NemoClaw v0.0.74 is out

[ericksoa]

NemoClaw v0.0.74 strengthens the boundary between agents, sandboxes, credentials, and the network. Stable OpenShell 0.0.72, native managed MCP lifecycle, progressive tool disclosure, and tighter LangChain Deep Agents Code controls give OpenClaw, Hermes, and the experimental terminal agent a more consistent and defensible runtime foundation.

Day-to-day workflows are more resilient as well. Onboarding can recover from transient sandbox states, BuildKit and validated image reuse reduce repeat work, messaging configuration survives rebuilds more faithfully, and recovery commands provide clearer ways out when gateways, policies, DNS, credentials, or retained state get in the way.

The release also invests in the path from a fresh checkout to trustworthy evidence. Contributors gain one-command setup, faster diff-scoped verification, and an agent-runnable value benchmark, while the release carries clearer operational documentation and exact-SHA validation across the full E2E surface.

OpenShell, MCP, Tool Disclosure, and Inference

• #6020 pins supported installs and policy handling to OpenShell 0.0.72, including verified artifacts and round-trippable base-policy state. This gives the release one stable, auditable OpenShell contract while preserving MCP and JSON-RPC policy fields during mutation.
• #5876 adds OpenShell-managed MCP add, list, status, restart, and remove flows for OpenClaw, Hermes, and LangChain Deep Agents Code. Authenticated HTTPS Streamable HTTP traffic stays on the native OpenShell policy and credential-replacement path, without a secret-bearing NemoClaw host proxy.
• #6251 makes progressive tool disclosure the default across all three agents while retaining an explicit direct mode. Large tool catalogs remain discoverable without placing every tool in every model turn, and the selected mode survives resume and transactional rebuilds.
• #5989 adds sandbox-first inference get and inference set commands. Namespaced agent workflows now reach the same route controls as the global inference commands without switching command grammar.

LangChain Deep Agents Code Runtime and Lifecycle

• #6082 hardens the managed LangChain Deep Agents Code runtime boundary and blocks unmanaged update, credential-store, tracing, and mutation paths. The wrapper and direct-module entry points now preserve the same NemoClaw-managed security posture.
• #6214 validates the recorded gateway, inference route, managed image, and staged recreation inputs before deleting a Ready LangChain Deep Agents Code sandbox. A healthy runtime is no longer destroyed when its replacement cannot be proven viable.
• #6215 separates snapshot-probe streams and requires one fresh marker with one valid state. Framed, duplicated, ambiguous, or injected terminal output can no longer falsely prove that a LangChain Deep Agents Code session is idle.
• #6219 stops inherited LangSmith tracing and project variables from entering the sandbox-readable runtime shell environment. This removes an unnecessary persistence path for credential-shaped and user-specific tracing state.
• #6230 enforces the manifest-declared terminal-agent version during fresh and resumed onboarding. Stale or unverifiable runtimes cannot be recorded as Ready.
• #6232 adds managed status, whoami, and identity commands without launching the interactive UI. Operators and automation can inspect the current sandbox through the supported runtime boundary.
• #6260 hardens the managed MCP rebuild handoff by revalidating reconstructable inputs, exact policy intent, staged context, and runtime state before deletion. It also restores managed MCP state after recreation and keeps malformed or drifted state fail-closed.

Onboarding, Images, and Platform Recovery

• #6130 honors installer restore intent when a pre-existing sandbox is not Ready. Upgrade-driven onboarding can recreate from the validated pre-upgrade backup instead of stopping before recovery.
• #6150 distinguishes an unreachable container DNS server from one returning NXDOMAIN or REFUSED. Users now receive remediation that matches the actual resolver failure instead of one generic networking diagnosis.
• #6164 tolerates a bounded sequence of transient OpenShell Error observations while preserving immediate failure for terminal states. Recoverable DGX Spark startup races no longer abort onboarding prematurely.
• #6166 prebuilds eligible local sandbox images with asynchronous BuildKit and bounded progress heartbeats. Onboarding can reuse work and remain visibly active during long build phases without silently hanging.
• #6234 marks the Windows-on-Arm N1X integrated GPU as compute-constrained. Automatic Ollama setup now selects qwen3.5:9b instead of starter models that cannot answer within the agent timeout on that hardware.
• #6254 reuses locally validated sandbox base-image resolutions across warm onboarding and rebuilds. Digest, platform, ABI, local-image identity, and refresh checks keep the speedup behind the existing trust boundary.
• #6265 validates staged BuildKit contexts before host execution and falls back safely when provenance or filesystem checks fail. Generated and custom Dockerfiles remain on their intended builder boundary rather than turning prebuild optimization into a trust shortcut.

Messaging, Credentials, and Tunnels

• #5573 lets credential reset detach an attached provider and retry deletion, with concrete guidance if attachments remain. Users can clear a stuck provider without destroying and recreating the sandbox.
• #5955 detects shared messaging-credential conflicts before backup or deletion begins. An invalid rebuild now leaves the original sandbox intact instead of discovering the conflict after destructive work.
• #5987 persists policy presets for every enabled messaging channel, not only channels whose policy is required at initial creation. Live gateway policy and registry state remain aligned through onboarding and rebuilds.
• #5988 makes legacy stop release its managed gateway port without disrupting another registered sandbox that shares the gateway. Tunnel and restart workflows can reuse the port without unsafe host-wide cleanup.
• #6129 moves messaging network policies into their channel packages and keeps resolution manifest-driven. Channel ownership is clearer and central endpoint duplication no longer drifts from packaged behavior.
• #6220 reports Telegram's effective group mention mode in channels status. Operators can inspect the rendered runtime behavior without opening or comparing raw configuration files.
• #6235 registers each exact quick-tunnel origin in OpenClaw's allowed-origin configuration and prunes stale entries. The tunneled Web UI works without wildcard access or manual edits.
• #6241 recognizes a configured WhatsApp allowlist during initial non-interactive setup. The channel can be selected from WHATSAPP_ALLOWED_IDS without an extra add-and-rebuild cycle.

Day-Two CLI, Installation, and Recovery

• #5963 adds update --fresh, allowing a clean reinstall of the maintained build even when the reported version is current. Source checkouts remain protected from the destructive installer path.
• #5986 makes user errors and startup failures return a nonzero exit code even when they carry an incorrect oclif exit marker. Shell scripts and CI can once again distinguish failure from graceful help or exit.
• #6050 lets destroy --force perform bounded local cleanup when the OpenShell gateway is unreachable. The command warns that gateway-side sandbox and retained-volume state may still exist, preserving an honest recovery boundary.
• #6084 installs user-local shims for every packaged CLI alias. Normal source installation now restores nemohermes and nemo-deepagents alongside the primary command.
• #6101 removes installer-managed agent alias shims during uninstall while preserving unrelated files with the same names. Clean removal is complete without deleting foreign commands.
• #6181 restores 127.0.0.1 as the primary WSL2 dashboard URL while retaining the WSL host address as an explicit fallback. The generated link now follows the path that works for most Windows users.
• #6238 appends a sanitized recent policy-denial breadcrumb after failed sandbox commands. An opaque proxy failure can point to the denied host and port without changing child output, exit status, or exposing raw audit-log content.

Contributor Experience and Benchmarks

• #5649 adds an agent-runnable value benchmark with machine-readable and Markdown reports for inference latency and trace-backed sandbox startup. Contributors get comparable measurements without presenting advisory timings as a release gate or claiming unsupported policy-overhead data.
• #6168 makes the developer doctor accept only supported Git signing formats and reject empty or invalid values. Contributors can catch signing misconfiguration before their first commit or pull request.
• #6200 adds idempotent one-command contributor setup, repair, read-only readiness checks, and machine-readable doctor output. New contributors have one supported path from a checkout to a working development environment.
• #6248 prevents the package prepare hook from pruning development dependencies during contributor installation and fills missing uv and global-bin setup guidance. A normal npm install now leaves the checkout ready for development.
• #6270 moves full coverage out of routine hooks, adds incremental pre-push checks and npm run check:diff, and retains full CI coverage gates. Local verification is faster while the authoritative repository-wide checks remain intact.

Thank you

Thank you to external contributors @abhi-0906 for the agent-runnable value benchmark in #5649, @mdrxy for hardening the managed LangChain Deep Agents Code runtime in #6082, and @WilliamK112 for restoring packaged CLI alias shims in #6084.

Compare the full release range: v0.0.73...v0.0.74.