fix(e2e): preserve OpenClaw shim authority - #9258
Merged
Merged
Conversation
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
Included review availability: Your plan includes up to 12 reviews per rolling hour; 10 remain after this review. 📝 WalkthroughWalkthroughThe launch shim now uses namespaced control variables and removes them before invoking OpenShell. E2E fixtures filter inherited environments, use fixture-specific PTY identifiers, record forwarded authority names, and assert that launch authority variables are not forwarded. ChangesLaunch authority isolation
Estimated code review effort: 2 (Simple) | ~15 minutes Merge Risk: ⚪ Minimal · up to This change preserves launch authority across the E2E subprocess boundary while removing it before the real OpenShell process runs. The reported targeted and repository checks pass, so no actionable merge-blocking risk remains. Sequence Diagram(s)sequenceDiagram
participant LaunchScript
participant LaunchShim
participant OpenShell
LaunchScript->>LaunchShim: pass OPENSHELL_NEMOCLAW_LAUNCH_* variables
LaunchShim->>LaunchShim: remove recognized private launch variables
LaunchShim->>OpenShell: spawn with filtered environment
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 183035b in the TypeScript / code-coverage/cliThe overall coverage in commit 183035b in the Show a code coverage summary of the most impacted files.
Updated |
Contributor
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
2 terminology differences from the second opinionAdvisory only. These are normalized differences from the primary terminology receipt.
2 additional E2E selections from the second opinionAdvisory only. The primary lane did not select these E2E jobs or targets.
Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests. 2 semantic terminology decisionsTerminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.
E2E guidanceAdvisory only. A maintainer can dispatch the default E2E suite for the commit under review. Recommended E2E: None Manual-only E2E: This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
senthilr-nv
marked this pull request as ready for review
August 16, 2026 21:16
prekshivyas
approved these changes
Aug 16, 2026
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
23 tasks
Collaborator
Author
|
Exact latest-head security follow-up for The shim removes only its current captured list before Please capture the required command values first, then strip exact |
23 tasks
24 tasks
23 tasks
cv
pushed a commit
that referenced
this pull request
Aug 17, 2026
<!-- markdownlint-disable MD041 --> ## Summary Repairs four exact lifecycle/convergence regressions behind five genuine failures in full main E2E run [31971397245](https://github.com/NVIDIA/NemoClaw/actions/runs/31971397245) at `03fdc7b0734d7f1f5d347b05d3a378a74d367da0`. The fixes preserve exact platform provenance, make the Docker replacement start the final lifecycle event, bound inference API-family cutover retries, and prove owner-qualified cleanup before the protected harness deletes a retained runtime. The two OpenClaw PTY failures were intentionally excluded from this PR and are now resolved on `main` by merged [#9258](#9258). This branch integrates that commit through `main` without carrying a PTY-path diff. Credential/configuration failures and the downstream aggregate failure are also excluded. ## Changes - Preserve a locally proven, same-repository platform digest when the first multi-architecture inspect reports the manifest-list digest but the later full inspect exposes one local platform RepoDigest. A regression test covers the exact DCode ordering from [job 95224452189](https://github.com/NVIDIA/NemoClaw/actions/runs/31971397245/job/95224452189). - Finalize Docker GPU replacement as stop replacement → remove backup → start replacement → fresh supervisor-readiness check. This makes the replacement start the final Docker lifecycle event and fixes the shared root behind [onboarding job 95224452811](https://github.com/NVIDIA/NemoClaw/actions/runs/31971397245/job/95224452811) and [Model Router job 95224452986](https://github.com/NVIDIA/NemoClaw/actions/runs/31971397245/job/95224452986). Partial stop/remove/start states remain fail closed. An already-finalized helper outcome is accepted after the earlier reconnect proof, while an explicit replacement restart failure remains fatal. - Resolve the previous inference API family before mutation. Only when the family changes, retry HTTP 400/404 route-convergence responses after one and two seconds, for three total bounded requests; all other failures retain the existing rollback path. This fixes [job 95224452700](https://github.com/NVIDIA/NemoClaw/actions/runs/31971397245/job/95224452700) without increasing probe timeouts or retrying authentication/5xx failures. Exhaustion coverage proves prior-route restoration, exact deletion of the newly created provider, and no registry/config persistence. - Correct the protected managed-image rollback proof for [job 95226998860](https://github.com/NVIDIA/NemoClaw/actions/runs/31971397245/job/95226998860): require the exact owner-cleanup error, durable sandbox identity, exact retained runtime, and stopped/unpaused/non-restarting state before harness-owned deletion, then prove zero container, network, and state orphans. OpenShell list validation now parses stdout and matches the exact sandbox-name field, rejecting containing names and stderr-only mentions. - Stabilize the CLI coverage merge without weakening its ratchet: keep the no-follow failure proof in the credential filter's owning test file so one shard reports both normal and fail-closed paths instead of competing instrumented module maps. The production credential filter is unchanged and remains above its existing 80% statements, 65% branches, and 80% lines thresholds. - Document the observable inference retry contract and the destructive Docker handoff boundary. - Do not change growth budgets, coverage thresholds, test-size limits, timeouts, security controls, or PTY files in the PR diff. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent nine-category review passed exact commit `637f52fa0e` with no findings or blockers. It verified unchanged fail-closed credential behavior, bounded retries and rollback, fail-closed Docker partial states, immutable digest provenance, exact cleanup ownership/name parsing, and no weakened guard, timeout, threshold, policy, or security boundary. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/inference/switch-providers.mdx`; `docs/reference/commands.mdx` - Agent: Codex Desktop <!-- docs-review-head-sha: 637f52f --> <!-- docs-review-agents-blob-sha: e30afb2 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: 65/65 focused CLI regression tests, 36/36 protected-runtime contract tests, 32/32 credential-filter tests, and 34/34 compatible-provider tests passed. Credential-filter coverage is 84% statements, 82.25% branches, 100% functions, and 90.36% lines against unchanged 80/65/80 thresholds. The merged #9258 PTY support suite passes 8/8 applicable tests locally with 20 Linux-only tests skipped. The independent security review additionally passed 268 focused/adjacent tests and 129 semantic E2E phase tests on the byte-identical reviewed tree. - [x] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: GitHub Linux PR CI run 31980074939 passed all 12 CLI shards, aggregate coverage, static checks, build/typecheck, installer integration, plugin coverage, reviewed audits, and required aggregate checks. Managed-images run 31980075046 passed DCode staging QA, Pi candidate builds, Hermes/Deep Agents Code/OpenClaw direct startup, and exact all-agent managed runtime activation. Earlier local macOS all-project attempts encountered unrelated #9189 fixture timing limits; affected-path suites and repository gates passed. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — result: 0 errors and 2 pre-existing Fern warnings; all generated variants and routes are synchronized. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Additional exact-commit validation at `637f52fa0e`: - `npm run validate:pr`: passed. - `npm run lint`: passed; 0 architecture cycles and fan-in/fan-out budgets preserved. - `npm run test-loops:scan -- --top 20`: passed. - `npm run test-conditionals:scan -- --top 25`: passed without adding a conditional. - `npm run test-size:check`: passed for 2,421 files. - `npm run typecheck:cli`: passed. - `npm run docs`: passed with 0 errors and 2 pre-existing Fern warnings. - `git diff --check`: passed. - Full diff: 17 files, 760 insertions, 131 deletions. - Independent documentation review: passed at `637f52fa0e`. - Independent nine-category security review: passed at `637f52fa0e` with no findings. --- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Reliability** - Provider switches now validate target routes before saving, retry eligible compatibility failures, and restore the previous route if validation fails. - GPU runtime replacement now completes a safer final handoff, preserving the backup until the replacement is confirmed ready. - Base image resolution more accurately preserves platform-specific digest information. - **Security** - Credential sanitizers fail safely when required file protections are unavailable, without modifying source files. - **Cleanup** - Failed managed runtime operations retain only expected stopped resources until cleanup completes, improving rollback verification. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The protected OpenClaw launch shim previously expected private
NEMOCLAW_LAUNCH_*authority after the CLI subprocess filter had removed it, so the current-main security-posture E2E stopped withopenshell_shim_authority_invalidbefore it could publish the PTY record. This change carries the six fixture-only values through the existingOPENSHELL_*subprocess boundary. The shim removes both the sourceNEMOCLAW_*names and their aliases before each call to the pinned real OpenShell binary.Related Issue
Relates #9200.
Source evidence: E2E run
31969859118, job95220668388, artifact9269583761(e2e-security-posture-openclaw), digestsha256:8cccd5b85af7614c68228df3a37153c1271deb6ac4f8967c4ae8cdd01d797161.Changes
OPENSHELL_*allowlisted prefix.NEMOCLAW_*names and the aliases before pass-through and intercepted calls reach the pinned OpenShell binary.Type of Change
Quality Gates
eb433efe26a13f62673cd074dca03449edba1f29. Commitd1d5df49bb4a75d3b38450b819f71129d1e59eearemoves both naming schemes, and focused negative evidence covers filtered and inherited subprocess environments.Documentation Writer Review
no-docs-neededtest/e2e/live/launch-agent-turn.tsandtest/e2e/support/launch-agent-turn.test.tschange internal OpenClaw E2E shim authority and deterministic non-leakage coverage only; no public CLI, configuration, default, supported workflow, or user-facing product behavior changes.Codex DesktopDGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailablenpx vitest run --project e2e-support test/e2e/support/launch-agent-turn.test.tspassed ond1d5df49b: 8 passed, 0 failed, and 20 intentional Linux-only skips on macOS. A direct inherited-environment probe confirmed that neither authority naming scheme reaches the real process.npm run checks:repository,npm run typecheck:cli, and direct Oxfmt checks passed ond1d5df49b. The installed pre-commit and commit-message hooks also passed; CI for this commit starts after the push.npm run docsbuilds without warnings (doc changes only)Signed-off-by: Senthil Ravichandran senthilr@nvidia.com
Summary by CodeRabbit
Bug Fixes
Tests