feat(openshell): upgrade managed runtime to v0.0.101 - #8660
Conversation
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
📝 WalkthroughWalkthroughOpenShell pins, trust metadata, manifests, compatibility references, and test fixtures were updated from v0.0.99 to v0.0.101 across production workflows, installers, runtime code, documentation, and validation tests. ChangesOpenShell v0.0.101 migration
Estimated code review effort: 2 (Simple) | ~15 minutes Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
|
🌿 Preview your docs: https://nvidia-preview-pr-8660.docs.buildwithfern.com/nemoclaw |
|
Exact-head E2E is running for candidate The trusted controller validated the PR head, packaged the exact-commit CLI, and launched the matrix. One early failure is classified as a workflow/candidate version mismatch, not an upgrade regression: trusted workflow Other lanes remain in progress. The PR-triggered rootless Podman check installed the pinned v0.0.101 runtime successfully and is exercising the lifecycle now. No later candidate push has invalidated this run. |
|
E2E follow-up: the full run above was canceled after the trusted-workflow audit confirmed that its main-sourced OpenShell and MCP pins make it unusable as v0.0.101 qualification evidence. Focused replacements are running:
The repository currently has no supported pre-merge focused Hermes MCP dispatch that can use this PR's updated static workflow pins. That controller skew is recorded as an infrastructure limitation, not treated as an OpenShell upgrade blocker; the candidate's Hermes MCP regression suites passed locally and its PR-triggered Hermes managed-startup check is green. |
PR Review Advisor — InformationalAdvisor assessment: Informational / low confidence Model lanes
Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests. E2E guidanceAdvisory only. A maintainer can dispatch the default E2E suite against this exact revision. Recommended E2E: This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/security/openshell-0.0.72-compatibility-review.mdx`:
- Line 38: Align OpenShell release references across all affected sites: in
docs/security/openshell-0.0.72-compatibility-review.mdx:38, keep the historical
0.0.72 evidence separate and update current compatibility guidance to reference
the reviewed release whose title, evidence, tests, and runtime version match;
update the corresponding OpenShell references in
docs/reference/commands.mdx:4399, docs/reference/troubleshooting.mdx:349, and
docs/security/gateway-authentication-controls.mdx:56 to use the matching review
and release identity while preserving the valid published route.
In `@scripts/install-openshell.sh`:
- Around line 40-49: The stable preflight must handle an existing OpenShell
0.0.99 installation before applying the MIN_VERSION gate. Update the
version-check flow in scripts/install-openshell.sh so 0.0.99 reaches
openshell_has_required_messaging_features and pinned_sandbox_build_version()
rather than the below-minimum upgrade branch, while preserving normal
minimum-version behavior; add a regression test covering an existing 0.0.99
installation.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1be47261-eee9-479e-a98f-e5a43daa61c5
📒 Files selected for processing (74)
.github/workflows/e2e.yaml.github/workflows/podman-cpu-proof.yamlagents/hermes/Dockerfileagents/hermes/mcp-config-transaction.pyagents/hermes/runtime-config-guard.pyagents/hermes/start.shdocs/deployment/set-up-mcp-bridge.mdxdocs/manage-sandboxes/add-mcp-server.mdxdocs/manage-sandboxes/update-sandboxes.mdxdocs/reference/commands.mdxdocs/reference/configure-runtime-identity.mdxdocs/reference/troubleshooting.mdxdocs/security/best-practices.mdxdocs/security/gateway-authentication-controls.mdxdocs/security/openshell-0.0.72-compatibility-review.mdxnemoclaw-blueprint/blueprint.yamlnemoclaw/src/shared/openshell-policy-boundary.ctsscripts/brev-launchable-ci-cpu.shscripts/checks/managed-image-protected-runtime-contract.tsscripts/install-openshell.shscripts/install.shscripts/update-hermes-agent.shsrc/lib/actions/sandbox/mcp-bridge-input-validation.test.tssrc/lib/actions/sandbox/mcp-bridge-url-validation.tssrc/lib/actions/sandbox/mcp-bridge-validation.tssrc/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.101.jsonsrc/lib/onboard/docker-driver-gateway-runtime.test.tssrc/lib/onboard/docker-driver-gateway-runtime.tssrc/lib/onboard/experimental/portable-demo-lifecycle.tssrc/lib/onboard/forward-start.tssrc/lib/onboard/managed-bootstrap/podman-held-workload.test.tssrc/lib/onboard/managed-bootstrap/podman-held-workload.tssrc/lib/onboard/openshell-feature-gate.test.tssrc/lib/onboard/openshell-feature-gate.tssrc/lib/onboard/openshell-install.test.tssrc/lib/onboard/openshell-install.tssrc/lib/onboard/openshell-version.tssrc/lib/onboard/runtime-provider/podman-lifecycle.tssrc/lib/policy/index.tstest/brev-launchable-ci-cpu-checksum.test.tstest/deepagents-mcp-legacy-lifecycle.test.tstest/e2e/live/mcp-bridge-sandbox.tstest/e2e/live/network-policy.test.tstest/e2e/live/openclaw-plugin-runtime-exdev.test.tstest/e2e/live/openshell-gateway-auth-source-contract-helpers.tstest/e2e/live/openshell-gateway-auth-source-contract.test.tstest/e2e/live/openshell-gateway-upgrade.test.tstest/e2e/live/podman-cpu-lifecycle-helpers.tstest/e2e/live/podman-cpu-lifecycle.test.tstest/e2e/support/mcp-bridge-sandbox.test.tstest/e2e/support/podman-cpu-proof-workflow.test.tstest/fixtures/openshell-v0.0.101test/hermes-doctor-config-hash.test.tstest/hermes-final-image-layout.test.tstest/hermes-mcp-config-transaction.test.tstest/hermes-mcp-credential-boundary-manifest.test.tstest/install-openshell-version-check.test.tstest/install-openshell-version-pin.test.tstest/installer-sandbox-build-trust.test.tstest/mcp-add-crash-consistency.test.tstest/mcp-destroy-lifecycle.test.tstest/mcp-openshell-workflow.test.tstest/mcp-policy-key-ownership.test.tstest/mcp-restart-policy-order.test.tstest/openshell-0.0.101-migration-review.test.tstest/openshell-0.0.85-migration-review.test.tstest/openshell-channel-workflow.test.tstest/openshell-e2e-qualification.test.tstest/pr-risk-plan.test.tstest/runner.test.tstest/sandbox-provisioning.test.tstest/sandbox-rlimit-hooks.test.tstest/update-hermes-agent-script.test.tstools/e2e/mcp-workflow-boundary.mts
Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
|
Exact-head validation refreshed after focused follow-up commit Local follow-up evidence is green: 131/131 workflow-boundary tests, 4/4 installer-pin tests including a full Fresh runs: The prior |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
test/install-openshell-version-pin.test.ts (1)
339-339: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick winAssert the pinned tag for every downloaded component.
At Line [362], the test checks only that
v0.0.101appears somewhere indownloads. It does not reject another tag for the gateway or sandbox. In the0.0.102case, a0.0.99or0.0.100request can pass because Line [366] excludes onlyv0.0.102. The fake tar setup at Line [339] writes0.0.101for every archive, so the final replacement check cannot detect a mixed download set. Assert that every logged asset request usesv0.0.101and verify all three installed components.As per path instructions, review tests for behavioral confidence rather than implementation lock-in. Based on the PR objective, every production consumer must select the same trusted release.
Also applies to: 354-388, 397-421
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/install-openshell-version-pin.test.ts` at line 339, Strengthen the version-pin assertions in the test cases around the fake tar setup and download checks so every logged asset request uses v0.0.101, rather than merely checking that the tag appears and v0.0.102 is absent. Verify all three installed components—CLI, gateway, and sandbox—select the same trusted release, while keeping the assertions focused on observable download and installation behavior.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@test/install-openshell-version-pin.test.ts`:
- Line 339: Strengthen the version-pin assertions in the test cases around the
fake tar setup and download checks so every logged asset request uses v0.0.101,
rather than merely checking that the tag appears and v0.0.102 is absent. Verify
all three installed components—CLI, gateway, and sandbox—select the same trusted
release, while keeping the assertions focused on observable download and
installation behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a1d140b1-c366-4a71-85ad-0eee7f482a79
📒 Files selected for processing (10)
ci/platform-matrix.jsondocs/reference/platform-support.mdxtest/exit-code-user-error-surfaces.test.tstest/install-openshell-version-pin.test.tstest/onboard-gateway-port-conflict-fast-fail.test.tstest/rebuild-credential-preflight.test.tstest/rebuild-shields-auto-unlock.test.tstest/rebuild-stale-recovery.test.tstest/repro-2201.test.tstools/e2e/cli-artifact-workflow-boundary.mts
2 participants
Summary
Upgrade NemoClaw's managed OpenShell runtime from v0.0.99 to the reviewed v0.0.101 release identities, including the Hermes MCP compatibility path. Preserve only the v0.0.99 sandbox fallback needed to migrate existing installations, and add focused regression coverage and user documentation for the changed behavior.
Related Issue
Closes #8606
Changes
Type of Change
Quality Gates
Documentation Writer Review
docs-updateddocs/deployment/set-up-mcp-bridge.mdx,docs/manage-sandboxes/add-mcp-server.mdx,docs/manage-sandboxes/update-sandboxes.mdx,docs/reference/commands.mdx,docs/reference/configure-runtime-identity.mdx,docs/reference/platform-support.mdx,docs/reference/troubleshooting.mdx,docs/security/best-practices.mdx,docs/security/gateway-authentication-controls.mdx, anddocs/security/openshell-0.0.72-compatibility-review.mdxDGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailableFS_IOC_GETFLAGSpermission failures outside the changed behavior.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result:npm run checks:repository,npm run typecheck:cli, pluginnpm run typecheck, repository project/title/source-shape checks, live installer hash verification, and changed-file Biome checks passed.npm run docsbuilds without warnings (doc changes only)Signed-off-by: Apurv Kumaria akumaria@nvidia.com
Summary by CodeRabbit
Release Update
Documentation
Tests