fix(images): ignore BuildKit telemetry in dcode probe

[jyaunches]

Summary

The complete managed-image publication failed because BuildKit injected an OpenTelemetry endpoint into Dockerfile probe steps. Remove that build-only value before the probes run, while keeping the shipped runtime secret rejection unchanged.

Changes

• Remove OTEL_EXPORTER_OTLP_TRACES_ENDPOINT from the build-time Deep Agents Code probe environment.
• Verify that the removal occurs before the managed launcher probe.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: The change affects only Dockerfile probe execution under BuildKit. It does not change the shipped runtime, configuration, or user workflow.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The runtime secret rejection remains unchanged. The exact failing buildx driver and the focused image contract test verify the scoped build-time removal.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: The change affects only BuildKit probe execution. The shipped runtime, configuration, interface, and user workflow do not change.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project integration test/langchain-deepagents-code-image.test.ts passed 20 tests. The exact arm64 managed image also built with buildx's docker-container driver from the immutable attempt-3 base digest.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new docs only)

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved the Deep Agents Code image startup behavior by preventing unintended trace exporter configuration from affecting its non-interactive initialization.
  • Ensured initialization proceeds in the correct order for more reliable startup.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Dockerfile now unsets OTEL_EXPORTER_OTLP_TRACES_ENDPOINT before the non-interactive dcode probe. Tests verify the command is present and precedes the probe invocation.

Changes

Deep Agents Code image

Layer / File(s)	Summary
Trace endpoint probe isolation agents/langchain-deepagents-code/Dockerfile, test/langchain-deepagents-code-image.test.ts	The image build clears the OTLP traces endpoint before running dcode, while tests verify the command and its ordering.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7946: Both changes update Deep Agents Code Dockerfile contracts involving OTEL-related inputs.

Suggested labels: bug-fix, platform: container, integration: dcode

Suggested reviewers: cv, brandonpelfrey, prekshivyas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main change: excluding BuildKit OpenTelemetry telemetry from the dcode probe.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-buildkit-otel-probe

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 1db90ad in the codex/fix-buildkit-o... branch remains at 96%, unchanged from commit 818a62f in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 1db90ad in the codex/fix-buildkit-o... branch remains at 81%, unchanged from commit ef32617 in the main branch.

Show a code coverage summary of the most impacted files.

File	main ef32617	codex/fix-buildkit-o... 1db90ad	+/-
src/lib/onboard...flight-ports.ts	67%	33%	-34%
src/lib/onboard...box-prebuild.ts	92%	74%	-18%
src/lib/actions...ocker-health.ts	82%	65%	-17%
src/lib/actions...confirmation.ts	79%	69%	-10%
src/lib/onboard...box-gpu-mode.ts	97%	92%	-5%
src/lib/actions...orchestrator.ts	87%	83%	-4%
src/lib/onboard/preflight.ts	80%	80%	0%
src/lib/onboard...host-anchors.ts	90%	94%	+4%
src/lib/domain/.../connect-env.ts	89%	97%	+8%
src/lib/onboard/docker-cdi.ts	70%	80%	+10%

---

_{Updated July 30, 2026 22:58 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: Consider the suggestions below.
Findings: 0 blockers · 0 warnings · 1 suggestion

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 1 suggestion
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings differ; normalized E2E selections match; Nemotron reported the same number of blockers, the same number of warnings, 1 fewer suggestion.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, ubuntu-repo-cloud-langchain-deepagents-code

0 warnings · 1 suggestion

Suggestions

No response is required.

PRA-1 Suggestion — Document the build-probe telemetry workaround lifecycle

• Location: agents/langchain-deepagents-code/Dockerfile:148
• Category: docs
• Problem: The Dockerfile clears an inherited trace endpoint before the build-time dcode probe, but does not record the invalid state source, why that source cannot be fixed here, a regression boundary, or a removal condition.
• Impact: Future maintainers cannot determine whether this build-only workaround remains required or safely remove it after the telemetry-state source changes.
• Suggestion: Add a concise adjacent comment that names the inherited build-state source, why it is not corrected in this image layer, the checked-in regression evidence, and the condition for removal.
• Verification: Read Dockerfile:140-152 and test/langchain-deepagents-code-image.test.ts:358-369 to confirm the workaround has no adjacent source and removal rationale.
• Test coverage: The existing static ordering assertion in test/langchain-deepagents-code-image.test.ts:367-369 proves probe placement; retain it and add any lifecycle-specific assertion only if the documentation is made machine-checkable.
• Evidence: agents/langchain-deepagents-code/Dockerfile:148 unsets OTEL_EXPORTER_OTLP_TRACES_ENDPOINT immediately before the dcode build probe. The surrounding comment at Dockerfile:140-145 describes launcher validation but does not describe this telemetry workaround's source or removal lifecycle. test/langchain-deepagents-code-image.test.ts:358,367-369 checks the statement and ordering but does not identify the workaround lifecycle.

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

🧹 Nitpick comments (1)

test/langchain-deepagents-code-image.test.ts (1)

358-358: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy lift

Verify the probe behavior, not only Dockerfile text.

These assertions prove that the unset string appears before the probe string, but they do not prove that the dcode process actually starts without OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. Add an image/build-level check that injects the variable and verifies the probe succeeds without receiving it.

Also applies to: 367-369

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/langchain-deepagents-code-image.test.ts` at line 358, Add an
image/build-level probe test in the existing Dockerfile test flow to inject
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, run the dcode process, and verify the probe
succeeds while the process does not receive that variable. Keep the current
Dockerfile ordering assertions, but extend the behavior check around the
existing unset/probe test cases.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/langchain-deepagents-code-image.test.ts`:
- Line 358: Add an image/build-level probe test in the existing Dockerfile test
flow to inject OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, run the dcode process, and
verify the probe succeeds while the process does not receive that variable. Keep
the current Dockerfile ordering assertions, but extend the behavior check around
the existing unset/probe test cases.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: cf15c14d-b6ab-4b1e-a5db-81b48fa5a6f1

📥 Commits

Reviewing files that changed from the base of the PR and between 7378642 and 1db90ad.

📒 Files selected for processing (2)

• agents/langchain-deepagents-code/Dockerfile
• test/langchain-deepagents-code-image.test.ts

[cjagwani]

Lgtm