NemoClaw v0.0.119 is out!

[cjagwani]

NemoClaw v0.0.119 is out

NemoClaw v0.0.119 expands local runtime choices. Qualified Linux hosts can now use native rootless Podman for standard managed-image onboarding. Qualifying Windows Subsystem for Linux (WSL) N1x hosts can also select an Experimental managed llama.cpp path for Qwen 3.6 35B-A3B.

This release strengthens the boundaries around network policy, credentials, and messaging. NemoClaw rejects untrusted private destinations earlier, keeps OpenShell policy data typed, limits WeChat redirects to the validated account origin, and stops rebuild or Model Context Protocol (MCP) operations when required credential evidence is absent.

NemoClaw v0.0.119 also improves recovery and release confidence. Onboarding, sandbox rebuild, Hermes recovery, Ollama selection, and sandbox commands now give more predictable results. Reviewed dependency graphs remove four high-severity fast-uri advisories, and the release workflows validate the image artifacts that they consume.

Local runtimes and inference

• #9923 adds native rootless Podman as an explicit runtime choice on qualified Linux hosts. Admission checks cover the current-user socket, rootless service, cgroups v2, networking, DNS, platform, and the managed-image receipt.
• #10742 adds an Experimental managed llama.cpp profile for Qwen 3.6 35B-A3B on qualifying WSL N1x hosts. The path remains explicit and requires the documented Docker Desktop, GPU, memory, driver, and product-identity checks.
• #10741, #10326, #10308, and #10767 make local inference more predictable. Windows Ollama traffic stays in Docker Desktop, automatic selection prefers the largest fitting registered model, vLLM reports safe reuse or reconfiguration steps for GPU conflicts, and failed Ollama verification processes are removed as a process tree.

Network policy and credentials

• #10659, #10834, and #10809 strengthen custom policy presets. Untrusted private and special-use destinations fail before mutation, dry-run and apply enforce the same reserved-key rules, and successful custom-preset operations no longer print a contradictory missing-preset message.
• #10150 and #10149 add typed OpenShell policy boundaries and route credential commands through the shared provider adapter. These changes keep provider-composed policy separate from round-trippable base policy and reduce the chance that literal credentials enter a replacement sandbox.
• #10759 and #10844 make credential handling fail closed. MCP restart checks every selected server's stored credential before mutation, while Hermes Langfuse Cloud uses an endpoint-bound OpenShell provider profile for its public and secret keys.
• #10692 authorizes only the validated Tencent iLink IDC origin during Experimental WeChat QR login. This prevents an untrusted redirect host from receiving the login request.

Messaging, recovery, and commands

• #10707 preserves messaging channels during rebuild when matching gateway providers still hold all required credentials. NemoClaw disables a channel only after confirmed absence and stops before mutation when inspection is uncertain.
• #10444, #10743, and #10491 improve interrupted-install and rebuild recovery. NemoClaw directs users to rerun incomplete installs, ignores abandoned Portable configuration without lifecycle authority, and recovers safely from an empty replacement journal.
• #10831, #10805, and #10811 tighten Hermes startup and recovery. Onboarding requires a tracked or equivalently controlled base image, skips one known-futile prelaunch request, and reports credential-free timing for each recovery phase.
• #10335, #10760, and #10803 clarify sandbox operations. Bare actions report the required grammar, sandbox exec avoids a pseudo-terminal unless --tty is set, and uninstall previews name the selected gateway and Docker volume.
• #10738 keeps headless remote guidance platform-neutral, so the recovery message applies outside one operating system.

Documentation and community

• #10328 links the supported community-contribution path and examples from the user documentation.
• #10787 and #10804 keep the published network-policy decision table contiguous across OpenClaw, Hermes, and Deep Agents Code variants. Users can now see every supported workflow row.
• #10832 and #10901 bring the user documentation and release entry through the final v0.0.119 surface.
• #10896 removes volatile skill counts from guidance so the documentation does not become inaccurate when the skill catalog changes.

CI and release confidence

• #10523, #10536, #10794, and #10796 make E2E selection more reliable. Image, messaging, and Shields tests select the intended targets without losing selector output.
• #10766 and #10856 move CI performance analysis and failure classification into maintainer skills. Maintainers can inspect failures with bounded, reusable procedures.
• #10820, #10825, #10835, #10838, #10841, #10849, #10850, #10853, and #10854 stabilize the PR Review Advisor runtime, model selection, and execution pressure.
• #10859 stabilizes Docker-boundary tests, while #10858 aligns the merge-conflict repair expectation with the current inference boundary.
• #10894 and #10892 pin fast-uri 3.1.6 throughout production dependency graphs and managed-image inputs. Reviewed locks, integrity metadata, runtime bundles, and fixtures no longer contain the four affected earlier releases.
• #10902 accepts standard signed and unsigned ZIP data descriptors in the release artifact verifier while retaining CRC, size, path, encryption, and flag checks.

Thank you

Thank you to external contributors @deepujain for the complete published network-policy table in #10787, and @aarav1109s for removing the misleading custom-preset diagnostic in #10809.