Release Notes

NemoClaw v0.0.100 strengthens restored OpenClaw pairing, transactional sandbox replacement, managed Deep Agents Code, and host readiness provenance. It also improves onboarding recovery, lifecycle cleanup, Hermes image builds, runtime diagnostics, documentation, and trusted end-to-end (E2E) evidence.

• OpenClaw cross-sandbox restore now uses descriptor-pinned clone pairing, while fresh onboarding continues to use generated pairing identity. A restored clone can perform one bounded scope-upgrade recovery and tolerate a brief pending-request publication interval. Unsafe filesystem shapes, persistent malformed state, and mismatched identities still fail closed. For more information, refer to Create and Restore Snapshots.
• Managed Model Context Protocol (MCP) startup for Deep Agents Code now works when OpenShell seccomp denies memfd_create and workspace-backed /tmp rejects O_TMPFILE. The Deep Agents Code sandbox receives a 1 MiB private tmpfs with verified mount options, and the managed runtime keeps its anonymous descriptor and integrity checks. For more information, refer to Run LangChain Deep Agents Code.
• Managed Deep Agents Code requests now apply the recorded compatible-endpoint reasoning effort at runtime. Recovered onboarding and sandbox recreation also preserve recorded reasoning mode and effort instead of accepting unrelated ambient values. For more information, refer to Quickstart with Deep Agents and Configure Model Capabilities.
• rebuild and same-name onboarding replacement now record a transaction before the first destructive mutation. Recovery binds the source, replacement, registry generation, and OpenShell gateway, then continues the recorded operation or fails closed when those identities drift. For more information, refer to Recover and Rebuild Sandboxes and the NemoClaw CLI Commands Reference.
• Compatible-endpoint onboarding now limits the Responses API streaming-event probe to 5 seconds while preserving the Chat Completions API fallback. Onboarding reuses a successful Chat Completions validation result instead of sending the immediate host-side validation request when the public endpoint, model, authentication mode, and request requirements match. The validated IP address set must also match, so onboarding sends another validation request after the DNS pin changes. NemoClaw still sends a separate validation request for an operator-trusted private endpoint. Host interruptions during an active onboarding step produce the existing resumable recovery path instead of an invalid state transition. DGX Station Express also preserves its owner-only resume receipt when automatic dual-Station discovery selects the single-Station fallback. For more information, refer to Choose a Compatible Inference API, Quickstart, and Prepare DGX Station to Install NemoClaw.
• nemoclaw status now reads terminal-runtime out-of-memory counters through a bounded host-side Docker probe, so a recorded kill produces degraded status and rebuild guidance. Destroying the final sandbox now stops a packaged OpenShell gateway service and refuses cleanup when the service remains active. For more information, refer to the NemoClaw CLI Commands Reference and Troubleshooting.
• shields down now succeeds without changing state when an OpenClaw configuration already has the exact mutable posture. Cloudflare Tunnel cleanup verifies that the recorded process still belongs to cloudflared before each signal and removes a stale PID file without signaling an unrelated process. For more information, refer to Understand Runtime Changes and Run Sandboxes.
• Managed Hermes image probes now run through a checked-in Python runner, so OpenShell gateways that use Docker’s legacy builder enforce the same image assertions as BuildKit. For more information, refer to Install Hermes Plugins.
• nemoclaw host probe schema 1.1.0 now identifies the exact compiled CLI version and immutable source revision for every readiness result. Consumers can reject stale or mismatched readiness producers before they use host evidence. For more information, refer to System Readiness.
• Provider-neutral runtime bundles now enforce provider, workload, ownership, and registry contracts for the existing Docker and Kubernetes paths. Root-owned managed shared-state transactions enforce atomic application and rollback contracts but remain inactive in production onboarding. Neither foundation activates a new runtime provider or adds a CLI, configuration, default, or support claim.
• Documentation now includes a focused Deep Agents Code operation page, publishes the agentic-documentation guide in every guide variant, and uses host capability detection for optional NVIDIA DORI routing. It also adds missing recovery, memory-search, and two-DGX Station verification guidance identified by post-tag documentation audits. For more information, refer to Run LangChain Deep Agents Code and Engineer Documentation for AI Agents.
• Trusted E2E now binds request proofs to explicit authenticated phases, keeps calibration ancestry durable after evidence-source PR refs disappear, and validates coupled MCP credential evidence. Recovery repetition moved into deterministic integration tests, while the retained live test verifies one exact replacement process and connect-driven recovery. The PR Review Advisor now preserves validated second-opinion lane disagreements and rejects malformed E2E collections.

NemoClaw v0.0.99 strengthens snapshot restore, sandbox recovery, shared-route upgrades, Hermes lockdown, and experimental runtime identity. It also hardens host readiness, inference health checks, managed images, documentation routing, and release end-to-end (E2E) evidence.

• Snapshot restore can now create a Docker- or VM-driver replacement from a stopped source when the registry records its image and complete inference route. Restored SQLite databases must accept a write transaction, and OpenClaw clone restore waits for bounded managed-supervisor readiness before it applies state. Pairing verification now proves that the restored authenticated session belongs to the clone. For more information, refer to Create and Restore Snapshots and the NemoClaw CLI Commands Reference.
• Legacy supervisor recovery now backs up manifest-declared state before it recreates a container and restores that state only after replacement identity and managed health pass. Rebuild recovery manifests publish atomically, OpenClaw onboarding persists the credential-free nemoclaw-start command, and recreated managed OpenClaw configuration files regain their required writable mode. Failed recovery preserves the temporary backup and reports host recovery guidance when rollback also fails. For more information, refer to Recover and Rebuild Sandboxes and the NemoClaw CLI Commands Reference.
• Rebuild now migrates only missing canonical credential environment-variable names for legacy sandboxes that share a gateway route. It revalidates the target and every registered peer immediately before deletion, while explicit credential, model, endpoint, API-family, and gateway conflicts continue to stop the rebuild. For more information, refer to Use Shared Gateway Routes and the NemoClaw CLI Commands Reference.
• Hermes lockdown now keeps /sandbox/.hermes at 3770 root:sandbox, which lets the gateway create runtime state while sealed configuration files remain protected. Gateway restart, recovery, and connect now classify exhausted or refused relaunches as relaunch quarantined and direct you to rebuild instead of retrying a deterministic refusal. For more information, refer to Troubleshooting and the NemoClaw CLI Commands Reference.
• The experimental direct OpenClaw blueprint runner now includes a data-only Microsoft Entra runtime identity reference. The reviewed policy restricts refresh to login.microsoftonline.com, bearer delivery to GET graph.microsoft.com/v1.0/me, and delegated permission guidance to User.Read with offline_access. NemoClaw does not package OAuth bootstrap, on-behalf-of exchange, or a production identity middleware service, and normal nemoclaw onboard does not enable this component. For more information, refer to Configure Experimental Runtime Identity.
• nemoclaw host probe now classifies a symlinked DGX Station release marker as unqualified instead of inconclusive, matching the other rejected marker shapes. Local inference adapter health checks now retain at most 64 KiB and fail closed on oversized declared or chunked loopback responses. For more information, refer to System Readiness.
• Managed Hermes images now pin Node.js 24.18.1, uv==0.11.33, mcp==1.28.1, and tornado==6.5.7. Managed LangChain Deep Agents Code images retain the reviewed 0.1.34 integration contract while pinning uv==0.11.33, mcp==1.28.1, Pillow==12.3.0, and pyasn1==0.6.4. Image validation also rejects retained uv build cache metadata, ignores build-only BuildKit telemetry during the Deep Agents Code probe, and clears each local platform pull before validating the next architecture.
• Trusted CI now publishes agent-complete Open Container Initiative images by immutable digest, validates anonymous pulls and runtime contracts, and promotes aliases only after those checks pass. Dormant managed-image selection and startup-profile contracts resolve exact all-agent cohorts and bounded agent-specific startup data without activating buildless onboarding or changing the current Dockerfile path.
• Documentation now keeps provider-switch sections within the applicable OpenClaw and Hermes guide variants, corrects the Omni sub-agent model ID, and generalizes agent-selection guidance. The runtime identity, two-DGX Station vLLM, and memory search guides are now separate focused pages. The NVIDIA DORI installation pin is corrected from 0.10.0 to 0.9.0. For more information, refer to Switch Inference Providers and Set Up Task-Specific Sub-Agents.
• Release E2E now preserves command and agent first-turn latency separately, evaluates recurring anomalies within an exact 12-sample cohort, and routes retired rebuild selectors to focused replacement evidence. The credential-generation window runs independently, managed startup recovery covers the persisted startup command, and the standing Brev Launchable waits for the staging image family before deployment.

NemoClaw v0.0.98 upgrades managed Hermes to 0.19.0 and adds structured non-interactive output for LangChain Deep Agents Code, no-clobber skill installation, and explicit storage-remediation readiness evidence. It also repairs post-reboot delivery recovery, OpenShell-preserving uninstall, messaging conflict enforcement, Docker host diagnostics, sandbox dependency baselines, and bounded runtime diagnostics.

NemoClaw v0.0.97 adds read-only host readiness reporting, a Deferred automatic two-Station vLLM evaluation, compatible-endpoint reasoning effort controls, and an experimental runtime identity reference for direct OpenClaw blueprints. It also hardens compatible-provider switching, managed sandbox images, Jetson GPU access, lifecycle recovery, network policy guidance, MCP discovery, and release E2E evidence.

NemoClaw v0.0.96 adds persistent baseline network policy exclusions, DNS-backed HTTPS inference switching, host-managed default OpenShell gateways, and opt-in MCP tool discovery. It also hardens blueprint identifier validation, improves onboarding and recovery diagnostics, preserves Shields posture during bulk backups, locks and updates managed sandbox image dependencies, reduces Hermes image size, and strengthens release validation.

NemoClaw v0.0.95 adds explicit ownership for externally supervised OpenShell gateways, strengthens recovery and state-transfer paths, expands inference compatibility, refreshes sandbox security packages, and requires E2E evidence from executed runs while separating runner wait time from test execution.

• Platforms can now declare whether NemoClaw or an external systemd service owns the OpenShell gateway lifecycle. NemoClaw validates the declared listener and keeps stop, recovery, and uninstall operations from changing an externally supervised gateway. Stopping a sandbox now removes its dashboard forward, forward startup retries terminated listener attempts, and managed recovery retries dropped OpenShell relay connections. Hermes preserves managed gateway restart recovery. Uninstall keeps OpenShell-orphaned sibling sandboxes outside the selected cleanup scope. For more information, refer to Declare the OpenShell Gateway Lifecycle Authority, Run Sandboxes, Recover and Rebuild Sandboxes, and Uninstall NemoClaw.
• Snapshot restore now replaces SQLite state files through staged atomic operations. Strict backup-all skips stranded orphan sandboxes, and nemoclaw <name> download verifies that each requested host artifact exists before reporting success. For more information, refer to Create and Restore Snapshots and the NemoClaw CLI Commands Reference.
• Onboarding now reuses a reachable Ollama service on Windows hosts and falls back to the standard CDI directories when Docker reports no CDI specification directories. OpenRouter forwarding applies a connection-establishment deadline, and managed NVIDIA Build Nemotron-3 requests omit the unsupported top-level thinking field. Managed Deep Agents Code preserves configured headless retry limits while classifying provider failures. For more information, refer to Set Up Ollama, Configure Inference Timeouts, and NemoClaw Quickstart with Deep Agents.
• When a base-image override is supplied, NemoClaw accepts only an official immutable remote digest or a local image built and pinned during the current operation. Rebuilds can reuse those local images, OpenClaw runtime checks validate version output, and shields preserve openclaw.json when a legacy lock has no config hash. The base images also update bundled npm packages, Perl, libexpat, and jq to address reviewed security findings, while the final OpenClaw image uses fewer payload layers. For more information, refer to Recover and Rebuild Sandboxes, Architecture Details, and the NemoClaw CLI Commands Reference.
• The default OpenClaw Discord policy now allows the bot to manage its own application commands without granting unrelated Discord API access. For more information, refer to Choose Messaging Channels and Network Policies.
• Release E2E automation no longer accepts a skipped PR gate as passing evidence. Root image changes select the full suite, direct main runs provision Hermes swap, retry reservations clean up after terminal outcomes, and runtime reports separate runner wait time from execution time. Nightly history and selected-test risk signals make infrastructure delays and product failures easier to distinguish.

NemoClaw v0.0.94 strengthens sandbox restore and update behavior, adds machine-readable onboarding progress, improves policy and security evidence, reduces Hermes image build time, and makes live E2E failures easier to classify.

• Snapshot restore now clears stale contents only from state directories declared by the snapshot manifest. It preserves target-only directories and directories whose backup failed. Cross-sandbox OpenClaw restores re-establish gateway pairing and verify it with an authenticated agent run. Hermes images repair virtual-environment access for the sandbox user, and session exports verify that each download produced the expected host artifact. For more information, refer to Create and Restore Snapshots and the NemoClaw CLI Commands Reference.
• nemoclaw upgrade-sandboxes --check now reads sandbox state without starting, recovering, or selecting a gateway. When registered sandboxes resolve to one recorded gateway, the command queries that gateway instead of the gateway selected by the current environment. For more information, refer to Update Sandboxes.
• policy-add now compares an already-applied catalog preset with the live policy. It exits without mutation when the content matches and previews the update when the preset changed. Network policy guidance now explains when an endpoint requires tls: skip raw TLS passthrough and identifies the lost L7 inspection and credential-resolution controls. For more information, refer to Apply Policy Presets, Configure Raw TLS Passthrough, Common NemoClaw Integration Policy Examples, and the NemoClaw CLI Commands Reference.
• Onboarding now supports --events=jsonl for a versioned, redacted stream of canonical state-machine events. The human-readable progress stream remains on standard error, and closing or slowing the event stream does not cancel onboarding. DGX Spark resume preserves the selected managed vLLM Express path, managed vLLM rejects a model that does not support the detected platform before downloads, and compatibility recovery selects and probes one usable IPv4 resolver. For more information, refer to the NemoClaw CLI Commands Reference, Set Up vLLM, and Troubleshooting.
• DGX Station qualification now accepts an OTA-upgraded GB300 release marker that omits DGX_OTA_PRETTY_NAME when the base workstation identity is present. The metadata override guidance now distinguishes recognized GB300 hardware from release-marker variants without weakening runtime checks. For more information, refer to Prepare DGX Station to Install NemoClaw.
• sandbox doctor --json now redacts token-shaped values at both machine-readable output boundaries while preserving the exit status from the original report. Reviewed npm audits now retain scanner, registry, timing, package, advisory, report-path, and failure provenance. A read-only advisory correlation tool can identify exact npm package and range matches before a reviewed audit record appears, while ambiguous matches remain informational and do not block a release.
• Hermes image assembly now groups repository payloads into five ownership-preserving BuildKit layers. The first hosted comparison reduced the production build step from 205 seconds to 101 seconds and the layer export from 178.8 seconds to 70.4 seconds. Build-time checks preserve file contents, modes, owners, scanner ordering, and cache boundaries.
• Live E2E validation now isolates long-running lanes, trusts exact-head Hermes swap setup, stabilizes cancelled child lifecycles, parallelizes plugin EXDEV coverage, and records periodic runner-pressure telemetry. These changes distinguish hosted-runner loss from product failures while retaining the cold-onboard performance budget as a separate release signal. Documentation validation also keeps agent-variant checks read-only, accepts an absent Fern preview as a non-blocking condition, and uses Fern 5.80.1.

NemoClaw v0.0.93 updates DGX Station and DGX Spark onboarding, adds resumable managed vLLM download guidance, preserves installer cancellation status, rejects Intel macOS before downloads, and strengthens release validation.

• DGX Station Express now recognizes the stock no-OTA DGX OS 7.6.x workstation family when its release marker proves the expected GB300 lineage. The existing hardware, driver, ECC, Docker, CDI, and container GPU checks still apply, and future release families remain fail-closed. Stock DGX OS and AI Developer Tools profiles can keep an idle PackageKit daemon because those paths preserve factory packages, but active or malformed package transactions still block preparation. Full Station Express end-to-end qualification for the accepted no-OTA DGX OS 7.6.x profile remains pending. For more information, refer to Prepare DGX Station to Install NemoClaw and Platform Support and Launch Claims.
• When Station Express detects an existing vLLM workload, NemoClaw leaves the workload unchanged and reports an exact manual stop command. The default choice preserves the managed Express recipe and prints an exact revision-pinned resume command. The alternative keeps the running vLLM and continues through advanced manual Local vLLM setup while preserving the selected installer revision and ports across a login handoff or interrupted retry. A non-interactive run preserves Express and does not change the host. For more information, refer to Prepare DGX Station to Install NemoClaw and the NemoClaw Quickstart with OpenClaw.
• Managed vLLM onboarding now explains optional Hugging Face read-token authentication before large public-model downloads. NemoClaw passes the token only to the temporary downloader, sanitizes downloader output across standard output and standard error, and prints resumable HTTP 429 recovery steps that reuse the existing cache. On DGX Spark, non-interactive onboarding with no requested or recorded provider now selects a running local vLLM first, then managed vLLM, and then NVIDIA Endpoints when neither local option is available. DGX Station and other hosts keep their existing unset-provider behavior. For more information, refer to Set Up vLLM and the NemoClaw Quickstart with OpenClaw.
• The public installer now rejects Intel macOS before it resolves a release reference or performs network work, and it reports that macOS requires Apple Silicon. Pressing Ctrl+C at a hidden onboarding credential prompt now preserves exit status 130 and resumable-session guidance without printing the rejected prompt error or a Node.js stack. For more information, refer to Platform Support and Launch Claims and the NemoClaw CLI Commands Reference.
• Release validation now waits for the relevant base image before final-main E2E fanout, tests the staging Brev Launchable, centralizes larger-runner selection, and retries one confirmed hosted-runner loss. E2E runs also publish semantic phase durations and runner-comparison telemetry while ignoring base-image run history that cannot affect the candidate. These controls separate infrastructure loss from product failures and keep candidate validation tied to the image under test.
• Documentation checks now require a documentation-writer receipt for docs-only PRs and record the matching PR without redundant receipt metadata. Quickstart platform guidance and inference command references now match the supported CLI paths, and the historical v0.0.91 audit follow-up remains part of the canonical changelog.

NemoClaw v0.0.92 updates OpenClaw and its sandbox Node.js runtime, documents headless deployment, and strengthens security, installer, platform, and live E2E validation.

• OpenClaw sandboxes now use OpenClaw 2026.7.1 and Node.js 22.23.1. The reviewed build remediates vulnerable Axios plugin copies and the affected OpenTelemetry Jaeger diagnostics graph with integrity-pinned packages. It also locks patched mcporter dependencies, preserves device-scope enforcement and private state during upgrades, and validates upgrades from NemoClaw v0.0.89. A real-artifact regression confirms malformed Jaeger trace and baggage headers do not terminate the diagnostics process.
• Remote deployment guidance now uses one provider-neutral headless Linux server workflow for OpenClaw, Hermes, and Deep Agents Code. The guide covers unattended installation, loopback-only access, readiness checks, policy setup, updates, and recovery after a host reboot. Retired Brev deployment routes redirect to the shared workflow. For more information, refer to Deploy NemoClaw to a Headless Server.
• Live E2E tests now report ordered semantic phases, outcomes, durations, resource-release timing, and secret-safe stall diagnostics. Each run saves a progress artifact that identifies where failures or stalls occurred. Collection-time validation rejects missing or invalid phase plans before tests use live infrastructure.
• Installer integrity checks now accept the reviewed OpenShell Homebrew formula transition only when the template hash matches its exact release asset set. This maintains the fail-closed boundary while preserving the current archive-only installer contract.
• Platform and image validation now compares canonical macOS watcher targets, raises the full WSL suite limit from 60 to 90 minutes, and capability-gates its Docker-only Hermes contract. The WSL tag test still verifies that a rejected concurrent update cannot replace latest. Hosted Hermes image exports now provision bounded swap before the final layer export. Hermes guard tests raise the child-process allowance from 5 to 90 seconds and use WSL fixtures that match production ownership. The validation and test changes do not alter runtime behavior or final image contents.
• The canonical changelog now includes the previously missed v0.0.91 entry and corrects its legacy inference-selector guidance to match the tagged code. This restores release-history validation without changing the immutable v0.0.91 tag.

NemoClaw v0.0.91 strengthens completed sandbox images, makes rebuild replacement safer, documents the Hermes API token lifecycle, expands qualified DGX Station guidance, and restores historical release validation.

• Completed OpenClaw, Hermes, and Deep Agents Code images now replace affected node-tar installations with reviewed versions and scan the final filesystem before publication. Current and historical OpenClaw security-revision verifiers also validate exact dependency versions, resolved archives, integrity metadata, executable identity, and transactional state restoration in constrained containers. For more information, refer to the OpenClaw 2026.6.10 Dependency Review.
• Rebuilds now carry validated local-base trust through Deep Agents Code image preparation, reuse the outer state backup during inner onboarding, and wait for OpenShell to confirm sandbox deletion before removing registry state or creating a replacement. These checks prevent rebuild from rejecting its own current base, taking a second backup against stale gateway state, or racing an asynchronous sandbox deletion. Rebuild also stops before deletion when a manifest-declared state file cannot be archived unless you pass --force. Remote base-image overrides now require an official repository reference that resolves to an immutable digest. NemoClaw accepts local bases only when the current operation builds and pins them. For more information, refer to Recover and Rebuild Sandboxes and the NemoClaw CLI Commands Reference.
• Hermes guidance now explains when the API bearer token remains stable, when rebuild or invalid state rotates it, and how to retrieve the current value with nemohermes <sandbox> gateway-token --quiet instead of reading the generated environment file. For more information, refer to the NemoHermes CLI Commands Reference and Recover and Rebuild Sandboxes.
• DGX Station documentation now records qualified single-system GB300 profiles as tested with limitations while keeping dual-Station and dedicated-CI gaps explicit. Coding-agent guidance also constructs non-interactive installs with explicit agent, provider, and release-tag variables and keeps Docker approval command-scoped. For more information, refer to Platform Support and Launch Claims, Prepare DGX Station to Install NemoClaw, and the NemoClaw Quickstart with OpenClaw.
• Historical OpenClaw gateway-upgrade and Hermes rebuild fixtures now use immutable reviewed inputs that match each pinned release’s contract. This restores deterministic coverage for legacy image upgrades, Hermes token rotation, stale-base replacement, and completed-image security checks without weakening production validation.

NemoClaw v0.0.90 keeps managed-image routing identifiers out of secret-shaped build arguments, remediates reviewed OpenClaw dependency vulnerabilities, restores provider-reset recovery, corrects WhatsApp health reporting, and aligns DGX Station guidance with the versioned installer.

• Managed OpenClaw, Hermes, and Deep Agents images now use NEMOCLAW_INFERENCE_PROVIDER_ID for the non-secret inference route selector, while provider credentials stay in OpenShell storage and the host-side credential alias remains unchanged. Existing custom images can still use the legacy selector in v0.0.91, but should migrate to NEMOCLAW_INFERENCE_PROVIDER_ID before the compatibility fallback is removed in a future release. For more information, refer to the NemoClaw CLI Commands Reference.
• OpenClaw core, Slack, and Microsoft Teams installations now replace reviewed vulnerable transitive packages with integrity-verified remediated versions while retaining the openclaw@2026.6.10 release pin. Archive validation fails closed, and the dependency audit records the remaining reviewed low- and moderate-severity findings. For more information, refer to the OpenClaw 2026.6.10 Dependency Review.
• credentials reset now recognizes sandbox attachments from wrapped OpenShell diagnostics, validates each sandbox name, detaches affected sandboxes, and retries provider deletion without exposing credential values. For more information, refer to Credential Rotation.
• OpenClaw WhatsApp status now recognizes the current paired-session path and derives in-process bridge activity from redacted gateway-log evidence. This prevents a working paired channel from being reported as unpaired or inactive while keeping phone numbers and raw log lines out of host output. For more information, refer to Set Up WhatsApp and the NemoClaw CLI Commands Reference.
• DGX Station coding-agent guidance now delegates qualification, preparation, consent, and resume behavior to the selected versioned installer. Station Express keeps Nemotron 3 Ultra 550B as the default, while --station-deepseek selects DeepSeek V4 Flash. Related guidance adds bounded OpenIB repair or disable steps, clarifies legacy recovery state limits, and gives platform-specific setup its own navigation group. For more information, refer to Prepare DGX Station to Install NemoClaw, the NemoClaw Quickstart with OpenClaw, and Recover and Rebuild Sandboxes.

NemoClaw v0.0.89 broadens qualified DGX Station installation paths, preserves inference choices through onboarding and rebuilds, strengthens sandbox recovery, discloses messaging policy scope before mutation, and keeps CLI output and background processes contained.

• DGX Station preparation now recognizes qualified OTA-upgraded GB300 workstations, both reviewed GB300 PCI device variants, and compatible installed package revisions without weakening the fail-closed boundary for unknown host drift. The Station Express flow preserves its accepted recipe across reboot or login handoff, validates package state before mutation, retains the qualified forward DKMS revision, and allows an idle PackageKit daemon while continuing to reject active package transactions. For more information, refer to Prepare DGX Station to Install NemoClaw and the NemoClaw Quickstart with OpenClaw.
• Onboarding now attaches the selected inference provider when it creates a sandbox and preserves the original endpoint provenance so later model switches retain the intended custom endpoint security boundary. Managed vLLM cleanup reaps processes left behind by failed or interrupted startup, onboarding heartbeats identify the active vLLM installation, and Ollama model selection guidance distinguishes explicit model names from discovery. For more information, refer to Meet Custom Endpoint Security Requirements, Switch Inference Models, and Set Up Ollama.
• Sandbox recovery and rebuild now wait for the target sandbox before probe-only inspection without restarting the shared host gateway, verify recovered sandbox stability, and recommend start when a sandbox container has crashed. Rebuilds refresh the agent’s primary model from the newly generated configuration, preserve durable agent tuning and intentional non-default model pins, preserve the Hermes default kanban database, and respawn the OpenClaw gateway after a managed restart. For more information, refer to Recover and Rebuild Sandboxes, Create and Restore Snapshots, and the NemoClaw CLI Commands Reference.
• Channel onboarding, channel lifecycle commands, rebuild reconciliation, and policy dry runs now print the complete effective messaging-preset egress before applying any policy mutation. The disclosure comes from the exact policy YAML and includes hosts, ports, transport and access details, HTTP methods and paths, and the binary allowlist. For more information, refer to Common NemoClaw Integration Policy Examples and the NemoClaw CLI Commands Reference.
• Sandbox status keeps human-readable gateway selection diagnostics out of JSON standard output, and inference route displays sanitize terminal control characters before printing provider, endpoint, or model values. Hermes uninstall also stops its detached dashboard forward watcher so the background process does not survive sandbox removal. For more information, refer to the NemoClaw CLI Commands Reference.

NemoClaw v0.0.88 strengthens DGX Station host preparation, makes inference health claims more precise, fixes multi-gateway sandbox operations and recovery, aligns onboarding policy defaults with web search, and restores credential-aware rebuilds.

• DGX Station preparation preserves stopped containers whose restart policy is no and stops if the container inventory changes or a workload becomes active. It provides RDMA-aware remediation when openibd.service fails and can restore the packaged CDI refresh lifecycle on the exact June 2026 NVIDIA AI Developer Tools factory image without generating CDI directly or restarting Docker or containerd. For more information, refer to Prepare DGX Station to Install NemoClaw, Platform Support and Launch Claims, and Troubleshooting.
• Sandbox status and doctor now distinguish an inference route that is reachable from an upstream model that is healthy by using bounded authenticated model-invocation probes for supported remote providers. Gateway-based agents also report Serving process: not checked so a fresh sandbox exec is not presented as proof that the long-running gateway process has equivalent inference access. For more information, refer to Verify the Sandbox Inference Route and the NemoClaw CLI Commands Reference.
• Sandbox-scoped status and exec operations select the sandbox’s owning OpenShell gateway before querying or dispatching, which prevents another active gateway on the host from producing stale state or receiving the command. Recovery also accepts an already-active port forward as success only after the live forward inventory confirms that the target sandbox owns the reachable listener. For more information, refer to the NemoClaw CLI Commands Reference and Recover and Rebuild Sandboxes.
• Fresh interactive onboarding now checks only the policy presets implied by the selected agent and web-search provider. Disabling web search no longer preselects Brave egress, while Brave and Tavily selections continue to preselect only their matching maintained preset. For more information, refer to Common NemoClaw Integration Policy Examples.
• OpenClaw rebuild preflight now reuses the sandbox’s exact gateway-registered Brave or Tavily credential binding when no host key is staged. Rebuilds therefore no longer require you to export a web-search key again when the durable gateway provider already matches the sandbox configuration, while missing or mismatched bindings still fail closed. For more information, refer to Recover and Rebuild Sandboxes.

NemoClaw v0.0.87 adds bounded DGX Station factory-image qualification paths, fixes Station post-reboot resume, makes managed Deep Agents Code startup restart-safe, and improves rebuild recovery, managed vLLM storage checks, sandbox backups, and strict-provider compatibility.

• DGX Station Express recognizes the exact April 2026 NVIDIA Colossus BaseOS and June 2026 NVIDIA AI Developer Tools GB300 factory profiles for qualification. The installer preserves each factory kernel, driver, Docker, and NVIDIA Container Toolkit stack, applies only the bounded access or runtime preparation required by that exact profile, and rejects identity, package, service, GPU, or runtime drift. DGX Station remains Deferred while physical qualification continues. For more information, refer to Prepare DGX Station to Install NemoClaw and Platform Support and Launch Claims.
• Station Express adds the temporary --force-station-install flag for a genuine DGX Station GB300 whose release metadata is not recognized. The flag bypasses only the release-metadata allowlist, rejects recognized profiles and other hardware, requires an interactive prompt, and preserves the GB300 hardware, GPU, ECC, Docker, Buildx, NVIDIA Container Toolkit, CDI, and container-visibility checks. For more information, refer to Prepare DGX Station to Install NemoClaw.
• Station Express onboarding now accepts both the current six-field installer resume receipt and the legacy three-field format after host preparation requires a reboot. The current format validates the agent, sandbox name, and policy tier in addition to the pinned revision, model, and receipt generation, while malformed, unsupported, or extended receipts remain fail-closed for troubleshooting. For more information, refer to Prepare DGX Station to Install NemoClaw.
• Managed Deep Agents Code onboarding now persists the nemoclaw-dcode-entrypoint startup command when the OpenShell Docker driver recreates a sandbox. The recreated container also receives the required nproc=512:512 and nofile=65536:65536 limits, so the managed runtime remains available after a gateway restart without weakening its process and file-descriptor boundaries. For more information, refer to Security Best Practices.
• Rebuild recovery verifies that a restored Hermes sandbox returns to healthy gateway and managed MCP state before reporting success. OpenClaw rebuilds also clear stale managed-provider session pins after an inference switch, allowing restored sessions to use the current configured model while preserving intentional pins to other providers. For more information, refer to Recover and Rebuild Sandboxes and Switch Inference Providers.
• Managed vLLM storage preflight estimates cold image and model downloads from pinned image metadata and model payload sizes. It checks Docker storage and the Hugging Face cache separately when they use different filesystems, rechecks capacity after a cold image pull, warns and continues during express or other non-interactive setup, and requires confirmation during interactive setup. For more information, refer to Set Up vLLM.
• Sandbox backup creation now streams archive data and validates entries incrementally instead of buffering the complete archive in host memory. Large backups therefore retain the existing traversal checks and partial-state behavior without requiring memory proportional to the archive size. For more information, refer to Create and Restore Snapshots.
• Hermes registers NemoClaw tools with the single function-schema envelope required by strict OpenAI-compatible providers. Google Gemini no longer rejects the managed Hermes tool list because of a nested schema, and audio transcription retains its declared parameters. For more information, refer to Use Google Gemini.
• Replacement-image rebuild failures preserve bounded, redacted Docker diagnostics when process output arrives as buffered data, making host-specific build failures actionable without exposing credentials or private host paths. For more information, refer to Recover and Rebuild Sandboxes.

NemoClaw v0.0.86 enables the Station express recipe on qualified stock DGX OS GB300 systems, makes interrupted Station setup resumable, and fixes model validation, managed vLLM cache checks, sandbox builds, and upgrade guidance.

• DGX Station GB300 express setup now accepts stock DGX OS 7.2.0, 7.4.0, and 7.5.0 when strict Station, GB300, release-marker, driver, ECC, Docker, CDI, and GPU-container checks pass. Direct-GPU sandboxes receive only the exact read-only GPU, CPU, memory, NUMA, and NVIDIA module-initialization sysfs paths required for CUDA instead of broad /sys access. A clean physical DGX OS 7.5.0 validation completed with local Nemotron Ultra inference, sandbox CUDA, and Hermes file-tool use; DGX Station support remains Deferred pending broader qualification. For more information, refer to Prerequisites, the NemoClaw Quickstart, and Platform Support and Launch Claims.
• Interrupted Station Express setup now persists its validated, secret-free provider, model, sandbox, and interaction choices. nemoclaw onboard --resume restores those choices and retries the failed managed-vLLM step, while successful onboarding and --fresh retire stale Express intent and installer reboot receipts. For more information, refer to the NemoClaw CLI Commands Reference and Set Up vLLM.
• Managed vLLM cache preflight now checks only the Hugging Face cache paths used by the selected model. Root-owned artifacts from an unrelated model no longer block a model switch, and repair guidance identifies the exact unwritable path. For more information, refer to Set Up vLLM.
• Manual Google Gemini model IDs are validated against Google’s native model catalog before the existing OpenAI-compatible chat-completions probe. Catalog results with or without the models/ prefix are normalized, non-chat models are filtered out, and API credentials remain outside process arguments. For more information, refer to Use Google Gemini.
• Sandbox image staging normalizes script and directory permissions before Docker consumes the build context. Fresh installs created under a restrictive umask no longer carry root-only modes into later non-root image-build stages.
• Legacy sandbox recreation now warns before the destructive step that managed recovery restores .openclaw state only and does not preserve files elsewhere under /sandbox. Back up paths such as /sandbox/user-data separately before upgrading. For more information, refer to Recover and Rebuild Sandboxes.
• The starter prompt now loads focused DGX Spark, DGX Station, or Windows WSL Express instructions only after platform detection, keeping unrelated platform guidance out of general onboarding while preserving each platform’s safeguards. The E2E workflow planner also owns typed selector, inference-mode, schema, and Hermes-selection validation before emitting the execution plan.

NemoClaw v0.0.85 upgrades the supported OpenShell release, prepares qualified DGX Station hosts for express setup, strengthens inference identity and route changes, and improves recovery across onboarding, MCP, rebuild, and managed gateway operations.

• NemoClaw now uses OpenShell v0.0.85 and pins its consumed release archives, manifests, binaries, and supervisor image to reviewed immutable identities. The integration preserves multiline command arguments byte-for-byte, rejects supervisor TLS credentials that reach child processes, validates release archives before extraction, and reports unavailable credential rewriting with specific recovery guidance. For more information, refer to Platform Support and Launch Claims, NemoClaw CLI Commands Reference, and Security Best Practices.
• Authenticated MCP setup now rejects OpenShell’s reserved revisioned credential names before provider mutation and keeps child-visible compatibility checks aligned with OpenShell v0.0.85. MCP bridge validation also preserves fail-closed address pinning and reports credential-rewrite failures separately from generic transport errors. For more information, refer to About Managed MCP Servers, Add an MCP Server, and Troubleshoot MCP Servers.
• DGX Station GB300 express setup can prepare a qualified generic Ubuntu 24.04 ARM64 host with reviewed NVIDIA driver, Docker, Buildx, and NVIDIA Container Toolkit versions. Preparation reuses exact matches, stops on unsupported version drift, validates CDI and GPU container access, restores Docker configuration after a failed runtime change, and resumes the accepted recipe after a required reboot. DGX Station remains Deferred pending physical end-to-end validation, and the --station-deepseek express flag now requires an interactive terminal instead of silently continuing headlessly. For more information, refer to Prerequisites, NemoClaw Quickstart, and Set Up vLLM.
• Managed and existing vLLM routes now distinguish a safe served-model alias from a model mismatch by requiring /v1/models to report the exact registered model as its root. Managed Nemotron 3 Nano uses its reasoning parser, the Nemotron Ultra Build route removes an unsupported top-level thinking field, and inference switching verifies sandbox access before changing the live route. For more information, refer to Set Up vLLM, Understand Provider Validation, and Switch Models.
• Onboarding routes custom endpoint DNS failures through the transport recovery flow, with retry, back, and exit choices instead of returning silently to provider selection. Installer upgrades also recover a user-local OpenShell installation, while interactive and non-interactive DGX Station notice handling remains explicit. For more information, refer to NemoClaw Quickstart, Meet Custom Endpoint Security Requirements, and Troubleshooting.
• Rebuild now treats a backup as unsuccessful when every state directory fails, even if it captured loose files, and stops before deleting the original sandbox unless you explicitly accept the --force recovery path. Managed gateway discovery ignores only descriptor-pinned, single-thread zombies while failing closed on ambiguous empty command lines, and Hermes shields transitions attest the private mutable runtime topology before acting. For more information, refer to Recover and Rebuild Sandboxes and Trusted Computing Base.

NemoClaw v0.0.84 adds DGX Station Nemotron Ultra express setup, trusted private inference endpoints, model-aware readiness checks, per-gateway host state, and safer recovery for snapshots, onboarding, configuration, messaging, and Hermes runtime changes.

• DGX Station now offers a one-confirmation express path that selects the pinned NVIDIA Nemotron 3 Ultra 550B managed-vLLM recipe, while --station-deepseek selects the existing DeepSeek V4 Flash recipe. Verified low Docker or model-cache capacity is advisory during express and other non-interactive setup while the storage checks mature, interactive setup still requires explicit confirmation, and an inconclusive model-cache check still stops non-interactive setup. For more information, refer to Set Up vLLM and the NemoClaw Quickstart.
• Custom endpoint onboarding can admit an exact trusted private hostname or IP literal from NEMOCLAW_TRUSTED_PRIVATE_INFERENCE_HOSTS when it resolves only to RFC1918, CGNAT, or IPv6 ULA destinations. DNS resolution, connection-address pinning, exact-match semantics, and fail-closed blocking for metadata, link-local, multicast, translation, documentation, and other reserved ranges remain enforced. For more information, refer to Meet Custom Endpoint Security Requirements and Set Up an OpenAI-Compatible Endpoint.
• Ollama onboarding prefers NEMOCLAW_MODEL, accepts NEMOCLAW_PROVIDER_MODEL as a compatibility fallback, and uses a requested model as the interactive default when it appears in the rendered model list. Hermes setup now carries its 64000-token Ollama context floor through daemon configuration, model validation, and generated config, while OpenClaw keeps its existing 16384-token floor. For more information, refer to Use Ollama and Configure Model Limits.
• Sandbox status and doctor checks compare the configured Ollama or vLLM model with the provider inventory without issuing a completion or consuming tokens. Onboarding finalization also treats an unreachable or HTTP 5xx inference route as not ready, preserves the session at retryable final verification, and lets onboard --resume complete after you repair the same route. For more information, refer to View Sandbox Status and Verify the Sandbox Inference Route.
• OpenClaw resume checkpoints completed sandbox name, web search, messaging, and resource choices, then reuses validated OpenShell credential registrations when their live bindings still match. Installer failures and rebuild retry output now print complete fresh-install and resume commands that retain the selected agent and sandbox name. For more information, refer to the NemoClaw CLI Commands Reference, Troubleshooting, and Credential Storage.
• A non-default NEMOCLAW_GATEWAY_PORT now owns a separate ~/.nemoclaw/gateways/<port>/ host state root for its registry, onboarding state, snapshots, migration files, and local inference adapter state. The default port keeps ~/.nemoclaw/, and uninstall preserves other port-scoped environments. For more information, refer to Architecture Details and Uninstall NemoClaw.
• OpenClaw snapshots no longer capture machine-local device identity or pairing-token directories, and restore ignores those directories even in older snapshots. OpenClaw regenerates device identity as needed and NemoClaw pairs clients again on connect instead of replacing live pairing state with sanitized snapshot data. For more information, refer to Create and Restore Snapshots.
• nemoclaw <name> channels status --channel telegram now combines non-secret config comparison with a live OpenClaw log-based health probe and reports healthy, idle, unreachable, token_rejected, or not_started. An unhealthy Telegram channel exits non-zero, and the default summary says when runtime health was not checked instead of presenting an all-green result. For more information, refer to the NemoClaw CLI Commands Reference.
• nemohermes inference set re-seeds the isolated Hermes dashboard config after an in-place route change and withholds the synced success message when the dashboard does not converge. Hermes MCP reload also recognizes when the gateway already committed the intended config and integrity state during a concurrent apply-state update, so it returns success instead of starting a destructive rollback. For more information, refer to Switch Models and Manage MCP Servers.
• Host-side OpenClaw config set validates the complete candidate with the installed OpenClaw runtime before replacing live config. Schema failures, validator failures, timeouts, size-limit failures, and concurrent changes leave the existing config in place and do not reach the destructive gateway restart path. For more information, refer to Understand Runtime Changes.
• shields up and shields down can quarantine and recover a transition-lock record only when its recorded process is definitively dead or its process ID was reused. Live, malformed, ambiguous, identity-unavailable, or concurrently replaced lock owners still fail closed with manual recovery guidance. For more information, refer to Trusted Computing Base.

NemoClaw v0.0.83 restores the DGX Station GB300 express-install path without changing its Deferred support status. It also makes shared inference route changes explicit and safe, warns on risky local vLLM configurations, and fixes several onboarding and platform edge cases.

• Shared inference route changes are now explicit and fail-safe. When multiple sandboxes share a gateway, onboarding warns immediately before re-pointing the live route and fails closed before replacing a provider-global identity used by another sandbox. Status output shows each sandbox’s recorded route, the live route, and whether connect can safely restore a drifted route. For more information, refer to Use Shared Gateway Routes and View Active Inference Route.
• Qualifying DGX Station GB300 systems enter the express-install path. This path availability does not change DGX Station’s Deferred support status. Managed vLLM storage preflight treats verified shortages as advisory during express and other non-interactive setup while the checks mature. Interactive setup still requires explicit confirmation, and non-interactive setup still stops when model-cache capacity is inconclusive. For more information, refer to Set Up vLLM, Platform Support and Launch Claims, and NemoClaw CLI Commands Reference.
• Onboarding warns when a bring-your-own vLLM server on DGX Spark appears to serve a large unquantized model that may exhaust GPU memory under agent tool-call load. The warning is suppressed for the managed Spark vLLM recipe. For more information, refer to Set Up vLLM and Troubleshooting.
• Re-onboarding with the reuse path preserves tier-default policy presets such as brave and tavily when the policy tier and web-search choice are unchanged.
• Unreachable custom endpoints during onboarding now route through the transport-recovery path with DNS/VPN guidance and a retry/back/exit prompt instead of silently looping back to provider selection.
• Rebuild preflight uses the model-aware token field for GPT-5 and o-series models, preventing spurious HTTP 400 failures before rebuild processing begins.
• Corporate CA trust anchors are available throughout the sandbox image build, so npm audit signatures succeeds behind TLS-intercepting corporate proxies without manual workarounds. For more information, refer to Configure Corporate CA Trust.
• SSH ControlMaster-delegated forwards are recognized by the untracked-forward fallback, preventing a healthy sandbox from being deleted after a forward-detection timeout.
• Hermes light terminal skin writes correctly on macOS via stdin streaming.

NemoClaw v0.0.82 adds non-destructive sandbox stop and start commands, protects managed vLLM downloads with storage checks, strengthens custom policy and dependency validation, and improves onboarding, backup, snapshot, and contributor guidance.

• Sandbox lifecycle controls can now free host resources without deleting a workspace. nemoclaw <name> stop stops managed channels and the sandbox’s Docker containers while leaving the workspace, registry entry, OpenShell record, credentials, shared gateway, and inference services intact. nemoclaw <name> start starts or unpauses the container, then checks runtime health and repairs the gateway and host forwards where applicable. For more information, refer to Run Sandboxes and NemoClaw CLI Commands Reference.
• Backup and snapshot recovery handle stopped and cloned sandboxes more safely. backup-all can temporarily start an eligible stopped Docker sandbox, capture its backup, and return it to the stopped state, while strict mode still fails when identity, startup, backup, or cleanup cannot be proven. Snapshot clones receive a destination-owned dashboard port so their dashboard URL and later rebuilds do not conflict with the source sandbox. Installer upgrades also ignore route-only placeholders left by interrupted onboarding instead of treating them as backupable sandboxes. For more information, refer to Create and Restore Snapshots and Run Sandboxes.
• Managed vLLM setup checks storage before large downloads begin. NemoClaw verifies Docker image storage and the Hugging Face model cache before an uncached image pull or model download, rechecks model capacity after the image pull, and treats low verified capacity as an advisory warning in express and other non-interactive setup paths. Interactive setup still stops unless the operator explicitly accepts the warning. Managed profiles use immutable platform digests, and the model download and serving containers use --pull=never so an implicit pull cannot bypass the storage gate. For more information, refer to Set Up vLLM and Choose an Inference Provider.
• Onboarding reports local inference and gateway conflicts more accurately. An identifiable foreign listener on the OpenShell gateway port now fails fast with process details and recovery guidance, interactive setup continues to detect running Ollama and vLLM services when another registry route exists, and an installed but stopped Ollama daemon appears as a start action instead of a running status. Loopback readiness checks bypass host proxies, compatible endpoint validation recommends an OpenAI-compatible endpoint or switching to OpenClaw when a Chat-Completions-only agent selects an Anthropic-compatible endpoint that does not serve /v1/chat/completions, and an eligible matching successful check can satisfy the immediately following smoke probe without a duplicate request. For more information, refer to Troubleshooting, Choose a Local Inference Server, and Understand Provider Validation.
• Interrupted onboarding preserves more of the selected route and sandbox intent. Resume repairs a missing pending route reservation when inference setup is already complete, and sandbox creation resolves its secret-free policy, messaging, provider, resource, and cleanup intent before destructive state changes begin. These protections keep resumed setup and stale-provider cleanup aligned with the choices made before the interruption. For more information, refer to NemoClaw Quickstart and NemoClaw CLI Commands Reference.
• Managed Deep Agents headless sessions now use the bounded session supervisor, so completed sessions reap their DCode and LangGraph descendants without affecting other sessions or leaving the sandbox unusable. For more information, refer to Quickstart with LangChain Deep Agents Code.
• Custom policy application rejects catch-all destinations before widening sandbox egress. Runtime custom presets now reject *, 0.0.0.0, 0.0.0.0/0, ::, and ::/0 while continuing to allow scoped subdomain wildcards such as *.example.com. The same semantic check protects repository validation, policy-add --from-file, and in-memory custom preset application. For more information, refer to Create Custom Policy Presets.
• NemoClaw now requires Node.js 22.19 or later for host installs and contributor tooling, matching current OpenClaw runtime and advisor SDK requirements. Ubuntu 26.04 has a digest-pinned userspace contract lane for CLI, preflight, installer, and platform checks, while Docker-host, AppArmor, Landlock, and live onboarding validation remain pending. For more information, refer to Prerequisites and Platform Support and Launch Claims.
• Contributor guidance now routes independent integrations, custom images, recipes, and complete workflows through Community Solutions while reserving canonical NemoClaw documentation for approved, maintained product surfaces. The contributor skill catalog also adds evidence-driven workflows for semantic dependency upgrades and route-safe documentation refactors. For more information, refer to Community Solutions and the Documentation Contributor Guide.
• Build and dependency trust boundaries cover more of the sandbox image path. Reviewed npm archives now share one production dependency audit, OpenClaw’s managed WeChat runtime installs from a NemoClaw-owned offline lock, and the messaging build plan no longer persists in final OpenClaw or Hermes image environments. Source and blueprint rebuilds also reuse cached plugin dependency layers. For more information, refer to the OpenClaw 2026.6.10 Dependency Review.

NemoClaw v0.0.81 strengthens rebuild and snapshot state preservation, repairs local compatible inference and WhatsApp setup, improves Docker restart recovery, and makes onboarding, backup, and security diagnostics easier to act on.

• Rebuild and restore preserve more user-owned state without letting old backups replace current managed configuration. Agent manifests can declare key-level restore ownership, managed Deep Agents restores keep only allowlisted UI and thread preferences, and Hermes rebuilds retain the Web Dashboard profile under /sandbox/.hermes/dashboard-home/, including its MEMORY.md and USER.md files. Deep Agents snapshot creation also falls back to /proc when ps is unavailable while continuing to fail closed when it cannot prove the runtime is idle. For more information, refer to Create and Restore Snapshots and Understand Sandbox State.
• Compatible inference setup handles more endpoint and model contracts automatically. Eligible loopback endpoints on ports 8000, 11434, and 11435 are validated on the host and registered through host.openshell.internal, GPT-5 and the o1, o3, and o4 model families use max_completion_tokens, and related provider validation probes can reuse bounded HTTPS connections with established fallbacks. Direct blueprint apply now aborts without persisting an incomplete plan or reporting false completion when provider creation or inference configuration fails. For more information, refer to Set Up an OpenAI-Compatible Endpoint and Choose a Compatible Inference API.
• Sandbox lifecycle recovery covers more host restart and teardown cases. On supported local Docker deployments, recover can transactionally replace a legacy keepalive container whose managed supervisor disappeared after a restart, and it commits only after health and settle checks pass. Hermes persists its managed startup command across direct Docker restarts, while unattended destruction of the final sandbox releases the shared gateway by default on macOS. For more information, refer to Recover and Rebuild Sandboxes, NemoClaw CLI Commands Reference, and Troubleshooting.
• Managed Deep Agents sessions skip optional first-run setup and clean up their own process trees on disconnect. The image includes ripgrep, pre-completes optional upstream onboarding, suppresses the optional Tavily warning unless web search is configured or used, and refuses a managed fetch CA bundle with unsafe ownership, permissions, links, or content. For more information, refer to Quickstart with LangChain Deep Agents Code and Security Best Practices.
• WhatsApp pairing now uses the OpenClaw loopback gateway so a successful QR login can start the channel without moving a gateway token or requiring operator.admin. Externally installed channel plugins now retain verified npm provenance, which enables the trusted persistent-state features expected by current OpenClaw releases. For more information, refer to Set Up WhatsApp.
• Backup and onboarding failures provide more specific recovery evidence. backup-all tells you to start a stopped sandbox or container and rerun the backup or installer, and backup failures identify these causes when available: permission denied, tar read error, or absent after extraction. A created-but-not-ready sandbox prints a lifecycle receipt with its readiness gate, timeout, and cleanup result, onboarding progress waits while an interactive prompt owns the terminal, and resumed onboarding does not advance durable state from stale replay results. For more information, refer to Create and Restore Snapshots, NemoClaw Quickstart, NemoClaw CLI Commands Reference, and Troubleshooting.
• Security and policy diagnostics preserve more context without hiding risk. OpenClaw security audits keep NemoClaw-managed dashboard compatibility findings visible with their severity, remediation, and recorded reason, while token-shaped URL query values are redacted even when their parameter names look benign. The custom Streamable HTTP MCP policy recipe also scopes DELETE to the exact MCP endpoint used for session termination. For more information, refer to Security Best Practices and Create Custom Policy Presets.