docs(starter-prompt): improve guided installation - #6990
Merged
Conversation
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughThe starter prompt now defines prescriptive onboarding for platform readiness, installation, runtime selection, credential capture, messaging, approvals, and verification. Tests enforce the revised security rules, provider eligibility, placeholders, and documentation references. ChangesStarter prompt onboarding flow
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-6990.docs.buildwithfern.com/nemoclaw |
miyoungc
changed the title
Contributor
PR Review Advisor — InformationalAdvisor assessment: Informational / high confidence Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: None 1 optional E2E recommendation
This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage remains at 96%, unchanged from the TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most impacted files.
Updated |
Signed-off-by: San Dang <sdang@nvidia.com>
sandl99
changed the title
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
miyoungc
marked this pull request as ready for review
July 16, 2026 05:31
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
docs/resources/starter-prompt.md (1)
189-203: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winClarify the managed vLLM mapping for DGX Spark and DGX Station. The Spark Express flow intentionally leaves
NEMOCLAW_VLLM_MODELunset, while DGX Station Express pinsnvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B-NVFP4; spell out both cases instead of saying “required Express model.”🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/resources/starter-prompt.md` around lines 189 - 203, Update the “Managed vLLM” entry in the provider mapping to distinguish DGX Spark, where NEMOCLAW_VLLM_MODEL remains unset, from DGX Station, where Express setup pins nvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B-NVFP4. Replace the vague “required Express model” wording with these explicit platform-specific behaviors.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/resources/starter-prompt.md`:
- Around line 29-31: Update the Goal section and corresponding messaging
instructions to make messaging in the first sandbox conditional on the selected
agent supporting messaging; preserve the existing Deep Agents exception and
avoid requiring messaging for unsupported agents.
- Around line 94-100: Update the Express installation policy flow so it does not
ask users to choose among policy tiers when the flow always sets
NEMOCLAW_POLICY_TIER=balanced. Clearly state that Balanced is required for
Express and continue using the fixed balanced value; apply this consistently to
both Express paths, including the later policy flow.
---
Nitpick comments:
In `@docs/resources/starter-prompt.md`:
- Around line 189-203: Update the “Managed vLLM” entry in the provider mapping
to distinguish DGX Spark, where NEMOCLAW_VLLM_MODEL remains unset, from DGX
Station, where Express setup pins
nvidia/NVIDIA-Nemotron-3-Ultra-550B-A55B-NVFP4. Replace the vague “required
Express model” wording with these explicit platform-specific behaviors.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: af6f6a25-2541-4ac5-890f-50d70a86c0e3
📒 Files selected for processing (2)
docs/resources/starter-prompt.mdtest/starter-prompt-docs.test.ts
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/resources/starter-prompt.md (1)
164-179: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAdd an explicit SHA-256 check for the helper before execution.
The prompt should tell the agent to hash both downloaded files and compare them to the pinned digests before running the helper. The helper already checks the form digest, but it does not protect its own bytes, so a tampered helper could still run first.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/resources/starter-prompt.md` around lines 164 - 179, Update the instructions around the helper and form trust boundary to explicitly require computing the SHA-256 digest of both downloaded files and comparing each against its pinned digest before executing the helper. Require stopping and deleting the temporary files if either check fails, ensuring the helper itself is verified before it runs.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@docs/resources/starter-prompt.md`:
- Around line 164-179: Update the instructions around the helper and form trust
boundary to explicitly require computing the SHA-256 digest of both downloaded
files and comparing each against its pinned digest before executing the helper.
Require stopping and deleting the temporary files if either check fails,
ensuring the helper itself is verified before it runs.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3755e4f4-e0cc-47ee-a7ae-2fdccd522f7b
📒 Files selected for processing (2)
docs/resources/starter-prompt.mdtest/starter-prompt-docs.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- test/starter-prompt-docs.test.ts
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
cv
approved these changes
Jul 16, 2026
cv
left a comment
cv
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed exact head e12e48f against current base c1bda80. The starter prompt now matches existing supported agent/Express behavior, explicitly verifies both pinned credential-helper artifacts before execution, and has focused contract coverage. All current checks are green, both advisor lanes and CodeRabbit have no remaining actionable findings, the docs build passed, and DCO/Verified gates pass.
This was referenced Jul 17, 2026
cv
added a commit
that referenced
this pull request
Aug 13, 2026
## Summary A Windows checkout with `core.autocrlf=true` rewrites tracked text files to CRLF, so repository checks fail before a contributor changes anything. `.gitattributes` sets no line-ending rule, so Git converts every text file in the repository. This sets `* text=auto eol=lf`, which gives every tracked text file LF on every checkout. ## Related Issue Fixes #8648 ## Changes - `.gitattributes`: `* text=auto eol=lf`. - `CONTRIBUTING.md`: how to re-check-out an existing Windows clone, next to the existing `core.hooksPath` note. Git converts a file when it copies that file out of the index, not when `.gitattributes` changes, so a clone made before this rule keeps its CRLF bytes. The current-main merge updates `test/starter-prompt-docs.test.ts` to verify the repository-wide LF attribute contract. ### Why a repository-wide rule and not per-file rules The issue proposes a rule for the starter-prompt source. That file is one of many. These checks all compare a tracked file byte-for-byte against a pinned digest, or reject a carriage return: - `scripts/generate-starter-prompt.mts:19` rejects any carriage return. - `scripts/checks/local-credential-helper-pin.mts:66` compares the SHA-256 of the working-tree bytes. - `test/starter-prompt-docs.test.ts:731` byte-compares each prompt asset with its pinned Git blob. - `test/hermes-final-image-layout.test.ts:502` compares 16 SHA-256 digests with the values `agents/hermes/Dockerfile` declares. - `test/mcp-tool-discovery-image-contract.test.ts:306` pins four reviewed runtime bundle digests. There are more. `scripts/audit-reviewed-npm-graph.mts:265` digests reviewed npm lockfiles, `tools/e2e/workflow-boundary-policy.mts:4` pins workflow action and script content, and `test/e2e-fixture-dependency-review.test.ts` and `test/langchain-deepagents-code-image.test.ts` pin image fixtures. The Verification section shows those failing on a CRLF checkout too. An enumerated list was written first and reviewed; the review found 18 files the list had missed. A list that must name every pinned file is wrong the moment someone pins a new one, and a check built on that list cannot detect the omission. One rule covers all of them and every future one. ### Why this is safe - `text=auto` keeps Git's own binary detection. `git ls-files --eol` reports the same 110 binary files before and after the rule, so no binary file is touched. - No tracked file holds CRLF or mixed line endings today: `git ls-files --eol` reports 0 `i/crlf` and 0 `i/mixed`. The rule therefore normalizes no content and produces no renormalization commit. - The existing `linguist-generated`, `diff=markdown`, and `-diff` rules still resolve. `git check-attr` confirms this for the bundle and skills paths. One behavior change worth naming: `scripts/bootstrap-windows.ps1` and `tools/wsl/ci-helper.ps1` will check out with LF on Windows instead of CRLF. Both are already LF in the index and on every Linux and macOS checkout today. PowerShell runs LF scripts. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes — `CONTRIBUTING.md` gains the existing-Windows-clone remediation. No `docs/` page changes: no public API, CLI, configuration, default, error, or product behavior changes, and no tracked content changes. - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: #8657 (comment) - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `CONTRIBUTING.md` documents the existing-Windows-clone remediation and requires a clean worktree before `git reset --hard`. `.gitattributes` preserves Git binary detection while assigning LF to tracked text. `test/starter-prompt-docs.test.ts` verifies the repository-wide attribute contract. No public docs page changes because this affects contributor checkout behavior. - Agent: Codex Desktop documentation writer <!-- docs-review-head-sha: b1bee67 --> <!-- docs-review-agents-blob-sha: c4923a3 --> ## Verification Two real clones with `core.autocrlf=true`, one at base `8096cdd7b` and one at this commit. Tracked files that check out with CRLF: ```text before @ 8096cdd: 5052 after on branch: 0 ``` Repository checks: ```text before after docs:sync-starter-prompt exit 1 exit 0 ("use LF line endings") checks:repository exit 1 exit 0 ``` Pinned-digest suites in the same two trees, `--no-file-parallelism`: ```text npx vitest run --project integration --no-file-parallelism \ test/hermes-final-image-layout.test.ts test/mcp-tool-discovery-image-contract.test.ts \ test/starter-prompt-docs.test.ts test/e2e-fixture-dependency-review.test.ts before: 27 failed after: 0 failed ``` Every one of the 27 failures is fixed, and none fails in both trees. They include `keeps security entrypoint hashes synchronized with the copied files`, `pins the reviewed image runtime artifacts exactly`, `keeps local prompt assets byte-aligned with their pinned revision blobs (#6990)`, and `rejects a cache seed that does not match the lockfile integrity`. On the rebased tree, every tracked text file resolves the rule: ```text git ls-files --eol | awk '$1=="i/lf"{sub(/^[^\t]*\t/,""); print}' \ | git check-attr --stdin eol | grep -vc ': eol: lf$' 0 ``` Index forms are unchanged by the rule: 5140 `i/lf`, 110 `i/-text`, 3 `i/none`, 3 empty. `npm run checks:repository`, `npm run typecheck:cli`, `npx @biomejs/biome check`, and `npm run docs` all pass. Limits, stated plainly: - The Windows behavior is proven by a `core.autocrlf=true` checkout on macOS, not on a Windows host. `core.autocrlf` is the setting that performs the conversion and it behaves the same on every platform. - An existing Windows working tree that already holds CRLF is not rewritten by pulling this commit. `CONTRIBUTING.md` gives the fix, but the commit cannot repair a working tree by itself. - `.github/workflows/wsl-e2e.yaml:33` and `.github/workflows/platform-vitest-main.yaml:174` already set `core.autocrlf false`. Those lines are now redundant. They are left in place because they are harmless and removing them is a separate decision. - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed - [x] Targeted behavior tests pass for the current change set — the normal pre-commit hook passed repository checks after the attribute-contract test update. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings — the build completed with 0 errors and 2 existing Fern warnings - [ ] Doc pages follow the style guide (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Harjoth Khara <harjoth.khara@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added Windows-specific guidance for restoring consistent LF line endings in local checkouts. * Included steps to preserve local changes, verify a clean working tree, and safely reset files. * **Chores** * Standardized tracked text files to use LF line endings while preserving binary-file handling across the repository. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: harjoth <harjoth.khara@gmail.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Apurv Kumaria <akumaria@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The copyable starter prompt now guides a non-technical user through an end-to-end NemoClaw installation one question at a time, without leaving interactive terminal menus running or exposing credentials. It retains the DGX Station Express mapping while adding complete platform readiness, provider, messaging, approval, sudo, Ollama, credential-helper, and documentation-discovery guidance.
Changes
docs/resources/starter-prompt.md: Reflect DGX Station GB300 firmware detection in the starter decision flow.docs/resources/starter-prompt.md: Preserve the merged Station Nemotron Ultra Express selectors and explicit non-interactive equivalent.Type of Change
Quality Gates
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpx vitest run test/starter-prompt-docs.test.ts test/changelog-docs.test.tspassed 18 tests in 2 files.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — not run for this documentation-only change.npm run docsbuilds without warnings (doc changes only) — passed with zero errors and two existing Fern warnings.Signed-off-by: Miyoung Choi miyoungc@nvidia.com
Signed-off-by: San Dang sdang@nvidia.com
Summary by CodeRabbit
Documentation
Tests
Signed-off-by: Carlos Villela cvillela@nvidia.com