fix(sandbox): clear stale restore dirs and repair hermes venv perms#7436
Conversation
Two v0.0.91 regressions on hermes sandboxes: - snapshot restore left files created after the snapshot in state dirs that were empty when the snapshot was taken. The pre-extract clean-up now also clears declared target state dirs missing from the backup, preserving the directory and its owner and mode, and never touches runtime auth dirs or image-managed extensions. - the hermes venv was built with permissions the sandbox user could not read, so python3 crashed reading pyvenv.cfg during init_import_site. The venv is made readable in the base and final images, gated by a build-time check that runs python3 as the sandbox user. Fixes #7428 Signed-off-by: Tinson Lai <tinsonl@nvidia.com>
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit 7b37970 in the TypeScript / code-coverage/cliThe overall coverage in commit 7b37970 in the Show a code coverage summary of the most impacted files.
Updated |
laitingsheng
added
NV QA
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughRestore cleanup removes stale state contents while preserving protected directories and symlinks. Sandbox restore records failed backup directories and supplies eligible cleanup paths. Hermes image builds verify sandbox access to the Python virtual environment. ChangesHermes restore and runtime access
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant SnapshotBackup
participant RebuildManifest
participant SandboxRestore
participant CleanupCommand
participant TarExtraction
SnapshotBackup->>RebuildManifest: persist failedBackupDirs
RebuildManifest-->>SandboxRestore: provide restore manifest
SandboxRestore->>CleanupCommand: build cleanup for local and stale directories
CleanupCommand-->>SandboxRestore: return directory cleanup command
SandboxRestore->>TarExtraction: extract restoreTar after cleanup
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/lib/state/sandbox.ts (1)
1603-1641: 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy liftStale-content cleanup is unreachable when no state dir was backed up.
The new
staleContentDirscleanup (1631-1639) is nested insideif (localDirs.length > 0). Since the bug being fixed is precisely about directories that were empty at snapshot time (hence absent fromlocalDirs), if every declared state dir was empty when the snapshot was taken — e.g. a snapshot taken right after sandbox provisioning —localDirs.lengthstays 0 and this whole block (including the new cleanup) is skipped, leaving stale post-snapshot content in place for that restore. SSH setup already happens above this gate (lines 1542-1569), so cleanup could run independently of whether a tar extraction is needed.🛠️ Suggested restructuring direction
- const staleContentDirs = targetAgent.stateDirs.filter( - (stateDir) => !targetRuntimeAuthDirs.has(stateDir), - ); - const rmCmd = buildRestoreCleanupCommand( - dir, - localDirs, - pluginRestorePlan.preservedExtensionDirs, - new Set(pluginRestorePlan.requiredFreshExtensionDirs), - staleContentDirs, - ); - _log(`Cleaning target dirs before restore: ${rmCmd}`); - const rmResult = spawnSync("ssh", [...sshArgs(configFile, sandboxName), rmCmd], { - stdio: ["ignore", "pipe", "pipe"], - timeout: 30000, - }); - if (rmResult.status !== 0 || rmResult.error || rmResult.signal) { - ... - } - - const extractCmd = ... + // (compute staleContentDirs and run rmCmd above the `if (localDirs.length > 0)` + // gate, or add `|| staleContentDirs.length > 0` to that gate, so cleanup still + // runs for dirs that were empty at snapshot time even when nothing was backed up.)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/state/sandbox.ts` around lines 1603 - 1641, Move the stale-content cleanup flow centered on staleContentDirs and buildRestoreCleanupCommand outside the localDirs.length > 0 guard so it also runs when no state directories were backed up. Keep tar creation/extraction conditional on localDirs being non-empty, while preserving SSH setup and existing restore result handling.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/lib/state/sandbox.ts`:
- Around line 1603-1641: Move the stale-content cleanup flow centered on
staleContentDirs and buildRestoreCleanupCommand outside the localDirs.length > 0
guard so it also runs when no state directories were backed up. Keep tar
creation/extraction conditional on localDirs being non-empty, while preserving
SSH setup and existing restore result handling.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ba51b560-8e3d-4272-b928-ff5c8116aef7
📒 Files selected for processing (5)
agents/hermes/Dockerfileagents/hermes/Dockerfile.basesrc/lib/state/openclaw-managed-extensions.test.tssrc/lib/state/openclaw-managed-extensions.tssrc/lib/state/sandbox.ts
PR Review Advisor — InformationalAdvisor assessment: Informational / high confidence Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 2 optional E2E recommendations
1 warning · 0 suggestionsWarningsWarnings do not block.
|
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/lib/state/sandbox.ts`:
- Line 1560: Update the pre-cleanup failure return paths for SSH configuration,
plugin planning, and local-tar setup in the restore flow to report failed
directories from cleanupStateDirs instead of localDirs. Preserve the existing
behavior for successful cleanup and ensure stale-only restores return the
eligible stale directories when setup fails.
In `@test/snapshot-stale-directory-restore.test.ts`:
- Around line 14-20: Replace the HOME cleanup conditional in afterAll with
restoreEnv("HOME", ORIGINAL_HOME), and replace the direct PATH assignment at
test/snapshot-stale-directory-restore.test.ts lines 129-130 with
restoreEnv("PATH", oldPath) so both present and absent environment states are
restored deterministically.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ce967275-f8ed-4012-8633-2c53439507a9
📒 Files selected for processing (2)
src/lib/state/sandbox.tstest/snapshot-stale-directory-restore.test.ts
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/snapshot-stale-directory-restore.test.ts (1)
155-155: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse the repository’s POSIX PATH separator.
Line 155 should use
:instead ofpath.delimiter; these tests run on Linux CI and the repository’s established test convention is explicitly POSIX-only.Suggested change
- process.env.PATH = `${binDir}${path.delimiter}${oldPath || ""}`; + process.env.PATH = `${binDir}:${oldPath || ""}`;Based on learnings, this repository’s Linux-only tests should construct
PATHwith:rather thanpath.delimiter.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/snapshot-stale-directory-restore.test.ts` at line 155, Update the PATH assignment in the test setup to join binDir and oldPath with the repository’s POSIX separator “:” instead of path.delimiter, preserving the existing fallback for an unset oldPath.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/snapshot-stale-directory-restore.test.ts`:
- Line 155: Update the PATH assignment in the test setup to join binDir and
oldPath with the repository’s POSIX separator “:” instead of path.delimiter,
preserving the existing fallback for an unset oldPath.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ca1fc551-9ef7-449f-a426-92a059d68f72
📒 Files selected for processing (2)
src/lib/state/sandbox.tstest/snapshot-stale-directory-restore.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- src/lib/state/sandbox.ts
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
test/snapshot-stale-directory-restore.test.ts (1)
164-164: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse the suite’s POSIX PATH separator.
Use
:here rather thanpath.delimiter; this test lane runs on POSIX CI and the repository convention keeps these fixtures explicit.Proposed change
- process.env.PATH = `${binDir}${path.delimiter}${oldPath || ""}`; + process.env.PATH = `${binDir}:${oldPath || ""}`;Based on learnings, prefer the established POSIX PATH separator
:in these tests.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/snapshot-stale-directory-restore.test.ts` at line 164, Update the PATH assignment in the affected test to use the explicit POSIX separator ":" instead of path.delimiter, preserving the existing binDir and oldPath composition.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/snapshot-stale-directory-restore.test.ts`:
- Around line 155-157: Update the fake SSH command handling and related
assertion in the snapshot restore test to detect semantic destructive cleanup
targeting /sandbox/.openclaw/workspace rather than the exact d='...' shell
assignment shape. Ensure equivalent workspace-deletion command forms remove the
marker and are validated consistently.
---
Nitpick comments:
In `@test/snapshot-stale-directory-restore.test.ts`:
- Line 164: Update the PATH assignment in the affected test to use the explicit
POSIX separator ":" instead of path.delimiter, preserving the existing binDir
and oldPath composition.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7156e0ab-2475-4f88-a70e-81631acc68db
📒 Files selected for processing (1)
test/snapshot-stale-directory-restore.test.ts
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
|
🌿 Preview your docs: https://nvidia-preview-pr-7436.docs.buildwithfern.com/nemoclaw |
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
prekshivyas
left a comment
prekshivyas
left a comment
There was a problem hiding this comment.
Sensitive-path security review for exact head 5c5f4ef75588204a920330f61b51cd5cd1367f7d against base 0670d20352298dd4686d6efe6abc5118ab8f27d2: PASS.
- Secrets/credentials: no secret material or new credential flow.
- Authentication/authorization: no trust-boundary expansion; restored files retain intended sandbox use.
- Input validation/injection: archive paths remain manifest-scoped; symlink-safe handling is preserved.
- Network/SSRF: no new network destination or request construction.
- Filesystem/path traversal: cleanup is limited to snapshot-manifest entries and preserves failed or untracked backup directories; legacy manifests intentionally avoid absence cleanup.
- Privilege/isolation: the Hermes venv receives read/execute access only, not write access, for the sandbox user.
- Supply chain/dependencies: no dependency or provenance change.
- Cryptography: no cryptographic change.
- Logging/error handling/tests: failures remain surfaced; targeted snapshot, failed-backup, symlink, and Hermes venv tests cover the changed behavior.
I also checked the second-opinion advisor concerns. The alleged pre-extraction rollback gap predates this PR, failed discovered workspaces are omitted from the successful manifest and therefore preserved, legacy behavior is deliberately fail-safe, and the venv permission is a+rX rather than writable. No security blocker found; exact-head CI and credentialed E2E remain separate approval gates.
|
Exact-head disposition of the Nemotron second-opinion warnings/suggestions on
The canonical advisor ledger is already 0 blockers / 0 warnings. Required exact-head Hermes/security E2E remains the runtime gate. |
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
prekshivyas
left a comment
prekshivyas
left a comment
There was a problem hiding this comment.
Verdict
PASS for 9272e0dc3c1a450077b4e797235a0ed6a3b7ea88. The PR does not weaken an existing security control. The finalization fix only changes when the existing loopback dashboard forward is refreshed; it adds no port, listener, policy, credential, or authorization surface. Snapshot cleanup remains restricted to manifest-declared directories, shell-quotes paths, preserves failed backups, and refuses symlink targets.
Findings
No security findings.
Detailed analysis
- Secrets and credentials — PASS: no secret material added or logged.
- Input validation and sanitization — PASS: existing port validation and shell quoting remain intact; cleanup rejects symlink targets.
- Authentication and authorization — PASS: no auth or scope checks are removed or bypassed.
- Dependencies — PASS: no dependency changes.
- Error handling and logging — PASS: no sensitive output or new exception path.
- Cryptography and data protection — PASS: no cryptographic behavior changes.
- Configuration and exposure — PASS: the refreshed forward remains bound to the existing
127.0.0.1URL and declared ports. - Security testing — PASS: symlink-preservation and failed-backup tests remain present; the new ordering test covers the lifecycle regression.
- System security — PASS: policy/recovery/scope checks still complete before the forward refresh and deployment verification.
Files reviewed
agents/hermes/Dockerfile, agents/hermes/Dockerfile.base, docs/manage-sandboxes/backup-restore.mdx, docs/reference/commands.mdx, src/lib/state/openclaw-managed-extensions.ts, src/lib/state/openclaw-managed-extensions.test.ts, src/lib/state/sandbox.ts, test/snapshot-stale-directory-restore.test.ts, src/lib/onboard/machine/handlers/finalization.ts, and src/lib/onboard/machine/handlers/finalization.test.ts.
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
prekshivyas
left a comment
prekshivyas
left a comment
There was a problem hiding this comment.
Verdict
PASS for 7b3797056a1c76f6d36cc51314f4fc774817189b. The optimized finalization change preserves the existing loopback dashboard surface and conditionally invokes the established gateway/forward recovery path before verification. It does not add listeners, ports, privileges, credentials, policy changes, or authorization bypasses.
Findings
No security findings.
Detailed analysis
- Secrets and credentials — PASS: no secret material added or logged.
- Input validation and sanitization — PASS: existing validated ports and shell-quoted, symlink-guarded restore paths are unchanged.
- Authentication and authorization — PASS: policy recovery and scope approval still run before final verification; no auth check is bypassed.
- Dependencies — PASS: no dependency changes.
- Error handling and logging — PASS: the existing recovery path retains its fail-closed diagnostics and no sensitive output is introduced.
- Cryptography and data protection — PASS: no cryptographic behavior changes.
- Configuration and exposure — PASS: dashboard forwarding remains loopback-only and uses the existing declared ports.
- Security testing — PASS: existing symlink/failed-backup coverage remains; the ordering test requires a final recovery pass before verification.
- System security — PASS: the final pass rechecks gateway and forward health and restarts only when needed, avoiding a blind tunnel restart while preserving least exposure.
Files reviewed
agents/hermes/Dockerfile, agents/hermes/Dockerfile.base, docs/manage-sandboxes/backup-restore.mdx, docs/reference/commands.mdx, src/lib/state/openclaw-managed-extensions.ts, src/lib/state/openclaw-managed-extensions.test.ts, src/lib/state/sandbox.ts, test/snapshot-stale-directory-restore.test.ts, src/lib/onboard/machine/handlers/finalization.ts, and src/lib/onboard/machine/handlers/finalization.test.ts.
|
Maintainer CI disposition for exact head Evidence:
Follow-up: #6660 is reopened with the exact base/head evidence to restore a calibrated acceptance signal. Do not raise the checked-in budget in this unrelated bug-fix PR. |
prekshivyas
left a comment
prekshivyas
left a comment
There was a problem hiding this comment.
Approved after exact-head human review at 7b37970. Ordinary CI, CodeRabbit, both advisors, targeted restore/onboarding coverage, and PR-specific E2E evidence are clean with no unresolved threads. Maintainer waiver: the only non-passing gate is the known current-main OpenClaw cold-onboard performance-budget failure tracked by #6660; the functional flow completed and the PR body records the accepted non-success evidence.
<!-- markdownlint-disable MD041 --> ## Summary This PR adds the canonical dated release entry for NemoClaw v0.0.94 before the tag is cut. The entry reconciles all 26 commits since v0.0.93 and links each user-visible change to its owning documentation. ## Changes - Add `docs/changelog/2026-07-24.mdx` with the exact `## v0.0.94` heading, parser-safe SPDX comment, release summary, and detailed bullets. - Record sandbox restore and update behavior, onboarding and inference changes, network policy behavior, security evidence, Hermes build performance, DGX Station guidance, and E2E validation changes. - Preserve `docs/` as the source of truth without changing the AI-agent documentation routing skill. - Use [E2E run 30075443016](https://github.com/NVIDIA/NemoClaw/actions/runs/30075443016) for release QA evidence at exact tested SHA `04e6dfa883071dda9df429c66e73168e1a995cba`. ### Source summary - [#7461](#7461) -> `docs/changelog/2026-07-24.mdx`: Record the ownership-preserving Hermes image layer reduction and hosted timing comparison. - [#7460](#7460) -> `docs/changelog/2026-07-24.mdx`: Record removal of candidate Hermes swap setup from E2E validation. - [#7458](#7458) -> `docs/security/fern-5.80.1-dependency-review.md`, `docs/changelog/2026-07-24.mdx`: Record the reviewed Fern CLI update. - [#7457](#7457) -> `docs/changelog/2026-07-24.mdx`: Record periodic runner-pressure telemetry. - [#7455](#7455) -> `docs/changelog/2026-07-24.mdx`: Record non-blocking absent Fern previews. - [#7450](#7450) -> `docs/changelog/2026-07-24.mdx`: Record stable cancellation handling for live-test child processes. - [#7449](#7449) -> `docs/changelog/2026-07-24.mdx`: Record parallel plugin EXDEV coverage. - [#7448](#7448) -> `docs/changelog/2026-07-24.mdx`: Record isolated long-running E2E lanes. - [#7444](#7444) -> `docs/changelog/2026-07-24.mdx`: Record exact-head Hermes swap validation. - [#7437](#7437) -> `docs/manage-sandboxes/backup-restore.mdx`, `docs/changelog/2026-07-24.mdx`: Record gateway pairing and authenticated verification after cross-sandbox restore. - [#7436](#7436) -> `docs/manage-sandboxes/backup-restore.mdx`, `docs/reference/commands.mdx`, `docs/changelog/2026-07-24.mdx`: Record selected stale-state cleanup and Hermes virtual-environment access repair. - [#7385](#7385) -> `docs/network-policy/customize-network-policy.mdx`, `docs/changelog/2026-07-24.mdx`: Record the read-only agent-variant route check. - [#7371](#7371) -> `docs/changelog/2026-07-24.mdx`: Record host-artifact verification for session exports. - [#7359](#7359) -> `docs/changelog/2026-07-24.mdx`: Record platform validation for managed vLLM model overrides. - [#7356](#7356) -> `docs/changelog/2026-07-24.mdx`: Record token-shaped value redaction for `sandbox doctor --json`. - [#7354](#7354) -> `docs/security/advisory-early-warning.md`, `docs/changelog/2026-07-24.mdx`: Record advisory correlation and retained audit provenance. - [#7352](#7352) -> `docs/network-policy/customize-network-policy.mdx`, `docs/network-policy/integration-policy-examples.mdx`, `docs/reference/commands.mdx`, `docs/changelog/2026-07-24.mdx`: Record preset reapplication and bounded `tls: skip` guidance. - [#7345](#7345) -> `docs/security/openclaw-2026.6.10-dependency-review.md`, `docs/security/openclaw-2026.7.1-dependency-review.md`, `docs/changelog/2026-07-24.mdx`: Record reviewed npm audit exception enforcement. - [#7340](#7340) -> `docs/network-policy/customize-network-policy.mdx`, `docs/changelog/2026-07-24.mdx`: Record the repaired CLI-reference route. - [#7334](#7334) -> `docs/get-started/dgx-station-preparation.mdx`, `docs/changelog/2026-07-24.mdx`: Record the qualified OTA metadata fallback and narrowed override wording. - [#7322](#7322) -> `docs/changelog/2026-07-24.mdx`: Reconcile the gateway source tag added to plugin registration banners. - [#7284](#7284) -> `docs/manage-sandboxes/update-sandboxes.mdx`, `docs/changelog/2026-07-24.mdx`: Record read-only `upgrade-sandboxes --check` behavior and recorded-gateway selection. - [#7277](#7277) -> `docs/changelog/2026-07-24.mdx`: Reconcile deterministic gateway TCP refusal coverage. - [#7234](#7234) -> `docs/reference/troubleshooting.mdx`, `docs/changelog/2026-07-24.mdx`: Record preserved DGX Spark managed vLLM Express intent on resume. - [#7185](#7185) -> `docs/reference/troubleshooting.mdx`, `docs/changelog/2026-07-24.mdx`: Record IPv4 fallback DNS selection and exact resolver probing. - [#6820](#6820) -> `docs/reference/commands.mdx`, `docs/changelog/2026-07-24.mdx`: Record the versioned, redacted `--events=jsonl` onboarding stream. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: `npx vitest run test/changelog-docs.test.ts` passed 6/6 tests. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/changelog/2026-07-24.mdx`; the writing rules, documentation style, exact release range, skip terms, published routes, and product scope were reviewed; the changelog test passed 6/6; `npm run docs` passed with route checking OK, zero errors, and two existing warnings. - Agent: Codex Desktop <!-- docs-review-head-sha: 65368f9 --> <!-- docs-review-agents-blob-sha: 9c9b36d --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable - Station profile/scenario: Not applicable - Result: Not applicable - Supporting evidence: Not applicable. This PR does not change `scripts/prepare-dgx-station-host.sh`. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run test/changelog-docs.test.ts` passed 6/6 tests. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not applicable to the dated changelog entry. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only). The build passed with zero errors and two existing Fern warnings. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only). Native dated changelog entries use the required parser-safe MDX SPDX comment and no frontmatter. --- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added the v0.0.94 release changelog. * Documented improvements to sandbox snapshot and restore behavior. * Added updates for gateway selection, policy comparisons, onboarding event output, and DGX recovery workflows. * Documented enhanced diagnostics redaction, npm audit provenance, image assembly performance, and validation stability improvements. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
2 participants
Summary
Two v0.0.91 regressions on hermes sandboxes. A
snapshot restoreleft files created after the snapshot in state directories that were empty when the snapshot was taken, so a clean restore no longer matched the snapshot. The hermes venv was built with permissions the sandbox user could not read, so everypython3inside the sandbox crashed readingpyvenv.cfgbefore any user code ran. After this change a clean restore removes post-snapshot files only from directories declared by the snapshot manifest, preserves state introduced only by a newer target manifest, preserves each directory and its mode, and lets the sandbox user runpython3.Related Issue
Fixes #7428
Changes
/opt/hermes/.venvreadable and traversable for all users in the base image, and reassert it in the final image so a lagging base cannot regress it. Both steps run a build-time check that reproduces the reported failure by invokingpython3as the sandbox user, so a bad-umask build fails fast.Type of Change
Quality Gates
E2E / PR Gate; accepted for exact head as a current-main cold-path performance-budget failure: fix(sandbox): clear stale restore dirs and repair hermes venv perms #7436 (comment); follow-up: Stabilize full-e2e cold-onboard performance budget #6660Documentation Writer Review
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablenpm run typecheck:cliandnpm run check:diffpassnpm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: not applicable; the change is scoped to snapshot restore cleanup and Hermes image permissions, with targeted suites and exact-diff hooks passing.npm run docsbuilds without warnings (doc changes only)Signed-off-by: Tinson Lai tinsonl@nvidia.com
Summary by CodeRabbit