From dd9d2a02ac60f61ab2120853a0c800d958c4b29d Mon Sep 17 00:00:00 2001 From: Glenn-Agent Date: Wed, 3 Jun 2026 07:49:39 +0530 Subject: [PATCH 1/2] docs: update sub-agent config exec examples Signed-off-by: Glenn-Agent --- .../references/set-up-sub-agent.md | 29 +++++++++---------- docs/inference/set-up-sub-agent.mdx | 17 +++++------ .../references/set-up-sub-agent.md | 17 +++++------ 3 files changed, 30 insertions(+), 33 deletions(-) diff --git a/.agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md b/.agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md index 272b093974d..6ca7be7512b 100644 --- a/.agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md +++ b/.agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md @@ -37,17 +37,16 @@ It keeps the primary `main` agent on the normal NemoClaw inference route and add | Sub-agent model | `nvidia-omni/private/nvidia/nemotron-3-nano-omni-reasoning-30b-a3b` | | Delegation tool | `sessions_spawn` | -The sub-agent uses Omni as the specialist model for image tasks. +Omni is used as the specialist model for image tasks. The primary orchestration model remains responsible for conversation, planning, and deciding when to delegate. ## Update the Sandbox Config Fetch the current OpenClaw config from the sandbox, patch it with your auxiliary provider and `agents.list` changes, then upload it back. -```bash -export SANDBOX=my-assistant -export DOCKER_CTR=openshell-cluster-nemoclaw -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json +```console +$ export SANDBOX=my-assistant +$ nemoclaw "$SANDBOX" exec -- cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json ``` Create `/tmp/openclaw.updated.json` with the OpenClaw sub-agent config. @@ -56,13 +55,13 @@ For the Omni example, the demo provides `vlm-demo/vlm-subagent/openclaw-patch.py Upload the patched config and refresh the hash. In the default mutable state, this keeps the local hash consistent but does not make it tamper-proof; lock the config root-owned and read-only afterward if the sandbox should enforce config integrity at startup. -```bash -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/openclaw.json -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/.config-hash -cat /tmp/openclaw.updated.json | docker exec -i "$DOCKER_CTR" kubectl exec -i -n openshell "$SANDBOX" -c agent -- sh -c 'cat > /sandbox/.openclaw/openclaw.json' -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- /bin/bash -c "cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash" -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/openclaw.json -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/.config-hash +```console +$ SANDBOX_CTR=$(docker ps --format '{{.Names}}' \ +> | awk -v name="$SANDBOX" '$0 == "openshell-" name || $0 ~ "^openshell-" name "-" { print; exit }') +$ test -n "$SANDBOX_CTR" +$ cat /tmp/openclaw.updated.json \ +> | docker exec -i --user root "$SANDBOX_CTR" sh -c 'cat > /sandbox/.openclaw/openclaw.json' +$ docker exec --user root "$SANDBOX_CTR" sh -c 'cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash && chown sandbox:sandbox openclaw.json .config-hash && chmod 660 openclaw.json .config-hash' ``` Check `/tmp/gateway.log` after upload and confirm the gateway hot-reloaded the provider or `agents.list` change. @@ -77,10 +76,10 @@ For the Omni example: ``` Use the same provider ID that appears in `models.providers`, such as `nvidia-omni`. -After uploading the auth profile, make sure the sandbox user owns the sub-agent directory: +After uploading the auth profile, make sure the sub-agent directory is owned by the sandbox user: -```bash -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator +```console +$ docker exec --user root "$SANDBOX_CTR" chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator ``` ## Allow Auxiliary Provider Egress diff --git a/docs/inference/set-up-sub-agent.mdx b/docs/inference/set-up-sub-agent.mdx index c836365565c..f5310cd0cfa 100644 --- a/docs/inference/set-up-sub-agent.mdx +++ b/docs/inference/set-up-sub-agent.mdx @@ -55,8 +55,7 @@ Fetch the current OpenClaw config from the sandbox, patch it with your auxiliary ```bash export SANDBOX=my-assistant -export DOCKER_CTR=openshell-cluster-nemoclaw -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json +nemoclaw "$SANDBOX" exec -- cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json ``` Create `/tmp/openclaw.updated.json` with the OpenClaw sub-agent config. @@ -66,12 +65,12 @@ Upload the patched config and refresh the hash. In the default mutable state, this keeps the local hash consistent but does not make it tamper-proof; lock the config root-owned and read-only afterward if the sandbox should enforce config integrity at startup. ```bash -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/openclaw.json -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/.config-hash -cat /tmp/openclaw.updated.json | docker exec -i "$DOCKER_CTR" kubectl exec -i -n openshell "$SANDBOX" -c agent -- sh -c 'cat > /sandbox/.openclaw/openclaw.json' -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- /bin/bash -c "cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash" -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/openclaw.json -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/.config-hash +SANDBOX_CTR=$(docker ps --format '{{.Names}}' \ + | awk -v name="$SANDBOX" '$0 == "openshell-" name || $0 ~ "^openshell-" name "-" { print; exit }') +test -n "$SANDBOX_CTR" +cat /tmp/openclaw.updated.json \ + | docker exec -i --user root "$SANDBOX_CTR" sh -c 'cat > /sandbox/.openclaw/openclaw.json' +docker exec --user root "$SANDBOX_CTR" sh -c 'cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash && chown sandbox:sandbox openclaw.json .config-hash && chmod 660 openclaw.json .config-hash' ``` Check `/tmp/gateway.log` after upload and confirm the gateway hot-reloaded the provider or `agents.list` change. @@ -89,7 +88,7 @@ Use the same provider ID that appears in `models.providers`, such as `nvidia-omn After uploading the auth profile, make sure the sandbox user owns the sub-agent directory: ```bash -docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator +docker exec --user root "$SANDBOX_CTR" chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator ``` ## Allow Auxiliary Provider Egress diff --git a/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md b/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md index 148eaf0e7e2..6ca7be7512b 100644 --- a/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md +++ b/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md @@ -46,8 +46,7 @@ Fetch the current OpenClaw config from the sandbox, patch it with your auxiliary ```console $ export SANDBOX=my-assistant -$ export DOCKER_CTR=openshell-cluster-nemoclaw -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json +$ nemoclaw "$SANDBOX" exec -- cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json ``` Create `/tmp/openclaw.updated.json` with the OpenClaw sub-agent config. @@ -57,12 +56,12 @@ Upload the patched config and refresh the hash. In the default mutable state, this keeps the local hash consistent but does not make it tamper-proof; lock the config root-owned and read-only afterward if the sandbox should enforce config integrity at startup. ```console -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/openclaw.json -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/.config-hash -$ cat /tmp/openclaw.updated.json | docker exec -i "$DOCKER_CTR" kubectl exec -i -n openshell "$SANDBOX" -c agent -- sh -c 'cat > /sandbox/.openclaw/openclaw.json' -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- /bin/bash -c "cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash" -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/openclaw.json -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/.config-hash +$ SANDBOX_CTR=$(docker ps --format '{{.Names}}' \ +> | awk -v name="$SANDBOX" '$0 == "openshell-" name || $0 ~ "^openshell-" name "-" { print; exit }') +$ test -n "$SANDBOX_CTR" +$ cat /tmp/openclaw.updated.json \ +> | docker exec -i --user root "$SANDBOX_CTR" sh -c 'cat > /sandbox/.openclaw/openclaw.json' +$ docker exec --user root "$SANDBOX_CTR" sh -c 'cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash && chown sandbox:sandbox openclaw.json .config-hash && chmod 660 openclaw.json .config-hash' ``` Check `/tmp/gateway.log` after upload and confirm the gateway hot-reloaded the provider or `agents.list` change. @@ -80,7 +79,7 @@ Use the same provider ID that appears in `models.providers`, such as `nvidia-omn After uploading the auth profile, make sure the sub-agent directory is owned by the sandbox user: ```console -$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator +$ docker exec --user root "$SANDBOX_CTR" chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator ``` ## Allow Auxiliary Provider Egress From 0589d53156b73605387e77915bd3dabfea01b9a7 Mon Sep 17 00:00:00 2001 From: Glenn-Agent Date: Sat, 6 Jun 2026 09:32:45 +0530 Subject: [PATCH 2/2] docs: remove generated skill changes Signed-off-by: Glenn-Agent --- .../references/set-up-sub-agent.md | 29 ++++++++++--------- .../references/set-up-sub-agent.md | 17 ++++++----- 2 files changed, 24 insertions(+), 22 deletions(-) diff --git a/.agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md b/.agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md index 6ca7be7512b..272b093974d 100644 --- a/.agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md +++ b/.agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md @@ -37,16 +37,17 @@ It keeps the primary `main` agent on the normal NemoClaw inference route and add | Sub-agent model | `nvidia-omni/private/nvidia/nemotron-3-nano-omni-reasoning-30b-a3b` | | Delegation tool | `sessions_spawn` | -Omni is used as the specialist model for image tasks. +The sub-agent uses Omni as the specialist model for image tasks. The primary orchestration model remains responsible for conversation, planning, and deciding when to delegate. ## Update the Sandbox Config Fetch the current OpenClaw config from the sandbox, patch it with your auxiliary provider and `agents.list` changes, then upload it back. -```console -$ export SANDBOX=my-assistant -$ nemoclaw "$SANDBOX" exec -- cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json +```bash +export SANDBOX=my-assistant +export DOCKER_CTR=openshell-cluster-nemoclaw +docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json ``` Create `/tmp/openclaw.updated.json` with the OpenClaw sub-agent config. @@ -55,13 +56,13 @@ For the Omni example, the demo provides `vlm-demo/vlm-subagent/openclaw-patch.py Upload the patched config and refresh the hash. In the default mutable state, this keeps the local hash consistent but does not make it tamper-proof; lock the config root-owned and read-only afterward if the sandbox should enforce config integrity at startup. -```console -$ SANDBOX_CTR=$(docker ps --format '{{.Names}}' \ -> | awk -v name="$SANDBOX" '$0 == "openshell-" name || $0 ~ "^openshell-" name "-" { print; exit }') -$ test -n "$SANDBOX_CTR" -$ cat /tmp/openclaw.updated.json \ -> | docker exec -i --user root "$SANDBOX_CTR" sh -c 'cat > /sandbox/.openclaw/openclaw.json' -$ docker exec --user root "$SANDBOX_CTR" sh -c 'cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash && chown sandbox:sandbox openclaw.json .config-hash && chmod 660 openclaw.json .config-hash' +```bash +docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/openclaw.json +docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/.config-hash +cat /tmp/openclaw.updated.json | docker exec -i "$DOCKER_CTR" kubectl exec -i -n openshell "$SANDBOX" -c agent -- sh -c 'cat > /sandbox/.openclaw/openclaw.json' +docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- /bin/bash -c "cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash" +docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/openclaw.json +docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/.config-hash ``` Check `/tmp/gateway.log` after upload and confirm the gateway hot-reloaded the provider or `agents.list` change. @@ -76,10 +77,10 @@ For the Omni example: ``` Use the same provider ID that appears in `models.providers`, such as `nvidia-omni`. -After uploading the auth profile, make sure the sub-agent directory is owned by the sandbox user: +After uploading the auth profile, make sure the sandbox user owns the sub-agent directory: -```console -$ docker exec --user root "$SANDBOX_CTR" chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator +```bash +docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator ``` ## Allow Auxiliary Provider Egress diff --git a/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md b/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md index 6ca7be7512b..148eaf0e7e2 100644 --- a/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md +++ b/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md @@ -46,7 +46,8 @@ Fetch the current OpenClaw config from the sandbox, patch it with your auxiliary ```console $ export SANDBOX=my-assistant -$ nemoclaw "$SANDBOX" exec -- cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json +$ export DOCKER_CTR=openshell-cluster-nemoclaw +$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- cat /sandbox/.openclaw/openclaw.json > /tmp/openclaw.json ``` Create `/tmp/openclaw.updated.json` with the OpenClaw sub-agent config. @@ -56,12 +57,12 @@ Upload the patched config and refresh the hash. In the default mutable state, this keeps the local hash consistent but does not make it tamper-proof; lock the config root-owned and read-only afterward if the sandbox should enforce config integrity at startup. ```console -$ SANDBOX_CTR=$(docker ps --format '{{.Names}}' \ -> | awk -v name="$SANDBOX" '$0 == "openshell-" name || $0 ~ "^openshell-" name "-" { print; exit }') -$ test -n "$SANDBOX_CTR" -$ cat /tmp/openclaw.updated.json \ -> | docker exec -i --user root "$SANDBOX_CTR" sh -c 'cat > /sandbox/.openclaw/openclaw.json' -$ docker exec --user root "$SANDBOX_CTR" sh -c 'cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash && chown sandbox:sandbox openclaw.json .config-hash && chmod 660 openclaw.json .config-hash' +$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/openclaw.json +$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 644 /sandbox/.openclaw/.config-hash +$ cat /tmp/openclaw.updated.json | docker exec -i "$DOCKER_CTR" kubectl exec -i -n openshell "$SANDBOX" -c agent -- sh -c 'cat > /sandbox/.openclaw/openclaw.json' +$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- /bin/bash -c "cd /sandbox/.openclaw && sha256sum openclaw.json > .config-hash" +$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/openclaw.json +$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chmod 444 /sandbox/.openclaw/.config-hash ``` Check `/tmp/gateway.log` after upload and confirm the gateway hot-reloaded the provider or `agents.list` change. @@ -79,7 +80,7 @@ Use the same provider ID that appears in `models.providers`, such as `nvidia-omn After uploading the auth profile, make sure the sub-agent directory is owned by the sandbox user: ```console -$ docker exec --user root "$SANDBOX_CTR" chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator +$ docker exec "$DOCKER_CTR" kubectl exec -n openshell "$SANDBOX" -c agent -- chown -R sandbox:sandbox /sandbox/.openclaw/agents/vision-operator ``` ## Allow Auxiliary Provider Egress