Merge branch 'main' into fix/debug-bundle-url-credential-redaction

Author: apurvvkumaria

agents/hermes/Dockerfile

@@ -9,9 +9,9 @@
 ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:212de47e723e9fec1e697d4eec1db82af2d0fb7802aade4fa5dfc3f05274d3c5
 ARG NEMOCLAW_CORPORATE_CA_B64=
 ARG NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION=0
-# Portable Podman does not provide BuildKit's automatic platform arguments.
-# Its accepted x86_64 path uses this default; multi-platform builders override it.
-ARG TARGETARCH=amd64
+# BuildKit supplies this automatic platform argument. The Portable staged
+# context pins its accepted x86_64 target because Podman does not supply it.
+ARG TARGETARCH
 
 # The reviewed npm graph is audited in CI; image assembly copies only its
 # generated runtime artifacts and therefore needs neither npm nor network.
@@ -269,14 +269,12 @@ RUN if ! grep -Fq 'ensure("memory.hindsight", prompt=False)' /opt/hermes/hermes_
     && rm /scripts/hermes-security-dependencies.patch
 
 # The final Hermes image owns the shipped dependency boundary independently of
-# base freshness. Reassert the idempotent npm-private node-tar fix here. When
-# onboarding supplied a corporate CA, use it for the registry-backed download.
-RUN if [ -f /usr/local/share/nemoclaw/corporate-ca.pem ]; then \
-      export CURL_CA_BUNDLE=/usr/local/share/nemoclaw/corporate-ca.pem; \
-      export NODE_EXTRA_CA_CERTS=/usr/local/share/nemoclaw/corporate-ca.pem; \
-    fi; \
-    node --experimental-strip-types /scripts/patch-bundled-npm-tar.mts \
-      --npm-root /usr/local/lib/node_modules/npm
+# base freshness. Reassert the idempotent npm-private node-tar fix from the
+# locked cache seed so protected rebuilds remain network-disabled.
+COPY tools/mcp-tool-discovery-runtime/npm-cache-seed/tar-7.5.21.tgz /tmp/nemoclaw-bundled-npm-tar.tgz
+RUN node --experimental-strip-types /scripts/patch-bundled-npm-tar.mts \
+      --npm-root /usr/local/lib/node_modules/npm \
+      --archive /tmp/nemoclaw-bundled-npm-tar.tgz
 
 # Reassert the npm-private brace-expansion fix for the exact final filesystem.
 # When onboarding supplied a corporate CA, use it for the registry-backed

agents/langchain-deepagents-code/validate-read-only-mcp-call.py

@@ -3,6 +3,7 @@
 """Validate deterministic read-only MCP calls against the installed package."""
 
 import datetime
+import errno
 import ipaddress
 import json
 import signal
@@ -183,14 +184,22 @@ def ambiguous_b_c() -> str:
     )
 
 
-def _container_address() -> str:
-    with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as probe:
-        probe.connect(("10.255.255.254", 1))
-        address = probe.getsockname()[0]
+def _validation_hosts() -> tuple[str, str]:
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as probe:
+            probe.connect(("10.255.255.254", 1))
+            address = probe.getsockname()[0]
+    except OSError as error:
+        if error.errno != errno.ENETUNREACH:
+            raise
+        # Protected image rebuilds deliberately disable BuildKit networking.
+        # Bind to loopback while using a canonical DNS name so the validation
+        # still exercises the managed destination and local TLS/MCP contracts.
+        return "127.0.0.1", "localhost"
     parsed = ipaddress.ip_address(address)
     if parsed.version != 4 or parsed.is_loopback or parsed.is_link_local:
         raise RuntimeError("validation server did not resolve a routed IPv4 address")
-    return address
+    return address, address
 
 
 def _free_port(host: str) -> int:
@@ -208,6 +217,10 @@ def _write_certificate(directory: Path, host: str) -> tuple[Path, Path]:
     key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
     name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, host)])
     now = datetime.datetime.now(datetime.timezone.utc)
+    try:
+        alternative_name: x509.GeneralName = x509.IPAddress(ipaddress.ip_address(host))
+    except ValueError:
+        alternative_name = x509.DNSName(host)
     certificate = (
         x509.CertificateBuilder()
         .subject_name(name)
@@ -217,7 +230,7 @@ def _write_certificate(directory: Path, host: str) -> tuple[Path, Path]:
         .not_valid_before(now - datetime.timedelta(minutes=1))
         .not_valid_after(now + datetime.timedelta(minutes=10))
         .add_extension(
-            x509.SubjectAlternativeName([x509.IPAddress(ipaddress.ip_address(host))]),
+            x509.SubjectAlternativeName([alternative_name]),
             critical=False,
         )
         .sign(key, hashes.SHA256())
@@ -493,14 +506,14 @@ def main() -> None:
     if len(sys.argv) != 1:
         raise RuntimeError("invalid validation command")
 
-    host = _container_address()
-    port = _free_port(host)
-    malformed_port = _free_port(host)
+    bind_host, url_host = _validation_hosts()
+    port = _free_port(bind_host)
+    malformed_port = _free_port(bind_host)
     while malformed_port == port:
-        malformed_port = _free_port(host)
+        malformed_port = _free_port(bind_host)
     with tempfile.TemporaryDirectory(prefix="nemoclaw-read-only-mcp-") as raw_directory:
         directory = Path(raw_directory)
-        cert, key = _write_certificate(directory, host)
+        cert, key = _write_certificate(directory, url_host)
         marker = directory / "calls"
         malformed_marker = directory / "malformed-calls"
         processes = [
@@ -511,7 +524,7 @@ def main() -> None:
                     str(Path(__file__)),
                     "--server",
                     mode,
-                    host,
+                    bind_host,
                     str(server_port),
                     str(cert),
                     str(key),
@@ -527,10 +540,10 @@ def main() -> None:
             )
         ]
         try:
-            _wait_for_server(host, port, cert, processes[0])
-            _wait_for_server(host, malformed_port, cert, processes[1])
+            _wait_for_server(url_host, port, cert, processes[0])
+            _wait_for_server(url_host, malformed_port, cert, processes[1])
             _validate(
-                host,
+                url_host,
                 port,
                 malformed_port,
                 cert,

docs/manage-sandboxes/manage-messaging-channels.mdx

@@ -113,8 +113,9 @@ The next rebuild reuses the bridge provider without requiring the service-accoun
 Hermes Google Chat does not use the dedicated webhook endpoint or `$$nemoclaw tunnel` commands.
 </AgentOnly>
 
-When `channels start` re-enables a channel, NemoClaw reapplies the matching built-in policy preset before rebuild.
-If policy restoration fails, the command keeps the channel disabled and exits without rebuilding into a partially active state.
+When `channels start` re-enables a channel, NemoClaw records the channel as enabled in the messaging plan.
+The rebuild attaches the existing bridge provider before applying its matching built-in policy preset to the replacement sandbox.
+If the command queues the change without rebuilding, the running sandbox keeps its existing bridge and network policy until you rebuild it.
 
 ## Avoid Cross-Sandbox Conflicts
 

docs/reference/commands.mdx

@@ -2981,12 +2981,13 @@ Use `channels stop` instead of `channels remove` when you want to pause a bridge
 
 ### `$$nemoclaw <name> channels start <channel>`
 
-Re-enable a channel previously paused with `channels stop`. The channel is removed from the disabled list, the sandbox is rebuilt, and the bridge registers with the gateway again using the stored credentials.
+Re-enable a channel previously paused with `channels stop`.
 The command verifies that the sandbox's agent runtime supports the channel before reading configured or disabled channel state.
 It then requires the channel to be configured for the sandbox.
-Before the rebuild, NemoClaw reapplies the matching built-in network policy preset so the restored bridge has egress to its upstream API.
-Before updating the disabled list or applying the policy, NemoClaw prints the exact effective egress scope when the preset would open or replace access, or reports that no new egress would be opened when the preset is already effective.
-If policy restoration fails, NemoClaw rolls the channel back to disabled and exits without rebuilding into a partially active state.
+NemoClaw removes the channel from the disabled list and records it as enabled in the messaging plan.
+The rebuild uses that plan to attach the existing bridge provider before applying its matching built-in network policy preset to the replacement sandbox.
+Before updating the disabled list, NemoClaw prints the exact effective egress scope when the preset would open or replace access, or reports that no new egress would be opened when the preset is already effective.
+If the command queues the change without rebuilding, the running sandbox keeps its existing bridge and network policy until you run `$$nemoclaw <name> rebuild`.
 
 ```bash
 $$nemoclaw my-assistant channels start telegram

scripts/patch-bundled-npm-tar.mts

@@ -16,9 +16,10 @@ import {
   readFileSync,
   renameSync,
   rmSync,
+  writeFileSync,
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import {
@@ -136,7 +137,7 @@ export function patchBundledNpmTar(options: {
   const stagingRoot = mkdtempSync(join(dirname(livePath), ".tar.nemoclaw-stage-"));
   const stagedPath = join(stagingRoot, "replacement");
   const backupPath = `${livePath}.nemoclaw-backup-${transactionId}`;
-  let mutationStarted = false;
+  let rollbackRequired = false;
   try {
     cpSync(replacementRoot, stagedPath, { dereference: false, recursive: true });
     cpSync(livePath, backupPath, {
@@ -146,17 +147,18 @@ export function patchBundledNpmTar(options: {
       preserveTimestamps: true,
       recursive: true,
     });
-    mutationStarted = true;
+    rollbackRequired = true;
     rmSync(livePath, { recursive: true });
     renameSync(stagedPath, livePath);
     const fixed = verifyBundledNpmTar(npmRoot);
     if (fixed.tarVersion !== FIXED_TAR_VERSION) {
       throw new Error(`npm bundled tar replacement did not reach tar@${FIXED_TAR_VERSION}`);
     }
+    rollbackRequired = false;
     rmSync(backupPath, { force: true, recursive: true });
     return fixed;
   } catch (error) {
-    if (mutationStarted) {
+    if (rollbackRequired) {
       rmSync(livePath, { force: true, recursive: true });
       renameSync(backupPath, livePath);
     }
@@ -190,24 +192,17 @@ export type BundledNpmTarRegistryDependencies = Readonly<{
   prepareReplacement?: (commandRunner: BundledNpmTarCommandRunner) => PreparedReplacement;
 }>;
 
-function prepareFixedTarReplacement(
+function prepareFixedTarReplacementFromArchive(
+  archivePath: string,
   commandRunner: BundledNpmTarCommandRunner,
 ): PreparedReplacement {
+  if (!isAbsolute(archivePath)) {
+    throw new Error("npm bundled tar replacement archive path must be absolute");
+  }
   const rootDirectory = mkdtempSync(join(tmpdir(), "nemoclaw-npm-tar-bootstrap-"));
-  const archivePath = join(rootDirectory, `tar-${FIXED_TAR_VERSION}.tgz`);
+  const verifiedArchivePath = join(rootDirectory, `tar-${FIXED_TAR_VERSION}.tgz`);
   const replacementRoot = join(rootDirectory, "replacement");
   try {
-    commandRunner("curl", [
-      "--proto",
-      "=https",
-      "--tlsv1.2",
-      "--fail",
-      "--silent",
-      "--show-error",
-      "--output",
-      archivePath,
-      FIXED_TAR_TARBALL,
-    ]);
     const archiveDescriptor = openSync(archivePath, constants.O_RDONLY | constants.O_NOFOLLOW);
     let archiveBytes: Buffer;
     try {
@@ -225,12 +220,13 @@ function prepareFixedTarReplacement(
       );
     }
 
+    writeFileSync(verifiedArchivePath, archiveBytes, { flag: "wx", mode: 0o600 });
     mkdirSync(replacementRoot, { mode: 0o700 });
     commandRunner("tar", [
       "--extract",
       "--gzip",
       "--file",
-      archivePath,
+      verifiedArchivePath,
       "--directory",
       replacementRoot,
       "--strip-components=1",
@@ -247,18 +243,49 @@ function prepareFixedTarReplacement(
   }
 }
 
-export function patchBundledNpmTarFromRegistry(
+function prepareFixedTarReplacement(
+  commandRunner: BundledNpmTarCommandRunner,
+): PreparedReplacement {
+  const rootDirectory = mkdtempSync(join(tmpdir(), "nemoclaw-npm-tar-download-"));
+  const archivePath = join(rootDirectory, `tar-${FIXED_TAR_VERSION}.tgz`);
+  try {
+    commandRunner("curl", [
+      "--proto",
+      "=https",
+      "--tlsv1.2",
+      "--fail",
+      "--silent",
+      "--show-error",
+      "--output",
+      archivePath,
+      FIXED_TAR_TARBALL,
+    ]);
+    const prepared = prepareFixedTarReplacementFromArchive(archivePath, commandRunner);
+    return {
+      cleanup: () => {
+        prepared.cleanup();
+        rmSync(rootDirectory, { force: true, recursive: true });
+      },
+      replacementRoot: prepared.replacementRoot,
+    };
+  } catch (error) {
+    rmSync(rootDirectory, { force: true, recursive: true });
+    throw error;
+  }
+}
+
+function patchBundledNpmTarWithPreparedReplacement(
   npmRoot: string,
-  dependencies: BundledNpmTarRegistryDependencies = {},
+  commandRunner: BundledNpmTarCommandRunner,
+  prepareReplacement: () => PreparedReplacement,
 ): BundledNpmTarState {
-  const commandRunner = dependencies.commandRunner ?? run;
   const current = inspectBundledNpmTar(npmRoot);
   if (current.state === "fixed") {
     commandRunner("npm", ["--version"]);
     commandRunner("npx", ["--version"]);
     return current;
   }
-  const prepared = (dependencies.prepareReplacement ?? prepareFixedTarReplacement)(commandRunner);
+  const prepared = prepareReplacement();
   try {
     const result = patchBundledNpmTar({
       npmRoot,
@@ -272,20 +299,53 @@ export function patchBundledNpmTarFromRegistry(
   }
 }
 
+export function patchBundledNpmTarFromRegistry(
+  npmRoot: string,
+  dependencies: BundledNpmTarRegistryDependencies = {},
+): BundledNpmTarState {
+  const commandRunner = dependencies.commandRunner ?? run;
+  return patchBundledNpmTarWithPreparedReplacement(npmRoot, commandRunner, () =>
+    (dependencies.prepareReplacement ?? prepareFixedTarReplacement)(commandRunner),
+  );
+}
+
+export function patchBundledNpmTarFromArchive(
+  npmRoot: string,
+  archivePath: string,
+  commandRunner: BundledNpmTarCommandRunner = run,
+): BundledNpmTarState {
+  return patchBundledNpmTarWithPreparedReplacement(npmRoot, commandRunner, () =>
+    prepareFixedTarReplacementFromArchive(archivePath, commandRunner),
+  );
+}
+
 function argument(name: string): string {
   const index = process.argv.indexOf(name);
   const value = index >= 0 ? process.argv[index + 1] : undefined;
   if (!value || value.startsWith("--")) throw new Error(`${name} is required`);
   return value;
 }
 
+function optionalArgument(name: string): string | undefined {
+  const index = process.argv.indexOf(name);
+  if (index < 0) return undefined;
+  const value = process.argv[index + 1];
+  if (!value || value.startsWith("--")) throw new Error(`${name} requires a value`);
+  return value;
+}
+
 function isMainModule(): boolean {
   return process.argv[1] ? fileURLToPath(import.meta.url) === resolve(process.argv[1]) : false;
 }
 
 if (isMainModule()) {
   try {
-    const result = patchBundledNpmTarFromRegistry(argument("--npm-root"));
+    const npmRoot = argument("--npm-root");
+    const archivePath = optionalArgument("--archive");
+    const result = archivePath
+      ? patchBundledNpmTarFromArchive(npmRoot, archivePath)
+      : patchBundledNpmTarFromRegistry(npmRoot);
+    if (archivePath) rmSync(archivePath);
     process.stdout.write(
       `Verified npm@${result.npmVersion} bundled tar@${result.tarVersion} (minimum ${MINIMUM_SAFE_TAR_VERSION})\n`,
     );