Understand Gateway and Secret Controls

NemoClaw applies gateway access controls when the selected agent runtime exposes an in-sandbox gateway or dashboard. CLI secret redaction and runtime-specific memory guidance apply across guide variants.

OpenShell Gateway Authentication

On Docker-driver deployments, NemoClaw gives host CLI calls and sandbox callbacks separate authenticated paths to the OpenShell gateway.

Aspect	Detail
Default	NemoClaw enables local TLS, mTLS user authentication, and sandbox JWT authentication. Host-side OpenShell CLI calls use local mTLS. Sandbox callbacks use the guest mTLS bundle plus a sandbox-scoped JWT. The generated config sets `allow_unauthenticated_users = false`, and gateway launch removes an inherited `OPENSHELL_DISABLE_GATEWAY_AUTH=true`.
Supervisor TLS name	OpenShell 0.0.116 removes a user-supplied `OPENSHELL_GATEWAY_TLS_SERVER_NAME` from Docker, Podman, and VM supervisor environments after it merges sandbox settings. The supervisor therefore verifies the gateway name chosen by the trusted driver rather than one chosen inside the sandbox specification.
Token lifetime	Local sandbox JWTs use OpenShell’s `ttl_secs = 0` contract for a non-expiring token on a local single-user gateway. Sandbox identity checks and the local mTLS boundary still apply to each callback.
What you can change	These authentication controls are not user-facing settings. Use NemoClaw to configure and start the Docker-driver gateway.
Risk if relaxed	Disabling gateway authentication or widening the gateway listener can expose privileged gateway methods to another local or network client.
Recommendation	Keep the OpenShell gateway on `127.0.0.1`. Use the dashboard forward when a supported agent dashboard needs remote access.

Gateway Compatibility Container

On Linux hosts whose glibc is older than the OpenShell gateway binary requires, NemoClaw can run openshell-gateway in a Docker compatibility container so the Docker-driver gateway still starts. This path requires the explicit opt-in NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH=1.

Aspect	Detail
Default	NemoClaw does not auto-enable the compatibility container on ABI mismatch. If `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH=1` is set, the container keeps the main gateway listener on `127.0.0.1`, uses host networking so OpenShell computes the same Docker bridge callback addresses as a host-side gateway, mounts the Docker socket read-only, drops Linux capabilities, sets `no-new-privileges`, and publishes no extra Docker ports.
What you can change	Opt in with `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH=1`, keep the path disabled with `NEMOCLAW_OPENSHELL_GATEWAY_CONTAINER_PATCH=0`, or run on a host/OpenShell build combination where the gateway binary launches directly.
Risk if relaxed	The Docker socket remains a privileged host API even when bind-mounted read-only. Treat this mode as equivalent to trusting the host user that can drive Docker, and do not enable it on untrusted shared hosts.
Recommendation	Prefer a host with glibc 2.39 or newer, which OpenShell 0.0.116 supports directly, and use the compatibility container only as an explicit local bridge on an older trusted host.

OpenShell owns the native Linux glibc support floor. NemoClaw owns the explicit opt-in, host-networking configuration, read-only socket mount, and gateway authentication controls for this fallback. Remove the fallback when every supported Linux host meets OpenShell’s native floor and the gateway authentication and upgrade tests pass for the release candidate without the flag.

Hermes exposes an OpenAI-compatible API and can optionally expose the native Hermes dashboard. New and successfully migrated API forwards bind to 127.0.0.1, including after restart and on WSL. NEMOCLAW_DASHBOARD_BIND=0.0.0.0 changes only the dashboard bind. If NemoClaw cannot prove ownership of a legacy wildcard forward, it refuses migration and leaves that listener unchanged. A missing or different gateway endpoint in the listener’s process command also prevents migration. The old listener can remain remotely reachable. Run nemohermes <name> status and nemohermes <name> recover, then follow any refusal diagnostic. Do not assume loopback isolation until recovery succeeds. For remote API access, use the SSH forwarding procedure. Protect any remotely exposed dashboard with your own access controls.

NemoClaw keeps provider credentials in OpenShell. NVIDIA Endpoints and supported fixed hosted providers use native endpoints through sandbox-attached OpenShell providers. New Ollama, standalone vLLM, llama.cpp, and qualifying host-local compatible selections also use sandbox-attached providers and scoped credential references. Owned Local NVIDIA NIM, nonqualifying custom endpoints, and retained legacy shared routes continue to use inference.local. Live qualification of the Hermes native local lifecycle is pending. Generated Hermes runtime files use OpenShell resolver placeholders for managed-tool and messaging credentials.

Hermes startup rejects raw secret-shaped values in sandbox-visible environment or config fields, while allowing empty values, migration sentinels, OpenShell resolver placeholders, and expected Slack placeholder forms.

CLI Secret Redaction

The CLI automatically redacts secret patterns (API keys, bearer tokens, provider credentials) from command output and error messages before logging them.

Aspect	Detail
Default	Enabled. The runner redacts secrets from stdout, stderr, and thrown error messages.
What you can change	This is not a user-facing knob. The CLI enforces it on all command output paths.
Risk if relaxed	Without redaction, secrets could appear in terminal scrollback, log files, or debug output shared in bug reports.
Recommendation	No action needed. If you share NemoClaw debug output, verify that no secrets appear in the collected diagnostics.

Memory Secret Scanner

Hermes does not use the OpenClaw NemoClaw plugin memory scanner. Keep secrets in environment variables or OpenShell providers, and avoid writing raw credentials to Hermes state files or workspace content.