. E2E test provides live validation; Dockerfile smoke test provides build-time validation; AST validation provides flag drift detection.
  • PRA-T3 E2E inline helpers should move to fixture module — Move hermesSessionIds, onlyNewHermesSessionId, expectNoNewHermesSessions, runHermesCli, listHermesSessionsText, listHermesSessions, sessionLastActive to test/e2e/fixtures/hermes-session.ts and import them.
Since last review details

Current findings, using the urgency labels above:

PRA-1 Resolve/justify — Missing follow-up issue for upstream Hermes flag monitoring

  • Location: agents/hermes/hermes-wrapper.py:75
  • Category: security
  • Problem: Wrapper source-of-truth note states 'Tracking: keep monitoring upstream Hermes flag stability' but does not reference a specific GitHub issue number for this tracking.
  • Impact: Maintainers may forget to monitor upstream flag changes; when Hermes adds/removes flags, the wrapper's allowlist could drift silently until build-time AST validation catches it.
  • Recommended action: Create a GitHub issue to track upstream Hermes flag stability monitoring and reference it in the wrapper's source-of-truth note (lines 65-75).
  • Expected follow-up: Resolve in this PR or explain why the risk is acceptable.
  • Verification: Check agents/hermes/hermes-wrapper.py lines 65-75 for source-of-truth note; verify a follow-up issue exists and its number is referenced in the comment.
  • Missing regression test: Process follow-up: create GitHub issue for upstream Hermes flag monitoring and add issue reference to wrapper comment.
  • Done when: The risk is fixed or explicitly justified in the PR. Verification: Check agents/hermes/hermes-wrapper.py lines 65-75 for source-of-truth note; verify a follow-up issue exists and its number is referenced in the comment.
  • Evidence: Source-of-truth note lines 65-75 mention 'Tracking: keep monitoring upstream Hermes flag stability while this localized compatibility layer exists' with no issue link.

PRA-2 Resolve/justify — Merge conflict with open PRs #6293 and #6292 on agents/hermes/Dockerfile

PRA-3 Resolve/justify — High merge conflict risk with PRs #6357, #6358, #6359 on hermes-e2e.test.ts

PRA-4 Improvement — E2E inline helpers should move to fixture module

  • Location: test/e2e/live/hermes-e2e.test.ts:130
  • Category: tests
  • Problem: The E2E test defines 7 helper functions inline (hermesSessionIds, onlyNewHermesSessionId, expectNoNewHermesSessions, runHermesCli, listHermesSessionsText, listHermesSessions, sessionLastActive) that duplicate or complement utilities in test/e2e/fixtures/hermes-session.ts.
  • Impact: Reduced maintainability; helpers cannot be reused across E2E tests; test file grows beyond focused scope.
  • Suggested action: Move hermesSessionIds, onlyNewHermesSessionId, expectNoNewHermesSessions, runHermesCli, listHermesSessionsText, listHermesSessions, sessionLastActive to test/e2e/fixtures/hermes-session.ts and import them.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Inspect test/e2e/live/hermes-e2e.test.ts lines 130-200 for inline helpers; check test/e2e/fixtures/hermes-session.ts for existing exports (hermesSessionRow, hermesLastActive, exportHermesSession).
  • Missing regression test: Refactor helpers to fixture module; ensure all usages in hermes-e2e.test.ts import from fixture; verify tests still pass.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: E2E test lines 130-200 define hermesSessionIds, onlyNewHermesSessionId, expectNoNewHermesSessions, runHermesCli, listHermesSessionsText, listHermesSessions, sessionLastActive inline.

PRA-5 Improvement — Dockerfile grep pattern duplicates patch script NEW constant

  • Location: agents/hermes/Dockerfile:135
  • Category: correctness
  • Problem: Dockerfile line 135 hardcodes 'ORDER BY m.timestamp DESC, m.id DESC LIMIT 1' which duplicates patch-session-list-preview.py line 19 NEW constant. If patch constant changes, grep won't match (though patch script fails closed on occurrence mismatch).
  • Impact: Minor maintenance burden; defense-in-depth layer could drift from source of truth. Patch script's occurrence-count check remains primary guard.
  • Suggested action: Accept current defense-in-depth since patch script fails closed on drift, or derive grep pattern from patch script at build time (e.g., python3 -c 'import patch_hermes_session_list_preview; print(patch_hermes_session_list_preview.NEW)').
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Compare agents/hermes/patch-session-list-preview.py line 19 (NEW constant) with agents/hermes/Dockerfile line 135 (grep pattern).
  • Missing regression test: No automated cross-check; patch script occurrence count + Dockerfile grep provide layered verification.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Patch script line 19: NEW = 'ORDER BY m.timestamp DESC, m.id DESC LIMIT 1'; Dockerfile line 135: grep -q 'ORDER BY m.timestamp DESC, m.id DESC LIMIT 1' /opt/hermes/hermes_state.py

PRA-6 Improvement — EXPECTED_OCCURRENCES hardcoded without shared constant

  • Location: agents/hermes/patch-session-list-preview.py:25
  • Category: correctness
  • Problem: EXPECTED_OCCURRENCES = 6 is hardcoded in patch script. Acceptable since script is single source of truth and Dockerfile RUN step executes it (fails closed on mismatch), but could be derived from source analysis or shared manifest.
  • Impact: If Hermes source adds/removes query occurrences, the constant must be manually updated. Low risk since patch script fails closed and Dockerfile grep provides secondary verification.
  • Suggested action: Accept as-is (defense-in-depth adequate) or define in shared JSON manifest imported by both patch script and Dockerfile for consistency.
  • Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
  • Verification: Check agents/hermes/patch-session-list-preview.py line 25 and Dockerfile lines 130-140 for occurrence count usage.
  • Missing regression test: Patch script fails closed on occurrence mismatch; Dockerfile grep verifies patched pattern exists.
  • Done when: The local improvement is applied, or the PR notes why it should be deferred.
  • Evidence: Patch script line 25: EXPECTED_OCCURRENCES = 6; Dockerfile runs patch script which validates count; grep on line 135 verifies rewrite.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: hermes-e2e, build-hermes-sandbox-image, rebuild-hermes
Optional E2E: hermes-dashboard, hermes-inference-switch

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • hermes-e2e (high): Required because the PR changes real Hermes assistant session behavior and the Hermes wrapper. This job runs install.sh onboarding for Hermes, validates sandbox health, live hosted inference, and now directly exercises resumed/continued one-shot session append/export behavior in a live sandbox.
  • build-hermes-sandbox-image (high): Required because agents/hermes/Dockerfile and installed Hermes runtime files changed. This job builds the Hermes production sandbox image and runs the Hermes sandbox secret-boundary/root-entrypoint coverage that protects the security-critical wrapper and image startup boundary.
  • rebuild-hermes (high): Required because the PR changes the Hermes Dockerfile and update/deployment compatibility logic. This job validates the real Hermes rebuild path from source, including install.sh, Docker/OpenShell integration, Hermes base-image rebuild, registry behavior, and runtime deployment hygiene.

Optional E2E

  • hermes-dashboard (high): Optional adjacent confidence: it reruns the Hermes live flow with the dashboard enabled. Useful because the PR patches session-list preview semantics that are user-visible in Hermes session surfaces, but the main required hermes-e2e already covers the core CLI/session contract.
  • hermes-inference-switch (high): Optional adjacent confidence: the wrapper translation forwards provider/model-related flags for resumed one-shot calls. This job validates Hermes inference-provider switching, but the PR does not directly change inference routing.

New E2E recommendations

  • hermes-agent-upgrade-workaround-removal (medium): Existing unit tests check update-hermes-agent guard logic, and rebuild-hermes validates the current rebuild path, but there is no dedicated E2E that simulates a Hermes version upgrade where the v0.17.0 wrapper/session-preview compatibility workarounds must be removed or rejected end-to-end.
    • Suggested test: Add a Hermes upgrade E2E that runs scripts/update-hermes-agent.sh against an installed-copy fixture or ephemeral source install, attempts a simulated Hermes semver bump, and verifies the compatibility-workaround removal guard fails closed before a stale patched image can be built.

@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

E2E Target Recommendation

Required E2E targets: hermes-dashboard, security-posture
Optional E2E targets: hermes-gpu-startup

Dispatch required E2E targets:

  • gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=hermes-dashboard
  • gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=security-posture

Workflow run

Full E2E target advisor summary

E2E Target Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E targets

  • hermes-dashboard: Focused free-standing E2E job wired for changed live test test/e2e/live/hermes-e2e.test.ts.
    • Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=hermes-dashboard
  • security-posture: Focused free-standing E2E job wired for changed live test test/e2e/live/hermes-e2e.test.ts.
    • Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=security-posture

Optional E2E targets

  • hermes-gpu-startup: Optional adjacent Hermes coverage on the special GPU runner, since the PR changes the Hermes Dockerfile/runtime wrapper. The primary non-GPU Hermes runtime path is covered by the required hermes-e2e job.
    • Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=hermes-gpu-startup

Relevant changed files

  • agents/hermes/Dockerfile
  • agents/hermes/hermes-wrapper.py
  • agents/hermes/patch-session-list-preview.py
  • scripts/update-hermes-agent.sh
  • test/e2e/fixtures/hermes-session.ts
  • test/e2e/live/hermes-e2e.test.ts

@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: No advisor follow-up required beyond maintainer review.
Open items: 0 required · 0 warnings · 0 suggestions · 0 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@coderabbitai

coderabbitai Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details
{"name":"HttpError","status":500,"request":{"method":"PATCH","url":"https://api.github.com/repos/NVIDIA/NemoClaw/issues/comments/4890712488","headers":{"accept":"application/vnd.github.v3+json","user-agent":"octokit.js/0.0.0-development octokit-core.js/7.0.6 Node.js/24","content-type":"application/json; charset=utf-8"},"body":{"body":"<!-- This is an auto-generated comment: summarize by coderabbit.ai -->\n<!-- review_stack_entry_start -->\n\n[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/NVIDIA/NemoClaw/pull/6303?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)\n\n<!-- review_stack_entry_end -->\n<!-- This is an auto-generated comment: review in progress by coderabbit.ai -->\n\n> [!NOTE]\n> Currently processing new changes in this PR. This may take a few minutes, please wait...\n> \n> <details>\n> <summary>⚙️ Run configuration</summary>\n> \n> **Configuration used**: Path: .coderabbit.yaml\n> \n> **Review profile**: CHILL\n> \n> **Plan**: Enterprise\n> \n> **Run ID**: `1ad5676b-9019-48d9-bcb9-6c97b16fa7e1`\n> \n> </details>\n> \n> <details>\n> <summary>📥 Commits</summary>\n> \n> Reviewing files that changed from the base of the PR and between f0d25491cacb430026d4e0fe6d85ba07a182b2f5 and ea21a24adf7f739b5684d16fde5e988448ac7532.\n> \n> </details>\n> \n> <details>\n> <summary>📒 Files selected for processing (2)</summary>\n> \n> * `agents/hermes/hermes-wrapper.py`\n> * `test/hermes-gateway-wrapper.test.ts`\n> \n> </details>\n> \n> \n\n<!-- end of auto-generated comment: review in progress by coderabbit.ai -->\n\n<!-- finishing_touch_checkbox_start -->\n\n<details>\n<summary>✨ Finishing Touches</summary>\n\n<details>\n<summary>📝 Generate docstrings</summary>\n\n- [ ] <!-- {\"checkboxId\": \"7962f53c-55bc-4827-bfbf-6a18da830691\"} --> Create stacked PR\n- [ ] <!-- {\"checkboxId\": \"3e1879ae-f29b-4d0d-8e06-d12b7ba33d98\"} --> Commit on current branch\n\n</details>\n<details>\n<summary>🧪 Generate unit tests (beta)</summary>\n\n- [ ] <!-- {\"checkboxId\": \"f47ac10b-58cc-4372-a567-0e02b2c3d479\", \"radioGroupId\": \"utg-output-choice-group-unknown_comment_id\"} -->   Create PR with unit tests\n- [ ] <!-- {\"checkboxId\": \"6ba7b810-9dad-11d1-80b4-00c04fd430c8\", \"radioGroupId\": \"utg-output-choice-group-unknown_comment_id\"} -->   Commit unit tests in branch `fix/5254_hermes_resume_session`\n\n</details>\n\n</details>\n\n<!-- finishing_touch_checkbox_end -->\n<!-- tips_start -->\n\n---\n\n\n\n\n<sub>Comment `@coderabbitai help` to get the list of available commands.</sub>\n\n<!-- tips_end -->"},"request":{"retryCount":3,"signal":{},"retries":3,"retryAfter":16}}}

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
test/hermes-gateway-wrapper.test.ts (1)

226-228: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Assertions can't distinguish argument boundaries.

Because the stub records with printf '%s' "$*" (space-joined), a bug that splits the prompt (e.g. --query Summarize the latest turn as multiple argv items vs a single quoted arg) would produce an identical string and pass. For prompts containing spaces, the exact-string check doesn't actually prove the prompt was forwarded as one argument. Consider recording args newline-separated (printf '%s\n' "$@") so boundary regressions are observable.

As per path instructions: prefer observable outcomes and flag assertions that pass without exercising their claim.

Also applies to: 248-250

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/hermes-gateway-wrapper.test.ts` around lines 226 - 228, The current
assertion on run.realArgs only compares a space-joined string, so it cannot
detect whether the prompt was passed as one argv item or split into multiple
arguments. Update the test harness around the hermes-gateway wrapper to record
arguments with clear boundaries (for example in the run stub used by
hermes-gateway-wrapper.test.ts) and then adjust the expectations in the affected
test cases so they verify the prompt is forwarded as a single argument rather
than just matching the flattened string.

Source: Path instructions

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/hermes-gateway-wrapper.test.ts`:
- Around line 226-228: The current assertion on run.realArgs only compares a
space-joined string, so it cannot detect whether the prompt was passed as one
argv item or split into multiple arguments. Update the test harness around the
hermes-gateway wrapper to record arguments with clear boundaries (for example in
the run stub used by hermes-gateway-wrapper.test.ts) and then adjust the
expectations in the affected test cases so they verify the prompt is forwarded
as a single argument rather than just matching the flattened string.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f8c979db-da6b-4b66-9124-6be6180e76d7

📥 Commits

Reviewing files that changed from the base of the PR and between f0d2549 and 28a9a4d.

📒 Files selected for processing (2)
  • agents/hermes/hermes-wrapper.py
  • test/hermes-gateway-wrapper.test.ts

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
test/hermes-gateway-wrapper.test.ts (1)

425-465: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Outer test timeout may be too tight relative to per-call timeouts.

This test issues ~10 sequential real spawnSync calls (via runHermes/listSessions), each governed by an independently configurable timeout (NEMOCLAW_HERMES_SESSION_PERSISTENCE_TIMEOUT_MS, default 120000ms), but the it() itself is capped at a fixed 5 * 60_000 (300000ms). If per-call latency (especially the real -z LLM calls) trends toward the per-call timeout, the outer test timeout can fire first, producing a flaky failure unrelated to the resume/session-persistence behavior under test.

Consider deriving the outer timeout from the configured per-call timeout and call count (or bumping it with headroom), e.g.:

💡 Suggested timeout budgeting fix
-  5 * 60_000,
+  timeout * 6, // headroom for ~10 sequential real CLI calls
 );
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/hermes-gateway-wrapper.test.ts` around lines 425 - 465, The Hermes
session persistence integration test timeout is hard-coded too low relative to
the configurable per-call `spawnSync` timeout used in `runHermes` and
`listSessions`, which can cause flaky outer `it()` failures before the real work
finishes. Update the timeout passed to `it.skipIf(... )` in
`hermes-gateway-wrapper.test.ts` to be derived from
`NEMOCLAW_HERMES_SESSION_PERSISTENCE_TIMEOUT_MS` with enough headroom for the
sequential calls in this test, so the test budget matches the configured
runtime. Use the existing `runHermes` and `listSessions` flow as the reference
point when sizing the outer timeout.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/hermes-gateway-wrapper.test.ts`:
- Around line 425-465: The Hermes session persistence integration test timeout
is hard-coded too low relative to the configurable per-call `spawnSync` timeout
used in `runHermes` and `listSessions`, which can cause flaky outer `it()`
failures before the real work finishes. Update the timeout passed to
`it.skipIf(... )` in `hermes-gateway-wrapper.test.ts` to be derived from
`NEMOCLAW_HERMES_SESSION_PERSISTENCE_TIMEOUT_MS` with enough headroom for the
sequential calls in this test, so the test budget matches the configured
runtime. Use the existing `runHermes` and `listSessions` flow as the reference
point when sizing the outer timeout.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: dcc80b6a-96c9-4b5a-9a59-1f9e3ff740c9

📥 Commits

Reviewing files that changed from the base of the PR and between a191f8e and 32dc421.

📒 Files selected for processing (2)
  • agents/hermes/hermes-wrapper.py
  • test/hermes-gateway-wrapper.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
  • agents/hermes/hermes-wrapper.py

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (2)
agents/hermes/Dockerfile (1)

206-206: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Add a timeout to the hermes --help subprocess call.

subprocess.check_output(["/usr/local/bin/hermes", "--help"], text=True) has no timeout; a hang here would stall the Docker build indefinitely.

♻️ Proposed fix
-help_text = subprocess.check_output(["/usr/local/bin/hermes", "--help"], text=True); \
+help_text = subprocess.check_output(["/usr/local/bin/hermes", "--help"], text=True, timeout=30); \
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@agents/hermes/Dockerfile` at line 206, The Hermes build-time validation in
the Dockerfile can hang because the
`subprocess.check_output(["/usr/local/bin/hermes", "--help"], text=True)` call
has no timeout. Update the inline Python check that computes `expected` and
`missing` to pass a reasonable timeout to the `check_output` call so the `hermes
--help` probe fails fast instead of stalling the build indefinitely.
test/e2e/live/hermes-e2e.test.ts (1)

478-513: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Extract the repeated "no new sessions" assertion.

The resume block (Lines 487-499) and continue block (Lines 501-513) duplicate the same "list sessions before → run CLI → list sessions after → assert no new IDs" pattern. Consolidating reduces duplication risk if the assertion logic needs to change later.

♻️ Proposed helper extraction
+async function expectNoNewHermesSessions(
+  runHermesCli: (args: string[], artifactName: string) => Promise<string>,
+  listHermesSessions: (artifactName: string) => Promise<Set<string>>,
+  before: Set<string>,
+  args: string[],
+  runArtifact: string,
+  afterArtifact: string,
+): Promise<void> {
+  await runHermesCli(args, runArtifact);
+  const after = await listHermesSessions(afterArtifact);
+  expect([...after].filter((id) => !before.has(id))).toEqual([]);
+}
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/live/hermes-e2e.test.ts` around lines 478 - 513, The resume and
continue checks in hermes-e2e.test.ts duplicate the same “no new sessions” flow
around listHermesSessions, runHermesCli, and the post-run filter/assertion.
Extract that repeated logic into a small helper near the existing issue5254 test
block, and use it for both the "--resume" and "-c" paths so the session
comparison and expectation live in one place.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@agents/hermes/Dockerfile`:
- Line 206: The Hermes wrapper drift check only validates _VALUE_FLAGS and
_BOOLEAN_FLAGS, so it can miss changes to the resumed-oneshot flags. Update the
Dockerfile’s hermes --help verification to also include the flags handled by
_translate_resumed_oneshot() in hermes-wrapper.py, specifically the -z/--oneshot
and -c/--continue aliases, so upstream changes to those options are caught by
the build guard.

---

Nitpick comments:
In `@agents/hermes/Dockerfile`:
- Line 206: The Hermes build-time validation in the Dockerfile can hang because
the `subprocess.check_output(["/usr/local/bin/hermes", "--help"], text=True)`
call has no timeout. Update the inline Python check that computes `expected` and
`missing` to pass a reasonable timeout to the `check_output` call so the `hermes
--help` probe fails fast instead of stalling the build indefinitely.

In `@test/e2e/live/hermes-e2e.test.ts`:
- Around line 478-513: The resume and continue checks in hermes-e2e.test.ts
duplicate the same “no new sessions” flow around listHermesSessions,
runHermesCli, and the post-run filter/assertion. Extract that repeated logic
into a small helper near the existing issue5254 test block, and use it for both
the "--resume" and "-c" paths so the session comparison and expectation live in
one place.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fbcba3de-c4eb-4d1f-b105-d545f36db749

📥 Commits

Reviewing files that changed from the base of the PR and between 32dc421 and d088c3d.

📒 Files selected for processing (4)
  • agents/hermes/Dockerfile
  • agents/hermes/hermes-wrapper.py
  • test/e2e/live/hermes-e2e.test.ts
  • test/hermes-gateway-wrapper.test.ts
🚧 Files skipped from review as they are similar to previous changes (2)
  • agents/hermes/hermes-wrapper.py
  • test/hermes-gateway-wrapper.test.ts

Comment thread agents/hermes/Dockerfile Outdated
@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some jobs failed

Run: 28815425624
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: hermes-dashboard
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
hermes-dashboard ❌ failure

Failed jobs: hermes-dashboard. Check run artifacts for logs.

@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some jobs failed

Run: 28815425613
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: security-posture
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
security-posture ❌ failure

Failed jobs: security-posture. Check run artifacts for logs.

@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28815967524
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: hermes-dashboard
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
hermes-dashboard ✅ success

@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28815967190
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: security-posture
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
security-posture ✅ success

@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28816036907
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: security-posture
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
security-posture ✅ success

@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28816036916
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: hermes-dashboard
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
hermes-dashboard ✅ success

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28832647303
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: hermes-dashboard
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
hermes-dashboard ✅ success

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28832647339
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: security-posture
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
security-posture ✅ success

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28833007118
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: hermes-dashboard
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
hermes-dashboard ✅ success

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28833006984
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: security-posture
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
security-posture ✅ success

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some jobs failed

Run: 28833945887
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: hermes-dashboard
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
hermes-dashboard ❌ failure

Failed jobs: hermes-dashboard. Check run artifacts for logs.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some jobs failed

Run: 28833945932
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: security-posture
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
security-posture ❌ failure

Failed jobs: security-posture. Check run artifacts for logs.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some jobs failed

Run: 28837384639
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: hermes-dashboard
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
hermes-dashboard ❌ failure

Failed jobs: hermes-dashboard. Check run artifacts for logs.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ❌ Some jobs failed

Run: 28837384657
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: security-posture
Summary: 0 passed, 1 failed, 0 cancelled, 0 skipped

Job Result
security-posture ❌ failure

Failed jobs: security-posture. Check run artifacts for logs.

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28837981570
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: hermes-dashboard
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
hermes-dashboard ✅ success

@github-actions

github-actions Bot commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

E2E Target Results — ✅ All requested jobs passed

Run: 28838233081
Workflow ref: fix/5254_hermes_resume_session
Requested targets: (default — all supported)
Requested jobs: security-posture
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job Result
security-posture ✅ success

@cv cv added the v0.0.76 label Jul 7, 2026

@cv cv left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Substantive review passed. The session-version fallback, Dockerfile patch guard, and regression coverage satisfy #5254. Required Target Advisor runs passed on behavior-equivalent predecessor 6a9a95e (hermes-dashboard and security-posture); the later delta is comments, build-time grep and hash refresh, and test assertions only, so the existing live evidence remains valid.

@cv
cv merged commit 977af0a into main Jul 7, 2026
41 checks passed
@cv
cv deleted the fix/5254_hermes_resume_session branch July 7, 2026 08:36
@wscurran wscurran added area: cli Command line interface, flags, terminal UX, or output bug-fix PR fixes a bug or regression integration: hermes Hermes integration behavior labels Jul 7, 2026
@wscurran

wscurran commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

apurvvkumaria added a commit that referenced this pull request Jul 8, 2026
<!-- markdownlint-disable MD041 -->
## Summary

Prepares the user-facing documentation for NemoClaw v0.0.76 and closes
the release-prep documentation gate. It adds the release highlights,
documents the arm64 Local NIM warning and expanded image cleanup
behavior, and fixes agent-specific command headings in generated guides.

## Changes

- Add the v0.0.76 release-notes section and move the shared-gateway
route containment entry out of the v0.0.74 history where it was
incorrectly placed.
- Document the advisory Linux arm64 Local NIM manifest warning in the
canonical platform matrix and local-inference guidance.
- Document that `gc` scans both gateway-built and locally prebuilt
sandbox image repositories.
- Keep OpenClaw and Hermes session headings out of the generated Deep
Agents command guide.
- Add a focused variant regression test for the agent-specific session
headings.

### Source summary

| Merged sources | Documentation coverage |
| --- | --- |
| [#6414](#6414),
[#6418](#6418),
[#6416](#6416),
[#6344](#6344) | v0.0.76 release
notes and the Deep Agents quickstart/inference routes |
| [#6340](#6340) | v0.0.76
release notes and existing Deep Agents observability guidance |
| [#6338](#6338),
[#6378](#6378),
[#6297](#6297) | v0.0.76 release
notes and existing inference/troubleshooting guidance |
| [#6362](#6362) | v0.0.76
release notes and existing lifecycle, command, and credential guidance |
| [#6330](#6330),
[#6307](#6307),
[#6008](#6008) | v0.0.76 release
notes and existing security, troubleshooting, and command guidance |
| [#6382](#6382) | v0.0.76
release notes and existing MCP/command guidance |
| [#6326](#6326),
[#5868](#5868),
[#5539](#5539) | v0.0.76 release
notes, platform matrix, inference options, and local-inference guidance
|
| [#6396](#6396),
[#6390](#6390),
[#6007](#6007) | v0.0.76 release
notes and existing messaging guidance |
| [#5388](#5388),
[#6249](#6249),
[#6303](#6303),
[#6306](#6306) | v0.0.76 release
notes and command/lifecycle guidance |

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification

- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx vitest run --project integration
test/generate-platform-docs.test.ts test/agent-variant-docs.test.ts
test/sync-agent-variant-docs.test.ts` (3 files, 29 tests passed)
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only) —
completed with 0 errors and 2 pre-existing Fern warnings
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Added v0.0.76 release notes content, and removed an older conflicting
bullet from the surrounding release history.
* Expanded Local NVIDIA NIM guidance across inference/provider docs,
including an advisory for Linux arm64 DGX Spark/DGX Station hosts when a
matching `linux/arm64` image manifest is unavailable.
* Updated the command reference for correct session-section rendering
and clarified `gc` image cleanup sources.
* **Tests**
* Added coverage ensuring Deep Agents omits sessions headings while
Hermes includes them.
* **CI**
* Refreshed Local NVIDIA NIM provider notes used in the platform matrix.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
## Summary
Translate Hermes top-level resumed one-shot invocations through the
native non-interactive chat resume path so the new turn appends to the
selected session instead of fragmenting into a fresh session.

## Related Issue
Fixes NVIDIA#5254

## Changes
- Detect top-level `--resume`/`--continue` combined with
`-z`/`--oneshot` in the installed Hermes wrapper.
- Rewrite only that composed form to `hermes chat --query ... --quiet
--resume/--continue ...`, preserving model/tool/config flags and leaving
plain one-shot invocations untouched.
- Add wrapper regression coverage for resumed one-shot, continued
one-shot, and unchanged plain one-shot behavior.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: fixes existing documented
flag composition without changing user-facing syntax.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: scoped wrapper argument
rewrite only; existing `gateway` guard and `config show` masker branches
remain first and unchanged, and the new path delegates to Hermes' native
`chat --query --quiet --resume/--continue` implementation instead of
directly editing session storage.
- [x] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue: local `npx vitest run
test/hermes-gateway-wrapper.test.ts` is skipped by the existing
Linux+python3 `canRun` gate on macOS; CI Linux should execute it.

## Verification
- [ ] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [ ] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification:
`python3 -m py_compile agents/hermes/hermes-wrapper.py` passed; direct
Python assertions for `_translate_resumed_oneshot` passed;
`NPM_CONFIG_CACHE=/tmp/nemoclaw-5254-npm-cache npx biome check
test/hermes-gateway-wrapper.test.ts` passed;
`NPM_CONFIG_CACHE=/tmp/nemoclaw-5254-npm-cache npx vitest run
test/hermes-gateway-wrapper.test.ts` loaded but skipped all 45 tests due
the existing macOS gate.
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Chengjie Wang <chengjiew@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added automatic routing that rewrites resumed/continued one-shot agent
invocations into Hermes’ non-interactive `chat --query` resume flow.

* **Bug Fixes**
* Fail-closed argv translation: only rewrites when inputs match
supported resume/continue patterns; otherwise runs the original command
unchanged.
* Preserves supported arguments while safely handling
unsupported/ambiguous forms (including `--` termination and conflicting
usage).

* **Tests**
* Expanded Hermes one-shot/resume/continue routing assertions, including
updated argv recording (`realArgv`).
* Added Hermes e2e regression to verify resume/continue don’t create
extra sessions and export content matches the seeded marker.
* Updated sandbox rebuild recovery test harness to use shared
environment helpers.

* **Chores**
* Updated Hermes wrapper integrity pin and added build-time verification
to detect flag allowlist drift.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
<!-- markdownlint-disable MD041 -->
## Summary

Prepares the user-facing documentation for NemoClaw v0.0.76 and closes
the release-prep documentation gate. It adds the release highlights,
documents the arm64 Local NIM warning and expanded image cleanup
behavior, and fixes agent-specific command headings in generated guides.

## Changes

- Add the v0.0.76 release-notes section and move the shared-gateway
route containment entry out of the v0.0.74 history where it was
incorrectly placed.
- Document the advisory Linux arm64 Local NIM manifest warning in the
canonical platform matrix and local-inference guidance.
- Document that `gc` scans both gateway-built and locally prebuilt
sandbox image repositories.
- Keep OpenClaw and Hermes session headings out of the generated Deep
Agents command guide.
- Add a focused variant regression test for the agent-specific session
headings.

### Source summary

| Merged sources | Documentation coverage |
| --- | --- |
| [NVIDIA#6414](NVIDIA#6414),
[NVIDIA#6418](NVIDIA#6418),
[NVIDIA#6416](NVIDIA#6416),
[NVIDIA#6344](NVIDIA#6344) | v0.0.76 release
notes and the Deep Agents quickstart/inference routes |
| [NVIDIA#6340](NVIDIA#6340) | v0.0.76
release notes and existing Deep Agents observability guidance |
| [NVIDIA#6338](NVIDIA#6338),
[NVIDIA#6378](NVIDIA#6378),
[NVIDIA#6297](NVIDIA#6297) | v0.0.76 release
notes and existing inference/troubleshooting guidance |
| [NVIDIA#6362](NVIDIA#6362) | v0.0.76
release notes and existing lifecycle, command, and credential guidance |
| [NVIDIA#6330](NVIDIA#6330),
[NVIDIA#6307](NVIDIA#6307),
[NVIDIA#6008](NVIDIA#6008) | v0.0.76 release
notes and existing security, troubleshooting, and command guidance |
| [NVIDIA#6382](NVIDIA#6382) | v0.0.76
release notes and existing MCP/command guidance |
| [NVIDIA#6326](NVIDIA#6326),
[NVIDIA#5868](NVIDIA#5868),
[NVIDIA#5539](NVIDIA#5539) | v0.0.76 release
notes, platform matrix, inference options, and local-inference guidance
|
| [NVIDIA#6396](NVIDIA#6396),
[NVIDIA#6390](NVIDIA#6390),
[NVIDIA#6007](NVIDIA#6007) | v0.0.76 release
notes and existing messaging guidance |
| [NVIDIA#5388](NVIDIA#5388),
[NVIDIA#6249](NVIDIA#6249),
[NVIDIA#6303](NVIDIA#6303),
[NVIDIA#6306](NVIDIA#6306) | v0.0.76 release
notes and command/lifecycle guidance |

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [x] Docs updated for user-facing behavior changes
- [ ] Docs not applicable — justification:
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification

- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — `npx vitest run --project integration
test/generate-platform-docs.test.ts test/agent-variant-docs.test.ts
test/sync-agent-variant-docs.test.ts` (3 files, 29 tests passed)
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only) —
completed with 0 errors and 2 pre-existing Fern warnings
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Added v0.0.76 release notes content, and removed an older conflicting
bullet from the surrounding release history.
* Expanded Local NVIDIA NIM guidance across inference/provider docs,
including an advisory for Linux arm64 DGX Spark/DGX Station hosts when a
matching `linux/arm64` image manifest is unavailable.
* Updated the command reference for correct session-section rendering
and clarified `gc` image cleanup sources.
* **Tests**
* Added coverage ensuring Deep Agents omits sessions headings while
Hermes includes them.
* **CI**
* Refreshed Local NVIDIA NIM provider notes used in the platform matrix.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: cli Command line interface, flags, terminal UX, or output bug-fix PR fixes a bug or regression integration: hermes Hermes integration behavior

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[All Platforms][CLI&UX] --resume <sessionId> starts a new session instead of appending to existing session

3 participants