[Linux][CLI&UX] nemoclaw status shows Phase:Ready with EXIT:0 when dcode version is below manifest minimum — no version drift warning

[lyral-commits]

Description

When a LangChain Deep Agents Code sandbox (dcode-drift) is running a dcode version below the manifest-pinned minimum, nemoclaw dcode-drift status reports Phase:Ready with EXIT:0 and no version warning. The status command does not detect the version drift and silently reports the sandbox as healthy, leaving the user with no indication that a rebuild is needed.

Environment

Device:        NVIDIA 2u2g-gen-0642 (Ubuntu 24.04 x86_64 / A100)
OS:            Ubuntu 24.04.4 LTS
Architecture:  x86_64
OpenShell CLI: 0.0.44
NemoClaw:      v0.0.67
OpenClaw:      deepagents-code (version below manifest minimum)

Steps to Reproduce

1. Onboard a LangChain Deep Agents Code sandbox on an older NemoClaw version (e.g. v0.0.66):

   nemoclaw onboard --agent langchain-deepagents-code --name dcode-drift

2. Upgrade NemoClaw CLI to v0.0.67 without rebuilding the sandbox image:

   curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_INSTALL_TAG=v0.0.67 bash

3. Run status on the drifted sandbox:

   nemoclaw dcode-drift status; echo "EXIT:$?"

Expected Result

Step 3: Status prints a non-zero exit OR shows an explicit warning line such as:

Warning: dcode version X.Y.Z is below the required minimum A.B.C — run `nemoclaw dcode-drift rebuild` to update.

The user can see the drift without running re-onboard.

Actual Result

Step 3: Status reports Phase:Ready with EXIT:0, no version drift warning:

Sandbox: dcode-drift
  Phase: Ready
  Agent: LangChain Deep Agents Code v0.1.12
EXIT:0

The sandbox appears fully healthy. The user has no indication that the installed dcode version is below the manifest minimum or that a rebuild is needed.

---

NVB#6374632

[jason-ma-nv]

Investigation findings (code read against current main):

The status version-drift check does run for terminal-runtime agents and should already flag a below-minimum dcode.

• status calls checkAgentVersion for all agents (not gateway-only), and shouldProbeSandboxRuntimeVersion returns true whenever the registry has a recorded agentVersion — so it live-probes dcode --version (the manifest version_command) for a Deep Agents Code sandbox.
• It computes isStale = !versionGte(installed, expected_version), and the dcode manifest's expected_version is 0.1.12 (same threshold as version_constraint: ">=0.1.12"). So a probed dcode below 0.1.12 should already print:

  Update:   v0.1.12 available
            Run `nemoclaw <name> rebuild` to upgrade
  

The pasted Actual Result shows Agent: LangChain Deep Agents Code v0.1.12 — i.e. the probed version equals expected_version, which correctly produces no drift warning. With that output I can't reproduce a "below minimum, no warning" case on current main.

Could you share, from the affected dcode-drift sandbox:

1. nemoclaw dcode-drift status full output, and
2. the actual installed dcode version vs. the expected_version in the NemoClaw build under test (i.e. confirm installed < expected)?

If installed is genuinely below expected_version and no Update:/unable to verify line appears, that points at the probe path (e.g. dcode --version not being captured, or a stale registry agentVersion short-circuiting the fast path) rather than a missing check — useful to know which.

Separately: the dcode manifest declares version_constraint: ">=0.1.12", but version_constraint is not consumed anywhere in the codebase — only expected_version is. For dcode the two are equal so behaviour is unchanged today, but if the intent is an explicit "below required minimum" hard-stop message (distinct from the softer "Update: available"), that would be a small enhancement to wire version_constraint through and word the warning accordingly.