Skip to content

chore(deps): update LangChain Deep Agents Code to 0.1.71 - #12376

Merged
prekshivyas merged 69 commits into
mainfrom
nemopatch/deep-agents-upgrade/f1fbd2ef6b194e8a
Oct 13, 2026
Merged

prekshivyas merged 69 commits into
mainfrom
nemopatch/deep-agents-upgrade/f1fbd2ef6b194e8a

Conversation

@nvidia-nemopatch-writer

@nvidia-nemopatch-writer nvidia-nemopatch-writer Bot commented Sep 28, 2026 •

Copy link
Copy Markdown
Contributor

Outcome

Upgrade managed LangChain Deep Agents Code from 0.1.55 to 0.1.71 with a hash-locked Python 3.13 dependency graph, updated startup and MCP behavior, and matching onboarding and runtime validation. Preserve the existing security, lifecycle, inference, and cleanup requirements.

Reason

Keep the managed Deep Agents release, dependency lock, startup patches, and lifecycle contract consistent with Deep Agents Code 0.1.71.

Changes

  • Adapt the Deep Agents image, managed patches, CLI entrypoint, native startup, persistent environment, and subprocess handling to the pinned release. Update the Nemotron profile and live version expectations.
  • Consolidate the fixture and gateway repairs formerly proposed in closed test(sandbox): preserve device files in double-source fixture #12611, test: make llama.cpp model replacement deterministic #12612, and fix(onboard): preserve gateway ownership and wait for all Linux threads #12614. Historical installer fixtures keep their historical executable reader; process and gateway checks retain exact ownership and bounded, redacted failure diagnostics.
  • For mixed-ownership native state on rootless Podman, complete the validated wipe as the image's pinned UID/GID 999 after the privileged pass. The provider rechecks the exact container handle; protected paths, timeout, final verification, fail-closed registry retention, and the public destroy assertion remain.
  • Bind the Deep Agents base-image, runtime validator, cleanup, and managed startup contract to one shared UID/GID JSON, resolving the migration and ownership findings in successive nine-specialist Advisor reviews.
  • Verify the native NVIDIA credential handle inside the OpenClaw sandbox before redaction, and accept that exact handle in the Hermes E2E config assertion. Preserve secret suppression and the later inference assertions. Record scoped, read-only Docker container-discovery evidence if Model Router onboarding fails.
  • Keep the v2 protected activation contract for candidate base-image builds, the v1 published-base path for older runs, and the existing assertion ratchet. The source projection, cleanup, deadline, and inference requirements are not relaxed.

Verification

Commit under review: c4131d9db91dc4a9f1904d71e9f5af1c91b2c6a6; base 1d76efb8fbb7e10ec5dc2dd431dabc30ce54537e; trusted E2E workflow 697289aec2e0c5a1a2b8d2ed5a714b31bb5df4b4.

Checks on this commit (all green):

Full default PR E2E (run 38327515342), empty selectors, mock inference, no Jetson or Launchable. Final: 77 jobs succeeded, 5 failed (the three Hermes jobs and protected GPU below, plus the Relevant E2E aggregate, which fails because of them) and 17 were skipped. The aggregate fails, so no full-suite pass is claimed. These are workflow job counts, not test counts.

Passed on this commit: the Deep Agents Code repository-install and deferred-onboarding jobs, MCP bridge for Deep Agents, OpenClaw and Hermes, protected managed-image startup on amd64 and arm64, and the credential generation window.

Comparison with main. The full main run 38290099089 (e15557e) fails the same three jobs with the same assertions. No job fails on this PR that passes on main.

Failed job This PR Main full run Same signature
Hermes E2E (docker) job: hermes-e2e.test.ts:920, configExport.passed is false job: same assertion yes
Security: Hermes retains the required sandbox posture job: same test and assertion job: same yes
Hermes switches to native NVIDIA job: hermes-inference-switch.test.ts:228, PID 2341 versus 1159 job: PID 2341 versus 1160 yes; only the old PID differs between runs
Protected managed-image GPU and local inference job: Ollama and vLLM phases passed; NVIDIA NIM phase failed with ENOSPC: no space left on device; cleanup passed job: Ollama and vLLM passed; NIM phase failed with No space left on device writing /opt/nim/.cache; cleanup passed yes (same phase and cause); no PR-specific signal

Main's full run also fails the Hermes Slack credential and channel stop/start Messaging jobs, which pass here. This PR does not claim to fix them, and their cause is not established.

The earlier full run on 6672192 (run 38123921937) is superseded by the run above.

Remaining qualification

  • Protected GPU: Ollama and vLLM qualification passed; the NVIDIA NIM phase failed on runner disk exhaustion here and on main's full run, so NIM qualification is not established for this commit. It needs a runner with enough disk and is not Deep Agents-specific.
  • The three Hermes failures above also fail on main with the same assertions, so they are not introduced by this PR. This PR does touch some Hermes E2E helpers and fixtures; the identical main signatures are the evidence they are inherited, and the PR does not claim to fix them.
  • Pi qualification receipt digests change in candidate-authority.ts and the two ci/pi-agent-qualification-v1-*.json files, refreshed to match this branch's candidate inputs. Pi inference qualification is otherwise unrelated to Deep Agents; its known source mismatches are covered by feat(inference): [slice 2] use native hosted providers #12886.
  • CodeRabbit skipped this PR ("bot user not eligible"), so it is not review evidence. Independent human approval is still required.

Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

Patch-Walker-Manifest: sha256:a0f61cff523ec0832bb6e461e1dfe730a415d48e0890f72ac51a6895d69327f0
Patch-Walker-Action: sha256:b7fb4a31d109f7d4646d6d1e67c20ffc5a2cb05b77a4b014589c518fec0733f9

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
@copy-pr-bot

copy-pr-bot Bot commented Sep 28, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@coderabbitai

coderabbitai Bot commented Sep 28, 2026 •

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: NVIDIA/NemoClaw/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: fbd0cf5c-cfd3-4bbc-a70a-caacefe525f3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Sep 28, 2026 •

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit c4131d9 in the nemopatch/deep-agent... branch is 97%. The line coverage in commit 63002cd in the main branch is 96%.

Show a line coverage summary of the most impacted files.
File main 63002cd nemopatch/deep-agent... c4131d9 +/-
nemoclaw/src/onboard/config.ts 98% 96% -2%
nemoclaw/src/index.ts 94% 93% -1%
nemoclaw/src/bl...print/runner.ts 95% 95% 0%
nemoclaw/src/bl...ime-identity.ts 97% 97% 0%
nemoclaw/src/bl...t-management.ts 100% 100% 0%
nemoclaw/src/co.../config-show.ts 100% 100% 0%
nemoclaw/src/commands/slash.ts 100% 100% 0%
nemoclaw/src/on...native-route.ts 0% 100% +100%

TypeScript / code-coverage/cli

The overall line coverage in commit c4131d9 in the nemopatch/deep-agent... branch is 86%. The line coverage in commit 63002cd in the main branch is 84%.

Show a line coverage summary of the most impacted files.
File main 63002cd nemopatch/deep-agent... c4131d9 +/-
src/lib/onboard.ts 62% 47% -15%
src/lib/actions...ess-recovery.ts 65% 78% +13%
src/lib/state/l...diness-lease.ts 66% 82% +16%
src/lib/inferen...ollama/proxy.ts 41% 61% +20%
src/lib/onboard.../application.ts 55% 84% +29%
src/lib/domain/...y/dimensions.ts 0% 71% +71%
src/lib/actions...ry/operation.ts 0% 76% +76%
src/lib/actions...try/snapshot.ts 0% 78% +78%
src/lib/inferen...ovider/index.ts 0% 88% +88%
src/lib/onboard...ternal-image.ts 0% 91% +91%

Updated October 12, 2026 22:46 UTC

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@prekshivyas
prekshivyas marked this pull request as ready for review September 29, 2026 02:25
@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@prekshivyas
prekshivyas marked this pull request as draft September 29, 2026 05:56
@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Sep 30, 2026 •

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review skipped.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review skipped.

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review skipped.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review skipped.

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review skipped.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
@github-actions

github-actions Bot commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review skipped.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai help

@coderabbitai

coderabbitai Bot commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

CodeRabbit commands

These commands are invoked using PR/Issue comments.

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai review --preview-config to test the unmerged CodeRabbit configuration on a draft PR. The requester must have repository write access; preview results are non-authoritative.
  • @coderabbitai rate limit to show your current review rate limit status.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai track in a human-authored review thread to track the original finding until CodeRabbit verifies it is fixed.
  • @coderabbitai fixed in a tracked review thread to verify the current code against the original finding.
  • @coderabbitai evaluate custom pre-merge check --instructions <custom-checks-instructions> --name <custom-checks-title> [--mode <error|warning>] to validate the custom pre-merge checks instructions. Defaults to error when --mode is omitted.
  • @coderabbitai ignore pre-merge checks to override pre-merge checks and get an approval on PR.
  • @coderabbitai run pre-merge checks to run pre-merge checks on the pull request.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai generate unit tests to generate unit tests for this PR.
  • @coderabbitai emit path instructions to emit generated path-specific review instructions for this repository.
  • @coderabbitai generate project vocabulary to list vocabulary that is specific to this repository.
  • @coderabbitai resolve merge conflict to automatically resolve merge conflicts.
  • @coderabbitai autofix to automatically fix issues in the current review thread, or all unresolved review comments when used in the PR conversation.
  • @coderabbitai autopilot to enable Autopilot to fix CodeRabbit findings and required CI, and resolve merge conflicts.
  • @coderabbitai autopilot resume to resume Autopilot for this PR.
  • @coderabbitai autopilot stop to stop Autopilot for this PR.
  • @coderabbitai fix-ci to automatically fix failing CI checks in a stacked pull request.
  • @coderabbitai fix-ci commit to automatically fix failing CI checks by committing fixes to the current branch.
  • @coderabbitai resolve to resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai generate configuration to create a PR that adds the current resolved configuration as .coderabbit.yaml (or show it if already present).
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore or @coderabbit ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

Status, support, documentation and community

  • Visit our status page to check the current availability of CodeRabbit.
  • Create a ticket on our support page for assistance with any issues or questions.
  • Visit our documentation site for detailed information on how to use CodeRabbit.
  • Join our Discord community to connect with other users and get help from the community.
  • Follow us on X/Twitter for updates and announcements.

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai pause

@coderabbitai

coderabbitai Bot commented Oct 3, 2026

Copy link
Copy Markdown
Contributor
✅ Action performed

Reviews paused.

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Oct 3, 2026 •

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review skipped.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@prekshivyas

Copy link
Copy Markdown
Collaborator

@coderabbitai full review

prekshivyas added a commit that referenced this pull request Oct 11, 2026
## Outcome
Linux gateway recovery, cleanup, drift detection, and Podman readiness
share one bounded process-identity reader. A zombie leader can recover
identity from a live sibling in its own thread group, and healthy
gateways retain readiness and ownership when they inherit an environment
larger than 64 KiB. Incomplete identity still fails closed.

## Reason
The full E2E run for #12376 failed to compile its protected trusted-main
checkout because the projected candidate runtime imports this reader,
which main lacks. The reader and its production consumers must reach
main before that protected GPU/rollback/cleanup path can qualify the
upgrade. This PR keeps the protected projection allowlist unchanged.

## Changes
- Centralize gateway cmdline, environment, and executable reads while
preserving executable, user, namespace, target, supervisor/cgroup, and
repeated identity checks.
- Stream at most 64 sibling entries. Keep command/status reads capped at
64 KiB; allow environment reads up to 6 MiB to cover [Linux's documented
exec ceiling](https://man7.org/linux/man-pages/man2/execve.2.html).
Allocate 4 KiB initially and grow only as data arrives; oversized
identity is rejected without trusting a partial value.
- Exercise readiness and scoped ownership with 128 KiB and 3 MiB
inherited environments on both live leaders and live siblings. Cover
over-limit refusal and oversized-command `ps` fallback for matching and
unrelated executables.
- Align both command-reference scan descriptions with the uninstall
guide. Generated OpenClaw, Hermes, and Deep Agents Code references
retain the bounded-scan recovery wording.

## Verification
- Focused Linux tests: 221 passed across six affected files in a
credential-free container. After splitting conditional test setup into
explicit cases, all 58 tests in the two affected files passed again; the
other four files are unchanged. Zombie-leader executable recovery
coverage is retained.
- Regression reproduction against the published `4f3b672b9` reader: four
large-environment readiness cases failed, then passed with this repair.
- `npm run docs`: passed; generated reference variants inspected.
- `npm run lint`: passed, including formatting and all 18 repository
checks.
- Normal signed commit hooks and isolated normal pre-push publication
validation: passed, including CLI typecheck.
- Prior `4f3b672b9` [core
CI](https://github.com/NVIDIA/NemoClaw/actions/runs/38091842719),
[managed Docker and Podman
activation](https://github.com/NVIDIA/NemoClaw/actions/runs/38091842738),
[selected self-hosted
qualification](https://github.com/NVIDIA/NemoClaw/actions/runs/38091844207),
[rootless Linux
E2E](https://github.com/NVIDIA/NemoClaw/actions/runs/38091842723), and
[Podman CPU
proof](https://github.com/NVIDIA/NemoClaw/actions/runs/38091842760)
passed. These results precede the latest repair and do not qualify it.
- The diff contains no secrets, API keys, or credentials.

## Review notes
Latest repair: `e597da662323692be50e2fc66035327ec4d8c93f`. It addresses
[Deepak's requested
changes](#12928 (review)),
including incremental allocation and the suggested fallback regression,
plus Advisor's remaining command-reference P1. All nine [prior Advisor
reports](https://github.com/NVIDIA/NemoClaw/actions/runs/38092989782)
were collected before this update; eight were clear and documentation
was blocked. That finding awaits a fresh exact-head review; it is not
waived.

Sensitive paths in `NVIDIA/NemoClaw` include the changed
`src/lib/onboard/**` process identity consumers. Local diff review and
the tests above cover the repair; CI, Advisor, and independent
maintainer review of the latest commit remain pending. CodeRabbit's
green paused status is not a completed review. No approval or merge is
claimed.

The separate full #12376 E2E objective remains open. No additional
manual E2E selectors were recommended by the nine specialists; the
existing lifecycle and managed-runtime validation floor remains distinct
from the passing narrower workflows. Launchable remains opted out by the
user. This change does not clear unrelated same-base E2E failures.

---
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved gateway detection and readiness checks when a process leader
has exited but another thread is still active.
* Gateway shutdown and scoped cleanup more reliably verify process
ownership before signaling, including when the leader has exited.
* When ownership cannot be confirmed, shutdown avoids signaling the
process and preserves its PID and runtime markers.
* Improved handling of missing, incomplete, or mismatched process
identity information, including during Podman readiness checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
prekshivyas and others added 13 commits October 10, 2026 21:04
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Adopt main's native NVIDIA credential checks from #12920 for Hermes and
OpenClaw; drop the superseded placeholder helpers. Keep routed-onboarding
container discovery and strict baseline reply coverage. Restore main's Pi
receipt authority; the prior merge mixed both receipt pairs.

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Publish receipts from managed-images run 38281421544 at 61142e3, which
contains both main's native hosted provider inputs and the reviewed
direct startup bundle.

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Use main's stop-failure diagnostics instead of collecting twice, keep
full-e2e.test.ts within its line budget by passing readiness capture
arguments positionally, and ratchet the throw-guard census to 526.

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run the pinned sandbox-user native-home cleanup after any privileged
status-1 failure, prove the provider-backed fallback identity and resource
handle, derive the base-image validation user from the shared identity
file, and inline the single-use deferred cleanup diagnostic.

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Restoring main's mock-parity.json dropped this PR's own mappings for the
changed live scenarios. Re-add them and map deferred onboarding to the
native-home destroy fallback test that covers its cleanup path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
@github-actions

Copy link
Copy Markdown
Contributor

PR Review Advisor finished for commit c4131d9. Include the Advisor findings in the complete PR feedback collection. Verify and group valid findings before repair.

Request review only when Require no Advisor blockers is green.

All previous runs

@prekshivyas
prekshivyas merged commit 3746022 into main Oct 13, 2026
@prekshivyas
prekshivyas deleted the nemopatch/deep-agents-upgrade/f1fbd2ef6b194e8a branch October 13, 2026 02:29
@wscurran wscurran added chore Build, CI, dependency, or tooling maintenance security and removed security labels Oct 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: packaging Packages, images, registries, installers, or distribution area: security Security controls, permissions, secrets, or hardening chore Build, CI, dependency, or tooling maintenance integration: dcode LangChain Deep Code integration behavior needs: unblock Blocked item needs dependency or decision resolved platform: container Affects Docker, containerd, Podman, or images platform: linux Affects non-Ubuntu Linux environments

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants