fix(cli): recommend and run 'openshell gateway remove' on all platforms (#6569) by jason-ma-nv · Pull Request #6570 · NVIDIA/NemoClaw

jason-ma-nv · 2026-07-09T11:25:46Z

Summary

nemoclaw <name> destroy gated its gateway-removal on process.platform: Linux used openshell gateway remove <name> (correct), while macOS and other non-Linux platforms used openshell gateway destroy -g <name>. Modern OpenShell (≥0.0.44, including the reporter's 0.0.72) has no gateway destroy subcommand and rejects it as unrecognized subcommand 'destroy'.

That mistaken platform assumption caused two bugs:

The reported symptom — the preserved-gateway hint printed a command that fails on macOS:
Shared NemoClaw gateway preserved. Re-run 'openshell gateway destroy -g nemoclaw' to remove it, …
A worse, silent functional bug — nemoclaw destroy --cleanup-gateway on macOS ran only gateway destroy -g (destroy-gateway.ts), which errors and is swallowed by ignoreError: true, so the gateway was silently never removed.

Both share the same root cause: the belief that macOS OpenShell uses gateway destroy. The codebase's own authoritative removal calls (onboard.ts:1184, gateway-destroy.ts:41) already use gateway remove unconditionally.

Fixes #6569.

Changes

src/lib/actions/sandbox/destroy-gateway.ts — run gateway remove <name> (with gateway destroy -g as a best-effort pre-0.0.44 fallback) on all platforms. The Linux-only host gateway-process stop (stopHostGatewayProcesses) is unchanged and stays Linux-gated.
src/lib/actions/sandbox/destroy.ts — the preserved-gateway hint now unconditionally recommends openshell gateway remove <name>.
test/cli/destroy-gateway-cleanup.test.ts — replaced the two process.platform === "linux" ? "gateway remove" : "gateway destroy -g" assertions with unconditional gateway remove (+ not.toContain the destroy -g form), and added an assertion that the preserved-gateway hint recommends openshell gateway remove and never gateway destroy.

gateway destroy -g remains only as the resilient fallback for pre-0.0.44 builds; it is never the primary command or a user-facing recommendation.

Verification

What was proven (local + host, unit level):
- npx vitest run test/cli/destroy-gateway-cleanup.test.ts → 11/11 pass (locally and on the ipp2-0085 verify host, Node 22.23.1).
- npx vitest run src/lib/actions/sandbox/destroy-flow.test.ts test/cli/destroy-gateway-unreachable.test.ts → 17/17 pass.
- npx biome check clean; npx tsx scripts/checks/run.ts all structural checks pass; npm run build:cli succeeds; test-conditionals:scan flags nothing in the touched test file.
- The removal command is now platform-independent, so the Linux-run tests exercise the exact gateway remove→fallback logic macOS now uses.
What remains: a live nemoclaw destroy --cleanup-gateway on a physical macOS host to observe the gateway actually removed. The verify hosts are Linux (x86_64 + aarch64); the macOS-specific branch was unified with the Linux path by this change, so the behavior is fully covered by the platform-independent unit tests above.

Signed-off-by: Jason Ma jama@nvidia.com

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes
- Improved gateway teardown during sandbox destruction to try openshell gateway remove <name> first, and only run openshell gateway destroy -g <name> when removal fails.
- Standardized the manual gateway cleanup hint to always use openshell gateway remove <name>.
Tests
- Updated CLI cleanup tests to enforce consistent remove/destroy behavior and verify the new command order and messaging across cleanup modes and environment opt-in.

…ms (#6569) nemoclaw destroy gated the gateway removal command on process.platform: Linux used 'openshell gateway remove <name>' (correct), while macOS and other platforms used 'openshell gateway destroy -g <name>'. Modern OpenShell (>=0.0.44, incl. 0.0.72) has no 'gateway destroy' subcommand and rejects it as unrecognized, so: - the preserved-gateway hint recommended a command that fails on macOS (the reported symptom), and - --cleanup-gateway on macOS actually ran ONLY 'gateway destroy -g', which errors and is swallowed by ignoreError, silently leaving the gateway behind. Use 'gateway remove <name>' as the primary subcommand on every platform (matching the authoritative runOpenshell(["gateway","remove",...]) calls), keeping 'gateway destroy -g' only as a best-effort fallback for pre-0.0.44 builds. The Linux-only host gateway-process stop is unchanged. Update the tests that encoded the platform ternary and assert the hint recommends the real subcommand. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Jason Ma <jama@nvidia.com>

coderabbitai · 2026-07-09T11:26:05Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6f2e680a-4139-4589-8e08-bd61e06a3d3e

📥 Commits

Reviewing files that changed from the base of the PR and between 9b5e546 and ff2958a.

📒 Files selected for processing (2)

src/lib/actions/sandbox/destroy-gateway.ts
test/cli/destroy-gateway-cleanup.test.ts

🚧 Files skipped from review as they are similar to previous changes (2)

src/lib/actions/sandbox/destroy-gateway.ts
test/cli/destroy-gateway-cleanup.test.ts

📝 Walkthrough

Walkthrough

Gateway cleanup now tries openshell gateway remove first and only falls back to gateway destroy -g if removal fails. The destroy hint was standardized to gateway remove on all platforms, and CLI tests were updated for the new command flow.

Changes

Gateway Remove Command Fix

Layer / File(s)	Summary
Gateway cleanup and hint logic `src/lib/actions/sandbox/destroy-gateway.ts`, `src/lib/actions/sandbox/destroy.ts`	Cleanup now runs `gateway remove` first and falls back to `gateway destroy -g` only on non-zero status; the preserved-gateway hint always suggests `openshell gateway remove` regardless of platform.
Test assertions updated for gateway remove `test/cli/destroy-gateway-cleanup.test.ts`	Tests updated to expect `gateway remove` commands and hints, verify fallback command order, and confirm `gateway destroy` no longer appears in preserved-gateway output.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: bug-fix, area: sandbox

Suggested reviewers: cv, brandonpelfrey

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main fix: using `openshell gateway remove` across platforms.
Linked Issues check	✅ Passed	The PR fixes the bad destroy hint and updates gateway cleanup to use `openshell gateway remove` with a destroy fallback, matching `#6569`.
Out of Scope Changes check	✅ Passed	The added test updates and documentation support the gateway-removal fix and do not introduce unrelated scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/6569-gateway-remove-subcommand

_{Comment @coderabbitai help to get the list of available commands.}

github-code-quality · 2026-07-09T11:26:35Z

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the fix/6569-gateway-rem... branch remains at 77%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	`main` 4970809	`fix/6569-gateway-rem...` ff2958a	+/-
`src/lib/runner.ts`	80%	72%	-8%
`src/lib/messagi...ate-resolver.ts`	100%	96%	-4%
`src/lib/actions...troy-gateway.ts`	10%	7%	-3%
`src/lib/messagi...els/metadata.ts`	100%	99%	-1%
`src/lib/security/redact.ts`	96%	97%	+1%
`src/lib/actions...dbox/destroy.ts`	71%	72%	+1%

_{Updated July 09, 2026 16:31 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

github-actions · 2026-07-09T11:27:54Z

E2E Advisor Recommendation

Required E2E: onboard-repair, onboard-resume, sandbox-operations
Optional E2E: None

Dispatch hint: onboard-repair,onboard-resume,sandbox-operations

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

onboard-repair (high): Required by the deterministic lifecycle-state risk plan: onboarding and sandbox state must converge across persisted metadata, reported status, and the live runtime after cleanup/repair scenarios.
onboard-resume (medium): Required by the deterministic lifecycle-state risk plan: resume scenarios must validate that partially completed lifecycle state can recover without stale gateway or sandbox resources.
sandbox-operations (high): The source changes directly affect real sandbox destroy/gateway cleanup behavior; run the live sandbox operations flow to exercise user-visible sandbox lifecycle operations against OpenShell and Docker.

Optional E2E

None.

New E2E recommendations

cross-platform gateway cleanup (medium): The fix explicitly changes macOS gateway removal guidance and cleanup behavior, but the existing live E2E jobs run on ubuntu-latest. A Darwin live or smoke E2E would catch platform-specific OpenShell gateway subcommand regressions.
- Suggested test: Add a macOS destroy-gateway cleanup E2E/smoke flow that destroys the last sandbox with and without --cleanup-gateway and verifies openshell gateway remove <name> is used before any legacy fallback.

Dispatch hint

Workflow: .github/workflows/e2e.yaml
jobs input: onboard-repair,onboard-resume,sandbox-operations

github-actions · 2026-07-09T11:27:55Z

E2E Target Recommendation

Required E2E targets: onboard-repair, onboard-resume
Optional E2E targets: None

Dispatch required E2E targets:

gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=onboard-repair
gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=onboard-resume

Workflow run

Full E2E target advisor summary

E2E Target Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E targets

onboard-repair: Onboarding and sandbox state must converge across persisted metadata, reported status, and the live runtime.
- Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=onboard-repair
onboard-resume: Onboarding and sandbox state must converge across persisted metadata, reported status, and the live runtime.
- Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=onboard-resume

Optional E2E targets

None.

Relevant changed files

src/lib/actions/sandbox/destroy-gateway.ts
src/lib/actions/sandbox/destroy.ts

github-actions · 2026-07-09T11:28:17Z

PR Review Advisor (Nemotron Ultra) — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 5 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Action checklist

PRA-T1 Add or justify test follow-up: Runtime validation
PRA-T2 Add or justify test follow-up: Runtime validation
PRA-T3 Add or justify test follow-up: Runtime validation
PRA-T4 Add or justify test follow-up: Runtime validation
PRA-T5 Add or justify test follow-up: Runtime validation

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

PRA-T1 Runtime validation — Run the `onboard-repair` E2E job for Onboarding and sandbox state must converge across persisted metadata, reported status, and the live runtime. Matched files: `src/lib/actions/sandbox/destroy-gateway.ts`, `src/lib/actions/sandbox/destroy.ts`.. Deterministic regression risks require live validation: lifecycle-state. Deterministic regression risks require live validation: lifecycle-state family invariants (partial failure convergence, status agreement with probed state, cleanup preservation of unrelated sandboxes). Unit/mocked coverage adequate (11 tests in destroy-gateway-cleanup.test.ts). Two gaps: no version-gate test proving fallback inactive on modern OpenShell; fallback test verifies command sequence but not success semantics. Required jobs onboard-repair and onboard-resume are CI E2E validation floors.
PRA-T2 Runtime validation — Add test asserting 'gateway destroy -g' is NOT called when 'gateway remove' succeeds (proves fallback inactive on modern CLI). Deterministic regression risks require live validation: lifecycle-state. Deterministic regression risks require live validation: lifecycle-state family invariants (partial failure convergence, status agreement with probed state, cleanup preservation of unrelated sandboxes). Unit/mocked coverage adequate (11 tests in destroy-gateway-cleanup.test.ts). Two gaps: no version-gate test proving fallback inactive on modern OpenShell; fallback test verifies command sequence but not success semantics. Required jobs onboard-repair and onboard-resume are CI E2E validation floors.
PRA-T3 Runtime validation — Run the `onboard-resume` E2E job for Onboarding and sandbox state must converge across persisted metadata, reported status, and the live runtime. Matched files: `src/lib/actions/sandbox/destroy-gateway.ts`, `src/lib/actions/sandbox/destroy.ts`.. Deterministic regression risks require live validation: lifecycle-state. Deterministic regression risks require live validation: lifecycle-state family invariants (partial failure convergence, status agreement with probed state, cleanup preservation of unrelated sandboxes). Unit/mocked coverage adequate (11 tests in destroy-gateway-cleanup.test.ts). Two gaps: no version-gate test proving fallback inactive on modern OpenShell; fallback test verifies command sequence but not success semantics. Required jobs onboard-repair and onboard-resume are CI E2E validation floors.
PRA-T4 Runtime validation — Add unit test for cleanupGatewayAfterLastSandbox directly mocking openshell: fail on 'gateway remove', succeed on 'gateway destroy -g', assert function completes without throwing and dockerRemoveVolumesByPrefix called. Deterministic regression risks require live validation: lifecycle-state. Deterministic regression risks require live validation: lifecycle-state family invariants (partial failure convergence, status agreement with probed state, cleanup preservation of unrelated sandboxes). Unit/mocked coverage adequate (11 tests in destroy-gateway-cleanup.test.ts). Two gaps: no version-gate test proving fallback inactive on modern OpenShell; fallback test verifies command sequence but not success semantics. Required jobs onboard-repair and onboard-resume are CI E2E validation floors.
PRA-T5 Runtime validation — Run onboard-repair E2E job for lifecycle-state convergence. Deterministic regression risks require live validation: lifecycle-state. Deterministic regression risks require live validation: lifecycle-state family invariants (partial failure convergence, status agreement with probed state, cleanup preservation of unrelated sandboxes). Unit/mocked coverage adequate (11 tests in destroy-gateway-cleanup.test.ts). Two gaps: no version-gate test proving fallback inactive on modern OpenShell; fallback test verifies command sequence but not success semantics. Required jobs onboard-repair and onboard-resume are CI E2E validation floors.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

github-actions · 2026-07-09T11:29:36Z

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 4 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Action checklist

PRA-T1 Add or justify test follow-up: Runtime validation
PRA-T2 Add or justify test follow-up: Runtime validation
PRA-T3 Add or justify test follow-up: Runtime validation
PRA-T4 Add or justify test follow-up: Runtime validation

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

PRA-T1 Runtime validation — Run the `onboard-repair` E2E job for Onboarding and sandbox state must converge across persisted metadata, reported status, and the live runtime. Matched files: `src/lib/actions/sandbox/destroy-gateway.ts`, `src/lib/actions/sandbox/destroy.ts`.. Deterministic regression risks require live validation: lifecycle-state. Local CLI regression coverage is sufficient for the code-level behavior changed in this PR, including preserve-by-default hinting, all-platform primary `gateway remove`, remove-failure fallback, volume cleanup, and unrelated gateway preservation. The deterministic risk plan still marks lifecycle-state tier 2, so runtime validation remains the external validation floor.
PRA-T2 Runtime validation — Run the `onboard-repair` E2E job to validate lifecycle-state convergence across persisted metadata, reported status, and the live runtime for the changed destroy/gateway cleanup paths.. Deterministic regression risks require live validation: lifecycle-state. Local CLI regression coverage is sufficient for the code-level behavior changed in this PR, including preserve-by-default hinting, all-platform primary `gateway remove`, remove-failure fallback, volume cleanup, and unrelated gateway preservation. The deterministic risk plan still marks lifecycle-state tier 2, so runtime validation remains the external validation floor.
PRA-T3 Runtime validation — Run the `onboard-resume` E2E job for Onboarding and sandbox state must converge across persisted metadata, reported status, and the live runtime. Matched files: `src/lib/actions/sandbox/destroy-gateway.ts`, `src/lib/actions/sandbox/destroy.ts`.. Deterministic regression risks require live validation: lifecycle-state. Local CLI regression coverage is sufficient for the code-level behavior changed in this PR, including preserve-by-default hinting, all-platform primary `gateway remove`, remove-failure fallback, volume cleanup, and unrelated gateway preservation. The deterministic risk plan still marks lifecycle-state tier 2, so runtime validation remains the external validation floor.
PRA-T4 Runtime validation — Run the `onboard-resume` E2E job to validate recovery/resume behavior after gateway cleanup changes, especially absence of ghost resources or stale ports after partial failures.. Deterministic regression risks require live validation: lifecycle-state. Local CLI regression coverage is sufficient for the code-level behavior changed in this PR, including preserve-by-default hinting, all-platform primary `gateway remove`, remove-failure fallback, volume cleanup, and unrelated gateway preservation. The deterministic risk plan still marks lifecycle-state tier 2, so runtime validation remains the external validation floor.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

jason-ma-nv · 2026-07-09T11:59:31Z

Advisor checklist — resolved / justified

PRA-1 (advisor unavailable — "canonical finding ledger mismatch after retry") — this is an advisor-infrastructure failure, not a finding about this change. No file-specific issue was reported. The diff is small and self-contained (unify the gateway-removal subcommand across platforms), CI is green (46 checks), and CodeRabbit surfaced no line-level findings. Requesting a re-run; no code action indicated.
PRA-T1 / PRA-T2 (runtime validation) — already covered. test/cli/destroy-gateway-cleanup.test.ts is a CLI-dispatch integration test that runs the real nemoclaw destroy against a fake openshell on PATH and asserts the actual commands issued. It now asserts gateway remove <name> (and not.toContain gateway destroy -g) unconditionally, and asserts the preserved-gateway hint recommends openshell gateway remove. Because this change unifies the previously macOS-only branch onto the same remove→fallback path as Linux, the Linux-run integration tests exercise the exact logic macOS now uses.
Remaining (documented in the PR "Verification" section): a live nemoclaw destroy --cleanup-gateway on a physical macOS host to watch the gateway actually get removed. The verify hosts are Linux (x86_64 + aarch64); the macOS branch is no longer distinct, so behavior is fully covered by the platform-independent unit tests.

Signed-off-by: Jason Ma jama@nvidia.com

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

github-actions · 2026-07-09T16:01:21Z

E2E Target Results — ✅ All requested jobs passed

Run: 29031341826
Workflow ref: fix/6569-gateway-remove-subcommand
Requested targets: (default — all supported)
Requested jobs: onboard-repair,onboard-resume,sandbox-operations
Summary: 3 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
onboard-repair	✅ success
onboard-resume	✅ success
sandbox-operations	✅ success

cv · 2026-07-09T16:04:38Z

Exact-head runtime evidence after the `main` refresh

Head: be2e46c5a8a29b03c381d5bb14076f3d67090112, with current main 4970809a55c5063007b10de3d74877b1bcf8b799 merged normally. The three-file functional diff is byte-for-byte unchanged by the merge.

The E2E Advisor's exact required set passed in run 29031341826, and every selected job log confirms checkout of be2e46c5a8a29b03c381d5bb14076f3d67090112:

onboard-repair: 1/1 live test passed against OpenShell 0.0.72; repair recreated missing runtime state and rejected conflicting resume inputs.
onboard-resume: 1/1 live test passed against OpenShell 0.0.72; interrupted onboarding resumed without repeating cached lifecycle steps.
sandbox-operations: 1/1 live test passed; list/status/log/recovery/multi-sandbox and destroy convergence contracts held.

The refreshed ordinary rollup is also green (43/43). On the merged tree, npm run build:cli passed and the focused destroy coverage passed 28/28: 11 gateway-cleanup dispatch tests, 15 destroy-flow tests, and 2 unreachable-gateway tests. The dispatch tests cover the exact changed boundary: modern gateway remove selection on the cleanup path and the user-facing preservation hint.

For the Nemotron partial-failure note: a successful gateway remove followed by a failed fallback is not a reachable sequence because the fallback executes only when removeResult.status !== 0. Docker volume cleanup is unconditional after that branch, so neither fallback success nor fallback failure can skip it. The live lifecycle floor and focused command-selection coverage above therefore address the changed behavior without a further source change.

Signed-off-by: Carlos Villela cvillela@nvidia.com

Co-authored-by: Jason Ma <jama@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

github-actions · 2026-07-09T16:16:34Z

E2E Target Results — ✅ All requested jobs passed

Run: 29032327832
Workflow ref: fix/6569-gateway-remove-subcommand
Requested targets: (default — all supported)
Requested jobs: onboard-repair,onboard-resume,sandbox-operations
Summary: 3 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
onboard-repair	✅ success
onboard-resume	✅ success
sandbox-operations	✅ success

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

github-actions · 2026-07-09T16:31:01Z

E2E Target Results — ❌ Some jobs failed

Run: 29033232462
Workflow ref: fix/6569-gateway-remove-subcommand
Requested targets: (default — all supported)
Requested jobs: onboard-repair,onboard-resume,sandbox-operations
Summary: 2 passed, 1 failed, 0 cancelled, 0 skipped

Job	Result
onboard-repair	✅ success
onboard-resume	❌ failure
sandbox-operations	✅ success

Failed jobs: onboard-resume. Check run artifacts for logs.

github-actions · 2026-07-09T16:35:37Z

E2E Target Results — ✅ All requested jobs passed

Run: 29033232462
Workflow ref: fix/6569-gateway-remove-subcommand
Requested targets: (default — all supported)
Requested jobs: onboard-repair,onboard-resume,sandbox-operations
Summary: 3 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
onboard-repair	✅ success
onboard-resume	✅ success
sandbox-operations	✅ success

cv · 2026-07-09T16:36:52Z

Exact-head follow-up verification

Head: ff2958a9b6b61cc6c6071a6cb3138bcd3fceb9cc

The three advisor findings are now covered directly:

successful gateway remove asserts Docker-volume cleanup;
remove-nonzero asserts the ordered legacy gateway destroy -g fallback and continued volume cleanup; and
the compatibility block records its source boundary, regression proof, and removal condition against the repository's min_openshell_version policy.

Verification on the final tree:

Ordinary CI: 47/47 settled green, with no pending or failing checks.
Local: npm run build:cli passed; the focused destroy suite passed 28/28; npm run check:diff and normal commit/push hooks passed.
Required live E2E: run 29033232462 completed successfully on attempt 2. Every selected job log confirms checkout of ff2958a9b6b61cc6c6071a6cb3138bcd3fceb9cc and OpenShell 0.0.72:
- onboard-repair: 1/1 passed; artifact 8204874880, sha256:0903ff22a02dec9d42b8402124c1ab98c024753e661913cc0c9c49717c5bb9ca.
- onboard-resume: 1/1 passed on the failed-job retry; artifact 8205047609, sha256:ad7eb250f8c9cf8f60f87c15b270659f5fee1b18935cbb79d4edc72032092482.
- sandbox-operations: 1/1 passed; artifact 8204933566, sha256:45d2c31b44b1120058d650cb310d218427bc25c6e0e364db4c91e21c7fe263eb.

The first onboard-resume attempt stopped before tests because the OpenShell download returned HTTP 504; the failed-job-only retry installed OpenShell successfully and passed the live test.

Signed-off-by: Carlos Villela cvillela@nvidia.com

apurvvkumaria

Exact head ff2958a is ready for final human merge. Normal CI is green, the required onboard-repair, onboard-resume, and sandbox-operations live jobs passed after the infrastructure retry, both refreshed advisors recommend merge_as_is, and CodeRabbit has no actionable thread.

cv

Approved at exact head ff2958a. All 47 ordinary checks, the required onboard-repair/onboard-resume/sandbox-operations live E2Es, contributor compliance, CodeRabbit, and both exact-head advisor reviews are green.

## Summary Adds the pre-tag v0.0.79 release notes entry to `docs/about/release-notes.mdx` so the release plan can be generated after docs merge. The entry summarizes the merged v0.0.79 release train across inference, diagnostics, runtime hardening, policies, onboarding recovery, and release validation. ## Changes - Added the v0.0.79 release notes section with linked follow-up documentation for OpenRouter onboarding, managed vLLM changes, completion and logging, Deep Agents runtime limits, policy updates, onboarding recovery, and release validation. - Source summary: - #6461 -> `docs/about/release-notes.mdx`: Documents OpenRouter onboarding support and links to inference/provider references. - #6271 and #6272 -> `docs/about/release-notes.mdx`: Documents shell completion and structured logging highlights. - #6465, #6539, #6570, and #6528 -> `docs/about/release-notes.mdx`: Documents status route-drift, orphaned sandbox, gateway cleanup, and DGX Spark express-install diagnostics. - #6523, #6551, #6484, #6488, #6324, and #6542 -> `docs/about/release-notes.mdx`: Documents managed vLLM, Qwen3.6 tool parser, compaction, and timeout/readiness improvements. - #6559, #6538, #6560, #6568, #6552, #6567, and #6587 -> `docs/about/release-notes.mdx`: Documents runtime, credential, proxy, PID namespace, TOML, and provider-state hardening. - #6541, #5415, #6246, #6496, and #6573 -> `docs/about/release-notes.mdx`: Documents GitHub policy, Gmail policy, MCP allowlist, WhatsApp, and messaging-variant updates. - #6253, #6572, #6444, #6536, and #5860 -> `docs/about/release-notes.mdx`: Documents onboarding resume and create-step recovery improvements. - #6508, #6527, #5506, #6588, #6446, #6447, #6582, #6296, #6367, #6397, and #6505 -> `docs/about/release-notes.mdx`: Documents docs, release-risk, and E2E validation updates. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates  - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: Release-note prose only. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification  - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: Tests not applicable, release-note prose only. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Docs validation note: `npm run docs:check-agent-variants && npm run docs:check-routes && git diff --check` passed. Full `npm run docs` is currently blocked before Fern validation because the pinned `fern-api@5.65.2` package is unavailable from npm (`ETARGET No matching version found`). ---  Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>  ## Summary by CodeRabbit * **Documentation** * Added release notes for v0.0.79 with a new summary of recent improvements, including onboarding and inference options, operator/CLI diagnostics, sandbox recovery hardening, runtime limits, network policy behavior, and release validation updates. * Added updated references and links for the latest release.

…ms (NVIDIA#6569) (NVIDIA#6570) ## Summary `nemoclaw <name> destroy` gated its gateway-removal on `process.platform`: Linux used `openshell gateway remove <name>` (correct), while **macOS and other non-Linux platforms used `openshell gateway destroy -g <name>`**. Modern OpenShell (≥0.0.44, including the reporter's 0.0.72) has **no `gateway destroy` subcommand** and rejects it as `unrecognized subcommand 'destroy'`. That mistaken platform assumption caused two bugs: 1. **The reported symptom** — the preserved-gateway hint printed a command that fails on macOS: `Shared NemoClaw gateway preserved. Re-run 'openshell gateway destroy -g nemoclaw' to remove it, …` 2. **A worse, silent functional bug** — `nemoclaw destroy --cleanup-gateway` on macOS ran **only** `gateway destroy -g` (`destroy-gateway.ts`), which errors and is swallowed by `ignoreError: true`, so the gateway was **silently never removed**. Both share the same root cause: the belief that macOS OpenShell uses `gateway destroy`. The codebase's own authoritative removal calls (`onboard.ts:1184`, `gateway-destroy.ts:41`) already use `gateway remove` unconditionally. Fixes NVIDIA#6569. ## Changes - **`src/lib/actions/sandbox/destroy-gateway.ts`** — run `gateway remove <name>` (with `gateway destroy -g` as a best-effort pre-0.0.44 fallback) on **all** platforms. The Linux-only host gateway-process stop (`stopHostGatewayProcesses`) is unchanged and stays Linux-gated. - **`src/lib/actions/sandbox/destroy.ts`** — the preserved-gateway hint now unconditionally recommends `openshell gateway remove <name>`. - **`test/cli/destroy-gateway-cleanup.test.ts`** — replaced the two `process.platform === "linux" ? "gateway remove" : "gateway destroy -g"` assertions with unconditional `gateway remove` (+ `not.toContain` the `destroy -g` form), and added an assertion that the preserved-gateway hint recommends `openshell gateway remove` and never `gateway destroy`. `gateway destroy -g` remains **only** as the resilient fallback for pre-0.0.44 builds; it is never the primary command or a user-facing recommendation. ## Verification - **What was proven (local + host, unit level):** - `npx vitest run test/cli/destroy-gateway-cleanup.test.ts` → **11/11 pass** (locally and on the `ipp2-0085` verify host, Node 22.23.1). - `npx vitest run src/lib/actions/sandbox/destroy-flow.test.ts test/cli/destroy-gateway-unreachable.test.ts` → 17/17 pass. - `npx biome check` clean; `npx tsx scripts/checks/run.ts` all structural checks pass; `npm run build:cli` succeeds; `test-conditionals:scan` flags nothing in the touched test file. - The removal command is now platform-independent, so the Linux-run tests exercise the exact `gateway remove`→fallback logic macOS now uses. - **What remains:** a live `nemoclaw destroy --cleanup-gateway` on a physical **macOS** host to observe the gateway actually removed. The verify hosts are Linux (x86_64 + aarch64); the macOS-specific branch was unified with the Linux path by this change, so the behavior is fully covered by the platform-independent unit tests above. Signed-off-by: Jason Ma <jama@nvidia.com> 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **Bug Fixes** * Improved gateway teardown during sandbox destruction to try `openshell gateway remove <name>` first, and only run `openshell gateway destroy -g <name>` when removal fails. * Standardized the manual gateway cleanup hint to always use `openshell gateway remove <name>`. * **Tests** * Updated CLI cleanup tests to enforce consistent remove/destroy behavior and verify the new command order and messaging across cleanup modes and environment opt-in.  --------- Signed-off-by: Jason Ma <jama@nvidia.com> Signed-off-by: Carlos Villela <cvillela@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Apurv Kumaria <akumaria@nvidia.com>

## Summary Adds the pre-tag v0.0.79 release notes entry to `docs/about/release-notes.mdx` so the release plan can be generated after docs merge. The entry summarizes the merged v0.0.79 release train across inference, diagnostics, runtime hardening, policies, onboarding recovery, and release validation. ## Changes - Added the v0.0.79 release notes section with linked follow-up documentation for OpenRouter onboarding, managed vLLM changes, completion and logging, Deep Agents runtime limits, policy updates, onboarding recovery, and release validation. - Source summary: - NVIDIA#6461 -> `docs/about/release-notes.mdx`: Documents OpenRouter onboarding support and links to inference/provider references. - NVIDIA#6271 and NVIDIA#6272 -> `docs/about/release-notes.mdx`: Documents shell completion and structured logging highlights. - NVIDIA#6465, NVIDIA#6539, NVIDIA#6570, and NVIDIA#6528 -> `docs/about/release-notes.mdx`: Documents status route-drift, orphaned sandbox, gateway cleanup, and DGX Spark express-install diagnostics. - NVIDIA#6523, NVIDIA#6551, NVIDIA#6484, NVIDIA#6488, NVIDIA#6324, and NVIDIA#6542 -> `docs/about/release-notes.mdx`: Documents managed vLLM, Qwen3.6 tool parser, compaction, and timeout/readiness improvements. - NVIDIA#6559, NVIDIA#6538, NVIDIA#6560, NVIDIA#6568, NVIDIA#6552, NVIDIA#6567, and NVIDIA#6587 -> `docs/about/release-notes.mdx`: Documents runtime, credential, proxy, PID namespace, TOML, and provider-state hardening. - NVIDIA#6541, NVIDIA#5415, NVIDIA#6246, NVIDIA#6496, and NVIDIA#6573 -> `docs/about/release-notes.mdx`: Documents GitHub policy, Gmail policy, MCP allowlist, WhatsApp, and messaging-variant updates. - NVIDIA#6253, NVIDIA#6572, NVIDIA#6444, NVIDIA#6536, and NVIDIA#5860 -> `docs/about/release-notes.mdx`: Documents onboarding resume and create-step recovery improvements. - NVIDIA#6508, NVIDIA#6527, NVIDIA#5506, NVIDIA#6588, NVIDIA#6446, NVIDIA#6447, NVIDIA#6582, NVIDIA#6296, NVIDIA#6367, NVIDIA#6397, and NVIDIA#6505 -> `docs/about/release-notes.mdx`: Documents docs, release-risk, and E2E validation updates. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [x] Doc only (prose changes, no code sample modifications) - [ ] Doc only (includes code sample changes) ## Quality Gates  - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: Release-note prose only. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification  - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: Tests not applicable, release-note prose only. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Docs validation note: `npm run docs:check-agent-variants && npm run docs:check-routes && git diff --check` passed. Full `npm run docs` is currently blocked before Fern validation because the pinned `fern-api@5.65.2` package is unavailable from npm (`ETARGET No matching version found`). ---  Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>  ## Summary by CodeRabbit * **Documentation** * Added release notes for v0.0.79 with a new summary of recent improvements, including onboarding and inference options, operator/CLI diagnostics, sandbox recovery hardening, runtime limits, network policy behavior, and release validation updates. * Added updated references and links for the latest release.

apurvvkumaria added the v0.0.79 Release target label Jul 9, 2026

apurvvkumaria self-assigned this Jul 9, 2026

merge(main): refresh gateway removal fix

be2e46c

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

test(cli): cover gateway removal fallback

9b5e546

Co-authored-by: Jason Ma <jama@nvidia.com> Signed-off-by: Apurv Kumaria <akumaria@nvidia.com>

test(cli): complete gateway cleanup coverage

ff2958a

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

apurvvkumaria approved these changes Jul 9, 2026

View reviewed changes

cv approved these changes Jul 9, 2026

View reviewed changes

apurvvkumaria merged commit 6fa1881 into main Jul 9, 2026
204 of 205 checks passed

apurvvkumaria deleted the fix/6569-gateway-remove-subcommand branch July 9, 2026 17:30

jyaunches mentioned this pull request Jul 9, 2026

docs: prepare v0.0.79 release notes #6594

Merged

21 tasks

wscurran added area: cli Command line interface, flags, terminal UX, or output bug-fix PR fixes a bug or regression labels Jul 12, 2026

hunglp6d mentioned this pull request Jul 24, 2026

VDR 5 checklist: non-DGX findings and current-release verification #7209

Open

82 tasks

Uh oh!

Conversation

jason-ma-nv commented Jul 9, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

github-code-quality Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Coverage Overview

TypeScript / code-coverage/plugin

TypeScript / code-coverage/cli

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Advisor Recommendation

E2E Recommendation Advisor

Required E2E

Optional E2E

New E2E recommendations

Dispatch hint

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Target Recommendation

E2E Target Advisor

Required E2E targets

Optional E2E targets

Relevant changed files

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor (Nemotron Ultra) — No blocking findings

Action checklist

Uh oh!

github-actions Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor — No blocking findings

Action checklist

Uh oh!

jason-ma-nv commented Jul 9, 2026

Advisor checklist — resolved / justified

Uh oh!

github-actions Bot commented Jul 9, 2026

E2E Target Results — ✅ All requested jobs passed

Uh oh!

cv commented Jul 9, 2026

Exact-head runtime evidence after the main refresh

Uh oh!

github-actions Bot commented Jul 9, 2026

E2E Target Results — ✅ All requested jobs passed

Uh oh!

github-actions Bot commented Jul 9, 2026

E2E Target Results — ❌ Some jobs failed

Uh oh!

github-actions Bot commented Jul 9, 2026

E2E Target Results — ✅ All requested jobs passed

Uh oh!

cv commented Jul 9, 2026

Exact-head follow-up verification

Uh oh!

apurvvkumaria left a comment

Choose a reason for hiding this comment

Uh oh!

cv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

jason-ma-nv commented Jul 9, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 9, 2026 •

edited

Loading

github-code-quality Bot commented Jul 9, 2026 •

edited

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading

github-actions Bot commented Jul 9, 2026 •

edited

Loading

Exact-head runtime evidence after the `main` refresh