fix(hermes): support legacy gateway image builds - #7989
Conversation
Signed-off-by: San Dang <sdang@nvidia.com>
sandl99
added
area: docs
|
🌿 Preview your docs: https://nvidia-preview-pr-7989.docs.buildwithfern.com/nemoclaw |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit df828bb in the TypeScript / code-coverage/cliThe overall coverage in commit df828bb in the Show a code coverage summary of the most impacted files.
Updated |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughHermes image validation now uses a checked-in ChangesHermes image probe migration
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
3 additional E2E selections from the second opinionAdvisory only. The primary lane did not select these E2E jobs or targets.
Second-opinion E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 1 optional E2E recommendation
This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
Signed-off-by: San Dang <sdang@nvidia.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
test/hermes-image-build-probes.test.ts (1)
46-56: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd negative-path coverage for the runner dispatch boundary.
The runner is a build-gate script under
agents/. This test proves that the usage text lists every command. It does not prove that the runner rejects an unknown command, and it does not cover the two-argumentdashboard-policyform.Add assertions for both. An unknown command must exit nonzero.
dashboard-policywithout a path argument must also exit nonzero instead of falling through.💚 Proposed additional coverage
it("lists every Dockerfile probe command in the runner usage", () => { const result = spawnSync("python3", ["-I", probes], { encoding: "utf8", timeout: 5000, }); expect(result.status).toBe(1); for (const command of commands) { expect(result.stderr).toContain(command); } }); + + it("rejects an unknown command and a dashboard-policy call without a path", () => { + for (const argv of [["unknown-probe"], ["dashboard-policy"]]) { + const result = spawnSync("python3", ["-I", probes, ...argv], { + encoding: "utf8", + timeout: 5000, + }); + expect(result.status).toBe(1); + expect(result.stderr).toContain("usage:"); + } + }); });Based on the path instruction "Require negative-path tests that prove the boundary rejects bypasses".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/hermes-image-build-probes.test.ts` around lines 46 - 56, Add negative-path assertions to the existing runner test around the Python probes invocation: verify an unknown command exits nonzero, and verify invoking the dashboard-policy command without its required path argument also exits nonzero. Reuse the existing spawnSync setup and preserve the current usage-listing assertions.Source: Path instructions
test/hermes-discord-recovery-permissions.test.ts (1)
183-190: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueDrop the exact indentation from the Dockerfile invocation assertions.
These assertions encode the line continuation and the eight-space continuation indent of
agents/hermes/DockerfileLines 811-812 and 816-817. A whitespace-only reformat of the Dockerfile breaks the test while the contract holds.
test/hermes-image-build-probes.test.tsLine 35 already normalizes continuations and collapses whitespace before matching the same invocations. Reuse that normalization here and assert the identity plus the command, not the layout.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/hermes-discord-recovery-permissions.test.ts` around lines 183 - 190, Update the Dockerfile assertions in the recovery-permissions test to normalize line continuations and whitespace like the existing logic in hermes-image-build-probes.test.ts, then assert the invocation identity and command without requiring exact indentation or line layout. Preserve checks for both discord-create and discord-backup.agents/hermes/image-build-probes.py (1)
233-259: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueSeparate the dashboard-policy cleanup from the assertion.
verify_dashboard_policydeletes the file it validates at Line 259. The name states verification only. A reader of the Dockerfile step at Lines 565-567 cannot see that the probe consumes its input. Move thepath.unlink()call into the DockerfileRUNstep, or rename the command to state that it consumes the probe file.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/hermes/image-build-probes.py` around lines 233 - 259, Keep verify_dashboard_policy focused on validating the parsed policy and remove the path.unlink() side effect from that function. Add the cleanup explicitly in the Dockerfile RUN step that invokes the probe, so the command’s file consumption is visible at the call site.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/hermes-discord-recovery-permissions.test.ts`:
- Around line 191-192: Update the two expect assertions for
source.backup(target) and os.replace(staged, path) to be specific to the Discord
backup path by using discriminating strings unique to verify_discord_backup
rather than generic strings that appear in both verify_cron_backup and
verify_discord_backup. Replace or supplement the generic string patterns with
Discord-unique identifiers such as the staged filename
`.nemoclaw-discord-recovery-staged` to ensure the test only passes when the
Discord-specific function contains the expected calls.
---
Nitpick comments:
In `@agents/hermes/image-build-probes.py`:
- Around line 233-259: Keep verify_dashboard_policy focused on validating the
parsed policy and remove the path.unlink() side effect from that function. Add
the cleanup explicitly in the Dockerfile RUN step that invokes the probe, so the
command’s file consumption is visible at the call site.
In `@test/hermes-discord-recovery-permissions.test.ts`:
- Around line 183-190: Update the Dockerfile assertions in the
recovery-permissions test to normalize line continuations and whitespace like
the existing logic in hermes-image-build-probes.test.ts, then assert the
invocation identity and command without requiring exact indentation or line
layout. Preserve checks for both discord-create and discord-backup.
In `@test/hermes-image-build-probes.test.ts`:
- Around line 46-56: Add negative-path assertions to the existing runner test
around the Python probes invocation: verify an unknown command exits nonzero,
and verify invoking the dashboard-policy command without its required path
argument also exits nonzero. Reuse the existing spawnSync setup and preserve the
current usage-listing assertions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7d71de0b-a05f-4a82-99b0-f2187363cda6
📒 Files selected for processing (10)
.agents/skills/nemoclaw-contributor-update-hermes/SKILL.md.agents/skills/nemoclaw-contributor-update-hermes/references/hermes-contract-map.mdagents/hermes/Dockerfileagents/hermes/image-build-probes.pydocs/manage-sandboxes/install-plugins-hermes.mdxtest/hermes-cron-execution-runtime-patch.test.tstest/hermes-discord-recovery-permissions.test.tstest/hermes-final-image-layout.test.tstest/hermes-image-build-probes.test.tstest/hermes-profile-policy-defaults.test.ts
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
Signed-off-by: San Dang <sdang@nvidia.com>
There was a problem hiding this comment.
🧹 Nitpick comments (1)
agents/hermes/image-build-probes.py (1)
277-277: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winReplace the PATH-resolved
chmodprocess withos.chmod.Call
os.chmod(staged, 0o660)at both call sites. Remove the localsubprocessimports. Keep the existing mode assertions.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/hermes/image-build-probes.py` at line 277, Replace the PATH-resolved chmod subprocess calls at both call sites with os.chmod(staged, 0o660), remove the local subprocess imports, and preserve the existing mode assertions.Sources: Path instructions, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@agents/hermes/image-build-probes.py`:
- Line 277: Replace the PATH-resolved chmod subprocess calls at both call sites
with os.chmod(staged, 0o660), remove the local subprocess imports, and preserve
the existing mode assertions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 76fe73d7-6b3c-4963-b5de-3751d7a7a223
📒 Files selected for processing (3)
agents/hermes/Dockerfileagents/hermes/image-build-probes.pytest/hermes-discord-recovery-permissions.test.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- test/hermes-discord-recovery-permissions.test.ts
- agents/hermes/Dockerfile
…-7981' into fix/hermes-cron-ledger-ownership-7981-followup
<!-- markdownlint-disable MD041 --> ## Summary Adds the canonical dated changelog entry for `v0.0.100` so the maintainer release plan can verify the pre-tag documentation prerequisite. The entry summarizes the user-facing changes merged since `v0.0.99` and links to the relevant guides. ## Changes - Add `docs/changelog/2026-07-31.mdx` with the exact `## v0.0.100` heading. - Cover restored OpenClaw pairing, transactional replacement, Deep Agents Code, onboarding recovery, lifecycle cleanup, Hermes builds, host provenance, documentation, and trusted E2E evidence. - Distinguish active Docker and Kubernetes runtime-bundle enforcement from the still-inactive managed shared-state transaction foundation. ## Source Coverage The release entry maps the doc-impacting merged PRs in the `v0.0.99..main` release range to `docs/changelog/2026-07-31.mdx`: #8021, #8024, #7973, #8028, #7947, #7788, #7884, #8023, #7969, #8020, #7989, #8000, #7907, #7942, #7567, #8013, #7955, #8017, #8014, #8015, #7629, #7644, #7821, #7971, and #7991. PR #7974 was reviewed after the final rebase and excluded because it changes internal maintainer-skill attribution policy and tests only; it does not change a user-facing product or documentation surface. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: the changelog contract test validates the dated entry, version heading, SPDX form, and route constraints. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/changelog/2026-07-31.mdx`; exact-head review passed for `6093f44f`; writing rules and documentation style reviewed; `npx vitest run test/changelog-docs.test.ts` passed 6/6; `npm run docs` passed with zero Fern errors and two generic Fern upgrade notices. - Agent: Codex Desktop <!-- docs-review-head-sha: 6093f44 --> <!-- docs-review-agents-blob-sha: 3dd7c24 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable; no DGX Station host script changed. - Station profile/scenario: Not applicable. - Result: Not applicable. - Supporting evidence: Not applicable. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: `npx vitest run test/changelog-docs.test.ts` passed 6/6 at `6093f44f`. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not applicable to a dated prose-only release entry. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — validation passed with zero errors; Fern emitted two generic upgrade notices. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) — the changelog entry has the required parser-safe MDX SPDX header; dated changelog entries intentionally do not use page frontmatter. --- Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added release notes for v0.0.100. * Documented improvements to restore pairing, sandbox replacement, onboarding recovery, lifecycle cleanup, runtime handling, build support, host readiness, and end-to-end validation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
4 participants
Summary
Hermes image builds now run source and cross-identity probes through a checked-in Python runner instead of Dockerfile heredocs.
This lets OpenShell gateways that use Docker's legacy builder execute the same assertions as BuildKit and prevents the Hermes onboard failure reported in #7981.
Related Issue
Fixes #7981
Changes
image-build-probes.pyrunner for the 14 existing Hermes image assertions.Type of Change
Quality Gates
origin/main...c3106eea0against the nine-category security checklist. The review found no security findings: command dispatch is fixed, the runner is hash-bound and build-only, and the change adds no dependency, credential, authorization, network, or runtime surface.Documentation Writer Review
docs-updateddocs/manage-sandboxes/install-plugins-hermes.mdx; reviewed the Hermes updater skill and contract map against the committed implementation, 41/41 focused tests, successful BuildKit and legacy-builder image builds, and passing documentation validation. The final internal integrity-pin classification did not change a user-visible surface; its focused suite passed 115/115.DGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailablenpx vitest run test/hermes-image-build-probes.test.ts test/hermes-cron-execution-runtime-patch.test.ts test/hermes-discord-recovery-permissions.test.ts test/hermes-profile-policy-defaults.test.ts test/hermes-final-image-layout.test.tspassed 41/41 tests.npx vitest run test/changelog-docs.test.tspassed 6/6 tests. Full BuildKit andDOCKER_BUILDKIT=0Hermes image builds passed all 14 probe commands.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: Not run. A wider focused command passedtest/update-hermes-agent-script.test.ts; seven unrelated local host-harness tests failed in sandbox provisioning and rlimit checks.npm run docsbuilds without warnings (doc changes only)npm run docscompleted with zero errors and two pre-existing warnings.Signed-off-by: San Dang sdang@nvidia.com