fix(agents): Honor shared CLI context for base URL and auth by tylersbray · Pull Request #582 · NVIDIA-NeMo/nemo-platform

tylersbray · 2026-07-06T22:33:00Z

Summary

The nemo agents command group resolved its own base URL (only --base-url/NEMO_BASE_URL, else localhost) and attached no auth token. On any real remote this means:

P0 docs: fix cloned repo directory in setup docs #1 — wrong target, silently. It ignored nemo config set --base-url and NMP_BASE_URL (the vars the rest of the CLI honors), so deploy/invoke/list silently hit localhost:8080 — and reported success against the wrong platform.
P0 fix(studio): force NODE_ENV=production during build #2 — 401/403 on secured clusters. With no Authorization header, every agents call is rejected on an auth-enabled cluster, even after nemo auth login.

Both gate the "build local, ship remote" flow. Reported in the local→remote test run (AIRCORE-885, follow-up to the AIRCORE-867 runbook).

What changed

New shared module plugins/nemo-agents/src/nemo_agents_plugin/cli_context.py — resolve_base_url / resolve_context_headers read the same CLIContext (typer.Context.obj) as the rest of the CLI. It lives outside cli.py to avoid the cli.py ↔ usage/cli.py import cycle.
Base URL precedence: --base-url/NEMO_BASE_URL → nemo config/NMP_BASE_URL → localhost. Resolved target echoed to stderr (Targeting <url>) so a mis-point is visible; stdout stays clean JSON.
Auth: bearer token from nemo auth login attached to the platform httpx calls (_api_request, gateway invoke) and to the usage show SDK client. Falls back to unauthenticated when no token is configured (local dev unchanged).
Scope: covers the platform commands and nemo agents usage show (builds its own SDK client; resolution runs only in the fileset branch that actually contacts the platform).
The previously misleading nemo config view error hint is now accurate.

Not regenerated: the CLI/SDK generator only owns packages/nemo_platform_ext/.../cli/commands/api/; the agents plugin CLI is hand-written, and no API routes/models changed.

Test plan

New test_cli_context_resolution.py: base-URL precedence (flag/env/config/default), stderr-only banner, auth-header attach, gateway invoke, no-auth-without-context.
New usage test: usage show <fileset> builds the SDK client with the context base URL + Authorization: Bearer.
Updated JSON-output tests to read result.stdout (banner is on stderr).
ruff check, ruff format --check, ty: clean.
No regressions: full agents unit suite failure set byte-identical to origin/main (same pre-existing failures).

Summary by CodeRabbit

New Features
- CLI commands now use a shared, configurable platform base URL (with --base-url defaulting from config/env) instead of a fixed local default.
- Platform-related requests can now include resolved context headers (including authentication when available).
- nemo agents usage show now follows the same base-URL and context behavior when platform downloads are needed.
Bug Fixes
- Improved CLI output routing so status/targeting banners go to stderr, keeping JSON on stdout clean.
Tests
- Added/updated unit tests for base-URL precedence, header attachment, and stdout/stderr behavior.

The `nemo agents` command group resolved its own base URL (only `--base-url`/`NEMO_BASE_URL`, else localhost) and attached no auth token, so it silently targeted the wrong platform and was rejected (401/403) on any secured cluster — breaking the local-to-remote deploy flow (AIRCORE-885). Add a shared `cli_context` module (resolve_base_url, resolve_context_headers) that reads the same CLIContext the rest of the CLI uses: - Base URL precedence: --base-url/NEMO_BASE_URL > `nemo config`/NMP_BASE_URL > localhost. The resolved target is echoed to stderr ("Targeting <url>") so mis-pointed commands are visible; stdout stays clean JSON. - Auth: attach the `nemo auth login` bearer token to the platform httpx calls (_api_request, gateway invoke) and to the usage-report SDK client. Applies to the platform commands and to `nemo agents usage show` (which builds its own SDK client). The module lives outside cli.py to avoid the cli.py <-> usage/cli.py import cycle. Tests: base-URL precedence + auth attachment (new test_cli_context_resolution.py), usage SDK client build with context base URL + auth, and stdout/stderr stream separation for JSON output. Signed-off-by: Tyler Bray <tbray@nvidia.com>

coderabbitai · 2026-07-06T22:37:51Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b4d94ea5-303d-46a5-ab4e-a571edbd3f9d

📥 Commits

Reviewing files that changed from the base of the PR and between 4ff6b13 and 0156e8c.

📒 Files selected for processing (3)

plugins/nemo-agents/src/nemo_agents_plugin/cli.py
plugins/nemo-agents/src/nemo_agents_plugin/cli_context.py
plugins/nemo-agents/src/nemo_agents_plugin/usage/cli.py

🚧 Files skipped from review as they are similar to previous changes (3)

plugins/nemo-agents/src/nemo_agents_plugin/cli_context.py
plugins/nemo-agents/src/nemo_agents_plugin/usage/cli.py
plugins/nemo-agents/src/nemo_agents_plugin/cli.py

📝 Walkthrough

Walkthrough

Adds shared CLI context helpers for base URL and default headers. Platform commands and usage SDK setup now resolve these values from shared context, and tests were updated for stderr-targeting output plus JSON parsing from stdout.

Changes

CLI context resolution

Layer / File(s)	Summary
Shared resolution helpers `plugins/nemo-agents/src/nemo_agents_plugin/cli_context.py`	Defines shared base URL option wiring, base URL resolution, and context-derived default header extraction.
Platform CLI command wiring `plugins/nemo-agents/src/nemo_agents_plugin/cli.py`	Uses the shared base URL resolver across platform commands and sends resolved headers with platform HTTP calls.
Usage SDK construction `plugins/nemo-agents/src/nemo_agents_plugin/usage/cli.py`	Uses the shared base URL resolver for fileset handling and passes resolved headers into `NeMoPlatform` construction.
Resolution and output tests `plugins/nemo-agents/tests/unit/test_cli_context_resolution.py`, `plugins/nemo-agents/tests/unit/test_cli_list_output.py`, `plugins/nemo-agents/tests/unit/usage/test_cli.py`	Adds coverage for base URL precedence, stderr output, auth headers, and SDK construction with context values.

Sequence Diagram(s)

sequenceDiagram
  participant CLI as Command
  participant Ctx as cli_context
  participant HTTP as httpx
  participant SDK as NeMoPlatform

  CLI->>Ctx: resolve_base_url(base_url)
  Ctx-->>CLI: resolved base URL

  CLI->>Ctx: resolve_context_headers()
  Ctx-->>CLI: headers or {}

  CLI->>HTTP: request(..., headers)
  HTTP-->>CLI: response

  CLI->>SDK: NeMoPlatform(base_url, default_headers)
  SDK-->>CLI: platform client

Possibly related PRs

NVIDIA-NeMo/nemo-platform#297: Touches the same nemo agents list/deployments list command paths and their output/tests.

Suggested reviewers: SandyChapman, arpitsardhana

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: agents now honor shared CLI context for base URL and auth.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch aircore-885-agents-cli-context/tbray

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-06T22:45:08Z

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	23273/30443	76.4%	61.2%
Integration Tests	13617/29123	46.8%	20.0%

mckornfield

yay centralized config

Address review feedback: the --base-url option (and its help text) was repeated inline across all 12 platform commands plus `usage show`. Define it once in cli_context as a reusable Annotated `BaseUrlOption` (with the help text in a `BASE_URL_HELP` constant) and reuse it everywhere. Also reformat the help as a numbered resolution-order list. No behavior change. Signed-off-by: Tyler Bray <tbray@nvidia.com>

* fix(agents): Honor shared CLI context for base URL and auth The `nemo agents` command group resolved its own base URL (only `--base-url`/`NEMO_BASE_URL`, else localhost) and attached no auth token, so it silently targeted the wrong platform and was rejected (401/403) on any secured cluster — breaking the local-to-remote deploy flow (AIRCORE-885). Add a shared `cli_context` module (resolve_base_url, resolve_context_headers) that reads the same CLIContext the rest of the CLI uses: - Base URL precedence: --base-url/NEMO_BASE_URL > `nemo config`/NMP_BASE_URL > localhost. The resolved target is echoed to stderr ("Targeting <url>") so mis-pointed commands are visible; stdout stays clean JSON. - Auth: attach the `nemo auth login` bearer token to the platform httpx calls (_api_request, gateway invoke) and to the usage-report SDK client. Applies to the platform commands and to `nemo agents usage show` (which builds its own SDK client). The module lives outside cli.py to avoid the cli.py <-> usage/cli.py import cycle. Tests: base-URL precedence + auth attachment (new test_cli_context_resolution.py), usage SDK client build with context base URL + auth, and stdout/stderr stream separation for JSON output. Signed-off-by: Tyler Bray <tbray@nvidia.com> * refactor(agents): Extract shared --base-url typer option Address review feedback: the --base-url option (and its help text) was repeated inline across all 12 platform commands plus `usage show`. Define it once in cli_context as a reusable Annotated `BaseUrlOption` (with the help text in a `BASE_URL_HELP` constant) and reuse it everywhere. Also reformat the help as a numbered resolution-order list. No behavior change. Signed-off-by: Tyler Bray <tbray@nvidia.com> --------- Signed-off-by: Tyler Bray <tbray@nvidia.com>

tylersbray requested review from a team as code owners July 6, 2026 22:33

github-actions Bot added the fix label Jul 6, 2026

tylersbray requested a review from mckornfield July 7, 2026 17:31

mckornfield approved these changes Jul 7, 2026

View reviewed changes

Comment thread plugins/nemo-agents/src/nemo_agents_plugin/cli.py Outdated

Comment thread plugins/nemo-agents/src/nemo_agents_plugin/cli.py Outdated

Comment thread plugins/nemo-agents/src/nemo_agents_plugin/cli.py Outdated

tylersbray added this pull request to the merge queue Jul 7, 2026

Merged via the queue into main with commit f60de77 Jul 7, 2026
55 checks passed

tylersbray deleted the aircore-885-agents-cli-context/tbray branch July 7, 2026 23:42

Navigation Menu

Uh oh!

fix(agents): Honor shared CLI context for base URL and auth - #582

fix(agents): Honor shared CLI context for base URL and auth#582
tylersbray merged 2 commits into
mainfrom
aircore-885-agents-cli-context/tbray

tylersbray commented Jul 6, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

mckornfield left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

tylersbray commented Jul 6, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mckornfield left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tylersbray commented Jul 6, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

github-actions Bot commented Jul 6, 2026 •

edited

Loading