Repository navigation
fix: bootstrap cli pairing when device list is gated - #6330
Merged
Merged
Conversation
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds an initial CLI auto-pair recovery path in the watcher, then extends unit and integration coverage for allowlisted CLI pairing, validation failures, retries, and related test-budget updates. ChangesInitial CLI auto-pair seed
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Watcher as start_auto_pair watcher
participant CLI as openclaw devices list
participant Approve as openclaw devices approve
participant State as pending.json / paired.json / device-auth.json
Watcher->>CLI: devices list --json
CLI-->>Watcher: pairing required / empty output
Watcher->>Watcher: parse requestId and validate initial CLI pairing
Watcher->>Approve: approve <requestId> --json
Approve-->>Watcher: approval result
Watcher->>State: update handled approvals and fast re-entry state
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
PR Review Advisor (Nemotron Ultra) — Changes requestedMerge posture: Do not merge yet Action checklist
Findings index
🚨 Required before mergeAddress these before merging unless a maintainer explicitly overrides the advisor with rationale.
|
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
E2E Target RecommendationRequired E2E targets: Dispatch required E2E targets:
Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings Action checklist
Findings index
Review findings by urgency: 0 required fixes, 1 item to resolve/justify, 1 in-scope improvement
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
scripts/nemoclaw-start.sh (1)
2497-2498: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDuplicate scope allowlist source of truth.
INITIAL_PAIRING_ALLOWED_SCOPESre-declares the same set asALLOWED_SCOPESinscripts/lib/openclaw_device_approval_policy.py(already loaded here viaload_approval_policy). If the policy's allowlist changes later, this copy can silently drift and either over- or under-restrict the bootstrap seed.♻️ Suggested fix: reuse the already-loaded policy constant
-approval_request_decision, gateway_approval_env = load_approval_policy(APPROVAL_POLICY_FILE) +approval_request_decision, gateway_approval_env, policy_allowed_scopes = load_approval_policy(APPROVAL_POLICY_FILE) ... -INITIAL_PAIRING_ALLOWED_SCOPES = {'operator.pairing', 'operator.read', 'operator.write'} +INITIAL_PAIRING_ALLOWED_SCOPES = policy_allowed_scopes(requires
load_approval_policyto also returnmodule.ALLOWED_SCOPES)Also applies to: 2573-2585
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/nemoclaw-start.sh` around lines 2497 - 2498, `INITIAL_PAIRING_ALLOWED_SCOPES` is duplicating the allowlist already defined by the loaded approval policy, so update the bootstrap logic in `scripts/nemoclaw-start.sh` to reuse the policy’s `ALLOWED_SCOPES` instead of hardcoding a second set. Extend `load_approval_policy` to return or expose `module.ALLOWED_SCOPES`, then use that value where `INITIAL_PAIRING_SCOPES` and `INITIAL_PAIRING_ALLOWED_SCOPES` are initialized so the bootstrap seed stays in sync with `openclaw_device_approval_policy`.test/nemoclaw-start-auto-pair-bootstrap.test.ts (1)
27-43: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winDuplicated clock-mocking heredoc-rewrite logic.
This helper (including the exact
_nemoclaw_test_clock/_nemoclaw_test_sleepinjection block) duplicates the equivalent logic intest/nemoclaw-start.test.ts(autoPairPythonScript, lines 177-189). Consider extracting a shared test utility (e.g. undertest/helpers) that both files import, so the mocking behavior can't silently drift between the two suites.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/nemoclaw-start-auto-pair-bootstrap.test.ts` around lines 27 - 43, The auto-pair script rewrite logic in autoPairPythonScript duplicates the same clock-mocking heredoc injection used in the other nemoclaw test suite, so extract the shared replacement behavior into a common test helper and have both autoPairPythonScript implementations call it. Keep the shared utility responsible for the _nemoclaw_test_clock, _nemoclaw_test_time, and _nemoclaw_test_sleep injection so the behavior stays consistent across both test files.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/nemoclaw-start.sh`:
- Around line 2590-2663: The initial CLI pairing flow in
seed_initial_cli_pairing_from_state updates pending.json, paired.json, and
device-auth.json independently, so the state can become inconsistent if another
writer races or the process crashes mid-write. Add a single guard around the
whole read/modify/write sequence in seed_initial_cli_pairing_from_state, or
re-check freshness before any write and abort if the files changed. Keep the
existing _write_json_atomic calls, but make them part of one protected
transaction so all three files stay in sync.
- Around line 2590-2663: Add bootstrap negative-path coverage for
seed_initial_cli_pairing_from_state by testing the failure branches that
currently return None or skip seeding: a persisted identity/public-key mismatch
in the device.json path, an already-paired device present in paired.json, and
the OPENCLAW_GATEWAY_TOKEN collision check after token generation. Use the
seed_initial_cli_pairing_from_state helper and the related
_identity_public_key/_same_initial_cli_requests flow so the tests directly
exercise the bootstrap logic rather than only the happy path.
In `@test/nemoclaw-start-auto-pair-bootstrap.test.ts`:
- Around line 14-18: The helper startScriptHeredoc currently introduces a new
conditional branch that triggers the guardrail; refactor it to avoid any if
statement while keeping the same behavior. Update the regex match handling in
startScriptHeredoc so it returns the captured heredoc content when present and
throws the same error when absent, but do so with a branchless expression
instead of control flow.
---
Nitpick comments:
In `@scripts/nemoclaw-start.sh`:
- Around line 2497-2498: `INITIAL_PAIRING_ALLOWED_SCOPES` is duplicating the
allowlist already defined by the loaded approval policy, so update the bootstrap
logic in `scripts/nemoclaw-start.sh` to reuse the policy’s `ALLOWED_SCOPES`
instead of hardcoding a second set. Extend `load_approval_policy` to return or
expose `module.ALLOWED_SCOPES`, then use that value where
`INITIAL_PAIRING_SCOPES` and `INITIAL_PAIRING_ALLOWED_SCOPES` are initialized so
the bootstrap seed stays in sync with `openclaw_device_approval_policy`.
In `@test/nemoclaw-start-auto-pair-bootstrap.test.ts`:
- Around line 27-43: The auto-pair script rewrite logic in autoPairPythonScript
duplicates the same clock-mocking heredoc injection used in the other nemoclaw
test suite, so extract the shared replacement behavior into a common test helper
and have both autoPairPythonScript implementations call it. Keep the shared
utility responsible for the _nemoclaw_test_clock, _nemoclaw_test_time, and
_nemoclaw_test_sleep injection so the behavior stays consistent across both test
files.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 0cf9e583-e3aa-4855-87be-9de2728ed236
📒 Files selected for processing (5)
ci/test-file-size-budget.jsonscripts/nemoclaw-start.shsrc/lib/actions/sandbox/auto-pair-approval.test.tstest/nemoclaw-start-auto-pair-bootstrap.test.tstest/nemoclaw-start.test.ts
Signed-off-by: Chengjie Wang <chengjiew@nvidia.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/nemoclaw-start-auto-pair-bootstrap.test.ts`:
- Line 146: The test title in the root-level integration test should include the
local issue reference suffix to match the test naming guideline. Update the
`it(...)` description in `nemoclaw-start-auto-pair-bootstrap.test.ts` so it
remains behavior-oriented and ends with the `(`#6113`)` suffix, keeping the change
localized to the affected test case.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 20273553-bdcd-44ab-b3bf-8bb8a2501fb9
📒 Files selected for processing (2)
scripts/nemoclaw-start.shtest/nemoclaw-start-auto-pair-bootstrap.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/nemoclaw-start.sh
Signed-off-by: Chengjie Wang <chengjiew@nvidia.com>
Signed-off-by: Chengjie Wang <chengjiew@nvidia.com>
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/nemoclaw-start-auto-pair-bootstrap.test.ts (1)
171-261: 📐 Maintainability & Code Quality | 🔵 TrivialExtract shared scaffolding to reduce duplication across the negative-path suites.
Each of these five blocks (rejected-pending fixtures, gated-list requestId errors, identity validation, malformed public key, and retry) repeats near-identical boilerplate:
mkdtempSync, writingdevice.json/pending.json, generating the fakeopenclawbash script,spawnSync, and thefinally { fs.rmSync(...) }cleanup. Factoring this into one or two helpers (e.g.setupAutoPairFixture({ identity, pending, openclawScript })andrunAutoPairWatcher(src, tmpDir, env)) would cut this file's size substantially and make future fixture variants cheaper to add without copy/paste drift.Also applies to: 263-355, 357-442, 444-512, 514-599
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/nemoclaw-start-auto-pair-bootstrap.test.ts` around lines 171 - 261, The negative-path auto-pair tests duplicate the same fixture setup, fake openclaw script creation, spawnSync invocation, and temp-dir cleanup across multiple blocks. Extract the repeated scaffolding into shared helpers such as setupAutoPairFixture and runAutoPairWatcher, then update the affected test cases to call those helpers while keeping each scenario’s specific identity/pending overrides and script behavior intact.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/nemoclaw-start-auto-pair-bootstrap.test.ts`:
- Around line 171-261: The negative-path auto-pair tests duplicate the same
fixture setup, fake openclaw script creation, spawnSync invocation, and temp-dir
cleanup across multiple blocks. Extract the repeated scaffolding into shared
helpers such as setupAutoPairFixture and runAutoPairWatcher, then update the
affected test cases to call those helpers while keeping each scenario’s specific
identity/pending overrides and script behavior intact.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 38807fd0-2190-4319-ad34-c87cc0d35503
📒 Files selected for processing (2)
scripts/nemoclaw-start.shtest/nemoclaw-start-auto-pair-bootstrap.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/nemoclaw-start.sh
This was referenced Jul 6, 2026
# Conflicts: # scripts/nemoclaw-start.sh
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28884729073
|
wscurran
added
the
area: cli
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28896008881
|
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28896000850
|
cv
requested changes
Jul 7, 2026
cv
left a comment
cv
left a comment
Collaborator
There was a problem hiding this comment.
Re-review of exact head 818b7c1: the fast-to-slow polling transition and embedded requestId validation are fixed, and standard attached CI is green.
Changes are still required for the remaining hard gates:
- 10 of 12 commits are unsigned/unverified. chengjiew is not covered by the maintainer waiver. Please rebuild this as compliant Verified history; if the published branch cannot be force-pushed, use a fresh branch and PR.
- The exact packaged first-run gated-list bootstrap is still not proven with real OpenClaw: the deterministic positive test uses a fake openclaw shell fixture. The required cloud-onboard job was not dispatched.
- Exact-head full-e2e failed twice at 188s and 183s against the 180s cold-onboard budget. Please provide a passing run or an explicit maintainer disposition of that repeated failure.
The ubuntu-repo-cloud-openclaw, sessions-agents-cli, and issue-4462-scope-upgrade-approval runs passed; CodeRabbit threads are resolved.
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28898782251
|
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28898779642
|
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28899404186
|
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28899402431
|
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28899786080
|
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28899784129
|
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28900218936
|
cv
requested changes
Jul 7, 2026
cv
left a comment
cv
left a comment
Collaborator
There was a problem hiding this comment.
Re-reviewing exact head 08b575c99e0ea2b0e65d7eb490442e13030df1b7.
The production issues from my prior review are resolved: the fast-to-slow transition runs before failure continuations, and embedded request IDs fail closed unless they match the map key. The three commits since 818b7c18 are Verified and test-only; the packaged cloud-onboard proof now forces a fresh gated rebootstrap, exact operator.pairing-only scopes, a successful device list, and a real gateway agent turn without fallback.
The hard contributor-compliance blocker remains: 10 of the 15 commits are GitHub unsigned/unverified. They are the original chengjiew commits, and that account is not covered by the maintainer waiver (which applies only to ericksoa and jyaunches). Please replace them with a clean Verified history; if force-push is unavailable, use a fresh branch and PR.
After the history is compliant, exact-head gates still need to settle. The E2E advisor requires cloud-onboard, issue-4462-scope-upgrade-approval, and device-auth-health. cloud-onboard and optional full-e2e are running, but the other two required exact-head targets have not been dispatched.
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28900217228
|
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28900735091
|
cv
requested changes
Jul 7, 2026
cv
left a comment
cv
left a comment
Collaborator
There was a problem hiding this comment.
Re-reviewing exact head 016cde3 with the updated maintainer policy.
Contributor compliance now passes: chengjiew is a team member explicitly exempted from commit signing, all six non-waived commits are GitHub Verified, the PR-body DCO declaration is present, and exact-head DCO CI passes. All attached CI is green and the branch is conflict-free.
I also adjudicated Nemotron PRA-1 as nonblocking. The gated first-pair path is intentionally narrower than the shared normal pending-list/scope-upgrade policy: it validates the same local identity and accepts only exact clientId/clientMode cli, operator role, and operator.pairing scope. The dependency review and inline source-boundary comment document that split, and the parameterized rejection test exercises the non-cli guard. Broadening this first-pair exception to every shared-policy client would weaken the fail-closed boundary. The primary exact-head advisor recommends merge_as_is.
The remaining blockers are live evidence:
- Required cloud-onboard failed on this exact head: https://github.com/NVIDIA/NemoClaw/actions/runs/28900735091/job/85736663178
It exited 22 with INITIAL_CLI_PAIRING_MARKER_MISSING. The watcher log showed only the normal approval/convergence path, so the new test still did not prove the gated-list fallback this PR adds. - The exact-head E2E advisor also requires issue-4462-scope-upgrade-approval; no exact-head run exists yet.
Please make the packaged proof reliably enter and observe the gated bootstrap, then pass both required exact-head targets. Commit signing is no longer a blocker.
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Contributor
E2E Target Results — ❌ Some jobs failedRun: 28901316811
|
Contributor
E2E Target Results — ✅ All requested jobs passedRun: 28901315087
|
Collaborator
|
Exact-head follow-up for the remaining validation gates on
All commits I authored during this investigation are DCO-signed and GitHub Verified. The previously reported legacy-history verification gate remains separate. |
cv
approved these changes
Jul 7, 2026
9 of 21 tasks
apurvvkumaria
added a commit
that referenced
this pull request
Jul 8, 2026
<!-- markdownlint-disable MD041 --> ## Summary Prepares the user-facing documentation for NemoClaw v0.0.76 and closes the release-prep documentation gate. It adds the release highlights, documents the arm64 Local NIM warning and expanded image cleanup behavior, and fixes agent-specific command headings in generated guides. ## Changes - Add the v0.0.76 release-notes section and move the shared-gateway route containment entry out of the v0.0.74 history where it was incorrectly placed. - Document the advisory Linux arm64 Local NIM manifest warning in the canonical platform matrix and local-inference guidance. - Document that `gc` scans both gateway-built and locally prebuilt sandbox image repositories. - Keep OpenClaw and Hermes session headings out of the generated Deep Agents command guide. - Add a focused variant regression test for the agent-specific session headings. ### Source summary | Merged sources | Documentation coverage | | --- | --- | | [#6414](#6414), [#6418](#6418), [#6416](#6416), [#6344](#6344) | v0.0.76 release notes and the Deep Agents quickstart/inference routes | | [#6340](#6340) | v0.0.76 release notes and existing Deep Agents observability guidance | | [#6338](#6338), [#6378](#6378), [#6297](#6297) | v0.0.76 release notes and existing inference/troubleshooting guidance | | [#6362](#6362) | v0.0.76 release notes and existing lifecycle, command, and credential guidance | | [#6330](#6330), [#6307](#6307), [#6008](#6008) | v0.0.76 release notes and existing security, troubleshooting, and command guidance | | [#6382](#6382) | v0.0.76 release notes and existing MCP/command guidance | | [#6326](#6326), [#5868](#5868), [#5539](#5539) | v0.0.76 release notes, platform matrix, inference options, and local-inference guidance | | [#6396](#6396), [#6390](#6390), [#6007](#6007) | v0.0.76 release notes and existing messaging guidance | | [#5388](#5388), [#6249](#6249), [#6303](#6303), [#6306](#6306) | v0.0.76 release notes and command/lifecycle guidance | ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run --project integration test/generate-platform-docs.test.ts test/agent-variant-docs.test.ts test/sync-agent-variant-docs.test.ts` (3 files, 29 tests passed) - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — completed with 0 errors and 2 pre-existing Fern warnings - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added v0.0.76 release notes content, and removed an older conflicting bullet from the surrounding release history. * Expanded Local NVIDIA NIM guidance across inference/provider docs, including an advisory for Linux arm64 DGX Spark/DGX Station hosts when a matching `linux/arm64` image manifest is unavailable. * Updated the command reference for correct session-section rendering and clarified `gc` image cleanup sources. * **Tests** * Added coverage ensuring Deep Agents omits sessions headings while Hermes includes them. * **CI** * Refreshed Local NVIDIA NIM provider notes used in the platform matrix. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
## Summary - bootstrap the initial local CLI pairing state when `openclaw devices list --json` is itself blocked by gateway pairing - keep the bootstrap narrowly scoped to the persisted same-device `cli` request and grant only `operator.pairing` - add NVIDIA#6113 regression coverage in a split test file and update existing auto-pair expectations for the `cli` client id Fixes NVIDIA#6113 ## Test Plan - [x] `npx vitest run --project integration test/nemoclaw-start-auto-pair-bootstrap.test.ts test/nemoclaw-start.test.ts -t "seeds an initial CLI pairing request|approves only known client identities|approves concurrent late CLI"` - [x] `npx vitest run --project cli src/lib/actions/sandbox/auto-pair-approval.test.ts -t "approves allowlisted upgrades"` - [x] `npx vitest run --project integration test/openclaw-device-approval-policy.test.ts` - [x] `npm run test-size:check` - [x] `git diff --check` - [x] `npm run check:diff` - [x] Linux live A/B on `aits-log-worker-6` / `ncq2621-latest-main`: before the new watcher, `openclaw devices list --json` returned `pairing required`; after running the new watcher against the same pending state, `devices list` returned `pending: []` and a paired `cli` device with `operator.pairing` only <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added deterministic “initial CLI pairing” recovery when device listing indicates pairing is required. * Extended auto-pairing to support an additional allowlisted CLI client identity. * **Bug Fixes** * Improved auto-pair approval failure logging with concise, formatted last-error output (and safer logging conditions). * **Tests** * Added/expanded coverage for initial CLI auto-pair bootstrap, including multiple validation and recovery scenarios. * Updated auto-pairing expectations and sandbox approval-pass assertions for the new CLI client. * **Chores** * Adjusted CI test file size budget for a specific test file. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: Chengjie Wang <chengjiew@nvidia.com> --------- Signed-off-by: Chengjie Wang <chengjiew@nvidia.com> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary Prepares the user-facing documentation for NemoClaw v0.0.76 and closes the release-prep documentation gate. It adds the release highlights, documents the arm64 Local NIM warning and expanded image cleanup behavior, and fixes agent-specific command headings in generated guides. ## Changes - Add the v0.0.76 release-notes section and move the shared-gateway route containment entry out of the v0.0.74 history where it was incorrectly placed. - Document the advisory Linux arm64 Local NIM manifest warning in the canonical platform matrix and local-inference guidance. - Document that `gc` scans both gateway-built and locally prebuilt sandbox image repositories. - Keep OpenClaw and Hermes session headings out of the generated Deep Agents command guide. - Add a focused variant regression test for the agent-specific session headings. ### Source summary | Merged sources | Documentation coverage | | --- | --- | | [NVIDIA#6414](NVIDIA#6414), [NVIDIA#6418](NVIDIA#6418), [NVIDIA#6416](NVIDIA#6416), [NVIDIA#6344](NVIDIA#6344) | v0.0.76 release notes and the Deep Agents quickstart/inference routes | | [NVIDIA#6340](NVIDIA#6340) | v0.0.76 release notes and existing Deep Agents observability guidance | | [NVIDIA#6338](NVIDIA#6338), [NVIDIA#6378](NVIDIA#6378), [NVIDIA#6297](NVIDIA#6297) | v0.0.76 release notes and existing inference/troubleshooting guidance | | [NVIDIA#6362](NVIDIA#6362) | v0.0.76 release notes and existing lifecycle, command, and credential guidance | | [NVIDIA#6330](NVIDIA#6330), [NVIDIA#6307](NVIDIA#6307), [NVIDIA#6008](NVIDIA#6008) | v0.0.76 release notes and existing security, troubleshooting, and command guidance | | [NVIDIA#6382](NVIDIA#6382) | v0.0.76 release notes and existing MCP/command guidance | | [NVIDIA#6326](NVIDIA#6326), [NVIDIA#5868](NVIDIA#5868), [NVIDIA#5539](NVIDIA#5539) | v0.0.76 release notes, platform matrix, inference options, and local-inference guidance | | [NVIDIA#6396](NVIDIA#6396), [NVIDIA#6390](NVIDIA#6390), [NVIDIA#6007](NVIDIA#6007) | v0.0.76 release notes and existing messaging guidance | | [NVIDIA#5388](NVIDIA#5388), [NVIDIA#6249](NVIDIA#6249), [NVIDIA#6303](NVIDIA#6303), [NVIDIA#6306](NVIDIA#6306) | v0.0.76 release notes and command/lifecycle guidance | ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [x] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run --project integration test/generate-platform-docs.test.ts test/agent-variant-docs.test.ts test/sync-agent-variant-docs.test.ts` (3 files, 29 tests passed) - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — completed with 0 errors and 2 pre-existing Fern warnings - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added v0.0.76 release notes content, and removed an older conflicting bullet from the surrounding release history. * Expanded Local NVIDIA NIM guidance across inference/provider docs, including an advisory for Linux arm64 DGX Spark/DGX Station hosts when a matching `linux/arm64` image manifest is unavailable. * Updated the command reference for correct session-section rendering and clarified `gc` image cleanup sources. * **Tests** * Added coverage ensuring Deep Agents omits sessions headings while Hermes includes them. * **CI** * Refreshed Local NVIDIA NIM provider notes used in the platform matrix. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
openclaw devices list --jsonis itself blocked by gateway pairingclirequest and grant onlyoperator.pairingcliclient idFixes #6113
Test Plan
npx vitest run --project integration test/nemoclaw-start-auto-pair-bootstrap.test.ts test/nemoclaw-start.test.ts -t "seeds an initial CLI pairing request|approves only known client identities|approves concurrent late CLI"npx vitest run --project cli src/lib/actions/sandbox/auto-pair-approval.test.ts -t "approves allowlisted upgrades"npx vitest run --project integration test/openclaw-device-approval-policy.test.tsnpm run test-size:checkgit diff --checknpm run check:diffaits-log-worker-6/ncq2621-latest-main: before the new watcher,openclaw devices list --jsonreturnedpairing required; after running the new watcher against the same pending state,devices listreturnedpending: []and a pairedclidevice withoperator.pairingonlySummary by CodeRabbit
Signed-off-by: Chengjie Wang chengjiew@nvidia.com