fix(dcode): support managed MCP snapshots on private tmpfs - #8024
Merged
Conversation
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
jyaunches
added
area: sandbox
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughDeep Agents Code now uses a validated private tmpfs for anonymous MCP snapshot fallback. Onboarding provisions the mount for the target agent. Tests verify integrity, mount properties, cleanup, and lifecycle residue. ChangesManaged MCP snapshot fallback
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Onboarding
participant Sandbox
participant DeepAgentsCode
participant MCPProof
Onboarding->>Sandbox: create Deep Agents Code sandbox with tmpfs configuration
Sandbox-->>Onboarding: mount /run/nemoclaw-dcode-mcp
DeepAgentsCode->>DeepAgentsCode: attempt memfd and /tmp O_TMPFILE snapshot creation
DeepAgentsCode->>Sandbox: validate private tmpfs and create fallback snapshot
MCPProof->>DeepAgentsCode: run platform and residue checks
MCPProof-->>MCPProof: verify integrity, mount properties, and empty storage
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Comment |
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-8024.docs.buildwithfern.com/nemoclaw |
Contributor
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
3 additional E2E selections from the second opinionAdvisory only. The primary lane did not select these E2E jobs or targets.
Second-opinion E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 1 optional E2E recommendation
1 warning · 0 suggestionsWarningsWarnings do not block.
|
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in commit d8bde4e in the TypeScript / code-coverage/cliThe overall coverage in commit d8bde4e in the Show a code coverage summary of the most impacted files.
Updated |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@agents/langchain-deepagents-code/managed-dcode-runtime.py`:
- Around line 919-931: Update the mount-entry scan to continue through all
mountinfo lines instead of breaking on the first matching directory. In the loop
that sets mount_options, retain only the options from the last matching tmpfs
entry, while preserving fail-closed behavior when no valid tmpfs entry is found.
In `@docs/security/openshell-0.0.85-migration-review.md`:
- Around line 361-366: Reformat the affected documentation sections so each
sentence occupies a single raw line and ends with a period. Apply this
consistently to the sentences near the mount description and the additional
ranges identified in the review, without changing their technical content.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 00446d8f-f3d3-4341-95ca-bcc992d47930
📒 Files selected for processing (11)
agents/langchain-deepagents-code/managed-dcode-runtime.pyagents/langchain-deepagents-code/policy-additions.yamldocs/security/openshell-0.0.85-migration-review.mdsrc/lib/onboard/sandbox-create-plan-materialization.tssrc/lib/onboard/sandbox-create-plan.test.tstest/e2e/live/mcp-bridge.test.tstest/e2e/live/openshell-driver-config-test-wrapper.tstest/e2e/live/openshell-exact-main-driver-config.tstest/e2e/live/openshell-exact-main-mcp-proof.tstest/e2e/support/openshell-exact-main-driver-config.test.tstest/langchain-deepagents-code-managed-mcp-hardening.test.ts
senthilr-nv
requested changes
Jul 31, 2026
senthilr-nv
left a comment
senthilr-nv
left a comment
Collaborator
There was a problem hiding this comment.
Blocking: _validate_private_managed_mcp_tmpfs() stops at the first same-path mountinfo record. With stacked mounts, a compliant lower tmpfs can make an effective upper mount that lacks noexec, nosuid, or nodev pass validation. Resolve or reject stacked mounts and add a regression for this case.
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
test/e2e/live/openshell-exact-main-driver-config.ts (1)
585-586: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winPass
EXACT_MAIN_DRIVER_CONFIG_JSONto the live wrapper.Without
driverConfigJson, the wrapper delegatessandbox createwithout--driver-config-json. The live proof does not validate the 1 MiB tmpfs contract.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e/live/openshell-exact-main-driver-config.ts` around lines 585 - 586, Update the exact-main-driver-config live wrapper configuration to pass EXACT_MAIN_DRIVER_CONFIG_JSON as driverConfigJson alongside delegatedCapabilityMarkers and label, ensuring sandbox create includes --driver-config-json and validates the 1 MiB tmpfs contract.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@test/e2e/live/openshell-exact-main-driver-config.ts`:
- Around line 585-586: Update the exact-main-driver-config live wrapper
configuration to pass EXACT_MAIN_DRIVER_CONFIG_JSON as driverConfigJson
alongside delegatedCapabilityMarkers and label, ensuring sandbox create includes
--driver-config-json and validates the 1 MiB tmpfs contract.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 8e03b0ff-8dc1-430c-9d71-3fd9114d8350
📒 Files selected for processing (5)
docs/security/openshell-0.0.85-migration-review.mdsrc/lib/onboard/sandbox-create-plan-materialization.tssrc/lib/onboard/sandbox-create-plan.test.tstest/e2e/live/openshell-exact-main-driver-config.tstest/e2e/support/openshell-exact-main-driver-config.test.ts
🚧 Files skipped from review as they are similar to previous changes (4)
- src/lib/onboard/sandbox-create-plan.test.ts
- src/lib/onboard/sandbox-create-plan-materialization.ts
- test/e2e/support/openshell-exact-main-driver-config.test.ts
- docs/security/openshell-0.0.85-migration-review.md
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
senthilr-nv
approved these changes
Jul 31, 2026
senthilr-nv
left a comment
senthilr-nv
left a comment
Collaborator
There was a problem hiding this comment.
The stacked-mount validation now fails closed on ambiguous same-path entries, with focused regression coverage and an installed-runtime live proof. No blocking findings.
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
senthilr-nv
enabled auto-merge (squash)
July 31, 2026 22:27
23 tasks
senthilr-nv
added a commit
that referenced
this pull request
Jul 31, 2026
<!-- markdownlint-disable MD041 --> ## Summary Make the trusted PR E2E coordinator account for the credential-window job that the workflow couples to every MCP bridge selection. This prevents successful evidence from being rejected as an unexpected job. ## Related Issue Prerequisite for #8024. ## Changes - Expand MCP bridge selections with the coupled credential-window job before dispatch. - Expect the coupled job's signed evidence during coordinator validation. - Add a regression test for the exact selection and shard contract. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: This changes only the internal trusted PR E2E coordinator and does not change supported product behavior. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The change preserves fail-closed SHA, plan, correlation, job, and shard validation and only adds the workflow-defined coupled job. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `no-docs-needed` - Evidence: `tools/e2e/pr-e2e-gate.mts`, `test/pr-e2e-gate-signal-shards.test.ts` - Agent: Codex Desktop <!-- docs-review-head-sha: a8e8406 --> <!-- docs-review-agents-blob-sha: 3dd7c24 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: 40 PR-gate tests and 14 MCP workflow-boundary tests passed. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com> --------- Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+479
to
+496
| const result = spawnSync( | ||
| "/bin/bash", | ||
| [ | ||
| "-c", | ||
| 'source "$1"; CLI="$2"; SANDBOX_NAME="deepagents-sandbox"; NEMOCLAW_E2E_DCODE_REBUILD_RETRY_DELAY_SECONDS=0; rebuild_named_sandbox disabled', | ||
| "bash", | ||
| dcodeApprovalCheck, | ||
| mockCli, | ||
| ], | ||
| { | ||
| encoding: "utf8", | ||
| env: { | ||
| ...process.env, | ||
| MOCK_REBUILD_COUNTER_FILE: counterFile, | ||
| MOCK_REBUILD_MODE: mode, | ||
| }, | ||
| }, | ||
| ); |
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
23 tasks
senthilr-nv
added a commit
that referenced
this pull request
Aug 1, 2026
<!-- markdownlint-disable MD041 --> ## Summary Adds the canonical dated changelog entry for `v0.0.100` so the maintainer release plan can verify the pre-tag documentation prerequisite. The entry summarizes the user-facing changes merged since `v0.0.99` and links to the relevant guides. ## Changes - Add `docs/changelog/2026-07-31.mdx` with the exact `## v0.0.100` heading. - Cover restored OpenClaw pairing, transactional replacement, Deep Agents Code, onboarding recovery, lifecycle cleanup, Hermes builds, host provenance, documentation, and trusted E2E evidence. - Distinguish active Docker and Kubernetes runtime-bundle enforcement from the still-inactive managed shared-state transaction foundation. ## Source Coverage The release entry maps the doc-impacting merged PRs in the `v0.0.99..main` release range to `docs/changelog/2026-07-31.mdx`: #8021, #8024, #7973, #8028, #7947, #7788, #7884, #8023, #7969, #8020, #7989, #8000, #7907, #7942, #7567, #8013, #7955, #8017, #8014, #8015, #7629, #7644, #7821, #7971, and #7991. PR #7974 was reviewed after the final rebase and excluded because it changes internal maintainer-skill attribution policy and tests only; it does not change a user-facing product or documentation surface. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: the changelog contract test validates the dated entry, version heading, SPDX form, and route constraints. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: `docs/changelog/2026-07-31.mdx`; exact-head review passed for `6093f44f`; writing rules and documentation style reviewed; `npx vitest run test/changelog-docs.test.ts` passed 6/6; `npm run docs` passed with zero Fern errors and two generic Fern upgrade notices. - Agent: Codex Desktop <!-- docs-review-head-sha: 6093f44 --> <!-- docs-review-agents-blob-sha: 3dd7c24 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: Not applicable; no DGX Station host script changed. - Station profile/scenario: Not applicable. - Result: Not applicable. - Supporting evidence: Not applicable. ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run validate:pr` passed after refreshing `origin/main` when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: `npx vitest run test/changelog-docs.test.ts` passed 6/6 at `6093f44f`. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not applicable to a dated prose-only release entry. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — validation passed with zero errors; Fern emitted two generic upgrade notices. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) — the changelog entry has the required parser-safe MDX SPDX header; dated changelog entries intentionally do not use page frontmatter. --- Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added release notes for v0.0.100. * Documented improvements to restore pairing, sandbox replacement, onboarding recovery, lifecycle cleanup, runtime handling, build support, host readiness, and end-to-end validation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Deep Agents Code managed MCP startup currently fails in OpenShell when seccomp rejects
memfd_createand the workspace-backed/tmprejectsO_TMPFILE. This change gives only Deep Agents Code a bounded private tmpfs and uses it for the existing anonymous snapshot fallback after validating the mount and preserving the descriptor integrity contract.Related Issue
Fixes #8018
Changes
/run/nemoclaw-dcode-mcpwith explicitnoexec, mode01777, and Docker-providednosuidandnodevdefaults that are verified at runtime./tmpto the private mount only forO_TMPFILEunsupported errors while preserving anonymous/unlinked mode000, a read-only descriptor, and file descriptor/device/inode/size/SHA-256 binding.The current requirement and consumer are issue #8018 and the managed Deep Agents Code MCP runtime. A direct
/tmpretry is insufficient because the supported OpenShell workspace mount rejectsO_TMPFILE;test/langchain-deepagents-code-managed-mcp-hardening.test.tsand the exact-main MCP proof protect the fallback contract.Type of Change
Quality Gates
Documentation Writer Review
docs-updateddocs/security/openshell-0.0.85-migration-review.md; all 16 changed files were independently reviewed at exact headd8bde4e79. The bounded fail-closed E2E timeout retry and its linear test assertion change no product behavior, and no additional documentation change was needed.DGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appears asVerifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run validate:prpassed after refreshingorigin/mainwhen hooks were skipped or unavailablenpm testfor broad runtime/test-harness changes;npm run checkfor repo-wide validation/coverage changes — command/result: Fresh trusted CI and selected live E2E are running for headd8bde4e7925941ef6b6f97086fd1103d0384046d.npm run docsbuilds without warnings (doc changes only)Signed-off-by: Julie Yaunches jyaunches@nvidia.com
Summary by CodeRabbit
Security
Reliability
Testing