Release Notes

September 10, 2026

v0.0.123

NemoClaw v0.0.123 expands configuration export for managed OpenClaw and Hermes sandboxes. It adds an experimental external-component onboarding contract and improves installer recovery, sandbox lifecycle handling, and inference diagnostics.

  • nemoclaw config export now exports canonical managed Hermes sandboxes, including verified API-key authentication and nondefault interface settings. OAuth authentication and Hermes tool gateways remain outside the export contract. Related changes: PR #11323, PR #11450, and PR #11477. Refer to the NemoClaw CLI Commands Reference.
  • OpenClaw configuration export now preserves managed Brave Search references, proxy settings, hosted inference tuning, execution settings, dashboard settings, direct tool disclosure, and local conversation diagnostics. It also supports one read-only secondary agent that shares the primary hosted inference route. Local Ollama export preserves verified daemon and proxy ports. Export verifies live and retained configuration evidence and writes credential references instead of secret values. Related changes: PR #11384, PR #11387, PR #11383, PR #11429, PR #11430, PR #11431, PR #11473, and PR #11478. Refer to the NemoClaw CLI Commands Reference for the supported export profiles and their limits.
  • Fresh onboarding on Linux can register one experimental external host component with a NemoClaw-managed Docker-driver gateway. NemoClaw validates the declaration before gateway changes and verifies sandbox identity and effective policy before activation. Failed or ambiguous activation preserves the sandbox and records incomplete state; resume and automatic activation retries are unsupported. NemoClaw does not manage the component service or its credentials. Related changes: PR #11366 and PR #11471. Refer to Register an External Component During Onboarding.
  • The installer now attempts existing sandbox recovery before generic host admission and preserves each sandbox’s recorded GPU selection. It distinguishes confirmed recovery from missing sandboxes or unconfirmed recovery output, and reports warnings instead of claiming complete recovery. Fresh onboarding and required DGX Station reconciliation still require host admission. Related change: PR #10397. Refer to Update Sandboxes.
  • Sandbox status now distinguishes an intentional stop from a failure, and connect directs you to start a stopped sandbox. Portable Hermes start, stop, and recovery use OpenShell for lifecycle changes and verify the receipt-owned Podman container afterward. Portable lifecycle operations share the same lock authority, including the host fence during startup. Related changes: PR #11211, PR #11336, PR #11482, and PR #11490. Refer to Recover and Rebuild Sandboxes.
  • NVIDIA Endpoints validation now checks the selected inference route. Onboarding and sandbox status identify the account-access cause when NVIDIA returns a matching model-access 404, without exposing the response body in status diagnostics. Docker readiness failures identify authority conflicts, and GPU-mode probe failures retain the Docker failure reason. Non-interactive onboarding resolves the sandbox name before provider selection. Related changes: PR #10957, PR #11393, PR #11280, and PR #11442. Refer to Verify the Sandbox Inference Route and System Readiness.
  • Removing Teams now removes Teams-owned Microsoft login credential bindings from matching Outlook policy endpoints. It refuses to remove bindings owned by another integration. Related change: PR #10846. Refer to the NemoClaw CLI Commands Reference.

v0.0.122

NemoClaw v0.0.122 improves host detection and local inference selection for Docker, DGX Station, and N1x WSL. It also strengthens interrupted onboarding, Hermes Portable lifecycle recovery, configuration export, remote dashboard access, and uninstall failure reporting.

  • Host readiness now runs Docker probes with the environment that later Docker commands use. It respects the selected Docker context and configuration, rejects unsafe explicit endpoints, and can select the rootless Linux socket after an unreachable default authority. DGX Station checks now separate GB300 hardware identity from the qualified software profile and apply the same classifier during host preparation and onboarding. Related changes: PR #10379 and PR #10914. For more information, refer to System Readiness and Prepare a DGX Station.
  • A CUDA-qualified N1x WSL host now selects the managed Qwen llama.cpp profile instead of falling back to the smaller Ollama profile. A resumed preset-driven managed vLLM installation verifies the recorded model and serving preset before it changes runtime state. A mismatch stops onboarding and directs you to restart with nemoclaw onboard --fresh. Related changes: PR #11078 and PR #11271. For more information, refer to Choose a Local Inference Server, Set Up llama.cpp, and Set Up vLLM.
  • Interrupted onboarding now releases its process lock and abandons an uncommitted inference-route reservation before a later resume. Final handoff keeps incomplete sandbox identity available for recovery and does not report success when replacement onboarding exits nonzero. The global nemoclaw doctor command remains available without a sandbox name, including when a registered sandbox is named doctor. Related changes: PR #11140, PR #11205, PR #11218, and PR #11296. For more information, refer to Recover and Rebuild Sandboxes and the NemoClaw CLI Commands Reference.
  • Hermes Portable onboarding now records the selected OpenShell gateway for later recovery and uninstall operations. Start and recovery repair the receipt-owned host forwards before reporting readiness, while stop retries an incomplete identity observation within its bounded settlement policy. Upgrade recovery preserves the Portable lifecycle and forward identities instead of replacing them with ambient gateway state. Related changes: PR #11034, PR #11266, and PR #11312. For more information, refer to Recover and Rebuild Sandboxes and the NemoClaw CLI Commands Reference.
  • nemoclaw config export now supports native NVIDIA hosted inference only when the gateway uses the built-in nvidia-prod profile, its default endpoint, and no provider configuration overrides. Missing or inconsistent provider evidence stops the export without writing a configuration document. Related changes: PR #11065 and PR #11318. For more information, refer to the NemoClaw CLI Commands Reference.
  • Neutral managed OpenClaw images no longer declare the uninstalled Tavily plugin. This removes recurring plugin not installed: tavily warnings when Tavily Search was not selected, while explicitly selected Tavily configuration remains unchanged. Related change: PR #10331. For more information, refer to Troubleshooting.
  • Remote dashboard access now keeps an external CHAT_UI_URL separate from the host forward bind. A reverse proxy or tunnel can reach the loopback forward while the URL configures the browser origin and Host-header validation. Direct access on a non-WSL host requires NEMOCLAW_DASHBOARD_BIND=0.0.0.0 before onboarding and for later nemohermes <sandbox> connect calls. Protect the dashboard and API ingress before exposing either service. Related change: PR #10931. For more information, refer to Quickstart with Hermes and Gateway Authentication Controls.
  • The installer now refuses an implicit NemoClaw CLI downgrade and reports the installed and requested versions before it changes the installation. Uninstall exits nonzero when it cannot remove the gateway registration, so automation does not treat partial cleanup as success. Related changes: PR #11209 and PR #9860. For more information, refer to Update Sandboxes and Uninstall NemoClaw.