> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/nemoclaw/llms.txt. > For full documentation content, see https://docs.nvidia.com/nemoclaw/llms-full.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemoclaw/_mcp/server. # Choose Between NemoClaw and OpenShell CLIs > Choose between the NemoClaw CLI and the OpenShell CLI for common sandbox operations. NemoClaw uses two host-side CLIs. Use `nemohermes` for NemoClaw-managed workflows. Use `openshell` when you need a lower-level OpenShell operation that NemoClaw intentionally exposes. ## Rule of Thumb If the task changes how NemoClaw creates, rebuilds, preserves, or configures a sandbox, start with `nemohermes`. If the task inspects or changes the live OpenShell gateway, TUI, raw policy, port forwarding, inference route, or sandbox file transfer, use `openshell`. Do not create or recreate NemoClaw-managed sandboxes directly with `openshell sandbox create` unless you intend to manage OpenShell yourself. Run `nemohermes onboard` afterward if you need to return to a NemoClaw-managed environment. ## Use `nemohermes` For NemoClaw Workflows Use `nemohermes` for operations where NemoClaw adds product-specific state, safety checks, backup behavior, credential handling, or OpenClaw configuration. * Install, onboard, or recreate a NemoClaw sandbox: ```bash nemohermes onboard nemohermes onboard --resume --recreate-sandbox ``` * List, connect to, check, or delete NemoClaw-managed sandboxes: ```bash nemohermes list nemohermes my-assistant connect nemohermes my-assistant status nemohermes my-assistant logs --follow nemohermes my-assistant destroy ``` * Rebuild or upgrade while preserving workspace state: ```bash nemohermes my-assistant rebuild nemohermes upgrade-sandboxes --check ``` * Snapshot, restore, or mount sandbox state: ```bash nemohermes my-assistant snapshot create --name before-change nemohermes my-assistant snapshot restore before-change nemohermes my-assistant share mount ``` * Add or remove NemoClaw policy presets: ```bash nemohermes my-assistant policy-add pypi --yes nemohermes my-assistant policy-list nemohermes my-assistant policy-remove pypi --yes ``` * Manage NemoClaw messaging channels, credentials, diagnostics, and cleanup: ```bash nemohermes my-assistant channels add slack nemohermes credentials list nemohermes credentials reset nvidia-prod nemohermes debug --sandbox my-assistant nemohermes gc --dry-run ``` ## Use `openshell` For OpenShell Operations Use `openshell` when the docs explicitly call for a live OpenShell gateway operation or when you need a lower-level view beneath the NemoClaw wrapper. * Open the OpenShell TUI for network approvals and live activity: ```bash openshell term ``` * Manage dashboard or service port forwards: ```bash openshell forward start --background openshell forward list ``` * Inspect the underlying sandbox state: ```bash openshell sandbox list openshell sandbox get openshell logs -n 20 openshell doctor check ``` * Move files, or run raw one-off commands when you intentionally want to bypass NemoClaw's sandbox registry and wrappers: ```bash openshell sandbox upload ./local-file /sandbox/ openshell sandbox download /sandbox/output ./output openshell sandbox exec -n -- env | grep '^HOME=' ``` * Inspect or replace raw OpenShell policy: ```bash openshell policy get --full > live-policy.yaml openshell policy update --add-endpoint api.example.com:443:read-only:rest:enforce openshell policy set --policy live-policy.yaml ``` `openshell policy update` merges specific endpoint and rule changes into the live sandbox policy. `openshell policy set` replaces the live policy with the file you provide. For normal NemoClaw network access changes, prefer `nemohermes policy-add` so NemoClaw preserves presets and records the change for rebuilds. ## Common Decisions This section covers common decisions when using the NemoClaw CLI and the OpenShell CLI. ### First Setup or Full Recreate Use `nemohermes onboard`. It starts the OpenShell gateway when needed, registers providers, builds the OpenClaw sandbox image, applies NemoClaw policy choices, and creates the sandbox. Avoid running `openshell gateway start --recreate` or `openshell sandbox create` directly for NemoClaw-managed sandboxes. Those commands do not update NemoClaw's registry, session metadata, workspace-preservation flow, or OpenClaw-specific configuration. ### Connect to the Sandbox Use `nemohermes connect` for an interactive NemoClaw sandbox shell. It waits for readiness, handles stale SSH host keys after gateway restarts, and prints agent-specific hints. Use `openshell sandbox connect ` only when you intentionally want the raw OpenShell connection path. For a one-off command in a NemoClaw-managed sandbox, use `nemohermes exec` instead of opening an interactive shell. It resolves the sandbox by its NemoClaw registry name and runs through the standard NemoClaw CLI surface. The command executes as the sandbox user with `HOME=/sandbox` inside the provisioned sandbox, where the agent configuration, inference routing, and policy state are already in place. ```bash nemohermes my-assistant exec -- cat /tmp/gateway.log ``` Use `openshell sandbox exec` for the raw OpenShell execution path, for example when addressing a sandbox by its gateway name or intentionally bypassing the NemoClaw CLI and registry. ```bash openshell sandbox exec -n my-assistant -- cat /tmp/gateway.log ``` ### Check Health or Logs Use `nemohermes status` and `nemohermes logs` first. They combine NemoClaw registry data, OpenShell state, OpenClaw process health, inference health, policy details, and messaging-channel warnings. Use `openshell sandbox list`, `openshell sandbox get`, `openshell logs -n 20`, or `openshell doctor check` when debugging lower-level OpenShell behavior. When using `openshell logs` directly, `-n ` controls the line count; use `--tail` only when you want live OpenShell log streaming. ### Approve Blocked Network Requests Use `openshell term`. The OpenShell TUI owns live network activity and operator approval prompts. Approved endpoints are session-scoped unless you also add them to the policy through a NemoClaw preset or raw OpenShell policy update. ### Change Models or Providers Use the NemoClaw commands for model or provider inspection and switches so the OpenShell route and the running agent config stay consistent: ```bash nemohermes inference get nemohermes inference set --provider nvidia-prod --model nvidia/nemotron-3-super-120b-a12b ``` For Hermes sandboxes, use the alias; it updates the route and `/sandbox/.hermes/config.yaml` without a rebuild or restart: ```bash nemohermes inference set --provider hermes-provider --model openai/gpt-5.4-mini ``` For a build-time agent setting change, rerun onboarding so the sandbox configuration is recreated consistently: ```bash nemohermes onboard --resume --recreate-sandbox ``` Verify either path with: ```bash nemohermes status ``` ### Update Network Policy Use `nemohermes policy-add` or `policy-remove` for NemoClaw presets and custom preset files. NemoClaw merges the new policy with the live policy and reapplies presets during rebuilds. Use `openshell policy update` for precise live endpoint or REST rule changes. Use `openshell policy get --full` and `openshell policy set` only when you need to edit and replace the raw policy file. ### Move Workspace Files Use `nemohermes snapshot create`, `snapshot restore`, or `share mount` for normal workspace preservation and editing. Use `openshell sandbox upload` and `openshell sandbox download` for manual file copies when you need exact control over source and destination paths. ## Related Topics * [Commands](commands) for the full NemoClaw command reference. * [Manage Sandbox Lifecycle](../manage-sandboxes/lifecycle) for day-two operations. * [Switch Inference Models](../inference/switch-inference-providers) for inference route examples. * [Customize the Network Policy](../network-policy/customize-network-policy) for persistent network access changes. * [Approve or Deny Network Requests](../network-policy/approve-network-requests) for the OpenShell TUI approval flow.