fix(installer): retire out-of-range gateway after backup#7078
Conversation
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (5)
🚧 Files skipped from review as they are similar to previous changes (4)
📝 WalkthroughWalkthroughThe installer now validates the current blueprint’s OpenShell version range before retiring legacy gateways, with process-stop fallback handling. Tests cover supported, out-of-range, invalid, and failed-retirement scenarios; upgrade fixtures use structured registry metadata, and documentation reflects the updated workflow. ChangesOpenShell upgrade compatibility
Estimated code review effort: 3 (Moderate) | ~30 minutes Sequence Diagram(s)sequenceDiagram
participant Installer
participant Blueprint
participant Gateway
Installer->>Blueprint: Read supported OpenShell range
Blueprint-->>Installer: Return validated min/max versions
Installer->>Installer: Compare installed version with range
Installer->>Gateway: Retire out-of-range gateway
Gateway-->>Installer: Confirm lifecycle removal or process stop
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage remains at 96%, unchanged from the branch. TypeScript / code-coverage/cliThe overall coverage in the branch remains at 80%, unchanged from the branch. Show a code coverage summary of the most impacted files.
Updated |
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
cjagwani
changed the title
PR Review Advisor — InformationalAdvisor assessment: Informational / high confidence Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
E2E Target Results —
|
| Test | Result | Total wall clock time |
|---|---|---|
| openshell-gateway-upgrade | 6m 56s |
Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>
cjagwani
changed the title
|
🌿 Preview your docs: https://nvidia-preview-pr-7078.docs.buildwithfern.com/nemoclaw |
E2E Target Results — ❌ Some tests failedRun: 29559652425
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
scripts/install.sh (1)
2311-2313: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winEmpty
old_openshell_versiontriggers retirement with a blank version in the info message.If
installed_openshell_version(line 2279) fails to extract a version,old_openshell_versionis empty. Theversion_gte "" "$min_openshell_version"regex check fails, so! version_gteis true and the retirement block is entered. Theinfomessage on line 2313 then prints "Retiring OpenShell gateway" with a blank version. While this is fail-safe behavior, the message is misleading and retirement may be unnecessary when the installed version is simply undetectable rather than out-of-range.Consider guarding against the empty case before the range comparison.
🛡️ Proposed fix: skip retirement when installed version is unknown
read -r min_openshell_version max_openshell_version <<<"$supported_range" - if ! version_gte "$old_openshell_version" "$min_openshell_version" \ + if [ -z "$old_openshell_version" ]; then + warn "Could not determine the installed OpenShell version; skipping gateway retirement. Existing gateway and sandbox state were left unchanged after backup." + elif ! version_gte "$old_openshell_version" "$min_openshell_version" \ || ! version_gte "$max_openshell_version" "$old_openshell_version"; then🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/install.sh` around lines 2311 - 2313, Guard the retirement condition around the version comparison so it runs only when old_openshell_version is non-empty. Preserve the existing out-of-range checks and retirement behavior for detected versions, while skipping the block when installed_openshell_version yields an unknown version.
🧹 Nitpick comments (1)
scripts/install.sh (1)
2216-2217: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueShellCheck flags
A && B || Cpattern — prefer an explicitiffor the PID-file trust check.The logic is correct here (both operands are pure test commands with no side-effect return codes), but ShellCheck emits an info-level warning because
Ccan run whenAis true. Since the coding guidelines require shell scripts to pass ShellCheck, consider rewriting as an explicit conditional for clarity and to silence the warning.♻️ Optional refactor to explicit if-statement
- [ ! -L "$pid_file" ] && [ -O "$pid_file" ] \ - || error "Refusing to retire the legacy OpenShell gateway from an untrusted PID file: ${pid_file}" + if [ -L "$pid_file" ] || ! [ -O "$pid_file" ]; then + error "Refusing to retire the legacy OpenShell gateway from an untrusted PID file: ${pid_file}" + fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/install.sh` around lines 2216 - 2217, Replace the `[ ! -L "$pid_file" ] && [ -O "$pid_file" ] || error ...` expression with an explicit conditional around the PID-file trust check. Preserve the existing behavior: only continue when the file is not a symlink and is owned by the current user; otherwise invoke error with the same message.Sources: Coding guidelines, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/install.sh`:
- Around line 2222-2225: Update stop_legacy_openshell_gateway_process so the
stale-PID-file branch removes the file and returns 0 when kill -0 confirms the
process is already stopped. Preserve the existing failure return for other stop
failures, allowing the retirement cleanup chain to continue to openshell gateway
remove.
---
Outside diff comments:
In `@scripts/install.sh`:
- Around line 2311-2313: Guard the retirement condition around the version
comparison so it runs only when old_openshell_version is non-empty. Preserve the
existing out-of-range checks and retirement behavior for detected versions,
while skipping the block when installed_openshell_version yields an unknown
version.
---
Nitpick comments:
In `@scripts/install.sh`:
- Around line 2216-2217: Replace the `[ ! -L "$pid_file" ] && [ -O "$pid_file" ]
|| error ...` expression with an explicit conditional around the PID-file trust
check. Preserve the existing behavior: only continue when the file is not a
symlink and is owned by the current user; otherwise invoke error with the same
message.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1d3c006f-56e6-45a0-b440-347df0fc64d7
📒 Files selected for processing (6)
docs/get-started/quickstart.mdxdocs/manage-sandboxes/update-sandboxes.mdxdocs/reference/commands.mdxscripts/install.shtest/e2e/live/openshell-gateway-upgrade.test.tstest/install-openshell-upgrade-prompt.test.ts
🚧 Files skipped from review as they are similar to previous changes (5)
- docs/get-started/quickstart.mdx
- test/e2e/live/openshell-gateway-upgrade.test.ts
- docs/manage-sandboxes/update-sandboxes.mdx
- docs/reference/commands.mdx
- test/install-openshell-upgrade-prompt.test.ts
E2E Target Results —
|
| Test | Result | Total wall clock time |
|---|---|---|
| openshell-gateway-upgrade | 3m 29s |
E2E Target Results — ✅ All requested tests passedRun: 29561006926
|
4 participants
Summary
Follow up #7077 and #7028 by completing direct historical gateway upgrades. After a strict backup, the installer now retires a running gateway whenever its installed OpenShell is outside the prepared current release's supported range, preventing the new CLI from encountering the old gateway schema during recovery.
Changes
v0.0.55fixture records the original OpenShell directory before hiding it fromPATH.v0.0.74registry contract to bothnemoclawVersion: "0.0.74"andfromDockerfile: null, as proven by selective live E2E artifacts.Type of Change
Quality Gates
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm run docsbuilds without warnings (doc changes only) — passed with 0 errors; Fern reported the existing unauthenticated-redirect and accent-contrast warningsSigned-off-by: Charan Jagwani cjagwani@nvidia.com
Summary by CodeRabbit