fix(onboard): make local docker-driver gateway JWT non-expiring - #6304
Merged
Conversation
Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Contributor
📝 WalkthroughWalkthroughThis PR changes the Docker-driver gateway sandbox JWT TTL from 3600 seconds to 0 (non-expiring), updates associated auth contract tests to mint and validate tokens with exp=0 when ttl_secs is 0, and revises documentation to reflect the new non-expiring token rationale. ChangesSandbox JWT TTL Update
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-6304.docs.buildwithfern.com/nemoclaw |
Contributor
PR Review Advisor (Nemotron Ultra) — No blocking findingsMerge posture: No blocking advisor findings Action checklist
Findings index
Review findings by urgency: 0 required fixes, 1 item to resolve/justify, 2 in-scope improvements
|
laitingsheng
added
security
NV QA
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Contributor
PR Review Advisor — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
Review findings by urgency: 0 required fixes, 2 items to resolve/justify, 1 in-scope improvement
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/lib/onboard/docker-driver-gateway-config-auth-contract.test.ts (1)
206-213: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winInconsistent
exphandling vs. rest of the file.Line 212 still computes
exp: now + DOCKER_DRIVER_GATEWAY_JWT_TTL_SECS, unlike thettlSecs === 0 ? 0 : now + ttlSecspattern applied at lines 91 and 107. With the TTL now0, this mints a token withexp = nowinstead of the actualexp = 0sentinel production code emits, so this test no longer exercises a representative non-expiring token.As per path instructions, tests should avoid "conditionals that make a test pass without exercising its claim" — here the test still passes, but only because
exp = nowhappens to satisfy thenow - 60skew window, not because it validates the real sentinel shape.🧪 Proposed fix for consistency
const token = mintOpenShellStyleSandboxJwt({ signingKeyPath: pathsA.signingKeyPath, kid: kidA, gatewayId: gatewayIdA, sandboxId: sandboxIdA, iat: now, - exp: now + DOCKER_DRIVER_GATEWAY_JWT_TTL_SECS, + exp: + DOCKER_DRIVER_GATEWAY_JWT_TTL_SECS === 0 + ? 0 + : now + DOCKER_DRIVER_GATEWAY_JWT_TTL_SECS, });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/docker-driver-gateway-config-auth-contract.test.ts` around lines 206 - 213, Update the token minting in docker-driver-gateway-config-auth-contract.test.ts to match the file’s existing TTL handling pattern. In the test that calls mintOpenShellStyleSandboxJwt, replace the direct now + DOCKER_DRIVER_GATEWAY_JWT_TTL_SECS exp value with the same ttlSecs === 0 ? 0 : now + ttlSecs logic used elsewhere so the test exercises the exp = 0 sentinel path consistently. Keep the change localized to the mintOpenShellStyleSandboxJwt setup and ensure the assertions still validate the intended non-expiring token shape.Source: Path instructions
🧹 Nitpick comments (1)
docs/security/openshell-0.0.71-gateway-auth-review.mdx (1)
95-95: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSplit into one sentence per line.
Line 95 packs three sentences onto a single source line. As per path instructions, docs/mdx source should "Keep one sentence per line in Markdown and MDX source files."
📝 Proposed reflow
-The sandbox JWT config uses OpenShell's `ttl_secs = 0` non-expiring gateway contract for local single-player Docker-driver deployments, matching OpenShell's documented default (a positive TTL is reserved for shared, multi-tenant gateways). Non-expiring local tokens avoid the file-based sandbox JWT refresh dead-end, where an expired on-disk bootstrap token can no longer call `RefreshSandboxToken` and the host-CLI relay fails closed; this remains covered by the upstream OpenShell sandbox JWT expiry tests plus NemoClaw config-auth contract tests. +The sandbox JWT config uses OpenShell's `ttl_secs = 0` non-expiring gateway contract for local single-player Docker-driver deployments, matching OpenShell's documented default (a positive TTL is reserved for shared, multi-tenant gateways). +Non-expiring local tokens avoid the file-based sandbox JWT refresh dead-end, where an expired on-disk bootstrap token can no longer call `RefreshSandboxToken` and the host-CLI relay fails closed; this remains covered by the upstream OpenShell sandbox JWT expiry tests plus NemoClaw config-auth contract tests.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/security/openshell-0.0.71-gateway-auth-review.mdx` at line 95, Reflow the MDX text in the relevant documentation block so each sentence is on its own source line, since the current paragraph under the sandbox JWT config note contains multiple sentences on one line. Update the prose near the OpenShell `ttl_secs = 0` explanation in the docs content to preserve the same wording while splitting it into separate sentence-per-line entries.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/lib/onboard/docker-driver-gateway-config-auth-contract.test.ts`:
- Around line 206-213: Update the token minting in
docker-driver-gateway-config-auth-contract.test.ts to match the file’s existing
TTL handling pattern. In the test that calls mintOpenShellStyleSandboxJwt,
replace the direct now + DOCKER_DRIVER_GATEWAY_JWT_TTL_SECS exp value with the
same ttlSecs === 0 ? 0 : now + ttlSecs logic used elsewhere so the test
exercises the exp = 0 sentinel path consistently. Keep the change localized to
the mintOpenShellStyleSandboxJwt setup and ensure the assertions still validate
the intended non-expiring token shape.
---
Nitpick comments:
In `@docs/security/openshell-0.0.71-gateway-auth-review.mdx`:
- Line 95: Reflow the MDX text in the relevant documentation block so each
sentence is on its own source line, since the current paragraph under the
sandbox JWT config note contains multiple sentences on one line. Update the
prose near the OpenShell `ttl_secs = 0` explanation in the docs content to
preserve the same wording while splitting it into separate sentence-per-line
entries.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 74447ac5-2f8e-4430-9543-2c96c9d30e43
📒 Files selected for processing (3)
docs/security/openshell-0.0.71-gateway-auth-review.mdxsrc/lib/onboard/docker-driver-gateway-config-auth-contract.test.tssrc/lib/onboard/docker-driver-gateway-config.ts
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28804263616
|
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28807471694
|
prekshivyas
approved these changes
Jul 6, 2026
prekshivyas
left a comment
prekshivyas
left a comment
Collaborator
There was a problem hiding this comment.
Approving: recommended E2E (openshell-gateway-auth-contract) dispatched on this head and passed, all required CI green, and the PR review advisor posted no blocking (needs_rework/blocked) verdict. Gateway-auth-contract change is well-scoped. Signed-off-by: Prekshi Vyas prekshiv@nvidia.com
7 tasks
cv
pushed a commit
that referenced
this pull request
Jul 7, 2026
## Summary Add the v0.0.75 release-notes entry for the release train, summarizing the user-facing fixes merged since v0.0.74. Release-prep docs for the `nemoclaw-maintainer-cut-release-tag` gate. ## Related Issue Release prep for v0.0.75. Remove this section if none. ## Changes - `docs/about/release-notes.mdx`: add the `## v0.0.75` section (themed intro + grouped bullets with source-page links), matching the existing v0.0.74 style. ### Source summary (doc-impacting PRs → doc page) - #6370 -> `docs/about/release-notes.mdx`: prepared-backup recovery restores gateway state and defers the live route check to onboarding, so upgrade recovery no longer fails on an unset gateway route. - #6305 -> `docs/about/release-notes.mdx`: in-place upgrades recover gateway-orphaned sandboxes. - #6332 -> `docs/about/release-notes.mdx`: same-name `--fresh` re-onboard preserves fresh LangChain Deep Agents Code routing. - #6335 -> `docs/about/release-notes.mdx`: custom Anthropic-compatible inference uses the OpenAI frontend. - #6298 -> `docs/about/release-notes.mdx`: OpenAI-only agents keep the `/v1` base URL on Anthropic-compatible endpoints. - #6304 -> `docs/about/release-notes.mdx`: local docker-driver gateway credentials no longer expire. - #6261 -> `docs/about/release-notes.mdx`: Hermes runtime and managed MCP state reconcile after a runtime change. - #6318 -> `docs/about/release-notes.mdx`: Hermes installs accept a pinned base platform digest. - #6291 -> `docs/about/release-notes.mdx`: OpenClaw local CLI pairing restores its previous connection path. Test-performance, CI, and chore commits since v0.0.74 are excluded as non-user-facing. ## Type of Change - [x] Doc only (prose changes, no code sample modifications) ## Quality Gates - [x] Tests not applicable — justification: documentation-only change (release notes prose). - [x] Docs updated for user-facing behavior changes ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] `npm run docs` builds without warnings introduced by this change — command/result: "Found 0 errors and 2 warnings" (the 2 warnings pre-exist this change). - [x] Doc pages follow the style guide (active voice, no numbered/colon titles, correct NVIDIA/NemoClaw/OpenShell capitalization; skip-terms avoided). - [x] No secrets, API keys, or credentials committed --- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new **v0.0.75** section to the release notes, highlighting improved sandbox upgrade hardening and prepared-backup recovery, updated inference routing for Anthropic-compatible endpoints, longer-lasting local gateway credential handling, and restored CLI pairing reconnection without re-pairing. Also includes cross-links to related NemoClaw CLI and documentation pages. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
21 tasks
ericksoa
added a commit
that referenced
this pull request
Jul 7, 2026
<!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 sentences: what this PR does and why. --> Correct the v0.0.75 release-note entry merged in #6371 before the release tag is cut. This follow-up restores the omitted OpenClaw `2026.6.10` upgrade and narrows three claims to the runtime contracts that actually shipped. ## Changes <!-- Bullet list of key changes. --> - #5595 -> `docs/about/release-notes.mdx`: add the bundled OpenClaw `2026.6.10` upgrade and its reviewed package, pairing, and recovery boundaries. - #6370 -> `docs/about/release-notes.mdx`: state that authoritative onboarding restores the gateway provider and inference route during rebuild, before sandbox recreation. - #6335 and #6298 -> `docs/about/release-notes.mdx`: scope the OpenAI frontend to Hermes while retaining the separate OpenAI-only-agent behavior. - #6304 -> `docs/about/release-notes.mdx`: name the non-expiring local Docker-driver sandbox JWT contract precisely and link its gateway-auth review. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check exactly one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: prose-only release-note corrections with no runtime behavior or code samples. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: tests are not applicable; `npm run docs` passed with 0 errors and 2 pre-existing warnings. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — result: 0 errors and 2 pre-existing warnings (missing authenticated redirects check and existing light-theme accent contrast). - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the `v0.0.75` release notes with clearer wording and expanded details. * Added more specific notes about the runtime upgrade, sandbox recovery behavior, and routing safeguards. * Refined the description of inference routing behavior and local Docker-driver sandbox authentication handling. * Adjusted the linked references and final release-note wording for consistency. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
…IA#6304) <!-- markdownlint-disable MD041 --> ## Summary Local Docker-driver sandboxes were provisioned with a 1-hour gateway sandbox JWT (`gateway_jwt.ttl_secs = 3600`). Once that token expires it cannot be renewed — the file-based token source has no rebootstrap path and `RefreshSandboxToken` requires a still-valid JWT — so `exec`, `agents`, `logs`, and `rebuild` fail with `invalid token: ExpiredSignature` / `relay open timed out`. This sets the local Docker-driver gateway JWT to non-expiring (`ttl_secs = 0`), which is OpenShell's documented default for single-player local deployments. ## Related Issue Fixes NVIDIA#6287 ## Changes - `src/lib/onboard/docker-driver-gateway-config.ts`: `DOCKER_DRIVER_GATEWAY_JWT_TTL_SECS` `3600` → `0`. The gateway then mints the `exp = 0` non-expiring sentinel, which OpenShell's `SandboxJwtAuthenticator` accepts. The `3600` value was a stale carryover of OpenShell's pre-`v0.0.71` default, which OpenShell itself changed to `0` for local single-player Docker/Podman/VM gateways in [NVIDIA/OpenShell#1721](NVIDIA/OpenShell#1721) ("fix(gateway): allow local sandbox jwt to not expire"). - `src/lib/onboard/docker-driver-gateway-config-auth-contract.test.ts`: the valid-token case now asserts the `exp = 0` non-expiring sentinel; the expiry-rejection case uses fixed offsets so it still proves the validator rejects genuinely expired tokens regardless of the configured TTL. - `docs/security/openshell-0.0.71-gateway-auth-review.mdx`: update the sandbox JWT TTL rationale to reflect the non-expiring local contract. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: awaiting maintainer sensitive-path review - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result: `vitest run docker-driver-gateway` → 17 files, 121/121 passed; `tsc -p tsconfig.cli.json` exit 0; `biome check` clean on changed files - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Tinson Lai <tinsonl@nvidia.com> Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Add the v0.0.75 release-notes entry for the release train, summarizing the user-facing fixes merged since v0.0.74. Release-prep docs for the `nemoclaw-maintainer-cut-release-tag` gate. ## Related Issue Release prep for v0.0.75. Remove this section if none. ## Changes - `docs/about/release-notes.mdx`: add the `## v0.0.75` section (themed intro + grouped bullets with source-page links), matching the existing v0.0.74 style. ### Source summary (doc-impacting PRs → doc page) - NVIDIA#6370 -> `docs/about/release-notes.mdx`: prepared-backup recovery restores gateway state and defers the live route check to onboarding, so upgrade recovery no longer fails on an unset gateway route. - NVIDIA#6305 -> `docs/about/release-notes.mdx`: in-place upgrades recover gateway-orphaned sandboxes. - NVIDIA#6332 -> `docs/about/release-notes.mdx`: same-name `--fresh` re-onboard preserves fresh LangChain Deep Agents Code routing. - NVIDIA#6335 -> `docs/about/release-notes.mdx`: custom Anthropic-compatible inference uses the OpenAI frontend. - NVIDIA#6298 -> `docs/about/release-notes.mdx`: OpenAI-only agents keep the `/v1` base URL on Anthropic-compatible endpoints. - NVIDIA#6304 -> `docs/about/release-notes.mdx`: local docker-driver gateway credentials no longer expire. - NVIDIA#6261 -> `docs/about/release-notes.mdx`: Hermes runtime and managed MCP state reconcile after a runtime change. - NVIDIA#6318 -> `docs/about/release-notes.mdx`: Hermes installs accept a pinned base platform digest. - NVIDIA#6291 -> `docs/about/release-notes.mdx`: OpenClaw local CLI pairing restores its previous connection path. Test-performance, CI, and chore commits since v0.0.74 are excluded as non-user-facing. ## Type of Change - [x] Doc only (prose changes, no code sample modifications) ## Quality Gates - [x] Tests not applicable — justification: documentation-only change (release notes prose). - [x] Docs updated for user-facing behavior changes ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] `npm run docs` builds without warnings introduced by this change — command/result: "Found 0 errors and 2 warnings" (the 2 warnings pre-exist this change). - [x] Doc pages follow the style guide (active voice, no numbered/colon titles, correct NVIDIA/NemoClaw/OpenShell capitalization; skip-terms avoided). - [x] No secrets, API keys, or credentials committed --- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new **v0.0.75** section to the release notes, highlighting improved sandbox upgrade hardening and prepared-backup recovery, updated inference routing for Anthropic-compatible endpoints, longer-lasting local gateway credential handling, and restored CLI pairing reconnection without re-pairing. Also includes cross-links to related NemoClaw CLI and documentation pages. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 sentences: what this PR does and why. --> Correct the v0.0.75 release-note entry merged in NVIDIA#6371 before the release tag is cut. This follow-up restores the omitted OpenClaw `2026.6.10` upgrade and narrows three claims to the runtime contracts that actually shipped. ## Changes <!-- Bullet list of key changes. --> - NVIDIA#5595 -> `docs/about/release-notes.mdx`: add the bundled OpenClaw `2026.6.10` upgrade and its reviewed package, pairing, and recovery boundaries. - NVIDIA#6370 -> `docs/about/release-notes.mdx`: state that authoritative onboarding restores the gateway provider and inference route during rebuild, before sandbox recreation. - NVIDIA#6335 and NVIDIA#6298 -> `docs/about/release-notes.mdx`: scope the OpenAI frontend to Hermes while retaining the separate OpenAI-only-agent behavior. - NVIDIA#6304 -> `docs/about/release-notes.mdx`: name the non-expiring local Docker-driver sandbox JWT contract precisely and link its gateway-auth review. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check exactly one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: prose-only release-note corrections with no runtime behavior or code samples. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: tests are not applicable; `npm run docs` passed with 0 errors and 2 pre-existing warnings. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — result: 0 errors and 2 pre-existing warnings (missing authenticated redirects check and existing light-theme accent contrast). - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated the `v0.0.75` release notes with clearer wording and expanded details. * Added more specific notes about the runtime upgrade, sandbox recovery behavior, and routing safeguards. * Refined the description of inference routing behavior and local Docker-driver sandbox authentication handling. * Adjusted the linked references and final release-note wording for consistency. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Local Docker-driver sandboxes were provisioned with a 1-hour gateway sandbox JWT (
gateway_jwt.ttl_secs = 3600). Once that token expires it cannot be renewed — the file-based token source has no rebootstrap path andRefreshSandboxTokenrequires a still-valid JWT — soexec,agents,logs, andrebuildfail withinvalid token: ExpiredSignature/relay open timed out. This sets the local Docker-driver gateway JWT to non-expiring (ttl_secs = 0), which is OpenShell's documented default for single-player local deployments.Related Issue
Fixes #6287
Changes
src/lib/onboard/docker-driver-gateway-config.ts:DOCKER_DRIVER_GATEWAY_JWT_TTL_SECS3600→0. The gateway then mints theexp = 0non-expiring sentinel, which OpenShell'sSandboxJwtAuthenticatoraccepts. The3600value was a stale carryover of OpenShell's pre-v0.0.71default, which OpenShell itself changed to0for local single-player Docker/Podman/VM gateways in NVIDIA/OpenShell#1721 ("fix(gateway): allow local sandbox jwt to not expire").src/lib/onboard/docker-driver-gateway-config-auth-contract.test.ts: the valid-token case now asserts theexp = 0non-expiring sentinel; the expiry-rejection case uses fixed offsets so it still proves the validator rejects genuinely expired tokens regardless of the configured TTL.docs/security/openshell-0.0.71-gateway-auth-review.mdx: update the sandbox JWT TTL rationale to reflect the non-expiring local contract.Type of Change
Quality Gates
Verification
Verifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablevitest run docker-driver-gateway→ 17 files, 121/121 passed;tsc -p tsconfig.cli.jsonexit 0;biome checkclean on changed filesnpm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm run docsbuilds without warnings (doc changes only)Signed-off-by: Tinson Lai tinsonl@nvidia.com