chore(deps): update dependency nvidia/openshell to v0.0.116

[renovate-fullsend]

This PR contains the following updates:

Package	Update	Change
NVIDIA/OpenShell	patch	0.0.115 → 0.0.116

---

Release Notes

NVIDIA/OpenShell (NVIDIA/OpenShell)

v0.0.116: OpenShell v0.0.116

Compare Source

OpenShell v0.0.116

Quick install

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.0.116 sh

What's Changed

• fix(dev): harden local cluster and gateway startup by @​krishicks in #​2993
• fix(server): suppress expected session errors on shutdown by @​krishicks in #​2994
• test(network): avoid DNS socket bind race by @​krishicks in #​2996
• chore(deps): bump jdx/mise-action from 4.2.4 to 4.3.0 by @​dependabot[bot] in #​2970
• fix(ci): normalize macOS binary dependencies by @​SDAChess in #​3006

Full Changelog: NVIDIA/OpenShell@v0.0.115...v0.0.116

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:21 PM UTC · Completed 7:31 PM UTC

Commit: 094ff79 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.76

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Score unchanged from prior assessment at 2 (moderate). PR now touches 4 files (up from 1 in prior review) but the 3 added files are trivial 1-line version string bumps in docs and hack scripts. Tier 1 remains low (1.38) driven by the single protected path (.github/). Tier 2 is elevated (2.75) due to high churn and fix/revert counts on the docs file, though these reflect routine automated updates rather than instability. Tier 3 confirms the PR directly resolves issue #6707 (broken macOS binaries). Composite 1.81 rounds to 2 (moderate).

Previous run

Risk Assessment: moderate (2/5)

Details

Trivial 4-line version bump by Renovate bot in a single script file (.github/scripts/openshell-version.sh). Tier 1 is very low (1.25) driven only by the protected path (.github/). Tier 2 is elevated (2.75) due to multi-author contention and fix/revert history on this file, though these reflect routine automated version bumps rather than true instability. Composite 1.82 rounds to 2 (moderate).

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/scripts/openshell-version.sh — This PR modifies a file under the .github/ protected path. The change is a Renovate-managed version pin bump (OpenShell 0.0.115 → 0.0.116) linked to issue docs: OpenShell 0.0.115 macOS release binaries are Nix-linked and do not start; install guide points Apple Silicon users at it #6707, which provides sufficient context for the update. Human approval is always required for protected-path changes, regardless of context.

Previous run

Review

Findings

High

• [protected-path] .github/scripts/openshell-version.sh — This PR modifies a file under the .github/ protected path. The PR has no linked issue providing authorization for modifying governance/infrastructure files. While this is an automated Renovate dependency version bump (OpenShell 0.0.115 → 0.0.116) and the file itself documents that it is managed by Renovate via renovate.json with postUpgradeTasks, human approval is required for all protected-path changes.
  Remediation: A human reviewer must approve this protected-path change. No code changes are needed.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[waynesun09]

Added 5932b2f2 on top of the Renovate commit: Renovate only tracks .github/scripts/openshell-version.sh, so the hand-maintained mirrors — the OPENSHELL_VERSION fallbacks in hack/gitlab-runner-vm/{create-vm,setup}.sh and the install snippet in docs/guides/user/running-agents-locally.md — were still at 0.0.115. Moved them together with the pin, as #6696 did.

The docs line is the one that matters: 0.0.115's Apple Silicon binaries could not start (NVIDIA/OpenShell#2997, fixed upstream in NVIDIA/OpenShell#3006 and shipped in 0.0.116), and the guide pointed macOS users at that build. The commit carries Closes #6707 for that. Verified the 0.0.116 darwin CLI and gateway tarballs run unpatched (0 /nix/store refs).

Note for Renovate: a non-bot commit is now on this branch, so it will stop rebasing it automatically; tick the rebase checkbox only if you want to discard the extra commit.

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 8:07 PM UTC · Ended 8:21 PM UTC

Commit: 5932b2f · View workflow run →

[github-actions]

Site preview

Preview: https://1112319a-site.fullsend-ai.workers.dev

Commit: 5932b2f2a8a4b6e0ae8b5f2a07b92b92b1e6bd8e

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:07 PM UTC · Completed 8:21 PM UTC

Commit: 5932b2f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.59

[waynesun09]

Renovate pin bump to OpenShell 0.0.116 plus the hand-maintained mirrors (runner VM fallbacks, local-run guide) moved in the same PR. OPENSHELL_SHA matches the v0.0.116 tag commit. v0.0.115→v0.0.116 contains only the macOS binary normalization (NVIDIA/OpenShell#3006), a shutdown log reclassification, and test/dev-script changes — nothing in the proxy, providers, or sandbox lifecycle. CI on this head installed 0.0.116 and passed functional-tests (4/4), e2e, and behaviour.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 8:41 PM UTC · Completed 9:00 PM UTC

Commit: 5932b2f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $7.19

[fullsend-ai-retro]

Retro: PR #6737 — OpenShell dependency bump (0.0.115 → 0.0.116)

Workflow summary: Renovate opened a 1-file version bump. The review agent flagged .github/scripts/openshell-version.sh as a protected path (HIGH, no linked issue) and requested changes. The fix agent correctly skipped (bot author without fullsend-fix label). A human (waynesun09) pushed a second commit updating 3 hand-maintained version mirrors and linking issue #6707 (macOS Apple Silicon binary breakage). The review agent re-ran, downgraded the finding to MEDIUM, and dismissed the stale REQUEST_CHANGES review. The human approved and merged. Total review agent cost: $5.35 across two runs (7m26s + 11m29s).

Verdict: workflow functioned correctly. The protected-path gate worked as designed — it surfaced a governance-relevant file change, a human reviewed and approved it, and the PR merged with all CI checks passing. No bugs, no missed findings, no false negatives.

No new proposals filed. All improvement opportunities identified are already covered by existing open issues:

• Stale sonnet model version mapping inflates review sub-agent costs ~5x #6666 (stale sonnet model version mapping inflates sub-agent costs): Both review runs wasted time retrying failed claude-sonnet-4-5@20250929 dispatches on Vertex AI. Two subagents in each run failed on the unavailable model and had to be retried on opus, adding ~35s wall time per run. This PR provides fresh evidence that the stale mapping is still active.
• Consolidate 22+ overlapping "skip retro/agent dispatch" issues into a single design issue #5817 (consolidate 22+ overlapping skip-dispatch issues): This PR is another $5.35 data point for the recurring pattern of full-cost reviews on trivial bot dependency bumps. The second review was 2x more expensive than the first ($3.59 vs $1.76) because the PR grew from 1 to 4 files, triggering additional subagent dispatches (correctness spent 65s grepping the repo for stale version references; docs-currency ran because a docs file was now in scope).
• Add CI check for OPENSHELL_VERSION/SHA consistency in openshell-version.sh #6708 / docs: running-agents-locally.md OpenShell version not updated by Renovate #4808 (version mirror sync): Renovate only bumped 1 of 4 files containing the OpenShell version. The human had to manually update docs/guides/user/running-agents-locally.md, hack/gitlab-runner-vm/create-vm.sh, and hack/gitlab-runner-vm/setup.sh — exactly the gap these issues describe.
• Review agent: downgrade protected-path severity for bot-authored dependency update PRs #2588 / Review agent should downgrade protected-path for platform bot managed-file updates #3164 (downgrade protected-path severity for bot dependency PRs): The initial HIGH severity on a Renovate-managed file in .github/ was arguably too aggressive. The agent's own second review acknowledged this by downgrading to MEDIUM after the human commit provided additional context.
• Review sub-agents should fall back to an available model when the primary model is unavailable #1771 (sub-agent model fallback): The orchestrator handled the sonnet unavailability by retrying on opus, which is a reasonable workaround but adds latency and cost. A proper fallback chain would avoid the wasted dispatch entirely.