NemoClaw v0.0.72 has shipped

[ericksoa]

NemoClaw v0.0.72 puts recovery ahead of replacement. The installer can now assess and recover eligible non-Ready sandboxes before generic onboarding, OpenClaw gateways respawn after watchdog-initiated termination, and mutable configuration permissions are repaired after one-shot commands. These paths retain identity, image-provenance, and rollback checks so recovery remains fail-closed when the evidence is ambiguous.

Day-two operations are clearer and safer across the CLI, inference, and messaging surfaces. Operators can register provider credentials directly, inspect non-secret rendered channel configuration, distinguish host-wide from sandbox-specific status, and get actionable guidance for unsupported multiline exec arguments and denied network requests. NVIDIA Endpoints selection now follows the public featured-model catalog with a bounded fallback, while credential probes, Hermes output, custom policies, and OpenClaw metadata discovery expose less credential-adjacent state.

The release also strengthens the path from contribution to published documentation and live validation. A read-only developer doctor catches local setup problems earlier, Fern publishing now separates staging from release-tag publication, and the E2E workflow has tighter authentication, permissions, setup, artifact, and platform contracts. Most importantly, the raw-token process probe now avoids matching its own scanner while preserving strict detection of a real token in another process, so a green messaging result is stronger evidence rather than a relaxed assertion.

Installer, Sandbox, and Runtime Recovery

• #6132 runs validated prepared-backup recovery before generic onboarding. It attempts every eligible non-Ready sandbox, requires matching sandbox identity and managed-image provenance, and stops before onboarding if any recovery is blocked or fails, avoiding destructive recovery from ambiguous evidence.
• #6131 distinguishes a watchdog-requested OpenClaw gateway termination from an operator-requested clean exit. PID 1 now respawns a gateway whose listener failed instead of tearing down the sandbox, while identity-scoped markers prevent stale kills from forcing an unwanted restart.
• #6060 restores NemoClaw's mutable OpenClaw permission contract after entrypoint one-shot commands and nemoclaw <name> exec. Descriptor-safe, privilege-separated repair and fail-closed verification keep openclaw doctor --fix from leaving later runtime operations unusable or widening the privilege boundary.
• #6089 compares Hermes agent versions only within the runtime's actual version scheme. This removes false update notices caused by comparing a semver runtime against a calver manifest while retaining real behind-version detection.
• #6127 replaces a Kubernetes-only shields relock hint with driver-neutral staged recovery. Operators are guided to restore sandbox readiness, retry shields up, and rebuild only as an explicit last step, while structural or unsafe failures remain CRITICAL.

CLI, Onboarding, and Messaging Operations

• #5540 clarifies the difference between global nemoclaw status and sandbox-scoped <name> status in help, docs, and text output. Wrong-order invocations now receive an actionable correction without changing JSON behavior.
• #5990 treats prompt stdin EOF as onboarding cancellation instead of silently exiting successfully. Scripted or redirected runs now print a cancellation message and return nonzero, so automation cannot mistake an unanswered prompt for a completed install.
• #5991 rejects newline-containing exec arguments before OpenShell does and points users to supported script and stdin alternatives. The diagnostic identifies the argument position without echoing its contents, preserving both command semantics and accidental-secret safety.
• #6018 adds a once-per-shell breadcrumb for the opaque CONNECT tunnel failed, response 403 signature. It points users to the sandbox logs for the policy decision without wrapping or changing the exit behavior of curl, git, Python, or other tools.
• #6044 makes channels status summarize configured channels and compare safe, non-secret registry inputs with rendered OpenClaw or Hermes configuration. Per-channel parsers surface mismatches without exposing secrets or corrupted raw values.

Inference, Credentials, and Model Selection

• #5969 adds nemoclaw credentials add <provider> --type <type> and a bundled Tavily provider profile. Users can register OpenShell provider credentials through NemoClaw while keeping known credential keys inside the existing sanitization and rotation paths.
• #6023 lists registered providers and an onboarding recovery tip when inference set names a provider that is not registered. The replay preserves the verified work originally contributed by @kagura-agent in #5983, then bounds and redacts subprocess diagnostics so the extra context cannot leak secrets.
• #6069 removes the retiring GLM 5.1 model from NVIDIA Endpoints onboarding and moves direct NVIDIA switch tests to Nemotron 3 Super. The independent Hermes Provider catalog remains unchanged, making the provider boundary and migration path explicit.
• #6074 refreshes the NVIDIA Endpoints picker from NVIDIA's public featured-model catalog once per interactive session. Untrusted catalog text is sanitized and bounded, and malformed or unavailable data falls back to a safe bundled model list rather than blocking onboarding.
• #6095 validates a stored credential before recreating a gateway-missing provider during resumed onboarding. Invalid keys now fail non-interactive recovery or trigger an interactive re-prompt instead of allowing a sandbox to build on an unusable provider.

Policy and Security Boundaries

• #5975 moves inference-probe credentials out of curl process arguments and into temporary mode-0600 curl config files. Defense-in-depth validation rejects inline auth headers and secret-bearing query parameters, closing the /proc and process-list exposure path without weakening probe coverage.
• #5993 masks api_key values in hermes config show across Python-dict, JSON, and YAML output while preserving the underlying command's exit status. Even non-secret proxy sentinels no longer appear in a key-like shape that can be copied or flagged as leaked credentials.
• #6087 validates Hermes endpoint URLs before credentials are dispatched and rejects allowed_ips in user-supplied policy presets. These checks close user-CLI SSRF and private-IP allowlist expansion paths before either reaches OpenShell.
• #6096 makes AWS_EC2_METADATA_DISABLED=true a durable OpenClaw image, startup, child-process, and connected-shell invariant. This removes an impossible metadata credential-discovery path while leaving deliberate AWS credential providers available and keeping the Hermes boundary unchanged.
• #6134 restores Tavily egress for the read-only managed Deep Agents Code Python interpreter in both policy and provider-profile enforcement. System Python and writable project environments remain excluded, so the documented opt-in works without broadening executable trust.

Documentation and Contributor Workflow

• #6109 adds npm run dev:doctor, a read-only check of source checkout, toolchain, dependencies, Git and GitHub setup, Docker resources, hooks, and local CLI linkage. Contributors can catch readiness problems before coding or opening a pull request without mutating their host.
• #6147 fixes release-note links that crossed between OpenClaw and Hermes documentation variants. Readers now land on the guide variant that actually owns each LangChain Deep Agents Code or Hermes page.
• #6148 clarifies that the hosted installer follows the maintained last-known-good release by default. Common install paths no longer suggest stale explicit pins, while override examples stay generic or lkg-based.
• #6151 updates stale Sandbox Hardening links to the canonical manage-sandboxes/sandbox-hardening route. Security and enterprise-readiness guidance now reaches the maintained page instead of a retired deployment path.
• #6152 documents that nemoclaw inference set needs a running, selected sandbox and explains recovery from No sandbox selected. New users get the prerequisite before the first switch command rather than after a preventable failure.
• #6157 publishes merged documentation to a staging Fern instance and release-tag documentation to the public instance. Public publication is protected by a release environment and main-ancestry check, while merged PR previews are cleaned up only after staging succeeds.
• #6162 moves release-note documentation preparation before tag cutting in the contributor workflow. Post-release patch labeling remains a recovery path, reducing the chance that a release ships before its public documentation is ready.
• #6163 adds the v0.0.72 documentation summary and records the custom-preset allowed_ips guard. The public release history now links the major recovery, CLI, inference, policy, and sandbox changes to deeper operational guidance.

CI, E2E, and Release Confidence

• #6100 restores guarded Docker Hub authentication to every image-consuming scheduled and manual-main E2E job. Trusted runs fail closed around credential setup and cleanup, while untrusted refs keep isolated anonymous Docker configuration.
• #6102 retires scheduled GitHub issue mutation from E2E reporting while preserving Actions history, scorecards, Slack notifications, and validated PR comments. Removing general issue-write permission narrows the workflow's authority to the surfaces maintainers still use.
• #6106 hardens that retirement boundary by denying generic API, GraphQL, fetch, and gh api issue-routing surfaces outside the validated PR reporter. The scorecard's fixed Slack webhook remains the only explicit exception.
• #6115 centralizes repeated E2E Node, dependency, and CLI setup behind an immutable same-repository action. It removes hundreds of duplicated workflow lines while preserving all jobs, selectors, runners, permissions, secret scopes, and commands under a content-digest contract.
• #6118 reuses one coverage shard's verified CLI build in the merge job instead of rebuilding it. Current-run provenance and sourcemap checks retain trust while shortening the coverage critical path.
• #6121 centralizes 73 E2E artifact uploads behind an immutable shared action with exact policy and caller validation. Artifact names, paths, conditions, retention, and missing-file behavior remain unchanged while duplicated workflow and validator code is removed.
• #6140 fixes Bash 3.2, locale, fixture, and process-tracking failures in the macOS Vitest lane. Byte-exact locale handling also keeps gateway nonce validation consistent across platforms instead of allowing uppercase values under a locale-dependent range.
• #6146 installs the pinned Node dependencies before Hermes image Vitest runs on clean workers. A workflow contract test locks in the ordering so vitest/config cannot disappear again through runner state differences.
• #6167 replaces external raw-token process matching in the messaging-provider and Hermes Discord E2Es with a shared shell-builtin scanner. It excludes only its own scanner PID, still fails on a literal token in any other readable command line, and emits no token or command text, eliminating self-match flakes without hiding a product leak.

Thank you

Thank you to external contributors @HwangJohn for the clearer status-command experience in #5540, @HOYALIM for the safer live NVIDIA Endpoints catalog integration in #6074, and @kagura-agent for the original provider-not-found diagnostics in #5983, preserved and hardened in #6023.

Compare the full release range: v0.0.71...v0.0.72.