fix(onboard): preserve fresh DCode routing on re-onboard#6332
Merged
Conversation
Co-authored-by: Chengjie Wang <chengjiew@nvidia.com> Signed-off-by: Chengjie Wang <chengjiew@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
21 tasks
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds DCode drift handling to onboarding and resume flows, introduces managed ChangesManaged DCode onboarding and restore flow
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant CLI as nemoclaw onboard
participant Onboard as onboard.ts
participant Restore as restoreSandboxState
participant Drift as getDcodeSelectionDrift
participant Finalize as finalizeCreatedSandbox
participant Registry as sandboxRegistration
CLI->>Onboard: re-onboard --fresh sandbox
Onboard->>Restore: restore backup with managed policy
Restore-->>Onboard: merged config.toml
Onboard->>Finalize: finalizeCreatedSandbox(options, deps)
Finalize->>Drift: verify live selection
Drift-->>Finalize: {changed, unknown}
alt drift changed or unknown
Finalize->>CLI: log error, exit 1
else verified match
Finalize->>Registry: registerCreatedSandbox(provider, model)
Registry-->>CLI: status reflects verified live selection
end
Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
PR Review Advisor (Nemotron Ultra) — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-6332.docs.buildwithfern.com/nemoclaw |
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the branch is 96%. Coverage data for the branch is not yet available. Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the branch is 73%. Coverage data for the branch is not yet available. Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
cv
approved these changes
Jul 6, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
src/lib/onboard/dcode-selection-drift.ts (1)
111-119: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPossibly unnecessary try/catch around a non-throwing boundary call.
deps.runCaptureOpenshellis invoked here withignoreError: true, yet every other call site ofrunCaptureOpenshellwith the same option insrc/lib/onboard.ts(e.g.forward list,sandbox list,--version) is used directly with no surrounding try/catch. This suggestsignoreError: truealready prevents throwing, making this try/catch dead defensive code.Based on learnings, "avoid adding 'defensive' error handling (e.g., try/catch wrappers, fallbacks, or extra validation) around internal helper logic when there is no realistic throwing path or failure mode... otherwise remove unnecessary try/catch that doesn't handle any actionable error."
♻️ Suggested simplification (pending confirmation that runCaptureOpenshell cannot throw with ignoreError:true)
- let output: string | null | undefined; - try { - output = deps.runCaptureOpenshell( - ["sandbox", "exec", "-n", sandboxName, "--", "dcode", "identity"], - { ignoreError: true }, - ); - } catch { - return { ...UNKNOWN_SELECTION_DRIFT }; - } + const output = deps.runCaptureOpenshell( + ["sandbox", "exec", "-n", sandboxName, "--", "dcode", "identity"], + { ignoreError: true }, + );🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/dcode-selection-drift.ts` around lines 111 - 119, The try/catch around deps.runCaptureOpenshell in dcode-selection-drift.ts appears unnecessary because ignoreError: true is already used and similar call sites in onboard.ts call the same helper directly. Remove the dead defensive wrapper and keep the sandbox exec "dcode identity" call as a straightforward assignment to output, while preserving the existing UNKNOWN_SELECTION_DRIFT fallback only if the helper can truly throw without ignoreError.Source: Learnings
src/lib/state/dcode-config-restore-input.test.ts (1)
20-50: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider sharing the TOML test double with
created-sandbox-finalization.test.ts.This file and
created-sandbox-finalization.test.tseach define an independent faketomllib/tomli_wshim for exercising the sameDCODE_CONFIG_MERGE_PYTHONscript. Consolidating into one shared test helper would reduce the risk of the two fakes drifting apart and masking a real regression that only one of them would catch.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/state/dcode-config-restore-input.test.ts` around lines 20 - 50, The TOML test double is duplicated here and in created-sandbox-finalization.test.ts, which can let the two shims drift apart. Extract the shared fake tomllib/tomli_w setup from PYTHON_TEST_WRAPPER into a common test helper and reuse it in both tests, keeping the DCODE_CONFIG_MERGE_PYTHON execution path identical across them.src/lib/onboard/created-sandbox-finalization.ts (1)
4-4: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winReuse the shared sandbox restore types
RestoreOptionsandRestoreResultalready live insrc/lib/state/sandbox.ts; importing them here avoids a second copy drifting from the canonical shape.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/created-sandbox-finalization.ts` at line 4, The sandbox finalization code is importing a separate type instead of reusing the canonical restore types. Update the imports in created-sandbox-finalization to use RestoreOptions and RestoreResult from sandbox.ts, and remove the duplicated local shape so the restore flow stays aligned with the shared state types. Keep the existing finalization logic, but make any references in the module use the shared type names consistently.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/onboard/created-sandbox-finalization.ts`:
- Around line 6-14: Duplicate local RestoreOptions/RestoreResult definitions in
created-sandbox-finalization should be removed and replaced with imports from
the canonical sandbox state module. Update the code around
createdSandboxFinalization to use the exported RestoreOptions and RestoreResult
from state/sandbox.ts so there is a single source of truth, and adjust any
references in the finalization logic to match the full RestoreResult shape
including failedDirs and failedFiles.
---
Nitpick comments:
In `@src/lib/onboard/created-sandbox-finalization.ts`:
- Line 4: The sandbox finalization code is importing a separate type instead of
reusing the canonical restore types. Update the imports in
created-sandbox-finalization to use RestoreOptions and RestoreResult from
sandbox.ts, and remove the duplicated local shape so the restore flow stays
aligned with the shared state types. Keep the existing finalization logic, but
make any references in the module use the shared type names consistently.
In `@src/lib/onboard/dcode-selection-drift.ts`:
- Around line 111-119: The try/catch around deps.runCaptureOpenshell in
dcode-selection-drift.ts appears unnecessary because ignoreError: true is
already used and similar call sites in onboard.ts call the same helper directly.
Remove the dead defensive wrapper and keep the sandbox exec "dcode identity"
call as a straightforward assignment to output, while preserving the existing
UNKNOWN_SELECTION_DRIFT fallback only if the helper can truly throw without
ignoreError.
In `@src/lib/state/dcode-config-restore-input.test.ts`:
- Around line 20-50: The TOML test double is duplicated here and in
created-sandbox-finalization.test.ts, which can let the two shims drift apart.
Extract the shared fake tomllib/tomli_w setup from PYTHON_TEST_WRAPPER into a
common test helper and reuse it in both tests, keeping the
DCODE_CONFIG_MERGE_PYTHON execution path identical across them.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 02f9551a-6662-47d4-ac88-03f684f3df40
📒 Files selected for processing (18)
agents/langchain-deepagents-code/manifest.yamldocs/get-started/quickstart-langchain-deepagents-code.mdxdocs/reference/commands-nemohermes.mdxdocs/reference/commands.mdxsrc/lib/onboard.tssrc/lib/onboard/created-sandbox-finalization.test.tssrc/lib/onboard/created-sandbox-finalization.tssrc/lib/onboard/dcode-selection-drift.test.tssrc/lib/onboard/dcode-selection-drift.tssrc/lib/onboard/machine/core-flow-phases.test.tssrc/lib/onboard/machine/handlers/sandbox-dcode-selection.test.tssrc/lib/onboard/machine/handlers/sandbox-resume.test.tssrc/lib/onboard/machine/handlers/sandbox-resume.tssrc/lib/onboard/machine/handlers/sandbox-test-fixtures.tssrc/lib/onboard/machine/handlers/sandbox.tssrc/lib/state/dcode-config-restore-input.test.tssrc/lib/state/dcode-config-restore-input.tssrc/lib/state/sandbox.ts
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/onboard/gateway-start-failure.ts`:
- Around line 76-90: The gateway diagnostics path currently redacts before
normalizing text, which can let ANSI/CR sequences interfere with plain-token and
KEY= matching. Update the gateway-start-failure flow around
collectDiagnostics(), redact(), and the line processing in
gateway-start-failure.ts to strip carriage returns and ANSI escapes first, then
pass the cleaned text into redact() before printing. Use the existing ANSI_RE
handling and redact() call site as the main place to adjust the order of
operations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 65754065-4fe9-479d-acd6-8d1ed45d845e
📒 Files selected for processing (3)
src/lib/onboard.tssrc/lib/onboard/created-sandbox-finalization.test.tssrc/lib/onboard/gateway-start-failure.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- src/lib/onboard/created-sandbox-finalization.test.ts
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/lib/onboard/created-sandbox-finalization.test.ts (1)
224-227: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPrefer observable restore behavior over call-shape lock-in.
These assertions pin the exact policy object/argument shape instead of proving the restore boundary outcome. Assert the resulting config/registry behavior for managed vs custom restore so refactors of
restoreSandboxStatedo not break tests without changing behavior. As per path instructions, tests should prefer observable outcomes through the public boundary over mock-call assertions.Also applies to: 322-326
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/created-sandbox-finalization.test.ts` around lines 224 - 227, The test is overfitting to the internal call shape of restoreSandboxState instead of verifying behavior. Update the created-sandbox-finalization tests to assert the observable restore outcome through the public boundary, such as the resulting config/registry state for managed versus custom restore, and remove the expectation on options?.stateFileRestorePolicy in the mocked restoreSandboxState wrapper. Use the existing restoreSandboxState, managedDcodeConfigRestorePolicy, and sandboxState references to keep the assertions focused on behavior rather than implementation details.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/lib/onboard/created-sandbox-finalization.test.ts`:
- Around line 224-227: The test is overfitting to the internal call shape of
restoreSandboxState instead of verifying behavior. Update the
created-sandbox-finalization tests to assert the observable restore outcome
through the public boundary, such as the resulting config/registry state for
managed versus custom restore, and remove the expectation on
options?.stateFileRestorePolicy in the mocked restoreSandboxState wrapper. Use
the existing restoreSandboxState, managedDcodeConfigRestorePolicy, and
sandboxState references to keep the assertions focused on behavior rather than
implementation details.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 36347e4a-9875-4ad7-a73e-5f1b0987afde
📒 Files selected for processing (8)
src/lib/onboard/created-sandbox-finalization.test.tssrc/lib/onboard/created-sandbox-finalization.tssrc/lib/onboard/machine/handlers/sandbox-dcode-resume.tssrc/lib/onboard/machine/handlers/sandbox.tssrc/lib/state/dcode-config-restore-input.test.tssrc/lib/state/dcode-config-restore-input.tssrc/lib/state/sandbox.tssrc/lib/state/state-file-restore-policy.ts
✅ Files skipped from review due to trivial changes (1)
- src/lib/state/state-file-restore-policy.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- src/lib/onboard/created-sandbox-finalization.ts
- src/lib/state/dcode-config-restore-input.test.ts
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/onboard/gateway-start-failure.test.ts`:
- Around line 7-10: The legacy gateway-start failure path is still being
invoked, so onboarding is not using only the final failure handler yet. Update
the gateway start failure flow in the onboarding logic to stop calling
reportLegacyGatewayStartResultFailure on non-zero starts and route failures
through createFinalGatewayStartFailureHandler instead; make sure any remaining
references in gateway-start-failure are removed or replaced so the final handler
is the only active branch.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: bdc96664-5fbe-4760-8bd6-590c1e6dd145
📒 Files selected for processing (4)
src/lib/onboard/created-sandbox-finalization.test.tssrc/lib/onboard/created-sandbox-finalization.tssrc/lib/onboard/gateway-start-failure.test.tssrc/lib/onboard/gateway-start-failure.ts
🚧 Files skipped from review as they are similar to previous changes (3)
- src/lib/onboard/created-sandbox-finalization.ts
- src/lib/onboard/created-sandbox-finalization.test.ts
- src/lib/onboard/gateway-start-failure.ts
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
2 tasks
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28817114802
|
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Contributor
E2E Target Results — ✅ All selected jobs passedRun: 28817457576
|
prekshivyas
added a commit
that referenced
this pull request
Jul 6, 2026
The cloud-experimental check-04 (fresh DCode re-onboard) captures `dcode identity` stdout+stderr into a shell variable via command substitution, but the `|| fail` handler prints only a generic message and discards the captured output. When `dcode identity` exits non-zero the real reason is lost — CI logs and result.json show stdout "" — which is why the current cloud-onboard failure on main (introduced with this check in #6332) cannot be diagnosed. Print the captured output to stdout (so it lands in result.json) before failing, on both the initial and post-re-onboard identity reads. No behavior change to the check's pass/fail logic; this only makes the existing failure observable so the root cause in the managed DCode onboarding flow can be found. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
9 tasks
prekshivyas
added a commit
that referenced
this pull request
Jul 6, 2026
…rd check check-04 read the live identity with `openshell sandbox exec -- dcode identity`. That runs without a login shell, so /usr/local/bin is not on PATH and `dcode` resolves to "command not found" — the real reason cloud-onboard has failed on main since #6332 added this check (surfaced by the preceding observability commit). The image installs the launcher at /usr/local/bin/dcode, so invoke it by absolute path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
cv
pushed a commit
that referenced
this pull request
Jul 6, 2026
…board dcode identity failure (#6343) ## Summary Fixes two E2E-harness problems surfaced by the E2E dispatch on `main`: 1. **e2e-live source require hook** — the `hermes-inference-switch` live suite (added in #6335) failed at collection with `Cannot find module '../runner'` because the `e2e-live` Vitest project never loaded the typed-source require hook. 2. **cloud-onboard observability** — the cloud-experimental check-04 (added in #6332) fails on `main` with `could not read initial dcode identity`, but the real `dcode identity` error is captured into a shell var and discarded, so it can't be diagnosed. ## Changes - `vitest.config.ts`: add `setupFiles: ["test/helpers/onboard-script-mocks.cjs"]` to the `e2e-live` project (mirrors `cli`). Registers the typed-source `.ts` require hook **in-process** — deliberately not via `env.NODE_OPTIONS`, so `--require` never leaks into the real CLI subprocesses live tests spawn. - `test/e2e/e2e-cloud-experimental/checks/04-deepagents-code-fresh-reonboard.sh`: on both `dcode identity` reads, print the captured stdout+stderr to stdout (so it lands in `result.json`) before `fail`. No change to pass/fail logic — only makes the existing failure observable. ### Root cause — #1 (fixed here) `hermes-inference-switch` is the first `e2e-live` suite to import a deep `src` graph — its helpers import `src/lib/inference/config.ts`, which transitively loads `ollama-runtime-context.ts`'s runtime `require("../runner")`. Without the require hook, Node's native CJS resolver can't resolve the extensionless `.ts` → suite throws at collection (`0 tests`, ~37s). Only this suite hit it; others drive the CLI as a subprocess and import only fixtures. `runner.ts` has no circular dependency on the inference graph, so the in-process hook resolves it fully. ### Root cause — #2 (observability only; product root cause pending) `cloud-onboard` was green on `main` through 2026-07-06 00:56 UTC and failed on the first main E2E after #6332 landed (19:50 UTC) — #6332 added check-04, which has never passed on main. `dcode identity` is the NemoClaw wrapper (`agents/langchain-deepagents-code/dcode-wrapper.sh`); its identity path returns 0 in isolation and #6332 did not modify it, so the non-zero exit is a runtime condition in #6332's new "recreate/verify live identity" onboarding flow. That can't be pinned without the swallowed stderr — which this change surfaces. Product root cause is for the #6332 author to fix once the next run shows the real error. ## Type of Change - [x] Code change (feature, bug fix, or refactor) ## Quality Gates - [x] Existing tests cover changed behavior — justification: both changes are E2E-harness config/diagnostics. #1: the `e2e-live` suites exercise the hook — verified the previously-failing `hermes-inference-switch` suite now collects and all `e2e-live` suites report 0 collection errors, and the full `e2e-all` dispatch ran the switch job (hosted) green. #2: pure diagnostic output; no pass/fail change. - [x] Docs not applicable — justification: internal test-harness config/diagnostics; no user-facing behavior. - [x] Sensitive paths changed (onboarding/inference/runner adjacent via test config) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — justification: changes are confined to Vitest test-runner setup (`vitest.config.ts`) and an E2E diagnostic print; no product runtime code path is altered. The require hook is in-process only and does not touch product CLI subprocesses. ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed — note: `pre-push` `tsc-cli` skipped for a pre-existing local-only `noImplicitAny` false-positive in `test/helpers/mcp-lifecycle-lock-properties.ts` and `src/lib/state/mcp-lifecycle-lock-identity.test.ts` (unrelated to this diff); CI `tsc-cli` covers it. Check-04 passed `bash -n` and the `shellcheck`/`shfmt` pre-commit hooks. - [x] Targeted behavior tests pass — command/result: `NEMOCLAW_RUN_LIVE_E2E=1 npx vitest list --project e2e-live` → switch suite collects; whole project 0 collection errors (before the fix it reproduced `Cannot find module '../runner'`). Full `e2e-all` dispatch on this branch ran `hermes-inference-switch (hosted)` green. - [x] No secrets, API keys, or credentials committed --- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved reliability of live end-to-end test runs by loading the required hook inside the test process, avoiding leakage into real CLI subprocesses. * Made identity checks in sandboxed cloud experimental flows more robust, with clearer diagnostics when identity lookup fails. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
7 tasks
cv
pushed a commit
that referenced
this pull request
Jul 7, 2026
## Summary Add the v0.0.75 release-notes entry for the release train, summarizing the user-facing fixes merged since v0.0.74. Release-prep docs for the `nemoclaw-maintainer-cut-release-tag` gate. ## Related Issue Release prep for v0.0.75. Remove this section if none. ## Changes - `docs/about/release-notes.mdx`: add the `## v0.0.75` section (themed intro + grouped bullets with source-page links), matching the existing v0.0.74 style. ### Source summary (doc-impacting PRs → doc page) - #6370 -> `docs/about/release-notes.mdx`: prepared-backup recovery restores gateway state and defers the live route check to onboarding, so upgrade recovery no longer fails on an unset gateway route. - #6305 -> `docs/about/release-notes.mdx`: in-place upgrades recover gateway-orphaned sandboxes. - #6332 -> `docs/about/release-notes.mdx`: same-name `--fresh` re-onboard preserves fresh LangChain Deep Agents Code routing. - #6335 -> `docs/about/release-notes.mdx`: custom Anthropic-compatible inference uses the OpenAI frontend. - #6298 -> `docs/about/release-notes.mdx`: OpenAI-only agents keep the `/v1` base URL on Anthropic-compatible endpoints. - #6304 -> `docs/about/release-notes.mdx`: local docker-driver gateway credentials no longer expire. - #6261 -> `docs/about/release-notes.mdx`: Hermes runtime and managed MCP state reconcile after a runtime change. - #6318 -> `docs/about/release-notes.mdx`: Hermes installs accept a pinned base platform digest. - #6291 -> `docs/about/release-notes.mdx`: OpenClaw local CLI pairing restores its previous connection path. Test-performance, CI, and chore commits since v0.0.74 are excluded as non-user-facing. ## Type of Change - [x] Doc only (prose changes, no code sample modifications) ## Quality Gates - [x] Tests not applicable — justification: documentation-only change (release notes prose). - [x] Docs updated for user-facing behavior changes ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] `npm run docs` builds without warnings introduced by this change — command/result: "Found 0 errors and 2 warnings" (the 2 warnings pre-exist this change). - [x] Doc pages follow the style guide (active voice, no numbered/colon titles, correct NVIDIA/NemoClaw/OpenShell capitalization; skip-terms avoided). - [x] No secrets, API keys, or credentials committed --- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new **v0.0.75** section to the release notes, highlighting improved sandbox upgrade hardening and prepared-backup recovery, updated inference routing for Anthropic-compatible endpoints, longer-lasting local gateway credential handling, and restored CLI pairing reconnection without re-pairing. Also includes cross-links to related NemoClaw CLI and documentation pages. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This was referenced Jul 7, 2026
10 tasks
wscurran
added
area: onboarding
Merged
21 tasks
21 tasks
jyaunches
added a commit
that referenced
this pull request
Jul 9, 2026
…e step into modules (#6444) <!-- markdownlint-disable MD041 --> ## Summary Extracts cohesive units of the sandbox create/register orchestration out of the ~4,900-line `src/lib/onboard.ts` entrypoint into focused modules under `src/lib/onboard/`, following the injected-deps boundary style established by `created-sandbox-finalization.ts` (#6332). The primary goal is maintainability and independent unit-test coverage for the create path, with intentional safety/behavior refinements discovered during review: redacted create-output failure echoing, preservation of non-zero create-stream status when readiness fails, direct argv spawning for trusted create paths, fail-closed Docker-GPU create-poll side-effect handling, and redacted trace reporting for poll/readiness errors. Note on the issue's premise: #6258 cites a `+27 net lines` growth-guard violation from #6166. That premise is stale — the merged #6166 left `onboard.ts` net-smaller, and #6276/#6332 shrank it further, so the guard (`.github/workflows/codebase-growth-guardrails.yaml`, a per-PR net-neutral diff gate) is not currently red. This PR is therefore incremental maintainability work; it keeps `onboard.ts` net-neutral-or-smaller so the gate stays green. ## Related Issue Refs #6258 <!-- Refs (not Fixes): this PR lands two increments of a larger extraction; the remaining create/finalize wiring is left for follow-ups, so the issue should stay open. --> ## Changes - Add `src/lib/onboard/created-sandbox-failure.ts`: `reportSandboxCreateFailure` (warns-and-continues on an incomplete create; otherwise prints diagnostics + recovery hints and exits) and `reportSandboxReadinessFailure` (prints the readiness failure, defers cleanup to the Docker-GPU patch or deletes the failed sandbox, then exits). `onboard.ts` replaces the two inline blocks with module calls — net −2 lines. - Add `src/lib/onboard/sandbox-create-step.ts`: `runSandboxCreateStep` encapsulates the BuildKit prebuild handoff → Docker-GPU create-patch provisioning → create-stream behind a context + injected-deps boundary. This move is **line-neutral** on `onboard.ts`; its value is a named, unit-testable boundary (the `prepare → patch → stream` sequence is now testable without standing up the entrypoint), not a size reduction. Build-context and exit-listener cleanup stay with the caller that armed them. - Add focused unit tests across `created-sandbox-failure.test.ts`, `sandbox-create-step.test.ts`, `sandbox-create-launch.test.ts`, `create-stream.test.ts`, `create-stream-argv.test.ts`, and `create-stream-ready-gate.test.ts` covering failure branches, redaction, exit-code preservation, GPU vs non-GPU readiness cleanup, prebuild/patch/stream wiring, direct argv spawn boundaries, terminal-agent/default-driver ready-check gating, fail-closed `onPoll` error handling, and redacted poll/readiness trace behavior. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: no CLI flags, commands, configuration, or documented user workflow changed. The user-visible differences are limited to safer failure-path diagnostics (credential redaction), more accurate readiness-failure exit status, and fail-closed create-poll error handling. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: onboarding/sandbox path. Extraction boundaries were verified against the pre-extraction source; intentional safety refinements are explicitly covered by tests: create output is redacted before failure logging, readiness failure preserves a non-zero create-stream status instead of flattening to `1`, Docker-GPU during-create polling is isolated from readiness detection via `onPoll`, escaping poll errors abort create with classified/generic failure text plus redacted trace emission, and ready-check exceptions emit redacted trace evidence without falsely forcing Ready. Requesting maintainer sensitive-path review. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result: `npx vitest run --project cli src/lib/actions/sandbox/snapshot.test.ts src/lib/onboard/created-sandbox-failure.test.ts src/lib/onboard/sandbox-create-launch.test.ts src/lib/onboard/sandbox-create-step.test.ts src/lib/sandbox/create-stream.test.ts src/lib/sandbox/create-stream-ready-gate.test.ts src/lib/sandbox/create-stream-argv.test.ts` → 107 passed; `npx tsc --noEmit --pretty false --project tsconfig.cli.json` → clean; `npm run test-size:check` → passed; `npx prek run --all-files --stage pre-commit --skip source-shape-test-budget --skip test-skills-yaml` → passed; `npm run test-conditionals:scan -- --top 25` → no new changed-file conditional failures; `git diff --check` → clean. - [x] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Required live E2E run [29021019725](https://github.com/NVIDIA/NemoClaw/actions/runs/29021019725) passed on exact head `82518f7e6f69c39d9bc04f63a365753aac7b1b6d`: `cloud-onboard`, `onboard-repair`, `onboard-resume`, `state-backup-restore`, `upgrade-stale-sandbox`, and `snapshot-commands` all succeeded. PR CI checks also passed on the same head after rerunning flaky `policy-channel-list.test.ts` shard timeout (`cli-test-shards (3)`). - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Dongni Yang <dongniy@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved sandbox onboarding using a dedicated creation step that centralizes prebuild handoff, streaming create execution, GPU patch wiring, and readiness capture. * **Bug Fixes** * More consistent, centralized handling for both create failures and readiness failures, including redacted output, clearer diagnostics, and reliable retry guidance. * Safer cleanup on readiness failures to avoid same-name collisions, with correct behavior for GPU-enabled flows. * **Tests** * Added coverage for create/readiness failure reporting, exit-code fallback, cleanup/command messaging, and early-detach behavior in create-stream. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Dongni Yang <dongniy@nvidia.com> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Julie Yaunches <jyaunches@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Keep managed Deep Agents Code runtime routing aligned with the provider/model selected during same-name re-onboarding. The fix treats the live `dcode identity` result as authoritative, reconciles mixed-ownership `config.toml` state without restoring stale routing, and publishes registry metadata only after the restored runtime is verified. ## Related Issue Closes NVIDIA#6311 Supersedes NVIDIA#6317. This incorporates and extends @chengjiew's original drift/recreate investigation; Chengjie is credited as a co-author on the commit. ## Changes - Recreate stock managed DCode sandboxes when live route, provider, model, or endpoint identity is stale or unreadable; refuse unverifiable reuse when the registry row is absent. - Restore only four bounded display preferences from backed-up DCode config: three booleans and the enumerated thread sort order. Keep fresh `models`, `update`, and generated provider metadata authoritative, and drop free-form or behavior-bearing backup settings. - Perform the merge with bounded TOML parsing, regular-file checks, same-directory staging, inode revalidation, `fsync`, and atomic replacement. - Validate the live restored selection before writing registry/status metadata, and leave custom-image plus ordinary snapshot/rebuild restore behavior unchanged. - Keep generic hotspots bounded by extracting gateway failure handling, DCode resume policy, and caller-authorized state-file restore policy into focused modules. - Add unit, handler, restore-boundary, and orchestration regression coverage plus user-facing documentation. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: independent reviews checked live identity parsing, restore ordering, custom-image provenance, file safety, same-user atomic-replace assumptions, and registry publication; all confirmed blockers were resolved. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: focused CLI suites 67/67; snapshot, OpenClaw restore, and spawned gateway integrations 53/53; final restore/finalization follow-ups 22/22 and prepared-context integration 2/2. - [x] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: not applicable; this is a scoped DCode onboarding/restore fix, and the targeted suites plus normal repository hooks cover the changed boundaries. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — passed with 0 errors and 2 existing unspecified Fern warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Managed Deep Agents Code onboarding and resume now verify live `dcode identity` to detect selection drift and recreate sandboxes when selections are unreadable or mismatched. * Managed restores can merge backed-up `config.toml` while keeping freshly generated model routing and provider metadata authoritative. * **Bug Fixes** * Prevents unverified managed DCode reuse when the expected registry entry is missing. * Improves gateway-start failure output by redacting sensitive diagnostics and printing clearer remediation commands. * **Documentation** * Updated quickstart and command reference for revised restore behavior and non-interactive recreation rules. * **Tests** * Added coverage for managed config merge ownership, selection drift, and sandbox finalization/resume flows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Chengjie Wang <chengjiew@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Chengjie Wang <chengjiew@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
…board dcode identity failure (NVIDIA#6343) ## Summary Fixes two E2E-harness problems surfaced by the E2E dispatch on `main`: 1. **e2e-live source require hook** — the `hermes-inference-switch` live suite (added in NVIDIA#6335) failed at collection with `Cannot find module '../runner'` because the `e2e-live` Vitest project never loaded the typed-source require hook. 2. **cloud-onboard observability** — the cloud-experimental check-04 (added in NVIDIA#6332) fails on `main` with `could not read initial dcode identity`, but the real `dcode identity` error is captured into a shell var and discarded, so it can't be diagnosed. ## Changes - `vitest.config.ts`: add `setupFiles: ["test/helpers/onboard-script-mocks.cjs"]` to the `e2e-live` project (mirrors `cli`). Registers the typed-source `.ts` require hook **in-process** — deliberately not via `env.NODE_OPTIONS`, so `--require` never leaks into the real CLI subprocesses live tests spawn. - `test/e2e/e2e-cloud-experimental/checks/04-deepagents-code-fresh-reonboard.sh`: on both `dcode identity` reads, print the captured stdout+stderr to stdout (so it lands in `result.json`) before `fail`. No change to pass/fail logic — only makes the existing failure observable. ### Root cause — rh-ai-quickstart#1 (fixed here) `hermes-inference-switch` is the first `e2e-live` suite to import a deep `src` graph — its helpers import `src/lib/inference/config.ts`, which transitively loads `ollama-runtime-context.ts`'s runtime `require("../runner")`. Without the require hook, Node's native CJS resolver can't resolve the extensionless `.ts` → suite throws at collection (`0 tests`, ~37s). Only this suite hit it; others drive the CLI as a subprocess and import only fixtures. `runner.ts` has no circular dependency on the inference graph, so the in-process hook resolves it fully. ### Root cause — NVIDIA#2 (observability only; product root cause pending) `cloud-onboard` was green on `main` through 2026-07-06 00:56 UTC and failed on the first main E2E after NVIDIA#6332 landed (19:50 UTC) — NVIDIA#6332 added check-04, which has never passed on main. `dcode identity` is the NemoClaw wrapper (`agents/langchain-deepagents-code/dcode-wrapper.sh`); its identity path returns 0 in isolation and NVIDIA#6332 did not modify it, so the non-zero exit is a runtime condition in NVIDIA#6332's new "recreate/verify live identity" onboarding flow. That can't be pinned without the swallowed stderr — which this change surfaces. Product root cause is for the NVIDIA#6332 author to fix once the next run shows the real error. ## Type of Change - [x] Code change (feature, bug fix, or refactor) ## Quality Gates - [x] Existing tests cover changed behavior — justification: both changes are E2E-harness config/diagnostics. rh-ai-quickstart#1: the `e2e-live` suites exercise the hook — verified the previously-failing `hermes-inference-switch` suite now collects and all `e2e-live` suites report 0 collection errors, and the full `e2e-all` dispatch ran the switch job (hosted) green. NVIDIA#2: pure diagnostic output; no pass/fail change. - [x] Docs not applicable — justification: internal test-harness config/diagnostics; no user-facing behavior. - [x] Sensitive paths changed (onboarding/inference/runner adjacent via test config) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — justification: changes are confined to Vitest test-runner setup (`vitest.config.ts`) and an E2E diagnostic print; no product runtime code path is altered. The require hook is in-process only and does not touch product CLI subprocesses. ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed — note: `pre-push` `tsc-cli` skipped for a pre-existing local-only `noImplicitAny` false-positive in `test/helpers/mcp-lifecycle-lock-properties.ts` and `src/lib/state/mcp-lifecycle-lock-identity.test.ts` (unrelated to this diff); CI `tsc-cli` covers it. Check-04 passed `bash -n` and the `shellcheck`/`shfmt` pre-commit hooks. - [x] Targeted behavior tests pass — command/result: `NEMOCLAW_RUN_LIVE_E2E=1 npx vitest list --project e2e-live` → switch suite collects; whole project 0 collection errors (before the fix it reproduced `Cannot find module '../runner'`). Full `e2e-all` dispatch on this branch ran `hermes-inference-switch (hosted)` green. - [x] No secrets, API keys, or credentials committed --- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved reliability of live end-to-end test runs by loading the required hook inside the test process, avoiding leakage into real CLI subprocesses. * Made identity checks in sandboxed cloud experimental flows more robust, with clearer diagnostics when identity lookup fails. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary Add the v0.0.75 release-notes entry for the release train, summarizing the user-facing fixes merged since v0.0.74. Release-prep docs for the `nemoclaw-maintainer-cut-release-tag` gate. ## Related Issue Release prep for v0.0.75. Remove this section if none. ## Changes - `docs/about/release-notes.mdx`: add the `## v0.0.75` section (themed intro + grouped bullets with source-page links), matching the existing v0.0.74 style. ### Source summary (doc-impacting PRs → doc page) - NVIDIA#6370 -> `docs/about/release-notes.mdx`: prepared-backup recovery restores gateway state and defers the live route check to onboarding, so upgrade recovery no longer fails on an unset gateway route. - NVIDIA#6305 -> `docs/about/release-notes.mdx`: in-place upgrades recover gateway-orphaned sandboxes. - NVIDIA#6332 -> `docs/about/release-notes.mdx`: same-name `--fresh` re-onboard preserves fresh LangChain Deep Agents Code routing. - NVIDIA#6335 -> `docs/about/release-notes.mdx`: custom Anthropic-compatible inference uses the OpenAI frontend. - NVIDIA#6298 -> `docs/about/release-notes.mdx`: OpenAI-only agents keep the `/v1` base URL on Anthropic-compatible endpoints. - NVIDIA#6304 -> `docs/about/release-notes.mdx`: local docker-driver gateway credentials no longer expire. - NVIDIA#6261 -> `docs/about/release-notes.mdx`: Hermes runtime and managed MCP state reconcile after a runtime change. - NVIDIA#6318 -> `docs/about/release-notes.mdx`: Hermes installs accept a pinned base platform digest. - NVIDIA#6291 -> `docs/about/release-notes.mdx`: OpenClaw local CLI pairing restores its previous connection path. Test-performance, CI, and chore commits since v0.0.74 are excluded as non-user-facing. ## Type of Change - [x] Doc only (prose changes, no code sample modifications) ## Quality Gates - [x] Tests not applicable — justification: documentation-only change (release notes prose). - [x] Docs updated for user-facing behavior changes ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] `npm run docs` builds without warnings introduced by this change — command/result: "Found 0 errors and 2 warnings" (the 2 warnings pre-exist this change). - [x] Doc pages follow the style guide (active voice, no numbered/colon titles, correct NVIDIA/NemoClaw/OpenShell capitalization; skip-terms avoided). - [x] No secrets, API keys, or credentials committed --- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new **v0.0.75** section to the release notes, highlighting improved sandbox upgrade hardening and prepared-backup recovery, updated inference routing for Anthropic-compatible endpoints, longer-lasting local gateway credential handling, and restored CLI pairing reconnection without re-pairing. Also includes cross-links to related NemoClaw CLI and documentation pages. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
…e step into modules (NVIDIA#6444) <!-- markdownlint-disable MD041 --> ## Summary Extracts cohesive units of the sandbox create/register orchestration out of the ~4,900-line `src/lib/onboard.ts` entrypoint into focused modules under `src/lib/onboard/`, following the injected-deps boundary style established by `created-sandbox-finalization.ts` (NVIDIA#6332). The primary goal is maintainability and independent unit-test coverage for the create path, with intentional safety/behavior refinements discovered during review: redacted create-output failure echoing, preservation of non-zero create-stream status when readiness fails, direct argv spawning for trusted create paths, fail-closed Docker-GPU create-poll side-effect handling, and redacted trace reporting for poll/readiness errors. Note on the issue's premise: NVIDIA#6258 cites a `+27 net lines` growth-guard violation from NVIDIA#6166. That premise is stale — the merged NVIDIA#6166 left `onboard.ts` net-smaller, and NVIDIA#6276/NVIDIA#6332 shrank it further, so the guard (`.github/workflows/codebase-growth-guardrails.yaml`, a per-PR net-neutral diff gate) is not currently red. This PR is therefore incremental maintainability work; it keeps `onboard.ts` net-neutral-or-smaller so the gate stays green. ## Related Issue Refs NVIDIA#6258 <!-- Refs (not Fixes): this PR lands two increments of a larger extraction; the remaining create/finalize wiring is left for follow-ups, so the issue should stay open. --> ## Changes - Add `src/lib/onboard/created-sandbox-failure.ts`: `reportSandboxCreateFailure` (warns-and-continues on an incomplete create; otherwise prints diagnostics + recovery hints and exits) and `reportSandboxReadinessFailure` (prints the readiness failure, defers cleanup to the Docker-GPU patch or deletes the failed sandbox, then exits). `onboard.ts` replaces the two inline blocks with module calls — net −2 lines. - Add `src/lib/onboard/sandbox-create-step.ts`: `runSandboxCreateStep` encapsulates the BuildKit prebuild handoff → Docker-GPU create-patch provisioning → create-stream behind a context + injected-deps boundary. This move is **line-neutral** on `onboard.ts`; its value is a named, unit-testable boundary (the `prepare → patch → stream` sequence is now testable without standing up the entrypoint), not a size reduction. Build-context and exit-listener cleanup stay with the caller that armed them. - Add focused unit tests across `created-sandbox-failure.test.ts`, `sandbox-create-step.test.ts`, `sandbox-create-launch.test.ts`, `create-stream.test.ts`, `create-stream-argv.test.ts`, and `create-stream-ready-gate.test.ts` covering failure branches, redaction, exit-code preservation, GPU vs non-GPU readiness cleanup, prebuild/patch/stream wiring, direct argv spawn boundaries, terminal-agent/default-driver ready-check gating, fail-closed `onPoll` error handling, and redacted poll/readiness trace behavior. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: no CLI flags, commands, configuration, or documented user workflow changed. The user-visible differences are limited to safer failure-path diagnostics (credential redaction), more accurate readiness-failure exit status, and fail-closed create-poll error handling. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: onboarding/sandbox path. Extraction boundaries were verified against the pre-extraction source; intentional safety refinements are explicitly covered by tests: create output is redacted before failure logging, readiness failure preserves a non-zero create-stream status instead of flattening to `1`, Docker-GPU during-create polling is isolated from readiness detection via `onPoll`, escaping poll errors abort create with classified/generic failure text plus redacted trace emission, and ready-check exceptions emit redacted trace evidence without falsely forcing Ready. Requesting maintainer sensitive-path review. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result: `npx vitest run --project cli src/lib/actions/sandbox/snapshot.test.ts src/lib/onboard/created-sandbox-failure.test.ts src/lib/onboard/sandbox-create-launch.test.ts src/lib/onboard/sandbox-create-step.test.ts src/lib/sandbox/create-stream.test.ts src/lib/sandbox/create-stream-ready-gate.test.ts src/lib/sandbox/create-stream-argv.test.ts` → 107 passed; `npx tsc --noEmit --pretty false --project tsconfig.cli.json` → clean; `npm run test-size:check` → passed; `npx prek run --all-files --stage pre-commit --skip source-shape-test-budget --skip test-skills-yaml` → passed; `npm run test-conditionals:scan -- --top 25` → no new changed-file conditional failures; `git diff --check` → clean. - [x] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Required live E2E run [29021019725](https://github.com/NVIDIA/NemoClaw/actions/runs/29021019725) passed on exact head `82518f7e6f69c39d9bc04f63a365753aac7b1b6d`: `cloud-onboard`, `onboard-repair`, `onboard-resume`, `state-backup-restore`, `upgrade-stale-sandbox`, and `snapshot-commands` all succeeded. PR CI checks also passed on the same head after rerunning flaky `policy-channel-list.test.ts` shard timeout (`cli-test-shards (3)`). - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Dongni Yang <dongniy@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Improved sandbox onboarding using a dedicated creation step that centralizes prebuild handoff, streaming create execution, GPU patch wiring, and readiness capture. * **Bug Fixes** * More consistent, centralized handling for both create failures and readiness failures, including redacted output, clearer diagnostics, and reliable retry guidance. * Safer cleanup on readiness failures to avoid same-name collisions, with correct behavior for GPU-enabled flows. * **Tests** * Added coverage for create/readiness failure reporting, exit-code fallback, cleanup/command messaging, and early-detach behavior in create-stream. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Dongni Yang <dongniy@nvidia.com> Signed-off-by: Julie Yaunches <jyaunches@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Julie Yaunches <jyaunches@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Keep managed Deep Agents Code runtime routing aligned with the provider/model selected during same-name re-onboarding. The fix treats the live
dcode identityresult as authoritative, reconciles mixed-ownershipconfig.tomlstate without restoring stale routing, and publishes registry metadata only after the restored runtime is verified.Related Issue
Closes #6311
Supersedes #6317. This incorporates and extends @chengjiew's original drift/recreate investigation; Chengjie is credited as a co-author on the commit.
Changes
models,update, and generated provider metadata authoritative, and drop free-form or behavior-bearing backup settings.fsync, and atomic replacement.Type of Change
Quality Gates
Verification
Verifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: not applicable; this is a scoped DCode onboarding/restore fix, and the targeted suites plus normal repository hooks cover the changed boundaries.npm run docsbuilds without warnings (doc changes only) — passed with 0 errors and 2 existing unspecified Fern warnings.Signed-off-by: Apurv Kumaria akumaria@nvidia.com
Summary by CodeRabbit
dcode identityto detect selection drift and recreate sandboxes when selections are unreadable or mismatched.config.tomlwhile keeping freshly generated model routing and provider metadata authoritative.