fix(dcode): preserve max retries in headless runs

[jyaunches]

Summary

Managed headless DCode runs now preserve the validated --max-retries value instead of silently discarding it. The managed boundary continues to reject credentials, endpoints, provider settings, and all unrelated model parameters.

Related Issue

Fixes #7414

Changes

• Preserve only Deep Agents Code's internal CLI_MAX_RETRIES_KEY carrier in run_non_interactive.
• Add a focused regression test for the retry carrier and blocked model parameters.
• Document the supported headless retry option and the unchanged managed security boundary.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Issue #7414 defines the single allowed retry carrier. The focused regression test proves credentials, endpoints, provider settings, and unrelated model parameters remain blocked.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: docs/get-started/quickstart-langchain-deepagents-code.mdx; exact-head review confirmed the text against the implementation, WRITING.md, and docs/CONTRIBUTING.md. Focused tests passed 56 with 1 platform-specific skip; npm run docs passed with 0 errors and 2 existing Fern warnings; git diff --check passed.
• Agent: Codex Desktop documentation writer subagent

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project integration test/langchain-deepagents-code-retry-boundary.test.ts passed 1/1. The existing direct patch suite passed 57/57 before the focused case moved to satisfy the test-file size budget.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — command passed with 0 errors and 2 unprinted Fern warnings
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: J. Yaunches jmyaunch@gmail.com

Summary by CodeRabbit

• Bug Fixes

  • Headless managed runs now preserve the validated maximum retry setting while discarding other model parameters.
  • Runs without a valid retry setting continue without model parameters.

• Documentation

  • Clarified support for --max-retries and the handling of other model settings in managed headless runs.

• Tests

  • Added coverage for retry preservation and model parameter filtering.

[coderabbitai]

📝 Walkthrough

Walkthrough

The managed Deep Agents Code wrapper now preserves the validated --max-retries value while discarding other model parameters. The fixture defines the retry key, documentation describes the boundary, and a regression test verifies both behaviors.

Changes

Managed retry boundary

Layer / File(s)	Summary
Preserve validated retry parameter agents/langchain-deepagents-code/patch-managed-deepagents-code.py, test/helpers/langchain-deepagents-code-patch-fixture.ts, docs/get-started/quickstart-langchain-deepagents-code.mdx	The wrapper retains only CLI_MAX_RETRIES_KEY, the fixture defines that key, and the quickstart documents the resulting managed-headless behavior.
Verify retry parameter filtering test/langchain-deepagents-code-retry-boundary.test.ts	A regression test verifies retry preservation and removal of unrelated model parameters.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: bug-fix, integration: dcode

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The code now preserves only the validated retry key, keeps other model params blocked, and adds regression coverage for the boundary.
Out of Scope Changes check	✅ Passed	The docs, test helper, and new regression test all support the retry-boundary fix and do not introduce unrelated scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the main change: preserving max retries in headless runs.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/issue-7414

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7491.docs.buildwithfern.com/nemoclaw

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 9fb793e in the codex/issue-7414 branch remains at 96%, unchanged from commit fac91e6 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 9fb793e in the codex/issue-7414 branch remains at 80%, unchanged from commit 361ceac in the main branch.

Show a code coverage summary of the most impacted files.

File	main 361ceac	codex/issue-7414 9fb793e	+/-
src/lib/platform.ts	89%	84%	-5%
src/lib/onboard/dashboard.ts	72%	72%	0%
src/lib/inferen...pter-forward.ts	88%	88%	0%
src/lib/messagi...nnels/policy.ts	100%	100%	0%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/securit...ntial-filter.ts	93%	93%	0%
src/lib/actions...eway-restart.ts	93%	95%	+2%
src/lib/onboard...shboard-port.ts	90%	93%	+3%
src/lib/onboard...orward-start.ts	89%	98%	+9%
src/lib/onboard...ixed-forward.ts	38%	77%	+39%

---

_{Updated July 24, 2026 20:10 UTC}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 1 warning · 1 suggestion
• Model comparison: normalized findings differ; normalized E2E selections match; Nemotron reported the same number of blockers, 1 more warning, 1 more suggestion.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 optional E2E recommendation

• ubuntu-repo-cloud-langchain-deepagents-code

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[senthilr-nv]

Exact-head security review for 9fb793e5bc4a5f3450693a83d6349da64a4c8462: PASS with no findings.

• Secrets and credentials — PASS: no secret material was added; the patch explicitly continues to discard API keys, endpoints, provider settings, and unrelated model parameters.
• Input validation and sanitization — PASS: only the pinned upstream CLI_MAX_RETRIES_KEY carrier survives after the upstream parser validates --max-retries; arbitrary --model-params remains blocked.
• Authentication and authorization — PASS: no authentication or authorization path changes.
• Dependencies — PASS: no dependency or lockfile changes.
• Error handling and logging — PASS: no error or logging behavior changes and no sensitive values are rendered.
• Cryptography and data protection — PASS: no cryptographic or data-storage changes.
• Configuration and security headers — PASS: no runtime exposure, container, policy, or HTTP configuration changes.
• Security testing — PASS: the new regression proves the retry carrier survives while credentials, endpoints, provider overrides, and unrelated model parameters do not. Exact-head focused suites passed 56 tests with 1 platform-specific skip.
• System security — PASS: the final managed headless boundary remains least-privilege and fail-closed for every model parameter except the reviewed retry carrier.

Additional verification: npm run docs passed with 0 errors and 2 existing Fern warnings; git diff --check passed. Open PR #7422 overlaps the same patch block, so #7491 should merge first and #7422 must refresh against this regression. PR #7463 touches a separate provider-resolver block.

[senthilr-nv]

Approved at exact head 9fb793e5bc4a5f3450693a83d6349da64a4c8462 after the repository merge gate returned allPass: true. Product scope is established by accepted issue #7414 for the existing managed DCode surface. Exact-head CI, E2E coordination, DCO and commit verification, CodeRabbit, advisor rerun, nine-category security review, focused tests, documentation build, and documentation-writer receipt pass. Merge #7491 before overlapping PR #7422 so its retry-boundary regression becomes the base contract.