From a1dd8c00145b1f2fcb889541a44690741d340201 Mon Sep 17 00:00:00 2001 From: Max Dubrinsky Date: Tue, 4 Aug 2026 12:55:52 -0400 Subject: [PATCH 1/2] fix(deploy-sandbox skill): use non-destructive uv pip install for openshell extras Pre-flight step 3 and the recovery table told users to run `uv sync --package nemo-deployments-plugin --extra openshell` to install the openshell extra. `uv sync --package` narrows the workspace venv to that one package's dependency set, which uninstalls nmp, nemo_agents_plugin, and python-on-whales. `nemo services run` then fails with `No module named 'nmp.platform_runner'`, and the step's own DEPS check reports DEPS_MISSING both before and after because the first remedy removes what the second installs. Replace both occurrences with the additive form: uv pip install "openshell>=0.0.92" "grpcio>=1.78.0" "protobuf>=6.31.1" uv pip install -e 'plugins/nemo-agents[container]' `uv pip install` adds the deps into the existing venv without narrowing it, so the platform stays intact. Fixes AIRCORE-980 https://linear.app/nvidia/issue/AIRCORE-980 Signed-off-by: Max Dubrinsky --- .../skills/deploy-sandbox/SKILL.md | 24 ++++++++++++++----- 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/plugins/nemo-deployments/src/nemo_deployments_plugin/skills/deploy-sandbox/SKILL.md b/plugins/nemo-deployments/src/nemo_deployments_plugin/skills/deploy-sandbox/SKILL.md index 01b0f01a7a..52dc05f5f3 100644 --- a/plugins/nemo-deployments/src/nemo_deployments_plugin/skills/deploy-sandbox/SKILL.md +++ b/plugins/nemo-deployments/src/nemo_deployments_plugin/skills/deploy-sandbox/SKILL.md @@ -152,11 +152,23 @@ Commands below assume `nemo` and `openshell` are on your PATH. In a repo checkou .venv/bin/python -c "import python_on_whales, openshell" && echo DEPS_OK || echo DEPS_MISSING ``` - If `DEPS_MISSING`, install the extras: `uv sync --package nemo-deployments-plugin - --extra openshell` for the backend, and `uv pip install -e - 'plugins/nemo-agents[container]'` for packaging. Base `make bootstrap-python` does - not install the platform-restricted `openshell` wheel or the agents `container` - extra, so both need this step. + If `DEPS_MISSING`, add the extras INTO the existing workspace venv with `uv pip + install`. These commands install the two missing pieces without touching the rest + of the venv: + + ```bash + uv pip install "openshell>=0.0.92" "grpcio>=1.78.0" "protobuf>=6.31.1" + uv pip install -e 'plugins/nemo-agents[container]' + ``` + + The first line adds the OpenShell SDK the backend needs; the second adds + `python-on-whales` (the agents `container` extra) for packaging. Base `make + bootstrap-python` installs neither, so both need this step. Do NOT run `uv sync + --package nemo-deployments-plugin --extra openshell` here: `uv sync --package` + narrows the venv to that one package's dependency set, which uninstalls `nmp`, + `nemo_agents_plugin`, and `python-on-whales`, so `nemo services run` then fails + with `No module named 'nmp.platform_runner'`. `uv pip install` adds the deps + additively and leaves the platform intact. Convenience variable for the curl steps: @@ -349,7 +361,7 @@ docker compose -f plugins/nemo-deployments/examples/openshell/docker-compose.yml | Invoke returns 503 `inference service unavailable` (in the response or the serve log) | The `inference.local` route resolved, but the gateway's upstream hop to the platform failed | Almost always a platform bound to `127.0.0.1`; restart it with `--host 0.0.0.0`. Confirm the address the sandbox actually dials with `openshell sandbox exec --name -- cat /etc/hosts` (look for `host.openshell.internal`) and check the platform answers there (`curl -sf http://:8080/health/ready`). A clean `openshell inference set` does NOT rule this out: it validates from the host | | Invoke returns empty/error `value`, or serve log shows connection refused to `inference.local` | `inference.local` route not wired, or model misbehaved | Confirm `openshell inference get` shows the `nemo-igw` provider + your model; re-run Step 1's `provider create` / `inference set`; try a gpt-4o-mini-class model | | `example.com` reachable in Step 7 | Egress policy not applied | Confirm executor is `openshell-local` and the generated default-deny policy is attached to the sandbox | -| `ModuleNotFoundError: openshell` at deploy, or `python-on-whales` missing at package | workspace extras not installed | `uv sync --package nemo-deployments-plugin --extra openshell` and `uv pip install -e 'plugins/nemo-agents[container]'` | +| `ModuleNotFoundError: openshell` at deploy, or `python-on-whales` missing at package | workspace extras not installed | `uv pip install "openshell>=0.0.92" "grpcio>=1.78.0" "protobuf>=6.31.1"` then `uv pip install -e 'plugins/nemo-agents[container]'` (do NOT use `uv sync --package`: it narrows the venv and uninstalls `nmp`/`nemo_agents_plugin`/`python-on-whales`, breaking `nemo services run`) | Do not claim the deployment succeeded until Step 6 prints a non-empty `value`. From 6a5bc68f6bf7c72a363e388da62cd25aeb5f5946 Mon Sep 17 00:00:00 2001 From: Max Dubrinsky Date: Tue, 4 Aug 2026 16:16:54 -0400 Subject: [PATCH 2/2] docs(deploy-sandbox): fix destructive openshell install in DEMO notebook The DEMO.ipynb install cell still ran the destructive uv sync --package nemo-deployments-plugin --extra openshell, which narrows the workspace venv and uninstalls the platform. Replace it with the additive uv pip install form, matching the SKILL.md fix (AIRCORE-980). Signed-off-by: Max Dubrinsky --- plugins/nemo-deployments/examples/openshell/DEMO.ipynb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/plugins/nemo-deployments/examples/openshell/DEMO.ipynb b/plugins/nemo-deployments/examples/openshell/DEMO.ipynb index b971b9555a..a2fdff7875 100644 --- a/plugins/nemo-deployments/examples/openshell/DEMO.ipynb +++ b/plugins/nemo-deployments/examples/openshell/DEMO.ipynb @@ -51,8 +51,10 @@ "outputs": [], "source": [ "%%bash\n", - "# install the deployments backend's openshell extra (a bootstrapped workspace already has it)\n", - "uv sync --package nemo-deployments-plugin --extra openshell" + "# install the deployments backend's openshell extra additively (a bootstrapped workspace already has it).\n", + "# Do NOT use `uv sync --package nemo-deployments-plugin --extra openshell`: it narrows the workspace\n", + "# venv to that one package and uninstalls the platform, breaking `nemo services run`.\n", + "uv pip install \"openshell>=0.0.92\" \"grpcio>=1.78.0\" \"protobuf>=6.31.1\"" ] }, {