Skip to content

docs: prepare v0.0.40 release docs #3427

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ericksoa merged 1 commit into from
May 13, 2026
Merged

docs: prepare v0.0.40 release docs #3427

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 11 additions & 9 deletions .agents/skills/nemoclaw-user-configure-inference/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,9 @@ The onboard wizard detects Ollama automatically when it is installed or running
If Ollama is installed but not running, NemoClaw starts it for you.
On macOS and Linux, the wizard can also offer to install Ollama when it is not present.
On WSL, the wizard can use, start, restart, or install Ollama on the Windows host through PowerShell interop.
On Debian and Ubuntu, the native Linux install path checks for `zstd` before it runs the Ollama installer.
If `zstd` is missing, NemoClaw installs it with `apt-get` and explains the sudo prompt before continuing.
On non-apt Linux distributions, install `zstd` first, then rerun onboarding.

Run the onboard wizard.

Expand Down Expand Up @@ -85,9 +88,10 @@ token as its `OPENAI_API_KEY` credential.
OpenShell's L7 proxy injects the token at egress, so the agent inside the
sandbox never sees the token directly.

`GET /api/tags` is exempt from authentication so container health checks
continue to work.
All other endpoints (including `POST /api/tags`) require the Bearer token.
All proxy endpoints require the Bearer token, including `GET /api/tags`.
Internal health and reachability checks run via the proxy treat any HTTP
response (including `401`) as proof the proxy is alive — they only fail
when nothing answers at all.

If Ollama is already running on a non-loopback address when you start onboard,
the wizard restarts it on `127.0.0.1:11434` so the proxy is the only network
Expand Down Expand Up @@ -218,15 +222,14 @@ $ NEMOCLAW_PROVIDER=anthropicCompatible \
When vLLM is already running on `localhost:8000`, NemoClaw can detect it automatically and query the `/v1/models` endpoint to determine the loaded model.
On supported Linux hosts with NVIDIA GPUs, the onboard wizard can also install or start a managed vLLM container for you.

Set the experimental flag and run onboard.
For an already-running vLLM server, run `nemoclaw onboard` and select **Local vLLM [experimental]** from the provider list.

```console
$ NEMOCLAW_EXPERIMENTAL=1 nemoclaw onboard
$ nemoclaw onboard
```

Select **Local vLLM [experimental]** from the provider list.
If vLLM is already running, NemoClaw detects the running model and validates the endpoint.
If vLLM is not running and your host matches a managed profile, select the **Install vLLM** or **Start vLLM** entry.
If vLLM is not running and your host matches a managed profile, set `NEMOCLAW_EXPERIMENTAL=1`, rerun `nemoclaw onboard`, and select the **Install vLLM** or **Start vLLM** entry.
NemoClaw pulls the vLLM image, downloads model weights into `~/.cache/huggingface`, starts the `nemoclaw-vllm` container on `localhost:8000`, and prints progress markers while the model loads.
The first run can take 10 to 30 minutes.
Later runs reuse the cached image and model weights.
Expand All @@ -247,8 +250,7 @@ Managed vLLM uses these profiles:
Use an already-running vLLM server:

```console
$ NEMOCLAW_EXPERIMENTAL=1 \
NEMOCLAW_PROVIDER=vllm \
$ NEMOCLAW_PROVIDER=vllm \
nemoclaw onboard --non-interactive
```

Expand Down
10 changes: 6 additions & 4 deletions .agents/skills/nemoclaw-user-configure-inference/references/inference-options.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,15 +31,16 @@ NemoClaw uses provider-specific local tokens for those routes, and rebuilds of l
| Hermes Provider | Hermes only | OpenAI-compatible route | Available when onboarding Hermes Agent through `nemohermes` |
| Local Ollama | Caveated | Local Ollama API | Available when Ollama is installed or running on the host |
| Local NVIDIA NIM | Experimental | Local OpenAI-compatible | Requires `NEMOCLAW_EXPERIMENTAL=1` and a NIM-capable GPU |
| Local vLLM | Experimental | Local OpenAI-compatible | Requires `NEMOCLAW_EXPERIMENTAL=1` and a server already running on `localhost:8000` |
| Local vLLM | Experimental | Local OpenAI-compatible | Appears when a vLLM server is already running on `localhost:8000`; managed install/start requires `NEMOCLAW_EXPERIMENTAL=1` |
<!-- provider-status:end -->

## Provider Options

The onboard wizard presents the following provider options by default.
The first six are always available.
Ollama appears when it is installed or running on the host.
Experimental local vLLM appears when you opt in and NemoClaw detects either a running vLLM server or a supported NVIDIA GPU host profile.
Experimental local vLLM appears when NemoClaw detects a running vLLM server.
The managed install/start vLLM entry appears when you opt in and NemoClaw detects a supported NVIDIA GPU host profile.

| Option | Description | Curated models |
|--------|-------------|----------------|
Expand Down Expand Up @@ -83,12 +84,13 @@ $ NEMOCLAW_PROVIDER=routed NVIDIA_API_KEY=<your-key> nemoclaw onboard --non-inte

## Experimental Options

The following local inference options require `NEMOCLAW_EXPERIMENTAL=1` and, when prerequisites are met, appear in the onboarding selection list.
The following local inference options are experimental.
Local NIM and managed vLLM install/start require `NEMOCLAW_EXPERIMENTAL=1`; an already-running vLLM server appears directly in the onboarding selection list.

| Option | Condition | Notes |
|--------|-----------|-------|
| Local NVIDIA NIM | NIM-capable GPU detected | Pulls and manages a NIM container. |
| Local vLLM | vLLM running on `localhost:8000`, or a supported DGX Spark, DGX Station, or Linux NVIDIA GPU profile | Auto-detects the loaded model. Can install or start a managed vLLM container for supported profiles. |
| Local vLLM | vLLM running on `localhost:8000`, or a supported DGX Spark, DGX Station, or Linux NVIDIA GPU profile | Auto-detects the loaded model when vLLM is already running. Can install or start a managed vLLM container for supported profiles after experimental opt-in. |

For setup instructions, refer to Use a Local Inference Server (use the `nemoclaw-user-configure-inference` skill).

Expand Down
15 changes: 0 additions & 15 deletions .agents/skills/nemoclaw-user-configure-security/references/best-practices.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,21 +230,6 @@ For sensitive workloads, use a reviewed host-side immutability workflow after in
| Risk of default | A writable `.openclaw` directory lets the agent modify its own gateway config: disabling CORS or redirecting inference to an attacker-controlled endpoint. |
| Recommendation | For always-on assistants handling sensitive workloads, lock config after initial setup. For development workflows, the writable default is appropriate. |

### Locking Config with Shields

NemoClaw exposes the reviewed host-side immutability workflow through shields commands:

| Command | Purpose |
|---|---|
| `nemoclaw <name> shields status` | Show whether the sandbox is in default mutable mode, locked mode, or temporarily unlocked mode. |
| `nemoclaw <name> shields up` | Opt into lockdown for sensitive workloads by locking config and state entry points with root ownership, read-only modes, and the immutable flag where available. |
| `nemoclaw <name> shields down --timeout 5m --reason "<reason>"` | Temporarily return a previously locked sandbox to the mutable default for maintenance, then auto-restore lockdown. |

Run shields commands from the host.
They use privileged OpenShell and Kubernetes paths that do not inherit the sandbox process's Landlock context.
Landlock itself stays fixed at sandbox creation; `shields up` does not rewrite the Landlock policy.
Instead, it layers DAC permissions and `chattr +i` over paths that the default Landlock policy intentionally leaves writable.

### Writable Paths

The agent has read-write access to `/sandbox`, `/tmp`, and `/dev/null`.
Expand Down
2 changes: 0 additions & 2 deletions .agents/skills/nemoclaw-user-deploy-remote/references/sandbox-hardening.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,8 +91,6 @@ The agent's home directory (`/sandbox`) is writable by default:
This writable default is intentional.
Seeing the sandbox user create files under `/sandbox` or `/sandbox/.openclaw` in a fresh sandbox does not mean Landlock failed.
Landlock still enforces the fixed read-only system paths below.
Use `nemoclaw <name> shields up` from the host to opt into config lockdown for sensitive workloads.
That host-side command layers root ownership, read-only modes, and the immutable flag where available; it does not change the Landlock policy after sandbox creation.

System paths remain read-only to prevent agents from:

Expand Down
9 changes: 2 additions & 7 deletions .agents/skills/nemoclaw-user-get-started/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -272,7 +272,7 @@ For example, Slack bot tokens must start with `xoxb-`.
### Choose Network Policy Presets

After the sandbox image builds and OpenClaw starts inside the sandbox, NemoClaw asks which network policy tier to apply.
The default **Balanced** tier includes common development presets such as npm, PyPI, Hugging Face, Homebrew, and Brave Search.
The default **Balanced** tier includes common development presets such as npm, PyPI, Hugging Face, Homebrew, and Brave Search when the selected agent supports web search.
Use the arrow keys or `j` and `k` to move, Space to select, and Enter to confirm.

The preset selector lets you include more destinations, such as GitHub, Jira, Slack, Telegram, or local inference.
Expand Down Expand Up @@ -346,9 +346,4 @@ openclaw agent --agent main --local -m "hello" --session-id test

## Related Skills

- `nemoclaw-user-manage-sandboxes` — Manage NemoClaw sandboxes (use the `nemoclaw-user-manage-sandboxes` skill) for port forwards, rebuilds, upgrades, and uninstall
- `nemoclaw-user-configure-inference` — Switch inference providers (use the `nemoclaw-user-configure-inference` skill) to use a different model or endpoint
- `nemoclaw-user-manage-policy` — Approve or deny network requests (use the `nemoclaw-user-manage-policy` skill) when the agent tries to reach external hosts
- `nemoclaw-user-deploy-remote` — Deploy to a remote GPU instance (use the `nemoclaw-user-deploy-remote` skill) for always-on operation
- `nemoclaw-user-monitor-sandbox` — Monitor sandbox activity (use the `nemoclaw-user-monitor-sandbox` skill) through the OpenShell TUI
- `nemoclaw-user-reference` — Consult the troubleshooting guide (use the `nemoclaw-user-reference` skill) for common error messages and resolution steps
- `nemoclaw-user-overview` — NemoClaw Overview (use the `nemoclaw-user-overview` skill) to learn what NemoClaw is and its capabilities
2 changes: 2 additions & 0 deletions .agents/skills/nemoclaw-user-get-started/references/prerequisites.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,8 @@ The sandbox image is approximately 2.4 GB compressed. During image push, the Doc

On Linux, the installer can install Docker, start the Docker service, and add your user to the `docker` group.
If the group change is not active in the current shell, the installer exits with `newgrp docker` guidance before it starts onboarding.
If you choose the native Linux Ollama install path, the onboard wizard also requires `zstd` for Ollama archive extraction.
On Debian and Ubuntu, NemoClaw installs `zstd` with `apt-get` if it is missing; on other Linux distributions, install `zstd` before onboarding.

:::{warning} OpenShell Lifecycle
For NemoClaw-managed environments, use `nemoclaw onboard` when you need to create or recreate the OpenShell gateway or sandbox.
Expand Down
2 changes: 1 addition & 1 deletion .agents/skills/nemoclaw-user-get-started/references/quickstart-hermes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
Use NemoHermes when you want NemoClaw to create an OpenShell sandbox that runs Hermes instead of the default OpenClaw agent.
The `nemohermes` command is an alias for `nemoclaw` with the Hermes agent pre-selected.

> **Warning:** The Hermes agent option is experimental.
> **Experimental Feature:** The Hermes agent option is experimental.
> Interfaces, defaults, and supported features may change without notice, and it is not recommended for production use.

Review the Prerequisites (use the `nemoclaw-user-get-started` skill) before starting.
Expand Down
3 changes: 3 additions & 0 deletions .agents/skills/nemoclaw-user-manage-sandboxes/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,6 +184,9 @@ When a new NemoClaw release becomes available, update the `nemoclaw` CLI on your

Re-run the installer.
Before it onboards anything, the installer calls `nemoclaw backup-all` (use the `nemoclaw-user-reference` skill) automatically, storing a snapshot of each running sandbox in `~/.nemoclaw/rebuild-backups/` as a safety net.
If your existing gateway is from OpenShell earlier than `0.0.37`, the installer prompts before it runs the new automatic gateway upgrade path.
The automatic path is offered only when the existing `nemoclaw` CLI supports `backup-all`; older installs must preserve sandbox state manually before retiring the gateway.
For unattended installs, set `NEMOCLAW_ACCEPT_EXPERIMENTAL_OPENSHELL_UPGRADE=1`, or manually run `nemoclaw backup-all` and `openshell gateway destroy -g nemoclaw || openshell gateway destroy` before rerunning the installer as `curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_OPENSHELL_UPGRADE_PREPARED=1 bash`.

```console
$ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
Expand Down
27 changes: 15 additions & 12 deletions .agents/skills/nemoclaw-user-overview/references/ecosystem.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,18 +8,8 @@ This page describes how the ecosystem is formed across projects, where NemoClaw

## How the Stack Fits Together

Three pieces usually appear together in a NemoClaw deployment, each with a distinct scope:

| Project | Scope |
|---------|--------|
| [OpenClaw](https://openclaw.ai) | The assistant: runtime, tools, memory, and behavior inside the container. It does not define the sandbox or the host gateway. |
| [OpenShell](https://github.com/NVIDIA/OpenShell) | The execution environment: sandbox lifecycle, network, filesystem, and process policy, inference routing, and the operator-facing `openshell` CLI for those primitives. |
| NemoClaw | The NVIDIA reference stack that implements the definition above on the host: `nemoclaw` CLI and plugin, versioned blueprint, channel messaging configured for OpenShell-managed delivery, and state migration helpers so OpenClaw runs inside OpenShell in a documented, repeatable way. |

NemoClaw sits above OpenShell in the operator workflow.
It drives OpenShell APIs and CLI to create and configure the sandbox that runs OpenClaw.
Models and endpoints sit behind OpenShell's inference routing.
NemoClaw onboarding wires provider choice into that routing.
There are three pieces that are put together in a NemoClaw deployment: OpenClaw, OpenShell, and NemoClaw, each with a distinct scope.
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Rewrite to active voice.

"There are three pieces that are put together" uses passive voice. As per coding guidelines, active voice is required in documentation.

Suggested rewrites:

  • "A NemoClaw deployment combines three pieces: OpenClaw, OpenShell, and NemoClaw, each with a distinct scope."
  • "NemoClaw deployments use three components: OpenClaw, OpenShell, and NemoClaw, each with a distinct scope."

As per coding guidelines: Active voice required. Flag passive constructions.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.agents/skills/nemoclaw-user-overview/references/ecosystem.md at line 11,
Replace the passive sentence "There are three pieces that are put together in a
NemoClaw deployment: OpenClaw, OpenShell, and NemoClaw, each with a distinct
scope." with an active-voice alternative; for example use "A NemoClaw deployment
combines three pieces: OpenClaw, OpenShell, and NemoClaw, each with a distinct
scope." or "NemoClaw deployments use three components: OpenClaw, OpenShell, and
NemoClaw, each with a distinct scope." Ensure the new sentence appears in place
of the original passive construction.

The following diagram shows how they fit together.

```mermaid
flowchart TB
Expand All @@ -42,6 +32,19 @@ flowchart TB
linkStyle 1 stroke:#76b900,stroke-width:2px
```

NemoClaw sits above OpenShell in the operator workflow.
It drives OpenShell APIs and CLI to create and configure the sandbox that runs OpenClaw.
Models and endpoints sit behind OpenShell's inference routing.
NemoClaw onboarding wires provider choice into that routing.

The following table shows the scope of each component in the stack.

| Project | Scope |
|---------|--------|
| [OpenClaw](https://openclaw.ai) | The assistant: runtime, tools, memory, and behavior inside the container. It does not define the sandbox or the host gateway. |
| [OpenShell](https://github.com/NVIDIA/OpenShell) | The execution environment: sandbox lifecycle, network, filesystem, and process policy, inference routing, and the operator-facing `openshell` CLI for those primitives. |
| NemoClaw | The NVIDIA reference stack that implements the definition above on the host: `nemoclaw` CLI and plugin, versioned blueprint, channel messaging configured for OpenShell-managed delivery, and state migration helpers so OpenClaw runs inside OpenShell in a documented, repeatable way. |

## NemoClaw Path versus OpenShell Path

Both paths assume OpenShell can sandbox a workload.
Expand Down
Loading
Loading