fix(openclaw): bump runtime deps EXDEV fix#3820
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughOpenClaw defaults and manifests are bumped from 2026.4.24 → 2026.5.18; Dockerfile patching now conditionally rewrites install-package-dir checks (lstat→stat or realpath guard) and widens the WebSocket pre-auth handshake timeout replacement to handle multiple original constants. ChangesOpenClaw Version Upgrade
Dockerfile patch adjustments
OpenClaw tool catalog patch handling
Test/script tweak
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
E2E Advisor RecommendationRequired E2E: Dispatch hint: Auto-dispatched E2E: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
Dockerfile.base (1)
1-48:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winAdd SPDX license header.
This file is missing the required SPDX license header. As per coding guidelines, every source file must include an SPDX license header for copyright and Apache-2.0 license.
📝 Proposed fix to add SPDX header
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + # NemoClaw sandbox base image — expensive, rarely-changing layers. # # Contains: node:22-trixie-slim, apt packages, gosu, user/group setup,🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile.base` around lines 1 - 48, Add the required SPDX license header to the very top of Dockerfile.base by inserting two shell-commented SPDX lines before the existing file comment block: a SPDX-FileCopyrightText entry with the project/copyright owner and a SPDX-License-Identifier set to Apache-2.0, using '#' as the comment marker so the header is recognized and remains a comment in the Dockerfile.
🧹 Nitpick comments (1)
Dockerfile.base (1)
180-180: ⚡ Quick winConsider E2E testing for container image changes.
This file affects the sandbox container image. As per coding guidelines, layer ordering, permissions, and baked config changes are only testable with a real container build.
Recommended E2E tests:
cloud-e2e— full onboard + cloud inferencesandbox-survival-e2e— gateway restart recoveryhermes-e2e— Hermes agent onboard + inferencerebuild-openclaw-e2e— workspace state survives rebuildTo run selectively:
gh workflow run nightly-e2e.yaml --ref <branch> -f jobs=cloud-e2e,sandbox-survival-e2e,hermes-e2e,rebuild-openclaw-e2e🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile.base` at line 180, Change to the sandbox container image (ARG OPENCLAW_VERSION) requires running the prescribed end-to-end tests; run the GitHub Actions nightly-e2e workflow for the listed jobs (cloud-e2e, sandbox-survival-e2e, hermes-e2e, rebuild-openclaw-e2e) to validate layer ordering, permissions and baked config by executing: gh workflow run nightly-e2e.yaml --ref <branch> -f jobs=cloud-e2e,sandbox-survival-e2e,hermes-e2e,rebuild-openclaw-e2e, and if needed also build the Dockerfile.base locally to verify image build/permission semantics before merging.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@Dockerfile.base`:
- Around line 1-48: Add the required SPDX license header to the very top of
Dockerfile.base by inserting two shell-commented SPDX lines before the existing
file comment block: a SPDX-FileCopyrightText entry with the project/copyright
owner and a SPDX-License-Identifier set to Apache-2.0, using '#' as the comment
marker so the header is recognized and remains a comment in the Dockerfile.
---
Nitpick comments:
In `@Dockerfile.base`:
- Line 180: Change to the sandbox container image (ARG OPENCLAW_VERSION)
requires running the prescribed end-to-end tests; run the GitHub Actions
nightly-e2e workflow for the listed jobs (cloud-e2e, sandbox-survival-e2e,
hermes-e2e, rebuild-openclaw-e2e) to validate layer ordering, permissions and
baked config by executing: gh workflow run nightly-e2e.yaml --ref <branch> -f
jobs=cloud-e2e,sandbox-survival-e2e,hermes-e2e,rebuild-openclaw-e2e, and if
needed also build the Dockerfile.base locally to verify image build/permission
semantics before merging.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: b1b0a972-9945-46d6-a6b6-49da8a3f200c
📒 Files selected for processing (3)
Dockerfile.baseagents/openclaw/manifest.yamlnemoclaw-blueprint/blueprint.yaml
Selective E2E Results — ❌ Some jobs failedRun: 26121235580
|
|
✨ Related open PRs: Related open issues: |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Around line 224-227: The sed command in the hto_files patch misuses '|' as
both the sed delimiter and the regex alternation operator, causing the
replacement to be parsed incorrectly; update the sed invocation in the hto_files
pipeline (the sed -i -E 's|DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS =
(1e4|15e3)|DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS = 6e4|g' call) to use a
delimiter that does not appear in the pattern (for example '#' or '@') so the
alternation (1e4|15e3) is preserved, e.g. change to
s#DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS =
(1e4|15e3)`#DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS` = 6e4#g and keep the subsequent
grep validation unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3e4ae5aa-2804-4d1a-8090-8ff52d0cdb9e
📒 Files selected for processing (1)
Dockerfile
Selective E2E Results — ❌ Some jobs failedRun: 26158933201
|
Selective E2E Results — ❌ Some jobs failedRun: 26159018921
|
Selective E2E Results — ❌ Some jobs failedRun: 26159537262
|
Selective E2E Results — ❌ Some jobs failedRun: 26159746352
|
…gin-runtime-exdev
Selective E2E Results — ❌ Some jobs failedRun: 26160605110
|
Selective E2E Results — ❌ Some jobs failedRun: 26161014906
|
There was a problem hiding this comment.
🧹 Nitpick comments (1)
Dockerfile (1)
177-229: Run the container E2Es for these baked dist rewrites.These
grep/sed/nodechecks prove the bundle text changed, not that the patched image still boots and behaves correctly end-to-end. I’d runcloud-e2e,sandbox-survival-e2e,hermes-e2e, andrebuild-openclaw-e2ealongside the EXDEV regression guard before merge.As per coding guidelines,
Dockerfile: This file affects the sandbox container image. Layer ordering, permissions, and baked config changes are only testable with a real container build.Also applies to: 231-239
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile` around lines 177 - 229, The review asks to validate the baked dist rewrites by running full container E2Es rather than relying solely on textual grep/sed checks; build and run the image produced by this Dockerfile and execute cloud-e2e, sandbox-survival-e2e, hermes-e2e and rebuild-openclaw-e2e (and the EXDEV regression guard) against that image to ensure changes around OC_DIST patches (fg_export, fg_assert), install-safe-path/ipd_file edits, and the DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS change (hto_files) actually boot and behave correctly end-to-end before merging.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@Dockerfile`:
- Around line 177-229: The review asks to validate the baked dist rewrites by
running full container E2Es rather than relying solely on textual grep/sed
checks; build and run the image produced by this Dockerfile and execute
cloud-e2e, sandbox-survival-e2e, hermes-e2e and rebuild-openclaw-e2e (and the
EXDEV regression guard) against that image to ensure changes around OC_DIST
patches (fg_export, fg_assert), install-safe-path/ipd_file edits, and the
DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS change (hto_files) actually boot and behave
correctly end-to-end before merging.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ab2435f5-5a18-4e8b-82a9-72cf3f0bda57
📒 Files selected for processing (3)
Dockerfilescripts/patch-openclaw-tool-catalog.jstest/openclaw-tool-catalog-patch.test.ts
💤 Files with no reviewable changes (1)
- test/openclaw-tool-catalog-patch.test.ts
Selective E2E Results — ✅ All requested jobs passedRun: 26161338524
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/e2e-test.sh`:
- Around line 258-259: The test expects restored.wizard.lastRunVersion ===
'2026.3.11' but the fixture /sandbox/.openclaw/openclaw.json and
onboarding/config creation code never define wizard or lastRunVersion, so the
test will fail; fix by either updating the test fixture to include "wizard":
{"lastRunVersion":"2026.3.11"} in the initial JSON or modify the config
initialization/onboarding routine that creates the openclaw.json (the code path
that writes the restored object) to populate restored.wizard.lastRunVersion =
'2026.3.11' (or derive the version constant used by tests) before the file is
saved so restored.wizard.lastRunVersion is present when the e2e test reads it.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 0965cfb1-1c2d-4fb9-80b4-bce80e412629
📒 Files selected for processing (1)
test/e2e-test.sh
Selective E2E Results — ❌ Some jobs failedRun: 26161625841
|
3 participants
Summary
Regression guard
openclaw-plugin-runtime-exdev-e2einregression-e2e.yamlEXDEV: cross-device link not permittedValidation
npm run build:clinpx vitest run src/lib/sandbox/version.test.ts src/lib/sandbox-base-image.test.ts test/sandbox-build-context.test.ts --testTimeout 60000Closes #3513
Summary by CodeRabbit
Chores
Bug Fixes / Reliability
Tests