fix(onboard): report an invalid DOCKER_HOST instead of a docker-group remediation - #7775
Merged
Merged
Conversation
… remediation An invalid DOCKER_HOST (a TCP endpoint or a relative path) makes `docker info` fail, so preflight marks the daemon unreachable. The local docker.service is still active because it is unaffected by the DOCKER_HOST override, and no advisory inspected DOCKER_HOST, so preflight emitted the unrelated "add user to the docker group" remediation and the provider was never created. Add a DOCKER_HOST-aware advisory. assessHost records dockerHostInvalid from a shared isSupportedGatewayDockerHost predicate (reused by the gateway env writer so both agree on which DOCKER_HOST values onboarding supports), and a new blocking invalid_docker_host advisory names the endpoint. The docker-group and start-daemon hints are guarded off for this state, because the advisory runner collects every match. Closes #7731 Signed-off-by: Dongni Yang <dongniy@nvidia.com>
Dongni-Yang
added
the
area: onboarding
Dongni-Yang
added
the
area: onboarding
Contributor
📝 WalkthroughWalkthroughThe change validates ChangesDocker host validation and assessment
Invalid Docker host remediation
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 02ff5bc in the TypeScript / code-coverage/cliThe overall coverage in commit 02ff5bc in the Show a code coverage summary of the most impacted files.
Updated |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
src/lib/onboard/preflight-docker-host.test.ts (1)
13-31: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winProve daemon-start suppression independently in both regression tests.
Both tests set
dockerServiceActive: true, so existing service-active logic suppresses daemon-start remediation before the new invalid-host guard is exercised.
src/lib/onboard/preflight-docker-host.test.ts#L13-L31: add an invalid-host case with an inactive service and assert the daemon-start remediation is absent.src/lib/advisories/checks/host/docker.test.ts#L56-L64: add the equivalent advisory-level assertion using the actualstartDockeradvisory ID.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/preflight-docker-host.test.ts` around lines 13 - 31, Update the invalid DOCKER_HOST regression test in src/lib/onboard/preflight-docker-host.test.ts:13-31 to use an inactive Docker service and assert the remediation IDs exclude daemon-start while still covering invalid_docker_host. Add the equivalent advisory-level assertion in src/lib/advisories/checks/host/docker.test.ts:56-64 using the actual startDocker advisory ID, so suppression is independently verified in both tests.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/advisories/checks/host/docker.ts`:
- Around line 69-77: Update invalidDockerHost.check to remove the
host.dockerReachable exclusion, so an invalid Docker host remains blocking even
when reachable. Add a regression case covering dockerHostInvalid: true with
dockerReachable: true and assert it returns the invalid_docker_host advisory.
In `@src/lib/onboard/docker-driver-gateway-env.ts`:
- Around line 261-268: Move the pure isSupportedGatewayDockerHost predicate from
the gateway environment serialization module into an appropriate src/lib/domain
module, preserving its current classification behavior. Export and import this
domain predicate from both preflight validation and gateway environment
generation, removing the local definition while keeping host-boundary operations
behind adapters.
- Around line 261-273: Update isSupportedGatewayDockerHost to validate the raw
DOCKER_HOST value for unsafe boundary newlines before trimming, so values
containing leading or trailing \r/\n are rejected. Adjust
normalizePackageServiceDockerHost to pass the untrimmed input into this
predicate while preserving normalization for accepted values, and add
boundary-newline test cases covering both paths.
---
Nitpick comments:
In `@src/lib/onboard/preflight-docker-host.test.ts`:
- Around line 13-31: Update the invalid DOCKER_HOST regression test in
src/lib/onboard/preflight-docker-host.test.ts:13-31 to use an inactive Docker
service and assert the remediation IDs exclude daemon-start while still covering
invalid_docker_host. Add the equivalent advisory-level assertion in
src/lib/advisories/checks/host/docker.test.ts:56-64 using the actual startDocker
advisory ID, so suppression is independently verified in both tests.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3a428cab-e9ee-47d4-bfe6-3b0bbab0e1af
📒 Files selected for processing (7)
src/lib/advisories/checks/host/docker.test.tssrc/lib/advisories/checks/host/docker.tssrc/lib/advisories/checks/host/index.test.tssrc/lib/onboard/docker-driver-gateway-env.test.tssrc/lib/onboard/docker-driver-gateway-env.tssrc/lib/onboard/preflight-docker-host.test.tssrc/lib/onboard/preflight.ts
Comment on lines
+261
to
+273
| export function isSupportedGatewayDockerHost(value: string | undefined): boolean { | ||
| const candidate = String(value ?? "").trim(); | ||
| if (!candidate) return true; | ||
| const prefix = "unix://"; | ||
| if (!candidate.startsWith(prefix)) return false; | ||
| const socketPath = candidate.slice(prefix.length); | ||
| return path.isAbsolute(socketPath) && !/[\0\r\n']/.test(socketPath); | ||
| } | ||
|
|
||
| function normalizePackageServiceDockerHost(value: string | undefined): string | undefined { | ||
| const candidate = String(value || "").trim(); | ||
| if (!candidate) return undefined; | ||
| const prefix = "unix://"; | ||
| const socketPath = candidate.startsWith(prefix) ? candidate.slice(prefix.length) : ""; | ||
| if (path.isAbsolute(socketPath) && !/[\0\r\n']/.test(socketPath)) { | ||
| if (isSupportedGatewayDockerHost(candidate)) { |
Contributor
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Validate the raw DOCKER_HOST value before trimming.
trim() removes leading/trailing \r and \n before the unsafe-character check, so a value such as unix:///var/run/docker.sock\n is accepted. normalizePackageServiceDockerHost also trims before calling this predicate, preserving the bypass on that path. Validate the raw value first and add boundary-newline test cases; otherwise preflight can classify an endpoint Docker cannot use as valid.
Proposed fix
export function isSupportedGatewayDockerHost(value: string | undefined): boolean {
- const candidate = String(value ?? "").trim();
+ const raw = String(value ?? "");
+ if (/[\0\r\n']/.test(raw)) return false;
+ const candidate = raw.trim();
if (!candidate) return true;
const prefix = "unix://";
if (!candidate.startsWith(prefix)) return false;
const socketPath = candidate.slice(prefix.length);
- return path.isAbsolute(socketPath) && !/[\0\r\n']/.test(socketPath);
+ return path.isAbsolute(socketPath);
}
function normalizePackageServiceDockerHost(value: string | undefined): string | undefined {
const candidate = String(value || "").trim();
if (!candidate) return undefined;
- if (isSupportedGatewayDockerHost(candidate)) {
+ if (isSupportedGatewayDockerHost(value)) {
return candidate;
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| export function isSupportedGatewayDockerHost(value: string | undefined): boolean { | |
| const candidate = String(value ?? "").trim(); | |
| if (!candidate) return true; | |
| const prefix = "unix://"; | |
| if (!candidate.startsWith(prefix)) return false; | |
| const socketPath = candidate.slice(prefix.length); | |
| return path.isAbsolute(socketPath) && !/[\0\r\n']/.test(socketPath); | |
| } | |
| function normalizePackageServiceDockerHost(value: string | undefined): string | undefined { | |
| const candidate = String(value || "").trim(); | |
| if (!candidate) return undefined; | |
| const prefix = "unix://"; | |
| const socketPath = candidate.startsWith(prefix) ? candidate.slice(prefix.length) : ""; | |
| if (path.isAbsolute(socketPath) && !/[\0\r\n']/.test(socketPath)) { | |
| if (isSupportedGatewayDockerHost(candidate)) { | |
| export function isSupportedGatewayDockerHost(value: string | undefined): boolean { | |
| const raw = String(value ?? ""); | |
| if (/[\0\r\n']/.test(raw)) return false; | |
| const candidate = raw.trim(); | |
| if (!candidate) return true; | |
| const prefix = "unix://"; | |
| if (!candidate.startsWith(prefix)) return false; | |
| const socketPath = candidate.slice(prefix.length); | |
| return path.isAbsolute(socketPath); | |
| } | |
| function normalizePackageServiceDockerHost(value: string | undefined): string | undefined { | |
| const candidate = String(value || "").trim(); | |
| if (!candidate) return undefined; | |
| if (isSupportedGatewayDockerHost(value)) { |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/lib/onboard/docker-driver-gateway-env.ts` around lines 261 - 273, Update
isSupportedGatewayDockerHost to validate the raw DOCKER_HOST value for unsafe
boundary newlines before trimming, so values containing leading or trailing
\r/\n are rejected. Adjust normalizePackageServiceDockerHost to pass the
untrimmed input into this predicate while preserving normalization for accepted
values, and add boundary-newline test cases covering both paths.
Contributor
Author
There was a problem hiding this comment.
Fixed in 3625b1c — the predicate now rejects null bytes and line breaks in the raw value before trimming, so unix:///var/run/docker.sock\n is no longer trimmed-then-accepted. Added trailing-newline, trailing-CR, and null-byte reject cases in docker-host.test.ts. (normalizePackageServiceDockerHost passes an already-trimmed value, so its behavior is unchanged.)
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git show --stat --oneline 3625b1c46
git show --format=fuller --find-renames --find-copies 3625b1c46 -- \
src/lib/domain/docker-host.ts \
src/lib/domain/docker-host.test.ts \
src/lib/onboard/docker-driver-gateway-env.ts \
src/lib/onboard/docker-driver-gateway-env.test.ts \
src/lib/onboard/docker-driver-gateway-env.test.tsLength of output: 8844
@Dongni-Yang, the shared predicate and its direct tests now correctly reject raw trailing \n, \r, and null bytes—thank you.
However, the gateway-service path remains unprotected: normalizePackageServiceDockerHost still trims into candidate and calls isSupportedGatewayDockerHost(candidate). Thus unix:///var/run/docker.sock\n is still accepted through that path after trimming. Please pass the original value to the predicate while retaining candidate as the normalized returned value, and add a test that reaches the normalization/service-env path.
🧠 Learnings used
Learnt from: jason-ma-nv
Repo: NVIDIA/NemoClaw PR: 3385
File: src/lib/actions/sandbox/process-recovery.ts:361-364
Timestamp: 2026-05-12T06:25:43.759Z
Learning: In this repo, avoid adding “defensive” error handling (e.g., try/catch wrappers, fallbacks, or extra validation) around internal helper logic when there is no realistic throwing path or failure mode. Trust internal code and framework guarantees. During review, only add validation/error handling at system boundaries (e.g., request/IPC input parsing, external API calls, filesystem/network boundaries) where failures can realistically occur; otherwise remove unnecessary try/catch that doesn’t handle any actionable error.
Contributor
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
Address review on the invalid-DOCKER_HOST advisory: - A reachable tcp:// or ssh:// DOCKER_HOST still cannot back the managed gateway (the gateway env writer only serializes an absolute unix:// socket), so onboarding must block it rather than proceed and fail later. Drop the reachability guard on invalid_docker_host and reword the advisory to state the endpoint is unsupported even when reachable. - Move the pure isSupportedGatewayDockerHost predicate into the domain layer (src/lib/domain/docker-host.ts) per the domain-purity contract, imported by both preflight and the gateway env writer. - Reject null bytes and line breaks in the raw DOCKER_HOST value before trimming, so a trailing newline can no longer be trimmed away and then accepted; the socket path still rejects the single quote it is wrapped in when written to the gateway environment file. Refs #7731 Signed-off-by: Dongni Yang <dongniy@nvidia.com>
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/lib/onboard/docker-driver-gateway-env.ts (1)
260-260: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winValidate the original
DOCKER_HOSTvalue, not the trimmed candidate.
candidatehas already been trimmed before Line 260, so a value such asunix:///var/run/docker.sock\nis accepted here despiteisSupportedGatewayDockerHostrejecting raw line breaks. The directprepareOpenShellGatewayUserServiceEnvpath at Lines 351-355 bypasses the earlier environment-file guard.Proposed fix
- if (isSupportedGatewayDockerHost(candidate)) { + if (isSupportedGatewayDockerHost(value)) {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/docker-driver-gateway-env.ts` at line 260, Update the validation around isSupportedGatewayDockerHost to use the original DOCKER_HOST value before trimming, ensuring raw whitespace or line breaks are rejected. Preserve the trimmed candidate only for subsequent normalized processing, including the direct prepareOpenShellGatewayUserServiceEnv path.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/lib/onboard/docker-driver-gateway-env.ts`:
- Line 260: Update the validation around isSupportedGatewayDockerHost to use the
original DOCKER_HOST value before trimming, ensuring raw whitespace or line
breaks are rejected. Preserve the trimmed candidate only for subsequent
normalized processing, including the direct
prepareOpenShellGatewayUserServiceEnv path.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fb2a06ea-cfb1-4dcd-9955-8be264f1ef90
📒 Files selected for processing (6)
src/lib/advisories/checks/host/docker.test.tssrc/lib/advisories/checks/host/docker.tssrc/lib/domain/docker-host.test.tssrc/lib/domain/docker-host.tssrc/lib/onboard/docker-driver-gateway-env.tssrc/lib/onboard/preflight.ts
🚧 Files skipped from review as they are similar to previous changes (3)
- src/lib/onboard/preflight.ts
- src/lib/advisories/checks/host/docker.test.ts
- src/lib/advisories/checks/host/docker.ts
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
jyaunches
approved these changes
Jul 29, 2026
23 tasks
cv
pushed a commit
that referenced
this pull request
Jul 30, 2026
<!-- markdownlint-disable MD041 --> ## Summary Add the canonical pre-tag release entry for NemoClaw v0.0.98. The dated entry records the user-visible changes merged after v0.0.97 and links each release theme to its published documentation. ## Changes - Add `docs/changelog/2026-07-29.mdx` with the exact `## v0.0.98` release heading. - Summarize Hermes 0.19, Deep Agents Code automation and skill safety, readiness diagnostics, lifecycle recovery, uninstall behavior, messaging conflicts, dependency hardening, and bounded diagnostics. - Use the parser-safe MDX SPDX comment and root-absolute routes for published OpenClaw, Hermes, and Deep Agents documentation. ### Source summary - [#7849](#7849) -> `docs/changelog/2026-07-29.mdx`: Record the Hermes 0.19 runtime migration repairs for cron state, dashboard seeding, and MCP naming. - [#7662](#7662) -> `docs/changelog/2026-07-29.mdx`: Record bounded gateway and Docker subprocess diagnostics. - [#7850](#7850) -> `docs/changelog/2026-07-29.mdx`: Record verified no-clobber Deep Agents Code skill installation. - [#7848](#7848) -> `docs/changelog/2026-07-29.mdx`: Record post-reboot delivery-chain recovery for visible OpenClaw sandboxes. - [#7831](#7831) -> `docs/changelog/2026-07-29.mdx`: Record OpenShell gateway-state preservation during uninstall. - [#7827](#7827) -> `docs/changelog/2026-07-29.mdx`: Record the removal of upstream test sources from published Hermes images. - [#7775](#7775) -> `docs/changelog/2026-07-29.mdx`: Record the blocking diagnostic for unsupported `DOCKER_HOST` values. - [#7833](#7833) -> `docs/changelog/2026-07-29.mdx`: Record reviewed Python dependency baselines for Hermes and Deep Agents Code images. - [#7771](#7771) -> `docs/changelog/2026-07-29.mdx`: Record the managed Hermes Agent 0.19.0 upgrade. - [#7811](#7811) -> `docs/changelog/2026-07-29.mdx`: Record fail-closed messaging channel conflict handling. - [#7797](#7797) -> `docs/changelog/2026-07-29.mdx`: Record the managed non-interactive Deep Agents Code JSON envelope. - [#7782](#7782) -> `docs/changelog/2026-07-29.mdx`: Record the storage-remediation readiness capability. - [#7784](#7784) -> `docs/changelog/2026-07-29.mdx`: Record the 120-second OpenShell readiness budget for sandbox recreation. - [#7810](#7810) -> `docs/changelog/2026-07-29.mdx`: Record rejection of stale Deep Agents Code security inventories. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: `test/changelog-docs.test.ts` validates the native changelog contract, including the version heading, MDX SPDX comment, and published routes. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/changelog/2026-07-29.mdx` was reviewed against `docs/CONTRIBUTING.md` and `WRITING.md` for release meaning, terminology, structure, voice, sentence form, MDX structure, published routes, and code-sample presentation. The changelog contract passed 6 tests. The docs build completed with 0 errors and 2 existing Fern warnings. - Agent: Codex CLI <!-- docs-review-head-sha: e3221d1 --> <!-- docs-review-agents-blob-sha: c052d60 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable. `scripts/prepare-dgx-station-host.sh` is unchanged. - Station profile/scenario: Not applicable. - Result: Not applicable. - Supporting evidence: Not applicable. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run test/changelog-docs.test.ts` passed 6 tests. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not run for this documentation-only change. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — The build completed with 0 errors and 2 existing Fern warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) — Native changelog entries use the required parser-safe MDX SPDX comment and do not use frontmatter. --- Signed-off-by: San Dang <sdang@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added managed Hermes upgrades with verified releases, version reporting, and preserved configuration contracts. - Improved Deep Agents Code JSON output and skill installation behavior. - Added clearer Docker host and system readiness reporting. - Improved post-reboot delivery recovery and sandbox readiness timing. - **Bug Fixes** - Preserved gateway state when uninstalling with `--keep-openshell`. - Prevented conflicting messaging credentials from blocking onboarding and rebuilds. - Improved gateway diagnostics, dependency security, runtime filesystem protection, and evidence handling. - **Documentation** - Published the v0.0.98 release notes. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
23 tasks
senthilr-nv
added a commit
that referenced
this pull request
Jul 31, 2026
#7947) <!-- markdownlint-disable MD041 --> ## Summary Documents the user-facing changes identified by the `v0.0.96..v0.0.97` post-tag audit and publishes the existing agentic-documentation guide in each documentation variant. Replaces repository-local DORI contributor classification state with current-host capability detection so fresh worktrees do not repeatedly prompt users. Links the internal Skill Library and Template Library for explicit setup requests. Adds the bounded `v0.0.98..v0.0.99` audit follow-ups for changelog accuracy, memory-search prerequisites, two-DGX Station route verification, and prose clarity. ## Changes - Document the `invalid_docker_host` recovery procedure from #7775 and the `sandbox_recovery_failed` state from #7848. - Move Deep Agents runtime, automation, supervision, approval, and identity guidance from the quickstart to a focused operation page while preserving the existing anchor. - Publish the existing `docs/resources/engineer-agentic-documentation.mdx` page under Resources in all guide variants and align its route description with the live TOC. - Add rendered-page route tests for the Deep Agents operation page, compatibility anchor, and agentic-documentation routes. - Select the DORI documentation workflow from current host capabilities. Use the checked-in writing guide when the verified NVIDIA Skill Library is unavailable, and reserve DORI setup for explicit installation or configuration requests. - Link the NVIDIA Skill Library and Template Library from the DORI setup guide with their distinct installation roles. - Correct the Hermes dependency-review punctuation identified by the audit. - Correct the `v0.0.99` changelog attribution for the focused runtime identity, two-DGX Station vLLM, and memory search pages. - State the already-running Ollama embedding prerequisite and `/api/tags` acceptance criterion for memory search. - Add post-install route and runtime verification for the two-DGX Station vLLM procedure, including the limits of the `reachable` status. - Split dense Microsoft Entra and Hermes configuration-root explanations without changing their supported behavior or information architecture. - Reserve `sandbox_recovery_failed` guidance for an unproven agent delivery chain and keep Docker readiness failures under their separate preflight layers. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: Reviewed the full effective 17-file PR diff, including `.gitignore`, `AGENTS.md`, `docs/AGENTS.md`, `docs/DORI_SETUP.md`, `docs/index.yml`, `docs/changelog/2026-07-30.mdx`, `docs/configure-agents/configure-memory-search.mdx`, `docs/get-started/quickstart-langchain-deepagents-code.mdx`, `docs/inference/set-up-vllm-on-two-dgx-stations.mdx`, `docs/manage-sandboxes/run-deep-agents-code.mdx`, `docs/reference/commands.mdx`, `docs/reference/configure-runtime-identity.mdx`, `docs/reference/troubleshooting.mdx`, `docs/resources/engineer-agentic-documentation.mdx`, `docs/security/hermes-0.19.0-dependency-review.md`, `scripts/check-docs-published-routes.mts`, and `test/check-docs-published-routes.test.ts`. The independent reviewer checked product scope, writing rules, documentation style, terminology, structure, voice, code samples, prerequisites, risks, navigation, routes, guide variants, and source-backed technical claims. The headless mutation warning now precedes the first `dcode -n` command. Plugin build passed; the focused six-file Vitest suite passed 88 tests; `npm run docs` passed with 65 guarded routes and 0 Fern errors. Final result: PASS on `d65f1793`. - Agent: Codex Desktop <!-- docs-review-head-sha: d65f179 --> <!-- docs-review-agents-blob-sha: 3dd7c24 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run test/changelog-docs.test.ts test/station-doc-ownership.test.ts test/inference-options-docs.test.ts test/check-docs-links.test.ts test/sync-agent-variant-docs.test.ts` passed 58 tests on the reviewed head. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — not applicable because this PR does not change runtime behavior or repository-wide validation. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — it passed with 0 errors and the existing Fern CLI upgrade warning. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [x] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Added a comprehensive guide for running Deep Agents Code in managed sandboxes, including interactive, headless, JSON, approval, and troubleshooting workflows. - Added navigation links for Deep Agents, OpenClaw, and Hermes resources. - Simplified the Deep Agents quickstart and linked to the dedicated runtime guide. - Updated command references and documented recovery status handling. - Added guidance for resolving invalid Docker host configuration errors. - Clarified documentation routing and setup guidance. - **Tests** - Added coverage to validate published documentation routes and links. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com> Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com> Co-authored-by: Senthil Ravichandran <senthilr@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
On Ubuntu, an invalid
DOCKER_HOSTcould make preflight report an unrelated docker-group remediation. This PR adds a blockinginvalid_docker_hostadvisory for unsupported endpoints, including reachable TCP and SSH endpoints, while accepting Docker's default socket or an absoluteunix://socket. It also validates raw package-service values before trimming so line breaks cannot be accepted.Related Issue
Closes #7731
Changes
src/lib/domain/docker-host.ts: define the pureisSupportedGatewayDockerHostpredicate for values managed onboarding can use. Preflight and the package-service gateway path share this definition.src/lib/onboard/preflight.ts: adddockerHostInvalidtoHostAssessment, computed fromenv.DOCKER_HOSTthrough the shared predicate.src/lib/advisories/checks/host/docker.ts: add the blockinginvalid_docker_hostadvisory beforedocker_group_permission. The advisory also blocks reachable unsupported endpoints. Guard the docker-group and stopped-daemon checks so they do not report unrelated remediations for this state.src/lib/onboard/docker-driver-gateway-env.ts: validate the raw package-serviceDOCKER_HOSTbefore returning its trimmed form, so a boundary line break cannot be removed before validation.preflight-docker-host.test.ts,docker.test.ts,docker-host.test.ts, anddocker-driver-gateway-env-service.test.ts.Type of Change
Quality Gates
unix://socket contract; this PR changes diagnosis and validation timingDOCKER_HOSTvalidity definitionDocumentation Writer Review
no-docs-neededdocs/reference/troubleshooting.mdxanddocs/reference/architecture.mdxalready describe the unchanged absolute localunix://socket contract. The changed advisory, comments, and test titles match the implementation.DGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpm exec -- vitest run --project cli src/lib/advisories/checks/host/docker.test.ts src/lib/advisories/checks/host/index.test.ts src/lib/domain/docker-host.test.ts src/lib/onboard/preflight-docker-host.test.ts src/lib/onboard/docker-driver-gateway-env-service.test.ts src/lib/onboard/docker-driver-gateway-env-deb-override.test.ts→ 43 pass in 6 files. Before the fix, the trailing-newline case reached the 60-second service-health deadline; after the fix, it rejects the raw value before service startup.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm run docsbuilds without warnings (doc changes only)Signed-off-by: Dongni Yang dongniy@nvidia.com
Signed-off-by: Julie Yaunches jyaunches@nvidia.com
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
DOCKER_HOSTvalues now produce a clearinvalid_docker_hostadvisory with guidance to unset the setting or use an absolute Unix socket.Bug Fixes