fix(security): validate snapshot base64 linearly by ericksoa · Pull Request #8081 · NVIDIA/NemoClaw

ericksoa · 2026-08-02T17:56:34Z

Summary

Replace the snapshot helper payload regex with a bounded linear validator. Maximum-size canonical payloads now decode without a JavaScript stack overflow, while malformed, oversized, non-canonical, and invalid UTF-8 payloads continue to fail closed.

Related Issue

Relates #7744.

Changes

Share the existing 16 MiB per-file limit between the Python helper and TypeScript decoder.
Validate Base64 length, alphabet, and terminal padding with an iterative scan before decoding.
Preserve decoded-size, canonical re-encoding, and UTF-8 round-trip validation.
Add maximum-size, malformed near-tail, oversized, canonical-padding, invalid UTF-8, and single-padding unused-bit regressions.
Enforce the same encoded-size and canonical re-encoding checks at the isolated Python apply boundary before any replacement write.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification: This is an internal fail-closed decoder implementation change with no command, configuration, default, workflow, error-contract, or support-surface change.
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: CodeRabbit's two findings were resolved in 19cfe1a7626c; CodeRabbit and both exact-head advisors report no blockers after the successful Nemotron rerun, and the consolidated advisor result remains merge_as_is: fix(security): validate snapshot base64 linearly #8081 (comment)
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

Documentation writer subagent reviewed the completed changes
Result: no-docs-needed
Evidence: The exact-head parent-relative patch is unchanged from reviewed commit 19cfe1a7626c (stable patch ID bd5b516ceb88ee3dd01c4df6da694af4f90c2e89), touches only the snapshot-sanitizer test and isolated apply-boundary implementation, and preserves the reviewed AGENTS.md blob. No user-facing interface or documented behavior changes.
Agent: Codex Desktop

DGX Station Hardware Evidence

Tested on DGX Station
Tested commit:
Station profile/scenario:
Result:
Supporting evidence:

Verification

PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — both snapshot sanitizer suites pass 25/25; plugin production/test typecheck, Biome, repository checks, test-size and conditional scans, commit hooks, and pre-push gates pass. Exact-head refresh commit 1513342a9d75 preserves the reviewed parent-relative patch byte-for-byte.
Applicable broad gate passed — all exact-head CI, CodeQL, advisors, CodeRabbit, and protected E2E passed. Protected E2E selected and passed rebuild-openclaw and state-backup-restore in child run https://github.com/NVIDIA/NemoClaw/actions/runs/30765186285.
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Aaron Erickson aerickson@nvidia.com

Summary by CodeRabbit

Bug Fixes
- Improved snapshot content validation for malformed, oversized, and improperly encoded data.
- Added clearer enforcement of size limits and canonical Base64 formatting rules.
- Strengthened UTF-8 boundary validation to prevent invalid content from being accepted or replaced.
Tests
- Added coverage for maximum-size valid payloads, oversized content, malformed and non-canonical Base64, padding, replacement payloads, and UTF-8 edge cases.

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

coderabbitai · 2026-08-02T17:57:01Z

📝 Walkthrough

Walkthrough

The snapshot sanitizer now shares size limits across TypeScript and Python, validates Base64 length, syntax, canonical form, decoded size, and UTF-8 boundaries, and tests replacement rejection.

Changes

Snapshot sanitizer validation

Layer / File(s)	Summary
Shared snapshot size limits `nemoclaw/src/shared/snapshot-sanitizer-boundary.cts`	Shared constants define the maximum snapshot file size and Base64 length. The embedded Python helper uses the shared file-size limit.
Strict Base64 validation and boundary tests `nemoclaw/src/shared/snapshot-sanitizer-boundary.cts`, `nemoclaw/src/security/snapshot-sanitizer-failure.test.ts`	Base64 validation checks length, allowed characters, padding, canonical encoding, and decoded size before UTF-8 validation. Tests cover valid boundaries, malformed and oversized inputs, UTF-8 boundaries, and non-canonical replacement content.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main security change: replacing snapshot Base64 validation with a bounded, linear validator.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/snapshot-sanitizer-linear-base64-20260802

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-08-02T17:57:18Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 1513342 in the fix/snapshot-sanitiz... branch remains at 96%, unchanged from commit f93b27d in the main branch.

Show a code coverage summary of the most impacted files.

File	`main` f93b27d	`fix/snapshot-sanitiz...` 1513342	+/-
`nemoclaw/src/sh...er-boundary.cts`	95%	96%	+1%

TypeScript / code-coverage/cli

The overall coverage in commit 1513342 in the fix/snapshot-sanitiz... branch remains at 81%, unchanged from commit f93b27d in the main branch.

Show a code coverage summary of the most impacted files.

File	`main` f93b27d	`fix/snapshot-sanitiz...` 1513342	+/-
`src/lib/onboard/docker-cdi.ts`	80%	70%	-10%
`src/lib/domain/.../connect-env.ts`	97%	89%	-8%
`src/lib/onboard...ad/authority.ts`	95%	88%	-7%
`src/lib/shields/index.ts`	73%	69%	-4%
`src/lib/onboard/preflight.ts`	79%	80%	+1%
`src/lib/gateway...ntime-action.ts`	84%	92%	+8%
`src/lib/actions...er-lifecycle.ts`	85%	94%	+9%
`src/lib/actions...confirmation.ts`	69%	79%	+10%
`src/lib/actions...ocker-health.ts`	65%	82%	+17%
`src/lib/onboard...box-prebuild.ts`	74%	92%	+18%

_{Updated August 02, 2026 20:14 UTC}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nemoclaw/src/security/snapshot-sanitizer-failure.test.ts`:
- Around line 208-218: Add "AAB=" to the rejected inputs in the test case's
rejection set, preserving the existing cases, so single-padding Base64 with
altered unused bits is verified as rejected alongside the existing "AB=="
coverage.

In `@nemoclaw/src/shared/snapshot-sanitizer-boundary.cts`:
- Line 128: Update the snapshot sanitizer helper boundary around
MAX_SNAPSHOT_FILE_BYTES to validate Base64 canonically: enforce the shared
encoded-length limit before decoding, then re-encode decoded input and reject
values such as AB== and AAB= when the encoding differs from the original. Add
apply-path tests covering both rejected values.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2e8b4ee9-1f60-4e72-93a4-10b79f2ae241

📥 Commits

Reviewing files that changed from the base of the PR and between d5b64a7 and a94c80e.

📒 Files selected for processing (2)

nemoclaw/src/security/snapshot-sanitizer-failure.test.ts
nemoclaw/src/shared/snapshot-sanitizer-boundary.cts

github-actions · 2026-08-02T18:00:45Z

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
Model comparison: normalized findings match; normalized terminology decisions differ; normalized E2E selections differ; severity counts match.

1 additional E2E selection from the second opinion

Advisory only. The primary lane did not select these E2E jobs or targets.

snapshot-commands: The completed second-opinion lane identified E2E coverage that the primary lane omitted.

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

established — canonical base64 at nemoclaw/src/shared/snapshot-sanitizer-boundary.cts:511: Keep the established term for the exact re-encoding requirement.
justified — descriptor apply boundary at nemoclaw/src/security/snapshot-sanitizer-failure.test.ts:224: Keep the modifier because the test names the distinct replacement-write security boundary.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: rebuild-openclaw, state-backup-restore

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

## Summary Adds the inert, provider-neutral contract for handing a managed snapshot clone to a replacement workload. The plan binds exact source snapshot authority, destination identity, startup profile, inference routes, messaging state, and provider receipt before any later slice may mutate or publish the clone. This slice intentionally exposes no snapshot-action dependency or production caller. It does not activate clone handling, buildless onboarding, Podman, or any partial runtime support. ## Related Issue Part of #7744 ## Changes - Define immutable clone source, destination, provider receipt, and managed-profile handoff contracts. - Bind clone authority to exact provider, runtime snapshot, source/destination agent, platform, profile, and registry revision. - Add all-agent startup rebind planning for OpenClaw, Hermes, and LangChain Deep Agents Code. - Normalize inference-route and messaging credential/host-forward rebinding without runtime-specific central switches. - Reject stale, mutable, mismatched, cross-agent, malformed, or hostile-provider receipts. - Freeze provider receipts before provider acceptance so callbacks cannot mutate reviewed authority. - Prove the contract remains dormant through the public snapshot action: managed cross-sandbox restore exits before destination deletion, provider creation, clone creation, or state restore. - Document that clone handoff remains deferred to later transactional integration. - Apply the five still-valid CodeRabbit cleanup findings: canonical sandbox-template resolution, cast-free agent narrowing, shared OpenClaw/Hermes config selection, isolated environment stubbing, and a fully typed messaging-plan fixture. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Exact-head audit covers immutable provider receipts, source/destination authority, credential and inference rebinding, hostile callback mutation, and dormant production boundaries. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: Reviewed the lifecycle-contract update and exact production-boundary diff at head/base `6b6605b76e60197b2407897fd9a31bfa4134b7e0` / `56b26f173a4a3fbed6af77e01f6f3ddda84b237f`. The append-only restack preserves the managed-clone review thesis while incorporating the merged #8081 sanitizer correction from `main`. The four-file CodeRabbit cleanup uses existing canonical contracts and completes the test fixture's discriminated types; it changes no user-visible support claim. The internal documentation correctly keeps managed clone handoff deferred and dormant, and behavioral public-restore coverage proves managed clone attempts fail closed before destination deletion, provider creation, clone creation, or state restore. No user-visible buildless or Podman support is activated or advertised, so public support documentation remains intentionally unchanged. - Agent: Codex Desktop   ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - Exact validated head/base: `6b6605b76e60197b2407897fd9a31bfa4134b7e0` / `56b26f173a4a3fbed6af77e01f6f3ddda84b237f`. - Review budget: 22 files, `+2,101/-17`. - Stable patch ID: `ca7a91e9d6c5ce1241c0d00d8070113d66916a00`. - [x] All three appended cleanup/restack commits are signed-DCO and GitHub Verified; the exact-head DCO check passes. - [x] The exact-head tree passes 51 focused clone-contract, messaging-parser, channel-state, and public-boundary tests across five files. - [x] The exact-head tree passes all 15 snapshot-sanitizer failure tests, including the maximum-size canonical payload and oversized/malformed no-overflow cases from merged #8081. - [x] `npm run build:cli`, `npm run typecheck:cli`, `npm run checks:repository`, normal pre-push TypeScript/version gates, commitlint, Biome, and `git diff --check` pass. - [x] Behavioral dormancy coverage proves public managed clone restore exits before every destination effect. - [x] Hostile-provider coverage proves receipt mutation after callback entry cannot change reviewed authority. - [x] The exact-head clone-authority test adds zero `if` statements and its 12 cases pass after linearization. - [x] No production clone caller, runtime selection change, Podman switch, or public activation exists. - [x] Applicable broad gate passed — exact-head CI [run 30770174361](https://github.com/NVIDIA/NemoClaw/actions/runs/30770174361), advisor [run 30770173371](https://github.com/NVIDIA/NemoClaw/actions/runs/30770173371) attempt 2 (`merge_as_is`, 0 blockers/warnings/suggestions), CodeRabbit `SUCCESS` with zero unresolved threads, and protected E2E [child run 30770630425](https://github.com/NVIDIA/NemoClaw/actions/runs/30770630425) attempt 1 plus [coordination run 30770608520](https://github.com/NVIDIA/NemoClaw/actions/runs/30770608520) and [observer run 30770187080](https://github.com/NVIDIA/NemoClaw/actions/runs/30770187080) all passed. - Exact-head protected-E2E evidence: [child run 30770630425](https://github.com/NVIDIA/NemoClaw/actions/runs/30770630425) passed all 15 jobs on attempt 1. [Coordination run 30770608520](https://github.com/NVIDIA/NemoClaw/actions/runs/30770608520) verified the evidence, and coordination check `91555901383` bound PR/head/base `8032:6b6605b76e60197b2407897fd9a31bfa4134b7e0:56b26f173a4a3fbed6af77e01f6f3ddda84b237f`; [observer run 30770187080](https://github.com/NVIDIA/NemoClaw/actions/runs/30770187080) passed. - Maintainer disposition: CodeRabbit's generic 8.33% docstring-coverage warning is waived for this slice. TypeScript contracts, focused behavioral tests, and lifecycle documentation carry the behavior; boilerplate docstrings are out of scope. This does not claim that warning passed. ## Risk Plan - Primary risk: treating mutable or mismatched clone authority as valid and rebinding secrets/routes/state to the wrong destination. - Containment: exact immutable authority plus agent, provider, platform, source/destination, registry, profile, inference, and messaging checks fail closed. - Regression risk: accidental eager imports can alter existing snapshot test mocks before activation. A dedicated dormancy assertion and the previously failing snapshot suites prove the seam is absent here. - Rollback: one inert contract slice; no production action imports it. ## Stack - Base: merged PR3.8 #8031 plus merged sanitizer correction #8081; current `main` exact head `56b26f173a4a3fbed6af77e01f6f3ddda84b237f`. - This slice: PR3.9A #8032, branch `feat/managed-clone-handoff-contract`, exact head `6b6605b76e60197b2407897fd9a31bfa4134b7e0`. - Next: PR3.9B #8034 adds the provider transaction/dependency surface while remaining dormant; PR3.9C adds the Hermes-specific broker boundary. - Buildless and Podman support remain disabled until the full all-agent, multiarch, GPU/local-inference, recovery, installer, and protected-E2E gates in #7744 pass. Signed-off-by: Aaron Erickson <aerickson@nvidia.com>  ## Summary by CodeRabbit * **New Features** * Added managed workload and startup profile cloning with validation, destination-specific rebinding, and immutable handoff data. * Added messaging-plan rebinding that removes source credentials and adapts provider identities. * Added clone authorization across runtime providers. * Added environment-aware restoration, inference-route resolution, and provider-name validation. * Added Hermes destination inference tracking. * **Bug Fixes** * Prevented unsafe restoration and clone handoffs when validation or authorization fails. * Rejected inconsistent messaging channel disablement settings. * **Tests** * Expanded coverage for cloning, credential isolation, provider rebinding, immutability, and failure scenarios.  --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

## Summary Adds the canonical dated `v0.0.101` changelog entry that was missing when the release tag was cut. This post-release recovery records the shipped behavior on current `main` without changing or replacing the existing tag. ## Changes - Add `docs/changelog/2026-08-03.mdx` with the exact `## v0.0.101` heading, release summary, detailed behavior changes, support boundaries, and links to durable documentation. - [#7317](#7317) -> `docs/changelog/2026-08-03.mdx`: Records experimental OpenClaw Google Chat support and its restricted credential and webhook boundary. - [#7715](#7715) -> `docs/changelog/2026-08-03.mdx`: Records strict onboarding recovery state and authoritative resume identity. - [#7749](#7749) -> `docs/changelog/2026-08-03.mdx`: Records the provider-neutral policy seam and unchanged runtime support boundary. - [#7817](#7817) -> `docs/changelog/2026-08-03.mdx`: Records preserved Hermes home-channel assignments across rebuilds. - [#7820](#7820) -> `docs/changelog/2026-08-03.mdx`: Records the SSH-session status field correction. - [#7847](#7847) -> `docs/changelog/2026-08-03.mdx`: Records fail-closed credential filtering for migration and rebuild backups. - [#7870](#7870) -> `docs/changelog/2026-08-03.mdx`: Records sandbox-qualified in-sandbox host command hints. - [#7875](#7875) -> `docs/changelog/2026-08-03.mdx`: Records Microsoft Teams stop and start E2E coverage. - [#7885](#7885) -> `docs/changelog/2026-08-03.mdx`: Records Hermes managed gateway detection in status. - [#7889](#7889) -> `docs/changelog/2026-08-03.mdx`: Records policy-authenticated HTTPS Pin Runtime route revocation. - [#7891](#7891) -> `docs/changelog/2026-08-03.mdx`: Records default fallback for negative timeout and polling overrides. - [#7993](#7993) -> `docs/changelog/2026-08-03.mdx`: Records correct sibling detection during uninstall. - [#7995](#7995) -> `docs/changelog/2026-08-03.mdx`: Records absent configuration-hash handling before shields lock. - [#8001](#8001) -> `docs/changelog/2026-08-03.mdx`: Records the dormant atomic managed workload replacement foundation. - [#8029](#8029) -> `docs/changelog/2026-08-03.mdx`: Records repository terminology review in PR Review Advisor. - [#8031](#8031) -> `docs/changelog/2026-08-03.mdx`: Records provider-neutral managed snapshot authority. - [#8032](#8032) -> `docs/changelog/2026-08-03.mdx`: Records immutable managed clone handoff contracts. - [#8034](#8034) -> `docs/changelog/2026-08-03.mdx`: Records the dormant provider-owned clone transaction surface. - [#8035](#8035) -> `docs/changelog/2026-08-03.mdx`: Records the dormant Hermes managed clone broker boundary. - [#8036](#8036) -> `docs/changelog/2026-08-03.mdx`: Records the dormant transactional managed bootstrap boundary. - [#8037](#8037) -> `docs/changelog/2026-08-03.mdx`: Records dormant Docker bootstrap primitives and the unchanged provider support boundary. - [#8070](#8070) -> `docs/changelog/2026-08-03.mdx`: Records consolidated sandbox resource-limit E2E coverage. - [#8071](#8071) -> `docs/changelog/2026-08-03.mdx`: Records escaped and bounded CLI validation diagnostics. - [#8081](#8081) -> `docs/changelog/2026-08-03.mdx`: Records bounded linear snapshot Base64 validation. - [#8085](#8085) -> `docs/changelog/2026-08-03.mdx`: Records commit-bound workflow approval for eligible same-repository maintainers. - [#8088](#8088) -> `docs/changelog/2026-08-03.mdx`: Records Hermes managed-policy E2E selection. - [#8090](#8090) -> `docs/changelog/2026-08-03.mdx`: Records pinned CI search-tool provisioning. - [#8106](#8106) -> `docs/changelog/2026-08-03.mdx`: Records fallback from failed managed OpenShell gateway startup. - [#8107](#8107) -> `docs/changelog/2026-08-03.mdx`: Records Hermes adapter lifecycle E2E selection. - [#8128](#8128) -> `docs/changelog/2026-08-03.mdx`: Records the dormant transactional Docker bootstrap adapter and rollback authority. - [#8140](#8140) -> `docs/changelog/2026-08-03.mdx`: Records Slack conflict scope across independent OpenShell gateways. - [#8147](#8147) -> `docs/changelog/2026-08-03.mdx`: Records completion of durable v0.0.100 documentation audit follow-ups. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: This documentation-only recovery does not change executable behavior. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: Independently reviewed `docs/changelog/2026-08-03.mdx` at commit `0bebe1f568e3dc85cf410aac1dfb8f8830070b85`. Its blob is `82887920f9720eafd75db6b2271c35f7477edb9b`. The entry follows the writing guide, controlled terminology, changelog structure, MDX SPDX format, literal CLI-name rule, and root-absolute route requirements. It accurately records the `v0.0.100...v0.0.101` release range, Announcement #8162, accepted scope boundaries, and shipped security behavior. There are no code samples. Focused changelog tests and the documentation build pass for this commit. - Agent: Codex Desktop independent documentation writer   ## Security Review - Result: `PASS` - Reviewed commit: `0bebe1f568e3dc85cf410aac1dfb8f8830070b85` - Base commit: `643a4ab8b5f583d8555192a37927268b26022c51` - Findings: None. - Secrets and credentials: `PASS`. No credential values or secret files are present. - Input validation and data sanitization: `PASS`. No executable input path changes. - Authentication and authorization: `PASS`. No identity or permission logic changes. - Dependencies and third-party libraries: `PASS`. No dependency changes. - Error handling and logging: `PASS`. No runtime path changes; diagnostic-security claims are precise. - Cryptography and data protection: `PASS`. No implementation changes. - Configuration and security controls: `PASS`. No configuration, container, port, or HTTP changes. - Security testing: `PASS`. No coverage is removed; the entry records shipped test and security behavior. - System security: `PASS`. No runtime control changes; dormant and non-activation boundaries are explicit. - Agent: Codex Desktop independent security reviewer ## Verification - [ ] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub — verification is pending after commit `0bebe1f568e3dc85cf410aac1dfb8f8830070b85` is pushed. - [ ] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable — commit hooks passed; pre-push is pending. - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — tests are not applicable to this documentation-only recovery. - [x] Applicable broad gate passed — not applicable to this documentation-only recovery. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, credentials, or private keys are added by this diff. - [ ] `npm run docs` builds without warnings (doc changes only) — GitHub documentation checks are pending. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) — independent documentation review passed. - [x] New doc pages include SPDX header and frontmatter (new pages only) — the native changelog entry uses the required parser-safe MDX SPDX comment and intentionally has no frontmatter. GitHub CI is authoritative. Focused changelog tests and `npm run docs` passed after the merge refresh. --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>  ## Summary by CodeRabbit * **New Features** * Added experimental Google Chat support. * Improved runtime and session status visibility. * Added onboarding recovery and persistence safeguards. * Added snapshot validation and dormant managed-workload support. * **Bug Fixes** * Improved backup sanitization, route handling, and gateway reliability. * **Documentation** * Added the v0.0.101 changelog and related updates. * **Tests** * Expanded end-to-end coverage and strengthened trusted CI validation.  --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Senthil Ravichandran <senthilr@nvidia.com>

fix(security): validate snapshot base64 linearly

a94c80e

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa added area: security Security controls, permissions, secrets, or hardening bug-fix PR fixes a bug or regression platform: container Affects Docker, containerd, Podman, or images labels Aug 2, 2026

ericksoa self-assigned this Aug 2, 2026

coderabbitai Bot reviewed Aug 2, 2026

View reviewed changes

Comment thread nemoclaw/src/security/snapshot-sanitizer-failure.test.ts

Comment thread nemoclaw/src/shared/snapshot-sanitizer-boundary.cts

ericksoa mentioned this pull request Aug 2, 2026

[Epic] Support native Podman with buildless managed onboarding #7744

Open

ericksoa added 2 commits August 2, 2026 11:45

fix(security): validate snapshot apply payloads

19cfe1a

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

merge(stack): refresh sanitizer on current main

1513342

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

ericksoa added the v0.0.101 label Aug 2, 2026

ericksoa merged commit 56b26f1 into main Aug 2, 2026
99 of 101 checks passed

ericksoa deleted the fix/snapshot-sanitizer-linear-base64-20260802 branch August 2, 2026 21:26

ericksoa mentioned this pull request Aug 2, 2026

feat(snapshot): prepare immutable managed clone handoff #8032

Merged

23 tasks

apurvvkumaria mentioned this pull request Aug 3, 2026

docs: recover v0.0.101 changelog entry #8160

Merged

22 tasks

Navigation Menu

Uh oh!

fix(security): validate snapshot base64 linearly - #8081

fix(security): validate snapshot base64 linearly#8081
ericksoa merged 3 commits into
mainfrom
fix/snapshot-sanitizer-linear-base64-20260802

ericksoa commented Aug 2, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 2, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

github-code-quality Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ericksoa commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Quality Gates

Documentation Writer Review

DGX Station Hardware Evidence

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-code-quality Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — No blocking findings reported

Model lanes

E2E guidance

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ericksoa commented Aug 2, 2026 •

edited

Loading

coderabbitai Bot commented Aug 2, 2026 •

edited

Loading

github-code-quality Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading