chore(deps): update dependency nvidia/openshell to v0.0.116 - #6737

🤖 Finished Review · ✅ Success · Started 7:21 PM UTC · Completed 7:31 PM UTC

Commit: 094ff79 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.76

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Risk Assessment: moderate (2/5)

Review

Findings

Medium

• [protected-path] .github/scripts/openshell-version.sh — This PR modifies a file under the .github/ protected path. The change is a Renovate-managed version pin bump (OpenShell 0.0.115 → 0.0.116) linked to issue docs: OpenShell 0.0.115 macOS release binaries are Nix-linked and do not start; install guide points Apple Silicon users at it #6707, which provides sufficient context for the update. Human approval is always required for protected-path changes, regardless of context.

Added 5932b2f2 on top of the Renovate commit: Renovate only tracks .github/scripts/openshell-version.sh, so the hand-maintained mirrors — the OPENSHELL_VERSION fallbacks in hack/gitlab-runner-vm/{create-vm,setup}.sh and the install snippet in docs/guides/user/running-agents-locally.md — were still at 0.0.115. Moved them together with the pin, as #6696 did.

The docs line is the one that matters: 0.0.115's Apple Silicon binaries could not start (NVIDIA/OpenShell#2997, fixed upstream in NVIDIA/OpenShell#3006 and shipped in 0.0.116), and the guide pointed macOS users at that build. The commit carries Closes #6707 for that. Verified the 0.0.116 darwin CLI and gateway tarballs run unpatched (0 /nix/store refs).

Note for Renovate: a non-bot commit is now on this branch, so it will stop rebasing it automatically; tick the rebase checkbox only if you want to discard the extra commit.

🤖 Review · ❌ Terminated · Started 8:07 PM UTC · Ended 8:21 PM UTC

Commit: 5932b2f · View workflow run →

Site preview

Preview: https://1112319a-site.fullsend-ai.workers.dev

Commit: 5932b2f2a8a4b6e0ae8b5f2a07b92b92b1e6bd8e

🤖 Finished Review · ✅ Success · Started 8:07 PM UTC · Completed 8:21 PM UTC

Commit: 5932b2f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.59

🤖 Finished Retro · ✅ Success · Started 8:41 PM UTC · Completed 9:00 PM UTC

Commit: 5932b2f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $7.19

Retro: PR #6737 — OpenShell dependency bump (0.0.115 → 0.0.116)

Workflow summary: Renovate opened a 1-file version bump. The review agent flagged .github/scripts/openshell-version.sh as a protected path (HIGH, no linked issue) and requested changes. The fix agent correctly skipped (bot author without fullsend-fix label). A human (waynesun09) pushed a second commit updating 3 hand-maintained version mirrors and linking issue #6707 (macOS Apple Silicon binary breakage). The review agent re-ran, downgraded the finding to MEDIUM, and dismissed the stale REQUEST_CHANGES review. The human approved and merged. Total review agent cost: $5.35 across two runs (7m26s + 11m29s).

Verdict: workflow functioned correctly. The protected-path gate worked as designed — it surfaced a governance-relevant file change, a human reviewed and approved it, and the PR merged with all CI checks passing. No bugs, no missed findings, no false negatives.

No new proposals filed. All improvement opportunities identified are already covered by existing open issues:

• Stale sonnet model version mapping inflates review sub-agent costs ~5x #6666 (stale sonnet model version mapping inflates sub-agent costs): Both review runs wasted time retrying failed claude-sonnet-4-5@20250929 dispatches on Vertex AI. Two subagents in each run failed on the unavailable model and had to be retried on opus, adding ~35s wall time per run. This PR provides fresh evidence that the stale mapping is still active.
• Consolidate 22+ overlapping "skip retro/agent dispatch" issues into a single design issue #5817 (consolidate 22+ overlapping skip-dispatch issues): This PR is another $5.35 data point for the recurring pattern of full-cost reviews on trivial bot dependency bumps. The second review was 2x more expensive than the first ($3.59 vs $1.76) because the PR grew from 1 to 4 files, triggering additional subagent dispatches (correctness spent 65s grepping the repo for stale version references; docs-currency ran because a docs file was now in scope).
• Add CI check for OPENSHELL_VERSION/SHA consistency in openshell-version.sh #6708 / docs: running-agents-locally.md OpenShell version not updated by Renovate #4808 (version mirror sync): Renovate only bumped 1 of 4 files containing the OpenShell version. The human had to manually update docs/guides/user/running-agents-locally.md, hack/gitlab-runner-vm/create-vm.sh, and hack/gitlab-runner-vm/setup.sh — exactly the gap these issues describe.
• Review agent: downgrade protected-path severity for bot-authored dependency update PRs #2588 / Review agent should downgrade protected-path for platform bot managed-file updates #3164 (downgrade protected-path severity for bot dependency PRs): The initial HIGH severity on a Renovate-managed file in .github/ was arguably too aggressive. The agent's own second review acknowledged this by downgrading to MEDIUM after the human commit provided additional context.
• Review sub-agents should fall back to an available model when the primary model is unavailable #1771 (sub-agent model fallback): The orchestrator handled the sonnet unavailability by retrying on opus, which is a reasonable workaround but adds latency and cost. A proper fallback chain would avoid the wasted dispatch entirely.