Merge remote-tracking branch 'origin/main' into fix/agent-timeout-enforcement

Signed-off-by: Hung Le <hple@nvidia.com>

# Conflicts:
#	src/lib/actions/sandbox/agent/passthrough-dispatch.test.ts
#	src/lib/actions/sandbox/agent/passthrough-dispatch.ts
#	src/lib/actions/sandbox/agent/passthrough-json.test.ts
#	src/lib/actions/sandbox/agent/passthrough-json.ts
#	src/lib/actions/sandbox/agent/passthrough.test.ts
#	src/lib/actions/sandbox/agent/passthrough.ts

Author: hunglp6d

.github/workflows/base-image.yaml

@@ -68,6 +68,7 @@ on:
       - "scripts/lib/reviewed-npm-audit.mts"
       - "scripts/security/build-native-security-packages.sh"
       - "scripts/security/build-perl-security-packages.sh"
+      - "scripts/security/patches/perl-5.44.0-net-ping-capability-tests.patch"
       - "scripts/security/patches/libssh2-1.11.1-cve-2026.patch"
       - "scripts/security/patches/python3.13-htmlparser-cve-2026-15308.patch"
       - "scripts/patch-bundled-npm-brace-expansion.mts"

Dockerfile.base

@@ -88,6 +88,7 @@ ARG PERL_SHA256
 ARG PERL_PACKAGE_REVISION
 
 COPY scripts/security/build-perl-security-packages.sh /scripts/security/build-perl-security-packages.sh
+COPY scripts/security/patches/perl-5.44.0-net-ping-capability-tests.patch /scripts/security/patches/perl-5.44.0-net-ping-capability-tests.patch
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         netbase=6.5 \

agents/hermes/Dockerfile.base

@@ -49,6 +49,7 @@ ARG PERL_SHA256
 ARG PERL_PACKAGE_REVISION
 
 COPY scripts/security/build-perl-security-packages.sh /scripts/security/build-perl-security-packages.sh
+COPY scripts/security/patches/perl-5.44.0-net-ping-capability-tests.patch /scripts/security/patches/perl-5.44.0-net-ping-capability-tests.patch
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         netbase=6.5 \

agents/hermes/runtime-config-guard.py

@@ -4754,17 +4754,17 @@ def _is_generated_api_server_key(value: str) -> bool:
 def _placeholder_suffix_matches_env_key(suffix: str, env_key: str) -> bool:
     if suffix == env_key:
         return True
-    revision_match = re.fullmatch(r"v[0-9]+_(.+)", suffix)
+    revision_match = re.fullmatch(r"v[0-9]{1,20}_(.+)", suffix)
     return revision_match is not None and revision_match.group(1) == env_key
 
 
-def _normalize_provider_placeholder_for_env_key(value: str, env_key: str) -> str | None:
+def _provider_placeholder_for_env_key(value: str, env_key: str) -> str | None:
     if not value.startswith(SCOPED_PLACEHOLDER_PREFIX):
         return None
     suffix = value[len(SCOPED_PLACEHOLDER_PREFIX) :]
     if not _placeholder_suffix_matches_env_key(suffix, env_key):
         return None
-    return f"{SCOPED_PLACEHOLDER_PREFIX}{env_key}"
+    return value
 
 
 def _has_env_control_chars(value: str) -> bool:
@@ -4914,7 +4914,12 @@ def _runtime_plan_replacements_and_provider_keys(
             raise UnsafePathError(
                 f"messaging runtime plan env alias regex is invalid: {exc}"
             ) from exc
-        if compiled.search(os.environ.get(env_key, "")):
+        runtime_value = os.environ.get(env_key, "")
+        if runtime_value.startswith(SCOPED_PLACEHOLDER_PREFIX):
+            suffix = runtime_value[len(SCOPED_PLACEHOLDER_PREFIX) :]
+            if not _placeholder_suffix_matches_env_key(suffix, env_key):
+                continue
+        if compiled.search(runtime_value):
             replacements[env_key] = (value, message)
     return replacements, provider_env_keys, True
 
@@ -4971,11 +4976,11 @@ def provider_placeholders(
     for key in allowed_fallback_keys:
         if key in replacements:
             continue
-        normalized = _normalize_provider_placeholder_for_env_key(
+        placeholder = _provider_placeholder_for_env_key(
             os.environ.get(key, ""), key
         )
-        if normalized:
-            replacements[key] = (normalized, "")
+        if placeholder:
+            replacements[key] = (placeholder, "")
     if not replacements:
         return
 

agents/langchain-deepagents-code/Dockerfile.base

@@ -53,6 +53,7 @@ ARG PERL_SHA256
 ARG PERL_PACKAGE_REVISION
 
 COPY scripts/security/build-perl-security-packages.sh /scripts/security/build-perl-security-packages.sh
+COPY scripts/security/patches/perl-5.44.0-net-ping-capability-tests.patch /scripts/security/patches/perl-5.44.0-net-ping-capability-tests.patch
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
         netbase=6.5 \

ci/platform-matrix.json

@@ -253,7 +253,7 @@
     {
       "name": "Podman / other container runtimes",
       "status": "unsupported",
-      "notes": "Onboard surfaces an explicit unsupported-runtime error for Podman (`src/lib/onboard/fatal-runtime-preflight.ts` prints the rejection; `src/lib/onboard/preflight.ts` flags the unsupported runtime upstream). Only Docker Engine, Docker Desktop, and Colima are supported. See issue #420 (closed)."
+      "notes": "Standard onboarding surfaces an explicit unsupported-runtime error for Podman (`src/lib/onboard/fatal-runtime-preflight.ts` prints the rejection; `src/lib/onboard/preflight.ts` flags the unsupported runtime upstream). The explicit portable experimental profile has one installer-preflight admission exception for the Podman unsupported-runtime finding, as accepted in issue #9007. It does not waive any other readiness blocker or make Podman generally supported. Only Docker Engine, Docker Desktop, and Colima are supported. See issue #420 (closed)."
     },
     {
       "name": "Intel Mac (macOS x86_64)",

docs/changelog/2026-08-12.mdx

@@ -9,8 +9,11 @@ NemoClaw v0.0.108 adds read-only host mounts and an Experimental Muse Glimmer pr
 It improves onboarding recovery, messaging credential rotation, inference validation, MCP registration, snapshots, and Hermes configuration.
 It also strengthens managed images, gateway credentials, runtime state, and release qualification.
 
-- On Linux and Windows Subsystem for Linux 2 (WSL2), `nemoclaw onboard` and `nemoclaw <sandbox> rebuild` can now mount an existing host directory read-only beneath `/sandbox` with `--host-mount`.
-  NemoClaw validates each source, destination, and symlink boundary before mutation, persists accepted mounts for `rebuild` and interrupted `onboard --resume`, removes their declaration during `destroy`, and reports them in sandbox status.
+- On Linux and Windows Subsystem for Linux 2 (WSL2), `nemoclaw onboard --host-mount <host:/sandbox/path>` can now expose an existing host directory read-only beneath `/sandbox`.
+  NemoClaw validates each source, destination, and symlink boundary before mutation.
+  It persists accepted mounts across `nemoclaw <sandbox> rebuild` and interrupted onboarding resumed with `nemoclaw onboard --resume`.
+  The `nemoclaw <sandbox> destroy` command removes their declaration.
+  The `nemoclaw <sandbox> status` command reports them.
   For more information, refer to [Understand Sandbox State](/user-guide/openclaw/manage-sandboxes/state-and-backups/understand-sandbox-state) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
   Related change: [PR #8280](https://github.com/NVIDIA/NemoClaw/pull/8280).
 - The explicit-only Experimental Muse Glimmer managed vLLM profile now runs on one DGX Spark with its validated checkpoint, ARM64 image, parser settings, and resource limits.

docs/inference/set-up-vllm.mdx

@@ -295,7 +295,9 @@ Two behaviors surprise direct callers of the managed vLLM endpoint; the OpenClaw
 
 - **Read reasoning from `reasoning`, not `reasoning_content`.**
   The pinned vLLM runtime renamed the deprecated `reasoning_content` response field to `reasoning`, so `choices[].message.reasoning_content` is `null` even for prompts that reasoned heavily.
-  The reasoning is not discarded — read `choices[].message.reasoning` (and the `delta.reasoning` field when streaming).
+  The reasoning is not discarded.
+  Read non-streaming reasoning from `choices[].message.reasoning`.
+  For streaming responses, read `choices[].delta.reasoning`.
 - **Send a generous `max_tokens` (at least `1024`, and more for hard prompts).**
   The reasoning trace counts against `max_tokens`.
   With a modest budget the model can spend the entire budget on reasoning before it reaches the answer, returning an empty `content` with `finish_reason=length`.

docs/manage-sandboxes/uninstall-nemoclaw.mdx

@@ -115,6 +115,13 @@ Rerun `NEMOCLAW_GATEWAY_PORT=<port> $$nemoclaw uninstall` with the gateway port
 For an externally supervised authority, uninstall preserves the local gateway state used by the running process in both full and gateway-scoped cleanup.
 It also preserves the gateway process, supervisor resources, marked Linux unit, Docker resources, OpenShell binaries, and the declared external state directory.
 A custom-port uninstall does not stop or remove the default gateway service or its environment file.
+Uninstall does not stop an `openshell-gateway` process that another non-root user owns and that this installation did not record.
+It names the owner and process ID, leaves that process running, and continues with the remaining cleanup.
+If no other cleanup fails, uninstall exits with status `0` even though that process can keep its port in use.
+Uninstall still tries to stop a `root`-owned process and the gateway process that this installation recorded.
+If either of those stops fails, uninstall prints `sudo kill -9 <pid>` for the process.
+A gateway-scoped uninstall and every `--all-gateway-ports` pass exit nonzero after that failure.
+A single full uninstall reports the process and continues.
 Before scoped cleanup stops a Docker gateway process, including a managed default gateway service, NemoClaw requires two Docker namespace proofs.
 The selected Docker gateway configuration and any running gateway process must use the state-root-specific OpenShell sandbox namespace that NemoClaw generated.
 Because the supported OpenShell Podman schema does not expose `sandbox_namespace`, scoped Podman uninstall fails closed before signaling and preserves the gateway runtime evidence and local state.

docs/manage-sandboxes/update-sandboxes.mdx

@@ -38,6 +38,10 @@ The `langchain-deepagents-code` agent manifest declares the expected Deep Agents
 
 </AgentOnly>
 
+## Use the Automatic Upgrade Path
+
+Run the maintained installer to update the host CLI and reconcile registered sandboxes.
+
 <Warning>
 OpenShell 0.0.101 limits a routed sandbox name to 19 characters and rejects consecutive hyphens.
 A NemoClaw sandbox name must contain 1 to 19 characters.
@@ -84,12 +88,24 @@ After the automatic path retires an out-of-range gateway, it forces installation
 This mandatory installation applies to source and managed install modes and cannot remain deferred after gateway retirement.
 If the forced installation fails, the installer does not stage a gateway service or start sandbox recovery, preserves the backups, and reports how to retry.
 
-For any registered-sandbox upgrade that you already prepared manually, set `NEMOCLAW_OPENSHELL_UPGRADE_PREPARED=1` only after you back up every registered sandbox and retire the gateway.
-This environment variable asserts that you completed those steps, so the installer skips the repeated backup and gateway-retirement phase before it checks whether OpenShell is installed or whether its version is in range.
+## Resume a Manually Prepared Upgrade
+
+Use this path only after you back up every registered sandbox and retire the gateway.
+Set `NEMOCLAW_GATEWAY_PORT` to the port for the gateway that you retired.
+Set `NEMOCLAW_OPENSHELL_UPGRADE_PREPARED=1` on the `bash` side of the install pipeline when you rerun the installer.
+
+```bash
+curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_GATEWAY_PORT=<selected-port> NEMOCLAW_OPENSHELL_UPGRADE_PREPARED=1 bash
+```
+
+You can omit `NEMOCLAW_GATEWAY_PORT` when you prepared the default gateway on port `8080`.
+`NEMOCLAW_OPENSHELL_UPGRADE_PREPARED` asserts that you completed those steps, so the installer skips the repeated backup and gateway-retirement phase before it checks whether OpenShell is installed or whether its version is in range.
 It reuses the latest backups, forces installation of the OpenShell version pinned by the prepared source, and starts recovery only after that installation succeeds.
-If the forced installation fails, rerun the installer with `NEMOCLAW_OPENSHELL_UPGRADE_PREPARED=1` to reuse the prepared state and retry the OpenShell installation.
+If the installation fails, rerun the same install-pipeline command to preserve `NEMOCLAW_GATEWAY_PORT` and `NEMOCLAW_OPENSHELL_UPGRADE_PREPARED`.
 Outside these forced paths, an in-range source checkout preserves an existing OpenShell installation and installs OpenShell only when it is missing.
 
+## Reconcile Registered Sandboxes
+
 After the host CLI and OpenShell update, the installer runs `$$nemoclaw upgrade-sandboxes --auto` to reconcile the existing sandboxes.
 
 During installer-driven recovery, each stale or non-Ready sandbox requires a validated latest backup.
@@ -121,7 +137,9 @@ This usually means a prior uninstall removed the gateway and Docker image while
 
 The installer finishes with `Installation completed with warnings` and tells you to run `$$nemoclaw <name> destroy`, then `$$nemoclaw onboard`, instead of claiming recovery succeeded.
 
-For a manual update flow, create a snapshot first:
+### Use the Manual Update Flow
+
+Create a snapshot before a manual update.
 
 ```bash
 $$nemoclaw <sandbox-name> snapshot create --name pre-upgrade