jyaunches · May 20, 2026 · May 19, 2026 · May 19, 2026 · May 19, 2026 · May 19, 2026
diff --git a/.agents/skills/nemoclaw-user-reference/references/commands.md b/.agents/skills/nemoclaw-user-reference/references/commands.md
@@ -376,7 +376,7 @@ Existing sandboxes do not auto-upgrade when a newer NemoClaw release ships a new
 ```console
 $ nemoclaw my-assistant status
 ...
-    Agent:    OpenClaw v2026.4.24
+    Agent:    OpenClaw v2026.5.18
 ...
 ```
 

diff --git a/.github/workflows/regression-e2e.yaml b/.github/workflows/regression-e2e.yaml
@@ -175,8 +175,8 @@ jobs:
 
 
   # ── OpenShell version-pin E2E ──────────────────────────────
-  # Coverage guard for #3474. If a host has sticky OpenShell 0.0.40 on PATH
-  # but this NemoClaw release supports only <=0.0.39, install-openshell.sh
+  # Coverage guard for #3474. If a host has sticky OpenShell 0.0.45 on PATH
+  # but this NemoClaw release supports only <=0.0.44, install-openshell.sh
   # must replace it with the pinned compatible release instead of hard-failing.
   openshell-version-pin-e2e:
     needs: select_regression_jobs

diff --git a/Dockerfile b/Dockerfile
@@ -202,12 +202,12 @@ RUN set -eu; \
     sed -i 's/const baseLstat = await fs\.lstat(params\.installBaseDir)/const baseLstat = await fs.stat(params.installBaseDir)/' "$ipd_file"; \
     sed -i 's/baseLstat\.isSymbolicLink()/false \/* nemoclaw: symlink check disabled, realpath guards containment *\//' "$ipd_file"; \
     if grep -q 'fs\.lstat(params\.installBaseDir)' "$ipd_file"; then echo "ERROR: Patch 3b (install-package-dir) left lstat in assertInstallBaseStable" >&2; exit 1; fi; \
-    # --- Patch 5: bump default WS handshake timeout 10s -> 60s (#2484) --- \
-    # OpenClaw's WS connect handshake has a hard-coded 10s timeout on both \
+    # --- Patch 5: bump default WS handshake timeout to 60s (#2484) --- \
+    # OpenClaw's WS connect handshake has a hard-coded short timeout on both \
     # client and server. Server-side connect-handler processing can exceed \
-    # 10s under load (multiple concurrent connects on slow CI infra), \
+    # that limit under load (multiple concurrent connects on slow CI infra), \
     # causing `openclaw agent --json` to fail with "gateway timeout after \
-    # 10000ms" and TC-SBX-02 to hit its 90s SSH timeout. \
+    # <timeout>ms" and TC-SBX-02 to hit its 90s SSH timeout. \
     # \
     # Both env vars (OPENCLAW_HANDSHAKE_TIMEOUT_MS, \
     # OPENCLAW_CONNECT_CHALLENGE_TIMEOUT_MS) are clamped at the same \
@@ -217,10 +217,10 @@ RUN set -eu; \
     # \
     # Removal criteria: drop when openclaw fixes the underlying connect \
     # latency, or exposes the timeout as an unbounded env override. \
-    hto_files="$(grep -RIlE --include='*.js' 'DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS = 1e4' "$OC_DIST")"; \
+    hto_files="$(grep -RIlE --include='*.js' 'DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS = (1e4|15e3)' "$OC_DIST")"; \
     test -n "$hto_files" || { echo "ERROR: handshake-timeout constant not found" >&2; exit 1; }; \
-    printf '%s\n' "$hto_files" | xargs sed -i -E 's|DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS = 1e4|DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS = 6e4|g'; \
-    if grep -REq --include='*.js' 'DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS = 1e4' "$OC_DIST"; then echo "ERROR: Patch 5 left a 1e4 constant" >&2; exit 1; fi
+    printf '%s\n' "$hto_files" | xargs sed -i -E 's#DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS = (1e4|15e3)#DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS = 6e4#g'; \
+    if grep -REq --include='*.js' 'DEFAULT_PREAUTH_HANDSHAKE_TIMEOUT_MS = (1e4|15e3)' "$OC_DIST"; then echo "ERROR: Patch 5 left a short timeout constant" >&2; exit 1; fi
 
 # Set up blueprint for local resolution.
 # Blueprints are immutable at runtime; DAC protection (root ownership) is applied

diff --git a/Dockerfile.base b/Dockerfile.base
@@ -177,7 +177,7 @@ RUN printf '%s\n' \
 # OpenClaw version: change the OPENCLAW_VERSION ARG default so CI rebuilds
 # the base image on push to main, or use workflow_dispatch on base-image.yaml
 # with the openclaw_version input for a one-off build without editing this file.
-ARG OPENCLAW_VERSION=2026.4.24
+ARG OPENCLAW_VERSION=2026.5.18
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
@@ -204,7 +204,7 @@ RUN --mount=type=bind,source=nemoclaw-blueprint/blueprint.yaml,target=/tmp/bluep
 USER sandbox
 WORKDIR /sandbox
 # hadolint ignore=DL3059,DL4006
-RUN openclaw plugins install '@tencent-weixin/openclaw-weixin@2.4.2' --pin \
+RUN openclaw plugins install '@tencent-weixin/openclaw-weixin@2.4.3' --pin \
     && openclaw config set plugins.entries.openclaw-weixin.enabled true
 # hadolint ignore=DL3002
 USER root

diff --git a/agents/hermes/Dockerfile.base b/agents/hermes/Dockerfile.base
@@ -23,9 +23,9 @@ FROM node:22-trixie-slim@sha256:2d9f5c76c8f4dd36e8f253bee5d828a83a6c09f36188f0b0
 ENV DEBIAN_FRONTEND=noninteractive
 
 # Hermes version pinned for reproducibility.
-# Calver tag v2026.4.23 = semver 0.11.0.
-ARG HERMES_VERSION=v2026.4.23
-ARG HERMES_TARBALL_SHA256=1ee1be80a2112b7edc581770cee8858e725ba110cc423979cd7102492504bc6b
+# Calver tag v2026.5.16 = Hermes Agent v0.14.0.
+ARG HERMES_VERSION=v2026.5.16
+ARG HERMES_TARBALL_SHA256=c0a554050a50ee9a62f3fa5cd288a167ba5640c42d647d100cdea084b7294143
 ARG HERMES_UV_EXTRAS="messaging web"
 ARG UV_VERSION=0.11.8
 

diff --git a/agents/hermes/config/hermes-config.ts b/agents/hermes/config/hermes-config.ts
@@ -62,7 +62,7 @@ export function buildHermesConfig(settings: HermesBuildSettings): Record<string,
     },
   };
 
-  // Hermes v2026.4.23 reads Discord behavior from top-level `discord:`.
+  // Hermes v2026.4.23+ reads Discord behavior from top-level `discord:`.
   // Bot tokens and user allowlists stay in .env so config.yaml never carries
   // real secrets or credential placeholders under platforms.discord.
   if (settings.messaging.enabledChannels.has("discord")) {

diff --git a/agents/hermes/manifest.yaml b/agents/hermes/manifest.yaml
@@ -16,7 +16,7 @@ homepage: "https://github.com/NousResearch/hermes-agent"
 install_method: curl  # curl install.sh | bash
 binary_path: /usr/local/bin/hermes
 version_command: "hermes --version"
-expected_version: "2026.4.23"
+expected_version: "2026.5.16"
 gateway_command: "hermes gateway run"
 
 # ── Health probe ────────────────────────────────────────────────

diff --git a/agents/openclaw/manifest.yaml b/agents/openclaw/manifest.yaml
@@ -19,7 +19,7 @@ homepage: "https://openclaw.ai"
 install_method: npm  # npm install -g openclaw@<version>
 binary_path: /usr/local/bin/openclaw
 version_command: "openclaw --version"
-expected_version: "2026.4.24"
+expected_version: "2026.5.18"
 gateway_command: "openclaw gateway run"
 
 # ── Health probe ────────────────────────────────────────────────

diff --git a/docs/reference/commands.md b/docs/reference/commands.md
@@ -416,7 +416,7 @@ Existing sandboxes do not auto-upgrade when a newer NemoClaw release ships a new
 ```console
 $ nemoclaw my-assistant status
 ...
-    Agent:    OpenClaw v2026.4.24
+    Agent:    OpenClaw v2026.5.18
 ...
 ```
 

diff --git a/docs/reference/commands.mdx b/docs/reference/commands.mdx
@@ -383,7 +383,7 @@ Existing sandboxes do not auto-upgrade when a newer NemoClaw release ships a new
 ```console
 $ nemoclaw my-assistant status
 ...
-    Agent:    OpenClaw v2026.4.24
+    Agent:    OpenClaw v2026.5.18
 ...
 ```
 

diff --git a/nemoclaw-blueprint/blueprint.yaml b/nemoclaw-blueprint/blueprint.yaml
@@ -2,9 +2,9 @@
 # SPDX-License-Identifier: Apache-2.0
 
 version: "0.1.0"
-min_openshell_version: "0.0.39"
-max_openshell_version: "0.0.39"
-min_openclaw_version: "2026.4.24"
+min_openshell_version: "0.0.44"
+max_openshell_version: "0.0.44"
+min_openclaw_version: "2026.5.18"
 # Mirrors the components.sandbox.image manifest digest below. Lets a
 # downstream consumer (or release tooling) verify the blueprint declares
 # a specific sandbox image without parsing the components tree, and

diff --git a/nemoclaw/package.json b/nemoclaw/package.json
@@ -11,11 +11,11 @@
       "./dist/index.js"
     ],
     "compat": {
-      "pluginApi": ">=2026.5.10-beta.1",
-      "minGatewayVersion": "2026.5.10-beta.1"
+      "pluginApi": ">=2026.5.18",
+      "minGatewayVersion": "2026.5.18"
     },
     "build": {
-      "openclawVersion": "2026.5.10-beta.1"
+      "openclawVersion": "2026.5.18"
     }
   },
   "scripts": {

diff --git a/nemoclaw/src/package-metadata.test.ts b/nemoclaw/src/package-metadata.test.ts
@@ -20,8 +20,8 @@ const packageJson = JSON.parse(
 
 describe("OpenClaw package metadata", () => {
   it("declares the required external plugin compatibility fields", () => {
-    expect(packageJson.openclaw?.compat?.pluginApi).toBe(">=2026.5.10-beta.1");
-    expect(packageJson.openclaw?.compat?.minGatewayVersion).toBe("2026.5.10-beta.1");
-    expect(packageJson.openclaw?.build?.openclawVersion).toBe("2026.5.10-beta.1");
+    expect(packageJson.openclaw?.compat?.pluginApi).toBe(">=2026.5.18");
+    expect(packageJson.openclaw?.compat?.minGatewayVersion).toBe("2026.5.18");
+    expect(packageJson.openclaw?.build?.openclawVersion).toBe("2026.5.18");
   });
 });
diff --git a/scripts/brev-launchable-ci-cpu.sh b/scripts/brev-launchable-ci-cpu.sh
@@ -28,7 +28,7 @@
 #   curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/<ref>/scripts/brev-launchable-ci-cpu.sh | bash
 #
 # Environment overrides:
-#   OPENSHELL_VERSION     — OpenShell CLI release tag (default: v0.0.39)
+#   OPENSHELL_VERSION     — OpenShell CLI release tag (default: v0.0.44)
 #   NEMOCLAW_REF          — NemoClaw git ref to clone (default: main)
 #   NEMOCLAW_CLONE_DIR    — Where to clone NemoClaw (default: ~/NemoClaw)
 #   SKIP_DOCKER_PULL      — Set to 1 to skip Docker image pre-pulls
@@ -40,7 +40,7 @@
 set -euo pipefail
 
 # ── Configuration ────────────────────────────────────────────────────
-OPENSHELL_VERSION="${OPENSHELL_VERSION:-v0.0.39}"
+OPENSHELL_VERSION="${OPENSHELL_VERSION:-v0.0.44}"
 NEMOCLAW_REF="${NEMOCLAW_REF:-main}"
 TARGET_USER="${SUDO_USER:-$(id -un)}"
 TARGET_HOME="$(getent passwd "$TARGET_USER" | cut -d: -f6)"
@@ -250,7 +250,7 @@ DOCKER_PULL_PID=""
 if [[ "${SKIP_DOCKER_PULL:-0}" != "1" ]]; then
   info "Pre-pulling Docker images in background..."
   (
-    SUPERVISOR_TAG="${OPENSHELL_VERSION#v}" # v0.0.39 -> 0.0.39
+    SUPERVISOR_TAG="${OPENSHELL_VERSION#v}" # v0.0.44 -> 0.0.44
     SUPERVISOR_IMAGE="ghcr.io/nvidia/openshell/supervisor:${SUPERVISOR_TAG}"
 
     # Pull all images in parallel

diff --git a/scripts/generate-openclaw-config.py b/scripts/generate-openclaw-config.py
@@ -674,7 +674,7 @@ def _placeholder(channel: str, env_key: str) -> str:
                 ),
                 # NemoClaw sandboxes are provisioned non-interactively and the
                 # E2E CLI contract expects the first agent turn to answer the
-                # caller's prompt. OpenClaw 2026.4.24 seeds BOOTSTRAP.md by
+                # caller's prompt. OpenClaw 2026.4.24+ seeds BOOTSTRAP.md by
                 # default, which redirects a fresh workspace into an identity
                 # setup conversation before normal replies.
                 "skipBootstrap": True,
@@ -701,7 +701,7 @@ def _placeholder(channel: str, env_key: str) -> str:
         #     load. The sandbox L7 proxy denies the registry URL, the
         #     install retries for ~6 minutes, and while it's stuck the
         #     gateway can't service openclaw-agent requests — that's the
-        #     TC-SBX-02 hang in 2026.4.24.
+        #     TC-SBX-02 hang observed in 2026.4.24.
         #
         # acpx is disabled by default because its runtime dependency staging
         # also reaches npm during gateway startup. NemoClaw's primary CLI path

diff --git a/scripts/install-openshell.sh b/scripts/install-openshell.sh
@@ -35,16 +35,16 @@ info "Detected $OS_LABEL ($ARCH_LABEL)"
 
 # Minimum version required for native messaging credential rewrite:
 # WebSocket text frames plus provider-shaped aliases and REST request bodies.
-MIN_VERSION="0.0.39"
+MIN_VERSION="0.0.44"
 # Maximum version validated for this NemoClaw release. Newer OpenShell builds
 # may change sandbox semantics; upgrade NemoClaw before upgrading past this.
-MAX_VERSION="0.0.39"
+MAX_VERSION="0.0.44"
 # Pin fresh installs to this version. The TS installer normally overrides this
 # via NEMOCLAW_OPENSHELL_PIN_VERSION after resolving the highest published
 # OpenShell release that satisfies the blueprint's max_openshell_version
 # (see #3404). The hardcoded value is the fallback for offline runs.
 PIN_VERSION="$MAX_VERSION"
-DEV_MIN_VERSION="0.0.39"
+DEV_MIN_VERSION="0.0.44"
 
 CHANNEL="${NEMOCLAW_OPENSHELL_CHANNEL:-auto}"
 case "$CHANNEL" in

diff --git a/scripts/seed-wechat-accounts.py b/scripts/seed-wechat-accounts.py
@@ -10,7 +10,7 @@
 # would otherwise drive an in-sandbox QR scan that has no terminal and no
 # paired phone access.
 #
-# Files written (matching auth/accounts.ts in @tencent-weixin/openclaw-weixin@2.4.2):
+# Files written (matching auth/accounts.ts in @tencent-weixin/openclaw-weixin@2.4.3):
 #   <stateDir>/openclaw-weixin/accounts.json                  — JSON array of accountIds
 #   <stateDir>/openclaw-weixin/accounts/<accountId>.json      — { token, savedAt, baseUrl, userId }
 #   <stateDir>/openclaw.json (channels.openclaw-weixin)       — registered channel + accounts.<id>.enabled

diff --git a/src/ext/wechat/qr.ts b/src/ext/wechat/qr.ts
@@ -38,7 +38,7 @@ export const WECHAT_ILINK_APP_ID = "bot";
  *  installed in the sandbox image, so the iLink gateway sees the same
  *  client version from both the host login and the in-sandbox plugin.
  *  Bump together with the version pinned in the Dockerfile. */
-export const WECHAT_ILINK_CLIENT_VERSION = encodeIlinkClientVersion("2.4.2");
+export const WECHAT_ILINK_CLIENT_VERSION = encodeIlinkClientVersion("2.4.3");
 
 /** Client-side ceiling for a single status long-poll. 35s keeps us within
  *  typical 60s gateway/proxy idle windows. */

diff --git a/src/lib/onboard.ts b/src/lib/onboard.ts
@@ -2919,7 +2919,7 @@ function getOpenShellDockerSupervisorImage(versionOutput: string | null = null):
   if (shouldUseOpenshellDevChannel() || isOpenshellDevVersion(versionOutput)) {
     return "ghcr.io/nvidia/openshell/supervisor:dev";
   }
-  const supportedVersion = installedVersion ?? getBlueprintMaxOpenshellVersion() ?? "0.0.39";
+  const supportedVersion = installedVersion ?? getBlueprintMaxOpenshellVersion() ?? "0.0.44";
   return `ghcr.io/nvidia/openshell/supervisor:${supportedVersion}`;
 }
 
@@ -4169,7 +4169,7 @@ async function startDockerDriverGateway({ exitOnFailure = true, skipSandboxBridg
   }
   if (!gatewayBin) {
     console.error("  OpenShell Docker-driver gateway binary not found.");
-    console.error("  Install OpenShell v0.0.39, or set NEMOCLAW_OPENSHELL_GATEWAY_BIN.");
+    console.error("  Install OpenShell v0.0.44, or set NEMOCLAW_OPENSHELL_GATEWAY_BIN.");
     if (exitOnFailure) process.exit(1);
     throw new Error("OpenShell gateway binary not found");
   }

diff --git a/src/lib/onboard/docker-driver-gateway-runtime-marker.test.ts b/src/lib/onboard/docker-driver-gateway-runtime-marker.test.ts
@@ -22,7 +22,7 @@ const expected = {
   },
   endpoint: "http://127.0.0.1:8080",
   gatewayBin: "/usr/local/bin/openshell-gateway",
-  openshellVersion: "0.0.39",
+  openshellVersion: "0.0.44",
   dockerHost: "unix:///Users/me/.colima/default/docker.sock",
   platform: "darwin" as NodeJS.Platform,
   arch: "arm64" as NodeJS.Architecture,

diff --git a/src/lib/onboard/openshell-install.ts b/src/lib/onboard/openshell-install.ts
@@ -159,7 +159,7 @@ export function ensureOpenshellForOnboard(deps: OpenShellInstallDeps): OpenShell
         deps.exit(1);
       }
     } else {
-      const minOpenshellVersion = deps.getBlueprintMinOpenshellVersion() ?? "0.0.39";
+      const minOpenshellVersion = deps.getBlueprintMinOpenshellVersion() ?? "0.0.44";
       const currentVersionOutput = deps.runCaptureOpenshell(["--version"], { ignoreError: true });
       const needsDevChannel =
         deps.isLinuxDockerDriverGatewayEnabled(platform, arch) &&

diff --git a/src/lib/sandbox/version.test.ts b/src/lib/sandbox/version.test.ts
@@ -36,7 +36,7 @@ vi.mock("../agent/defs.js", () => ({
     name,
     displayName: name === "openclaw" ? "OpenClaw" : "Hermes Agent",
     versionCommand: name === "openclaw" ? "openclaw --version" : "hermes --version",
-    expectedVersion: name === "openclaw" ? "2026.4.24" : "2026.4.24",
+    expectedVersion: name === "openclaw" ? "2026.5.18" : "2026.5.16",
     stateDirs: [],
     configPaths: { dir: "/sandbox/.openclaw" },
   })),
@@ -77,12 +77,12 @@ describe("checkAgentVersion", () => {
     registry.registerSandbox({
       name: "test-sb",
       agent: null,
-      agentVersion: "2026.4.24",
+      agentVersion: "2026.5.18",
     });
 
     const result = checkAgentVersion("test-sb");
     expect(result.detectionMethod).toBe("registry");
-    expect(result.sandboxVersion).toBe("2026.4.24");
+    expect(result.sandboxVersion).toBe("2026.5.18");
     expect(result.isStale).toBe(false);
   });
 
@@ -103,7 +103,7 @@ describe("checkAgentVersion", () => {
     registry.registerSandbox({
       name: "test-sb",
       agent: null,
-      agentVersion: "2026.4.24",
+      agentVersion: "2026.5.18",
     });
 
     const result = checkAgentVersion("test-sb");
@@ -120,7 +120,7 @@ describe("checkAgentVersion", () => {
 
     vi.mocked(spawnSync).mockReturnValue({
       status: 0,
-      stdout: "OpenClaw 2026.4.24 (abc123)\n",
+      stdout: "OpenClaw 2026.5.18 (abc123)\n",
       stderr: "",
       pid: 1234,
       output: [],
@@ -129,7 +129,7 @@ describe("checkAgentVersion", () => {
 
     const result = checkAgentVersion("test-sb");
     expect(result.detectionMethod).toBe("ssh-exec");
-    expect(result.sandboxVersion).toBe("2026.4.24");
+    expect(result.sandboxVersion).toBe("2026.5.18");
     expect(result.isStale).toBe(false);
     expect(captureOpenshellCommand).toHaveBeenCalledWith(
       "/usr/local/bin/openshell",
@@ -139,7 +139,7 @@ describe("checkAgentVersion", () => {
 
     // Should have cached the version in registry
     const updated = registry.getSandbox("test-sb");
-    expect(updated?.agentVersion).toBe("2026.4.24");
+    expect(updated?.agentVersion).toBe("2026.5.18");
   });
 
   it("returns unavailable when SSH config fails", () => {
@@ -183,7 +183,7 @@ describe("checkAgentVersion", () => {
 
     vi.mocked(spawnSync).mockReturnValue({
       status: 0,
-      stdout: "OpenClaw 2026.4.24 (abc123)\n",
+      stdout: "OpenClaw 2026.5.18 (abc123)\n",
       stderr: "",
       pid: 1234,
       output: [],
@@ -192,7 +192,7 @@ describe("checkAgentVersion", () => {
 
     const result = checkAgentVersion("test-sb", { forceProbe: true });
     expect(result.detectionMethod).toBe("ssh-exec");
-    expect(result.sandboxVersion).toBe("2026.4.24");
+    expect(result.sandboxVersion).toBe("2026.5.18");
   });
 });
 
@@ -219,14 +219,14 @@ describe("formatStalenessWarning", () => {
   it("includes sandbox name, versions, and rebuild hint", () => {
     const lines = formatStalenessWarning("my-sb", {
       sandboxVersion: "2026.3.11",
-      expectedVersion: "2026.4.24",
+      expectedVersion: "2026.5.18",
       isStale: true,
       detectionMethod: "registry",
     });
     const joined = lines.join("\n");
     expect(joined).toContain("my-sb");
     expect(joined).toContain("2026.3.11");
-    expect(joined).toContain("2026.4.24");
+    expect(joined).toContain("2026.5.18");
     expect(joined).toContain("rebuild");
   });
 });