fix(agents): disable Cline auto-update so the pinned CLI holds - #4654

What does this PR do?

Keeps the Cline CLI at the pinned cline_version for the whole run. Before this change, Gym's own
cline --version check started Cline's self-updater. The updater replaced the pinned 3.0.55 install
with npm latest while the run was going, and a task spawned during the swap failed with
FileNotFoundError. That surfaced as HTTP 500 and stopped collection.

Fixes NVBug 6764103.

Closes #4502

Cause

From cli-v3.0.55, every Cline CLI invocation, --version included, runs autoUpdateOnStartup()
(apps/cli/src/main.ts). If npm has a newer release, the CLI spawns a detached
npm update -g cline --tag latest --min-release-age=0 when it exits (applyDeferredUpdate() in
apps/cli/src/index.ts). Only CLINE_NO_AUTO_UPDATE=1 disables this.

The harness added in #2563 never set that variable:

• responses_api_agents/cline_agent/setup_cline.py _cline_version ran cline --version with the
  inherited environment. The post-install pin check in ensure_cline therefore started the updater
  at server startup, with its cwd set to the agent server directory, which matches the npm log in
  the NVBug.
• ClineAgent._env() built the environment for cline auth and the task without it, so every
  rollout started the updater again.

While npm reifies the package, bin/cline does not exist. In a local race, 185 of 349 spawns in
that window failed with FileNotFoundError while cwd and PATH were intact. Afterwards the
installed version is no longer the pin (3.0.71).

Fix

• _cline_version passes env={**os.environ, "CLINE_NO_AUTO_UPDATE": "1"} to the version probe.
• _env() adds CLINE_NO_AUTO_UPDATE=1 next to the other pinned CLINE_* keys. That overrides an
  inherited value, and an explicit config.env entry can still override it, as for every other key
  there. This is the same approach opencode_agent takes with OPENCODE_DISABLE_AUTOUPDATE.
• The server's own os.environ is not modified.
• npm install is unchanged, because it runs no cline command (postinstall.mjs only links the
  binary).
• responses_api_agents/anyswe_agent/setup_scripts/cline_agent_deps.sh checked the pinned install with
  a bare "$DEPS_DIR/bin/cline" --version, which started the same updater against $DEPS_DIR, the
  bundle the AnySWE sandbox mounts. It now runs CLINE_NO_AUTO_UPDATE=1 "$DEPS_DIR/bin/cline" --version
  (review follow-up). Changing the script also changes the AnySWE runtime-bundle recipe hash, so an
  existing, possibly unpinned bundle gets rebuilt.
• The README notes the opt-out under cline_version. It is a default: config.env is applied
  last, so an explicit env: {CLINE_NO_AUTO_UPDATE: "0"} re-enables the updater.
• harness_agent and anyswe_cline run ClineAgent, so its version probe and _env() cover their
  cline calls. The AnySWE install script above is their only other cline call.

Before the fix

Gym 717c04a3b (main when this PR was opened). The command runs Gym's own ensure_cline("3.0.55") against a
scratch npm prefix, with an npm wrapper first on PATH that logs argv and cwd:

PYTHONPATH=$GYM python -c 'from responses_api_agents.cline_agent.setup_cline import ensure_cline; ensure_cline("3.0.55")'

14:32:35,714 responses_api_agents.cline_agent.setup_cline cline 3.0.55 is ready at .../prefix/bin/cline
npm calls:
21:32:18.871 cwd=.../agentdir argv=install -g cline@3.0.55
21:32:32.146 cwd=.../agentdir argv=prefix -g
21:32:35.723 cwd=.../agentdir argv=update -g cline --tag latest --min-release-age=0

With the real update allowed to run, an asyncio loop spawning cline the way ClineAgent._spawn
does (90 s) recorded:

    7  rc=0 out='3.0.55'
  185  FileNotFoundError: [Errno 2] No such file or directory: 'cline'
  157  rc=0 out='3.0.71'

QA testcase cline_math (README Cline math stack, hosted policy endpoint, no GPU) on Gym
717c04a3b. The npm debug logs written during the run:

21:40:45 npm install cline@3.0.55   cwd=<checkout>/responses_api_agents/cline_agent
21:40:56 npm prefix                 cwd=<checkout>/responses_api_agents/cline_agent
21:40:57 npm update cline           cwd=<checkout>/responses_api_agents/cline_agent

(cline_math_agent)   File ".../responses_api_agents/cline_agent/app.py", line 629, in _run_cline
(cline_math_agent)   File ".../responses_api_agents/cline_agent/app.py", line 586, in _spawn
(cline_math_agent)     proc = await asyncio.create_subprocess_exec(
(cline_math_agent) FileNotFoundError: [Errno 2] No such file or directory
aiohttp.client_exceptions.ClientResponseError: 500, message='Internal Server Error', url='http://127.0.0.1:28895/run'
Collecting rollouts:   0%|          | 0/5 [00:01<?, ?it/s]

Global cline --version after the run: 3.0.71.

AnySWE setup path (h100). The Node and Cline section of cline_agent_deps.sh from main, run with a
scratch DEPS_DIR:

validation --version printed: 3.0.55
npm log: npm update cline   argv "update" "--global" "cline" "--tag" "latest" "--min-release-age" "0"
         placeDep ROOT cline@3.0.73 REPLACE
cline in DEPS_DIR 90 s later: 3.0.73

After the fix

Gym 7daa0a6a5 (this branch before the rebase; nothing in cline_agent or anyswe_agent changed on
main between 717c04a3b and c62f9cc67). Same ensure_cline("3.0.55"), then three spawns through
ClineAgent._spawn with ClineAgent._env(), with the real update allowed to run:

npm calls:
21:37:26.379 cwd=.../agentdir argv=install -g cline@3.0.55
21:37:37.530 cwd=.../agentdir argv=prefix -g
agent _env CLINE_NO_AUTO_UPDATE = 1 | os.environ: None
spawn 0: rc=0 out='3.0.55'
spawn 1: rc=0 out='3.0.55'
spawn 2: rc=0 out='3.0.55'
installed version 15 s later: 3.0.55

QA testcase cline_math on Gym 7daa0a6a5. The npm debug logs written during the run show no
update:

21:43:08 npm install cline@3.0.55   cwd=<checkout>/responses_api_agents/cline_agent
21:43:16 npm prefix                 cwd=<checkout>/responses_api_agents/cline_agent

$ gym eval run --no-serve --agent cline_math_agent --input .../environments/cline_math/data/example.jsonl ...
  exit 0 in 148.8s
    5 rollout rows with unique identities
    cline_math_agent: mean/reward 0.8 agrees with persisted rollouts
    5 real Cline trajectories; 15 live math verifier checks
PASS     5.0s  the README preparation validates every row of the complete DAPO17K train split
PASS   201.3s  the README Cline math stack evaluates all five examples with fifteen live controls and cleanup
cline_math: 2/2 passed in 206.3s

Global cline --version after the run: 3.0.55.

AnySWE setup path, same h100 run with this branch's script: --version printed 3.0.55; the only
npm log is npm install cline@3.0.55; cline in DEPS_DIR 90 s later: 3.0.55.

Validation

• QA testcase cline_math: before FAIL (FileNotFoundError → /run 500, 0/5 rollouts, Cline left at 3.0.71); after 2/2 PASS (5 rollouts, 15 live verifier checks, no npm update, Cline stays 3.0.55)

• responses_api_agents/cline_agent/tests + responses_api_agents/anyswe_agent/tests: 122 passed on the
  branch rebased onto c62f9cc67. New tests:

  • Version-probe env with an ambient "0", with the parent env left untouched.
  • _env() with an ambient "0".
  • cline auth and the task spawn both carrying "1".
  • An explicit config.env "0" still winning.
  • Every bin/cline call in cline_agent_deps.sh carrying CLINE_NO_AUTO_UPDATE=1.

  The first three fail on main (KeyError: 'CLINE_NO_AUTO_UPDATE', KeyError: 'env'), and the
  script test fails on main's script.

• AnySWE setup path: the cline_agent_deps.sh A/B above. The cline_math smoke covers only the
  cline_agent path. No AnySWE rollout smoke ran, because it needs a sandbox provider and container
  formatter that h100 does not have.

• CLINE_NO_AUTO_UPDATE A/B on the real 3.0.55 binary: unset, 0 and true each started one
  update. 1 started none.

• pre-commit run on the changed files: passed.

• Rollout evidence: the cline_math run above produced 5 real Cline trajectories against a hosted Nemotron endpoint, each with 1–3 tool calls, all finished_naturally=true and mask_sample=false, with rewards 1, 1, 1, 1, 0. The single 0 is a wrong answer from the model, not a plumbing failure.

Compatibility

Cline no longer self-updates when Gym runs it, by default. cline_version: null installs @latest only
on a clean machine. ensure_cline reuses any cline already on PATH when no version is requested,
and with the updater off, an existing install no longer upgrades itself either. To move to a newer
Cline, bump cline_version (and CLINE_VERSION in cline_agent_deps.sh). An explicit
env: {CLINE_NO_AUTO_UPDATE: "0"} restores the old behavior. No config or schema changes.

🤖 Generated with Claude Code