fix(inference): use NVIDIA inference credential env#5366
Merged
Conversation
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughRename NVIDIA API credential to ChangesNVIDIA inference key and endpoint migration
Estimated code review effort: Possibly related PRs:
Suggested labels: Suggested reviewers:
✨ Finishing Touches🧪 Generate unit tests (beta)
|
Contributor
|
🌿 Preview your docs: https://nvidia-preview-pr-5366.docs.buildwithfern.com/nemoclaw |
cv
changed the title
Contributor
E2E Advisor RecommendationRequired E2E: Dispatch hint: Auto-dispatched E2E: Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
Dispatch hint
|
Contributor
Vitest E2E Scenario RecommendationRequired Vitest E2E scenarios: Dispatch required Vitest E2E scenarios:
Full Vitest E2E advisor summaryVitest E2E Scenario AdvisorBase: Required Vitest E2E scenarios
Optional Vitest E2E scenarios
Relevant changed files
|
Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Contributor
PR Review AdvisorFindings: 3 needs attention, 6 worth checking, 0 nice ideas Review findings🛠️ Needs attention
🔎 Worth checking
🌱 Nice ideas
Consider writing more tests for
Since last review detailsCurrent findings:
This is an automated advisory review. A human maintainer must make the final merge decision. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 13
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (9)
test/e2e-scenario/manifests/hermes-nvidia-slack.yaml (1)
1-1: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winMissing SPDX header across YAML manifests (
hermes-nvidia-slack.yaml,openclaw-nvidia-resume.yaml, andopenclaw-nvidia-double-same-provider.yaml).All three changed YAML manifests are missing the required SPDX license header at the top of the file. Please add the SPDX header consistently to each manifest.
As per coding guidelines, all*.yamlfiles must include SPDX headers.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-scenario/manifests/hermes-nvidia-slack.yaml` at line 1, Add the required SPDX license header to the top of each YAML manifest (hermes-nvidia-slack.yaml, openclaw-nvidia-resume.yaml, openclaw-nvidia-double-same-provider.yaml) by inserting the standard single-line header comment, e.g. "# SPDX-License-Identifier: Apache-2.0", as the very first line of each file so it precedes any YAML content such as "apiVersion" entries.Source: Coding guidelines
test/e2e-scenario/manifests/hermes-nvidia.yaml (1)
1-1: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd required SPDX license header.
YAML files must include an SPDX license header. Add the following at the top of the file:
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. # SPDX-License-Identifier: Apache-2.0As per coding guidelines, all source files including YAML must include an SPDX license header.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-scenario/manifests/hermes-nvidia.yaml` at line 1, Add the required SPDX header to the very top of hermes-nvidia.yaml (above the existing apiVersion: nemoclaw.io/v1 line) by inserting the two SPDX lines specified in the review: the SPDX-FileCopyrightText line for NVIDIA CORPORATION & AFFILIATES and the SPDX-License-Identifier: Apache-2.0 line so the YAML includes the mandated license header.Source: Coding guidelines
test/e2e-scenario/manifests/openclaw-nvidia-rebuild.yaml (1)
1-1: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winAdd the required SPDX header to this YAML file.
This file is missing the mandatory SPDX license header for YAML sources.
Proposed fix
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 apiVersion: nemoclaw.io/v1 kind: NemoClawInstanceAs per coding guidelines, all
*.yaml/*.ymlsource files must include SPDX headers.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-scenario/manifests/openclaw-nvidia-rebuild.yaml` at line 1, Add the mandatory SPDX license header at the top of the YAML file (before the apiVersion line) to satisfy project policy; update test/e2e-scenario/manifests/openclaw-nvidia-rebuild.yaml by inserting the SPDX header line (e.g., "SPDX-License-Identifier: <LICENSE-ID>") as the first non-comment line so the file begins with the required SPDX identifier above apiVersion: nemoclaw.io/v1.Source: Coding guidelines
test/e2e-scenario/manifests/openclaw-nvidia-brev-launchable.yaml (1)
1-1: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winShared compliance root cause: missing SPDX headers in YAML manifests.
Bothtest/e2e-scenario/manifests/openclaw-nvidia-brev-launchable.yamlandtest/e2e-scenario/manifests/openclaw-nvidia-brave.yamlneed SPDX headers to satisfy repository license-header policy for YAML files.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-scenario/manifests/openclaw-nvidia-brev-launchable.yaml` at line 1, Add the required SPDX license header to the top of the YAML manifest(s) that start with "apiVersion: nemoclaw.io/v1" so they comply with the repository license-header policy; insert a single-line SPDX tag (e.g., "SPDX-License-Identifier: <LICENSE>") or the project's canonical multi-line SPDX header immediately above the apiVersion line in both manifests that contain "apiVersion: nemoclaw.io/v1" to satisfy license checks.Source: Coding guidelines
test/e2e-scenario/manifests/openclaw-nvidia-custom-policies.yaml (1)
1-1: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winMissing SPDX license header.
This YAML file is missing the required SPDX license header. As per coding guidelines, all source files matching
**/*.{yaml,yml}must include an SPDX license header.📝 Proposed fix
Add the following header at the top of the file:
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + apiVersion: nemoclaw.io/v1🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-scenario/manifests/openclaw-nvidia-custom-policies.yaml` at line 1, This file is missing the required SPDX license header; add the SPDX header as the very first lines of the YAML (above the existing "apiVersion: nemoclaw.io/v1" line) so all files matching **/*.{yaml,yml} include the license header required by project guidelines; ensure the header is formatted as a YAML comment (prefixed with #) and placed before any content so tools and linters detect it.Source: Coding guidelines
test/e2e-scenario/manifests/openclaw-nvidia-macos.yaml (1)
1-1: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winMissing SPDX license header.
This YAML file is missing the required SPDX license header. As per coding guidelines, all source files matching
**/*.{yaml,yml}must include an SPDX license header.📝 Proposed fix
Add the following header at the top of the file:
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + apiVersion: nemoclaw.io/v1🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-scenario/manifests/openclaw-nvidia-macos.yaml` at line 1, This file is missing the required SPDX license header; add a single SPDX header line at the very top of the YAML (above the existing "apiVersion: nemoclaw.io/v1") using the project's required identifier (e.g., "SPDX-License-Identifier: Apache-2.0" or the license specified by project policy) so all YAML files match the SPDX header requirement.Source: Coding guidelines
test/e2e-scenario/manifests/openclaw-nvidia-gateway-port-conflict.yaml (1)
1-1: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd the required SPDX header to this YAML source file.
This file is missing the repository-required SPDX license header for source files.
As per coding guidelines, all files matching
**/*.{js,ts,tsx,jsx,sh,md,mdx,json,yaml,yml,css,svg}must include the SPDX copyright and license header.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-scenario/manifests/openclaw-nvidia-gateway-port-conflict.yaml` at line 1, Add the repository-required SPDX copyright and license header at the top of this YAML file (the file whose first line is "apiVersion: nemoclaw.io/v1"); prepend the standard SPDX header used across the repo to the very beginning of the file so the YAML still starts with the header followed by the existing apiVersion and content.Source: Coding guidelines
test/e2e-scenario/manifests/openclaw-nvidia-no-docker-negative.yaml (1)
1-1: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winAdd the required SPDX header to this YAML file.
This manifest is missing the required SPDX license header for YAML source files.
Proposed fix
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + apiVersion: nemoclaw.io/v1 kind: NemoClawInstance metadata:As per coding guidelines,
**/*.{js,ts,tsx,jsx,sh,md,mdx,json,yaml,yml,css,svg}files must include SPDX headers.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/e2e-scenario/manifests/openclaw-nvidia-no-docker-negative.yaml` at line 1, This YAML manifest is missing the required SPDX license header; add the project's standard SPDX header as a YAML comment at the very top of the file (placed before the existing apiVersion: nemoclaw.io/v1 line) using the same SPDX-License-Identifier value used by other repo YAML files so the file begins with the SPDX header comment.Source: Coding guidelines
docs/inference/inference-options.mdx (1)
44-44: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winStale NVIDIA endpoint in provider status table
Line 44 still says hosted models are on
integrate.api.nvidia.com, which conflicts with the migrated hosted endpoint and can misdirect users during setup.Proposed doc fix
-| NVIDIA Endpoints | Tested | OpenAI-compatible | Hosted models on integrate.api.nvidia.com | +| NVIDIA Endpoints | Tested | OpenAI-compatible | Hosted models on inference-api.nvidia.com |🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/inference/inference-options.mdx` at line 44, Update the stale NVIDIA endpoint in the provider status table: locate the row labeled "NVIDIA Endpoints" in docs/inference/inference-options.mdx (the table cell containing the string "integrate.api.nvidia.com") and replace that domain with the migrated hosted endpoint URL used by NVIDIA's hosted models; confirm the entry is accurate and consistent with the migrated endpoint used elsewhere in the docs and tests.
🧹 Nitpick comments (3)
src/lib/credentials/store.ts (1)
747-748: 📐 Maintainability & Code Quality | 💤 Low valueRedundant
process.envassignment.
saveCredential(line 747) already setsprocess.env.NVIDIA_INFERENCE_API_KEYinternally. The explicit assignment on line 748 is redundant.♻️ Suggested simplification
saveCredential("NVIDIA_INFERENCE_API_KEY", key); - process.env.NVIDIA_INFERENCE_API_KEY = key;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/credentials/store.ts` around lines 747 - 748, The explicit assignment to process.env.NVIDIA_INFERENCE_API_KEY is redundant because saveCredential already sets that environment variable; remove the duplicate line "process.env.NVIDIA_INFERENCE_API_KEY = key" and keep the single call to saveCredential("NVIDIA_INFERENCE_API_KEY", key) (or if you prefer an explicit env write, ensure saveCredential does not also set process.env to avoid duplication) so only one place updates the environment variable.src/lib/inference/health.test.ts (1)
250-274: 📐 Maintainability & Code Quality | ⚡ Quick winAdd a legacy-alias coverage case for credential lookup.
Given migration support for
NVIDIA_API_KEY, add a focused test asserting Kimi probe behavior when only the legacy alias is available, to prevent regressions in the compatibility path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/inference/health.test.ts` around lines 250 - 274, Add a new unit test alongside the existing Kimi credential test that verifies the legacy alias lookup (NVIDIA_API_KEY) is honored: call probeRemoteProviderHealth("nvidia-prod", ...) with model "moonshotai/kimi-k2.6", a getCredentialImpl stub that returns a credential only for the legacy name "NVIDIA_API_KEY" (and null for other names), and a runCurlProbeImpl that should not be invoked; then assert the probe result indicates no network probe was performed (probed false), result.ok true, endpoint equals BUILD_ENDPOINT_URL + "/chat/completions", and result.detail contains both "NVIDIA_INFERENCE_API_KEY" and a note about "provider-level /models" to ensure the compatibility path is covered.test/ollama-proxy-recovery.test.ts (1)
170-170: 🔒 Security & Privacy | ⚡ Quick winKeep legacy alias leak coverage in this proxy-env assertion.
The migration keeps
NVIDIA_API_KEYas a legacy alias, but this test now only asserts scrubbing ofNVIDIA_INFERENCE_API_KEY. Add a legacy alias injection + assertion here too, so leakage regressions on legacy env setups are still caught.Suggested test hardening
env: { ...process.env, HTTP_PROXY: "http://proxy.invalid:8888", HOME: tmpDir, NVIDIA_INFERENCE_API_KEY: "must-not-leak", + NVIDIA_API_KEY: "must-not-leak-legacy", NO_PROXY: "", }, }); @@ assert.equal(payload.proxySpawns.length, 0); assert.equal(payload.curlEnv.NVIDIA_INFERENCE_API_KEY, undefined); + assert.equal(payload.curlEnv.NVIDIA_API_KEY, undefined); assert.equal(payload.curlEnv.HTTP_PROXY, "http://proxy.invalid:8888");Also applies to: 181-181
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/ollama-proxy-recovery.test.ts` at line 170, Add the legacy alias injection and assertion: when the test injects NVIDIA_INFERENCE_API_KEY: "must-not-leak" into the proxy env, also inject NVIDIA_API_KEY: "must-not-leak" and extend the existing scrubbed-environment assertion (the same assertion that checks NVIDIA_INFERENCE_API_KEY is removed) to assert that NVIDIA_API_KEY is also scrubbed from the proxied response; apply this addition at both locations where NVIDIA_INFERENCE_API_KEY is set in the test.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/network-policy/approve-network-requests.mdx`:
- Line 67: Split the single line containing "The walkthrough requires tmux and
the `NVIDIA_INFERENCE_API_KEY` environment variable, and it assumes an existing
sandbox to attach to." into two sentences, placing each sentence on its own
line: one line stating the tmux and NVIDIA_INFERENCE_API_KEY requirement, and
the next line stating the assumption about an existing sandbox to attach to;
ensure line breaks are literal (one sentence per line) to follow the
one-sentence-per-line documentation guideline.
In `@nemoclaw/src/index.ts`:
- Around line 286-288: The ternary that sets the label based on
providerCredentialEnv mislabels the legacy NVIDIA alias; update the condition in
that expression (the code using providerCredentialEnv) to treat both
"NVIDIA_INFERENCE_API_KEY" and the legacy "NVIDIA_API_KEY" as NVIDIA keys (e.g.,
check providerCredentialEnv === "NVIDIA_INFERENCE_API_KEY" ||
providerCredentialEnv === "NVIDIA_API_KEY") so the label becomes "NVIDIA API Key
(…)" for either value, otherwise fall back to the OpenAI label.
In `@scripts/nemoclaw-start.sh`:
- Around line 1703-1704: The startup script currently returns early if
NVIDIA_INFERENCE_API_KEY is unset, skipping write_auth_profile; update the check
so it preserves legacy NVIDIA_API_KEY by treating NVIDIA_API_KEY as a valid
fallback before returning or before calling write_auth_profile (i.e., if
NVIDIA_INFERENCE_API_KEY is empty but NVIDIA_API_KEY is set, use that value for
the auth profile generation), and ensure write_auth_profile uses the resolved
key variable; reference the conditional around NVIDIA_INFERENCE_API_KEY and the
write_auth_profile invocation to implement the fallback logic.
In `@src/lib/diagnostics/debug.test.ts`:
- Around line 20-22: The test description expects to validate redaction of
"NVIDIA_INFERENCE_API_KEY" but the test builds "NVIDIA_API_KEY"; update the test
to construct or use the correct canonical key ("NVIDIA_INFERENCE_API_KEY") so
the assertion against redact(...) checks the renamed key; locate the spec in
src/lib/diagnostics/debug.test.ts (the it block that calls redact) and change
the key variable or literal to include "INFERENCE" (e.g.,
["NVIDIA","INFERENCE","API","KEY"].join("_") or the string
"NVIDIA_INFERENCE_API_KEY") and keep the expectation toBe(`${key}=<REDACTED>`).
In `@src/lib/inference/nim.ts`:
- Around line 824-830: The ngcApiKey resolver currently omits the legacy
environment name; update the ngcApiKey assignment (the const ngcApiKey and its
resolution chain that references opts.ngcApiKey, process.env.NGC_API_KEY, and
process.env.NVIDIA_INFERENCE_API_KEY) to also include process.env.NVIDIA_API_KEY
as a fallback before or alongside process.env.NVIDIA_INFERENCE_API_KEY so legacy
NVIDIA_API_KEY users continue to authenticate; ensure the precedence remains:
explicit opts.ngcApiKey, then NGC_API_KEY, then NVIDIA_API_KEY (legacy), then
NVIDIA_INFERENCE_API_KEY, and finally default to an empty string.
In `@src/lib/onboard.ts`:
- Around line 3649-3656: The code uses getCredential(...) to decide whether to
let NEMOCLAW_PROVIDER_KEY fill NVIDIA_INFERENCE_API_KEY, which allows stored
credentials to block an explicit environment override; change the gate to only
consider raw environment variables so exported NEMOCLAW_PROVIDER_KEY can
override stored creds. Specifically, in the block that computes _nvProviderKey
and existingNvidiaKey, replace the getCredential(...) checks with direct checks
of process.env.NVIDIA_INFERENCE_API_KEY and process.env.NVIDIA_API_KEY
(trimmed/empty), and only set process.env.NVIDIA_INFERENCE_API_KEY =
_nvProviderKey when those raw env vars are absent.
In `@test/e2e/test-hermes-discord-e2e.sh`:
- Around line 604-607: Phase 8 currently only backs up and unsets
NVIDIA_INFERENCE_API_KEY (NVIDIA_INFERENCE_API_KEY_BACKUP /
NVIDIA_INFERENCE_API_KEY) but must also handle the legacy alias NVIDIA_API_KEY;
update the rebuild credential-isolation step to similarly back up NVIDIA_API_KEY
(e.g., NVIDIA_API_KEY_BACKUP="${NVIDIA_API_KEY:-}"), unset NVIDIA_API_KEY before
the test assertion so the gateway must provide the credential, and ensure both
NVIDIA_INFERENCE_API_KEY and NVIDIA_API_KEY are restored from their backups at
the end of the step.
In `@test/e2e/test-hermes-e2e.sh`:
- Around line 206-210: The reachability probe uses an unauthenticated curl which
treats a 401 as failure; update the check to use the NVIDIA_INFERENCE_API_KEY by
adding an Authorization header (e.g. "Authorization: Bearer
${NVIDIA_INFERENCE_API_KEY}") to the curl invocation and ensure the script
verifies NVIDIA_INFERENCE_API_KEY is non-empty before the probe; keep using the
same pass/fail handlers (pass, fail) and preserve --max-time/quiet flags so the
probe reports true network connectivity rather than unauthenticated 401s.
In `@test/e2e/test-kimi-inference-compat.sh`:
- Around line 397-398: The unset list in the test script leaves the legacy
NVIDIA_API_KEY variable intact, which can leak credentials; update the unset
commands (the block that currently unsets NVIDIA_INFERENCE_API_KEY
OPENAI_API_KEY ANTHROPIC_API_KEY GEMINI_API_KEY and the block that unsets
TELEGRAM_BOT_TOKEN DISCORD_BOT_TOKEN SLACK_BOT_TOKEN SLACK_APP_TOKEN) to also
include NVIDIA_API_KEY so the legacy alias is cleared before onboarding.
In `@test/e2e/test-messaging-providers.sh`:
- Around line 636-640: The check currently hard-fails when the
NVIDA_INFERENCE_API_KEY env var is empty; change the guard in the script so it
first prefers NVIDIA_INFERENCE_API_KEY but falls back to the legacy
NVIDIA_API_KEY before calling fail. Update the conditional around the check that
calls fail/pass (the block referencing NVIDIA_INFERENCE_API_KEY, NVIDIA_API_KEY,
fail, and pass) to test for ${NVIDIA_INFERENCE_API_KEY:-${NVIDIA_API_KEY:-}} and
only call fail if both are empty, and ensure pass prints when either value is
present.
In `@test/no-direct-credential-env.test.ts`:
- Around line 20-23: Add back explicit legacy NVIDIA key tests: in the test case
arrays that currently include 'process.env.NVIDIA_INFERENCE_API_KEY = "test";'
and "process.env.OPENAI_API_KEY = value;", add one write-allowed test string
'process.env.NVIDIA_API_KEY = "test";' and one flag-read test that references
the legacy env var (e.g. a read/usage case containing
'process.env.NVIDIA_API_KEY') so the suite continues to assert legacy alias
support alongside NVIDIA_INFERENCE_API_KEY and OPENAI_API_KEY.
In `@test/onboard-selection-vllm.test.ts`:
- Line 426: Tests currently only clear process.env.NVIDIA_INFERENCE_API_KEY
which lets the legacy alias process.env.NVIDIA_API_KEY leak state; update the
teardown/setup in the test to clear both environment names (e.g., delete
process.env.NVIDIA_INFERENCE_API_KEY and delete process.env.NVIDIA_API_KEY or
assign undefined/"" for both) so the test is hermetic and cannot be influenced
by the legacy variable.
In `@test/rebuild-credential-hydration.test.ts`:
- Around line 111-115: The test removed legacy NVIDIA alias coverage by only
asserting canonical "NVIDIA_INFERENCE_API_KEY" in the "NVIDIA Endpoints" test
case; restore explicit legacy-key assertions by adding parallel test entries
that use the legacy env name "NVIDIA_API_KEY" (same value "nvapi-test-hydrate")
so the migration behavior is still validated—update the test data used by
rebuild-credential-hydration.test.ts (and mirror the same change in
no-direct-credential-env.test.ts) ensuring the cases reference the "NVIDIA
Endpoints" case name or its test data object and include both credentialEnv:
"NVIDIA_INFERENCE_API_KEY" and credentialEnv: "NVIDIA_API_KEY".
---
Outside diff comments:
In `@docs/inference/inference-options.mdx`:
- Line 44: Update the stale NVIDIA endpoint in the provider status table: locate
the row labeled "NVIDIA Endpoints" in docs/inference/inference-options.mdx (the
table cell containing the string "integrate.api.nvidia.com") and replace that
domain with the migrated hosted endpoint URL used by NVIDIA's hosted models;
confirm the entry is accurate and consistent with the migrated endpoint used
elsewhere in the docs and tests.
In `@test/e2e-scenario/manifests/hermes-nvidia-slack.yaml`:
- Line 1: Add the required SPDX license header to the top of each YAML manifest
(hermes-nvidia-slack.yaml, openclaw-nvidia-resume.yaml,
openclaw-nvidia-double-same-provider.yaml) by inserting the standard single-line
header comment, e.g. "# SPDX-License-Identifier: Apache-2.0", as the very first
line of each file so it precedes any YAML content such as "apiVersion" entries.
In `@test/e2e-scenario/manifests/hermes-nvidia.yaml`:
- Line 1: Add the required SPDX header to the very top of hermes-nvidia.yaml
(above the existing apiVersion: nemoclaw.io/v1 line) by inserting the two SPDX
lines specified in the review: the SPDX-FileCopyrightText line for NVIDIA
CORPORATION & AFFILIATES and the SPDX-License-Identifier: Apache-2.0 line so the
YAML includes the mandated license header.
In `@test/e2e-scenario/manifests/openclaw-nvidia-brev-launchable.yaml`:
- Line 1: Add the required SPDX license header to the top of the YAML
manifest(s) that start with "apiVersion: nemoclaw.io/v1" so they comply with the
repository license-header policy; insert a single-line SPDX tag (e.g.,
"SPDX-License-Identifier: <LICENSE>") or the project's canonical multi-line SPDX
header immediately above the apiVersion line in both manifests that contain
"apiVersion: nemoclaw.io/v1" to satisfy license checks.
In `@test/e2e-scenario/manifests/openclaw-nvidia-custom-policies.yaml`:
- Line 1: This file is missing the required SPDX license header; add the SPDX
header as the very first lines of the YAML (above the existing "apiVersion:
nemoclaw.io/v1" line) so all files matching **/*.{yaml,yml} include the license
header required by project guidelines; ensure the header is formatted as a YAML
comment (prefixed with #) and placed before any content so tools and linters
detect it.
In `@test/e2e-scenario/manifests/openclaw-nvidia-gateway-port-conflict.yaml`:
- Line 1: Add the repository-required SPDX copyright and license header at the
top of this YAML file (the file whose first line is "apiVersion:
nemoclaw.io/v1"); prepend the standard SPDX header used across the repo to the
very beginning of the file so the YAML still starts with the header followed by
the existing apiVersion and content.
In `@test/e2e-scenario/manifests/openclaw-nvidia-macos.yaml`:
- Line 1: This file is missing the required SPDX license header; add a single
SPDX header line at the very top of the YAML (above the existing "apiVersion:
nemoclaw.io/v1") using the project's required identifier (e.g.,
"SPDX-License-Identifier: Apache-2.0" or the license specified by project
policy) so all YAML files match the SPDX header requirement.
In `@test/e2e-scenario/manifests/openclaw-nvidia-no-docker-negative.yaml`:
- Line 1: This YAML manifest is missing the required SPDX license header; add
the project's standard SPDX header as a YAML comment at the very top of the file
(placed before the existing apiVersion: nemoclaw.io/v1 line) using the same
SPDX-License-Identifier value used by other repo YAML files so the file begins
with the SPDX header comment.
In `@test/e2e-scenario/manifests/openclaw-nvidia-rebuild.yaml`:
- Line 1: Add the mandatory SPDX license header at the top of the YAML file
(before the apiVersion line) to satisfy project policy; update
test/e2e-scenario/manifests/openclaw-nvidia-rebuild.yaml by inserting the SPDX
header line (e.g., "SPDX-License-Identifier: <LICENSE-ID>") as the first
non-comment line so the file begins with the required SPDX identifier above
apiVersion: nemoclaw.io/v1.
---
Nitpick comments:
In `@src/lib/credentials/store.ts`:
- Around line 747-748: The explicit assignment to
process.env.NVIDIA_INFERENCE_API_KEY is redundant because saveCredential already
sets that environment variable; remove the duplicate line
"process.env.NVIDIA_INFERENCE_API_KEY = key" and keep the single call to
saveCredential("NVIDIA_INFERENCE_API_KEY", key) (or if you prefer an explicit
env write, ensure saveCredential does not also set process.env to avoid
duplication) so only one place updates the environment variable.
In `@src/lib/inference/health.test.ts`:
- Around line 250-274: Add a new unit test alongside the existing Kimi
credential test that verifies the legacy alias lookup (NVIDIA_API_KEY) is
honored: call probeRemoteProviderHealth("nvidia-prod", ...) with model
"moonshotai/kimi-k2.6", a getCredentialImpl stub that returns a credential only
for the legacy name "NVIDIA_API_KEY" (and null for other names), and a
runCurlProbeImpl that should not be invoked; then assert the probe result
indicates no network probe was performed (probed false), result.ok true,
endpoint equals BUILD_ENDPOINT_URL + "/chat/completions", and result.detail
contains both "NVIDIA_INFERENCE_API_KEY" and a note about "provider-level
/models" to ensure the compatibility path is covered.
In `@test/ollama-proxy-recovery.test.ts`:
- Line 170: Add the legacy alias injection and assertion: when the test injects
NVIDIA_INFERENCE_API_KEY: "must-not-leak" into the proxy env, also inject
NVIDIA_API_KEY: "must-not-leak" and extend the existing scrubbed-environment
assertion (the same assertion that checks NVIDIA_INFERENCE_API_KEY is removed)
to assert that NVIDIA_API_KEY is also scrubbed from the proxied response; apply
this addition at both locations where NVIDIA_INFERENCE_API_KEY is set in the
test.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 039fc6a9-ea08-401d-9a2e-0fe1f2bd1ea1
📒 Files selected for processing (234)
.github/workflows/brev-nightly-e2e.yaml.github/workflows/e2e-branch-validation.yaml.github/workflows/e2e-script.yaml.github/workflows/e2e-vitest-scenarios.yaml.github/workflows/macos-e2e.yaml.github/workflows/nightly-e2e.yaml.github/workflows/regression-e2e.yaml.github/workflows/wsl-e2e.yamlagents/hermes/policy-additions.yamlagents/hermes/policy-permissive.yamlagents/openclaw/policy-permissive.yamldocs/_components/StarterPromptButton.tsxdocs/about/release-notes.mdxdocs/get-started/quickstart-hermes.mdxdocs/get-started/quickstart.mdxdocs/inference/inference-options.mdxdocs/network-policy/approve-network-requests.mdxdocs/reference/network-policies.mdxdocs/reference/troubleshooting.mdxdocs/security/best-practices.mdxdocs/security/credential-storage.mdxnemoclaw-blueprint/blueprint.yamlnemoclaw-blueprint/policies/openclaw-sandbox-permissive.yamlnemoclaw-blueprint/policies/openclaw-sandbox.yamlnemoclaw-blueprint/router/pool-config.yamlnemoclaw-blueprint/scripts/nemotron-inference-fix.jsnemoclaw/src/banner.test.tsnemoclaw/src/blueprint/runner.test.tsnemoclaw/src/blueprint/ssrf.test.tsnemoclaw/src/commands/config-show.test.tsnemoclaw/src/commands/slash.test.tsnemoclaw/src/index.tsnemoclaw/src/lib/subprocess-env.tsnemoclaw/src/onboard/config.test.tsnemoclaw/src/register.test.tsnemoclaw/src/security/secret-scanner.test.tsscripts/checks/direct-credential-env.tsscripts/install.shscripts/nemoclaw-start.shscripts/smoke-macos-install.shscripts/validate-configs.tsscripts/walkthrough.shsrc/commands/sandbox/config/rotate-token.tssrc/lib/actions/dev/npm-link-or-shim.test.tssrc/lib/actions/sandbox/status.test.tssrc/lib/credentials/store.tssrc/lib/deploy/index.test.tssrc/lib/deploy/index.tssrc/lib/diagnostics/debug.test.tssrc/lib/diagnostics/debug.tssrc/lib/inference/health.test.tssrc/lib/inference/health.tssrc/lib/inference/model-prompts.test.tssrc/lib/inference/model-prompts.tssrc/lib/inference/nim.test.tssrc/lib/inference/nim.tssrc/lib/inference/onboard-probes.test.tssrc/lib/inference/provider-models.tssrc/lib/messaging-channel-config.test.tssrc/lib/onboard.tssrc/lib/onboard/bridge-dns-preflight.tssrc/lib/onboard/docker-gpu-patch.test.tssrc/lib/onboard/host-dns-preflight.test.tssrc/lib/onboard/initial-policy.test.tssrc/lib/onboard/machine/core-flow-phases.test.tssrc/lib/onboard/machine/flow-phases/provider-sandbox.test.tssrc/lib/onboard/machine/handlers/finalization.test.tssrc/lib/onboard/machine/handlers/policies.test.tssrc/lib/onboard/machine/handlers/provider-inference.test.tssrc/lib/onboard/machine/runtime.test.tssrc/lib/onboard/missing-credential-hints.tssrc/lib/onboard/model-router.tssrc/lib/onboard/preflight.tssrc/lib/onboard/providers.test.tssrc/lib/onboard/providers.tssrc/lib/onboard/routed-inference.test.tssrc/lib/onboard/routed-inference.tssrc/lib/onboard/summary.test.tssrc/lib/onboard/validation-recovery-prompt.tssrc/lib/security/credential-filter.test.tssrc/lib/security/redact.test.tssrc/lib/security/redact.tssrc/lib/state/onboard-session.test.tssrc/lib/state/onboard-step-mutation.test.tssrc/lib/subprocess-env.tssrc/lib/trace.test.tssrc/lib/validation.test.tssrc/lib/validation.tstest/canonical-credential-resolution.test.tstest/check-env-var-docs.test.tstest/cli/dispatch-basics.test.tstest/config-set-nested-ssrf.test.tstest/credential-exposure.test.tstest/credentials-cli-command.test.tstest/credentials-shim.test.tstest/credentials.test.tstest/e2e-runtime/4851-ultra-toolless-validation.mdtest/e2e-scenario/fixtures/phases/onboarding.tstest/e2e-scenario/live/credential-migration.test.tstest/e2e-scenario/live/credential-sanitization.test.tstest/e2e-scenario/live/gateway-guard-recovery.test.tstest/e2e-scenario/live/hermes-e2e.test.tstest/e2e-scenario/live/inference-routing.test.tstest/e2e-scenario/live/issue-4434-tui-unreachable-inference.test.tstest/e2e-scenario/live/launchable-smoke.test.tstest/e2e-scenario/live/model-router-provider-routed-inference.test.tstest/e2e-scenario/live/network-policy.test.tstest/e2e-scenario/live/onboard-negative-paths.test.tstest/e2e-scenario/live/onboard-resume.test.tstest/e2e-scenario/live/openclaw-tui-chat-correlation.test.tstest/e2e-scenario/live/rebuild-openclaw.test.tstest/e2e-scenario/live/sandbox-operations.test.tstest/e2e-scenario/live/sandbox-rebuild.test.tstest/e2e-scenario/live/sandbox-survival.test.tstest/e2e-scenario/live/shields-config.test.tstest/e2e-scenario/live/skill-agent.test.tstest/e2e-scenario/live/token-rotation.test.tstest/e2e-scenario/live/whatsapp-qr-compact.test.tstest/e2e-scenario/manifests/hermes-nvidia-discord.yamltest/e2e-scenario/manifests/hermes-nvidia-slack.yamltest/e2e-scenario/manifests/hermes-nvidia.yamltest/e2e-scenario/manifests/openclaw-nvidia-brave.yamltest/e2e-scenario/manifests/openclaw-nvidia-brev-launchable.yamltest/e2e-scenario/manifests/openclaw-nvidia-custom-policies.yamltest/e2e-scenario/manifests/openclaw-nvidia-discord.yamltest/e2e-scenario/manifests/openclaw-nvidia-double-provider-switch.yamltest/e2e-scenario/manifests/openclaw-nvidia-double-same-provider.yamltest/e2e-scenario/manifests/openclaw-nvidia-gateway-port-conflict.yamltest/e2e-scenario/manifests/openclaw-nvidia-invalid-key.yamltest/e2e-scenario/manifests/openclaw-nvidia-macos.yamltest/e2e-scenario/manifests/openclaw-nvidia-no-docker-negative.yamltest/e2e-scenario/manifests/openclaw-nvidia-post-reboot-recovery.yamltest/e2e-scenario/manifests/openclaw-nvidia-rebuild.yamltest/e2e-scenario/manifests/openclaw-nvidia-repair.yamltest/e2e-scenario/manifests/openclaw-nvidia-resume.yamltest/e2e-scenario/manifests/openclaw-nvidia-slack.yamltest/e2e-scenario/manifests/openclaw-nvidia-telegram.yamltest/e2e-scenario/manifests/openclaw-nvidia-token-rotation.yamltest/e2e-scenario/manifests/openclaw-nvidia-wsl.yamltest/e2e-scenario/manifests/openclaw-nvidia.yamltest/e2e-scenario/scenarios/scenarios/baseline.tstest/e2e-scenario/scenarios/types.tstest/e2e-scenario/support-tests/docker-probe.test.tstest/e2e-scenario/support-tests/e2e-fixture-context.test.tstest/e2e-scenario/support-tests/e2e-manifests.test.tstest/e2e-scenario/support-tests/e2e-phase-environment.test.tstest/e2e-scenario/support-tests/e2e-phase-onboarding.test.tstest/e2e-scenario/support-tests/e2e-phase-state-validation.test.tstest/e2e-scenario/support-tests/e2e-scenario-matrix.test.tstest/e2e-scenario/support-tests/e2e-scenarios-workflow.test.tstest/e2e-scenario/support-tests/network-policy-transient-provider.test.tstest/e2e-script-workflow.test.tstest/e2e/brev-e2e.test.tstest/e2e/e2e-cloud-experimental/expect-interactive-install.shtest/e2e/e2e-cloud-experimental/features/skill/add-sandbox-skill.shtest/e2e/e2e-cloud-experimental/features/skill/verify-sandbox-skill-via-agent.shtest/e2e/e2e-cloud-experimental/test-port8080-conflict.shtest/e2e/test-agent-turn-latency-e2e.shtest/e2e/test-bedrock-runtime-compatible-anthropic.shtest/e2e/test-brave-search-e2e.shtest/e2e/test-channels-add-remove.shtest/e2e/test-channels-stop-start.shtest/e2e/test-cloud-inference-e2e.shtest/e2e/test-cloud-onboard-e2e.shtest/e2e/test-common-egress-agent-e2e.shtest/e2e/test-credential-migration.shtest/e2e/test-credential-sanitization.shtest/e2e/test-cron-preflight-inference-local-e2e.shtest/e2e/test-device-auth-health.shtest/e2e/test-diagnostics.shtest/e2e/test-double-onboard.shtest/e2e/test-full-e2e.shtest/e2e/test-hermes-discord-e2e.shtest/e2e/test-hermes-e2e.shtest/e2e/test-hermes-inference-switch.shtest/e2e/test-hermes-slack-e2e.shtest/e2e/test-inference-routing.shtest/e2e/test-issue-2478-crash-loop-recovery.shtest/e2e/test-issue-4434-tui-unreachable-inference.shtest/e2e/test-issue-4462-scope-upgrade-approval.shtest/e2e/test-kimi-inference-compat.shtest/e2e/test-launchable-smoke.shtest/e2e/test-messaging-providers.shtest/e2e/test-model-router-provider-routed-inference.shtest/e2e/test-network-policy.shtest/e2e/test-onboard-negative-paths.shtest/e2e/test-onboard-repair.shtest/e2e/test-onboard-resume.shtest/e2e/test-openclaw-discord-pairing.shtest/e2e/test-openclaw-inference-switch.shtest/e2e/test-openclaw-plugin-runtime-exdev.shtest/e2e/test-openclaw-skill-cli-e2e.shtest/e2e/test-openclaw-slack-pairing.shtest/e2e/test-overlayfs-autofix.shtest/e2e/test-rebuild-hermes.shtest/e2e/test-rebuild-openclaw.shtest/e2e/test-sandbox-operations.shtest/e2e/test-sandbox-rebuild.shtest/e2e/test-sandbox-survival.shtest/e2e/test-sessions-agents-cli.shtest/e2e/test-shields-config.shtest/e2e/test-skill-agent-e2e.shtest/e2e/test-snapshot-commands.shtest/e2e/test-state-backup-restore.shtest/e2e/test-telegram-injection.shtest/e2e/test-token-rotation.shtest/e2e/test-tunnel-lifecycle.shtest/e2e/test-upgrade-stale-sandbox.shtest/gateway-state-reconcile-2276.test.tstest/generate-openclaw-config.test.tstest/helpers/onboard-final-flow-phases.tstest/host-artifact-cleanup.test.tstest/nemoclaw-start.test.tstest/nemotron-inference-fix.test.tstest/no-direct-credential-env.test.tstest/ollama-proxy-recovery.test.tstest/onboard-messaging.test.tstest/onboard-model-router.test.tstest/onboard-selection-vllm.test.tstest/onboard-selection.test.tstest/onboard.test.tstest/openclaw-config-snapshot.test.tstest/rebuild-credential-hydration.test.tstest/rebuild-credential-preflight.test.tstest/rebuild-shields-auto-unlock.test.tstest/rebuild-stale-recovery.test.tstest/regression-e2e-workflow.test.tstest/runner.test.tstest/secret-redaction.test.tstest/smoke-macos-install.test.tstest/validate-blueprint.test.tstest/validate-config-schemas.test.tstest/validate-configs-dangerous-hosts.test.tstools/e2e-scenarios/workflow-boundary.mts
💤 Files with no reviewable changes (5)
- agents/openclaw/policy-permissive.yaml
- agents/hermes/policy-permissive.yaml
- agents/hermes/policy-additions.yaml
- nemoclaw-blueprint/policies/openclaw-sandbox.yaml
- nemoclaw-blueprint/policies/openclaw-sandbox-permissive.yaml
cv
changed the title
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
agents/hermes/policy-additions.yaml (1)
62-62: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winInconsistent Python binary restrictions between network policies.
The
managed_inferencepolicy (line 62) tightens the Python binary allowlist to the specific/usr/bin/python3.11, but thenvidiapolicy (line 80) retains the wildcard/usr/bin/python3*. This creates an inconsistency within the same file.If the Python version is being tightened for security or compatibility reasons, both policies should be updated consistently. If there's a specific reason
managed_inferencerequires Python 3.11 butnvidiacan work with any 3.x version, that rationale should be documented.Additionally, this Python version tightening is not mentioned in the PR summary, suggesting possible scope creep beyond the credential/endpoint rename.
As per coding guidelines, changes that tighten the python runtime path may require corresponding updates in this file. The current state leaves an unexplained discrepancy between the two policies.
Also applies to: 80-80
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/hermes/policy-additions.yaml` at line 62, The managed_inference policy currently restricts the Python binary to /usr/bin/python3.11 while the nvidia policy still allows /usr/bin/python3*; make these policies consistent by choosing one allowlist format and applying it to both policy blocks (update the list entry in the managed_inference and nvidia policy definitions to the same path), or if they must differ, add a comment in the file and a note in the PR summary explaining why managed_inference requires Python 3.11 while nvidia accepts any 3.x binary; ensure the change is applied to the Python binary entries in both policy definitions (managed_inference, nvidia) and update documentation/PR description accordingly.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@nemoclaw/src/blueprint/runner.test.ts`:
- Around line 667-670: In the blueprint runner tests the NVIDIA endpoint host
string used in policy additions is incorrect; update every policy addition that
sets host: "integrate.api.nvidia.com" to host: "inference-api.nvidia.com" so the
tests validate the intended runtime target (search for the test blocks that
create policies with a host property, e.g., the policy addition objects in
runner.test.ts around the policy-add/test helper code referenced at the shown
diffs and the other occurrences noted).
In `@nemoclaw/src/commands/config-show.test.ts`:
- Line 39: Update the test fixtures' endpointUrl value from
"https://integrate.api.nvidia.com/v1" to the intended
"https://inference-api.nvidia.com" (adjust path suffix if needed) in the config
fixtures checked by the tests (look for the endpointUrl property in the config
fixture objects inside nemoclaw/src/commands/config-show.test.ts and the other
listed test fixtures), and apply the same replacement for all other occurrences
noted in the comment so the fixtures match the PR intent.
In `@src/lib/inference/model-prompts.test.ts`:
- Line 57: Update the hardcoded NVIDIA endpoint URL in the test error messages
to match the PR intent: replace occurrences of
"https://integrate.api.nvidia.com/v1/models" with the correct
"https://inference-api.nvidia.com/v1/models" in the test assertions inside
src/lib/inference/model-prompts.test.ts (look for the message template using
Model '${model}' is not available from NVIDIA Endpoints and any other similar
message strings around the same test block, including the second occurrence
referenced near the other assertion).
In `@src/lib/onboard/machine/handlers/provider-inference.test.ts`:
- Line 20: The PR summary is reversed relative to the code changes: update the
PR summary to reflect that the NVIDIA inference endpoint is being switched to
https://integrate.api.nvidia.com/v1 (not from it), and ensure the summary
explicitly lists the affected files (e.g., provider-inference.test.ts,
model-prompts.test.ts, config-show.test.ts, openclaw-sandbox.yaml,
runner.test.ts, providers.test.ts, agents/hermes/policy-additions.yaml,
policy-additions.yaml) and the corrected direction "to
https://integrate.api.nvidia.com/v1" so it matches the endpoint changes in the
diffs and the network policy reference to integrate.api.nvidia.com:443.
- Line 20: Test fixtures set endpointUrl to
"https://integrate.api.nvidia.com/v1" but PR intent says switch from
integrate.api.nvidia.com to inference-api.nvidia.com; confirm intended direction
and update the test fixtures (the endpointUrl values) to match the correct new
NVIDIA inference endpoint (use "https://inference-api.nvidia.com/v1" if the PR
intends to replace integrate.api with inference-api) in both occurrences
referenced (the endpointUrl test fixture and the other occurrence around the
second mention).
In `@src/lib/onboard/providers.test.ts`:
- Line 167: Tests in the provider upsert suite reference the wrong NVIDIA
endpoint string; replace all occurrences of
"https://integrate.api.nvidia.com/v1" in the provider upsert tests with the
intended endpoint "https://inference-api.nvidia.com" so the tests exercise the
actual inference provider wiring (search for the provider upsert test block and
string literals in src/lib/onboard/providers.test.ts, e.g., the
upsertProvider/upsert tests where the NVIDIA base URL is asserted or stubbed).
---
Outside diff comments:
In `@agents/hermes/policy-additions.yaml`:
- Line 62: The managed_inference policy currently restricts the Python binary to
/usr/bin/python3.11 while the nvidia policy still allows /usr/bin/python3*; make
these policies consistent by choosing one allowlist format and applying it to
both policy blocks (update the list entry in the managed_inference and nvidia
policy definitions to the same path), or if they must differ, add a comment in
the file and a note in the PR summary explaining why managed_inference requires
Python 3.11 while nvidia accepts any 3.x binary; ensure the change is applied to
the Python binary entries in both policy definitions (managed_inference, nvidia)
and update documentation/PR description accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7a2cd516-6b82-4c4d-a370-841aadb9e747
📒 Files selected for processing (19)
agents/hermes/policy-additions.yamlagents/hermes/policy-permissive.yamlagents/openclaw/policy-permissive.yamldocs/inference/inference-options.mdxdocs/reference/network-policies.mdxnemoclaw-blueprint/blueprint.yamlnemoclaw-blueprint/policies/openclaw-sandbox-permissive.yamlnemoclaw-blueprint/policies/openclaw-sandbox.yamlnemoclaw/src/blueprint/runner.test.tsnemoclaw/src/commands/config-show.test.tssrc/lib/inference/model-prompts.test.tssrc/lib/onboard/docker-gpu-patch.test.tssrc/lib/onboard/machine/handlers/provider-inference.test.tssrc/lib/onboard/providers.test.tssrc/lib/onboard/providers.tssrc/lib/validation.tstest/onboard-selection.test.tstest/validate-blueprint.test.tstools/advisors/session.mts
🚧 Files skipped from review as they are similar to previous changes (4)
- docs/reference/network-policies.mdx
- src/lib/validation.ts
- docs/inference/inference-options.mdx
- test/onboard-selection.test.ts
Contributor
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
agents/hermes/policy-additions.yaml (1)
62-62: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winInconsistent Python binary restrictions between network policies.
The
managed_inferencepolicy (line 62) tightens the Python binary allowlist to the specific/usr/bin/python3.11, but thenvidiapolicy (line 80) retains the wildcard/usr/bin/python3*. This creates an inconsistency within the same file.If the Python version is being tightened for security or compatibility reasons, both policies should be updated consistently. If there's a specific reason
managed_inferencerequires Python 3.11 butnvidiacan work with any 3.x version, that rationale should be documented.Additionally, this Python version tightening is not mentioned in the PR summary, suggesting possible scope creep beyond the credential/endpoint rename.
As per coding guidelines, changes that tighten the python runtime path may require corresponding updates in this file. The current state leaves an unexplained discrepancy between the two policies.
Also applies to: 80-80
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/hermes/policy-additions.yaml` at line 62, The managed_inference policy currently restricts the Python binary to /usr/bin/python3.11 while the nvidia policy still allows /usr/bin/python3*; make these policies consistent by choosing one allowlist format and applying it to both policy blocks (update the list entry in the managed_inference and nvidia policy definitions to the same path), or if they must differ, add a comment in the file and a note in the PR summary explaining why managed_inference requires Python 3.11 while nvidia accepts any 3.x binary; ensure the change is applied to the Python binary entries in both policy definitions (managed_inference, nvidia) and update documentation/PR description accordingly.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@nemoclaw/src/blueprint/runner.test.ts`:
- Around line 667-670: In the blueprint runner tests the NVIDIA endpoint host
string used in policy additions is incorrect; update every policy addition that
sets host: "integrate.api.nvidia.com" to host: "inference-api.nvidia.com" so the
tests validate the intended runtime target (search for the test blocks that
create policies with a host property, e.g., the policy addition objects in
runner.test.ts around the policy-add/test helper code referenced at the shown
diffs and the other occurrences noted).
In `@nemoclaw/src/commands/config-show.test.ts`:
- Line 39: Update the test fixtures' endpointUrl value from
"https://integrate.api.nvidia.com/v1" to the intended
"https://inference-api.nvidia.com" (adjust path suffix if needed) in the config
fixtures checked by the tests (look for the endpointUrl property in the config
fixture objects inside nemoclaw/src/commands/config-show.test.ts and the other
listed test fixtures), and apply the same replacement for all other occurrences
noted in the comment so the fixtures match the PR intent.
In `@src/lib/inference/model-prompts.test.ts`:
- Line 57: Update the hardcoded NVIDIA endpoint URL in the test error messages
to match the PR intent: replace occurrences of
"https://integrate.api.nvidia.com/v1/models" with the correct
"https://inference-api.nvidia.com/v1/models" in the test assertions inside
src/lib/inference/model-prompts.test.ts (look for the message template using
Model '${model}' is not available from NVIDIA Endpoints and any other similar
message strings around the same test block, including the second occurrence
referenced near the other assertion).
In `@src/lib/onboard/machine/handlers/provider-inference.test.ts`:
- Line 20: The PR summary is reversed relative to the code changes: update the
PR summary to reflect that the NVIDIA inference endpoint is being switched to
https://integrate.api.nvidia.com/v1 (not from it), and ensure the summary
explicitly lists the affected files (e.g., provider-inference.test.ts,
model-prompts.test.ts, config-show.test.ts, openclaw-sandbox.yaml,
runner.test.ts, providers.test.ts, agents/hermes/policy-additions.yaml,
policy-additions.yaml) and the corrected direction "to
https://integrate.api.nvidia.com/v1" so it matches the endpoint changes in the
diffs and the network policy reference to integrate.api.nvidia.com:443.
- Line 20: Test fixtures set endpointUrl to
"https://integrate.api.nvidia.com/v1" but PR intent says switch from
integrate.api.nvidia.com to inference-api.nvidia.com; confirm intended direction
and update the test fixtures (the endpointUrl values) to match the correct new
NVIDIA inference endpoint (use "https://inference-api.nvidia.com/v1" if the PR
intends to replace integrate.api with inference-api) in both occurrences
referenced (the endpointUrl test fixture and the other occurrence around the
second mention).
In `@src/lib/onboard/providers.test.ts`:
- Line 167: Tests in the provider upsert suite reference the wrong NVIDIA
endpoint string; replace all occurrences of
"https://integrate.api.nvidia.com/v1" in the provider upsert tests with the
intended endpoint "https://inference-api.nvidia.com" so the tests exercise the
actual inference provider wiring (search for the provider upsert test block and
string literals in src/lib/onboard/providers.test.ts, e.g., the
upsertProvider/upsert tests where the NVIDIA base URL is asserted or stubbed).
---
Outside diff comments:
In `@agents/hermes/policy-additions.yaml`:
- Line 62: The managed_inference policy currently restricts the Python binary to
/usr/bin/python3.11 while the nvidia policy still allows /usr/bin/python3*; make
these policies consistent by choosing one allowlist format and applying it to
both policy blocks (update the list entry in the managed_inference and nvidia
policy definitions to the same path), or if they must differ, add a comment in
the file and a note in the PR summary explaining why managed_inference requires
Python 3.11 while nvidia accepts any 3.x binary; ensure the change is applied to
the Python binary entries in both policy definitions (managed_inference, nvidia)
and update documentation/PR description accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7a2cd516-6b82-4c4d-a370-841aadb9e747
📒 Files selected for processing (19)
agents/hermes/policy-additions.yamlagents/hermes/policy-permissive.yamlagents/openclaw/policy-permissive.yamldocs/inference/inference-options.mdxdocs/reference/network-policies.mdxnemoclaw-blueprint/blueprint.yamlnemoclaw-blueprint/policies/openclaw-sandbox-permissive.yamlnemoclaw-blueprint/policies/openclaw-sandbox.yamlnemoclaw/src/blueprint/runner.test.tsnemoclaw/src/commands/config-show.test.tssrc/lib/inference/model-prompts.test.tssrc/lib/onboard/docker-gpu-patch.test.tssrc/lib/onboard/machine/handlers/provider-inference.test.tssrc/lib/onboard/providers.test.tssrc/lib/onboard/providers.tssrc/lib/validation.tstest/onboard-selection.test.tstest/validate-blueprint.test.tstools/advisors/session.mts
🚧 Files skipped from review as they are similar to previous changes (4)
- docs/reference/network-policies.mdx
- src/lib/validation.ts
- docs/inference/inference-options.mdx
- test/onboard-selection.test.ts
🛑 Comments failed to post (5)
nemoclaw/src/blueprint/runner.test.ts (1)
667-670: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Verify NVIDIA endpoint host in policy addition tests matches PR intent.
The blueprint runner tests now use
integrate.api.nvidia.comin policy additions, but the PR summary indicates the target should beinference-api.nvidia.com. This affects E2E test coverage—if the endpoint is wrong, tests won't validate the actual runtime configuration.Also applies to: 739-742, 762-762, 782-782, 800-800
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@nemoclaw/src/blueprint/runner.test.ts` around lines 667 - 670, In the blueprint runner tests the NVIDIA endpoint host string used in policy additions is incorrect; update every policy addition that sets host: "integrate.api.nvidia.com" to host: "inference-api.nvidia.com" so the tests validate the intended runtime target (search for the test blocks that create policies with a host property, e.g., the policy addition objects in runner.test.ts around the policy-add/test helper code referenced at the shown diffs and the other occurrences noted).nemoclaw/src/commands/config-show.test.ts (1)
39-39: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Verify endpoint URL in config fixtures matches PR intent.
The test config fixtures now use
https://integrate.api.nvidia.com/v1, but the PR summary indicates the target should beinference-api.nvidia.com. This is the same directional inconsistency found across all changed files in this PR.Also applies to: 47-47, 52-52, 62-62, 100-100, 118-118
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@nemoclaw/src/commands/config-show.test.ts` at line 39, Update the test fixtures' endpointUrl value from "https://integrate.api.nvidia.com/v1" to the intended "https://inference-api.nvidia.com" (adjust path suffix if needed) in the config fixtures checked by the tests (look for the endpointUrl property in the config fixture objects inside nemoclaw/src/commands/config-show.test.ts and the other listed test fixtures), and apply the same replacement for all other occurrences noted in the comment so the fixtures match the PR intent.src/lib/inference/model-prompts.test.ts (1)
57-57: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Verify endpoint URL in error messages matches PR intent.
The validation error messages now reference
https://integrate.api.nvidia.com/v1/models, but the PR summary indicates the target endpoint should beinference-api.nvidia.com, notintegrate.api.nvidia.com. This is the same inconsistency flagged in provider-inference.test.ts.Also applies to: 63-63
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/inference/model-prompts.test.ts` at line 57, Update the hardcoded NVIDIA endpoint URL in the test error messages to match the PR intent: replace occurrences of "https://integrate.api.nvidia.com/v1/models" with the correct "https://inference-api.nvidia.com/v1/models" in the test assertions inside src/lib/inference/model-prompts.test.ts (look for the message template using Model '${model}' is not available from NVIDIA Endpoints and any other similar message strings around the same test block, including the second occurrence referenced near the other assertion).src/lib/onboard/machine/handlers/provider-inference.test.ts (1)
20-20: 🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Critical inconsistency: PR summary contradicts code changes on NVIDIA endpoint direction.
All code changes across
provider-inference.test.ts,model-prompts.test.ts,config-show.test.ts,openclaw-sandbox.yaml,runner.test.ts,providers.test.ts, andpolicy-additions.yamlconsistently set the NVIDIA inference endpoint tohttps://integrate.api.nvidia.com/v1.However, the PR summary states: "Switch hosted NVIDIA inference endpoint from https://integrate.api.nvidia.com/v1 to https://inference-api.nvidia.com/v1", which would imply the opposite direction.
This creates a critical ambiguity:
- If the PR summary is correct, all these code changes are wrong and will break NVIDIA inference by pointing to the old/wrong endpoint
- If the code changes are correct, the PR summary has "from" and "to" reversed
The coding guidelines for
agents/hermes/policy-additions.yamlreferenceintegrate.api.nvidia.com:443as the expected NVIDIA host, which suggests the code changes may be correct and the PR summary is backwards.Please clarify and correct the PR summary to match the actual endpoint direction, as this affects E2E test validation, network policy security posture, and production inference routing.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/machine/handlers/provider-inference.test.ts` at line 20, The PR summary is reversed relative to the code changes: update the PR summary to reflect that the NVIDIA inference endpoint is being switched to https://integrate.api.nvidia.com/v1 (not from it), and ensure the summary explicitly lists the affected files (e.g., provider-inference.test.ts, model-prompts.test.ts, config-show.test.ts, openclaw-sandbox.yaml, runner.test.ts, providers.test.ts, agents/hermes/policy-additions.yaml, policy-additions.yaml) and the corrected direction "to https://integrate.api.nvidia.com/v1" so it matches the endpoint changes in the diffs and the network policy reference to integrate.api.nvidia.com:443.Source: Coding guidelines
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Verify endpoint URL direction matches PR intent.
These test fixtures now use
https://integrate.api.nvidia.com/v1as the NVIDIA inference endpoint. However, the PR summary states: "Switch hosted NVIDIA inference endpoint from https://integrate.api.nvidia.com/v1 to https://inference-api.nvidia.com/v1", which would imply the NEW endpoint should beinference-api.nvidia.com, notintegrate.api.nvidia.com.Either the PR summary has "from" and "to" reversed, or these test values are incorrect. Please confirm the intended endpoint direction.
Also applies to: 161-161
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/machine/handlers/provider-inference.test.ts` at line 20, Test fixtures set endpointUrl to "https://integrate.api.nvidia.com/v1" but PR intent says switch from integrate.api.nvidia.com to inference-api.nvidia.com; confirm intended direction and update the test fixtures (the endpointUrl values) to match the correct new NVIDIA inference endpoint (use "https://inference-api.nvidia.com/v1" if the PR intends to replace integrate.api with inference-api) in both occurrences referenced (the endpointUrl test fixture and the other occurrence around the second mention).src/lib/onboard/providers.test.ts (1)
167-167: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Verify NVIDIA base URL in provider tests matches PR intent.
The provider upsert tests now use
https://integrate.api.nvidia.com/v1as the NVIDIA endpoint, but the PR summary indicates the target should beinference-api.nvidia.com. This inconsistency affects test coverage for the actual inference provider wiring.Also applies to: 180-180, 190-190, 205-205
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/lib/onboard/providers.test.ts` at line 167, Tests in the provider upsert suite reference the wrong NVIDIA endpoint string; replace all occurrences of "https://integrate.api.nvidia.com/v1" in the provider upsert tests with the intended endpoint "https://inference-api.nvidia.com" so the tests exercise the actual inference provider wiring (search for the provider upsert test block and string literals in src/lib/onboard/providers.test.ts, e.g., the upsertProvider/upsert tests where the NVIDIA base URL is asserted or stubbed).
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27448774906
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27448873091
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27449158808
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27449346702
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27449623165
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27449749031
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27449811156
|
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/e2e/e2e-cloud-experimental/checks/03-security-checks.sh`:
- Around line 40-51: The auto-set default argv-leak marker logic only triggers
for _api_key_env_name == "NVIDIA_INFERENCE_API_KEY", so when callers use
"COMPATIBLE_API_KEY" the marker remains empty and the argv leak scan (using
_key_argv_needle, ps_lines and die) is skipped; update the conditional that sets
_key_argv_prefix_marker (and/or the check for
NEMOCLAW_E2E_CLOUD_API_KEY_ARGV_PREFIX) to also apply when _api_key_env_name ==
"COMPATIBLE_API_KEY" (or otherwise include both names) so the default marker is
populated for compatible mode and the subsequent _key_argv_needle-based ps_lines
scan runs as intended.
In `@test/e2e/test-full-e2e.sh`:
- Around line 243-249: The script validates compatible-mode using
HOSTED_INFERENCE_MODEL earlier but later in Phase 4b still hardcodes
"nvidia/nemotron-3-super-120b-a12b"; update the Phase 4b usage to respect
compatible mode by replacing the hardcoded model string with the
HOSTED_INFERENCE_MODEL variable and/or branching on
nemoclaw_e2e_using_compatible_inference to select HOSTED_INFERENCE_MODEL when
true, and ensure any grep/tests that currently look for the hardcoded name
instead check for the HOSTED_INFERENCE_MODEL value (or reuse the same grep logic
that checks inf_check).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3eb5df17-eca0-4e31-83b4-fbbea2ee49f2
📒 Files selected for processing (4)
test/e2e/e2e-cloud-experimental/checks/03-security-checks.shtest/e2e/lib/ci-compatible-inference.shtest/e2e/test-cloud-onboard-e2e.shtest/e2e/test-full-e2e.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- test/e2e/lib/ci-compatible-inference.sh
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27449922166
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27450272030
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27450143122
|
Contributor
Selective E2E Results — ✅ All requested jobs passedRun: 27450416388
|
…nference-endpoint # Conflicts: # test/e2e/test-issue-2478-crash-loop-recovery.sh
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27450531111
|
…dpoint' into codex/update-nvidia-inference-endpoint # Conflicts: # src/lib/onboard.ts
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27451202014
|
…nference-endpoint # Conflicts: # .github/workflows/e2e-vitest-scenarios.yaml
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27451451097
|
Contributor
Selective E2E Results — ❌ Some jobs failedRun: 27451890065
|
12 tasks
13 tasks
cv
pushed a commit
that referenced
this pull request
Jun 17, 2026
## Summary Refreshes release-prep documentation for NemoClaw v0.0.65. Adds the v0.0.65 release-notes section and refreshes generated `nemoclaw-user-*` skills from the Fern MDX source docs. ## Changes - Added the v0.0.65 release notes to `docs/about/release-notes.mdx` with links to the deeper docs pages for lifecycle, troubleshooting, inference, CLI commands, messaging, credentials, network policy, Hermes, and sub-agents. - Regenerated the `nemoclaw-user-*` skills with `scripts/docs-to-skills.py` so release-prep skill output matches the merged source docs. - Used the v0.0.65 announcement discussion as release context: #5472. ## Source Summary - #2492 -> `docs/about/release-notes.mdx`: Documents deadline-based gateway wait reliability in the v0.0.65 recovery summary. - #4958 -> `docs/about/release-notes.mdx`: Documents re-execed OpenClaw gateway health check recovery in the sandbox recovery summary. - #5163 -> `docs/about/release-notes.mdx`: Documents safer uninstall TTY confirmation behavior in the day-two CLI summary. - #5178 -> `docs/about/release-notes.mdx`: Documents fail-closed config restore merge behavior in the rebuild and restore summary. - #5179 -> `docs/about/release-notes.mdx`: Documents WeChat QR token redaction in the messaging summary. - #5182 -> `docs/about/release-notes.mdx`: Documents sustained gateway serving checks in the recovery summary. - #5194 -> `docs/about/release-notes.mdx`: Documents model-router teardown during uninstall in the day-two CLI summary. - #5195 -> `docs/about/release-notes.mdx`: Documents Shields auto-restore lock reconfirmation in the rebuild and restore summary. - #5198 -> `docs/about/release-notes.mdx`: Documents Docker Desktop WSL CDI injection failure handling in the onboarding diagnostics summary. - #5201 -> `docs/about/release-notes.mdx`: Documents sandbox download/upload wrappers and sessions export in the day-two CLI summary. - #5205 -> `docs/about/release-notes.mdx`: Documents reporter-owned model metadata preservation in the rebuild and restore summary. - #5214 -> `docs/about/release-notes.mdx`: Documents managed vLLM model preflight before side effects in the inference setup summary. - #5215 -> `docs/about/release-notes.mdx`: Documents managed vLLM extra serve arguments in the inference setup summary. - #5216 -> `docs/about/release-notes.mdx`: Documents silent OpenClaw runtime fallback surfacing in the onboarding diagnostics summary. - #5225 -> `docs/about/release-notes.mdx`: Documents persisted sandbox gateway lookup in the gateway recovery summary. - #5238 -> `docs/about/release-notes.mdx`: Documents sub-agent gateway dial-back through the sandbox interface in the Hermes and sub-agent summary. - #5248 -> `docs/about/release-notes.mdx`: Documents Discord per-account proxy resolution in the messaging summary. - #5264 -> `docs/about/release-notes.mdx`: Documents reserved Hermes port `8642` handling in the Hermes compatibility summary. - #5267 -> `docs/about/release-notes.mdx`: Documents the narrower Hermes baseline policy in the Hermes compatibility summary. - #5321 -> `docs/about/release-notes.mdx`: Documents restored gateway guard chains in the gateway recovery summary. - #5328 -> `docs/about/release-notes.mdx`: Documents compact persisted messaging plans in the messaging summary. - #5338 -> `docs/about/release-notes.mdx`: Documents manifest channel migration in the messaging summary. - #5352 -> `docs/about/release-notes.mdx`: Documents persisted agent preservation through registry recovery in the rebuild and restore summary. - #5371 -> `.agents/skills/nemoclaw-user-reference/references/commands.md`: Refreshes generated skill output for custom build cache and layer-ordering source docs. - #5379 -> `docs/about/release-notes.mdx`: Documents dashboard port allocation across multiple NemoClaw gateways in the recovery summary. - #5382 -> `docs/about/release-notes.mdx`: Documents recovery when an active gateway has no sandbox spec in the recovery summary. - #5389 -> `.agents/skills/nemoclaw-user-reference/references/troubleshooting.md`: Refreshes generated skill output for declared agent `forward_ports` recovery source docs. - #5400 -> `docs/about/release-notes.mdx`: Documents bounded compatible endpoint probes in the inference setup summary. - #5410 -> `docs/about/release-notes.mdx`: Documents provider credential hash removal from sandbox registry entries in the messaging summary. - #5418 -> `docs/about/release-notes.mdx`: Documents summarized inference validation failures in the onboarding diagnostics summary. - #5457 -> `docs/about/release-notes.mdx`: Documents context-window recomputation after runtime model switches in the inference setup summary. - #5463 -> `docs/about/release-notes.mdx`: Documents cleanup of hard-coded messaging channel stragglers in the messaging summary. ## Skipped - #5366 matched `docs/.docs-skip` entries through skipped experimental paths, so this PR does not add new release-note text for that commit. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Verification - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [ ] Tests added or updated for new or changed behavior - [x] No secrets, API keys, or credentials committed - [x] Docs updated for user-facing behavior changes - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification notes: - `npm run docs` passed after rerunning outside the sandbox. Fern reported 0 errors and 1 hidden warning. - The first sandboxed `npm run docs` attempt failed before validation because `tsx` could not create its local IPC pipe under sandbox restrictions. - `npm run build:cli` passed before push to refresh the local `dist/` artifacts used by the CLI typecheck hook. - `npm test` was not run because this is a docs-only release refresh. --- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Released NemoClaw v0.0.65 with improved gateway/sandbox recovery, safer day-two workflows, and enhanced Hermes compatibility. * Added managed vLLM extra-arguments configuration via `NEMOCLAW_VLLM_EXTRA_ARGS_JSON`. * Added Hermes troubleshooting guidance for port forwarding and health checks. * **Documentation** * Updated NVIDIA Endpoints/NIM setup and examples to use `NVIDIA_INFERENCE_API_KEY`. * Refined NVIDIA network policy and Model Router API base configuration. * Expanded CLI/environment variable documentation (including sub-agent gateway connectivity) and plugin build performance tips. * **Tests** * Expanded Vitest-backed E2E release validation coverage. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Make
NVIDIA_INFERENCE_API_KEYthe canonical NVIDIA hosted-inference credential variable while keeping the public/default NVIDIA Endpoints URL ashttps://integrate.api.nvidia.com/v1.https://inference-api.nvidia.com/v1is used only in CI/E2E live validation paths where it is convenient for the repository secret-backed tests.Changes
NVIDIA_API_KEYtoNVIDIA_INFERENCE_API_KEY.NVIDIA_API_KEYas a legacy resolver/redaction alias so existing local env or legacy credentials files can hydrate the new canonical key during migration.integrate.api.nvidia.com.inference-api.nvidia.comreferences limited to CI/E2E live probes and runtime validation notes.Type of Change
Verification
npx prek run --all-filespassesnpm testpassesnpm run docsbuilds without warnings (doc changes only)Additional verification run:
npm run build:clinpm run typecheck:clinpm run validate:configsnpx vitest run --project cli test/validate-blueprint.test.ts test/validate-configs-dangerous-hosts.test.ts test/openclaw-config-snapshot.test.ts test/generate-openclaw-config.test.ts test/onboard-selection.test.ts test/canonical-credential-resolution.test.ts test/credentials.test.ts test/no-direct-credential-env.test.tsnpx vitest run --project cli src/lib/onboard/providers.test.tsnpx vitest run --project e2e-vitest-supportnpx vitest run --project plugin nemoclaw/src/commands/config-show.test.ts nemoclaw/src/blueprint/runner.test.ts nemoclaw/src/blueprint/ssrf.test.tsgit commithooks passed, including config validation, docs-to-skills verification, CLI/plugin tests, and commitlintgit pushpre-push hooks passed, including TypeScript gates and CLI/plugin testsSigned-off-by: Carlos Villela cvillela@nvidia.com
Summary by CodeRabbit
Configuration Changes
Documentation
Tests & CI
Network & Policies