fix(hermes): accept uv version metadata

[senthilr-nv]

Summary

Fixes the Hermes base-image build after uv 0.11.33 added build metadata to its version output. The build now verifies the exact semantic version and permits the metadata suffix.

Changes

• Parse the semantic-version token from uv --version instead of comparing the complete output.
• Add a regression test that accepts uv 0.11.33 with build metadata and rejects uv 0.11.32.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: The change only corrects a build-time version assertion. It does not change an installed version or user-visible behavior.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The assertion still rejects any semantic version other than the checksum-reviewed uv 0.11.33; the regression test covers accepted metadata and a rejected version.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The Dockerfile fix only accepts build metadata from the pinned uv version output. The regression test executes the Dockerfile fragment directly, accepts the pinned version with metadata, and rejects a different version. The maintainer follow-ups change only test implementation; no user-visible surface changed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run test/hermes-dependency-review.test.ts passed all 5 tests.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Senthil Ravichandran senthilr@nvidia.com

[coderabbitai]

📝 Walkthrough

Walkthrough

The Hermes Docker build now compares the parsed semantic version from uv --version with UV_VERSION. Tests execute the Dockerfile-derived check for build metadata differences and semantic version mismatches.

Changes

Hermes uv version validation

Layer / File(s)	Summary
Parse and test the uv version check agents/hermes/Dockerfile.base, test/hermes-dependency-review.test.ts	The Dockerfile compares the parsed version with UV_VERSION; tests extract and execute the same shell logic, accepting build metadata differences and rejecting semantic version mismatches.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7908: Updates related Hermes uv version-checking logic and tests.

Suggested labels: bug-fix, integration: hermes

Suggested reviewers: cv, prekshivyas

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly captures the main Hermes fix: accepting uv version output that includes build metadata.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-hermes-uv-version-check

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 04138a0 in the codex/fix-hermes-uv-... branch remains at 96%, unchanged from commit 25de83d in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 04138a0 in the codex/fix-hermes-uv-... branch remains at 81%, unchanged from commit 25de83d in the main branch.

Show a code coverage summary of the most impacted files.

File	main 25de83d	codex/fix-hermes-uv-... 04138a0	+/-
src/lib/onboard...ndbox-create.ts	83%	33%	-50%
src/lib/onboard...-create-plan.ts	88%	75%	-13%
src/lib/onboard...ndbox-create.ts	91%	83%	-8%
src/lib/domain/.../connect-env.ts	97%	89%	-8%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	88%	88%	0%
src/lib/state/config-io.ts	93%	93%	0%
src/lib/tunnel/services.ts	73%	73%	0%
src/lib/platform.ts	84%	89%	+5%

---

_{Updated July 30, 2026 18:18 UTC}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

test/hermes-dependency-review.test.ts (1)

36-42: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy lift

Exercise the Dockerfile check rather than a copied parser.

uvVersionCheckStatus reimplements the shell fragment, while the Dockerfile assertions only inspect raw text. A future Dockerfile regression could therefore pass this test. Execute the extracted Dockerfile fragment with the stubbed uv (or add a minimal build smoke test); retain the assertion proving the old comparison was removed.

As per path instructions, tests should establish behavioral confidence and avoid copied production algorithms or source-text-only assertions.

Also applies to: 112-115

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/hermes-dependency-review.test.ts` around lines 36 - 42, Replace the
copied shell parser in uvVersionCheckStatus with a test that extracts and
executes the relevant Dockerfile check using the stubbed uv command, so the test
exercises the actual Dockerfile behavior. Retain an assertion that verifies the
obsolete comparison was removed, but avoid relying solely on raw-source
assertions or reimplementing the production logic.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/hermes-dependency-review.test.ts`:
- Around line 43-45: Update the test helper and fixture setup around the
Dockerfile’s UV_VERSION argument so both expected outputs derive from the parsed
arg("UV_VERSION") value rather than hardcoding 0.11.33. Reuse that single parsed
value when setting UV_VERSION in spawnSync and when constructing the expected
results, including the additional fixture lines.
- Line 99: Update the uvVersionCheckStatus assertion in the dependency review
test to require an exact rejection status of 1 rather than merely asserting it
is nonzero. This must fail when the command returns null due to a spawn failure.

---

Nitpick comments:
In `@test/hermes-dependency-review.test.ts`:
- Around line 36-42: Replace the copied shell parser in uvVersionCheckStatus
with a test that extracts and executes the relevant Dockerfile check using the
stubbed uv command, so the test exercises the actual Dockerfile behavior. Retain
an assertion that verifies the obsolete comparison was removed, but avoid
relying solely on raw-source assertions or reimplementing the production logic.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: aa47a3c4-9f2f-4036-8b31-e17c950c6904

📥 Commits

Reviewing files that changed from the base of the PR and between f7a4f8c and 7cdfb52.

📒 Files selected for processing (2)

• agents/hermes/Dockerfile.base
• test/hermes-dependency-review.test.ts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, full-e2e, hermes-e2e, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/hermes-dependency-review.test.ts`:
- Around line 36-44: Replace the duplicated parsing in uvVersionCheckStatus and
the primary source-text assertions with execution of the Dockerfile’s actual
build-stage uv version check, preserving assertions for both matching and
mismatching versions. Extract or invoke the Dockerfile command through the
public build boundary so wiring and execution defects are covered, while
retaining source checks only as supplemental coverage.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 1192c03a-4340-46da-bd5c-818626f2b434

📥 Commits

Reviewing files that changed from the base of the PR and between 7cdfb52 and 96c79c5.

📒 Files selected for processing (1)

• test/hermes-dependency-review.test.ts

[apurvvkumaria]

Reviewed exact head 8478ec6. I found no critical correctness or security issue and am not requesting changes. The latest test now executes the Dockerfile's actual uv version-check fragment, so the earlier duplicated-parser concern is addressed.\n\nFast follow-up (non-blocking): add a minimal full Hermes base-image smoke test so this assertion is also exercised in the real image-build environment.\n\nMerge-gate note, not a review change request: the required codebase-growth-guardrails check is red because the test adds one if statement. That mechanical CI cleanup and the remaining exact-head gates still need to settle before approval.

[apurvvkumaria]

Re-reviewed new exact head 1809aa6. No critical correctness or security blocker found; I am not requesting changes. The conditional guardrail cleanup is correct and that non-required check is now green.\n\nCorrection to my prior note: codebase-growth-guardrails was non-required, not required. Current required E2E is still running, and exact-head Advisor/CodeRabbit must settle before approval.\n\nFast follow-up remains non-blocking: add a minimal full Hermes base-image smoke test to cover the assertion in the real image-build environment.