fix(security): update sandbox dependency fixes#7563
Conversation
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
senthilr-nv
added
area: docs
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a transactional npm ChangesSandbox remediation and image integration
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
PR Review Advisor — No blocking findings reportedAdvisor assessment: No blocking advisor findings reported Model lanes
Nemotron output stays in workflow artifacts and does not change the assessment above. E2E guidanceAdvisory only. E2E / PR Gate selects and runs jobs independently. Recommended E2E: 2 optional E2E recommendations
1 warning · 0 suggestionsWarningsWarnings do not block.
|
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
agents/hermes/Dockerfile.base (1)
61-62: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftPropagate the jq/vim-tiny security fix to both sandbox base images.
agents/hermes/Dockerfile.baseandagents/langchain-deepagents-code/Dockerfile.basestill installjq=1.7.1-6+deb13u2andvim-tiny=2:9.1.1230-2via plainapt-get, while the rootDockerfile.basenow uses the snapshot-pinned, hash-verified remediation. Mirror that install pattern here, or document why these images are excluded.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/hermes/Dockerfile.base` around lines 61 - 62, The jq and vim-tiny security fix must be propagated to both sandbox base images. Update the package-install sections in agents/hermes/Dockerfile.base (lines 61-62) and agents/langchain-deepagents-code/Dockerfile.base (lines 35-37) to mirror the root Dockerfile.base snapshot-pinned, hash-verified installation pattern, or document why either image is intentionally excluded.Source: Path instructions
🧹 Nitpick comments (2)
test/perl-critical-cve-remediation.test.ts (1)
140-154: 📐 Maintainability & Code Quality | 🔵 Trivial | 🏗️ Heavy liftBack these checks with behavioral validation.
These assertions only prove that the completed Dockerfile text contains the expected commands; they do not prove that the final image can load the modules at those versions or that the checks execute in the active
RUNchain. Keep this contract assertion if useful, but add or confirm an image-execution test for the runtime behavior.As per path instructions, tests should prefer observable outcomes through the public boundary over source-text assertions.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/perl-critical-cve-remediation.test.ts` around lines 140 - 154, Add behavioral coverage to the test around completedStage() that builds or runs the resulting image through its public execution boundary, verifying Perl loads each reviewed module at the required version and the checks execute successfully in the active RUN chain. Retain the existing runtime text assertions only as supplementary contract coverage, not as the sole validation.Source: Path instructions
docs/security/sandbox-base-2026-07-25-dependency-review.md (1)
12-19: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winKeep each sentence on one Markdown source line.
The new document wraps sentences across physical lines, including Lines 12-13, 16-17, and 18-19. Reflow the prose throughout
docs/security/sandbox-base-2026-07-25-dependency-review.mdso each sentence remains on one source line.As per coding guidelines, Markdown and MDX source files must keep one sentence per line.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/security/sandbox-base-2026-07-25-dependency-review.md` around lines 12 - 19, Reflow the prose throughout the dependency review document so every sentence occupies a single Markdown source line, including the sentences in the package replacement and verification list around vim, brace-expansion, Perl, and retained packages. Preserve the existing wording and list structure while removing only the physical line wraps.Sources: Coding guidelines, Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/helpers/base-apt-security-functions.ts`:
- Around line 90-91: Update the APT fixture cases in the mock curl and sha256sum
handling near the vim-tiny entries to recognize both amd64 and arm64 URL
patterns and their corresponding architecture-specific digests. Retain the
existing arm64 cases, and add the amd64 vim-tiny contract using the digest
expected by Dockerfile.base.
In `@test/patch-bundled-npm-brace-expansion.test.ts`:
- Around line 82-105: In the test “does not invoke npm or npx until the private
package is replaced and verified,” remove the commandRunner if statement and
express the verification as a boolean assertion that is true for non-npm/npx
commands or verifies the package state for npm/npx commands. Preserve the
existing command ordering and fixed-state expectations.
---
Outside diff comments:
In `@agents/hermes/Dockerfile.base`:
- Around line 61-62: The jq and vim-tiny security fix must be propagated to both
sandbox base images. Update the package-install sections in
agents/hermes/Dockerfile.base (lines 61-62) and
agents/langchain-deepagents-code/Dockerfile.base (lines 35-37) to mirror the
root Dockerfile.base snapshot-pinned, hash-verified installation pattern, or
document why either image is intentionally excluded.
---
Nitpick comments:
In `@docs/security/sandbox-base-2026-07-25-dependency-review.md`:
- Around line 12-19: Reflow the prose throughout the dependency review document
so every sentence occupies a single Markdown source line, including the
sentences in the package replacement and verification list around vim,
brace-expansion, Perl, and retained packages. Preserve the existing wording and
list structure while removing only the physical line wraps.
In `@test/perl-critical-cve-remediation.test.ts`:
- Around line 140-154: Add behavioral coverage to the test around
completedStage() that builds or runs the resulting image through its public
execution boundary, verifying Perl loads each reviewed module at the required
version and the checks execute successfully in the active RUN chain. Retain the
existing runtime text assertions only as supplementary contract coverage, not as
the sole validation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7ce811be-3b9a-41b7-8497-253b1646aea1
📒 Files selected for processing (19)
.github/workflows/base-image.yamlDockerfileDockerfile.baseagents/hermes/Dockerfileagents/hermes/Dockerfile.baseagents/langchain-deepagents-code/Dockerfileagents/langchain-deepagents-code/Dockerfile.basedocs/security/sandbox-base-2026-07-25-dependency-review.mdscripts/patch-bundled-npm-brace-expansion.mtssrc/lib/sandbox-base-image/source-identity.test.tssrc/lib/sandbox-base-image/source-identity.tssrc/lib/sandbox/build-context.tstest/bundled-npm-brace-expansion-dockerfile-contract.test.tstest/helpers/base-apt-security-functions.tstest/hermes-final-image-layout.test.tstest/openclaw-final-image-layout.test.tstest/patch-bundled-npm-brace-expansion.test.tstest/perl-critical-cve-remediation.test.tstest/sandbox-build-context.test.ts
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/patch-bundled-npm-brace-expansion.test.ts (1)
151-185: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winAssert that rejected layouts remain unchanged.
These cases only assert that patching throws. Also verify that the original
brace-expansiontree is still present (for example,old.jsremains), otherwise a regression that mutates the live tree before rejecting could pass the test. As per path instructions, tests should prove observable behavior rather than only the thrown error.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/patch-bundled-npm-brace-expansion.test.ts` around lines 151 - 185, Extend the rejected-layout cases in the test around patchBundledNpmBraceExpansion to verify the original brace-expansion tree remains unchanged after each expected throw, such as asserting its existing old.js member is still present. Keep the current error assertions and cover the drifted, unsafe replacement, symlinked npm tree, and escaping bin-link fixtures.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/patch-bundled-npm-brace-expansion.test.ts`:
- Around line 151-185: Extend the rejected-layout cases in the test around
patchBundledNpmBraceExpansion to verify the original brace-expansion tree
remains unchanged after each expected throw, such as asserting its existing
old.js member is still present. Keep the current error assertions and cover the
drifted, unsafe replacement, symlinked npm tree, and escaping bin-link fixtures.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 5c606c05-4171-4dae-8d05-1062ee9e2e21
📒 Files selected for processing (3)
docs/security/sandbox-base-2026-07-25-dependency-review.mdscripts/patch-bundled-npm-brace-expansion.mtstest/patch-bundled-npm-brace-expansion.test.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- docs/security/sandbox-base-2026-07-25-dependency-review.md
- scripts/patch-bundled-npm-brace-expansion.mts
|
Maintainer CI disposition for exact head The reviewed npm audit failed closed twice because the registry returned an For this exact revision, the deterministic CI lanes, CodeQL, CodeRabbit, The manual |
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
cv
left a comment
cv
left a comment
There was a problem hiding this comment.
Security remediation is incomplete at exact head 3db39af.
.github/workflows/base-image.yaml publishes the Hermes and LangChain DeepAgents base images as managed artifacts, but agents/hermes/Dockerfile.base and agents/langchain-deepagents-code/Dockerfile.base still install the affected Debian jq 1.7.1-6+deb13u2 and Vim 9.1.1230-2 packages. Only the root base image receives the fixed jq/Vim artifacts in this PR.
Please apply the remediation to every managed image consumer and extend exact-artifact validation for those images. Required E2E is also not yet green. This remains a security HOLD until the refreshed exact head passes the full dependency, image-artifact, CI, and E2E gates.
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
|
@cv The managed-image scope finding is addressed at exact head
The refreshed dependency, image-artifact, CI, and E2E gates are running now, so the security HOLD should remain until those exact-head results complete. Please re-review the implementation and artifact coverage for this head. |
cv
left a comment
cv
left a comment
There was a problem hiding this comment.
The latest head only merges current main; the audited remediation files are unchanged from 20d41f2, so two release-blocking defects remain. First, the Hermes and Deep Agents arm64 apt closure omits libonig5=6.9.9-1+b1; a real arm64 BuildKit execution reaches dpkg -i and fails while configuring libjq1/jq. Add the exact dependency and validate immutable per-image architecture/package inventories plus the installed final-image package/runtime/dpkg state. Second, the bundled-npm replacement leaves rollback armed while deleting the backup; a partial cleanup failure can enter rollback and delete the already-verified live tree. Disarm rollback immediately after the verified replacement becomes authoritative, before best-effort backup cleanup, and cover the partial-cleanup path. The dependency ledger also needs the complete package/range evidence for the final fixed set. Fresh exact-head docs/security review and CI/E2E are required after these changes.
|
Maintainer exact-head non-success disposition Reviewed PR head f3794f7 against base d525e15. The reviewed-npm-audit job failed closed because the npm audit endpoint returned an empty error payload. The trusted parser reported that audit metadata must be an object and recorded empty summary/detail fields. This reproduces the identical external response observed on the immediately preceding reviewed head and its exact-head retry. No advisory or policy report was produced, so this disposition does not claim that npm audit passed. For this exact revision, all eight CLI shards, static checks, build/typecheck, installer integration, plugin tests, WeChat runtime audit, CodeQL, DCO, documentation receipt, both automated advisor lanes, both native amd64/arm64 sandbox-image builds, and all four downstream image tests passed. Local exact-head validation also passed 68 tests across the source-identity and security remediation suites. The PR remains approved, mergeable, and conflict-free. The E2E observer cannot reach a successful prerequisite verdict because it correctly mirrors the failed npm-audit aggregate. This is a cross-repository PR, so the internal run-control-plane authorization path is not applicable and credential-bearing E2E was not dispatched. Repository secrets were not made available to fork code. Based on the exact-head deterministic CI, architecture builds, downstream image validation, security approval, and clean automated reviews, I accept the reviewed-npm-audit, aggregate/coordination, and required E2E non-success contexts for this exact head/base pair. This does not claim that npm audit or credentialed E2E passed. This disposition is invalid if either SHA changes. |
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
|
@cv Exact-head security re-review requested for The two release blockers from the prior review are addressed:
Focused exact-head evidence passes 69/69 tests; normal commit hooks, Hadolint, secret scanning, and docs validation also pass. Fresh GitHub CI and review checks are in progress. |
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
|
@cv Exact-head review target is now |
cv
left a comment
cv
left a comment
There was a problem hiding this comment.
Thank you—the exact libonig5 closure, rollback disarm-before-cleanup, partial-cleanup regression, and expanded ledger address those findings, and the focused dependency suites pass. Two blockers remain on this head. (1) The exact package/runtime checks still run only in intermediate base-image layers and extracted/stubbed RUN-chain tests; no immutable per-image inventory or completed-final-image assertion binds the shipped OpenClaw, Hermes, and Deep Agents images to the reviewed architecture and exact libexpat1, libonig5, libjq1, jq, vim-common, and vim-tiny identities. Emit a root-owned immutable inventory in each base and reassert its metadata/content plus dpkg identities, jq→libonig linkage/runtime probes, and empty dpkg --audit in each final Dockerfile, with final-image contract coverage. (2) codebase-growth-guardrails fails because test/patch-bundled-npm-brace-expansion.test.ts adds a test-body if; move the injected branch into a named setup helper or otherwise keep the test body linear. Rerun exact docs/security review and full CI/E2E after the next head.
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
|
@cv Exact-head security re-review requested for The remaining completed-image blocker is addressed:
Normal commit/pre-push hooks, Hadolint, secret scanning, and docs validation pass. Fresh GitHub CI and multi-architecture image builds are starting on this head. |
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
|
@cv Final exact-head review target is |
|
@cv Refreshed exact-head review target: |
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
|
@cv Exact-head re-review target is now |
Signed-off-by: Senthil Ravichandran <senthilr@nvidia.com>
|
@cv Final exact-head review target is |
|
Maintainer exact-head non-success disposition Reviewed PR head The For this exact revision, all eight CLI shards and their aggregate, static checks, build/typecheck, installer integration, plugin tests, WeChat runtime audit, growth guardrails, DCO, documentation receipt, CodeQL, platform E2E, and repository security checks passed. Both native amd64 and arm64 production-image builds passed, followed by all four downstream sandbox smoke, isolation, port-override, and E2E image tests. The primary PR Review Advisor recommends merge-as-is with zero blockers, warnings, or suggestions; its optional second-opinion lane is not relied upon. The E2E observer cannot reach a successful prerequisite verdict because it correctly mirrors the failed npm-audit aggregate. This is a cross-repository PR, so the internal run-control-plane authorization path is not applicable and credential-bearing E2E was not dispatched. Repository secrets were not made available to fork code. Based on the exact-head deterministic CI, both architecture builds, downstream image validation, clean primary automated review, and the repeated external audit response, I accept the This disposition is invalid if either SHA changes. |
|
@cv Exact-head security approval requested for |
|
@cv Refreshed exact-head review target is |
|
@cv Exact head |
<!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 plain sentences: what changes and why. Describe before-and-after behavior when it applies. Follow the NemoClaw Writing Guide: https://github.com/NVIDIA/NemoClaw/blob/main/WRITING.md. Do not add unrelated prose cleanup. --> The reviewed npm audit gate currently fails immediately when the registry returns an incomplete JSON response. This change retries only incomplete or timed-out scans within a fixed 138-second budget, continues to evaluate complete vulnerability reports immediately, and still fails closed when the retry budget is exhausted. ## Changes <!-- List concrete changes. If this adds an abstraction, configuration, fallback, migration, or compatibility path, name its current requirement and consumer, explain why a direct change is insufficient, and identify the test that protects it. --> - Bound each `npm audit --omit=dev --json` attempt to 45 seconds and retry incomplete scans after fixed 1-second and 2-second delays. - Preserve immediate policy evaluation for every structurally complete audit report, including reports containing blocking vulnerabilities. - Fail closed after three incomplete attempts and retain the final report and failure provenance. - Sanitize transient retry warnings to stable reason codes so registry diagnostics, credentials, and control text cannot enter CI logs. - Add focused regressions for incomplete responses, scanner timeouts, retry exhaustion, blocking vulnerability reports, non-timeout process errors, and diagnostic redaction. ## Type of Change - [x] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates <!-- Check one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [x] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [ ] Tests not applicable — justification: - [ ] Docs updated for user-facing behavior changes - [x] Docs not applicable — justification: This changes an internal trusted CI audit retry boundary without changing supported commands, configuration, APIs, policy, or user workflows. - [x] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [x] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: A nine-category security review passed exact current-main head `293ed408a`. The final refresh adds only byte-identical upstream changes from merged PRs #7563 and #7578; the three PR-authored audit files are unchanged. Complete vulnerability reports still evaluate immediately, retry exhaustion remains fail-closed, and both transient and terminal diagnostics are redacted with negative regression coverage. - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review <!-- Required for code and documentation changes after the changes and applicable validation are complete. Keep one review checkbox and one instance of each visible or hidden field. For Evidence, list changed documentation paths. For documentation-only changes, also state that the writing rules and documentation style were reviewed. For other results, explain why no documentation change is needed or why the review is blocked. For Agent, use a consistent product and surface name, such as Codex Desktop, Codex CLI, Claude Code, or Cursor. After committing all review changes, put `git rev-parse --short HEAD` and `git rev-parse --short HEAD:AGENTS.md` in the hidden metadata below. Rerun the review and refresh that metadata after any new commit. This receipt is advisory during the data-collection pilot. --> - [x] Documentation writer subagent reviewed the completed changes - Result: `no-docs-needed` - Evidence: Exact head `293ed408a` changes only the internal reviewed-npm-audit helper and its tests relative to current main. The merge-only changes from #7563 and #7578 match main byte-for-byte. No user-facing CLI, configuration, API, or supported workflow contract changes. No comments were added; the new test titles precisely describe retry/backoff, timeout, non-timeout error, complete-report, and exhausted-budget behavior. No documentation or Fern build input changed. - Agent: Codex Desktop <!-- docs-review-head-sha: 293ed40 --> <!-- docs-review-agents-blob-sha: be20a09 --> ## DGX Station Hardware Evidence <!-- Required only when scripts/prepare-dgx-station-host.sh changes. Maintainers must review the linked evidence before approving or merging. This is human-reviewed evidence, not authenticated hardware provenance. Exceptional bypasses use existing repository governance and must be documented on the PR. --> - [ ] Tested on DGX Station - Tested commit: Not applicable - Station profile/scenario: Not applicable - Result: Not applicable - Supporting evidence: Not applicable ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — exact refreshed head: `npx vitest run --project integration test/reviewed-npm-audit.test.ts test/reviewed-npm-audit-workflow.test.ts`: 39 passed; the normal pre-push CLI TypeScript and package/tag version checks passed. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [ ] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> --------- Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com>
<!-- markdownlint-disable MD041 --> ## Summary Add the canonical `docs/changelog/2026-07-25.mdx` release entry with the exact `## v0.0.96` heading. The entry reconciles all 90 first-parent commits since v0.0.95 with all 92 merged PRs in the live `v0.0.96` label ledger and groups the user-visible changes by operator journey. ## Changes - Add the parser-safe dated MDX changelog entry for v0.0.96 with root-absolute links to the focused user guides. - Source summary: - [#7194](#7194) -> `docs/changelog/2026-07-25.mdx`: Document persistent baseline network policy exclusions and their inspection, rebuild, and snapshot behavior. - [#7188](#7188), [#7427](#7427), and [#7546](#7546) -> `docs/changelog/2026-07-25.mdx`: Document DNS-backed HTTPS inference routing, keyless loopback endpoints, and provider-marker isolation. - [#7238](#7238) -> `docs/changelog/2026-07-25.mdx`: Document blueprint sandbox and provider identifier validation before state writes or OpenShell calls, with bounded terminal-safe rejection previews. - [#7319](#7319), [#7274](#7274), [#7528](#7528), [#7353](#7353), and [#7560](#7560) -> `docs/changelog/2026-07-25.mdx`: Document the managed default gateway service, onboarding readiness, and container-runtime identity safeguards. - [#7349](#7349), [#7498](#7498), [#7406](#7406), [#7196](#7196), [#7559](#7559), [#7421](#7421), [#7510](#7510), [#7295](#7295), and [#7565](#7565) -> `docs/changelog/2026-07-25.mdx`: Document gateway-scoped status, lifecycle diagnostics, managed MCP recovery, delete-edge safeguards, and fail-closed CLI prompt and command output. - [#7591](#7591) -> `docs/changelog/2026-07-25.mdx`: Document opt-in authenticated MCP tool-name discovery, its bounded and names-only contract, probe interaction, and rebuild requirement. - [#7305](#7305), [#7480](#7480), [#7471](#7471), [#7365](#7365), and [#7541](#7541) -> `docs/changelog/2026-07-25.mdx`: Document installer version checks, version-tag reporting, license guidance, WSL Ollama selection, and DGX Station vLLM detection. - [#7482](#7482), [#7466](#7466), [#7208](#7208), [#7434](#7434), and [#7586](#7586) -> `docs/changelog/2026-07-25.mdx`: Document Ollama resource details, reasoning precedence, Hermes onboarding behavior, and preserved managed Hermes BuildKit failures. - [#6830](#6830), [#7492](#7492), [#7563](#7563), and [#7582](#7582) -> `docs/changelog/2026-07-25.mdx`: Document the authoritative OpenClaw production lock, fixed managed-image dependencies, immutable Hermes base adoption, and Hermes image-size reduction. - [#7505](#7505), [#7530](#7530), [#7547](#7547), [#7508](#7508), [#7548](#7548), [#7549](#7549), [#7537](#7537), [#7534](#7534), [#7515](#7515), [#7511](#7511), [#7551](#7551), [#7562](#7562), [#7575](#7575), [#7496](#7496), [#7594](#7594), [#7595](#7595), and [#7599](#7599) -> `docs/changelog/2026-07-25.mdx`: Summarize release validation, transient and bounded dispatch reconciliation, exact pre-tag qualification, identity revalidation, npm-audit retry, sharding, image reuse, timeout, telemetry, and workflow-hardening changes. - Reconciled without separate changelog prose: - [#7539](#7539), [#7526](#7526), [#7507](#7507), [#7506](#7506), [#7519](#7519), [#7516](#7516), [#7396](#7396), [#7254](#7254), [#7583](#7583), [#7596](#7596), and [#7598](#7598): Test-harness or fixture-only changes. - [#7403](#7403), [#7161](#7161), [#6877](#6877), [#7531](#7531), [#7525](#7525), [#7522](#7522), [#7536](#7536), [#7552](#7552), [#7566](#7566), [#7553](#7553), [#7561](#7561), [#7577](#7577), [#7569](#7569), [#7585](#7585), [#7584](#7584), [#7592](#7592), [#7580](#7580), [#7571](#7571), [#7517](#7517), [#7589](#7589), [#7402](#7402), [#7558](#7558), [#7544](#7544), and [#7601](#7601): Dependency, internal recovery, validation, contributor-workflow, E2E optimization, telemetry, or CI trust changes with no separate user-facing release claim. - [#7556](#7556), [#7573](#7573), [#7576](#7576), and [#7578](#7578): Experimental repository-maintainer conflict automation with no canonical user documentation surface. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates - [ ] Tests added or updated for changed behavior - [x] Existing tests cover changed behavior — justification: `test/changelog-docs.test.ts` validates dated changelog structure, version headings, and published links. - [ ] Tests not applicable — justification: - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `docs-updated` - Evidence: Reviewed `docs/changelog/2026-07-25.mdx` at exact head `0f5dedb47` against 90 first-parent release commits and 92 merged PRs labeled `v0.0.96`. Verified parser-safe MDX SPDX, the exact version heading, literal CLI names, writing style, skip terms, all 20 root-absolute published links, and the accepted #7591 opt-in authenticated discovery bounds. #7544, #7599, and #7601 remain internal or CI-only release-ledger entries. Changelog tests passed 6/6, the docs build passed with 0 errors and two pre-existing Fern warnings, and `npm run check:diff` plus the final diff check passed. - Agent: Codex Desktop documentation-writer subagent <!-- docs-review-head-sha: 0f5dedb --> <!-- docs-review-agents-blob-sha: be20a09 --> ## DGX Station Hardware Evidence - [ ] Tested on DGX Station - Tested commit: - Station profile/scenario: - Result: - Supporting evidence: ## Verification - [x] PR description includes a `Signed-off-by:` line and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — `npx vitest run test/changelog-docs.test.ts`: 6/6 passed. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: Not applicable to this prose-only changelog entry. - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) — the build passed with 0 errors and 2 existing Fern warnings; the published-route check passed. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) — native changelog files use the required parser-safe MDX SPDX comment and no frontmatter. --- Signed-off-by: Carlos Villela <cvillela@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Persistent network policy exclusions with consistent restore/exclusion reporting across rebuilds/snapshots. * Opt-in MCP tool discovery via `mcp status --tools` with bounded, redacted authenticated traffic. * Improved HTTPS inference switching for custom endpoints and refreshed onboarding/model menu details. * Refined OpenShell gateway defaults for port `8080`, including more reliable readiness checks. * **Bug Fixes** * Prevent incorrect provider/model restoration after compatible-provider update failures. * Preserve managed MCP state after exec loss and tighten gateway/doctor status scoping. * **Tests** * Stronger, fail-closed release validation with hardened evidence/artifact handoff and bounded timeouts/retries. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com>
3 participants
Summary
Update every managed sandbox base image to the same checksum-bound fixed Vim,
jq, and Expat package boundary. The image build also remediates npm's private
brace-expansioncopy and verifies the fixed Perl component versions.Changes
libexpat1=2.8.2-1,libonig5=6.9.9-1+b1,libjq1=1.8.2-1,jq=1.8.2-1,vim-common=2:9.2.0782-1, andvim-tiny=2:9.2.0782-1from one immutable Debian snapshot in the OpenClaw,Hermes, and Deep Agents Code base images. Verify architecture-specific
SHA-256 values before installation, then check every dpkg identity and
exercise the jq, Oniguruma, Expat, and Vim runtimes. Emit the architecture
and exact package identities as a root-owned, read-only inventory.
brace-expansion@5.0.7package inside reviewednpm@11.18.0with the SRI-pinned5.0.8registry archive. The helperrejects identity or layout drift, unsafe archive contents, duplicates, and
every symlink except a
node_modules/.binlink to a regular file inside thereviewed
node_modulesroot. It replaces the complete directorytransactionally, disarms rollback after the verified replacement becomes
authoritative, retries backup cleanup without risking the live tree, and
verifies npm and npx only after the fixed package is active.
Agents base-image npm upgrade. Reassert the contract in each completed image
because the completed filesystem is the published dependency boundary.
Socket,Storable,HTTP::Tiny,IO::Compress::Base,IO::Uncompress::Unzip, andFile::GlobMapperversions included in thechecksum-pinned Perl 5.44.0 package.
the Hermes and Deep Agents Code images to the same artifact boundary.
package identities, jq-to-Oniguruma linkage, jq/Expat/Vim runtime probes,
and an empty dpkg audit in each completed managed image.
and optimized sandbox build contexts.
RUN-chain execution and checksum-rejection tests for allthree managed base images on amd64 and arm64. Add behavior, pre-swap and
post-swap rollback, layout-drift, command-order, image-order, and
real-artifact tests. Record the public dependency review and removal
conditions in
docs/security/sandbox-base-2026-07-25-dependency-review.md.Type of Change
Quality Gates
onboarding, inference, runner, sandbox, or messaging)
reviewer/approval link/justification: Exact-head review pending after
resolving the immutable jq closure, completed-image inventory, and npm
rollback findings.
name, approval link, and follow-up issue: Current exact-head CI is pending
after the clean current-main refresh. The prior disposition is invalid
because the head and base SHAs changed.
Documentation Writer Review
docs-updateddocs/security/sandbox-base-2026-07-25-dependency-review.md; the exact-headreview confirmed the dependency identities, compatibility contracts,
concern dispositions, removal conditions, changed comments, and test titles.
It covered all three managed base images, both architectures, the
checksum/runtime contracts, and npm rollback evidence. It also confirmed
that the public diff contains no internal identifiers, private paths, scan
counts, assignees, or confidential audit context. The exact-head rerun
verified the complete jq runtime closure, corrected rollback state
transition, partial-cleanup test, and complete package/range ledger. The
exact-head follow-up confirmed that the growth-guard fixture refactor is
behavior-neutral and requires no documentation change. The latest exact-head
review verified the root-owned inventory and completed-image assertions for
all three images and both architectures. The exact-head follow-up confirmed
that the canonical instruction digest preserves trusted remote-dashboard
staging without weakening rejection of noncanonical post-generator rewrites.
The refreshed exact-head review confirmed the clean current-main merge only
carries upstream conflict-fixer changes and does not alter the remediation.
The latest exact-head follow-up confirmed the test-only base-APT fixture fix
redirects the immutable inventory into temporary directories with exact
root-ownership operation validation and requires no documentation change.
The final fixture compaction preserves those exact operations while keeping
the changed test file below its repository size budget.
The refreshed exact-head review confirmed that the clean fix(ci): publish validated conflict resolution trees #7576 current-main
merge is byte-for-byte identical to upstream in its two conflict-publisher
files and has no remediation or documentation overlap.
DGX Station Hardware Evidence
Verification
Signed-off-by:line and every commit appearsas
Verifiedin GitHubpre-commit,commit-msg, andpre-pushhooks passed, ornpm run check:diffpassed when hooks were skipped or unavailablemarked not applicable above — the exact package and npm rollback suites
passed 18 tests; relevant base-runtime provisioning passed 6 tests; bundled
npm, Deep Agents Code, Perl, and applicable Hermes layout contracts passed.
The one broader Hermes macOS permission fixture failure is unrelated to the
changed package layer and is not claimed as passing evidence. The exact
Hermes apt fixture that failed in CI now passes 10 tests after the current
main refresh. The refreshed exact head passes 76 focused tests, including
18 exact base/completed-image package matrix cases for all three images and
both architectures, plus the injected partial backup cleanup. The dashboard
lifecycle and security matrix regression selection passes 52/52. After the
current-main refresh, the complete relevant regression selection passes
110/110 plus the Hermes structural contract. The two full base-APT fixture
cases that failed on Linux CI now pass 2/2, and the exact security package
matrix remains green at 18/18. Hadolint passed for all six base/final
Dockerfiles, and
npm run docspassed. After the latest current-mainrefresh, the upstream conflict-publisher suite passes 12/12 and CLI
type-checking passes alongside the unchanged 2/2 and 18/18 remediation
regressions.
npm testfor broadruntime/test-harness changes;
npm run checkfor repo-widevalidation/coverage changes — command/result: Not run. The change is scoped
to reviewed image dependencies and focused contracts.
npm run docsbuilds without warnings (doc changes only) — the buildpassed with zero errors and two existing Fern warnings
guide
(doc changes only)
The new dependency review has the required SPDX header. It follows the
established plain-Markdown
docs/security/*-dependency-review.mdaudit-recordpattern, which does not use Fern frontmatter.
Signed-off-by: Senthil Ravichandran senthilr@nvidia.com