NemoClaw v0.0.81 is out!

[cv]

NemoClaw v0.0.81 is a stability-focused release for long-running agents. GPU onboarding now prefers native OpenShell injection on eligible Linux Docker hosts and uses the compatibility route only after trusted failure classification, while restart and teardown paths recover more cleanly across Hermes, OpenClaw, macOS, and legacy Docker containers.

The release also preserves more user-owned state without letting backups override current managed configuration. Snapshot retention is bounded, Hermes dashboard profiles survive rebuilds, compatible inference handles more endpoint and model contracts, and messaging, policy, credential, and backup failures provide clearer, safer recovery evidence.

Underneath those user-facing changes, the release makes its own evidence stronger. Risk-based PR E2E is tied to exact commits, credential-free tests are discovered from source, security-sensitive coverage has explicit floors, and consumer-level contracts replace brittle configuration mirrors so a green build says more about the behavior we actually ship.

GPU, sandbox, and lifecycle stability

• #6333 makes GPU onboarding prefer native OpenShell injection on eligible Linux Docker hosts and permits one compatibility retry only after trusted failure proof, preserving automatic setup without broadening fallback authority.
• #6597 makes unattended destruction of the final macOS sandbox release the shared gateway and port 8080, while Linux retains fast gateway reuse and explicit overrides still win.
• #6625 persists the Hermes managed startup command through direct Docker restarts, so the agent relaunches instead of leaving a healthy container without its workload.
• #6628 stops macOS installs from rewriting the Linux sandbox payload lockfile, keeping release installation reproducible across host platforms.
• #6677 lets recover transactionally replace a legacy Docker container whose managed supervisor disappeared after restart, committing only after pinned health checks pass and retaining rollback on failure.
• #6689 refreshes the unavailable Debian curl pin shared by standard and Hermes sandbox images, restoring reliable image builds while keeping published images aligned.
• #6722 preserves native CDI device requests when recreating Docker containers, preventing Hermes GPU access from disappearing after restart-safe startup-command persistence.

Backup, snapshots, and rebuild state

• #5453 adds direct Blueprint runner actions to list, prune, and safely delete migration snapshots, giving operators bounded disk-retention controls with path and symlink protections.
• #6445 adds manifest-owned key-level restore rules, preserving approved user preferences while keeping current generated configuration authoritative and failing closed on unsafe or mismatched backup state.
• #6617 verifies whether Deep Agents Code is idle through /proc when ps is unavailable, allowing safe snapshots on minimal images without weakening the fail-closed activity check.
• #6631 reports per-directory backup causes such as permission denial, tar read failure, or missing extracted content, turning opaque backup failures into actionable remediation.
• #6673 tells users how to recover when strict backup skips a stopped sandbox, making the required start-and-rerun path explicit without relaxing upgrade safety.
• #6675 replaces a broad rebuild-recovery bypass with a one-shot, target-bound authorization receipt, preventing replay or cross-sandbox recovery while preserving legitimate provider handoff.
• #6685 adds the Hermes Web Dashboard profile to durable rebuild state, so MEMORY.md and USER.md survive successful sandbox recreation.

Inference and onboarding

• #6598 invalidates stale replay results during resumed onboarding instead of applying them to durable state, preventing recomputed earlier phases from advancing an already-ahead session.
• #6620 prints a stable lifecycle receipt when a newly created sandbox never becomes ready, identifying the sandbox, failed gate, timeout, stream status, and cleanup result for safer retries.
• #6643 automatically sends max_completion_tokens for GPT-5 and o1/o3/o4 model families, avoiding unsupported-parameter failures during compatible-endpoint onboarding and agent turns.
• #6649 validates eligible local compatible endpoints on the host and registers sandbox routes through host.openshell.internal, making loopback inference reachable without weakening endpoint validation.
• #6661 reuses bounded DNS and HTTP connections across eligible provider-validation probes, reducing onboarding latency while retaining curl fallbacks for proxies, specialized TLS, and unsafe cases.
• #6664 pauses progress heartbeats while an interactive prompt owns the terminal, preventing onboarding menus from being overwritten while preserving cumulative progress reporting.
• #6704 makes direct Blueprint apply abort when provider creation or inference setup fails, preventing false completion and durable plans for sandboxes that cannot perform inference.

Messaging, policy, and security

• #6593 contextualizes NemoClaw-managed OpenClaw dashboard audit findings with explicit risk-acceptance reasons while keeping their severity, remediation, and unrelated findings visible.
• #6611 removes legacy credential-hash buckets when registry rows are rewritten while retaining the current messaging credential binding, preventing stale duplicate token state after rotation.
• #6633 permits percent-encoded slashes only on ClawHub package endpoints, restoring scoped plugin installation without enabling broader encoded-path behavior elsewhere.
• #6638 adds narrowly scoped DELETE /mcp guidance to the custom Streamable HTTP MCP policy recipe, allowing clean session termination without recommending wildcard access.
• #6645 routes WhatsApp pairing through the loopback gateway and records verified npm provenance for external plugins, allowing paired channels and trusted persistent-state features to start correctly.
• #6647 rejects writable, symlinked, unreadable, empty, or wrongly owned Deep Agents CA bundles, preventing tampered trust material from reaching start, direct launch, or connect-shell paths.
• #6650 redacts token-shaped URL query values even when parameter names appear benign, closing a session-persistence leak path for encoded, repeated, and structured credentials.

Agent, contributor, and maintainer experience

• #6503 preserves managed Deep Agents observability intent across policy-only restarts while rejecting unsafe marker state, keeping policy reloads durable without allowing sandbox-writable state to authorize tracing.
• #6646 makes the PR comparator derive merge eligibility from the complete Tier 0 gate set and fail closed on malformed or contradictory evidence, preventing unsafe merge recommendations.
• #6676 aligns contributor guidance, templates, and agent workflows around plain language and the smallest direct design, reducing speculative architecture and review churn.
• #6680 removes optional Deep Agents first-run friction and supervises each terminal's LangGraph descendants, giving users cleaner initial sessions and reliable process cleanup on disconnect.
• #6682 limits automated review findings to concrete defects, makes only blockers affect merge posture, and keeps the second model artifact-only, reducing repeated speculative author work.

Documentation and release confidence

• #6619 derives dependency pins from authoritative installer and image sources and checks every consumer for drift, preventing internally inconsistent releases without another hand-maintained manifest.
• #6621 makes snapshot lifecycle E2E independent of hosted inference credentials and upstream availability, replacing skips with repeatable real install, snapshot, and restore evidence.
• #6662 introduces a deterministic risk-based PR E2E gate that binds selected jobs and complete evidence to the exact PR head while keeping model output outside merge authority.
• #6670 discovers credential-free E2E tests beside their source and runs them through one controlled job, reducing duplicated workflow wiring and silent coverage gaps.
• #6683 limits superseded-run cancellation searches to active E2E runs, keeping the controller reliable after completed history exceeds GitHub's search cap.
• #6694 makes PR E2E prerequisite failures identify the exact CI attempt, failed jobs, and failed steps, turning a generic gate failure into actionable diagnostics.
• #6696 restores test:fast as a genuinely source-backed lane and blocks transitive compiled-artifact imports, keeping quick local feedback trustworthy.
• #6701 adds focused changed/watch testing, reproducible shuffle seeds, and async-leak diagnostics while making CI failure output quieter and more actionable.
• #6705 adds per-file coverage floors for security-sensitive modules and tightens aggregate tolerance, preventing weak security coverage from hiding behind repository averages.
• #6707 verifies that every test belongs to exactly one known Vitest project and enforces native credential-free tags, preventing omitted, duplicated, or incorrectly routed tests.
• #6712 adds the v0.0.81 documentation summary and expands backup guidance for Hermes dashboard state, per-item failures, and direct-runner-only snapshot retention controls, so operators can preserve dashboard profile data and distinguish public CLI controls from direct Blueprint runner actions.
• #6714 tests composed effective sandbox policies at their consumer boundary, protecting real host, method, credential, transport, and executable restrictions rather than YAML layout.
• #6718 replaces remaining declarative mirrors with executable consumer contracts and guards against their return, making green tests stronger evidence of shipped behavior.

Thank you

• Thank you to @vasanth53 for #5453.
• Thank you to @HOYALIM for #6611, #6612, #6613, #6615, #6617, #6618, #6619, #6620, and #6647.
• Thank you to @harjothkhara for #6621.
• Thank you to @Hokonoken for #6631.
• Thank you to @HwangJohn for #6638.
• Thank you to @gregmercer for #6643.
• Thank you to @fallintoplace for #6646 and #6650.
• Thank you to @deepujain for #6673.

Full comparison: v0.0.80...v0.0.81