chore: refresh dependency locks#112
Conversation
Signed-off-by: Will Killian <wkillian@nvidia.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThis PR installs Rustls crypto providers explicitly before HTTPS calls, adjusts Cargo features to add optional ChangesOpenClaw version compatibility update
Possibly related PRs
🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
github-actions
Bot
added
size:XXL
willkill07
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/core/src/observability/openinference.rs`:
- Around line 380-381: You added install_rustls_crypto_provider() in the HTTP
binary transport path (observability/openinference.rs); before merging, run the
required Rust validation and formatting: execute just test-rust, cargo fmt
--all, and cargo clippy --workspace --all-targets -- -D warnings and fix any
failures or lint warnings around install_rustls_crypto_provider() usage, then
run the full cross-language validation matrix (Rust, Python, Go, Node.js, and
WebAssembly) for changes under crates/core/**/*.rs and attach the
outputs/screenshots/logs of those test/format/lint runs and matrix results to
the PR.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 2f4cf156-c6e0-4885-ab82-9f125530e45e
⛔ Files ignored due to path filters (3)
Cargo.lockis excluded by!**/*.lockpackage-lock.jsonis excluded by!**/package-lock.jsonuv.lockis excluded by!**/*.lock
📒 Files selected for processing (15)
ATTRIBUTIONS-Node.mdATTRIBUTIONS-Python.mdcrates/cli/Cargo.tomlcrates/cli/src/doctor.rscrates/cli/src/installer.rscrates/cli/src/launcher.rscrates/cli/src/main.rscrates/cli/src/server.rscrates/cli/src/tls.rscrates/core/Cargo.tomlcrates/core/src/observability/openinference.rscrates/core/src/observability/otel.rsintegrations/openclaw/package.jsonintegrations/openclaw/src/openclaw-hook-types.tspyproject.toml
📜 Review details
🧰 Additional context used
📓 Path-based instructions (32)
**/*.rs
📄 CodeRabbit inference engine (.agents/skills/test-ffi-surface/SKILL.md)
**/*.rs: Runcargo fmt --allfor FFI work as it is Rust work
Runjust test-rustfor FFI validation
Runcargo clippy --workspace --all-targets -- -D warningsto enforce warnings-as-errors linting
**/*.rs: Runcargo fmt --allfor Rust code formatting
Runcargo clippy --workspace --all-targets -- -D warningsto enforce Rust linting with no warnings
Runjust test-rustas the shared-runtime build/test wrapper for Rust changesUse Rust snake_case naming convention for Rust code
**/*.rs: Any Rust change must runjust test-rust
Any Rust change must runcargo fmt --all
Any Rust change must runcargo clippy --workspace --all-targets -- -D warnings
**/*.rs: Runcargo fmt --allfor Rust code formatting when Node changes touch Rust files
Runcargo clippy --workspace --all-targets -- -D warningsto enforce strict linting when Rust files changed as part of Node work
**/*.rs: Always runjust test-rustwhen any Rust code changes
Always runcargo fmt --allwhen any Rust code changes
Always runcargo clippy --workspace --all-targets -- -D warningswhen any Rust code changes
Files:
crates/cli/src/launcher.rscrates/cli/src/main.rscrates/core/src/observability/openinference.rscrates/cli/src/server.rscrates/cli/src/installer.rscrates/core/src/observability/otel.rscrates/cli/src/tls.rscrates/cli/src/doctor.rs
**/*.{rs,go,js,ts,tsx}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Include SPDX license headers in all Rust, Go, JavaScript, and TypeScript source files using C-style comment syntax
Files:
crates/cli/src/launcher.rscrates/cli/src/main.rsintegrations/openclaw/src/openclaw-hook-types.tscrates/core/src/observability/openinference.rscrates/cli/src/server.rscrates/cli/src/installer.rscrates/core/src/observability/otel.rscrates/cli/src/tls.rscrates/cli/src/doctor.rs
**/*.{rs,py,go,js,ts,tsx}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Use
SONAR_IGNORE_START/SONAR_IGNORE_ENDmarkers only for documented false positives that cannot be resolved in code; keep ignored blocks small, add explanatory comments, and require reviewer sign-off
Files:
crates/cli/src/launcher.rscrates/cli/src/main.rsintegrations/openclaw/src/openclaw-hook-types.tscrates/core/src/observability/openinference.rscrates/cli/src/server.rscrates/cli/src/installer.rscrates/core/src/observability/otel.rscrates/cli/src/tls.rscrates/cli/src/doctor.rs
**/*.{js,ts,tsx,jsx,py,rs,go,java,c,cpp,h,cc,cxx,cs,rb,php,swift,kt}
📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)
Changed files must be formatted with the language-native formatter
Files:
crates/cli/src/launcher.rscrates/cli/src/main.rsintegrations/openclaw/src/openclaw-hook-types.tscrates/core/src/observability/openinference.rscrates/cli/src/server.rscrates/cli/src/installer.rscrates/core/src/observability/otel.rscrates/cli/src/tls.rscrates/cli/src/doctor.rs
**/*.{py,js,ts,tsx,go,rs,md}
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
Format changed files with the language-native formatter before the final lint/test pass
Files:
crates/cli/src/launcher.rscrates/cli/src/main.rsintegrations/openclaw/src/openclaw-hook-types.tscrates/core/src/observability/openinference.rscrates/cli/src/server.rscrates/cli/src/installer.rscrates/core/src/observability/otel.rscrates/cli/src/tls.rscrates/cli/src/doctor.rsATTRIBUTIONS-Python.md
**/*.{rs,py,js,ts,tsx,go}
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
During iteration, prefer
uv run pre-commit run --files <changed files...>for targeted validation
Files:
crates/cli/src/launcher.rscrates/cli/src/main.rsintegrations/openclaw/src/openclaw-hook-types.tscrates/core/src/observability/openinference.rscrates/cli/src/server.rscrates/cli/src/installer.rscrates/core/src/observability/otel.rscrates/cli/src/tls.rscrates/cli/src/doctor.rs
**/*.{js,ts,tsx}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Use camelCase naming convention for Node.js code
Files:
integrations/openclaw/src/openclaw-hook-types.ts
**/*.{md,markdown,py,sh,bash,js,ts,java,cpp,go,rust}
📄 CodeRabbit inference engine (.agents/skills/contribute-docs/SKILL.md)
Keep package names, repo references, and build commands current in documentation
Files:
integrations/openclaw/src/openclaw-hook-types.tsATTRIBUTIONS-Python.md
**/*.{md,markdown,py,sh,bash,js,ts,example}
📄 CodeRabbit inference engine (.agents/skills/contribute-docs/SKILL.md)
Example commands must match current package names and paths
Files:
integrations/openclaw/src/openclaw-hook-types.tsATTRIBUTIONS-Python.md
**/{integrations,integration,*-integration}/**
📄 CodeRabbit inference engine (.agents/skills/contribute-integration/SKILL.md)
**/{integrations,integration,*-integration}/**: Keep NeMo Flow optional in framework integrations
Preserve the framework's original behavior when NeMo Flow is absent
Wrap tool and LLM paths at the correct framework boundary
Integration pattern must followdocs/integrate-frameworks/adding-scopes.md
Files:
integrations/openclaw/src/openclaw-hook-types.tsintegrations/openclaw/package.json
{crates/adaptive/**,python/nemo_flow/{adaptive,plugin}.py,go/nemo_flow/{adaptive,**}/*.go,**/*.{ts,js,wasm}}
📄 CodeRabbit inference engine (.agents/skills/maintain-optimizer/SKILL.md)
Keep adaptive config schema, plugin lifecycle, and bindings in sync across crates/adaptive, core, bindings, Python (python/nemo_flow/adaptive.py and python/nemo_flow/plugin.py), Go (go/nemo_flow/adaptive and go/nemo_flow), and Node/WebAssembly helpers
Files:
integrations/openclaw/src/openclaw-hook-types.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
If Node.js language surface changed, always run Node.js test target even when Rust core did not change
Files:
integrations/openclaw/src/openclaw-hook-types.ts
integrations/openclaw/package.json
📄 CodeRabbit inference engine (.agents/skills/update-project-version/SKILL.md)
Keep
integrations/openclaw/package.jsonversion aligned with the workspace-rootpackage-lock.jsonunderpackages["integrations/openclaw"].version
Files:
integrations/openclaw/package.json
crates/core/src/observability/{atif,otel,openinference}.rs
📄 CodeRabbit inference engine (.agents/skills/maintain-observability/SKILL.md)
crates/core/src/observability/{atif,otel,openinference}.rs: When changing event fields, exporter behavior, subscriber config, or binding parity for ATIF, OpenTelemetry, or OpenInference, ensure the core event model and emitted fields remain in sync across ATIF (crates/core/src/observability/atif.rs), OpenTelemetry (crates/core/src/observability/otel.rs), and OpenInference (crates/core/src/observability/openinference.rs)
When event fields in observability exporters change, run the affected Rust crate tests plusjust test-rust
Files:
crates/core/src/observability/openinference.rscrates/core/src/observability/otel.rs
crates/{core,adaptive}/**
📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)
Changes to
crates/coreorcrates/adaptivemust run the full language matrix
Files:
crates/core/src/observability/openinference.rscrates/core/src/observability/otel.rscrates/core/Cargo.toml
{crates/core,crates/adaptive}/**/*.rs
📄 CodeRabbit inference engine (.agents/skills/test-wasm-binding/SKILL.md)
If the change touched shared runtime semantics in
crates/coreorcrates/adaptive, also usevalidate-change
Files:
crates/core/src/observability/openinference.rscrates/core/src/observability/otel.rs
crates/core/**/*.rs
📄 CodeRabbit inference engine (.agents/skills/validate-change/SKILL.md)
When
crates/corechanges, run the full validation matrix across Rust, Python, Go, Node.js, and WebAssembly
crates/core/**/*.rs: UseJson = serde_json::Valuein Rust-facing runtime APIs where the existing code expects JSON payloads.
UseResult<T>withFlowErrorin core runtime paths. Keep errors explicit and binding-appropriate at the wrapper layer.
Files:
crates/core/src/observability/openinference.rscrates/core/src/observability/otel.rs
crates/{core,adaptive}/**/*.rs
⚙️ CodeRabbit configuration file
crates/{core,adaptive}/**/*.rs: Review the Rust runtime for async correctness, scope isolation, middleware ordering, and event lifecycle regressions.
Pay close attention to task-local/thread-local scope propagation, callback lifetimes, stream finalization, and root_uuid isolation.
Public API changes should preserve existing behavior unless tests and docs show the intended migration path.
Files:
crates/core/src/observability/openinference.rscrates/core/src/observability/otel.rs
**/*.toml
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Include SPDX license headers in TOML files using TOML comment syntax
Files:
pyproject.tomlcrates/cli/Cargo.tomlcrates/core/Cargo.toml
{Cargo.toml,setup.py,setup.cfg,pyproject.toml,go.mod,go.sum,package.json,package-lock.json,yarn.lock,pom.xml,*.gradle}
📄 CodeRabbit inference engine (.agents/skills/rename-surfaces/SKILL.md)
Update repository manifest files (Cargo.toml, setup.py, go.mod, package.json, etc.) with new package/crate names during rename operations
Files:
pyproject.toml
{Cargo.toml,pyproject.toml,go/nemo_flow/go.mod,package.json,package-lock.json,crates/node/package.json}
📄 CodeRabbit inference engine (.agents/skills/maintain-packaging/SKILL.md)
Maintain consistent package names, import paths, and module names across Rust, Python, Go, Node, and WebAssembly workspaces in NeMo Flow
Files:
pyproject.toml
**/Cargo.{toml,lock}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Run
cargo deny checkfor Rust dependency auditing as configured indeny.toml
Files:
crates/cli/Cargo.tomlcrates/core/Cargo.toml
**/Cargo.toml
📄 CodeRabbit inference engine (.agents/skills/prepare-code-freeze/SKILL.md)
Confirm or infer the target release version from
upstream/main:Cargo.toml. Derive the release branch asrelease/<major>.<minor>
Files:
crates/cli/Cargo.tomlcrates/core/Cargo.toml
**/*.{md,rst,html,txt}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-brand-terminology.md)
**/*.{md,rst,html,txt}: Always spellNVIDIAin all caps. Do not useNvidia,nvidia,nVidia,nVIDIA, orNV.
Usean NVIDIAbefore a noun because the name starts with an 'en' sound.
Do not add a registered trademark symbol afterNVIDIAwhen referring to the company.
Use trademark symbols with product names only when the document type or legal guidance requires them.
Verify official capitalization, spacing, and hyphenation for product names.
Precede NVIDIA product names withNVIDIAon first mention when it is natural and accurate.
Do not rewrite product names for grammar or title-case rules.
Preserve third-party product names according to the owner's spelling.
Include the company name and full model qualifier on first use when it helps identify the model.
Preserve the official capitalization and punctuation of model names.
Use shorter family names only after the full name is established.
Spell out a term on first use and put the acronym in parentheses unless the acronym is widely understood by the intended audience.
Use the acronym on later mentions after it has been defined.
For long documents, reintroduce the full term if readers might lose context.
Form plurals of acronyms withs, not an apostrophe, such asGPUs.
In headings, common acronyms can remain abbreviated. Spell out the term in the first or second sentence of the body.
Common terms such asCPU,GPU,PC,API, andUIusually do not need to be spelled out for developer audiences.
Files:
ATTRIBUTIONS-Python.md
**/*.{md,rst,html}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-brand-terminology.md)
Link the first mention of a product name when the destination helps the reader.
Files:
ATTRIBUTIONS-Python.md
**/*.{md,rst,txt}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-guide.md)
**/*.{md,rst,txt}: SpellNVIDIAin all caps. Do not useNvidia,nvidia, orNV.
Format commands, code elements, expressions, package names, file names, and paths as inline code.
Use descriptive link text. Avoid raw URLs and weak anchors such as 'here' or 'read more.'
Use title case consistently for technical documentation headings.
Introduce code blocks, lists, tables, and images with complete sentences.
Write procedures as imperative steps. Keep steps parallel and split long procedures into smaller tasks.
Prefer active voice, present tense, short sentences, contractions, and plain English.
Usecanfor possibility and reservemayfor permission.
Useafterfor temporal relationships instead ofonce.
Preferrefer tooverseewhen the wording points readers to another resource.
Avoid culture-specific idioms, unnecessary Latinisms, jokes, and marketing exaggeration in technical documentation.
Spell out months in body text, avoid ordinal dates, and use clear time zones.
Spell out whole numbers from zero through nine unless they are technical values, parameters, versions, or UI values.
Use numerals for 10 or greater and include commas in thousands.
Do not add trademark symbols to learning-oriented documentation unless the source, platform, or legal guidance explicitly requires them.
Do not add trademark symbols to NeMo Flow learning documentation by default.
Do not rewrite API names, package names, command flags, or code literals for style reasons.
Files:
ATTRIBUTIONS-Python.md
**/*.{md,markdown,rst}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/assets/nvidia-style-technical-docs.md)
**/*.{md,markdown,rst}: Use title case consistently in technical documentation headings
Avoid quotation marks, ampersands, and exclamation marks in headings
Keep product, event, research, and whitepaper names in their official title case
Use title case for table headers
Do not force social-media sentence case into technical docs
Use monospace formatting for code elements, commands, parameters, package names, and expressions
Use monospace formatting for directories, file names, and paths
Use angle brackets inside monospace for variables inside paths, such as/home/<username>/.login
Use quotation marks for error messages and strings in documentation
Use bold formatting for UI buttons, menus, fields, and labels in documentation
Use angle brackets between UI labels for menu paths, such as File > Save As
Use italics for new terms on first use in documentation
Use italics for publication titles in documentation
Use plain text formatting for keyboard shortcuts in documentation
Prefer[NVIDIA/NeMo](link)format for GitHub repository references over generic phrases like 'the GitHub repo'
Introduce every code block with a complete sentence
Do not make a code block complete the grammar of the previous sentence
Do not continue a sentence after a code block
Use syntax highlighting when the format supports it for code blocks
Avoid the word 'snippet' unless the surrounding docs already use it as a term of art
Keep inline method, function, and class references consistent with nearby docs, omitting empty parentheses for prose readability when no call is shown
Use descriptive anchor text that matches the destination title when possible for links
Avoid raw URLs in running text in documentation
Avoid generic link anchors such as 'here,' 'this page,' and 'read more' in documentation
Include the acronym in link text if a linked term includes an acronym
Do not link long sentences or multiple sentences in documentation
Avoid links that pull readers away from a procedure unles...
Files:
ATTRIBUTIONS-Python.md
**/*.{html,md}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Include SPDX license headers in HTML and Markdown files using HTML comment syntax
Files:
ATTRIBUTIONS-Python.md
**/*.md
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Run Markdown link checking via
lycheeforREADME.md,CONTRIBUTING.md, anddocs/through pre-commit hooks
Files:
ATTRIBUTIONS-Python.md
**/*.{md,markdown,py,sh,bash}
📄 CodeRabbit inference engine (.agents/skills/contribute-docs/SKILL.md)
Keep stable user-facing wrappers at scripts/ root in docs and examples; only point at namespaced helper paths when documenting internal maintenance work
Files:
ATTRIBUTIONS-Python.md
{README*,CHANGELOG*,docs/**/*.{md,rst,txt},examples/**/*,*.md}
📄 CodeRabbit inference engine (.agents/skills/rename-surfaces/SKILL.md)
Update documentation, examples, and getting-started guides with new package/module/crate names after rename operations
Files:
ATTRIBUTIONS-Python.md
**/*.{md,txt,rst}
📄 CodeRabbit inference engine (.agents/skills/review-doc-style/SKILL.md)
**/*.{md,txt,rst}: Ensure commands, package names, file paths, and APIs in documentation are correct and not stale; flag incorrect or outdated information as blocking issues
Ensure examples and procedures in documentation will execute successfully with current APIs and commands
Use consistent user-facing terminology throughout documentation that matches current repo terminology
Capitalize NVIDIA correctly in all documentation and public-facing text
Format code, commands, paths, and filenames as inline code (monospace) in documentation
Use descriptive anchor text for links instead of bare URLs or weak labels like 'here' in documentation
Prefer active voice, present tense, short sentences, and plain English in documentation
Structure documentation procedures as imperative steps that are easy to scan and not too long for a single sequence
Prefer 'after' instead of 'once' for temporal references in documentation
Use 'can' instead of 'may' when describing possibility (rather than permission) in documentation
Avoid ambiguous numeric dates and ordinal dates in documentation body text
Files:
ATTRIBUTIONS-Python.md
🧠 Learnings (1)
📚 Learning: 2026-05-07T18:04:44.387Z
Learnt from: mnajafian-nv
Repo: NVIDIA/NeMo-Flow PR: 67
File: integrations/openclaw/src/modules.ts:1-2
Timestamp: 2026-05-07T18:04:44.387Z
Learning: In NVIDIA/NeMo-Flow, TypeScript source files should use `//` line comments for SPDX headers (e.g., `// SPDX-FileCopyrightText: ...` and `// SPDX-License-Identifier: ...`) rather than C-style block comments (`/* ... */`). The repo’s copyright checker enforces this mapping, so `//` SPDX headers in `.ts` files should not be flagged as a style violation.
Applied to files:
integrations/openclaw/src/openclaw-hook-types.ts
🔇 Additional comments (14)
pyproject.toml (1)
78-78: LGTM!Also applies to: 84-84
ATTRIBUTIONS-Python.md (1)
3009-3009: LGTM!Also applies to: 3039-3039, 3109-3109, 3139-3139, 3169-3169, 8048-8048
integrations/openclaw/package.json (1)
40-41: LGTM!Also applies to: 44-45, 58-58
integrations/openclaw/src/openclaw-hook-types.ts (1)
7-7: LGTM!Also applies to: 112-112
crates/cli/src/main.rs (1)
20-20: LGTM!crates/cli/src/tls.rs (1)
1-6: LGTM!crates/cli/Cargo.toml (1)
31-32: LGTM!crates/core/Cargo.toml (1)
27-28: LGTM!Also applies to: 43-44, 111-113
crates/cli/src/server.rs (1)
108-108: LGTM!crates/cli/src/launcher.rs (1)
699-699: LGTM!crates/cli/src/installer.rs (1)
133-133: LGTM!crates/cli/src/doctor.rs (1)
654-654: LGTM!crates/core/src/observability/openinference.rs (1)
463-466: LGTM!crates/core/src/observability/otel.rs (1)
378-379: LGTM!Also applies to: 460-463
Signed-off-by: Will Killian <wkillian@nvidia.com>
Signed-off-by: Will Killian <wkillian@nvidia.com>
Signed-off-by: Will Killian <wkillian@nvidia.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/core/Cargo.toml`:
- Around line 111-113: The Cargo.toml dependency changes (opentelemetry-otlp,
reqwest, rustls) require running the repository's dependency audit; run `cargo
deny check` locally to surface any policy violations from deny.toml, then fix
issues by updating the crate versions, features, or adding approved exceptions
per deny.toml (or removing/rewiring the optional dependencies) until `cargo deny
check` passes; re-run the check and include the passing output in the PR.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: 9a256885-6d0b-4053-a682-97f668e6dc98
📒 Files selected for processing (1)
crates/core/Cargo.toml
📜 Review details
🧰 Additional context used
📓 Path-based instructions (4)
**/Cargo.{toml,lock}
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Run
cargo deny checkfor Rust dependency auditing as configured indeny.toml
Files:
crates/core/Cargo.toml
**/*.toml
📄 CodeRabbit inference engine (CONTRIBUTING.md)
Include SPDX license headers in TOML files using TOML comment syntax
Files:
crates/core/Cargo.toml
crates/{core,adaptive}/**
📄 CodeRabbit inference engine (.agents/skills/prepare-pr/SKILL.md)
Changes to
crates/coreorcrates/adaptivemust run the full language matrix
Files:
crates/core/Cargo.toml
**/Cargo.toml
📄 CodeRabbit inference engine (.agents/skills/prepare-code-freeze/SKILL.md)
Confirm or infer the target release version from
upstream/main:Cargo.toml. Derive the release branch asrelease/<major>.<minor>
Files:
crates/core/Cargo.toml
🔇 Additional comments (2)
crates/core/Cargo.toml (2)
27-28: Attach explicit full language matrix evidence for thiscrates/corechange.Please include CI run links/job IDs showing the full matrix passed for this PR.
As per coding guidelines,
crates/{core,adaptive}/**: Changes tocrates/coreorcrates/adaptivemust run the full language matrix.Also applies to: 43-44
6-6: Update release branch target torelease/0.3.Upstream
mainCargo.toml showsversion = "0.3.0", so the target release branch should berelease/0.3rather thanrelease/0.2.> Likely an incorrect or invalid review comment.
Signed-off-by: Will Killian <wkillian@nvidia.com>
….2' into wkk_dependency-runtime-refresh-0.2
…cy-runtime-refresh-0.2 # Conflicts: # ATTRIBUTIONS-Python.md # uv.lock
Salonijain27
left a comment
Salonijain27
left a comment
There was a problem hiding this comment.
Approved from a dependency point of view
|
/merge |
* fix: address outstanding sonar issues (#104) #### Overview Addresses the open Sonar maintainability findings reported on `release/0.2` by reducing Rust cognitive complexity and replacing duplicated Go test literals. - [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license. - [x] I searched existing issues and open pull requests, and this does not duplicate existing work. #### Details - Split observability doctor and plugin editor control-flow into smaller helper functions. - Split OpenAI Responses request encoding overlays into focused helper functions. - Added constants for duplicated Go observability test literals. #### Where should the reviewer start? Start with `crates/core/src/codec/openai_responses.rs`, then review the smaller CLI refactors in `crates/cli/src/doctor.rs` and `crates/cli/src/plugins.rs`. #### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to) - Relates to: none ## Summary by CodeRabbit * **Refactor** * Enhanced code organization in observability component checking, plugin configuration editing, and OpenAI response encoding for improved internal structure and maintainability. * **Tests** * Standardized error message formatting in observability plugin tests for improved consistency and clearer diagnostic output during test failures. [](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Flow/pull/104) Authors: - Will Killian (https://github.com/willkill07) Approvers: - Ajay Thorve (https://github.com/AjayThorve) URL: #104 * test: isolate CLI config override tests (#105) #### Overview Isolates CLI config override unit tests from developer-level NeMo Flow configuration discovered through the normal user config path. - [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license. - [x] I searched existing issues and open pull requests, and this does not duplicate existing work. #### Details - Adds a temp-scoped explicit config path helper for config tests that require no implicit user or project config discovery. - Updates the affected override tests to use that explicit path instead of relying on ambient process configuration. #### Where should the reviewer start? Start with `crates/cli/tests/coverage/config_tests.rs`, especially the tests around CLI plugin config overrides. #### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to) - Relates to: none ## Summary by CodeRabbit * **Tests** * Enhanced test infrastructure for configuration resolution by improving test isolation and setup processes. [](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Flow/pull/105) Authors: - Will Killian (https://github.com/willkill07) Approvers: - Ajay Thorve (https://github.com/AjayThorve) URL: #105 * chore: keep OpenClaw dependency in lockstep (#107) #### Overview Keep the OpenClaw plugin package dependency on `nemo-flow-node` aligned with the package version emitted by repository versioning and packaging workflows. - [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license. - [x] I searched existing issues and open pull requests, and this does not duplicate existing work. #### Details - Change `nemo-flow-openclaw` to depend on the exact checked-in `nemo-flow-node` version. - Add a `justfile` helper that updates package dependency versions in both `package.json` and `package-lock.json`. - Wire the dependency update into `set-version`, `package-node`, and `package-openclaw` so prerelease package builds keep the Node and OpenClaw versions together. - Align OpenClaw non-tag CI package version suffixing with the Node package workflow. Validation run: - `just set-version 0.2.0-alpha.20260514`, verified OpenClaw's `nemo-flow-node` dependency updated without dependency success logs, then restored with `just set-version 0.2.0`. - `npm install --workspace=nemo-flow-node --ignore-scripts` - `npm install --workspace=nemo-flow-openclaw --ignore-scripts` - `npm run typecheck --workspace=nemo-flow-openclaw` - `npm run pack:check --workspace=nemo-flow-openclaw` - `just --list` - `git diff --check` - Commit-time pre-commit hooks passed for the staged files. #### Where should the reviewer start? Start with `justfile`, especially the new package dependency version helper and its calls from `set_node_package_versions`, `package-node`, and `package-openclaw`. #### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to) - Relates to: none ## Summary by CodeRabbit ## Release Notes * **Chores** * Refined OpenClaw package versioning format for improved clarity * Pinned nemo-flow-node dependency to a stable version for enhanced reliability * Improved build and packaging tooling to ensure consistent dependency alignment [](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Flow/pull/107) Authors: - Will Killian (https://github.com/willkill07) Approvers: - https://github.com/Salonijain27 URL: #107 * refactor: improve CLI coverage structure (#108) #### Overview Refactors the CLI coverage-heavy interactive setup/plugin editors so testable logic lives in focused helper modules, then adds coverage around the extracted behavior and related CLI paths. - [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license. - [x] I searched existing issues and open pull requests, and this does not duplicate existing work. #### Details - Split plugin config file handling and Observability editor state helpers out of `plugins.rs` into testable modules. - Split setup config/model/file helper logic out of `setup.rs` into `setup/model.rs`. - Added focused coverage for CLI setup, plugin editing models, doctor formatting/check helpers, completion install helpers, server gateway forwarding paths, and CLI smoke behavior. - Updated Codecov component reporting from Gateway Runtime to CLI, set the CLI target to 88%, and excluded only the remaining TTY prompt shells. - Added module guidance so future testable logic does not go back into the interactive prompt files. #### Where should the reviewer start? Start with `crates/cli/src/plugins.rs` and `crates/cli/src/setup.rs` to see the orchestration-only boundary, then review `crates/cli/src/plugins/editor_model.rs`, `crates/cli/src/plugins/config_io.rs`, and `crates/cli/src/setup/model.rs` for the extracted testable logic. Validation run locally: - `cargo fmt --all` - `cargo test -p nemo-flow-cli` with isolated `XDG_CONFIG_HOME` - `cargo clippy --workspace --all-targets -- -D warnings` - `just test-rust` with isolated `XDG_CONFIG_HOME` - `cargo llvm-cov --package nemo-flow-cli --summary-only ...` - commit hook pre-commit checks, including cargo fmt, cargo clippy, and cargo check #### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to) - Relates to: none ## Summary by CodeRabbit * **New Features** * Plugin config preview, validation, and safer save/merge behavior; clearer scope selection and Hermes hook handling in setup. * **Chores / Refactor** * Reorganized CLI internals into smaller, testable modules to make interactive editors and the setup wizard more reliable. * **Tests** * Added extensive CLI unit and integration tests covering agents, doctor, completions, plugin editor TTY behavior, setup flows, and gateway/server forwarding. * **Chores** * Updated Codecov to include CLI coverage and exclude interactive prompt loops. Signed-off-by: Will Killian <wkillian@nvidia.com> * ci: fold OpenClaw checks into Node workflow (#106) #### Overview Fold OpenClaw validation into the existing Node.js CI workflow as a conditional step, and make `just test-openclaw` run the live smoke coverage path. - [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license. - [x] I searched existing issues and open pull requests, and this does not duplicate existing work. #### Details - Add a `run_openclaw` input to the reusable Node.js workflow. - Run OpenClaw integration checks as a conditional step across the full Node test matrix. - Remove the separate OpenClaw workflow call and workflow file. - Keep OpenClaw package artifact creation inside the existing Node package job while leaving Node package steps gated by `run_package`. - Add the live smoke test path to `just test-openclaw` and document the target in contributor testing guidance. #### Where should the reviewer start? Start with `.github/workflows/ci_node.yml`, especially the conditional OpenClaw test step in the Node test job and the package-job gating. #### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to) - Relates to: none <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added live-run OpenClaw smoke tests and a helper script to run them. * OpenClaw integration checks now run conditionally inside the Node.js test flow. * Test suites updated to use compiled test artifacts and adjusted import paths. * **Chores** * Removed standalone OpenClaw CI job; its checks and optional packaging were folded into the Node.js workflow and gated by inputs. * OpenClaw packaging and artifact upload are now conditional. * **Documentation** * Testing guide and integration README updated with live-test target and artifact locations. <!-- end of auto-generated comment: release notes by coderabbit.ai --> * feat: update OpenClaw patch to use new config shape (#111) #### Overview This PR updates the OpenClaw patch to be aligned with `main` - [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license. - [x] I searched existing issues and open pull requests, and this does not duplicate existing work. #### Details <!-- Describe the changes made in this PR. --> #### Where should the reviewer start? <!-- Point to the most important file, test, or design decision. --> #### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to) - Closes # * feat: Add Deep Agents integration (#90) #### Overview * Primary entry point for end-users is the `add_nemo_flow_integration` method, which adds NeMo Flow middleware to the agent and subagents (if any). * Emit a mark when skills are loaded and HITL events * `langgraph` is promoted from a transitive dep to a direct-dep in the `langchain` extra since `python/nemo_flow/integrations/langchain/_serialization.py` now imports from `langgraph` * Adds work-around for installing OpenSSL on Windows-Arm CI runners - [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license. - [x] I searched existing issues and open pull requests, and this does not duplicate existing work. #### Details #### Where should the reviewer start? #### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to) - Closes # ## Summary by CodeRabbit * **New Features** * Deep Agents integration: observability for agent runs, tool calls, filesystem/sandbox operations, human-in-the-loop events, backend instrumentation, and middleware marks. * **Documentation** * Added Deep Agents integration README with setup, usage, and observed-event examples. * **Tests** * New integration and end-to-end tests covering middleware, backend instrumentation, sandbox behavior, and HITL flows; added shared test fixture. * **Chores** * Added optional Deep Agents dependency group and regenerated third‑party attributions/licenses. * **CI** * Updated CI and dev sync steps to include Deep Agents extras and platform-specific setup. [](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Flow/pull/90) Authors: - David Gardner (https://github.com/dagardner-nv) Approvers: - Will Killian (https://github.com/willkill07) - https://github.com/Salonijain27 URL: #90 * chore: refresh dependency locks (#112) #### Overview Refresh dependency locks and runtime compatibility wiring for the `release/0.2` branch. - [x] I confirm this contribution is my own work, or I have the right to submit it under this project license. - [x] I searched existing issues and open pull requests, and this does not duplicate existing work. #### Details - Updates Python optional integration constraints and lockfile entries for the release branch. - Updates OpenClaw peer compatibility to `2026.5.12` and syncs the local hook type mirror with the current session end reasons. - Adjusts Rust reqwest/rustls provider configuration and OTLP HTTP client selection so TLS and exporter initialization remain stable while unused optional transport packages stay out of the lockfile. - Makes Node attribution generation lockfile-driven so platform-gated optional packages are listed consistently across CI and local machines. - Pulls Node license text from integrity-checked locked npm artifacts when packages are not installed on the current platform. - Regenerates Python and Node attribution files from the refreshed lockfiles. Validation run: - `cargo test -p nemo-flow-cli` - `cargo check -p nemo-flow --features otel` - `cargo check -p nemo-flow --features otel,openinference` - `cargo test -p nemo-flow http_config_exports_scope_push_pop_and_marks_without_tokio_runtime -- --nocapture` - `npm test --workspace integrations/openclaw` - `uv run --extra langgraph --extra langchain-nvidia pytest python/tests/integrations/langchain python/tests/integrations/langgraph third_party/langgraph_tests` - `npm audit --ignore-scripts` - `cargo fmt --all --check` - `pre-commit run --files scripts/licensing/attributions_lockfile_md.py ATTRIBUTIONS-Node.md package-lock.json` - signed commit pre-commit suite #### Where should the reviewer start? Start with `scripts/licensing/attributions_lockfile_md.py`, `crates/cli/src/tls.rs`, `crates/core/Cargo.toml`, and `integrations/openclaw/package.json` to review the generator, runtime, and integration compatibility changes before the regenerated lockfile and attribution diffs. #### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to) - Relates to: none ## Summary by CodeRabbit * **Dependencies** * Bumped several Python packages (langchain, langchain-core, langgraph, langgraph-*, urllib3) and raised OpenClaw compatibility to 2026.5.12. * **New Features** * Added "shutdown" and "restart" as session termination reasons. * **Chores** * Ensure TLS/crypto provider is initialized before network operations across CLI and services. * **Documentation** * Refreshed third‑party attributions and improved license extraction for Node/Python packages. [](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Flow/pull/112) Authors: - Will Killian (https://github.com/willkill07) Approvers: - David Gardner (https://github.com/dagardner-nv) - https://github.com/Salonijain27 URL: #112 * fix: support Cursor CLI hook config (#109) #### Overview Fix Cursor CLI hook configuration so current `cursor-agent` builds can execute NeMo Flow hook commands, and document the remaining Cursor CLI hook coverage limits. - [x] I confirm this contribution is my own work, or I have the right to submit it under this project's license. - [x] I searched existing issues and open pull requests, and this does not duplicate existing work. #### Details - Generate Cursor `.cursor/hooks.json` entries as direct command entries with top-level `"version": 1`. - Preserve that Cursor-compatible shape when `nemo-flow run -- cursor-agent` temporarily patches project hooks. - Update `nemo-flow doctor cursor` to reject nested Cursor hook groups and missing or non-`1` top-level version fields. - Trim nullable fields from Cursor permission responses. - Update Cursor integration docs and packaged hooks to state the CLI limitation plainly: current Cursor CLI hook coverage is narrower than Cursor IDE hook coverage. #### Where should the reviewer start? Start with `crates/cli/src/installer.rs` for the hook-shape change, then `crates/cli/src/doctor.rs` for validation of user-managed Cursor hook files. #### Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to) - Closes https://linear.app/nvidia/issue/NMF-122/fix-cursor-cli-hook-config-and-document-stream-json-limitation ## Summary by CodeRabbit * **Refactor** * Standardized Cursor hook JSON to require a top-level version (1) and direct command entries; merged/generated hook files now enforce this shape. * **New Features** * Added stricter validation for Cursor hook files with clear, actionable status messages and test coverage. * **Bug Fixes** * Cursor hook responses/endpoints no longer include legacy message fields. * **Documentation** * Expanded Cursor integration and troubleshooting guidance, plus CLI verification steps. [](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Flow/pull/109) Authors: - Ajay Thorve (https://github.com/AjayThorve) Approvers: - Will Killian (https://github.com/willkill07) URL: #109 --------- Signed-off-by: Will Killian <wkillian@nvidia.com> Co-authored-by: Will Killian <2007799+willkill07@users.noreply.github.com> Co-authored-by: David Gardner <96306125+dagardner-nv@users.noreply.github.com> Co-authored-by: Ajay Thorve <AjayThorve@users.noreply.github.com>
](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Flow/pull/104){kind=link}
](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Flow/pull/105){kind=link}
](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Flow/pull/107){kind=link}
](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Flow/pull/90){kind=link}
](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Flow/pull/112){kind=link}
](https://app.coderabbit.ai/change-stack/NVIDIA/NeMo-Flow/pull/109){kind=link}
3 participants
Overview
Refresh dependency locks and runtime compatibility wiring for the
release/0.2branch.Details
2026.5.12and syncs the local hook type mirror with the current session end reasons.Validation run:
cargo test -p nemo-flow-clicargo check -p nemo-flow --features otelcargo check -p nemo-flow --features otel,openinferencecargo test -p nemo-flow http_config_exports_scope_push_pop_and_marks_without_tokio_runtime -- --nocapturenpm test --workspace integrations/openclawuv run --extra langgraph --extra langchain-nvidia pytest python/tests/integrations/langchain python/tests/integrations/langgraph third_party/langgraph_testsnpm audit --ignore-scriptscargo fmt --all --checkpre-commit run --files scripts/licensing/attributions_lockfile_md.py ATTRIBUTIONS-Node.md package-lock.jsonWhere should the reviewer start?
Start with
scripts/licensing/attributions_lockfile_md.py,crates/cli/src/tls.rs,crates/core/Cargo.toml, andintegrations/openclaw/package.jsonto review the generator, runtime, and integration compatibility changes before the regenerated lockfile and attribution diffs.Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)
Summary by CodeRabbit