docs: add gateway auth controls and update legacy setup description - #1374
Merged
Conversation
- Add Gateway Authentication Controls section to security best practices covering device auth, insecure auth derivation, auto-pair allowlist, and CLI secret redaction (from commits 2804b74, cb668d7) - Add device auth mistake to Common Mistakes table - Update legacy `nemoclaw setup` to reflect delegation to onboard (7c3687e) - Fix docs-to-skills command in CLAUDE.md (correct output path, python3) - Regenerate agent skills Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
📝 WalkthroughWalkthroughThis pull request reorganizes and expands NemoClaw documentation: it standardizes onboarding to Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~30 minutes Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (4)
.agents/skills/nemoclaw-monitor-sandbox/SKILL.md (1)
1-1:⚠️ Potential issue | 🟡 MinorMissing SPDX license header.
As per coding guidelines, all Markdown files must include an SPDX license header at the top (after frontmatter for docs files).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.agents/skills/nemoclaw-monitor-sandbox/SKILL.md at line 1, Add the required SPDX license header to .agents/skills/nemoclaw-monitor-sandbox/SKILL.md by inserting a single line "SPDX-License-Identifier: <LICENSE-ID>" immediately after any existing frontmatter (or at the top if no frontmatter), replacing <LICENSE-ID> with the project's license identifier (e.g., MIT, Apache-2.0); ensure there is exactly one SPDX header line and no extra punctuation so the file complies with the coding guidelines..agents/skills/nemoclaw-reference/references/network-policies.md (1)
1-1:⚠️ Potential issue | 🟡 MinorMissing SPDX license header.
As per coding guidelines, all Markdown files must include an SPDX license header at the top using HTML comments:
<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. SPDX-License-Identifier: Apache-2.0 -->🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.agents/skills/nemoclaw-reference/references/network-policies.md at line 1, Add the required SPDX license header as an HTML comment at the very top of the Markdown file to comply with guidelines: insert the provided SPDX block (including SPDX-FileCopyrightText and SPDX-License-Identifier) before any content in the "Network Policies" document so the header appears above the existing "# Network Policies" title..agents/skills/nemoclaw-overview/references/how-it-works.md (1)
1-1:⚠️ Potential issue | 🟡 MinorMissing SPDX license header.
As per coding guidelines, all Markdown files must include an SPDX license header at the top using HTML comments.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.agents/skills/nemoclaw-overview/references/how-it-works.md at line 1, Add an SPDX license header as an HTML comment at the very top of the Markdown file titled "How NemoClaw Works" (file .agents/skills/nemoclaw-overview/references/how-it-works.md); insert a line like <!-- SPDX-License-Identifier: <LICENSE-ID> --> (replace <LICENSE-ID> with the appropriate license identifier) immediately before the "# How NemoClaw Works" heading so the file complies with the project coding guidelines..agents/skills/nemoclaw-reference/references/inference-profiles.md (1)
1-1:⚠️ Potential issue | 🟡 MinorMissing SPDX license header.
As per coding guidelines, all Markdown files must include an SPDX license header at the top using HTML comments.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.agents/skills/nemoclaw-reference/references/inference-profiles.md at line 1, Add an SPDX license header as an HTML comment at the very top of the file (above the "# Inference Profiles" heading); insert a single line like <!-- SPDX-License-Identifier: <REPO_LICENSE> --> replacing <REPO_LICENSE> with the repository's declared license identifier so the Markdown file includes the required SPDX header.
🧹 Nitpick comments (6)
AGENTS.md (1)
86-86: Usepython3here for consistency and portability.This command now diverges from
CLAUDE.mdand may fail on environments wherepythonis unavailable.Suggested doc fix
-- Regenerate skills: `python scripts/docs-to-skills.py docs/ .agents/skills/ --prefix nemoclaw` +- Regenerate skills: `python3 scripts/docs-to-skills.py docs/ .agents/skills/ --prefix nemoclaw`🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@AGENTS.md` at line 86, Update the regenerating-skills command in the docs to use python3 for consistency and portability: replace the line containing "Regenerate skills: `python scripts/docs-to-skills.py docs/ .agents/skills/ --prefix nemoclaw`" with one that calls `python3` instead, and ensure the change aligns with the equivalent command in CLAUDE.md so both documents match.docs/security/best-practices.md (1)
374-374: Use active voice.The sentence contains passive constructions ("verified by hash"). As per coding guidelines, use active voice.
✏️ Suggested revision
-| What you can change | Set `NEMOCLAW_DISABLE_DEVICE_AUTH=1` as a Docker build argument to disable device authentication. This is a build-time setting baked into `openclaw.json` and verified by hash at startup. | +| What you can change | Set `NEMOCLAW_DISABLE_DEVICE_AUTH=1` as a Docker build argument to disable device authentication. The build process bakes this setting into `openclaw.json`, and the system verifies it by hash at startup. |🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@docs/security/best-practices.md` at line 374, The sentence in the table under "Risk if relaxed" uses passive voice; rewrite it in active voice so the subject performs the action (e.g., change "Disabling device auth allows any device on the network to connect to the gateway without proving identity. This is dangerous when combined with LAN-bind changes or cloudflared tunnels in remote deployments, resulting in an unauthenticated, publicly reachable dashboard." to an active phrasing such as "If you disable device auth, the gateway can no longer verify devices by hash, allowing any device on the network to connect without proving identity; combined with LAN-bind changes or cloudflared tunnels this can expose the dashboard publicly."). Ensure the new sentence explicitly names the actor ("you" or "the gateway") and replaces passive fragments like "verified by hash" with active verbs like "the gateway verifies devices by hash" or similar..agents/skills/nemoclaw-overview/references/how-it-works.md (1)
20-20: Split sentences onto separate lines.Multiple sentences appear on the same line. As per coding guidelines, use one sentence per line to make diffs readable.
📝 Suggested refactor
-OpenShell handles *how* to sandbox an agent securely. NemoClaw handles *what* goes in the sandbox and makes the setup accessible. For the full system diagram, see Architecture (see the `nemoclaw-reference` skill). +OpenShell handles *how* to sandbox an agent securely. +NemoClaw handles *what* goes in the sandbox and makes the setup accessible. +For the full system diagram, see Architecture (see the `nemoclaw-reference` skill).🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.agents/skills/nemoclaw-overview/references/how-it-works.md at line 20, The sentence "OpenShell handles *how* to sandbox an agent securely. NemoClaw handles *what* goes in the sandbox and makes the setup accessible. For the full system diagram, see Architecture (see the `nemoclaw-reference` skill)." should be split so each sentence is on its own line in the file .agents/skills/nemoclaw-overview/references/how-it-works.md; update the block containing those three sentences so they become three separate lines, preserving punctuation and inline formatting (e.g., *how*, *what*, and the `nemoclaw-reference` code span) and nothing else..agents/skills/nemoclaw-deploy-remote/references/sandbox-hardening.md (1)
58-61: Use MyST admonition instead of blockquote for callout.The note uses a blockquote with bold formatting. As per coding guidelines, callouts should use MyST admonition syntax:
:::{note}.📝 Suggested refactor
-> **Note:** The `Dockerfile` itself cannot enforce `--cap-drop` — that is a -> runtime concern controlled by the container orchestrator. Always configure -> capability dropping in your `docker run` flags, Compose file, or Kubernetes -> `securityContext`. +:::{note} +The `Dockerfile` itself cannot enforce `--cap-drop` — that is a runtime concern controlled by the container orchestrator. +Always configure capability dropping in your `docker run` flags, Compose file, or Kubernetes `securityContext`. +:::🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.agents/skills/nemoclaw-deploy-remote/references/sandbox-hardening.md around lines 58 - 61, Replace the blockquote callout that begins with the bold "Note:" and the sentence about the Dockerfile (the text containing "The `Dockerfile` itself cannot enforce `--cap-drop` — that is a runtime concern controlled by the container orchestrator...") with a MyST admonition using :::{note} ... :::; keep the same content text and emphasis (inline code backticks for Dockerfile and flags) but wrap it inside :::{note} at the start and ::: at the end so the callout follows project guidelines..agents/skills/nemoclaw-get-started/SKILL.md (1)
10-13: Prerequisites section needs a concrete pointer or checklist.Right now it tells users to “check the prerequisites” but does not provide where. Add either a short list here or a direct link to the detailed prerequisites source.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.agents/skills/nemoclaw-get-started/SKILL.md around lines 10 - 13, Update the "## Prerequisites" section in SKILL.md to include a concrete checklist or a direct link instead of the vague instruction; specifically, replace the one-line paragraph under the "Prerequisites" header with either a short bullet list (e.g., required OS, minimum Python/Node versions, hardware/GPU requirements, and key dependencies) or a single actionable link to the canonical prerequisites doc (e.g., the project's README or a dedicated prerequisites page), so readers have an immediate, discoverable reference..agents/skills/nemoclaw-security-best/references/best-practices.md (1)
147-158: Consider clarifying the L4/L7 distinction.The explanation of L4-only vs L7 inspection is technically accurate but dense. The key sentence (lines 154-156) is over 100 words and packs multiple concepts: L4 enforcement mechanics, when to use
protocol: rest, TLS auto-detection, and the difference betweenrulesandaccesspresets.Consider breaking this into two rows or adding a brief example to help readers distinguish when to use each mode.
✍️ Possible clarification
For example, after line 157, you could add:
| Recommendation | Use `protocol: rest` with specific `rules` for REST APIs where you want method and path control. Use `protocol: rest` with `access: read-only` for read-only endpoints. Omit `protocol` only for non-HTTP protocols (WebSocket, gRPC streaming) or endpoints that do not need HTTP inspection. | + +**Example:** For `api.github.com`, use `protocol: rest` with `rules: [{methods: [GET], paths: [/repos/**]}]` to restrict to read-only repository access. For a WebSocket endpoint like `gateway.discord.com`, omit `protocol` to allow the connection without HTTP inspection.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.agents/skills/nemoclaw-security-best/references/best-practices.md around lines 147 - 158, The long sentence explaining L4-only vs L7 inspection (the paragraph discussing the `protocol` field, TLS auto-detection, and `rules` vs `access` presets) should be split into two clearer sentences: one that concisely describes L4-only enforcement mechanics and when to omit `protocol` (e.g., non-HTTP protocols or when only host/port/binary checks are needed), and a second that describes `protocol: rest` behavior (auto-detects/terminates TLS and enables per-request HTTP inspection) and how to apply `rules` versus the `access` presets (`full`, `read-only`, `read-write`). Also add a one-line example immediately after that paragraph showing a common case (e.g., "Use `protocol: rest` with `access: read-only` for GET-only REST APIs; omit `protocol` for WebSockets"), so readers can quickly see when to pick each mode.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.agents/skills/nemoclaw-deploy-remote/references/sandbox-hardening.md:
- Line 1: Add an SPDX license header as an HTML comment at the very top of this
Markdown file (before the "# Sandbox Image Hardening" heading); include the
appropriate identifier in the comment (for example: an HTML comment containing
"SPDX-License-Identifier: <YOUR-LICENSE>" such as "SPDX-License-Identifier:
Apache-2.0"). Ensure the header is the first thing in the file so it satisfies
the repository coding guidelines.
In @.agents/skills/nemoclaw-deploy-remote/SKILL.md:
- Line 3: Update the description string in SKILL.md by replacing the phrase
"securities hardening measures" with the singular adjective form "security
hardening measures" so the description reads "...Also covers security hardening
measures applied to the NemoClaw sandbox container image..." (search for the
description line containing "Provisions a remote GPU VM with NemoClaw using Brev
deployment" to locate the exact spot).
- Around line 23-33: The Quick Start text is ambiguous about remote vs local
context: update the SKILL.md paragraph that currently shows the sandbox flow
with the commands `nemoclaw my-assistant connect` and `openclaw tui` to
explicitly state that those commands assume you are already on the remote Brev
instance (or connected via SSH/session), and add a clear sentence directing
users who are on their local machine to run `nemoclaw deploy <instance-name>`
(or `nemoclaw my-assistant connect` after deploy) first before using `openclaw
tui`; ensure the wording references the commands `nemoclaw my-assistant
connect`, `nemoclaw deploy <instance-name>`, and `openclaw tui` so readers
understand the required remote precondition.
In @.agents/skills/nemoclaw-reference/SKILL.md:
- Line 1: Add the required SPDX license header to the top of the Markdown file
SKILL.md (placing it immediately after any YAML frontmatter if present). Insert
a single-line SPDX identifier like "SPDX-License-Identifier: MIT" (or the
project's chosen license identifier) at the top of the file so the file complies
with the project's licensing header rule.
- Line 3: The description field in SKILL.md contains a typo: replace the phrase
"fulls CLI reference" with "full CLI reference" in the description string so it
reads "...Also covers full CLI reference for slash commands and standalone
NemoClaw commands; configurations reference..." (update the description entry).
In @.agents/skills/nemoclaw-security-best/SKILL.md:
- Line 3: The skill description contains a grammar error: replace the phrase "As
risk framework for every configurable security control in NemoClaw: defaults,
what you can change, and what happens if you do." with "A risk framework for
every configurable security control in NemoClaw: defaults, what you can change,
and what happens if you do." — update the description field in SKILL.md
accordingly so it begins with "A risk framework…" instead of "As risk
framework…".
---
Outside diff comments:
In @.agents/skills/nemoclaw-monitor-sandbox/SKILL.md:
- Line 1: Add the required SPDX license header to
.agents/skills/nemoclaw-monitor-sandbox/SKILL.md by inserting a single line
"SPDX-License-Identifier: <LICENSE-ID>" immediately after any existing
frontmatter (or at the top if no frontmatter), replacing <LICENSE-ID> with the
project's license identifier (e.g., MIT, Apache-2.0); ensure there is exactly
one SPDX header line and no extra punctuation so the file complies with the
coding guidelines.
In @.agents/skills/nemoclaw-overview/references/how-it-works.md:
- Line 1: Add an SPDX license header as an HTML comment at the very top of the
Markdown file titled "How NemoClaw Works" (file
.agents/skills/nemoclaw-overview/references/how-it-works.md); insert a line like
<!-- SPDX-License-Identifier: <LICENSE-ID> --> (replace <LICENSE-ID> with the
appropriate license identifier) immediately before the "# How NemoClaw Works"
heading so the file complies with the project coding guidelines.
In @.agents/skills/nemoclaw-reference/references/inference-profiles.md:
- Line 1: Add an SPDX license header as an HTML comment at the very top of the
file (above the "# Inference Profiles" heading); insert a single line like <!--
SPDX-License-Identifier: <REPO_LICENSE> --> replacing <REPO_LICENSE> with the
repository's declared license identifier so the Markdown file includes the
required SPDX header.
In @.agents/skills/nemoclaw-reference/references/network-policies.md:
- Line 1: Add the required SPDX license header as an HTML comment at the very
top of the Markdown file to comply with guidelines: insert the provided SPDX
block (including SPDX-FileCopyrightText and SPDX-License-Identifier) before any
content in the "Network Policies" document so the header appears above the
existing "# Network Policies" title.
---
Nitpick comments:
In @.agents/skills/nemoclaw-deploy-remote/references/sandbox-hardening.md:
- Around line 58-61: Replace the blockquote callout that begins with the bold
"Note:" and the sentence about the Dockerfile (the text containing "The
`Dockerfile` itself cannot enforce `--cap-drop` — that is a runtime concern
controlled by the container orchestrator...") with a MyST admonition using
:::{note} ... :::; keep the same content text and emphasis (inline code
backticks for Dockerfile and flags) but wrap it inside :::{note} at the start
and ::: at the end so the callout follows project guidelines.
In @.agents/skills/nemoclaw-get-started/SKILL.md:
- Around line 10-13: Update the "## Prerequisites" section in SKILL.md to
include a concrete checklist or a direct link instead of the vague instruction;
specifically, replace the one-line paragraph under the "Prerequisites" header
with either a short bullet list (e.g., required OS, minimum Python/Node
versions, hardware/GPU requirements, and key dependencies) or a single
actionable link to the canonical prerequisites doc (e.g., the project's README
or a dedicated prerequisites page), so readers have an immediate, discoverable
reference.
In @.agents/skills/nemoclaw-overview/references/how-it-works.md:
- Line 20: The sentence "OpenShell handles *how* to sandbox an agent securely.
NemoClaw handles *what* goes in the sandbox and makes the setup accessible. For
the full system diagram, see Architecture (see the `nemoclaw-reference` skill)."
should be split so each sentence is on its own line in the file
.agents/skills/nemoclaw-overview/references/how-it-works.md; update the block
containing those three sentences so they become three separate lines, preserving
punctuation and inline formatting (e.g., *how*, *what*, and the
`nemoclaw-reference` code span) and nothing else.
In @.agents/skills/nemoclaw-security-best/references/best-practices.md:
- Around line 147-158: The long sentence explaining L4-only vs L7 inspection
(the paragraph discussing the `protocol` field, TLS auto-detection, and `rules`
vs `access` presets) should be split into two clearer sentences: one that
concisely describes L4-only enforcement mechanics and when to omit `protocol`
(e.g., non-HTTP protocols or when only host/port/binary checks are needed), and
a second that describes `protocol: rest` behavior (auto-detects/terminates TLS
and enables per-request HTTP inspection) and how to apply `rules` versus the
`access` presets (`full`, `read-only`, `read-write`). Also add a one-line
example immediately after that paragraph showing a common case (e.g., "Use
`protocol: rest` with `access: read-only` for GET-only REST APIs; omit
`protocol` for WebSockets"), so readers can quickly see when to pick each mode.
In `@AGENTS.md`:
- Line 86: Update the regenerating-skills command in the docs to use python3 for
consistency and portability: replace the line containing "Regenerate skills:
`python scripts/docs-to-skills.py docs/ .agents/skills/ --prefix nemoclaw`" with
one that calls `python3` instead, and ensure the change aligns with the
equivalent command in CLAUDE.md so both documents match.
In `@docs/security/best-practices.md`:
- Line 374: The sentence in the table under "Risk if relaxed" uses passive
voice; rewrite it in active voice so the subject performs the action (e.g.,
change "Disabling device auth allows any device on the network to connect to the
gateway without proving identity. This is dangerous when combined with LAN-bind
changes or cloudflared tunnels in remote deployments, resulting in an
unauthenticated, publicly reachable dashboard." to an active phrasing such as
"If you disable device auth, the gateway can no longer verify devices by hash,
allowing any device on the network to connect without proving identity; combined
with LAN-bind changes or cloudflared tunnels this can expose the dashboard
publicly."). Ensure the new sentence explicitly names the actor ("you" or "the
gateway") and replaces passive fragments like "verified by hash" with active
verbs like "the gateway verifies devices by hash" or similar.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 9bb2e183-2b10-4343-a554-6961eea42721
📒 Files selected for processing (20)
.agents/skills/nemoclaw-deploy-remote/SKILL.md.agents/skills/nemoclaw-deploy-remote/references/sandbox-hardening.md.agents/skills/nemoclaw-get-started/SKILL.md.agents/skills/nemoclaw-monitor-sandbox/SKILL.md.agents/skills/nemoclaw-overview/SKILL.md.agents/skills/nemoclaw-overview/references/how-it-works.md.agents/skills/nemoclaw-overview/references/overview.md.agents/skills/nemoclaw-overview/references/release-notes.md.agents/skills/nemoclaw-reference/SKILL.md.agents/skills/nemoclaw-reference/references/architecture.md.agents/skills/nemoclaw-reference/references/commands.md.agents/skills/nemoclaw-reference/references/inference-profiles.md.agents/skills/nemoclaw-reference/references/network-policies.md.agents/skills/nemoclaw-reference/references/troubleshooting.md.agents/skills/nemoclaw-security-best/SKILL.md.agents/skills/nemoclaw-security-best/references/best-practices.mdAGENTS.mdCLAUDE.mddocs/reference/commands.mddocs/security/best-practices.md
💤 Files with no reviewable changes (1)
- .agents/skills/nemoclaw-overview/references/release-notes.md
cv
approved these changes
Apr 2, 2026
cjagwani
pushed a commit
to fdzdev/NemoClaw
that referenced
this pull request
Apr 3, 2026
…VIDIA#1374) Do not review files under `.agent/`; those are regenerated. Changes to look are under `docs/`. - Add Gateway Authentication Controls section to security best practices covering device auth, insecure auth derivation, auto-pair allowlist, and CLI secret redaction (from commits 2804b74, cb668d7) - Add device auth mistake to Common Mistakes table - Update legacy `nemoclaw setup` to reflect delegation to onboard (7c3687e) - Fix docs-to-skills command in CLAUDE.md (correct output path, python3) - Regenerate agent skills <!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 sentences: what this PR does and why. --> ## Related Issue <!-- Link to the issue: Fixes #NNN or Closes #NNN. Remove this section if none. --> ## Changes <!-- Bullet list of key changes. --> ## Type of Change <!-- Check the one that applies. --> - [ ] Code change for a new feature, bug fix, or refactor. - [ ] Code change with doc updates. - [x] Doc only. Prose changes without code sample modifications. - [ ] Doc only. Includes code sample changes. ## Testing <!-- What testing was done? --> - [ ] `npx prek run --all-files` passes (or equivalently `make check`). - [ ] `npm test` passes. - [x] `make docs` builds without warnings. (for doc-only changes) ## Checklist ### General - [x] I have read and followed the [contributing guide](https://github.com/NVIDIA/NemoClaw/blob/main/CONTRIBUTING.md). - [x] I have read and followed the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). (for doc-only changes) ### Code Changes <!-- Skip if this is a doc-only PR. --> - [ ] Formatters applied — `npx prek run --all-files` auto-fixes formatting (or `make format` for targeted runs). - [ ] Tests added or updated for new or changed behavior. - [x] No secrets, API keys, or credentials committed. - [ ] Doc pages updated for any user-facing behavior changes (new commands, changed defaults, new features, bug fixes that contradict existing docs). ### Doc Changes <!-- Skip if this PR has no doc changes. --> - [x] Follows the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). Try running the `update-docs` agent skill to draft changes while complying with the style guide. For example, prompt your agent with "`/update-docs` catch up the docs for the new changes I made in this PR." - [ ] New pages include SPDX license header and frontmatter, if creating a new page. - [ ] Cross-references and links verified. --- <!-- DCO sign-off (required by CI). Replace with your real name and email. --> Signed-off-by: Your Name <your-email@example.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added onboarding flow (replaces legacy setup) and new CLI commands for help, debug, uninstall, eject, and quick-start connect to launch the TUI. * Expanded inference options with experimental local providers. * **Documentation** * New sandbox hardening and security best-practices guidance; expanded troubleshooting and architecture docs; updated CLI reference and usage examples; removed alpha warning language. * **Chores** * Adjusted docs organization and build/regeneration outputs; legacy setup delegates to onboarding. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
16 tasks
lakamsani
pushed a commit
to lakamsani/NemoClaw
that referenced
this pull request
Apr 4, 2026
…VIDIA#1374) Do not review files under `.agent/`; those are regenerated. Changes to look are under `docs/`. - Add Gateway Authentication Controls section to security best practices covering device auth, insecure auth derivation, auto-pair allowlist, and CLI secret redaction (from commits 2804b74, cb668d7) - Add device auth mistake to Common Mistakes table - Update legacy `nemoclaw setup` to reflect delegation to onboard (7c3687e) - Fix docs-to-skills command in CLAUDE.md (correct output path, python3) - Regenerate agent skills <!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 sentences: what this PR does and why. --> ## Related Issue <!-- Link to the issue: Fixes #NNN or Closes #NNN. Remove this section if none. --> ## Changes <!-- Bullet list of key changes. --> ## Type of Change <!-- Check the one that applies. --> - [ ] Code change for a new feature, bug fix, or refactor. - [ ] Code change with doc updates. - [x] Doc only. Prose changes without code sample modifications. - [ ] Doc only. Includes code sample changes. ## Testing <!-- What testing was done? --> - [ ] `npx prek run --all-files` passes (or equivalently `make check`). - [ ] `npm test` passes. - [x] `make docs` builds without warnings. (for doc-only changes) ## Checklist ### General - [x] I have read and followed the [contributing guide](https://github.com/NVIDIA/NemoClaw/blob/main/CONTRIBUTING.md). - [x] I have read and followed the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). (for doc-only changes) ### Code Changes <!-- Skip if this is a doc-only PR. --> - [ ] Formatters applied — `npx prek run --all-files` auto-fixes formatting (or `make format` for targeted runs). - [ ] Tests added or updated for new or changed behavior. - [x] No secrets, API keys, or credentials committed. - [ ] Doc pages updated for any user-facing behavior changes (new commands, changed defaults, new features, bug fixes that contradict existing docs). ### Doc Changes <!-- Skip if this PR has no doc changes. --> - [x] Follows the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). Try running the `update-docs` agent skill to draft changes while complying with the style guide. For example, prompt your agent with "`/update-docs` catch up the docs for the new changes I made in this PR." - [ ] New pages include SPDX license header and frontmatter, if creating a new page. - [ ] Cross-references and links verified. --- <!-- DCO sign-off (required by CI). Replace with your real name and email. --> Signed-off-by: Your Name <your-email@example.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added onboarding flow (replaces legacy setup) and new CLI commands for help, debug, uninstall, eject, and quick-start connect to launch the TUI. * Expanded inference options with experimental local providers. * **Documentation** * New sandbox hardening and security best-practices guidance; expanded troubleshooting and architecture docs; updated CLI reference and usage examples; removed alpha warning language. * **Chores** * Adjusted docs organization and build/regeneration outputs; legacy setup delegates to onboarding. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
gemini2026
pushed a commit
to gemini2026/NemoClaw
that referenced
this pull request
Apr 14, 2026
…VIDIA#1374) Do not review files under `.agent/`; those are regenerated. Changes to look are under `docs/`. - Add Gateway Authentication Controls section to security best practices covering device auth, insecure auth derivation, auto-pair allowlist, and CLI secret redaction (from commits 2804b74, cb668d7) - Add device auth mistake to Common Mistakes table - Update legacy `nemoclaw setup` to reflect delegation to onboard (7c3687e) - Fix docs-to-skills command in CLAUDE.md (correct output path, python3) - Regenerate agent skills <!-- markdownlint-disable MD041 --> ## Summary <!-- 1-3 sentences: what this PR does and why. --> ## Related Issue <!-- Link to the issue: Fixes #NNN or Closes #NNN. Remove this section if none. --> ## Changes <!-- Bullet list of key changes. --> ## Type of Change <!-- Check the one that applies. --> - [ ] Code change for a new feature, bug fix, or refactor. - [ ] Code change with doc updates. - [x] Doc only. Prose changes without code sample modifications. - [ ] Doc only. Includes code sample changes. ## Testing <!-- What testing was done? --> - [ ] `npx prek run --all-files` passes (or equivalently `make check`). - [ ] `npm test` passes. - [x] `make docs` builds without warnings. (for doc-only changes) ## Checklist ### General - [x] I have read and followed the [contributing guide](https://github.com/NVIDIA/NemoClaw/blob/main/CONTRIBUTING.md). - [x] I have read and followed the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). (for doc-only changes) ### Code Changes <!-- Skip if this is a doc-only PR. --> - [ ] Formatters applied — `npx prek run --all-files` auto-fixes formatting (or `make format` for targeted runs). - [ ] Tests added or updated for new or changed behavior. - [x] No secrets, API keys, or credentials committed. - [ ] Doc pages updated for any user-facing behavior changes (new commands, changed defaults, new features, bug fixes that contradict existing docs). ### Doc Changes <!-- Skip if this PR has no doc changes. --> - [x] Follows the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). Try running the `update-docs` agent skill to draft changes while complying with the style guide. For example, prompt your agent with "`/update-docs` catch up the docs for the new changes I made in this PR." - [ ] New pages include SPDX license header and frontmatter, if creating a new page. - [ ] Cross-references and links verified. --- <!-- DCO sign-off (required by CI). Replace with your real name and email. --> Signed-off-by: Your Name <your-email@example.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added onboarding flow (replaces legacy setup) and new CLI commands for help, debug, uninstall, eject, and quick-start connect to launch the TUI. * Expanded inference options with experimental local providers. * **Documentation** * New sandbox hardening and security best-practices guidance; expanded troubleshooting and architecture docs; updated CLI reference and usage examples; removed alpha warning language. * **Chores** * Adjusted docs organization and build/regeneration outputs; legacy setup delegates to onboarding. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Do not review files under
.agent/; those are regenerated.Changes to look are under
docs/.nemoclaw setupto reflect delegation to onboard (7c3687e)Summary
Related Issue
Changes
Type of Change
Testing
npx prek run --all-filespasses (or equivalentlymake check).npm testpasses.make docsbuilds without warnings. (for doc-only changes)Checklist
General
Code Changes
npx prek run --all-filesauto-fixes formatting (ormake formatfor targeted runs).Doc Changes
update-docsagent skill to draft changes while complying with the style guide. For example, prompt your agent with "/update-docscatch up the docs for the new changes I made in this PR."Signed-off-by: Your Name your-email@example.com
Summary by CodeRabbit
New Features
Documentation
Chores