fix(hermes): update Hermes Agent to 0.18.2 - #7757
Conversation
Signed-off-by: Antonio Martinez <anmartinez@nvidia.com>
📝 WalkthroughWalkthroughHermes is pinned to v2026.7.7.2 / semver 0.18.2. Version-dependent Dockerfile checks, manifests, patch documentation, reviewed-version tracking, and related test fixtures and assertions are updated accordingly. ChangesHermes release update
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@agents/hermes/hermes-wrapper.py`:
- Around line 292-294: The protected sources changed, but their Dockerfile
integrity hashes are stale. Regenerate the SHA-256 values and update
NEMOCLAW_HERMES_WRAPPER_SHA256 in agents/hermes/Dockerfile for
agents/hermes/hermes-wrapper.py lines 292-294, and
NEMOCLAW_HERMES_LANGFUSE_PATCHER_SHA256 there for
agents/hermes/patch-langfuse-credentials.mts line 10; leave the source files
otherwise unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 75a7dabf-0b58-4c90-b8be-401332f72103
📒 Files selected for processing (10)
agents/hermes/Dockerfileagents/hermes/Dockerfile.baseagents/hermes/hermes-wrapper.pyagents/hermes/manifest.yamlagents/hermes/patch-langfuse-credentials.mtsagents/hermes/patch-session-list-preview.pysrc/lib/domain/sandbox/connect-env.test.tssrc/lib/domain/sandbox/connect-env.tstest/hermes-doctor-config-hash.test.tstest/update-hermes-agent-script.test.ts
| # Hermes Agent CLI in agents/hermes/Dockerfile.base (HERMES_VERSION=v2026.7.7.2, | ||
| # HERMES_SEMVER=0.18.2) and agents/hermes/manifest.yaml (expected_version | ||
| # "0.18.2"). Unknown flags deliberately fail closed by passing the original argv |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
Update all Dockerfile integrity hashes for changed protected sources.
Both edited files are covered by fail-closed SHA-256 gates, so their unchanged hashes will make the image build fail.
agents/hermes/hermes-wrapper.py#L292-L294: regenerate and updateNEMOCLAW_HERMES_WRAPPER_SHA256inagents/hermes/Dockerfile.agents/hermes/patch-langfuse-credentials.mts#L10-L10: regenerate and updateNEMOCLAW_HERMES_LANGFUSE_PATCHER_SHA256inagents/hermes/Dockerfile.
📍 Affects 2 files
agents/hermes/hermes-wrapper.py#L292-L294(this comment)agents/hermes/patch-langfuse-credentials.mts#L10-L10
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@agents/hermes/hermes-wrapper.py` around lines 292 - 294, The protected
sources changed, but their Dockerfile integrity hashes are stale. Regenerate the
SHA-256 values and update NEMOCLAW_HERMES_WRAPPER_SHA256 in
agents/hermes/Dockerfile for agents/hermes/hermes-wrapper.py lines 292-294, and
NEMOCLAW_HERMES_LANGFUSE_PATCHER_SHA256 there for
agents/hermes/patch-langfuse-credentials.mts line 10; leave the source files
otherwise unchanged.
1 participant
Summary
Updates the bundled Hermes Agent from 0.18.0 to the published 0.18.2 release required by NeMo Relay. The release pin, artifact integrity values, and version-scoped compatibility checks now agree on the installed version. This is the source-side input to the established base-image publication and release-promotion flow; public installs receive 0.18.2 after that flow publishes the new image, updates the immutable final-image digest, and promotes the resulting release.
Changes
v2026.7.7.2/0.18.2, including its SHA-256 and npm registry integrity value. The 0.18.2 patch fixes tagged Docker builds upstream.v2026.7.7.2to the reviewed light-skin source list and update version-bound test fixtures.Type of Change
Quality Gates
v2026.7.7.2source tag, archive SHA-256, npm integrity value, retained patch contracts, and light-skin source diff. The change adds no network, credential, or policy path.Documentation Writer Review
no-docs-neededWRITING.md; reviewed applicable documentation style indocs/CONTRIBUTING.md. No user-facing workflow changed.git diff --checkpassed. Validation evidence: normal pre-commit hooks including hadolint passed; CLI connect-env 9 passed; integration dependency-pin/update-script 18 passed; E2E Langfuse 3 passed; the targeted Hermes upgrade guard passed; update script check passed. The unrelated full doctor config-hash test has a localchmodEPERM limit.DGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablesrc/lib/domain/sandbox/connect-env.test.tspassed 9;test/dependency-pins-check.test.tsandtest/update-hermes-agent-script.test.tspassed 18;test/e2e/support/hermes-langfuse-credential-patch.test.tspassed 3; the targeted Hermes upgrade guard passed 1;bash scripts/update-hermes-agent.sh --tag v2026.7.7.2 --checkpassed. The unrelated full doctor config-hash test has a localchmodEPERM limit for CI to confirm.npm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: Not applicable; the change updates a dependency pin and focused version-bound contracts.npm run docsbuilds without warnings (doc changes only)Signed-off-by: Antonio Martinez anmartinez@nvidia.com
Summary by CodeRabbit
Updates
Bug Fixes
Tests