Docs/comprehensive documentation cleanup and v0.0.44 synchronization

docs/about/ecosystem.mdx

@@ -78,7 +78,7 @@ The following table compares the two paths.
 | Image hardening | The community image includes standard system tools for general-purpose use. | NemoClaw strips build toolchains (`gcc`, `g++`, `make`) and network probes (`netcat`) from the runtime image to reduce attack surface. |
 | Filesystem policy | The community sandbox bundles a policy for OpenClaw. | NemoClaw defines a targeted read-only and read-write layout. System paths (`/usr`, `/lib`, `/etc`) are read-only. The agent's home directory (`/sandbox`) and config directory (`/sandbox/.openclaw`) are writable by default so the agent can manage config, install skills, and write to standard paths natively. |
 | Inference setup | The community sandbox includes an `openclaw-start` script that runs OpenClaw's onboarding wizard inside the sandbox. You can also create providers and configure OpenShell inference routing manually from the host. | NemoClaw's onboarding wizard validates your credential from the host, lets you select a provider (NVIDIA Endpoints, OpenAI, Anthropic, Google Gemini, Ollama, and compatible endpoints), and configures OpenShell's inference routing automatically. Credentials stay on the host and are delivered through OpenShell's provider system. |
-| Channel messaging | OpenShell provides the credential provider system and L7 proxy that delivers channel tokens securely (including path-based resolution for Telegram's `/bot<token>/` URL pattern). You create providers and configure OpenClaw's channel settings manually. | NemoClaw automates channel setup during onboarding: it collects bot tokens, registers them as OpenShell providers, and bakes OpenClaw channel config with placeholder tokens that OpenShell's proxy resolves at egress. No separate bridge process runs on the host. |
+| Channel messaging | OpenShell provides the credential provider system and L7 proxy that delivers channel tokens securely (including path-based resolution for Telegram's `/bot<token>/` URL pattern). You create providers and configure OpenClaw's channel settings manually. | NemoClaw automates channel setup during onboarding: it collects bot tokens (Telegram, Discord, Slack, WeChat), registers them as OpenShell providers, and bakes OpenClaw channel config with placeholder tokens that OpenShell's proxy resolves at egress. No separate bridge process runs on the host. |
 | Blueprint versioning | No blueprint. The community sandbox uses whatever image version is currently published. | NemoClaw downloads the blueprint artifact, checks version compatibility, and verifies its digest before applying. Running `nemoclaw onboard` on different machines produces the same sandbox. |
 | State migration | Not included. | NemoClaw migrates agent state across machines with credential stripping and integrity verification. |
 | Process count limits | OpenShell applies seccomp and privilege dropping. You set process count limits manually with `--ulimit` or orchestrator config. | NemoClaw applies `ulimit -u 512` in the container entrypoint to cap the process count and mitigate fork-bomb attacks, on top of OpenShell's seccomp and privilege dropping. |

docs/about/overview.mdx

@@ -32,7 +32,7 @@ NemoClaw provides the following product capabilities.
 | Guided onboarding | Validates credentials, selects providers, and creates a working sandbox in one command. |
 | Hardened blueprint | A security-first Dockerfile with capability drops, least-privilege network rules, and declarative policy. |
 | State management | Safe migration of agent state across machines with credential stripping and integrity verification. |
-| Messaging channels | OpenShell-managed processes connect Telegram, Discord, Slack, and similar platforms to the sandboxed agent. NemoClaw configures channels during onboarding; OpenShell supplies the native constructs, credential flow, and runtime supervision. |
+| Messaging channels | OpenShell-managed processes connect Telegram, Discord, Slack, WeChat, and similar platforms to the sandboxed agent. NemoClaw configures channels during onboarding; OpenShell supplies the native constructs, credential flow, and runtime supervision. |
 | Routed inference | Provider-routed model calls through the OpenShell gateway, transparent to the agent. Supports NVIDIA Endpoints, OpenAI, Anthropic, Google Gemini, compatible endpoints, local Ollama, local vLLM, and the Model Router. |
 | Layered protection | Network, filesystem, process, and inference controls that can be hot-reloaded or locked at creation. |
 

docs/get-started/quickstart.mdx

@@ -69,7 +69,10 @@ If you export `NEMOCLAW_DISABLE_DEVICE_AUTH` after onboarding finishes, it has n
 
 ### Respond to the Onboard Wizard
 
-After the installer launches `nemoclaw onboard`, the wizard runs preflight checks, starts or reuses the OpenShell gateway, and asks for an inference provider, sandbox name, optional web search, optional messaging channels, and network policy presets.
+After the installer launches `nemoclaw onboard`, the wizard runs preflight checks and starts or reuses the OpenShell gateway.
+It asks for an inference provider, prompts for an API key when one is missing, then asks for the model and sandbox name.
+It shows a review summary for confirmation.
+After confirmation, it prompts for web search, messaging, and network policy presets.
 At any prompt, press Enter to accept the default shown in `[brackets]`, type `back` to return to the previous prompt, or type `exit` to quit.
 If existing sandbox sessions are running, the installer warns before onboarding because the setup can rebuild or upgrade sandboxes after the new sandbox launches.
 
@@ -82,9 +85,11 @@ The inference provider prompt presents a numbered list.
   4) Anthropic
   5) Other Anthropic-compatible endpoint
   6) Google Gemini
-  7) Local Ollama (localhost:11434)
+  7) Local Ollama (localhost:11434) - running (suggested)
   8) Model Router (experimental)
   Choose [1]:
+
+Ollama displays the running suffix only when it is detected and running.
 ```
 
 Pick the option that matches where you want inference traffic to go, then expand the matching helper below for the follow-up prompts and the API key environment variable to set.
@@ -108,7 +113,7 @@ Respond to the wizard as follows.
 
 1. At the `Choose [1]:` prompt, press Enter (or type `1`) to select **NVIDIA Endpoints**.
 2. At the `NVIDIA_API_KEY:` prompt, paste your key if it is not already exported.
-3. At the `Choose model [1]:` prompt, pick a curated model from the list (for example, `Nemotron 3 Super 120B`, `GLM-5`, `MiniMax M2.7`, `GPT-OSS 120B`, or `DeepSeek V4 Pro`), or pick `Other...` to enter any model ID from the [NVIDIA Endpoints catalog](https://build.nvidia.com).
+3. At the `Choose model [1]:` prompt, pick a model from the dynamic list (populated based on the provider) shown in the wizard, or pick `Other...` to enter any model ID from the [NVIDIA Endpoints catalog](https://build.nvidia.com).
 
 NemoClaw validates the model against the catalog API before creating the sandbox.
 
@@ -127,8 +132,6 @@ Respond to the wizard as follows.
 
 1. At the `Choose [1]:` prompt, type `2` to select **OpenAI**.
 2. At the `OPENAI_API_KEY:` prompt, paste your key if it is not already exported.
-3. At the `Choose model [1]:` prompt, pick a curated model (for example, `gpt-5.4`, `gpt-5.4-mini`, `gpt-5.4-nano`, or `gpt-5.4-pro-2026-03-05`), or pick **Other...** to enter any OpenAI model ID.
-</Accordion>
 
 <Accordion title="Option 3: Other OpenAI-Compatible Endpoint">
 
@@ -163,8 +166,6 @@ Respond to the wizard as follows.
 
 1. At the `Choose [1]:` prompt, type `4` to select **Anthropic**.
 2. At the `ANTHROPIC_API_KEY:` prompt, paste your key if it is not already exported.
-3. At the `Choose model [1]:` prompt, pick a curated model (for example, `claude-sonnet-4-6`, `claude-haiku-4-5`, or `claude-opus-4-6`), or pick **Other...** to enter any Claude model ID.
-</Accordion>
 
 <Accordion title="Option 5: Other Anthropic-Compatible Endpoint">
 
@@ -190,20 +191,19 @@ Respond to the wizard as follows.
 
 1. At the `Choose [1]:` prompt, type `6` to select **Google Gemini**.
 2. At the `GEMINI_API_KEY:` prompt, paste your key if it is not already exported.
-3. At the `Choose model [5]:` prompt, pick a curated model (for example, `gemini-3.1-pro-preview`, `gemini-3.1-flash-lite-preview`, `gemini-3-flash-preview`, `gemini-2.5-pro`, `gemini-2.5-flash`, or `gemini-2.5-flash-lite`), or pick **Other...** to enter any Gemini model ID.
-</Accordion>
 
 <Accordion title="Option 7: Local Ollama">
 
 Routes inference to a local Ollama instance. Depending on your platform, the wizard can use an existing daemon, start an installed daemon, or offer an install action.
 
 No API key is required. On non-WSL hosts, NemoClaw generates a token and starts an authenticated proxy so containers can reach Ollama without exposing the daemon directly to your network.
+When the wizard prints `proxy on :11435`, it refers to the authenticated reverse proxy described in [Use a Local Inference Server](/inference/use-local-inference).
 On WSL, NemoClaw can also use Ollama on the Windows host through `host.docker.internal`.
 
 Respond to the wizard as follows.
 
 1. At the `Choose [1]:` prompt, type `7` to select **Local Ollama**.
-2. At the `Choose model [1]:` prompt, pick from **Ollama models** if any are already installed. If none are installed, pick a **starter model** to pull and load now, or pick **Other...** to enter any Ollama model ID.
+2. At the `Choose model [1]:` prompt, pick from Ollama models if any are already installed. If none are installed, pick a starter model to pull and load now, or pick `Other...` to enter any Ollama model ID.
 
 For setup details, including GPU recommendations and starter model choices, refer to [Use a Local Inference Server](/inference/use-local-inference).
 
@@ -351,12 +351,18 @@ Treat the authenticated URL like a password.
 
 Connect to the sandbox and use the OpenClaw CLI.
 
-```bash
-nemoclaw my-assistant connect
-# inside the sandbox:
-openclaw tui
+```console
+$ nemoclaw my-assistant connect
 ```
 
+In the sandbox shell, send a single message and print the response.
+
+```console
+$ openclaw agent --agent main -m "hello"
+```
+
+NemoClaw rejects the `--local` flag inside sandboxes because it bypasses gateway protections.
+
 ## Next Steps
 
 Navigate to the following topics to learn more about NemoClaw.

docs/inference/set-up-sub-agent.mdx

@@ -55,8 +55,9 @@ Fetch the current OpenClaw config from the sandbox, patch it with your auxiliary
 
 ```console
 $ export SANDBOX=my-assistant
-$ export DOCKER_CTR=openshell-cluster-nemoclaw
-$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json
+$ export DOCKER_CTR=$(docker ps --filter "name=openshell-$SANDBOX" --format "{{.Names}}" | head -n 1)
+$ if [ -z "$DOCKER_CTR" ]; then echo "Error: No container found for sandbox $SANDBOX" >&2; exit 1; fi
+$ docker exec "$DOCKER_CTR" cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json
 ```
 
 Create `/tmp/openclaw.updated.json` with the OpenClaw sub-agent config.
@@ -66,12 +67,17 @@ Upload the patched config and refresh the hash.
 In the default mutable state, this keeps the local hash consistent but does not make it tamper-proof; lock the config root-owned and read-only afterward if the sandbox should enforce config integrity at startup.
 
 ```console
-$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/openclaw.json
-$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/.config-hash
-$ cat /tmp/openclaw.updated.json | docker exec -i "$DOCKER_CTR" kubectl exec -i -n openshell "$SANDBOX" -c agent -- sh -c 'cat > /sandbox/.openclaw/openclaw.json'
-$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- /bin/bash -c "cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash"
-$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/openclaw.json
-$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/.config-hash
+$ docker exec "$DOCKER_CTR" chmod 644 /sandbox/.openclaw/openclaw.json
+$ docker exec "$DOCKER_CTR" chmod 644 /sandbox/.openclaw/.config-hash
+$ cat /tmp/openclaw.updated.json | docker exec -i "$DOCKER_CTR" sh -c 'cat > /sandbox/.openclaw/openclaw.json'
+$ docker exec "$DOCKER_CTR" /bin/bash -c "cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash"
+# Optional: Lock the config to be root-owned and read-only to enforce integrity at startup
+$ docker exec --user root "$DOCKER_CTR" chown root:root /sandbox/.openclaw/openclaw.json
+$ docker exec --user root "$DOCKER_CTR" chmod 444 /sandbox/.openclaw/openclaw.json
+$ docker exec --user root "$DOCKER_CTR" chown root:root /sandbox/.openclaw/.config-hash
+$ docker exec --user root "$DOCKER_CTR" chmod 444 /sandbox/.openclaw/.config-hash
+# Rollback: If you need to edit the config again, restore write permissions
+# $ docker exec --user root "$DOCKER_CTR" sh -c 'chown sandbox:sandbox /sandbox/.openclaw/openclaw.json /sandbox/.openclaw/.config-hash && chmod 644 /sandbox/.openclaw/openclaw.json /sandbox/.openclaw/.config-hash'
 ```
 
 Check `/tmp/gateway.log` after upload and confirm the gateway hot-reloaded the provider or `agents.list` change.
@@ -89,7 +95,7 @@ Use the same provider ID that appears in `models.providers`, such as `nvidia-omn
 After uploading the auth profile, make sure the sub-agent directory is owned by the sandbox user:
 
 ```console
-$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator
+$ docker exec "$DOCKER_CTR" chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator
 ```
 
 ## Allow Auxiliary Provider Egress

docs/monitoring/monitor-sandbox-activity.mdx

@@ -33,26 +33,28 @@ Key fields in the output include the following:
 
 - Sandbox details, which show the configured model, provider, GPU mode, and applied policy presets.
 - Gateway and process health, which show whether NemoClaw can still reach the OpenShell gateway and whether the in-sandbox agent process is running.
-- Inference health for local Ollama and local vLLM, which shows `healthy` or `unreachable` together with the probed local URL.
+- Inference health for local Ollama and local vLLM, which shows `healthy`, `unreachable`, or `not probed` (when the endpoint URL is unknown for compatible-* providers) together with the probed local URL.
 - NIM status, which shows whether a NIM container is running and healthy when that path is in use.
 
 Run `nemoclaw <name> status` on the host to check sandbox state.
 Use `openshell sandbox list` for the underlying sandbox details.
 
-## View Blueprint and Sandbox Logs
+## Run Diagnostics
 
-Stream the most recent log output from the blueprint runner and sandbox:
+Run the `doctor` command to perform a grouped health check across the host, gateway, sandbox, inference, messaging, and local services:
 
 ```console
-$ nemoclaw <name> logs
+$ nemoclaw <name> doctor [--json]
 ```
 
-To follow the log output in real time:
+Stream the most recent log output from the blueprint runner and sandbox:
 
 ```console
-$ nemoclaw <name> logs --follow
+$ nemoclaw <name> logs [--follow] [--tail <lines>|-n <lines>] [--since <duration>]
 ```
 
+The command reads both OpenClaw gateway output and OpenShell audit events, so policy denials appear alongside the gateway log stream.
+
 ## Monitor Network Activity in the TUI
 
 Open the OpenShell terminal UI for a live view of sandbox network activity and egress requests: