NemoClaw v0.0.142 is out!

[rsliter]

NemoClaw v0.0.142 is out

NemoClaw v0.0.142 fixes native inference onboarding and tightens managed vLLM network exposure.
OpenClaw Model Router setup now attaches a sandbox-scoped provider, and GPU readiness checks follow the selected native endpoint.
New managed single-host vLLM containers publish their port only on loopback and the private OpenShell Docker bridge.

Sandbox recovery preserves more of the state you need to keep working.
Registered Hermes NVIDIA sandboxes can recover credential references damaged by an earlier migration, and rebuild completes cleanup before a late CLI failure exits.
Deep Agents Code keeps its managed route identity separate from saved native preferences.

Installation handles unsafe executable directories more carefully and gives clearer Ollama download recovery guidance.
WSL GPU detection finds the driver-provided executable when it is missing from PATH.
The release also improves resource sizing, qualification diagnostics, and the documentation used to operate these paths.

Native Inference and Network Boundaries

• #14104 attaches a sandbox-scoped native provider during OpenClaw Model Router onboarding.
  Resume restores the recorded attachment after revalidating sandbox identity, keeping the selected route bound to its sandbox.
• #14210 fixes onboarding and replacement of pinned NVIDIA-compatible provider profiles.
  The attached profile owns its network boundary; the unchanged bundled NVIDIA grant does not remain as a second grant.
  Operator-owned policy still has to pass admission checks.
• #14098 makes GPU post-ready verification use the selected native local endpoint before runtime commitment and sandbox registration.
  Local NIM and retained shared routes continue to use shared inference.
  Missing curl produces a warning and skips this reachability check.
• #14122 limits new managed single-host vLLM port bindings to loopback and the private OpenShell Docker bridge gateway.
  Existing containers retain their bindings until recreated; managed route recovery rejects owned bearerless containers with unsafe bindings.

Sandbox Recovery and Diagnostics

• #14153 repairs registered Hermes NVIDIA configurations whose three managed credential fields all contain [STRIPPED_BY_MIGRATION].
  Recovery validates sandbox identity and provider binding, installs a fresh scoped reference, and preserves unrelated settings and user state.
  Partial or ambiguous damage remains a refusal.
• #13671 completes rebuild maintenance-window and lock cleanup before a late CLI exit.
  Cleanup failures remain visible so operators can reconcile retained sources and recovery files.
  Thanks to @simoneschiavoi for identifying the failure and documenting its cause in #12959; the replacement was implemented independently.
• #14127 keeps Deep Agents Code managed route and upstream provider identity outside writable native preferences.
  Rebuild restores saved model and endpoint preferences while retaining the managed identity needed by status and health checks.
• #13768 identifies rejected OpenClaw CLI pairing state in readiness failures, making the next recovery action easier to determine.

Installation, WSL, and Resource Sizing

• #13856 creates user-local executable directories without group write access under Ubuntu's default 0002 umask.
  It preserves existing modes and rejects unsafe paths before publishing a binary or shim.
  This carries forward @PicoNVIDIA's original contribution in #12497.
• #14230 falls back from unsafe system npm prefixes to a guarded user-local location, allowing installation to continue without publishing into an unsafe directory.
• #14002 identifies the pinned URL, required host, and curl exit code when the Linux Ollama installer download fails.
  Recovery guidance covers blocked outbound access, while fixed diagnostic text avoids exposing proxy credentials from raw stderr.
• #14193 checks the WSL-provided nvidia-smi path when the command on PATH reports no GPU.
  Host assessment can recognize an available GPU without requiring a manual PATH repair.
• #14232 sizes memory profiles from Kubernetes allocatable memory consistently across bytes and binary units.
  Equivalent capacity values now produce the same request instead of falling back to total host memory.

Qualification and CI Maintenance

• #14152 retains bounded container state and logs when protected NIM or vLLM readiness polling is interrupted.
  It also reduces unrelated hook downloads and repeated compatibility builds in CI fixtures.
• #14151 verifies plugin survival through a normal OpenClaw agent turn after an OpenShell restart.
  Correlated audit records establish that the plugin tool ran without weakening the web-search guard.
• #14159 gives growth-check Git fetches up to 90 seconds within a shared 180-second preparation budget.
  Bounded, redacted diagnostics distinguish preparation failures from growth-check failures.
• #14173 corrects the reviewed OpenClaw 2026.10.5 lock identity recognized by the trusted audit controller.
  The default runtime identity and audit policy remain unchanged.
• #14219 stops Dependabot from proposing v1 installer-action updates that the organization does not allow.
  Other action updates and main retain their existing update behavior.
• #14216 defers DGX runtime imports until live execution, so test discovery does not require generated runtime files or installer dependencies.
• #14234 registers the default-branch workflow path needed to dispatch a separate v1 GB300 SSH connectivity smoke test.
  The registration is inert on main and does not establish application qualification.

Documentation

• #14161 adds the release changelog and clarifies WSL GPU discovery and existing NIM and vLLM health requirements.
  The provider guides describe the running-container and valid model-list conditions that onboarding already enforces.

Thank You

Thank you to @PansulBhatt for the allocatable-memory sizing fix in #14232.
Thank you to @PicoNVIDIA for the original Ubuntu directory-permission contribution in #12497, carried into this release through #13856.
Thank you to @simoneschiavoi for identifying and documenting the rebuild cleanup failure in #12959.