fix(sandbox): match re-execed plain-openclaw gateway argv in HEALTHCHECK (#4952) by jason-ma-nv · Pull Request #4958 · NVIDIA/NemoClaw

jason-ma-nv · 2026-06-08T12:20:14Z

Summary

The sandbox container Docker HEALTHCHECK reported every NemoClaw sandbox as (unhealthy) even when the gateway was alive and serving. Recent OpenClaw (v0.0.44 / 2026.5.18+) re-execs the long-running gateway into a process whose argv is plain openclaw with no gateway token, which the gateway-liveness fallback's pgrep -f 'openclaw[ -]gateway' could not match. This adds a pgrep -x openclaw fallback so the re-execed form is recognized.

Related Issue

Fixes #4952

Changes

Dockerfile: the HEALTHCHECK gateway-liveness fallback now tries pgrep --ignore-ancestors -f 'openclaw[ -]gateway' first and falls back to pgrep --ignore-ancestors -x openclaw, matching the re-execed plain-openclaw argv by exact process name. This mirrors the established gateway_pid() helper in test/e2e/test-issue-2478-crash-loop-recovery.sh (gateway-token match first, bare-openclaw fallback second). The surrounding comment is updated to explain the new form.
test/sandbox-provisioning.test.ts: new #4952 describe block that drives a pgrep mock which actually matches its -f/-x pattern against a simulated process table — so the probe outcome depends on the real argv shape rather than a forced exit code (which the existing runProductionHealthProbe harness cannot exercise). Covers the plain-openclaw argv, the launcher openclaw gateway run form, the legacy openclaw-gateway form, and the no-process case.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Verification

npx prek run --all-files passes
npm test passes
Tests added or updated for new or changed behavior
No secrets, API keys, or credentials committed
Docs updated for user-facing behavior changes
npm run docs builds without warnings (doc changes only)
Doc pages follow the style guide (doc changes only)
New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: jama@nvidia.com jama@nvidia.com

Summary by CodeRabbit

Bug Fixes
- More reliable container healthchecks to avoid false "unhealthy" states by recognizing re-execed gateway variants and validating a recorded gateway PID.
New Features
- HEALTHCHECK now falls back to a persisted gateway PID when process argv patterns are absent; gateway launches now record the PID for probe reliability.
Documentation
- Expanded HEALTHCHECK docs and rationale covering newer gateway re-exec behavior.
Tests
- Added regression and unit tests covering re-exec, PID-recording, and various healthy/unhealthy scenarios.

…ECK (#4952) Recent OpenClaw (v0.0.44 / 2026.5.18+) re-execs the long-running gateway into a process whose argv is plain `openclaw` with no `gateway` token. On runtime shapes where the in-container curl probe fails (connection refused, exit 7) and the /tmp/nemoclaw-gateway-local marker is present, the gateway-liveness fallback used `pgrep -f 'openclaw[ -]gateway'`, which cannot see the re-execed process — so the container was reported permanently unhealthy even though the gateway was alive and serving. Add a `pgrep -x openclaw` fallback that matches the re-execed form by exact process name, mirroring the gateway_pid() helper in test/e2e/test-issue-2478-crash-loop-recovery.sh (gateway-token match first, bare-openclaw fallback second). Cover the regression in test/sandbox-provisioning.test.ts with a pgrep mock that matches its -f/-x pattern against a simulated process table, so the probe outcome depends on the real argv shape rather than a forced exit code. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: jason <jama@nvidia.com>

coderabbitai · 2026-06-08T12:20:27Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4065cedb-9810-4f9c-a40c-fcce02f61bf5

📥 Commits

Reviewing files that changed from the base of the PR and between 998c642 and fd05be3.

📒 Files selected for processing (2)

Dockerfile
scripts/nemoclaw-start.sh

🚧 Files skipped from review as they are similar to previous changes (2)

scripts/nemoclaw-start.sh
Dockerfile

📝 Walkthrough

Walkthrough

Start script now records gateway PID to /tmp/nemoclaw-gateway.pid; Dockerfile HEALTHCHECK first tries pgrep for gateway argv and falls back to verifying the recorded PID's command name when curl reports connection refused. Tests validate PID recording and the HEALTHCHECK probe across argv variants and failure modes.

Changes

Sandbox Healthcheck Process Detection Fix

Layer / File(s)	Summary
Healthcheck comment and fallback detection logic `Dockerfile`	HEALTHCHECK docs updated; when curl returns connection refused the probe first tries `pgrep -f 'openclaw[ -]gateway'` and, if absent, reads `/tmp/nemoclaw-gateway.pid` and verifies that PID's `ps -o comm=` matches `openclaw*`; otherwise container is unhealthy.
record_gateway_pid helper and invocation points `scripts/nemoclaw-start.sh`	Adds `record_gateway_pid()` (best-effort write to `/tmp/nemoclaw-gateway.pid`) and invokes it immediately after gateway launch and after each respawn in both non-root and root modes.
Tests for record_gateway_pid behaviour `test/gateway-pid-recording.test.ts`	Extracts the shell helper from the start script, tests that it writes a provided PID to a temp file, and verifies it exits successfully when the target path is unwritable (best-effort semantics).
HEALTHCHECK regression tests (argv variants & failure modes) `test/sandbox-provisioning.test.ts`	Derives the HEALTHCHECK command from the Dockerfile and runs it with mocked `curl`, `pgrep`, and `ps` over simulated process tables and optional recorded gateway PID. Asserts healthy for plain re-execed `openclaw` when recorded PID resolves to `openclaw`, launcher-form `openclaw gateway run`, and legacy `openclaw-gateway`, and asserts unhealthy for missing/invalid recorded PID and PID reuse cases.
Test harness stub update `test/nemoclaw-start.test.ts`	Stubs `record_gateway_pid()` (no-op) alongside `cleanup_on_signal()` in the gateway launch test harness so generated scripts reference the symbol during tests.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested reviewers

cv
ericksoa
prekshivyas

🐰 I hopped through scripts and Dockerfile lines,
I left a PID trail for the healthcheck to find,
When argv hides the gateway as just "openclaw",
My small note shows which PID it saw,
Now containers can say "I'm healthy!" — hop hooray!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: fixing the HEALTHCHECK to detect re-execed plain-openclaw gateway argv by updating pattern matching and PID tracking logic.
Linked Issues check	✅ Passed	The PR fully addresses `#4952` requirements: updated pgrep fallback patterns, added PID file recording in nemoclaw-start.sh, implemented PID verification via ps, and added comprehensive test coverage for all argv forms and edge cases.
Out of Scope Changes check	✅ Passed	All changes directly support fixing the HEALTHCHECK fallback issue: Dockerfile updates pgrep logic, scripts/nemoclaw-start.sh adds PID tracking, and tests verify the fallback behavior and PID recording function.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/4952-healthcheck-pgrep-plain-openclaw

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-06-08T12:23:04Z

E2E Advisor Recommendation

Required E2E: None
Optional E2E: None

Workflow run

Full advisor summary

E2E Recommendation Advisor

Failed: Could not parse JSON from advisor output; see /home/runner/work/NemoClaw/NemoClaw/artifacts/e2e-advisor/e2e-advisor-raw-output.txt

github-actions · 2026-06-08T12:23:05Z

Vitest E2E Scenario Recommendation

Required Vitest E2E scenarios: None
Optional Vitest E2E scenarios: None

Workflow run

Full Vitest E2E advisor summary

Vitest E2E Scenario Advisor

Failed: Could not parse JSON from advisor output; see /home/runner/work/NemoClaw/NemoClaw/artifacts/e2e-advisor/e2e-scenario-advisor-raw-output.txt

github-actions · 2026-06-08T12:23:37Z

PR Review Advisor

Findings: 0 needs attention, 1 worth checking, 0 nice ideas
Top item: PR review advisor unavailable

Review findings

🛠️ Needs attention

None.

🔎 Worth checking

PR review advisor unavailable: The automated advisor could not complete: Could not parse JSON from PR review advisor output; see /home/runner/work/NemoClaw/NemoClaw/artifacts/pr-review-advisor/pr-review-advisor-raw-output.txt
- Recommendation: Re-run the PR Review Advisor or perform a manual review.
- Evidence: Could not parse JSON from PR review advisor output; see /home/runner/work/NemoClaw/NemoClaw/artifacts/pr-review-advisor/pr-review-advisor-raw-output.txt

🌱 Nice ideas

None.

Consider writing more tests for

**Runtime validation** — Add or identify targeted runtime/integration validation for the changed behavior; do not report external E2E job pass/fail here.. Runtime/sandbox/infrastructure paths need behavioral runtime validation: Dockerfile, scripts/nemoclaw-start.sh.

Workflow run details

This is an automated advisory review. A human maintainer must make the final merge decision.

…ay PID (#4952) Tighten the re-execed-gateway fallback added for #4952. A bare `pgrep -x openclaw` only proves *some* process named `openclaw` exists, so a marker-present container with a stale non-empty /tmp/gateway.log plus an unrelated `openclaw` one-shot (e.g. `openclaw agent ...`) could keep Docker healthy after the real gateway died, weakening restart/self-healing. nemoclaw-start now records the live gateway PID in /tmp/nemoclaw-gateway.pid (record_gateway_pid, written on both the root and non-root launch paths and refreshed on every respawn). When the `openclaw[ -]gateway` pgrep pattern misses, the HEALTHCHECK confirms THAT recorded PID is still a live `openclaw` process via `ps -p <pid> -o comm=`, with a comm-prefix guard against PID reuse. This is gateway-specific and no longer fooled by a non-gateway `openclaw` process. Tests: - test/sandbox-provisioning.test.ts: drive the fallback with a recorded PID file + ps mock; add the reviewer's case (stray non-gateway `openclaw` + dead recorded PID -> unhealthy) and a PID-reuse case. - test/gateway-pid-recording.test.ts (new, focused file): record_gateway_pid writes the PID file the HEALTHCHECK reads and never fails startup on a write error. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: jason <jama@nvidia.com>

jason-ma-nv · 2026-06-08T13:17:39Z

Pushed a follow-up addressing the review feedback.

PR Review Advisor — "Tighten bare openclaw fallback" (the self-healing gap): fixed. The bare pgrep -x openclaw fallback is replaced with a gateway-specific check: nemoclaw-start now records the live gateway PID in /tmp/nemoclaw-gateway.pid (record_gateway_pid, written on both the root and non-root launch paths and refreshed on every respawn), and when the openclaw[ -]gateway pgrep pattern misses, the HEALTHCHECK confirms that recorded PID is still a live openclaw process via ps -p <pid> -o comm= (with a comm-prefix guard against PID reuse). A stale /tmp/gateway.log plus an unrelated openclaw one-shot can no longer keep the container green after the real gateway dies — restart/self-healing is preserved.

New/updated tests:

test/sandbox-provisioning.test.ts: the fallback is now exercised with a recorded PID file + ps mock. Added the exact case you flagged — stray non-gateway openclaw present + recorded gateway PID dead → unhealthy — plus a PID-reuse case.
test/gateway-pid-recording.test.ts (new focused file): proves record_gateway_pid writes the file the HEALTHCHECK reads and never aborts startup on a write error.

Linked Issues check (curl probe): the curl exit-7 path is handled by design — it falls back rather than failing — so the "always unhealthy" symptom was driven by the liveness fallback, which is what this PR corrects. Binding the gateway to loopback / probing its actual listener address is a separate concern best tracked on its own; happy to open a follow-up if maintainers prefer the broader change here.

E2E advisors: the suggested real-container assertion of .State.Health.Status under the #4952 shape is a good addition but lives outside this unit/shell-snippet scope — noting it for issue-2478-crash-loop-recovery-e2e / a dedicated production-HEALTHCHECK e2e.

coderabbitai

🧹 Nitpick comments (2)

Dockerfile (1)
964-979: Run the container-level E2E health assertions for this HEALTHCHECK change.

Given this is Docker HEALTHCHECK behavior, please validate with the recommended E2E jobs to confirm .State.Health.Status behavior in a real container runtime.

As per coding guidelines, Dockerfile-layer behavior is only fully testable with real container builds and should be validated via the listed nightly E2E jobs.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` around lines 964 - 979, Run container-level E2E validation for
the new HEALTHCHECK snippet: build and run the image and exercise the
HEALTHCHECK path that reads
NEMOCLAW_DASHBOARD_PORT/OPENCLAW_GATEWAY_PORT/CHAT_UI_URL, probes
http://127.0.0.1:${port}/health, and falls back to the local gateway checks
(/tmp/nemoclaw-gateway-local, /tmp/nemoclaw-gateway.pid, process matching
'openclaw gateway', and /tmp/gateway.log); use the recommended nightly E2E jobs
to confirm the container .State.Health.Status transitions for success, curl
connection refused (rc=7) and other failures, and document any runtime
differences from the Dockerfile logic.
Source: Coding guidelines
scripts/nemoclaw-start.sh (1)
3185-3594: Run the entrypoint-focused E2E suite for restart and recovery semantics.

This PID-recording path affects every sandbox boot and respawn loop; please validate with the recommended sandbox-survival-e2e, sandbox-operations-e2e, cloud-e2e, and openclaw-slack-pairing-e2e jobs.

As per coding guidelines, scripts/nemoclaw-start.sh changes are not fully covered by unit tests and should be verified via the specified nightly E2E workflows.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/nemoclaw-start.sh` around lines 3185 - 3594, Run the
entrypoint-focused E2E suites (sandbox-survival-e2e, sandbox-operations-e2e,
cloud-e2e, openclaw-slack-pairing-e2e) to validate the new non-root and root
PID/respawn behavior: exercise gateway start/stop/crash scenarios and confirm
record_gateway_pid writes the expected PID, SANDBOX_CHILD_PIDS and
SANDBOX_WAIT_PID are populated correctly after launches and respawns, the
respawn sliding-window logic (RESPAWN_TIMES/RESPAWN_COUNT) enforces the intended
throttling/alerts, the persistent log mirror started by
start_persistent_gateway_log_mirror captures /tmp/gateway.log into the durable
sandbox log, and validate_tmp_permissions/path ownership fixes
(fix_openclaw_ownership, provision_agent_workspaces,
seed_default_workspace_templates_as_sandbox) preserve permissions so restarts
and auto-pairing succeed; file any failures or flakes as regressions against
these functions for follow-up.
Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@Dockerfile`:
- Around line 964-979: Run container-level E2E validation for the new
HEALTHCHECK snippet: build and run the image and exercise the HEALTHCHECK path
that reads NEMOCLAW_DASHBOARD_PORT/OPENCLAW_GATEWAY_PORT/CHAT_UI_URL, probes
http://127.0.0.1:${port}/health, and falls back to the local gateway checks
(/tmp/nemoclaw-gateway-local, /tmp/nemoclaw-gateway.pid, process matching
'openclaw gateway', and /tmp/gateway.log); use the recommended nightly E2E jobs
to confirm the container .State.Health.Status transitions for success, curl
connection refused (rc=7) and other failures, and document any runtime
differences from the Dockerfile logic.

In `@scripts/nemoclaw-start.sh`:
- Around line 3185-3594: Run the entrypoint-focused E2E suites
(sandbox-survival-e2e, sandbox-operations-e2e, cloud-e2e,
openclaw-slack-pairing-e2e) to validate the new non-root and root PID/respawn
behavior: exercise gateway start/stop/crash scenarios and confirm
record_gateway_pid writes the expected PID, SANDBOX_CHILD_PIDS and
SANDBOX_WAIT_PID are populated correctly after launches and respawns, the
respawn sliding-window logic (RESPAWN_TIMES/RESPAWN_COUNT) enforces the intended
throttling/alerts, the persistent log mirror started by
start_persistent_gateway_log_mirror captures /tmp/gateway.log into the durable
sandbox log, and validate_tmp_permissions/path ownership fixes
(fix_openclaw_ownership, provision_agent_workspaces,
seed_default_workspace_templates_as_sandbox) preserve permissions so restarts
and auto-pairing succeed; file any failures or flakes as regressions against
these functions for follow-up.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9807d797-5212-49f4-8643-dd3a7b8c6702

📥 Commits

Reviewing files that changed from the base of the PR and between 2684c22 and 4a4122c.

📒 Files selected for processing (4)

Dockerfile
scripts/nemoclaw-start.sh
test/gateway-pid-recording.test.ts
test/sandbox-provisioning.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

test/sandbox-provisioning.test.ts

…4952) The runLaunchBlock harness in nemoclaw-start.test.ts extracts the gateway launch block and runs it with its helper calls stubbed. The new record_gateway_pid call added for #4952 was not stubbed, so the extracted block hit an undefined command (exit 127) and failed the two launch-block tests in CI. Stub it alongside cleanup_on_signal (kept on one line to stay within the test-file-size budget) so the extracted block does not write the host /tmp during the test. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: jason <jama@nvidia.com>

wscurran · 2026-06-08T14:44:09Z

✨
Related open issues:

#4952 [All Platforms][Sandbox] sandbox container HEALTHCHECK always unhealthy — gateway not on container loopback and pgrep fallback uses wrong argv pattern

…pgrep-plain-openclaw # Conflicts: # scripts/nemoclaw-start.sh # test/nemoclaw-start.test.ts

## Summary Refreshes release-prep documentation for NemoClaw v0.0.65. Adds the v0.0.65 release-notes section and refreshes generated `nemoclaw-user-*` skills from the Fern MDX source docs. ## Changes - Added the v0.0.65 release notes to `docs/about/release-notes.mdx` with links to the deeper docs pages for lifecycle, troubleshooting, inference, CLI commands, messaging, credentials, network policy, Hermes, and sub-agents. - Regenerated the `nemoclaw-user-*` skills with `scripts/docs-to-skills.py` so release-prep skill output matches the merged source docs. - Used the v0.0.65 announcement discussion as release context: #5472. ## Source Summary - #2492 -> `docs/about/release-notes.mdx`: Documents deadline-based gateway wait reliability in the v0.0.65 recovery summary. - #4958 -> `docs/about/release-notes.mdx`: Documents re-execed OpenClaw gateway health check recovery in the sandbox recovery summary. - #5163 -> `docs/about/release-notes.mdx`: Documents safer uninstall TTY confirmation behavior in the day-two CLI summary. - #5178 -> `docs/about/release-notes.mdx`: Documents fail-closed config restore merge behavior in the rebuild and restore summary. - #5179 -> `docs/about/release-notes.mdx`: Documents WeChat QR token redaction in the messaging summary. - #5182 -> `docs/about/release-notes.mdx`: Documents sustained gateway serving checks in the recovery summary. - #5194 -> `docs/about/release-notes.mdx`: Documents model-router teardown during uninstall in the day-two CLI summary. - #5195 -> `docs/about/release-notes.mdx`: Documents Shields auto-restore lock reconfirmation in the rebuild and restore summary. - #5198 -> `docs/about/release-notes.mdx`: Documents Docker Desktop WSL CDI injection failure handling in the onboarding diagnostics summary. - #5201 -> `docs/about/release-notes.mdx`: Documents sandbox download/upload wrappers and sessions export in the day-two CLI summary. - #5205 -> `docs/about/release-notes.mdx`: Documents reporter-owned model metadata preservation in the rebuild and restore summary. - #5214 -> `docs/about/release-notes.mdx`: Documents managed vLLM model preflight before side effects in the inference setup summary. - #5215 -> `docs/about/release-notes.mdx`: Documents managed vLLM extra serve arguments in the inference setup summary. - #5216 -> `docs/about/release-notes.mdx`: Documents silent OpenClaw runtime fallback surfacing in the onboarding diagnostics summary. - #5225 -> `docs/about/release-notes.mdx`: Documents persisted sandbox gateway lookup in the gateway recovery summary. - #5238 -> `docs/about/release-notes.mdx`: Documents sub-agent gateway dial-back through the sandbox interface in the Hermes and sub-agent summary. - #5248 -> `docs/about/release-notes.mdx`: Documents Discord per-account proxy resolution in the messaging summary. - #5264 -> `docs/about/release-notes.mdx`: Documents reserved Hermes port `8642` handling in the Hermes compatibility summary. - #5267 -> `docs/about/release-notes.mdx`: Documents the narrower Hermes baseline policy in the Hermes compatibility summary. - #5321 -> `docs/about/release-notes.mdx`: Documents restored gateway guard chains in the gateway recovery summary. - #5328 -> `docs/about/release-notes.mdx`: Documents compact persisted messaging plans in the messaging summary. - #5338 -> `docs/about/release-notes.mdx`: Documents manifest channel migration in the messaging summary. - #5352 -> `docs/about/release-notes.mdx`: Documents persisted agent preservation through registry recovery in the rebuild and restore summary. - #5371 -> `.agents/skills/nemoclaw-user-reference/references/commands.md`: Refreshes generated skill output for custom build cache and layer-ordering source docs. - #5379 -> `docs/about/release-notes.mdx`: Documents dashboard port allocation across multiple NemoClaw gateways in the recovery summary. - #5382 -> `docs/about/release-notes.mdx`: Documents recovery when an active gateway has no sandbox spec in the recovery summary. - #5389 -> `.agents/skills/nemoclaw-user-reference/references/troubleshooting.md`: Refreshes generated skill output for declared agent `forward_ports` recovery source docs. - #5400 -> `docs/about/release-notes.mdx`: Documents bounded compatible endpoint probes in the inference setup summary. - #5410 -> `docs/about/release-notes.mdx`: Documents provider credential hash removal from sandbox registry entries in the messaging summary. - #5418 -> `docs/about/release-notes.mdx`: Documents summarized inference validation failures in the onboarding diagnostics summary. - #5457 -> `docs/about/release-notes.mdx`: Documents context-window recomputation after runtime model switches in the inference setup summary. - #5463 -> `docs/about/release-notes.mdx`: Documents cleanup of hard-coded messaging channel stragglers in the messaging summary. ## Skipped - #5366 matched `docs/.docs-skip` entries through skipped experimental paths, so this PR does not add new release-note text for that commit. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Verification - [x] Git hooks passed during commit and push, or `npx prek run --from-ref main --to-ref HEAD` passes - [ ] Targeted tests pass for changed behavior - [ ] Full `npm test` passes (broad runtime changes only) - [ ] Tests added or updated for new or changed behavior - [x] No secrets, API keys, or credentials committed - [x] Docs updated for user-facing behavior changes - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) Verification notes: - `npm run docs` passed after rerunning outside the sandbox. Fern reported 0 errors and 1 hidden warning. - The first sandboxed `npm run docs` attempt failed before validation because `tsx` could not create its local IPC pipe under sandbox restrictions. - `npm run build:cli` passed before push to refresh the local `dist/` artifacts used by the CLI typecheck hook. - `npm test` was not run because this is a docs-only release refresh. --- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>  ## Summary by CodeRabbit * **New Features** * Released NemoClaw v0.0.65 with improved gateway/sandbox recovery, safer day-two workflows, and enhanced Hermes compatibility. * Added managed vLLM extra-arguments configuration via `NEMOCLAW_VLLM_EXTRA_ARGS_JSON`. * Added Hermes troubleshooting guidance for port forwarding and health checks. * **Documentation** * Updated NVIDIA Endpoints/NIM setup and examples to use `NVIDIA_INFERENCE_API_KEY`. * Refined NVIDIA network policy and Model Router API base configuration. * Expanded CLI/environment variable documentation (including sub-agent gateway connectivity) and plugin build performance tips. * **Tests** * Expanded Vitest-backed E2E release validation coverage.

jason-ma-nv self-assigned this Jun 8, 2026

coderabbitai Bot reviewed Jun 8, 2026

View reviewed changes

wscurran added area: integrations Third-party service integration behavior area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery bug-fix PR fixes a bug or regression integration: openclaw OpenClaw integration behavior labels Jun 8, 2026

jason-ma-nv added the v0.0.64 label Jun 12, 2026

cv added v0.0.65 and removed v0.0.64 labels Jun 12, 2026

cv approved these changes Jun 13, 2026

View reviewed changes

Merge remote-tracking branch 'origin/main' into fix/4952-healthcheck-…

fd05be3

…pgrep-plain-openclaw # Conflicts: # scripts/nemoclaw-start.sh # test/nemoclaw-start.test.ts

cv merged commit 4d56aae into main Jun 13, 2026
44 checks passed

cv deleted the fix/4952-healthcheck-pgrep-plain-openclaw branch June 13, 2026 08:46

miyoungc mentioned this pull request Jun 16, 2026

docs: refresh v0.0.65 release docs #5519

Merged

13 tasks

coderabbitai Bot mentioned this pull request Jun 17, 2026

fix(sandbox): pin gateway.reload=hot and add gateway serving watchdog (#4710) #5181

Merged

6 tasks

wscurran added the NV QA Bugs found by the NVIDIA QA Team label Jun 26, 2026

Navigation Menu

Uh oh!

fix(sandbox): match re-execed plain-openclaw gateway argv in HEALTHCHECK (#4952) - #4958

fix(sandbox): match re-execed plain-openclaw gateway argv in HEALTHCHECK (#4952)#4958
cv merged 4 commits into
mainfrom
fix/4952-healthcheck-pgrep-plain-openclaw

jason-ma-nv commented Jun 8, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 8, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Suggested reviewers

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Jun 8, 2026 •

edited

Loading

E2E Recommendation Advisor

Uh oh!

github-actions Bot commented Jun 8, 2026 •

edited

Loading

Vitest E2E Scenario Advisor

Uh oh!

github-actions Bot commented Jun 8, 2026 •

edited

Loading

🛠️ Needs attention

🔎 Worth checking

🌱 Nice ideas

Uh oh!

jason-ma-nv commented Jun 8, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

wscurran commented Jun 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

jason-ma-nv commented Jun 8, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Verification

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Suggested reviewers

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E Advisor Recommendation

E2E Recommendation Advisor

Uh oh!

github-actions Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Vitest E2E Scenario Recommendation

Vitest E2E Scenario Advisor

Uh oh!

github-actions Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Advisor

🛠️ Needs attention

🔎 Worth checking

🌱 Nice ideas

Uh oh!

jason-ma-nv commented Jun 8, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

wscurran commented Jun 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jason-ma-nv commented Jun 8, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 8, 2026 •

edited

Loading

github-actions Bot commented Jun 8, 2026 •

edited

Loading

github-actions Bot commented Jun 8, 2026 •

edited

Loading

github-actions Bot commented Jun 8, 2026 •

edited

Loading