NemoClaw v0.0.78 is out

[cjagwani]

NemoClaw v0.0.78 expands what managed LangChain Deep Agents Code can do without turning broader capability into ambient authority. Thread-scoped auto-approval remains disabled by default and resets across process, thread, and agent transitions; repository reads through fetch_url stay inside NemoClaw's managed policy proxy; and the supported Nemotron Ultra profile preserves valid tool-call content while rejecting the observed execution placeholder before dispatch.

Reliability work extends from inference health into lifecycle recovery. status, doctor, and connect now treat the agent-visible inference route as authoritative, compatible endpoints carry their model context into Hermes, and local Ollama flows verify newly pulled models and warm them after daemon restarts. Rebuild and recreation also handle unreachable sandboxes, prepared MCP cleanup, incomplete custom images, image-owned plugin state, and legacy OpenClaw backups more deliberately while preserving user-owned state.

Operators and maintainers get clearer evidence at every layer. Policy state can be exported as validated, round-trippable YAML; automation-facing stdout remains parseable; local credential capture follows a pinned, authenticated helper path; and live validation now covers session-scoped TUI correlation, legacy upgrades, and managed-exec egress denial. The complete source range contains 53 merged changes in the v0.0.77...v0.0.78 comparison.

Sandbox, Rebuild, and Policy Recovery

• #3787 makes workspace-template seeding survive shell-function serialization, preventing startup failures when default bootstrap is skipped.
• #6068 routes recovery warnings through a gateway-log helper that refuses unsafe targets and adds regression coverage for explicit model overrides, preventing unsafe log writes while locking in reconciliation behavior.
• #6122 adds validated, round-trippable policy-get YAML with a diagnostic raw mode, making policy review and reapplication safer.
• #6211 lets an explicit rebuild --force skip backup when a crashed container is unreachable, providing a clearly warned recovery path instead of a dead end.
• #6320 moves gateway recovery to deadline-based polling with visible attempt budgets, making readiness timing deterministic and failures actionable.
• #6377 surfaces redacted MCP destroy diagnostics and gives prepared-only transactions a guarded mcp remove --force recovery path, preventing rebuild from crossing ambiguous destructive state.
• #6490 detects incomplete custom OpenClaw images and reconciles image-owned plugin provenance while preserving user state, avoiding invalid runtimes and stale plugin configuration.
• #6534 restores legacy and stock OpenClaw backups without prior provenance while keeping custom-image checks fail closed, preserving upgrade compatibility without weakening integrity.

Deep Agents Code Security and Runtime

• #6431 replaces Nemotron source mutation with a version-pinned first-party profile plugin, using the supported extension boundary with fail-closed drift checks.
• #6441 enforces the empty-prompt exit contract during image assembly and readiness checks, rejecting stale or misassembled Deep Agents Code images.
• #6486 adds default-disabled, thread-scoped auto-approval through transactional rebuilds, improving usability while retaining per-thread opt-in and OpenShell controls.
• #6494 supplies required nonempty Nemotron tool-call content and blocks literal [content] execution placeholders, preventing malformed requests from reaching shell dispatch.
• #6495 routes managed fetch_url through the policy proxy with redirect and trust-store validation, enabling repository reads without bypassing egress policy.
• #6497 isolates route probes from user startup files and curl configuration, preventing sandbox-controlled output from spoofing authoritative inference health.
• #6506 moves health probes to a root-owned, side-effect-free managed-exec boundary, preserving observability while failing closed on incompatible older images.

Inference and Local Model Reliability

• #5857 synchronizes the explicit OpenClaw main-agent model during inference switches while retaining secondary overrides, keeping runtime identity aligned with the selected route.
• #6293 propagates compatible-endpoint max_model_len into Hermes context_length, preventing capable models from falling back to an unusably small context window.
• #6412 makes the agent-visible inference.local route authoritative across status, doctor, and connect, integrating the original contributions from @harjothkhara in #6203 and @souvikDevloper in #6264 so health reflects what the sandbox can actually reach.
• #6421 expands the quiet vLLM pull watchdog to 15 minutes, avoiding premature cancellation of valid large-image pulls while retaining an overall safety limit.
• #6475 removes the unavailable Kimi K2.6 NVIDIA endpoint from managed selection, preventing onboarding from advertising a nonworking production route.
• #6481 replays @HOYALIM's model-discovery fix from #6075, waiting for Ollama to expose a newly pulled model before accepting the route so onboarding cannot succeed before daemon discovery completes.
• #6482 replays @HOYALIM's warm-up fix from #6076, loading an idle Ollama model before OpenClaw passthrough after daemon restarts to reduce avoidable first-turn failures.

Dashboard, Messaging, and CLI Automation

• #4960 recognizes OpenClaw's rewritten bare process name during tunnel shutdown, ensuring gateways and channel pollers actually stop.
• #5676 accepts warning-prefixed and wrapped agent-list JSON, keeping agents apply reliable across runtime output variations.
• #5929 prints copyable SSH port-forward guidance for remote dashboards without changing quiet output, improving access without encouraging unsafe binds.
• #6116 accepts a verified live loopback port when OpenShell cannot track a background forward, preventing healthy macOS/Colima onboarding from rolling back.
• #6283 aligns the Hermes WebUI with the resolved dashboard-forward port, avoiding false collisions and unusable host/sandbox port mismatches.
• #6439 binds starter-prompt credential collection to an authenticated, digest-pinned one-shot helper and hardened local form, keeping secrets behind reviewed command boundaries.
• #6450 makes shutdown agent-aware for Hermes gateways and host forwards while sparing terminal-only agents, cleaning up resources without applying gateway shutdown to terminal-only agents.
• #6474 makes WhatsApp and Slack runtime loaders compose safely and exposes redacted proof failures, preserving both channel integrations when enabled together.
• #6480 replays @WilliamK112's fix from #5674 and sends the plugin registration banner to stderr, keeping stdout machine-readable for automation.

Documentation and Extension Surface

• #6508 defines extension terminology, ownership boundaries, and measurable SDK-readiness gates, clarifying that no public NemoClaw plugin SDK exists yet.
• #6514 links non-interactive quickstart guidance directly to provider selection, reducing setup ambiguity.

CI and Release Confidence

• #4940 scopes TUI chat capture by session and distinguishes infrastructure capture failures, preventing stale retry events from masquerading as product regressions.
• #5599 guards the auto-pair timeout budget, and #6505 replays @atulya-singh's original wait-utility coverage from #4894. Together they keep polling and retry behavior bounded and prevent timing drift from silently weakening live checks.
• #6397 adds live upgrade coverage for both v0.0.36 and v0.0.55, increasing confidence in legacy backup and restoration paths.
• #6513 proves that direct managed-exec Python invocation cannot bypass default egress denial, closing a live security-evidence gap.
• #6526 restores a consistent CodeQL action revision and guards atomic updates, repairing security scanning and preventing future version drift.

Thank you

Thank you to our external contributors:

• @gauravprasadgp for #3787.
• @abhi-0906 for #4940 and #4960.
• @atulya-singh for #5599, #5929, and the original wait-utility contribution in #4894, replayed in #6505.
• @WilliamK112 for #5676 and the original banner fix in #5674, replayed in #6480.
• @deepujain for #5857.
• @kagura-agent for #6122 and #6211.
• @ogarciarevett for #6283.
• @HOYALIM for #6320 and the original Ollama fixes in #6075 and #6076, replayed in #6481 and #6482.
• @harjothkhara for the original inference-health contribution in #6203, integrated in #6412.
• @souvikDevloper for the original inference-health contribution in #6264, integrated in #6412.