chore(install): bump OpenShell version to 0.0.32

nemoclaw-blueprint/blueprint.yaml

@@ -2,8 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 version: "0.1.0"
-min_openshell_version: "0.0.29"
-max_openshell_version: "0.0.29"
+min_openshell_version: "0.0.32"
+max_openshell_version: "0.0.32"
 min_openclaw_version: "2026.4.2"
 # Mirrors the components.sandbox.image manifest digest below. Lets a
 # downstream consumer (or release tooling) verify the blueprint declares

scripts/brev-launchable-ci-cpu.sh

@@ -28,7 +28,7 @@
 #   curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/<ref>/scripts/brev-launchable-ci-cpu.sh | bash
 #
 # Environment overrides:
-#   OPENSHELL_VERSION     — OpenShell CLI release tag (default: v0.0.29)
+#   OPENSHELL_VERSION     — OpenShell CLI release tag (default: v0.0.32)
 #   NEMOCLAW_REF          — NemoClaw git ref to clone (default: main)
 #   NEMOCLAW_CLONE_DIR    — Where to clone NemoClaw (default: ~/NemoClaw)
 #   SKIP_DOCKER_PULL      — Set to 1 to skip Docker image pre-pulls
@@ -40,7 +40,7 @@
 set -euo pipefail
 
 # ── Configuration ────────────────────────────────────────────────────
-OPENSHELL_VERSION="${OPENSHELL_VERSION:-v0.0.29}"
+OPENSHELL_VERSION="${OPENSHELL_VERSION:-v0.0.32}"
 NEMOCLAW_REF="${NEMOCLAW_REF:-main}"
 TARGET_USER="${SUDO_USER:-$(id -un)}"
 TARGET_HOME="$(getent passwd "$TARGET_USER" | cut -d: -f6)"

scripts/install-openshell.sh

@@ -36,10 +36,10 @@ info "Detected $OS_LABEL ($ARCH_LABEL)"
 # Minimum version required for Landlock filesystem policy enforcement
 # (NVIDIA/OpenShell#810 fixes the drop_privileges/Landlock ordering bug
 # that caused /sandbox to remain writable on 0.0.26).
-MIN_VERSION="0.0.29"
+MIN_VERSION="0.0.32"
 # Maximum version validated for this NemoClaw release. Newer OpenShell builds
 # may change sandbox semantics; upgrade NemoClaw before upgrading past this.
-MAX_VERSION="0.0.29"
+MAX_VERSION="0.0.32"
 # Pin fresh installs to this version instead of pulling "latest".
 PIN_VERSION="$MAX_VERSION"
 

src/lib/onboard.ts

@@ -2689,7 +2689,7 @@ async function preflight() {
       // Source of truth: min_openshell_version in nemoclaw-blueprint/blueprint.yaml.
       // Fall back to the Landlock-enforcement floor (also MIN_VERSION in
       // scripts/install-openshell.sh) if the blueprint cannot be read.
-      const minOpenshellVersion = getBlueprintMinOpenshellVersion() ?? "0.0.29";
+      const minOpenshellVersion = getBlueprintMinOpenshellVersion() ?? "0.0.32";
       const needsUpgrade = !versionGte(currentVersion, minOpenshellVersion);
       if (needsUpgrade) {
         console.log(

test/install-openshell-version-check.test.ts

@@ -59,10 +59,10 @@ exit 1`,
 }
 
 describe("install-openshell.sh version check", () => {
-  it("exits cleanly when openshell 0.0.29 is already installed", () => {
-    const result = runWithInstalledVersion("0.0.29");
+  it("exits cleanly when openshell 0.0.32 is already installed", () => {
+    const result = runWithInstalledVersion("0.0.32");
     expect(result.status).toBe(0);
-    expect(result.stdout).toMatch(/already installed.*0\.0\.29/);
+    expect(result.stdout).toMatch(/already installed.*0\.0\.32/);
   });
 
   it("triggers upgrade when openshell 0.0.28 is installed (below MIN_VERSION)", () => {
@@ -85,7 +85,7 @@ describe("install-openshell.sh version check", () => {
   });
 
   it("fails with a clear error when openshell is above MAX_VERSION", () => {
-    const result = runWithInstalledVersion("0.0.30");
+    const result = runWithInstalledVersion("0.0.33");
     expect(result.status).toBe(1);
     expect(result.stdout).toMatch(/above the maximum/);
   });
@@ -96,13 +96,13 @@ describe("install-openshell.sh version check", () => {
     expect(result.stdout).toMatch(/above the maximum/);
   });
 
-  it("exits cleanly when openshell reports m-dev but sidecar records 0.0.29", () => {
+  it("exits cleanly when openshell reports m-dev but sidecar records 0.0.32", () => {
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-openshell-mdev-"));
     try {
       const fakeBin = path.join(tmp, "bin");
       fs.mkdirSync(fakeBin);
 
-      // Fake openshell that reports "m-dev" (as openshell 0.0.29 does in practice)
+      // Fake openshell that reports "m-dev" (as some OpenShell dev builds do)
       writeExecutable(
         path.join(fakeBin, "openshell"),
         `#!/usr/bin/env bash
@@ -111,7 +111,7 @@ exit 99`,
       );
 
       // Sidecar file written by a previous install
-      fs.writeFileSync(path.join(fakeBin, ".openshell-installed-version"), "0.0.29\n");
+      fs.writeFileSync(path.join(fakeBin, ".openshell-installed-version"), "0.0.32\n");
 
       writeExecutable(path.join(fakeBin, "curl"), `#!/usr/bin/env bash\nexit 1`);
       writeExecutable(path.join(fakeBin, "gh"), `#!/usr/bin/env bash\nexit 1`);
@@ -121,7 +121,7 @@ exit 99`,
         encoding: "utf8",
       });
       expect(result.status).toBe(0);
-      expect(result.stdout).toMatch(/already installed.*0\.0\.29/);
+      expect(result.stdout).toMatch(/already installed.*0\.0\.32/);
     } finally {
       fs.rmSync(tmp, { recursive: true, force: true });
     }

test/onboard.test.ts

@@ -929,13 +929,13 @@ describe("onboard helpers", () => {
       path.join(blueprintDir, "blueprint.yaml"),
       [
         'version: "0.1.0"',
-        'min_openshell_version: "0.0.29"',
-        'max_openshell_version: "0.0.29"',
+        'min_openshell_version: "0.0.32"',
+        'max_openshell_version: "0.0.32"',
         'min_openclaw_version: "2026.3.0"',
       ].join("\n"),
     );
     try {
-      expect(getBlueprintMaxOpenshellVersion(tmpDir)).toBe("0.0.29");
+      expect(getBlueprintMaxOpenshellVersion(tmpDir)).toBe("0.0.32");
     } finally {
       fs.rmSync(tmpDir, { recursive: true, force: true });
     }