docs: complete v0.0.101 post-tag audit follow-ups - #8255
Conversation
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughChannel actions now resolve agent-supported messaging manifests and use canonical channel IDs. Documentation covers Teams, experimental Google Chat support, enrollment, lifecycle behavior, policy presets, and route-revocation recovery. ChangesMessaging channel support
Route recovery documentation
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
🌿 Preview your docs: https://nvidia-preview-pr-8255.docs.buildwithfern.com/nemoclaw |
PR Review Advisor — InformationalAdvisor assessment: Informational / low confidence Model lanes
Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate. 3 semantic terminology decisionsTerminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.
E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/reference/commands.mdx`:
- Around line 2102-2108: Update the channels stop command to validate the
requested channel through the same agent-filtered listAvailable path used by
channels list before calling getChannelDef or stopping it. Reject channels
absent from that filtered list, while preserving existing handling for supported
configured channels.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b951a314-039b-4a19-9762-42abf415c32a
📒 Files selected for processing (6)
docs/get-started/quickstart.mdxdocs/inference/custom-endpoint-security.mdxdocs/manage-sandboxes/manage-messaging-channels.mdxdocs/manage-sandboxes/set-up-google-chat.mdxdocs/network-policy/integration-policy-examples.mdxdocs/reference/commands.mdx
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
<!-- markdownlint-disable MD041 --> ## Summary Channel start and stop accepted stale configured channels that the sandbox agent runtime does not support. They now use the same agent-filtered manifest availability as `channels list` before reading channel state or mutating policy, registry, or sandbox state. ## Changes - Gate channel start and stop by the sandbox agent's manifest-supported channels. - Cover stale Google Chat configuration on Hermes with fail-closed start and stop tests. - Preserve the supported Hermes and Microsoft Teams stop flow. - Document that both start and stop names match `channels list` for the sandbox agent runtime. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Exact-head nine-category security review passed; lifecycle commands now fail closed before state reads or mutations when a configured channel is unsupported by the sandbox agent. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/reference/commands.mdx`; independent review covered the complete change, writing rules, documentation style, 34 focused tests, CLI type-checking, Biome, agent-variant sync, and the docs build. - Agent: Codex Desktop <!-- docs-review-head-sha: 76d9018 --> <!-- docs-review-agents-blob-sha: 3dd7c24 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run --project cli src/lib/actions/sandbox/policy-channel-agent-gate.test.ts src/lib/actions/sandbox/policy-channel-remove-flow.test.ts src/lib/messaging/manifest/registry.test.ts src/lib/messaging/utils.test.ts` (34 passed) - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not applicable to this focused lifecycle gate; authoritative PR CI will run the repository-selected broad checks. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — build passed with 0 errors and 2 existing warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com> Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit d6b5c3b in the TypeScript / code-coverage/cliThe overall coverage in commit d6b5c3b in the Show a code coverage summary of the most impacted files.
Updated |
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
senthilr-nv
left a comment
senthilr-nv
left a comment
There was a problem hiding this comment.
Reviewed refreshed head 305b5f0. Product scope is in scope; the documentation and agent-gated channel lifecycle behavior are correct, focused validation passed, and no blocking findings remain.
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/reference/commands.mdx (1)
2180-2181: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winRender the Google Chat enrollment note only for OpenClaw.
This shared page describes an OpenClaw-only setup flow without an
<AgentOnly variant="openclaw">block. Hermes and Deep Agents readers can still see instructions for an unsupported channel. Wrap this paragraph in the OpenClaw block.As per coding guidelines, use
<AgentOnly>blocks for content that differs by agent behavior or setup flow.Proposed fix
+<AgentOnly variant="openclaw"> The OpenClaw-only Google Chat channel uses an experimental token-paste flow for the service-account JSON. It also requires interactive public-webhook confirmation and prompts for optional app-principal configuration during enrollment. + +</AgentOnly>🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/reference/commands.mdx` around lines 2180 - 2181, Wrap the Google Chat enrollment paragraph in an <AgentOnly variant="openclaw"> block so only OpenClaw readers see this OpenClaw-specific setup flow; leave the paragraph’s text unchanged.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/inference/custom-endpoint-security.mdx`:
- Around line 110-112: Update the cleanup guidance around NemoClaw uninstall to
require removing every sibling gateway, either manually or with nemoclaw
uninstall --all-gateway-ports, before declaring credentials purged. Instruct
operators to verify that the adapter PID and listener have stopped after
destroying all sandboxes and completing uninstall.
---
Outside diff comments:
In `@docs/reference/commands.mdx`:
- Around line 2180-2181: Wrap the Google Chat enrollment paragraph in an
<AgentOnly variant="openclaw"> block so only OpenClaw readers see this
OpenClaw-specific setup flow; leave the paragraph’s text unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 4242fc6e-d3b5-4df8-b8c3-0f05dd88a941
📒 Files selected for processing (3)
docs/get-started/quickstart.mdxdocs/inference/custom-endpoint-security.mdxdocs/reference/commands.mdx
🚧 Files skipped from review as they are similar to previous changes (1)
- docs/get-started/quickstart.mdx
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
5 participants
Summary
This PR updates Microsoft Teams, Google Chat, and HTTPS Pin Runtime documentation and corrects channel lifecycle validation.
channels startandchannels stopnow reject a configured channel that the sandbox agent runtime does not support.The cleanup guidance now requires snapshots and explains retained-volume risk before sandbox destruction.
Related Issue
No issue is linked to this PR.
Changes
Type of Change
Quality Gates
d6b5c3bbe66f71364a2be1575e04d420629b2d41against mainfdd68285e2c3e9f7c09ac63029236e108d02d9d1passed all nine categories. No security, correctness, or product-scope findings remain.Documentation Writer Review
docs-updatedd6b5c3bbe66f71364a2be1575e04d420629b2d41against mainfdd68285e2c3e9f7c09ac63029236e108d02d9d1. Claims match the implementation, manifests, lifecycle code, and agent-gate tests. Agent variants, cleanup warnings, terminology, and test titles follow repository guidance. The repaired snapshot link matches the nested published route indocs/index.yml. The cleanup guidance uses the shared command placeholder, requires every gateway-port environment to be removed, and requires the credential-bearing adapter process and listener to be gone before declaring in-memory credentials purged. The final merge preserves the concurrent contributor refresh without changing file content. No standalone suites or GitHub writes were performed during this review.DGX Station Hardware Evidence
scripts/prepare-dgx-station-host.sh.Verification
Signed-off-by:line and every commit appears asVerifiedin GitHub — DCO declarations are included for Miyoung Choi, Senthil Ravichandran, and Carlos Villela. The concurrent contributor refresh is preserved in history. GitHub marks all 23 PR commits asVerified.pre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailable — Applicable pre-commit and commit-msg hooks passed for both documentation repairs. Commit-msg and generated-output freshness hooks passed for all four main refreshes. Commit6fb65bda9used--no-verifyafter the linked worktree could not resolveCOMMIT_EDITMSG. A normal pre-push attempt stopped because the linked worktree lacked compiled CLI and plugin artifacts. The fast-forward push then used--no-verifywith this limitation recorded. Required GitHub checks must pass before merge.d6b5c3bbe66f71364a2be1575e04d420629b2d41must pass after publication.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — Not run locally. Required GitHub checks for commitd6b5c3bbe66f71364a2be1575e04d420629b2d41must pass after publication.npm run docsbuilds without warnings (doc changes only) — Not run locally. The required GitHub documentation check for commitd6b5c3bbe66f71364a2be1575e04d420629b2d41must pass after publication.Signed-off-by: Miyoung Choi miyoungc@nvidia.com
Signed-off-by: Senthil Ravichandran senthilr@nvidia.com
Signed-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit