Repository navigation
chore(deps): update LangChain Deep Agents Code to 0.1.71 - #12376
Conversation
Patch-Walker-Manifest: sha256:a0f61cff523ec0832bb6e461e1dfe730a415d48e0890f72ac51a6895d69327f0 Patch-Walker-Action: sha256:b7fb4a31d109f7d4646d6d1e67c20ffc5a2cb05b77a4b014589c518fec0733f9 Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall line coverage in commit c4131d9 in the Show a line coverage summary of the most impacted files.
TypeScript / code-coverage/cliThe overall line coverage in commit c4131d9 in the Show a line coverage summary of the most impacted files.
Updated |
|
@coderabbitai review |
|
@coderabbitai review |
|
@coderabbitai review |
|
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
|
@coderabbitai full review |
|
|
@coderabbitai review |
|
|
@coderabbitai full review |
|
|
@coderabbitai review |
|
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
|
🌿 Preview your docs: https://nvidia-preview-pr-12376.docs.buildwithfern.com/nemoclaw |
|
@coderabbitai review |
|
|
@coderabbitai help |
ChatThere are 3 ways to chat with CodeRabbit:
CodeRabbit commands
Other keywords and placeholders
Status, support, documentation and community
|
|
@coderabbitai pause |
✅ Action performedReviews paused. |
|
@coderabbitai review |
|
|
@coderabbitai full review |
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
## Outcome Linux gateway recovery, cleanup, drift detection, and Podman readiness share one bounded process-identity reader. A zombie leader can recover identity from a live sibling in its own thread group, and healthy gateways retain readiness and ownership when they inherit an environment larger than 64 KiB. Incomplete identity still fails closed. ## Reason The full E2E run for #12376 failed to compile its protected trusted-main checkout because the projected candidate runtime imports this reader, which main lacks. The reader and its production consumers must reach main before that protected GPU/rollback/cleanup path can qualify the upgrade. This PR keeps the protected projection allowlist unchanged. ## Changes - Centralize gateway cmdline, environment, and executable reads while preserving executable, user, namespace, target, supervisor/cgroup, and repeated identity checks. - Stream at most 64 sibling entries. Keep command/status reads capped at 64 KiB; allow environment reads up to 6 MiB to cover [Linux's documented exec ceiling](https://man7.org/linux/man-pages/man2/execve.2.html). Allocate 4 KiB initially and grow only as data arrives; oversized identity is rejected without trusting a partial value. - Exercise readiness and scoped ownership with 128 KiB and 3 MiB inherited environments on both live leaders and live siblings. Cover over-limit refusal and oversized-command `ps` fallback for matching and unrelated executables. - Align both command-reference scan descriptions with the uninstall guide. Generated OpenClaw, Hermes, and Deep Agents Code references retain the bounded-scan recovery wording. ## Verification - Focused Linux tests: 221 passed across six affected files in a credential-free container. After splitting conditional test setup into explicit cases, all 58 tests in the two affected files passed again; the other four files are unchanged. Zombie-leader executable recovery coverage is retained. - Regression reproduction against the published `4f3b672b9` reader: four large-environment readiness cases failed, then passed with this repair. - `npm run docs`: passed; generated reference variants inspected. - `npm run lint`: passed, including formatting and all 18 repository checks. - Normal signed commit hooks and isolated normal pre-push publication validation: passed, including CLI typecheck. - Prior `4f3b672b9` [core CI](https://github.com/NVIDIA/NemoClaw/actions/runs/38091842719), [managed Docker and Podman activation](https://github.com/NVIDIA/NemoClaw/actions/runs/38091842738), [selected self-hosted qualification](https://github.com/NVIDIA/NemoClaw/actions/runs/38091844207), [rootless Linux E2E](https://github.com/NVIDIA/NemoClaw/actions/runs/38091842723), and [Podman CPU proof](https://github.com/NVIDIA/NemoClaw/actions/runs/38091842760) passed. These results precede the latest repair and do not qualify it. - The diff contains no secrets, API keys, or credentials. ## Review notes Latest repair: `e597da662323692be50e2fc66035327ec4d8c93f`. It addresses [Deepak's requested changes](#12928 (review)), including incremental allocation and the suggested fallback regression, plus Advisor's remaining command-reference P1. All nine [prior Advisor reports](https://github.com/NVIDIA/NemoClaw/actions/runs/38092989782) were collected before this update; eight were clear and documentation was blocked. That finding awaits a fresh exact-head review; it is not waived. Sensitive paths in `NVIDIA/NemoClaw` include the changed `src/lib/onboard/**` process identity consumers. Local diff review and the tests above cover the repair; CI, Advisor, and independent maintainer review of the latest commit remain pending. CodeRabbit's green paused status is not a completed review. No approval or merge is claimed. The separate full #12376 E2E objective remains open. No additional manual E2E selectors were recommended by the nine specialists; the existing lifecycle and managed-runtime validation floor remains distinct from the passing narrower workflows. Launchable remains opted out by the user. This change does not clear unrelated same-base E2E failures. --- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved gateway detection and readiness checks when a process leader has exited but another thread is still active. * Gateway shutdown and scoped cleanup more reliably verify process ownership before signaling, including when the leader has exited. * When ownership cannot be confirmed, shutdown avoids signaling the process and preserves its PID and runtime markers. * Improved handling of missing, incomplete, or mismatched process identity information, including during Podman readiness checks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Adopt main's native NVIDIA credential checks from #12920 for Hermes and OpenClaw; drop the superseded placeholder helpers. Keep routed-onboarding container discovery and strict baseline reply coverage. Restore main's Pi receipt authority; the prior merge mixed both receipt pairs. Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Publish receipts from managed-images run 38281421544 at 61142e3, which contains both main's native hosted provider inputs and the reviewed direct startup bundle. Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Use main's stop-failure diagnostics instead of collecting twice, keep full-e2e.test.ts within its line budget by passing readiness capture arguments positionally, and ratchet the throw-guard census to 526. Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Run the pinned sandbox-user native-home cleanup after any privileged status-1 failure, prove the provider-backed fallback identity and resource handle, derive the base-image validation user from the shared identity file, and inline the single-use deferred cleanup diagnostic. Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Restoring main's mock-parity.json dropped this PR's own mappings for the changed live scenarios. Re-add them and map deferred onboarding to the native-home destroy fallback test that covers its cleanup path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
|
PR Review Advisor finished for commit Request review only when Require no Advisor blockers is green. |
Outcome
Upgrade managed LangChain Deep Agents Code from 0.1.55 to 0.1.71 with a hash-locked Python 3.13 dependency graph, updated startup and MCP behavior, and matching onboarding and runtime validation. Preserve the existing security, lifecycle, inference, and cleanup requirements.
Reason
Keep the managed Deep Agents release, dependency lock, startup patches, and lifecycle contract consistent with Deep Agents Code 0.1.71.
Changes
Verification
Commit under review:
c4131d9db91dc4a9f1904d71e9f5af1c91b2c6a6; base1d76efb8fbb7e10ec5dc2dd431dabc30ce54537e; trusted E2E workflow697289aec2e0c5a1a2b8d2ed5a714b31bb5df4b4.Checks on this commit (all green):
Full default PR E2E (run 38327515342), empty selectors, mock inference, no Jetson or Launchable. Final: 77 jobs succeeded, 5 failed (the three Hermes jobs and protected GPU below, plus the
Relevant E2Eaggregate, which fails because of them) and 17 were skipped. The aggregate fails, so no full-suite pass is claimed. These are workflow job counts, not test counts.Passed on this commit: the Deep Agents Code repository-install and deferred-onboarding jobs, MCP bridge for Deep Agents, OpenClaw and Hermes, protected managed-image startup on amd64 and arm64, and the credential generation window.
Comparison with main. The full main run 38290099089 (
e15557e) fails the same three jobs with the same assertions. No job fails on this PR that passes on main.hermes-e2e.test.ts:920,configExport.passedis falsehermes-inference-switch.test.ts:228, PID2341versus11592341versus1160ENOSPC: no space left on device; cleanup passedNo space left on devicewriting/opt/nim/.cache; cleanup passedMain's full run also fails the Hermes Slack credential and channel stop/start Messaging jobs, which pass here. This PR does not claim to fix them, and their cause is not established.
The earlier full run on
6672192(run 38123921937) is superseded by the run above.Remaining qualification
candidate-authority.tsand the twoci/pi-agent-qualification-v1-*.jsonfiles, refreshed to match this branch's candidate inputs. Pi inference qualification is otherwise unrelated to Deep Agents; its known source mismatches are covered by feat(inference): [slice 2] use native hosted providers #12886.Signed-off-by: Prekshi Vyas prekshiv@nvidia.com