fix(mxc): refresh stale demo gateway aliases by nv-vankit · Pull Request #4192 · NVIDIA/OpenShell

nv-vankit · 2026-10-05T08:43:30Z

Summary

Fix the shipped MXC E2E and OCSF-audit runners when a caller already has a gateway registration using the same alias.

Each runner now uses disposable per-run CLI state, so existing gateway registrations, stored authentication, and the caller’s active selection are never read, replaced, or deleted.

The runners also clear all inherited gateway-selection overrides, including the higher-precedence OPENSHELL_GATEWAY_ENDPOINT, and restore the caller’s environment during cleanup. Regression tests verify preservation of a sentinel registration and active selection while a nonblank endpoint override is present.

Related Issue

NVIDIA NVBug 6870039
No public GitHub issue required: localized Windows MXC example-runner bug.

Before / after reproduction

Before this change, bug6870039-e2e was seeded at http://127.0.0.1:18000 and the E2E runner started its gateway on port 17671. Registration reported that the alias already existed, the CLI continued using port 18000, and the run ended with PASS=0 FAIL=4.

After this change, both runners inspect the existing registration. A matching alias is reused, while a stale alias is removed and recreated for the current run.

Validated the full registration matrix:

E2E alias absent on port 17675: PASS=4 FAIL=0.
E2E alias already matching port 17675: reused, PASS=4 FAIL=0.
E2E alias stale at 17675 with the run on 17676: replaced, PASS=4 FAIL=0.
OCSF mock alias absent on port 17677: passed.
OCSF mock alias already matching port 17677: reused and passed.
OCSF mock alias stale at 17677 with the run on 17678: replaced and passed.

Changes

Capture native stdout separately so gateway-list JSON can be parsed without stderr contamination.
Clear an inherited blank OPENSHELL_GATEWAY override before registration.
Query the existing named gateway when gateway add fails.
Reuse a matching endpoint and replace a stale endpoint.
Fail with the underlying CLI diagnostics if list, JSON parsing, removal, or re-registration fails.

Testing

mise run windows:check:x64
mise run windows:test:x64 - 5,044 passed, 29 skipped.
mise run windows:artifacts
E2E missing/matching/stale alias matrix - all three runs PASS=4 FAIL=0.
OCSF mock missing/matching/stale alias matrix - all three runs passed.
PowerShell parser validation for both changed scripts.
IDE lint and git diff --check.
mise run windows:test:mxc-real:x64 - 13 passed, 2 unrelated existing failures: a stale IsolationSession request without schema version, and an HTTPS proxy probe returning HTTP 403 due to socket-owner/binary identity behavior.
Live OCSF event qualification - stale-alias replacement and sandbox creation passed, but this x64 host emitted 0/8 expected Sandboxing ETW event types. Three OCSF records were written; none had the expected event types.

Checklist

Follows Conventional Commits
Commit is signed off (DCO)

Signed-off-by: nv-vankit <nv-vankit@users.noreply.github.com>

copy-pr-bot · 2026-10-05T08:43:34Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

github-actions · 2026-10-05T08:43:40Z

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

nv-vankit · 2026-10-05T08:45:55Z

I have read the DCO document and I hereby sign the DCO.

shailendra-nv

Requesting changes for two safety issues in the stale-alias recovery path.

The runners can delete and replace an arbitrary persistent user gateway registration named by -GatewayName, including stored auth state, and do not restore the prior registration or active selection. Isolate CLI state per run or preserve and restore it.
Clearing only OPENSHELL_GATEWAY leaves the higher-precedence OPENSHELL_GATEWAY_ENDPOINT override active, so sandbox create/delete operations can still target the wrong gateway. Clear and restore both overrides or explicitly bind every operational command to the expected endpoint.

Please add regression coverage that preserves a sentinel existing registration and active selection, and that runs with a nonblank OPENSHELL_GATEWAY_ENDPOINT.

shailendra-nv · 2026-10-05T22:46:00Z

+        $normalizedExpected = $expectedEndpoint.TrimEnd('/')
+        if ($existingEndpoint -ne $normalizedExpected) {
+            Info "'$GatewayName' points at '$existingEndpoint' instead of '$normalizedExpected'; replacing the stale registration"
+            $removeResult = Invoke-NativeCaptured $cli @("gateway", "remove", $GatewayName)


[P1] This removes any user registration matching $GatewayName, including stored OIDC/edge credentials and the active selection, then replaces it with a plaintext test registration without restoring the old state. Run the CLI under a per-run XDG_CONFIG_HOME or preserve and restore the exact prior registration and active gateway. The OCSF runner has the same issue.

shailendra-nv · 2026-10-05T22:46:00Z

  Step "Register CLI -> gateway"
-  $env:OPENSHELL_GATEWAY = ""
-  $gatewayAdd = Invoke-Cli @("gateway", "add", "http://127.0.0.1:$Port", "--local", "--name", $GatewayName) -AllowFailure
+  Remove-Item Env:OPENSHELL_GATEWAY -ErrorAction SilentlyContinue


[P1] OPENSHELL_GATEWAY_ENDPOINT has higher routing precedence and remains inherited here. Later create/delete calls can therefore operate on that endpoint; because this runner deletes fixed names such as ocsf1 even after a failed create, it can delete an existing sandbox on the wrong gateway. Clear and restore both overrides or explicitly bind every operational call to the expected endpoint. The E2E runner has the same precedence gap.

Signed-off-by: nv-vankit <nv-vankit@users.noreply.github.com>

nv-vankit · 2026-10-06T06:50:49Z

Requesting changes for two safety issues in the stale-alias recovery path.

The runners can delete and replace an arbitrary persistent user gateway registration named by -GatewayName, including stored auth state, and do not restore the prior registration or active selection. Isolate CLI state per run or preserve and restore it.

Clearing only OPENSHELL_GATEWAY leaves the higher-precedence OPENSHELL_GATEWAY_ENDPOINT override active, so sandbox create/delete operations can still target the wrong gateway. Clear and restore both overrides or explicitly bind every operational command to the expected endpoint.

Please add regression coverage that preserves a sentinel existing registration and active selection, and that runs with a nonblank OPENSHELL_GATEWAY_ENDPOINT.

Addressed both requested safety issues in d4f11c40.

Both runners now use unique disposable CLI state directories. They no longer inspect, replace, or delete the caller’s gateway registrations, stored authentication, or active selection.
Both runners clear and restore OPENSHELL_GATEWAY, OPENSHELL_GATEWAY_ENDPOINT, and the related gateway overrides.

Regression coverage now:

Seeds an active sentinel registration using the same alias.
Sets a nonblank OPENSHELL_GATEWAY_ENDPOINT.
Runs both shipped mock runners.
Confirms the sentinel endpoint, active selection, and inherited override remain unchanged.

Please re-review the updated head.

shailendra-nv

Requesting changes on the updated head for a PowerShell 7 isolation regression.

SetEnvironmentVariable(..., $null, "Process") deletes the override under Windows PowerShell 5.1, but under PowerShell 7.6.5 it leaves an empty variable. The CLI treats an empty OPENSHELL_GATEWAY_ENDPOINT as a direct endpoint and fails with invalid URI: empty string; an absent override correctly reports no active gateway.

Please clear variables with Remove-Item "Env:$name" and restore null snapshots by removing the variable. Add a pwsh regression alongside powershell.exe; current harness coverage uses only powershell.exe and a plaintext sentinel.

shailendra-nv · 2026-10-06T16:02:33Z

+            [Environment]::SetEnvironmentVariable($entry.Key, $entry.Value, "Process")
+        }
+        foreach ($name in $cliEnvironmentNames | Where-Object { -not $isolatedPaths.ContainsKey($_) }) {
+            [Environment]::SetEnvironmentVariable($name, $null, "Process")


[P1] PowerShell 7 converts this null value into an existing empty environment variable. OPENSHELL_GATEWAY_ENDPOINT then resolves as an empty direct endpoint and operational commands fail with invalid URI: empty string. Use Remove-Item on the dynamic Env: path when clearing, and during restoration remove variables whose snapshot was null. Please cover pwsh as well as powershell.exe; the OCSF runner has the same defect at its corresponding clear loop.

Addressed in c573b22.

Both runners now use Remove-Item "Env:$name" to clear overrides and also remove variables when restoring null snapshots. This avoids empty OPENSHELL_GATEWAY_ENDPOINT values under PowerShell 7.

Regression coverage now runs under both powershell.exe and pwsh.exe, verifying preservation of the sentinel registration, active selection, endpoint override, and absent-variable state.

Please re-review the changes.

Signed-off-by: nv-vankit <nv-vankit@users.noreply.github.com>

fix(mxc): refresh stale demo gateway aliases (NVBug 6870039)

d8ecfb1

Signed-off-by: nv-vankit <nv-vankit@users.noreply.github.com>

nv-vankit requested review from a team, derekwaynecarr, mrunalp and sjenning as code owners October 5, 2026 08:43

nv-vankit mentioned this pull request Oct 5, 2026

fix(mxc): authorize curl in inference policy #4199

Merged

3 tasks done

nv-vankit changed the title ~~fix(mxc): refresh stale demo gateway aliases (NVBug 6870039)~~ fix(mxc): refresh stale demo gateway aliases Oct 5, 2026

shailendra-nv requested changes Oct 5, 2026

View reviewed changes

fix(mxc): isolate demo CLI gateway state

d4f11c4

Signed-off-by: nv-vankit <nv-vankit@users.noreply.github.com>

shailendra-nv requested changes Oct 6, 2026

View reviewed changes

fix(mxc): remove empty gateway overrides

c573b22

Signed-off-by: nv-vankit <nv-vankit@users.noreply.github.com>

Navigation Menu

Repository navigation

fix(mxc): refresh stale demo gateway aliases - #4192

fix(mxc): refresh stale demo gateway aliases#4192
nv-vankit wants to merge 3 commits into
NVIDIA:windowsfrom
nv-vankit:fix/mxc-refresh-stale-gateway-alias-6870039

nv-vankit commented Oct 5, 2026 •

edited

Loading

Uh oh!

copy-pr-bot Bot commented Oct 5, 2026

Uh oh!

github-actions Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

nv-vankit commented Oct 5, 2026

Uh oh!

shailendra-nv left a comment

Uh oh!

shailendra-nv Oct 5, 2026

Uh oh!

shailendra-nv Oct 5, 2026

Uh oh!

nv-vankit commented Oct 6, 2026

Uh oh!

shailendra-nv left a comment

Uh oh!

shailendra-nv Oct 6, 2026

Uh oh!

nv-vankit Oct 7, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

nv-vankit commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Before / after reproduction

Changes

Testing

Checklist

Uh oh!

copy-pr-bot Bot commented Oct 5, 2026

Uh oh!

github-actions Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nv-vankit commented Oct 5, 2026

Uh oh!

shailendra-nv left a comment

Choose a reason for hiding this comment

Uh oh!

shailendra-nv Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

shailendra-nv Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

nv-vankit commented Oct 6, 2026

Uh oh!

shailendra-nv left a comment

Choose a reason for hiding this comment

Uh oh!

shailendra-nv Oct 6, 2026

Choose a reason for hiding this comment

Uh oh!

nv-vankit Oct 7, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nv-vankit commented Oct 5, 2026 •

edited

Loading

github-actions Bot commented Oct 5, 2026 •

edited

Loading