diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md index 4c0c6d28f74..7e9b52523f9 100644 --- a/docs/CONTRIBUTING.md +++ b/docs/CONTRIBUTING.md @@ -39,12 +39,15 @@ The current generated skills and their source pages are: | Skill | Source docs | |---|---| | `nemoclaw-user-overview` | `docs/about/overview.md`, `docs/about/ecosystem.md`, `docs/about/how-it-works.md`, `docs/about/release-notes.md` | -| `nemoclaw-user-get-started` | `docs/get-started/quickstart.md`, `docs/get-started/quickstart-hermes.md` | -| `nemoclaw-user-configure-inference` | `docs/inference/inference-options.md`, `docs/inference/use-local-inference.md`, `docs/inference/switch-inference-providers.md` | -| `nemoclaw-user-manage-policy` | `docs/network-policy/customize-network-policy.md`, `docs/network-policy/approve-network-requests.md` | +| `nemoclaw-user-agent-skills` | `docs/resources/agent-skills.md` | +| `nemoclaw-user-deploy-remote` | `docs/deployment/deploy-to-remote-gpu.md`, `docs/deployment/install-openclaw-plugins.md`, `docs/deployment/sandbox-hardening.md` | +| `nemoclaw-user-get-started` | `docs/get-started/prerequisites.md`, `docs/get-started/quickstart.md`, `docs/get-started/quickstart-hermes.md`, `docs/get-started/windows-preparation.md` | +| `nemoclaw-user-configure-inference` | `docs/inference/inference-options.md`, `docs/inference/use-local-inference.md`, `docs/inference/switch-inference-providers.md`, `docs/inference/set-up-sub-agent.md` | +| `nemoclaw-user-manage-sandboxes` | `docs/manage-sandboxes/lifecycle.md`, `docs/manage-sandboxes/messaging-channels.md`, `docs/manage-sandboxes/workspace-files.md`, `docs/manage-sandboxes/backup-restore.md` | | `nemoclaw-user-monitor-sandbox` | `docs/monitoring/monitor-sandbox-activity.md` | -| `nemoclaw-user-deploy-remote` | `docs/deployment/deploy-to-remote-gpu.md`, `docs/deployment/set-up-telegram-bridge.md` | +| `nemoclaw-user-manage-policy` | `docs/network-policy/customize-network-policy.md`, `docs/network-policy/approve-network-requests.md` | | `nemoclaw-user-reference` | `docs/reference/architecture.md`, `docs/reference/commands.md`, `docs/reference/network-policies.md`, `docs/reference/troubleshooting.md` | +| `nemoclaw-user-configure-security` | `docs/security/best-practices.md`, `docs/security/credential-storage.md`, `docs/security/openclaw-controls.md` | ### Regenerating skills after doc changes diff --git a/docs/conf.py b/docs/conf.py index 7ddcdc5a909..44d789023b6 100644 --- a/docs/conf.py +++ b/docs/conf.py @@ -48,6 +48,11 @@ # tutorials/dgx-spark pages were removed; DGX Spark content now lives # in the NVIDIA Spark playbook (https://build.nvidia.com/spark/nemoclaw). "get-started/windows-setup": "windows-preparation.html", + # Manage Sandboxes reorganization (May 2026): operational pages moved + # from deployment/ and workspace/ into manage-sandboxes/. + "deployment/set-up-telegram-bridge": "../manage-sandboxes/messaging-channels.html", + "workspace/workspace-files": "../manage-sandboxes/workspace-files.html", + "workspace/backup-restore": "../manage-sandboxes/backup-restore.html", } autodoc_default_options = { diff --git a/docs/deployment/deploy-to-remote-gpu.md b/docs/deployment/deploy-to-remote-gpu.md index b23e3460193..0b981e9df00 100644 --- a/docs/deployment/deploy-to-remote-gpu.md +++ b/docs/deployment/deploy-to-remote-gpu.md @@ -12,6 +12,8 @@ content: type: how_to difficulty: intermediate audience: ["developer", "engineer"] +skill: + priority: 10 status: published --- @@ -152,6 +154,6 @@ $ nemoclaw deploy ## Related Topics -- [Set Up Telegram](set-up-telegram-bridge.md) to connect Telegram through OpenShell-managed channel messaging. +- [Set Up Messaging Channels](../manage-sandboxes/messaging-channels.md) to connect Telegram, Discord, or Slack through OpenShell-managed channel messaging. - [Monitor Sandbox Activity](../monitoring/monitor-sandbox-activity.md) for sandbox monitoring tools. - [Commands](../reference/commands.md) for the full `deploy` command reference. diff --git a/docs/deployment/install-openclaw-plugins.md b/docs/deployment/install-openclaw-plugins.md index e1a2db80537..27457243646 100644 --- a/docs/deployment/install-openclaw-plugins.md +++ b/docs/deployment/install-openclaw-plugins.md @@ -12,6 +12,8 @@ content: type: how_to difficulty: technical_intermediate audience: ["developer", "engineer"] +skill: + priority: 20 status: published --- diff --git a/docs/deployment/set-up-telegram-bridge.md b/docs/deployment/set-up-telegram-bridge.md deleted file mode 100644 index 9ce329177bb..00000000000 --- a/docs/deployment/set-up-telegram-bridge.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: - page: "Set Up Telegram with NemoClaw and OpenShell" - nav: "Set Up Telegram" -description: - main: "Connect Telegram to your sandboxed OpenClaw agent using OpenShell-managed channel messaging configured during onboarding." - agent: "Explains how Telegram reaches the sandboxed OpenClaw agent through OpenShell-managed processes and onboarding-time channel configuration. Use when setting up Telegram, a chat interface, or messaging integration without relying on nemoclaw tunnel start for bridges." -keywords: ["nemoclaw telegram", "telegram bot openclaw agent", "openshell channel messaging"] -topics: ["generative_ai", "ai_agents"] -tags: ["openclaw", "openshell", "telegram", "deployment", "nemoclaw"] -content: - type: how_to - difficulty: intermediate - audience: ["developer", "engineer"] -status: published ---- - - - -# Set Up Telegram - -Telegram, Discord, and Slack reach your agent through OpenShell-managed processes and gateway constructs. -NemoClaw configures those channels during `nemoclaw onboard`. Tokens are registered with OpenShell providers, channel configuration is baked into the sandbox image, and runtime delivery stays under OpenShell control. - -`nemoclaw tunnel start` does not start Telegram (or other chat bridges). It only starts optional host services such as the cloudflared tunnel when that binary is present. (`nemoclaw start` is kept as a deprecated alias.) -For details, refer to [Commands](../reference/commands.md). - -## Prerequisites - -- A machine where you can run `nemoclaw onboard` (local or remote host that runs the gateway and sandbox). -- A Telegram bot token from [BotFather](https://t.me/BotFather). - -## Create a Telegram Bot - -Open Telegram and send `/newbot` to [@BotFather](https://t.me/BotFather). -Follow the prompts to create a bot and copy the bot token. - -## Provide the Bot Token and Optional Allowlist - -Onboarding reads Telegram credentials from either host environment variables or the NemoClaw credential store (`getCredential` / `saveCredential` in the onboard flow). You do not have to export variables if you enter the token when the wizard asks. - -### Option A: Environment variables (CI, scripts, or before you start the wizard) - -```console -$ export TELEGRAM_BOT_TOKEN= -``` - -Optional comma-separated allowlist (maps to the wizard field “Telegram User ID (for DM access)”): - -```console -$ export TELEGRAM_ALLOWED_IDS="123456789,987654321" -``` - -### Option B: Interactive `nemoclaw onboard` - -When the wizard reaches **Messaging channels**, it lists Telegram, Discord, and Slack. -Press **1** to toggle Telegram on or off, then **Enter** when done. -If the token is not already in the environment or credential store, the wizard prompts for it and saves it to the store. -If `TELEGRAM_ALLOWED_IDS` is not set, the wizard can prompt for allowed sender IDs for Telegram DMs (you can leave this blank and rely on OpenClaw pairing instead). -NemoClaw applies that allowlist to Telegram DMs only. -Group chats stay open by default so rebuilt sandboxes do not silently drop Telegram group messages because of an empty group allowlist. - -## Run `nemoclaw onboard` - -Complete the rest of the wizard so the blueprint can create OpenShell providers (for example `-telegram-bridge`), bake channel configuration into the image (`NEMOCLAW_MESSAGING_CHANNELS_B64`), and start the sandbox. - -Channel entries in `/sandbox/.openclaw/openclaw.json` are baked into the container image at build time. Changes made inside the running sandbox do not persist across rebuilds. - -If you add or change `TELEGRAM_BOT_TOKEN` (or toggle channels) after a sandbox already exists, you typically need to run `nemoclaw onboard` again so the image and provider attachments are rebuilt with the new settings. - -NemoClaw stores a SHA-256 hash of each messaging token in the sandbox registry at creation time. -When you re-run `nemoclaw onboard --non-interactive` with a new token, NemoClaw detects the change, backs up workspace state, deletes the sandbox, recreates it with the new credential, and restores the backup. -This makes credential rotation safe to script. - -Telegram, Discord, and Slack each allow only one active consumer per bot token. -If you enable a messaging channel and another sandbox already uses the same token, onboard prompts you to confirm before continuing in interactive mode and exits non-zero in non-interactive mode. -`nemoclaw status` also reports cross-sandbox overlaps so you can resolve duplicates before messages start dropping. - -For a full first-time flow, refer to [Quickstart](../get-started/quickstart.md). - -## Confirm Delivery - -After the sandbox is running, send a message to your bot in Telegram. -If something fails, use `openshell term` on the host, check gateway logs, and verify network policy allows the Telegram API (see [Customize the Network Policy](../network-policy/customize-network-policy.md) and the `telegram` preset). - -## `nemoclaw tunnel start` (cloudflared Only) - -`nemoclaw tunnel start` starts cloudflared when it is installed, which can expose the dashboard with a public URL. -It does not affect Telegram connectivity. The older `nemoclaw start` still works as a deprecated alias. - -```console -$ nemoclaw tunnel start -``` - -To pause the Telegram bridge without removing its credentials or destroying the sandbox, use `nemoclaw channels stop telegram`. Re-enable it later with `nemoclaw channels start telegram`. - -## Related Topics - -- [Deploy NemoClaw to a Remote GPU Instance](deploy-to-remote-gpu.md) for remote deployment with messaging. -- [Architecture](../reference/architecture.md) for how providers, the gateway, and the sandbox fit together. -- [Commands](../reference/commands.md) for `tunnel start`, `tunnel stop`, `channels start`, `channels stop`, and `status`. diff --git a/docs/get-started/quickstart-hermes.md b/docs/get-started/quickstart-hermes.md index f999197f338..fd198fa7113 100644 --- a/docs/get-started/quickstart-hermes.md +++ b/docs/get-started/quickstart-hermes.md @@ -166,5 +166,5 @@ $ nemohermes my-hermes destroy - [Inference Options](../inference/inference-options.md) to choose a provider and model. - [Commands](../reference/commands.md) to see the full `nemohermes` alias behavior. -- [Backup and Restore](../workspace/backup-restore.md) to preserve sandbox state before destructive operations. +- [Backup and Restore](../manage-sandboxes/backup-restore.md) to preserve sandbox state before destructive operations. - [Monitor Sandbox Activity](../monitoring/monitor-sandbox-activity.md) to inspect OpenShell events and sandbox logs. diff --git a/docs/get-started/quickstart.md b/docs/get-started/quickstart.md index 377a9f12eb3..a7f8d23d2f8 100644 --- a/docs/get-started/quickstart.md +++ b/docs/get-started/quickstart.md @@ -78,7 +78,7 @@ Local Ollama appears only when NemoClaw detects Ollama on the host. :::{tip} Export the API key before launching the installer so the wizard does not have to ask for it. For example, run `export NVIDIA_API_KEY=` before `curl ... | bash`. -If you entered a key incorrectly, refer to [Reset a Stored Credential](#reset-a-stored-credential) to clear and re-enter it. +If you entered a key incorrectly, refer to [Reset a Stored Credential](../manage-sandboxes/lifecycle.md#reset-a-stored-credential) to clear and re-enter it. ::: :::{dropdown} Option 1: NVIDIA Endpoints @@ -276,7 +276,11 @@ Logs: nemoclaw my-gpt-claw logs --follow If you picked a different option, the `Model` line shows that provider's model and label instead. For example, you might see `gpt-5.4 (OpenAI)`, `claude-sonnet-4-6 (Anthropic)`, `gemini-2.5-flash (Google Gemini)`, `llama3.1:8b (Local Ollama)`, or ` (Other OpenAI-compatible endpoint)`. -## Open the OpenClaw UI in a Browser +## Run Your First Agent Prompt + +You can chat with the agent from the terminal or the browser. + +### Open the OpenClaw UI in a Browser to Chat with the Agent The onboard wizard starts a background port forward to the sandbox dashboard, then prints a tokenized URL in the install summary. The default host port is `18789`. @@ -294,193 +298,24 @@ Open the printed URL in your browser. The `#token=` fragment authenticates the browser to the sandbox gateway, so save the URL securely and treat it like a password. NemoClaw prints the token only once. -### Restart the Port Forward - -If the forward stopped, or the installer reported that no active forward was found and the URL does not load, restart it manually with the port from the install summary. - -```console -$ openshell forward start --background my-gpt-claw -``` - -To list active forwards across all sandboxes, run the following command. - -```console -$ openshell forward list -``` - -### Run Multiple Sandboxes - -Each sandbox needs its own dashboard port, since `openshell forward` refuses to bind a port that another sandbox is already using. -When the default port is already held by another sandbox, `nemoclaw onboard` scans ports `18789` through `18799` and uses the next free port. - -```console -$ nemoclaw onboard # first sandbox uses 18789 -$ nemoclaw onboard # second sandbox uses the next free port, such as 18790 -``` - -To choose a specific port, pass `--control-ui-port`: - -```console -$ nemoclaw onboard --control-ui-port 19000 -``` - -You can also set `CHAT_UI_URL` or `NEMOCLAW_DASHBOARD_PORT` before onboarding: - -```console -$ CHAT_UI_URL=http://127.0.0.1:19000 nemoclaw onboard -$ NEMOCLAW_DASHBOARD_PORT=19000 nemoclaw onboard -``` - -For full details on port conflicts and overrides, refer to [Port already in use](../reference/troubleshooting.md#port-already-in-use). - -### Open the UI from a Remote Host - -If NemoClaw is running on a remote GPU instance and you want to open the UI from a laptop, refer to [Remote Dashboard Access](../deployment/deploy-to-remote-gpu.md#remote-dashboard-access). Set `CHAT_UI_URL` to the origin the browser uses before running onboard, so the gateway's CORS allowlist accepts the remote browser. +### Chat with the Agent from the Terminal -## Chat with the Agent from the Terminal - -If you prefer a terminal-based chat, connect to the sandbox and use the OpenClaw CLI. +Connect to the sandbox and use the OpenClaw CLI. ```bash nemoclaw my-assistant connect ``` -In the sandbox shell, open the OpenClaw terminal UI and start a chat. - -```bash -openclaw tui -``` - -Alternatively, send a single message and print the response. +In the sandbox shell, send a single message and print the response. ```bash openclaw agent --agent main --local -m "hello" --session-id test ``` -## Reconfigure or Recover - -Recover from a misconfigured sandbox without re-running the full onboard wizard or destroying workspace state. - -### Change Inference Model or API - -Change the active model or provider at runtime without rebuilding the sandbox: - -```console -$ openshell inference set -g nemoclaw --model --provider -``` - -Refer to [Switch inference providers](../inference/switch-inference-providers.md) for provider-specific model IDs and API compatibility notes. - -### Reset a Stored Credential - -If a provider credential was entered incorrectly during onboarding, clear the gateway-registered value and re-enter it on the next onboard run: - -```console -$ nemoclaw credentials list # see which providers are registered -$ nemoclaw credentials reset # clear a single provider, for example nvidia-prod -$ nemoclaw onboard # re-run to re-enter the cleared provider -``` - -The credentials command is documented in full at [`nemoclaw credentials reset `](../reference/commands.md#nemoclaw-credentials-reset-provider). - -### Rebuild a Sandbox While Preserving Workspace State - -If you changed the underlying Dockerfile, upgraded OpenClaw, or want to pick up a new base image without losing your sandbox's workspace files, use `rebuild` instead of destroying and recreating: - -```console -$ nemoclaw rebuild -``` - -Rebuild preserves the mounted workspace and registered policies while recreating the container. Refer to [`nemoclaw rebuild`](../reference/commands.md#nemoclaw-name-rebuild) for flag details. - -### Add a Network Preset After Onboarding - -Apply an additional preset (for example, Telegram or GitHub) to a running sandbox without re-onboarding: - -```console -$ nemoclaw policy-add -``` - -Refer to [`nemoclaw policy-add`](../reference/commands.md#nemoclaw-name-policy-add) for usage details and flags. - -## Update to the Latest Version - -When a new NemoClaw release becomes available, update the `nemoclaw` CLI on your host and check existing sandboxes for stale agent/runtime versions. - -### Update the NemoClaw CLI - -Re-run the installer. -Before it onboards anything, the installer calls [`nemoclaw backup-all`](../reference/commands.md#nemoclaw-backup-all) automatically, storing a snapshot of each running sandbox in `~/.nemoclaw/rebuild-backups/` as a safety net. - -```console -$ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash -``` - -### Upgrade sandboxes with stale agent and runtime versions - -The installer checks registered sandboxes after onboarding succeeds and runs `nemoclaw upgrade-sandboxes --auto` for stale running sandboxes. Use `upgrade-sandboxes` directly to verify the result, rebuild when you skipped the installer or onboarding step, or handle sandboxes that were stopped or could not be version-checked. The upgrade flow is non-destructive by default because NemoClaw preserves manifest-defined workspace state, but a manual snapshot before any major upgrade gives you a state restore point. - -**Safe upgrade flow:** - -```console -$ nemoclaw snapshot create --name pre-upgrade # optional, recommended -$ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash # updates CLI; auto-upgrades stale running sandboxes -$ nemoclaw upgrade-sandboxes --check # verify or list remaining stale/unknown sandboxes -$ nemoclaw upgrade-sandboxes # manually rebuild remaining stale running sandboxes -``` - -For scripted manual rebuilds, use `nemoclaw upgrade-sandboxes --auto` to skip the confirmation prompt. - -If the upgraded sandbox needs its workspace state reverted, restore the pre-upgrade snapshot into the running sandbox. This restores saved state directories only; it does not downgrade the sandbox image or agent/runtime: - -```console -$ nemoclaw snapshot restore pre-upgrade -``` - -#### What changes during a rebuild - -Each rebuild destroys the existing container and creates a new one. NemoClaw protects your data through the same backup-and-restore flow as [`nemoclaw rebuild`](../reference/commands.md#nemoclaw-name-rebuild): - -- NemoClaw preserves manifest-defined workspace state. Before deleting the old container, NemoClaw snapshots the state directories defined in the agent manifest (typically `/sandbox/.openclaw/workspace/`) and restores them into the new container. Stored credentials (`~/.nemoclaw/credentials.json`) and registered policy presets live on the host and are re-applied to the new sandbox automatically. -- NemoClaw does not preserve runtime changes outside the workspace state directories. This includes packages installed inside the running container with `apt` or `pip`, files in non-workspace paths, and in-memory or process state. If you have customized the running container at runtime, capture that as `Dockerfile` changes (for `nemoclaw onboard --from`) or a manual `openshell sandbox download` before the rebuild starts. - -Aborts before the destroy step are non-destructive. The flow refuses to proceed past preflight if a credential is missing (see below) or past backup if the snapshot fails (with `"Aborting rebuild to prevent data loss"`), so a botched run leaves the original sandbox intact and ready to retry. - -See [Backup and Restore](../workspace/backup-restore.md) for the full list of state-preservation guarantees, snapshot retention, and instructions for manual backups when the auto-flow is not enough. - -:::{note} If the rebuild aborts with `Missing credential: ` -The rebuild preflight reads the provider credential recorded by your last `nemoclaw onboard` session. If you have switched providers since onboarding (for example, from a remote API to a local Ollama setup) the preflight may still reference the old key and fail before any destroy step runs. - -To recover, re-run `nemoclaw onboard` and select your current provider. This refreshes the session metadata. Your existing container keeps serving traffic until the new image is ready. -::: - -## Uninstall - -To remove NemoClaw and all resources created during setup, run the CLI's built-in uninstall command: - -```bash -nemoclaw uninstall -``` - -| Flag | Effect | -|--------------------|-----------------------------------------------------| -| `--yes` | Skip the confirmation prompt. | -| `--keep-openshell` | Leave the `openshell` binary installed. | -| `--delete-models` | Also remove NemoClaw-pulled Ollama models. | - -`nemoclaw uninstall` runs the version-pinned `uninstall.sh` that shipped with your installed CLI, so it does not fetch anything over the network at uninstall time. - -If the `nemoclaw` CLI is missing or broken, fall back to the hosted script: - -```bash -curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/refs/heads/main/uninstall.sh | bash -``` - -For a full comparison of the two forms — what they fetch, what they trust, and when to prefer each — see [`nemoclaw uninstall` vs. the hosted `uninstall.sh`](../reference/commands.md#nemoclaw-uninstall-vs-the-hosted-uninstallsh). - ## Next Steps - [NemoHermes Quickstart](quickstart-hermes.md) to launch Hermes instead of the default OpenClaw agent. +- [Manage NemoClaw sandboxes](../manage-sandboxes/lifecycle.md) for port forwards, rebuilds, upgrades, and uninstall. - [Switch inference providers](../inference/switch-inference-providers.md) to use a different model or endpoint. - [Approve or deny network requests](../network-policy/approve-network-requests.md) when the agent tries to reach external hosts. - [Customize the network policy](../network-policy/customize-network-policy.md) to pre-approve trusted domains. diff --git a/docs/index.md b/docs/index.md index ad0d6636a4b..623d13d16e9 100644 --- a/docs/index.md +++ b/docs/index.md @@ -243,7 +243,7 @@ Egress control, operator approval flow, and policy configuration. ::: :::{grid-item-card} Workspace Files -:link: workspace/workspace-files +:link: manage-sandboxes/workspace-files :link-type: doc Understand `SOUL.md`, `USER.md`, and other workspace files, plus backup and restore. @@ -322,20 +322,21 @@ Set Up Task-Specific Sub-Agents ``` ```{toctree} -:caption: Network Policy +:caption: Manage Sandboxes :hidden: -Approve or Deny Network Requests -Customize the Network Policy +Manage Sandbox Lifecycle +Set Up Messaging Channels +Workspace Files +Backup and Restore ``` ```{toctree} -:caption: Security +:caption: Network Policy :hidden: -Security Best Practices -Credential Storage -OpenClaw Controls +Approve or Deny Network Requests +Customize the Network Policy ``` ```{toctree} @@ -343,24 +344,24 @@ OpenClaw Controls :hidden: Deploy to a Remote GPU Instance -Set Up Telegram Install OpenClaw Plugins Sandbox Hardening ``` ```{toctree} -:caption: Workspace +:caption: Monitoring :hidden: -Workspace Files -Backup & Restore +Monitor Sandbox Activity ``` ```{toctree} -:caption: Monitoring +:caption: Security :hidden: -Monitor Sandbox Activity +Security Best Practices +Credential Storage +OpenClaw Controls ``` ```{toctree} diff --git a/docs/inference/set-up-sub-agent.md b/docs/inference/set-up-sub-agent.md index 69c22c9b94b..f6413f5ba9b 100644 --- a/docs/inference/set-up-sub-agent.md +++ b/docs/inference/set-up-sub-agent.md @@ -12,6 +12,8 @@ content: type: how_to difficulty: technical_intermediate audience: ["developer", "engineer"] +skill: + priority: 30 status: published --- @@ -137,4 +139,4 @@ Use the following resources for more information: - Refer to [OpenClaw Sub-Agents](https://docs.openclaw.ai/tools/subagents) for `sessions_spawn`, `agents.list`, nesting, tool policy, and auth behavior. - Refer to [Switch Inference Providers](switch-inference-providers.md) to change the primary orchestration model instead of adding a sub-agent model. -- Refer to [Workspace Files](../workspace/workspace-files.md) to understand per-agent workspace directories. +- Refer to [Workspace Files](../manage-sandboxes/workspace-files.md) to understand per-agent workspace directories. diff --git a/docs/inference/switch-inference-providers.md b/docs/inference/switch-inference-providers.md index 166db80b533..894a3e491b3 100644 --- a/docs/inference/switch-inference-providers.md +++ b/docs/inference/switch-inference-providers.md @@ -12,6 +12,8 @@ content: type: how_to difficulty: technical_beginner audience: ["developer", "engineer"] +skill: + priority: 20 status: published --- diff --git a/docs/inference/use-local-inference.md b/docs/inference/use-local-inference.md index c17db167a2d..9bd2f9f0c13 100644 --- a/docs/inference/use-local-inference.md +++ b/docs/inference/use-local-inference.md @@ -12,6 +12,8 @@ content: type: how_to difficulty: intermediate audience: ["developer", "engineer"] +skill: + priority: 10 status: published --- diff --git a/docs/workspace/backup-restore.md b/docs/manage-sandboxes/backup-restore.md similarity index 99% rename from docs/workspace/backup-restore.md rename to docs/manage-sandboxes/backup-restore.md index e1cc012a72a..a5406e1991e 100644 --- a/docs/workspace/backup-restore.md +++ b/docs/manage-sandboxes/backup-restore.md @@ -1,7 +1,7 @@ --- title: page: "Backup and Restore Workspace Files" - nav: "Backup & Restore" + nav: "Backup and Restore" description: main: "How to back up and restore OpenClaw workspace files before destructive operations." agent: "Backs up and restores OpenClaw workspace files before destructive operations such as sandbox rebuilds. Use when downloading workspace files from a sandbox, uploading restored files into a new sandbox, or preserving sandbox state across rebuilds." @@ -12,6 +12,8 @@ content: type: how_to difficulty: technical_beginner audience: ["developer", "engineer"] +skill: + priority: 20 status: published --- diff --git a/docs/manage-sandboxes/lifecycle.md b/docs/manage-sandboxes/lifecycle.md new file mode 100644 index 00000000000..b1cdacc2de3 --- /dev/null +++ b/docs/manage-sandboxes/lifecycle.md @@ -0,0 +1,222 @@ +--- +title: + page: "Manage Sandbox Lifecycle" + nav: "Manage Sandbox Lifecycle" +description: + main: "Open the sandbox UI, manage dashboard ports, reconfigure providers, rebuild safely, upgrade sandboxes, and uninstall NemoClaw." + agent: "Explains operational tasks after the quickstart: browser access, port forwards, multiple sandboxes, credential reset, rebuilds, network presets, upgrades, and uninstall." +keywords: ["manage nemoclaw sandboxes", "nemoclaw dashboard port", "nemoclaw rebuild", "nemoclaw upgrade sandboxes", "nemoclaw uninstall"] +topics: ["generative_ai", "ai_agents"] +tags: ["openclaw", "openshell", "sandboxing", "operations", "nemoclaw"] +content: + type: how_to + difficulty: intermediate + audience: ["developer", "engineer"] +skill: + priority: 10 +status: published +--- + + + +# Manage Sandbox Lifecycle + +Use this guide after you finish the [OpenClaw quickstart](../get-started/quickstart.md). +It covers day-two sandbox operations such as managing ports, rebuilding safely, upgrading, and uninstalling. + +## Restart the Port Forward + +If the forward stopped, or the installer reported that no active forward was found and the URL does not load, restart it manually with the port from the install summary. + +```console +$ openshell forward start --background my-gpt-claw +``` + +To list active forwards across all sandboxes, run the following command. + +```console +$ openshell forward list +``` + +## Run Multiple Sandboxes + +Each sandbox needs its own dashboard port, since `openshell forward` refuses to bind a port that another sandbox is already using. +When the default port is already held by another sandbox, `nemoclaw onboard` scans ports `18789` through `18799` and uses the next free port. + +```console +$ nemoclaw onboard # first sandbox uses 18789 +$ nemoclaw onboard # second sandbox uses the next free port, such as 18790 +``` + +To choose a specific port, pass `--control-ui-port`: + +```console +$ nemoclaw onboard --control-ui-port 19000 +``` + +You can also set `CHAT_UI_URL` or `NEMOCLAW_DASHBOARD_PORT` before onboarding: + +```console +$ CHAT_UI_URL=http://127.0.0.1:19000 nemoclaw onboard +$ NEMOCLAW_DASHBOARD_PORT=19000 nemoclaw onboard +``` + +For full details on port conflicts and overrides, refer to [Port already in use](../reference/troubleshooting.md#port-already-in-use). + +## Chat with the Agent from the Terminal + +Connect to the sandbox and use the OpenClaw terminal UI. + +```bash +nemoclaw my-assistant connect +``` + +In the sandbox shell, open the OpenClaw terminal UI and start a chat. + +```bash +openclaw tui +``` + +To send a single message and print the response instead, run: + +```bash +openclaw agent --agent main --local -m "hello" --session-id test +``` + +## Reconfigure or Recover + +Recover from a misconfigured sandbox without re-running the full onboard wizard or destroying workspace state. + +### Change Inference Model or API + +Change the active model or provider at runtime without rebuilding the sandbox: + +```console +$ openshell inference set -g nemoclaw --model --provider +``` + +Refer to [Switch Inference Providers](../inference/switch-inference-providers.md) for provider-specific model IDs and API compatibility notes. + +### Reset a Stored Credential + +If a provider credential was entered incorrectly during onboarding, clear the gateway-registered value and re-enter it on the next onboard run: + +```console +$ nemoclaw credentials list # see which providers are registered +$ nemoclaw credentials reset # clear a single provider, for example nvidia-prod +$ nemoclaw onboard # re-run to re-enter the cleared provider +``` + +The credentials command is documented in full at [`nemoclaw credentials reset `](../reference/commands.md#nemoclaw-credentials-reset-provider). + +### Rebuild a Sandbox While Preserving Workspace State + +If you changed the underlying Dockerfile, upgraded OpenClaw, or want to pick up a new base image without losing your sandbox's workspace files, use `rebuild` instead of destroying and recreating: + +```console +$ nemoclaw rebuild +``` + +Rebuild preserves the mounted workspace and registered policies while recreating the container. +Refer to [`nemoclaw rebuild`](../reference/commands.md#nemoclaw-name-rebuild) for flag details. + +### Add a Network Preset After Onboarding + +Apply an additional preset, such as Telegram or GitHub, to a running sandbox without re-onboarding: + +```console +$ nemoclaw policy-add +``` + +Refer to [`nemoclaw policy-add`](../reference/commands.md#nemoclaw-name-policy-add) for usage details and flags. + +## Update to the Latest Version + +When a new NemoClaw release becomes available, update the `nemoclaw` CLI on your host and check existing sandboxes for stale agent/runtime versions. + +### Update the NemoClaw CLI + +Re-run the installer. +Before it onboards anything, the installer calls [`nemoclaw backup-all`](../reference/commands.md#nemoclaw-backup-all) automatically, storing a snapshot of each running sandbox in `~/.nemoclaw/rebuild-backups/` as a safety net. + +```console +$ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash +``` + +### Upgrade Sandboxes with Stale Agent and Runtime Versions + +The installer checks registered sandboxes after onboarding succeeds and runs `nemoclaw upgrade-sandboxes --auto` for stale running sandboxes. +Use `upgrade-sandboxes` directly to verify the result, rebuild when you skipped the installer or onboarding step, or handle sandboxes that were stopped or could not be version-checked. +The upgrade flow is non-destructive by default because NemoClaw preserves manifest-defined workspace state, but a manual snapshot before any major upgrade gives you a state restore point. + +```console +$ nemoclaw snapshot create --name pre-upgrade # optional, recommended +$ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash # updates CLI; auto-upgrades stale running sandboxes +$ nemoclaw upgrade-sandboxes --check # verify or list remaining stale/unknown sandboxes +$ nemoclaw upgrade-sandboxes # manually rebuild remaining stale running sandboxes +``` + +For scripted manual rebuilds, use `nemoclaw upgrade-sandboxes --auto` to skip the confirmation prompt. + +If the upgraded sandbox needs its workspace state reverted, restore the pre-upgrade snapshot into the running sandbox. +This restores saved state directories only; it does not downgrade the sandbox image or agent/runtime: + +```console +$ nemoclaw snapshot restore pre-upgrade +``` + +### What Changes During a Rebuild + +Each rebuild destroys the existing container and creates a new one. +NemoClaw protects your data through the same backup-and-restore flow as [`nemoclaw rebuild`](../reference/commands.md#nemoclaw-name-rebuild): + +- NemoClaw preserves manifest-defined workspace state. Before deleting the old container, NemoClaw snapshots the state directories defined in the agent manifest, typically `/sandbox/.openclaw/workspace/`, and restores them into the new container. Stored credentials (`~/.nemoclaw/credentials.json`) and registered policy presets live on the host and are re-applied to the new sandbox automatically. +- NemoClaw does not preserve runtime changes outside the workspace state directories. This includes packages installed inside the running container with `apt` or `pip`, files in non-workspace paths, and in-memory or process state. If you have customized the running container at runtime, capture that as `Dockerfile` changes for `nemoclaw onboard --from` or a manual `openshell sandbox download` before the rebuild starts. + +Aborts before the destroy step are non-destructive. +The flow refuses to proceed past preflight if a credential is missing or past backup if the snapshot fails with `"Aborting rebuild to prevent data loss"`, so a failed run leaves the original sandbox intact and ready to retry. + +See [Backup and Restore](backup-restore.md) for the full list of state-preservation guarantees, snapshot retention, and instructions for manual backups when the auto-flow is not enough. + +:::{note} If the rebuild aborts with `Missing credential: ` +The rebuild preflight reads the provider credential recorded by your last `nemoclaw onboard` session. +If you have switched providers since onboarding, for example from a remote API to a local Ollama setup, the preflight may still reference the old key and fail before any destroy step runs. + +To recover, re-run `nemoclaw onboard` and select your current provider. +This refreshes the session metadata. +Your existing container keeps serving traffic until the new image is ready. +::: + +## Uninstall + +To remove NemoClaw and all resources created during setup, run the CLI's built-in uninstall command: + +```bash +nemoclaw uninstall +``` + +| Flag | Effect | +|--------------------|------------------------------------------------------| +| `--yes` | Skip the confirmation prompt. | +| `--keep-openshell` | Leave the `openshell` binary installed. | +| `--delete-models` | Also remove NemoClaw-pulled Ollama models. | + +`nemoclaw uninstall` runs the version-pinned `uninstall.sh` that shipped with your installed CLI, so it does not fetch anything over the network at uninstall time. + +If the `nemoclaw` CLI is missing or broken, fall back to the hosted script: + +```bash +curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/refs/heads/main/uninstall.sh | bash +``` + +For a full comparison of the two forms, including what they fetch, what they trust, and when to prefer each, see [`nemoclaw uninstall` vs. the hosted `uninstall.sh`](../reference/commands.md#nemoclaw-uninstall-vs-the-hosted-uninstallsh). + +## Related Topics + +- [Set Up Messaging Channels](messaging-channels.md) to connect Telegram, Discord, or Slack. +- [Workspace Files](workspace-files.md) for persistent OpenClaw files inside the sandbox. +- [Backup and Restore](backup-restore.md) for snapshot and restore workflows. +- [Monitor Sandbox Activity](../monitoring/monitor-sandbox-activity.md) for observability tools. diff --git a/docs/manage-sandboxes/messaging-channels.md b/docs/manage-sandboxes/messaging-channels.md new file mode 100644 index 00000000000..db14d70d184 --- /dev/null +++ b/docs/manage-sandboxes/messaging-channels.md @@ -0,0 +1,175 @@ +--- +title: + page: "Set Up Messaging Channels with NemoClaw and OpenShell" + nav: "Set Up Messaging Channels" +description: + main: "Connect Telegram, Discord, or Slack to your sandboxed OpenClaw agent using OpenShell-managed channel messaging." + agent: "Explains how Telegram, Discord, and Slack reach the sandboxed OpenClaw agent through OpenShell-managed processes and NemoClaw channel commands. Use when setting up messaging channels, chat interfaces, or integrations without relying on nemoclaw tunnel start for bridges." +keywords: ["nemoclaw messaging channels", "nemoclaw telegram", "nemoclaw discord", "nemoclaw slack", "openshell channel messaging"] +topics: ["generative_ai", "ai_agents"] +tags: ["openclaw", "openshell", "telegram", "discord", "slack", "messaging", "deployment", "nemoclaw"] +content: + type: how_to + difficulty: intermediate + audience: ["developer", "engineer"] +skill: + priority: 30 +status: published +--- + + + +# Messaging Channels + +Telegram, Discord, and Slack reach your agent through OpenShell-managed processes and gateway constructs. +NemoClaw registers channel tokens with OpenShell providers, bakes the selected channel configuration into the sandbox image, and keeps runtime delivery under OpenShell control. + +You can enable channels during `nemoclaw onboard` or add them later with host-side `nemoclaw channels` commands. +Do not run `openclaw channels add` or `openclaw channels remove` inside the sandbox because `/sandbox/.openclaw/openclaw.json` is generated at image build time and changes inside the running container do not persist across rebuilds. + +`nemoclaw tunnel start` does not start Telegram, Discord, Slack, or other chat bridges. +It only starts optional host services such as the cloudflared tunnel when that binary is present. (`nemoclaw start` is kept as a deprecated alias.) +For details, refer to [Commands](../reference/commands.md). + +## Prerequisites + +- A machine where you can run `nemoclaw onboard` (local or remote host that runs the gateway and sandbox). +- A token for each messaging platform you want to enable. +- A network policy preset for each enabled channel, or equivalent custom egress rules. + +## Channel Requirements + +| Channel | Required tokens | Optional settings | +|---------|-----------------|-------------------| +| Telegram | `TELEGRAM_BOT_TOKEN` | `TELEGRAM_ALLOWED_IDS` for DM allowlisting | +| Discord | `DISCORD_BOT_TOKEN` | `DISCORD_SERVER_ID`, `DISCORD_USER_ID`, `DISCORD_REQUIRE_MENTION` | +| Slack | `SLACK_BOT_TOKEN`, `SLACK_APP_TOKEN` | None | + +Telegram uses a bot token from [BotFather](https://t.me/BotFather). +Open Telegram, send `/newbot` to [@BotFather](https://t.me/BotFather), follow the prompts, and copy the token. +`TELEGRAM_ALLOWED_IDS` is a comma-separated list of Telegram user IDs for DM access. +Group chats stay open by default so rebuilt sandboxes do not silently drop Telegram group messages because of an empty group allowlist. + +Discord uses a bot token from the Discord Developer Portal. +For server channels, enable Developer Mode in Discord, right-click the server, and copy the Server ID into `DISCORD_SERVER_ID`. +By default, NemoClaw configures the bot to reply only when mentioned. +Set `DISCORD_REQUIRE_MENTION=0` if you want it to reply to all messages in the configured server. +Set `DISCORD_USER_ID` to restrict access to one user; otherwise, any member of the configured server can message the bot. + +Slack uses Socket Mode and requires two tokens. +Use `SLACK_BOT_TOKEN` for the bot user OAuth token (`xoxb-...`) and `SLACK_APP_TOKEN` for the app-level Socket Mode token (`xapp-...`). + +## Enable Channels During Onboarding + +When the wizard reaches **Messaging channels**, it lists Telegram, Discord, and Slack. +Press a channel number to toggle it on or off, then press **Enter** when done. +If a token is not already in the environment or credential store, the wizard prompts for it and saves it. + +For scripted setup, export the credentials and optional settings for the channels you want to enable before you run onboarding: + +```console +$ export TELEGRAM_BOT_TOKEN= +$ export DISCORD_BOT_TOKEN= +$ export DISCORD_SERVER_ID= +$ export SLACK_BOT_TOKEN= +$ export SLACK_APP_TOKEN= +``` + +Then run onboarding: + +```console +$ nemoclaw onboard +``` + +Complete the rest of the wizard so the blueprint can create OpenShell providers (for example `-telegram-bridge`), bake channel configuration into the image (`NEMOCLAW_MESSAGING_CHANNELS_B64`), and start the sandbox. + +## Add Channels After Onboarding + +Run channel commands from the host, not from inside the sandbox. +Use `channels list` to see the supported channel names: + +```console +$ nemoclaw my-assistant channels list +``` + +Add the channel you want: + +```console +$ nemoclaw my-assistant channels add telegram +$ nemoclaw my-assistant channels add discord +$ nemoclaw my-assistant channels add slack +``` + +`channels add` prompts for missing credentials, registers the bridge with the OpenShell gateway, updates the sandbox registry, and asks whether to rebuild immediately. +Choose the rebuild so the running sandbox image picks up the new channel. +If you need optional channel settings such as `TELEGRAM_ALLOWED_IDS`, `DISCORD_SERVER_ID`, `DISCORD_USER_ID`, or `DISCORD_REQUIRE_MENTION`, export them before the rebuild starts. +If you defer the rebuild, apply the change later: + +```console +$ nemoclaw my-assistant rebuild +``` + +In non-interactive mode, set the required environment variables before running `channels add`. +Missing credentials fail fast, and the command queues the change for a manual rebuild: + +```console +$ NEMOCLAW_NON_INTERACTIVE=1 TELEGRAM_BOT_TOKEN= \ + nemoclaw my-assistant channels add telegram +$ nemoclaw my-assistant rebuild +``` + +For Discord server access after onboarding, include the server settings when you add the channel and rebuild: + +```console +$ DISCORD_BOT_TOKEN= \ + DISCORD_SERVER_ID= \ + DISCORD_REQUIRE_MENTION=1 \ + nemoclaw my-assistant channels add discord +``` + +## Rotate or Remove Credentials + +Running `channels add` for a channel that is already configured overwrites the stored tokens and registers the updated bridge provider. +Rebuild the sandbox after the update so the image reflects the current channel set. + +To remove a channel and clear its stored credentials, run: + +```console +$ nemoclaw my-assistant channels remove telegram +``` + +Use `channels stop` when you want to pause a bridge without deleting credentials: + +```console +$ nemoclaw my-assistant channels stop telegram +$ nemoclaw my-assistant channels start telegram +``` + +Telegram, Discord, and Slack each allow only one active consumer per bot token. +If you enable a messaging channel and another sandbox already uses the same token, onboarding prompts you to confirm before continuing in interactive mode and exits non-zero in non-interactive mode. +`nemoclaw status` reports cross-sandbox overlaps so you can resolve duplicates before messages start dropping. + +## Confirm Delivery + +After the sandbox is running, send a message to the configured bot or app. +If delivery fails, use `openshell term` on the host, check gateway logs, and verify network policy allows the channel API. +Use the matching policy preset (`telegram`, `discord`, or `slack`) or review [Customize the Network Policy](../network-policy/customize-network-policy.md). + +## Tunnel Command + +`nemoclaw tunnel start` starts cloudflared when it is installed, which can expose the dashboard with a public URL. +It does not affect messaging channel connectivity. +The older `nemoclaw start` still works as a deprecated alias. + +```console +$ nemoclaw tunnel start +``` + +## Related Topics + +- [Deploy NemoClaw to a Remote GPU Instance](../deployment/deploy-to-remote-gpu.md) for remote deployment with messaging. +- [Architecture](../reference/architecture.md) for how providers, the gateway, and the sandbox fit together. +- [Commands](../reference/commands.md) for `channels add`, `channels remove`, `channels start`, `channels stop`, `tunnel start`, `tunnel stop`, and `status`. diff --git a/docs/workspace/workspace-files.md b/docs/manage-sandboxes/workspace-files.md similarity index 78% rename from docs/workspace/workspace-files.md rename to docs/manage-sandboxes/workspace-files.md index cec5dca16bb..7307fb381d2 100644 --- a/docs/workspace/workspace-files.md +++ b/docs/manage-sandboxes/workspace-files.md @@ -88,20 +88,23 @@ shared-file tooling (shared mount, `workspaces list` command) in ## Persistence Behavior -Understanding when these files persist and when they are lost is critical. +Workspace files live in the sandbox's persistent state volume, not in the container image. +This means they survive normal container restarts, but they are deleted when you destroy the sandbox. -### Survives: Sandbox Restart +### Preserved During Restart, Rebuild, and Upgrade -Sandbox restarts (`openshell sandbox restart`) preserve workspace files. -The sandbox uses a **Persistent Volume Claim (PVC)** that outlives individual container restarts. +Sandbox restarts preserve workspace files because the persistent state volume outlives individual container restarts. -### Lost: Sandbox Destroy +The `nemoclaw rebuild` command and the sandbox upgrade flow also preserve workspace state. +Before replacing the container, NemoClaw snapshots the workspace state directories and restores them into the rebuilt sandbox. -Running `nemoclaw destroy` **deletes the sandbox and its PVC**. -All workspace files are permanently lost unless you back them up first. +### Deleted During Sandbox Destroy + +Running `nemoclaw destroy` deletes the sandbox and its persistent state volume. +Workspace files are removed from the sandbox unless you created a snapshot or backup first. :::{warning} -Always back up your workspace files before running `nemoclaw destroy`. +Back up your workspace files before running `nemoclaw destroy`. See [Backup and Restore](backup-restore.md) for instructions. ::: @@ -110,8 +113,8 @@ See [Backup and Restore](backup-restore.md) for instructions. The agent reads these files at the start of every session. You can edit them in two ways: -1. **Let the agent do it** — Ask your agent to update its persona, memory, or user context. -2. **Edit manually** — Use `openshell sandbox shell` to open a terminal inside the sandbox and edit files directly, or use `openshell sandbox upload` to push edited files from your host. +1. Let the agent do it. Ask your agent to update its persona, memory, or user context. +2. Edit manually. Use `openshell sandbox shell` to open a terminal inside the sandbox and edit files directly, or use `openshell sandbox upload` to push edited files from your host. ## Next Steps diff --git a/docs/monitoring/monitor-sandbox-activity.md b/docs/monitoring/monitor-sandbox-activity.md index 3e427ecc294..770309469b7 100644 --- a/docs/monitoring/monitor-sandbox-activity.md +++ b/docs/monitoring/monitor-sandbox-activity.md @@ -12,6 +12,8 @@ content: type: how_to difficulty: technical_beginner audience: ["developer", "engineer"] +skill: + priority: 10 status: published --- diff --git a/docs/network-policy/approve-network-requests.md b/docs/network-policy/approve-network-requests.md index e765377984c..7e5ec3f52e0 100644 --- a/docs/network-policy/approve-network-requests.md +++ b/docs/network-policy/approve-network-requests.md @@ -12,6 +12,8 @@ content: type: how_to difficulty: technical_beginner audience: ["developer", "engineer", "security_engineer"] +skill: + priority: 20 status: published --- diff --git a/docs/network-policy/customize-network-policy.md b/docs/network-policy/customize-network-policy.md index aac0f9ae283..462053f0cdc 100644 --- a/docs/network-policy/customize-network-policy.md +++ b/docs/network-policy/customize-network-policy.md @@ -12,6 +12,8 @@ content: type: how_to difficulty: intermediate audience: ["developer", "engineer", "security_engineer"] +skill: + priority: 10 status: published --- diff --git a/docs/reference/commands.md b/docs/reference/commands.md index 3375f926af5..bb813bf1eaa 100644 --- a/docs/reference/commands.md +++ b/docs/reference/commands.md @@ -333,8 +333,8 @@ For Ollama-backed sandboxes, `destroy` also asks Ollama to unload currently load :::{warning} This command permanently deletes the sandbox **and its persistent volume**. -All [workspace files](../workspace/workspace-files.md) (SOUL.md, USER.md, IDENTITY.md, AGENTS.md, MEMORY.md, and daily memory notes) are lost. -Back up your workspace first with `nemoclaw snapshot create` or see [Backup and Restore](../workspace/backup-restore.md). +All [workspace files](../manage-sandboxes/workspace-files.md) (SOUL.md, USER.md, IDENTITY.md, AGENTS.md, MEMORY.md, and daily memory notes) are lost. +Back up your workspace first with `nemoclaw snapshot create` or see [Backup and Restore](../manage-sandboxes/backup-restore.md). If you want to upgrade the sandbox while preserving state, use `nemoclaw rebuild` instead. ::: diff --git a/docs/reference/troubleshooting.md b/docs/reference/troubleshooting.md index 2930ea79a6f..a2c53551e63 100644 --- a/docs/reference/troubleshooting.md +++ b/docs/reference/troubleshooting.md @@ -477,7 +477,7 @@ Follow these steps to reconnect. If the sandbox remains missing after restarting the gateway, run `nemoclaw onboard` to recreate it. The wizard prompts for confirmation before destroying an existing sandbox. If you confirm, it **destroys and recreates** the sandbox. Workspace files (SOUL.md, USER.md, IDENTITY.md, AGENTS.md, MEMORY.md, and daily memory notes) are lost. -Back up your workspace first by following the instructions at [Back Up and Restore](../workspace/backup-restore.md). +Back up your workspace first by following the instructions at [Back Up and Restore](../manage-sandboxes/backup-restore.md). ::: ### Sandbox is running an outdated agent version