Release Notes

September 2, 2026

v0.0.119

NemoClaw v0.0.119 adds an explicitly selected native rootless Podman runtime path and an experimental managed llama.cpp path for qualifying Windows WSL N1x hosts. It hardens custom network policy, WeChat redirect, Langfuse, MCP credential, and messaging-rebuild boundaries. It also improves local inference selection, Hermes recovery, interrupted-install guidance, and sandbox command behavior, and updates reviewed production dependency graphs to remove four high-severity fast-uri advisories.

  • Native rootless Podman can now run standard managed-image onboarding on qualified Linux hosts when you set NEMOCLAW_GATEWAY_RUNTIME=podman. The provider verifies the current-user socket, rootless service, cgroups v2, bridge networking, DNS, platform, and exact managed-image receipt before admission. Qualifying Windows WSL N1x hosts can use an explicit Experimental managed llama.cpp recipe for Qwen 3.6 35B-A3B after Docker Desktop, GPU passthrough, memory, driver, and product-identity checks pass. Related changes: PR #9923 and PR #10742.
  • Windows-host Ollama requests now stay inside Docker Desktop across inventory, pull, validation, health, recovery, and cleanup instead of switching to a WSL-inaccessible route. Automatic Ollama selection chooses the largest fitting registered installed model before unregistered inventory entries, and managed vLLM preserves explicit GPU intent when an existing server occupies the selected port while reporting safe reuse or reconfiguration steps. Failed Ollama proof processes are also cleaned up as a process tree. Related changes: PR #10741, PR #10326, PR #10308, and PR #10767.
  • Custom policy presets now reject untrusted private, local, metadata, and other special-use destinations before preview or mutation, while preserving exact explicit trust for supported private destinations. Dry-run and apply share the same reserved-key ownership checks, and successful custom-preset lookup and removal no longer print a contradictory missing-preset warning. Related changes: PR #10659, PR #10834, and PR #10809.
  • OpenShell policy reads and rebuild handoffs now use typed policy boundaries, separate provider-composed entries from the round-trippable base policy, and refuse to carry literal credentials into a replacement sandbox. Credential commands route through the shared OpenShell provider adapter, including endpoint-bound non-secret provider configuration and managed MCP key ownership checks. Related changes: PR #10150 and PR #10149.
  • Experimental WeChat QR login now rejects untrusted redirect hosts before contact and authorizes only the exact validated Tencent iLink IDC origin captured for the account. Rebuild preserves channels whose complete required credentials remain available through matching gateway providers; it disables a channel only after confirmed absence and stops without staging changes when inspection is uncertain or conflicting. Related changes: PR #10692 and PR #10707.
  • Managed MCP restart now verifies every selected server’s stored credential before changing policy, providers, or agent adapters when no replacement host value is exported. Hermes Langfuse Cloud credentials use an endpoint-bound OpenShell profile for the exact public and secret key names instead of relying on destination-independent placeholder rewriting. Related changes: PR #10759 and PR #10844.
  • An interrupted install or upgrade now reports that the compiled CLI is incomplete and directs you to rerun the installer, which attempts sandbox recovery. Ordinary onboarding ignores an abandoned Portable configuration directory when no lifecycle authority exists, while protected Portable state remains fail-closed with corrective guidance. Related changes: PR #10444 and PR #10743.
  • A bare sandbox action now reports the required nemoclaw <name> <action> grammar without exposing arbitrary input. nemoclaw <sandbox> exec runs without a pseudo-terminal by default so formatted output and stderr redirection behave predictably; pass --tty for an interactive terminal. Uninstall previews now name the gateway and Docker volume selected by NEMOCLAW_GATEWAY_PORT. Related changes: PR #10335, PR #10760, and PR #10803.
  • Hermes onboarding now requires its tracked base image, or a repository-built local base that passes the same controls, instead of falling through to an image that final provenance checks must reject. Stopped-container recovery omits one known-futile prelaunch health request, keeps final authenticated health required, and reports credential-safe timing for its qualification, startup, polling, rollback, and total phases. Related changes: PR #10831, PR #10805, and PR #10811.
  • NemoClaw now pins fast-uri 3.1.6 across its production dependency graphs and managed-image build inputs. Reviewed locks, integrity metadata, runtime bundles, and image fixtures now exclude the four high-severity advisories that affect earlier 3.x releases while preserving the fail-closed audit threshold. Related changes: PR #10894 and PR #10892.