chore(install): bump OpenShell version to 0.0.32

[prekshivyas]

Summary

Bumps the pinned OpenShell version range from 0.0.29 → 0.0.32 so fresh NemoClaw installs pick up sandbox hardening and TLS improvements from the last three OpenShell releases.

Notable upstream changes

0.0.30 (NVIDIA/OpenShell@v0.0.29...v0.0.30)

• Network policy deny rules (OpenShell#822)
• Preserve ownership on existing read_write paths (OpenShell#827)
• Disable child core dumps (OpenShell#821)
• Escape control characters in SSE error formatting (OpenShell#842)
• Fix silent truncation of large streaming inference responses (OpenShell#834)

0.0.31 (NVIDIA/OpenShell@v0.0.30...v0.0.31)

• Inference routed-request header allowlist (OpenShell#826)

0.0.32 (NVIDIA/OpenShell@v0.0.31...v0.0.32)

• Load system CA certificates for upstream TLS connections (OpenShell#862)
• Publish standalone openshell-gateway binaries (OpenShell#853)

Changes

• nemoclaw-blueprint/blueprint.yaml: min_openshell_version and max_openshell_version → 0.0.32
• scripts/install-openshell.sh: MIN_VERSION and MAX_VERSION → 0.0.32 (PIN_VERSION follows MAX)
• scripts/brev-launchable-ci-cpu.sh: default OPENSHELL_VERSION → v0.0.32
• src/lib/onboard.ts: blueprint-fallback min version → 0.0.32
• test/onboard.test.ts, test/install-openshell-version-check.test.ts: fixtures updated; "above MAX" test case moved from 0.0.30 to 0.0.33

Historical m-dev comments referencing 0.0.29 left in place — they describe a self-report quirk the sidecar fallback still handles.

Why not 0.0.33+?

0.0.34 introduced incremental sandbox policy updates and L7 request-target canonicalization — changes with larger surface area against how NemoClaw delivers policy via gRPC. Worth a follow-up PR rather than bundling here. 0.0.35 released hours before this PR was cut — too fresh.

Type of Change

• Code change for a new feature, bug fix, or refactor.

Testing

• npx vitest run test/install-openshell-version-check.test.ts — 9 passed
• pre-commit hooks (prek) clean: shellcheck, commitlint, gitleaks, YAML validator, CLI test suite
• Nightly E2E on this branch — will be kicked off after PR opens

Notes

• No user-facing CLI behavior changes — just the pinned version range.
• Two pre-existing failures in test/onboard.test.ts reproduce on clean main and are unrelated to this bump.

Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Updated OpenShell version constraints and default pinned version to v0.0.32 across configuration, install, and onboarding flows.

• Tests

  • Updated test fixtures and expectations to match the new OpenShell version (v0.0.32).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8c63f33f-73b9-4229-9a25-1cd54a6048db

📥 Commits

Reviewing files that changed from the base of the PR and between 43d4a79 and 6c088cd.

📒 Files selected for processing (1)

• src/lib/onboard.ts

---

📝 Walkthrough

Walkthrough

Consistent OpenShell version bump from 0.0.29 to 0.0.32 across blueprint metadata, install/CI scripts, onboarding preflight fallback, and corresponding tests.

Changes

Cohort / File(s)	Summary
Blueprint nemoclaw-blueprint/blueprint.yaml	Updated min_openshell_version and max_openshell_version from 0.0.29 → 0.0.32.
Scripts scripts/brev-launchable-ci-cpu.sh, scripts/install-openshell.sh	Bumped default/pinned OPENSHELL_VERSION and MIN/MAX version checks from v0.0.29 → v0.0.32.
Application logic src/lib/onboard.ts	Adjusted preflight fallback minimum OpenShell version threshold from 0.0.29 → 0.0.32, affecting upgrade decision when blueprint is unreadable.
Tests test/install-openshell-version-check.test.ts, test/onboard.test.ts	Updated fixtures and assertions to expect 0.0.32 (and related test inputs like 0.0.33) instead of 0.0.29.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I nudged the version—soft and spry,
From .29 to .32 I fly,
Through blueprints, scripts, and tests I hop,
A tidy bump—then off I stop! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: bumping the OpenShell version from 0.0.29 to 0.0.32 across all configuration and installation files.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch prekshi/bump-openshell-0.0.32

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[prekshivyas]

This bump may close:

• [WSL/Ubuntu] openshell --version reports "m-dev" instead of actual version after curl | bash install #2266 — openshell --version reports "m-dev" — fixed upstream by NVIDIA/OpenShell#843, shipped in v0.0.31.
• Agents create folder structure but never write files — output truncated mid-response #501 — Agents create folder structure but never write files — output truncated mid-response — fixed upstream by NVIDIA/OpenShell#834, shipped in v0.0.30. Reporter's logs show the error reading upstream response chunk warning at exactly 60s after each request start, matching the reqwest total-request timeout bug Add openclaw sessions reset <session-id> subcommand #834 fixes.

Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

[ericksoa]

Clean version bump, all references consistent. Good rationale for stopping at 0.0.32 and deferring 0.0.34+. LGTM.