NemoClaw v0.0.40

[ericksoa]

NemoClaw v0.0.40 is a release about the quiet machinery that lets a user trust the first minutes of an install. We spent this cycle making the small signals more honest: a gateway that is reported healthy should actually be reachable, a failed dashboard should say so with a non-zero status, long URLs should fit inside the box that contains them, and setup should explain the tools and permissions it needs before the user is left to infer them. These are modest changes individually, but together they move NemoClaw closer to a system whose behavior can be observed, reproduced, and repaired.

The largest body of work is around messaging and the OpenShell runtime boundary. v0.0.40 lands the native WebSocket credential rewrite path, preserves disabled channel state across rebuilds, improves Hermes next-step output, and adds macOS VM rootfs compatibility. This is meaningful progress toward a cleaner messaging architecture, but it is not the end of the voyage. Messaging still needs more stabilization and real-world testing across Slack, Discord, Telegram, and the OpenShell gateway paths before we should treat it as settled.

We also made the release more practical for Spark, UAT, and local-inference validation. The release adds compatibility metadata for OpenClaw, a running-vLLM option in onboarding, a Qwen3.6 35B starter model for large-memory Ollama hosts, documentation for local tool-call reliability, and fixes around custom gateway ports, GPU sandbox policy, Ollama loopback repair, and OpenClaw baseline recovery. In the large space of machines, networks, and user workflows, v0.0.40 is one more calibrated instrument: better at telling us what is working, clearer when it is not, and better prepared for the next round of UAT evidence.

Messaging, Hermes, and OpenShell

• #3323 - Use native WebSocket credential rewrite for messaging.
• #3395 - Preserve disabled channels through rebuild so channel start can recover cleanly.
• #3382 - Use the invoked CLI name in Hermes onboard next-step output.
• #3442 - Enable Hermes macOS VM rootfs compatibility.
• #3367 - Declare OpenClaw compatibility metadata.
• #3332 - Propagate custom OpenClaw gateway ports.
• #3408 - Harden OpenClaw baseline recovery.

Spark, UAT, and Local Inference

• #3417 - Offer running vLLM in the onboarding provider menu.
• #3424 - Add the nemoclaw inference get command.
• #3422 - Add qwen3.6:35b to Ollama starter models on large-memory hosts.
• #2823 - Document local tool-call reliability for local inference.
• #3384 - Repair existing Ollama loopback overrides.
• #3436 - Avoid a literal /proc wildcard in GPU sandbox policy.
• #3425 - Configure the OpenShell gateway bind address and port for remote-access workflows.

Onboarding, Gateway, Docker, and Install Reliability

• #3160 - Recover an empty openclaw.json on sandbox restart.
• #3385 - Use a TCP probe to verify forward health.
• #3420 - Preflight zstd before the Ollama Linux installer and clarify sudo prompts.
• #3378 - Verify the Docker-driver gateway is really serving before reporting healthy.
• #3383 - Use the Docker-driver gateway on macOS with OpenShell 0.0.37.
• #3405 - Clean up stale OpenClaw gateway dashboard listeners.
• #3311 - Suppress Docker manifest/build noise during gateway setup.
• #3438 - Repair an onboard duplicate import and gateway upgrade check.
• #3441 - Add a Docker sandbox-bridge reachability preflight.
• #3458 - Remove the sandbox bridge reachability probe before tagging after it proved too aggressive.

Security, Policy, and Shields

• #3407 - Clarify the mutable-default config posture in security docs.
• #3223 - Skip the Brave policy preset for unsupported agents.
• #3377 - Drop phantom /usr/bin/gh from GitHub preset binaries.
• #3353 - Require Bearer token auth on Ollama proxy native API routes.
• #3204 - Self-heal expired auto-restore timers in shields.

CLI, UX, and Observability

• #3370 - Render dynamic banner boxes for long URLs.
• #3402 - Surface gateway-down state with a non-zero exit code.
• #2442 - Replace race-condition sleeps with readiness probes.

Testing, CI, Refactors, and Release Docs

• #3297 - Extract compatible endpoint smoke helpers.
• #3380 - Enforce the onboarding entrypoint line budget.
• #3371 - Improve landing pages and about pages.
• #3299 - Extract config sync helpers.
• #3379 - Address install review feedback around tests, warning formatting, and ready-now comments.
• #3300 - Extract Dockerfile patch helpers.
• #3429 - Update OpenShell gateway upgrade stub features.
• #3410 - Add a dashboard remote-bind regression guard.
• #3411 - Move the gateway health guard to regressions.
• #3393 - Drop bash login/rc loading in spawnSync test invocations.
• #3302 - Extract the web search support helper.
• #3305 - Extract the web search verification probe.
• #3306 - Extract gateway bootstrap repair helpers.
• #3427 - Prepare v0.0.40 release docs.