chore: bump OpenShell pin to 0.0.44

.github/workflows/regression-e2e.yaml

@@ -175,8 +175,8 @@ jobs:
 
 
   # ── OpenShell version-pin E2E ──────────────────────────────
-  # Coverage guard for #3474. If a host has sticky OpenShell 0.0.40 on PATH
-  # but this NemoClaw release supports only <=0.0.39, install-openshell.sh
+  # Coverage guard for #3474. If a host has sticky OpenShell 0.0.45 on PATH
+  # but this NemoClaw release supports only <=0.0.44, install-openshell.sh
   # must replace it with the pinned compatible release instead of hard-failing.
   openshell-version-pin-e2e:
     needs: select_regression_jobs

nemoclaw-blueprint/blueprint.yaml

@@ -2,8 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 version: "0.1.0"
-min_openshell_version: "0.0.39"
-max_openshell_version: "0.0.39"
+min_openshell_version: "0.0.44"
+max_openshell_version: "0.0.44"
 min_openclaw_version: "2026.4.24"
 # Mirrors the components.sandbox.image manifest digest below. Lets a
 # downstream consumer (or release tooling) verify the blueprint declares

scripts/brev-launchable-ci-cpu.sh

@@ -28,7 +28,7 @@
 #   curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/<ref>/scripts/brev-launchable-ci-cpu.sh | bash
 #
 # Environment overrides:
-#   OPENSHELL_VERSION     — OpenShell CLI release tag (default: v0.0.39)
+#   OPENSHELL_VERSION     — OpenShell CLI release tag (default: v0.0.44)
 #   NEMOCLAW_REF          — NemoClaw git ref to clone (default: main)
 #   NEMOCLAW_CLONE_DIR    — Where to clone NemoClaw (default: ~/NemoClaw)
 #   SKIP_DOCKER_PULL      — Set to 1 to skip Docker image pre-pulls
@@ -40,7 +40,7 @@
 set -euo pipefail
 
 # ── Configuration ────────────────────────────────────────────────────
-OPENSHELL_VERSION="${OPENSHELL_VERSION:-v0.0.39}"
+OPENSHELL_VERSION="${OPENSHELL_VERSION:-v0.0.44}"
 NEMOCLAW_REF="${NEMOCLAW_REF:-main}"
 TARGET_USER="${SUDO_USER:-$(id -un)}"
 TARGET_HOME="$(getent passwd "$TARGET_USER" | cut -d: -f6)"
@@ -250,7 +250,7 @@ DOCKER_PULL_PID=""
 if [[ "${SKIP_DOCKER_PULL:-0}" != "1" ]]; then
   info "Pre-pulling Docker images in background..."
   (
-    SUPERVISOR_TAG="${OPENSHELL_VERSION#v}" # v0.0.39 -> 0.0.39
+    SUPERVISOR_TAG="${OPENSHELL_VERSION#v}" # v0.0.44 -> 0.0.44
     SUPERVISOR_IMAGE="ghcr.io/nvidia/openshell/supervisor:${SUPERVISOR_TAG}"
 
     # Pull all images in parallel

scripts/install-openshell.sh

@@ -35,16 +35,16 @@ info "Detected $OS_LABEL ($ARCH_LABEL)"
 
 # Minimum version required for native messaging credential rewrite:
 # WebSocket text frames plus provider-shaped aliases and REST request bodies.
-MIN_VERSION="0.0.39"
+MIN_VERSION="0.0.44"
 # Maximum version validated for this NemoClaw release. Newer OpenShell builds
 # may change sandbox semantics; upgrade NemoClaw before upgrading past this.
-MAX_VERSION="0.0.39"
+MAX_VERSION="0.0.44"
 # Pin fresh installs to this version. The TS installer normally overrides this
 # via NEMOCLAW_OPENSHELL_PIN_VERSION after resolving the highest published
 # OpenShell release that satisfies the blueprint's max_openshell_version
 # (see #3404). The hardcoded value is the fallback for offline runs.
 PIN_VERSION="$MAX_VERSION"
-DEV_MIN_VERSION="0.0.39"
+DEV_MIN_VERSION="0.0.44"
 
 CHANNEL="${NEMOCLAW_OPENSHELL_CHANNEL:-auto}"
 case "$CHANNEL" in

src/lib/onboard.ts

@@ -2919,7 +2919,7 @@ function getOpenShellDockerSupervisorImage(versionOutput: string | null = null):
   if (shouldUseOpenshellDevChannel() || isOpenshellDevVersion(versionOutput)) {
     return "ghcr.io/nvidia/openshell/supervisor:dev";
   }
-  const supportedVersion = installedVersion ?? getBlueprintMaxOpenshellVersion() ?? "0.0.39";
+  const supportedVersion = installedVersion ?? getBlueprintMaxOpenshellVersion() ?? "0.0.44";
   return `ghcr.io/nvidia/openshell/supervisor:${supportedVersion}`;
 }
 
@@ -4169,7 +4169,7 @@ async function startDockerDriverGateway({ exitOnFailure = true, skipSandboxBridg
   }
   if (!gatewayBin) {
     console.error("  OpenShell Docker-driver gateway binary not found.");
-    console.error("  Install OpenShell v0.0.39, or set NEMOCLAW_OPENSHELL_GATEWAY_BIN.");
+    console.error("  Install OpenShell v0.0.44, or set NEMOCLAW_OPENSHELL_GATEWAY_BIN.");
     if (exitOnFailure) process.exit(1);
     throw new Error("OpenShell gateway binary not found");
   }

src/lib/onboard/docker-driver-gateway-runtime-marker.test.ts

@@ -22,7 +22,7 @@ const expected = {
   },
   endpoint: "http://127.0.0.1:8080",
   gatewayBin: "/usr/local/bin/openshell-gateway",
-  openshellVersion: "0.0.39",
+  openshellVersion: "0.0.44",
   dockerHost: "unix:///Users/me/.colima/default/docker.sock",
   platform: "darwin" as NodeJS.Platform,
   arch: "arm64" as NodeJS.Architecture,

src/lib/onboard/openshell-install.ts

@@ -159,7 +159,7 @@ export function ensureOpenshellForOnboard(deps: OpenShellInstallDeps): OpenShell
         deps.exit(1);
       }
     } else {
-      const minOpenshellVersion = deps.getBlueprintMinOpenshellVersion() ?? "0.0.39";
+      const minOpenshellVersion = deps.getBlueprintMinOpenshellVersion() ?? "0.0.44";
       const currentVersionOutput = deps.runCaptureOpenshell(["--version"], { ignoreError: true });
       const needsDevChannel =
         deps.isLinuxDockerDriverGatewayEnabled(platform, arch) &&

test/e2e/docs/parity-inventory.generated.json

@@ -12140,9 +12140,9 @@
         {
           "script": "test/e2e/test-openshell-version-pin.sh",
           "line": 215,
-          "text": "Installer hard-failed on sticky OpenShell 0.0.40 instead of reinstalling pinned 0.0.39 (#3474)",
+          "text": "Installer hard-failed on sticky OpenShell 0.0.45 instead of reinstalling pinned 0.0.44 (#3474)",
           "polarity": "fail",
-          "normalized_id": "installer.hard.failed.on.sticky.openshell.0.0.40.instead.of.reinstalling.pinned.0.0.39.3474",
+          "normalized_id": "installer.hard.failed.on.sticky.openshell.0.0.45.instead.of.reinstalling.pinned.0.0.44.3474",
           "mapping_status": "retired"
         },
         {
@@ -12164,49 +12164,49 @@
         {
           "script": "test/e2e/test-openshell-version-pin.sh",
           "line": 222,
-          "text": "Expected installer to download pinned OpenShell v0.0.39",
+          "text": "Expected installer to download pinned OpenShell v0.0.44",
           "polarity": "fail",
-          "normalized_id": "expected.installer.to.download.pinned.openshell.v0.0.39",
+          "normalized_id": "expected.installer.to.download.pinned.openshell.v0.0.44",
           "mapping_status": "retired"
         },
         {
           "script": "test/e2e/test-openshell-version-pin.sh",
           "line": 224,
-          "text": "Installer downloaded pinned OpenShell v0.0.39",
+          "text": "Installer downloaded pinned OpenShell v0.0.44",
           "polarity": "pass",
-          "normalized_id": "installer.downloaded.pinned.openshell.v0.0.39",
+          "normalized_id": "installer.downloaded.pinned.openshell.v0.0.44",
           "mapping_status": "mapped"
         },
         {
           "script": "test/e2e/test-openshell-version-pin.sh",
           "line": 227,
-          "text": "Installer downloaded OpenShell v0.0.40 despite NemoClaw max 0.0.39",
+          "text": "Installer downloaded OpenShell v0.0.45 despite NemoClaw max 0.0.44",
           "polarity": "fail",
-          "normalized_id": "installer.downloaded.openshell.v0.0.40.despite.nemoclaw.max.0.0.39",
+          "normalized_id": "installer.downloaded.openshell.v0.0.45.despite.nemoclaw.max.0.0.44",
           "mapping_status": "retired"
         },
         {
           "script": "test/e2e/test-openshell-version-pin.sh",
           "line": 229,
-          "text": "Installer did not download too-new OpenShell v0.0.40",
+          "text": "Installer did not download too-new OpenShell v0.0.45",
           "polarity": "pass",
-          "normalized_id": "installer.did.not.download.too.new.openshell.v0.0.40",
+          "normalized_id": "installer.did.not.download.too.new.openshell.v0.0.45",
           "mapping_status": "mapped"
         },
         {
           "script": "test/e2e/test-openshell-version-pin.sh",
           "line": 232,
-          "text": "openshell binary was not replaced with pinned 0.0.39",
+          "text": "openshell binary was not replaced with pinned 0.0.44",
           "polarity": "fail",
-          "normalized_id": "openshell.binary.was.not.replaced.with.pinned.0.0.39",
+          "normalized_id": "openshell.binary.was.not.replaced.with.pinned.0.0.44",
           "mapping_status": "retired"
         },
         {
           "script": "test/e2e/test-openshell-version-pin.sh",
           "line": 234,
-          "text": "Sticky openshell 0.0.40 was replaced with pinned 0.0.39",
+          "text": "Sticky openshell 0.0.45 was replaced with pinned 0.0.44",
           "polarity": "pass",
-          "normalized_id": "sticky.openshell.0.0.40.was.replaced.with.pinned.0.0.39",
+          "normalized_id": "sticky.openshell.0.0.45.was.replaced.with.pinned.0.0.44",
           "mapping_status": "mapped"
         }
       ]

test/e2e/docs/parity-map.yaml

@@ -10772,7 +10772,7 @@ scripts:
     status: migrated
     bucket: install-upgrade
     assertions:
-    - legacy: Installer hard-failed on sticky OpenShell 0.0.40 instead of reinstalling pinned 0.0.39 (#3474)
+    - legacy: Installer hard-failed on sticky OpenShell 0.0.45 instead of reinstalling pinned 0.0.44 (#3474)
       status: retired
       reason: legacy negative/failure assertion retained by script but not represented as scenario success criterion
       reviewer: e2e-maintainers
@@ -10785,27 +10785,27 @@ scripts:
     - legacy: install-openshell.sh completed
       status: mapped
       id: legacy.openshell.version.pin.install.openshell.sh.completed
-    - legacy: Expected installer to download pinned OpenShell v0.0.39
+    - legacy: Expected installer to download pinned OpenShell v0.0.44
       status: retired
       reason: legacy negative/failure assertion retained by script but not represented as scenario success criterion
       reviewer: e2e-maintainers
       approved_at: '2026-05-13'
-    - legacy: Installer downloaded pinned OpenShell v0.0.39
+    - legacy: Installer downloaded pinned OpenShell v0.0.44
       status: mapped
-      id: legacy.openshell.version.pin.installer.downloaded.pinned.openshell.vv39
-    - legacy: Installer downloaded OpenShell v0.0.40 despite NemoClaw max 0.0.39
+      id: legacy.openshell.version.pin.installer.downloaded.pinned.openshell.vv44
+    - legacy: Installer downloaded OpenShell v0.0.45 despite NemoClaw max 0.0.44
       status: retired
       reason: legacy negative/failure assertion retained by script but not represented as scenario success criterion
       reviewer: e2e-maintainers
       approved_at: '2026-05-13'
-    - legacy: Installer did not download too-new OpenShell v0.0.40
+    - legacy: Installer did not download too-new OpenShell v0.0.45
       status: mapped
-      id: legacy.openshell.version.pin.installer.did.not.download.too.new.openshell.vv40
-    - legacy: openshell binary was not replaced with pinned 0.0.39
+      id: legacy.openshell.version.pin.installer.did.not.download.too.new.openshell.vv45
+    - legacy: openshell binary was not replaced with pinned 0.0.44
       status: retired
       reason: legacy negative/failure assertion retained by script but not represented as scenario success criterion
       reviewer: e2e-maintainers
       approved_at: '2026-05-13'
-    - legacy: Sticky openshell 0.0.40 was replaced with pinned 0.0.39
+    - legacy: Sticky openshell 0.0.45 was replaced with pinned 0.0.44
       status: mapped
-      id: legacy.openshell.version.pin.sticky.openshell.v40.was.replaced.with.pinned.v39
+      id: legacy.openshell.version.pin.sticky.openshell.v45.was.replaced.with.pinned.v44

test/e2e/test-openshell-gateway-upgrade.sh

@@ -52,7 +52,7 @@ STATE_DIR="${NEMOCLAW_OPENSHELL_GATEWAY_STATE_DIR:-$HOME/.local/state/nemoclaw/o
 PID_FILE="${STATE_DIR}/openshell-gateway.pid"
 OLD_NEMOCLAW_REF="${NEMOCLAW_OLD_NEMOCLAW_REF:-v0.0.36}"
 OLD_OPENSHELL_VERSION="${NEMOCLAW_OLD_OPENSHELL_VERSION:-0.0.36}"
-CURRENT_OPENSHELL_VERSION="${NEMOCLAW_CURRENT_OPENSHELL_VERSION:-0.0.39}"
+CURRENT_OPENSHELL_VERSION="${NEMOCLAW_CURRENT_OPENSHELL_VERSION:-0.0.44}"
 SURVIVOR_SANDBOX="${NEMOCLAW_GATEWAY_UPGRADE_SURVIVOR_NAME:-e2e-gateway-upgrade-survivor}"
 SURVIVOR_MARKER="gateway-upgrade-survivor-$(date +%s)"
 SURVIVOR_MARKER_PATH="/sandbox/.openclaw/workspace/nemoclaw-gateway-upgrade-marker"
@@ -145,7 +145,7 @@ EOF
 # request-body-credential-rewrite
 # websocket-credential-rewrite
 if [ "${1:-}" = "--version" ]; then
-  printf 'openshell 0.0.39\n'
+  printf 'openshell 0.0.44\n'
   exit 0
 fi
 exit 99
@@ -235,7 +235,7 @@ EOF
 # request-body-credential-rewrite
 # websocket-credential-rewrite
 if [ "${1:-}" = "--version" ]; then
-  printf 'openshell 0.0.39\n'
+  printf 'openshell 0.0.44\n'
   exit 0
 fi
 exit 99

test/e2e/test-openshell-version-pin.sh

@@ -8,11 +8,11 @@
 # pinned compatible version instead of failing before the reinstall path.
 #
 # Expected result on unfixed main: FAIL. scripts/install-openshell.sh sees the
-# fake installed `openshell 0.0.40`, compares it to MAX_VERSION=0.0.39, and
-# exits with "above the maximum" before downloading the pinned 0.0.39 release.
+# fake installed `openshell 0.0.45`, compares it to MAX_VERSION=0.0.44, and
+# exits with "above the maximum" before downloading the pinned 0.0.44 release.
 #
 # Expected result after the fix: PASS. The script warns about the too-new
-# installed OpenShell, downloads v0.0.39, replaces openshell plus helper
+# installed OpenShell, downloads v0.0.44, replaces openshell plus helper
 # binaries, and exits successfully.
 
 set -euo pipefail
@@ -74,7 +74,7 @@ SH
 # the pinned compatible release.
 write_executable "$FAKE_BIN/openshell" <<'SH'
 #!/usr/bin/env bash
-if [ "${1:-}" = "--version" ]; then echo "openshell 0.0.40"; exit 0; fi
+if [ "${1:-}" = "--version" ]; then echo "openshell 0.0.45"; exit 0; fi
 # request-body-credential-rewrite websocket-credential-rewrite
 exit 0
 SH
@@ -163,7 +163,7 @@ exit 0
 SH
 
 # The installer extracts three archives. Create the binary each archive would
-# have produced. The replacement openshell reports 0.0.39 and contains the
+# have produced. The replacement openshell reports 0.0.44 and contains the
 # feature strings checked by install-openshell.sh.
 write_executable "$FAKE_BIN/tar" <<'SH'
 #!/usr/bin/env bash
@@ -185,7 +185,7 @@ case "$*" in
 esac
 cat > "$outdir/$name" <<'EOS'
 #!/usr/bin/env bash
-if [ "${1:-}" = "--version" ]; then echo "openshell 0.0.39"; exit 0; fi
+if [ "${1:-}" = "--version" ]; then echo "openshell 0.0.44"; exit 0; fi
 # request-body-credential-rewrite websocket-credential-rewrite
 exit 0
 EOS
@@ -200,7 +200,7 @@ cat "$@" 2>/dev/null || true
 SH
 
 cd "$REPO_ROOT"
-info "Running install-openshell.sh with sticky openshell 0.0.40 and max 0.0.39"
+info "Running install-openshell.sh with sticky openshell 0.0.45 and max 0.0.44"
 set +e
 env \
   PATH="$FAKE_BIN:/usr/bin:/bin" \
@@ -211,26 +211,26 @@ install_rc=$?
 set -e
 
 if [ "$install_rc" -ne 0 ]; then
-  if grep -q "openshell 0.0.40 is above the maximum (0.0.39)" "$INSTALL_LOG"; then
-    fail "Installer hard-failed on sticky OpenShell 0.0.40 instead of reinstalling pinned 0.0.39 (#3474)"
+  if grep -q "openshell 0.0.45 is above the maximum (0.0.44)" "$INSTALL_LOG"; then
+    fail "Installer hard-failed on sticky OpenShell 0.0.45 instead of reinstalling pinned 0.0.44 (#3474)"
   fi
   fail "install-openshell.sh failed before proving sticky-version recovery (exit ${install_rc})"
 fi
 pass "install-openshell.sh completed"
 
-if ! grep -q "v0.0.39" "$DOWNLOAD_LOG"; then
-  fail "Expected installer to download pinned OpenShell v0.0.39"
+if ! grep -q "v0.0.44" "$DOWNLOAD_LOG"; then
+  fail "Expected installer to download pinned OpenShell v0.0.44"
 fi
-pass "Installer downloaded pinned OpenShell v0.0.39"
+pass "Installer downloaded pinned OpenShell v0.0.44"
 
-if grep -q "v0.0.40" "$DOWNLOAD_LOG"; then
-  fail "Installer downloaded OpenShell v0.0.40 despite NemoClaw max 0.0.39"
+if grep -q "v0.0.45" "$DOWNLOAD_LOG"; then
+  fail "Installer downloaded OpenShell v0.0.45 despite NemoClaw max 0.0.44"
 fi
-pass "Installer did not download too-new OpenShell v0.0.40"
+pass "Installer did not download too-new OpenShell v0.0.45"
 
-if ! "$FAKE_BIN/openshell" --version 2>&1 | grep -q "0.0.39"; then
-  fail "openshell binary was not replaced with pinned 0.0.39"
+if ! "$FAKE_BIN/openshell" --version 2>&1 | grep -q "0.0.44"; then
+  fail "openshell binary was not replaced with pinned 0.0.44"
 fi
-pass "Sticky openshell 0.0.40 was replaced with pinned 0.0.39"
+pass "Sticky openshell 0.0.45 was replaced with pinned 0.0.44"
 
 info "OpenShell sticky-version pin guard complete"