fix(hermes): install safety-net + ciao NODE_OPTIONS preloads so recover can relaunch#5416
fix(hermes): install safety-net + ciao NODE_OPTIONS preloads so recover can relaunch#5416hizrianraz wants to merge 2 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds ChangesHermes Node Preload Guard Installation and Proxy Env Wiring
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@agents/hermes/start.sh`:
- Around line 767-770: Remove the sandbox path
`/sandbox/.nemoclaw/blueprints/*/scripts` from the default search list in the
NEMOCLAW_GUARD_DIRS parameter expansion. The for loop iterating over _gd should
only default to image-owned preload directories
(`/opt/nemoclaw-blueprint/scripts` and `/usr/local/lib/nemoclaw/preloads`) when
NEMOCLAW_GUARD_DIRS is not explicitly set, allowing users to add sandbox paths
only through explicit environment variable overrides for test/dev purposes
rather than by default.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: fdeffcd8-d465-4534-8380-0d54923f18db
📒 Files selected for processing (1)
agents/hermes/start.sh
…er can relaunch
The OpenClaw entrypoint (scripts/nemoclaw-start.sh) installs the
sandbox-safety-net and ciao-network-guard NODE_OPTIONS preloads, but the
Hermes entrypoint (agents/hermes/start.sh) did not. The gateway-recovery path
refuses to relaunch unless NODE_OPTIONS advertises both guards ("proxy-env
present but NODE_OPTIONS missing safety-net preload or ciao preload - refusing
unguarded gateway relaunch"), so a stopped Hermes gateway can never be brought
back with `recover`. The ciao guard is also what prevents the @homebridge/ciao
networkInterfaces() crash (NVIDIA#2478) on Hermes sandboxes.
Port the guard install to the Hermes entrypoint. Hardened so a guard-install
failure can never abort the `set -euo pipefail` entrypoint (an unguarded version
left the gateway dead): the install runs as `... || true` (errexit suppressed
through the whole function), every fallible command sits inside an `if`, all
vars are `${x:-}`-safe, and a guard is only added to NODE_OPTIONS once its /tmp
copy exists and is non-empty. Worst case it warns and the gateway still starts.
The guards are also re-exported into the sourced proxy-env so connect/recovery
sessions see them.
Signed-off-by: Hizrian Raz <hizrian@ainfera.ai>
hizrianraz
force-pushed
the
fix/hermes-recover-node-guards-2478
branch
from
0ccc925 to
8c9a3f7
Compare
|
Thanks @coderabbitai — good catch. Removed the sandbox-writable |
|
Tip For best results, initiate chat on the files or code changes.
(ᵔᴥᵔ)🐇 |
2 participants
Summary
The Hermes entrypoint (
agents/hermes/start.sh) never installed thesandbox-safety-netandciao-network-guardNODE_OPTIONS preloads that the OpenClaw entrypoint (scripts/nemoclaw-start.sh) installs. As a result the gateway-recovery path refuses to relaunch a stopped Hermes gateway ("proxy-env present but NODE_OPTIONS missing safety-net preload or ciao preload — refusing unguarded gateway relaunch"), and the@homebridge/ciaonetworkInterfaces()crash (#2478) can hit Hermes sandboxes. This ports the guard install to the Hermes entrypoint, hardened so it can never abort the entrypoint.Related Issue
Relates to #2478 — the
ciao-network-guardpreload this ports to the Hermes entrypoint.Changes
agents/hermes/start.sh: addinstall_nemoclaw_node_guards()— copiessandbox-safety-net.js+ciao-network-guard.jsto/tmp/nemoclaw-*.jsand adds them toNODE_OPTIONS(mirrorsscripts/nemoclaw-start.sh, sourcing from the Hermes image's/opt/nemoclaw-blueprint/scripts)./tmp/nemoclaw-proxy-env.sh) so connect/recovery sessions see them — this is what satisfies the recovery guard-check.set -euo pipefailentrypoint: invoked… || true(errexit suppressed through the whole function), every fallible step inside anif, all vars${x:-}-safe, and a guard added toNODE_OPTIONSonly after its/tmpcopy exists and is non-empty ([ -s ]). Worst case it logs a warning and the gateway still starts.Type of Change
Verification
npx prek run --all-filespassesnpm testpassesnpm run docsbuilds without warnings (doc changes only)Signed-off-by: Hizrian Raz hizrian@ainfera.ai
Summary by CodeRabbit
NODE_OPTIONSpreloads are conditionally re-exported for both connect and recovery flows when guards are present.