NemoClaw v0.0.77 is out

[ericksoa]

NemoClaw v0.0.77 is a focused hardening release for LangChain Deep Agents Code. It restores release-pipeline integrity by publishing the current multi-architecture sandbox base image, validating the installed Deep Agents Code version against the managed manifest, and rejecting stale image inputs before final-image construction.

The release also reduces accidental data exposure and makes the managed runtime easier to understand. Credential-shaped values receive a best-effort redaction pass before OTLP trace export, and the TUI now reports the upstream provider selected during NemoClaw onboarding while preserving the OpenAI-compatible wire adapter.

Guided setup is more deterministic as well. The starter prompt now reuses a checked-in, loopback-only credential form instead of asking a coding agent to generate credential-capture HTML. The complete source range is available in the v0.0.76...v0.0.77 comparison.

Deep Agents Runtime and Packaging

• #6469 adds guarded multi-architecture publication for the LangChain Deep Agents Code sandbox base image and binds base-image resolution to the agent manifest and dependency lock. Published, cached, or overridden images with the wrong installed version are rejected, preventing an obsolete base from being reused silently.

Observability and Credential Safety

• #6460 adds bounded, best-effort scrubbing for recognized credential-shaped values in managed Deep Agents Code OTLP spans. API keys, bearer tokens, private-key blocks, and related patterns are replaced before export, reducing accidental disclosure while preserving the requirement for upstream controls and collector-side redaction of unrecognized sensitive content.

Provider Identity

• #6462 shows the onboarding-selected upstream provider in the Deep Agents Code status bar, launch banner, and model-identity prompt. Operators see the provider they selected instead of the internal openai adapter name, while inference routing and credential handling remain unchanged.

Guided Setup and Documentation

• #6423 gives the starter prompt a checked-in local credential form with loopback-only submission, a restrictive content security policy, redacted confirmation output, and no external resources. Coding agents can follow one reviewed credential-capture path instead of generating variable HTML or asking users to paste secrets into chat.