docs: refresh v0.0.65 release docs

.agents/skills/nemoclaw-user-configure-inference/references/inference-options.md

@@ -53,7 +53,7 @@ The managed install/start vLLM entry appears by default on DGX Spark and DGX Sta
 
 | Option | Description | Curated models |
 |--------|-------------|----------------|
-| NVIDIA Endpoints | Routes to models hosted on [build.nvidia.com](https://build.nvidia.com). You can also enter any model ID from the catalog. Set `NVIDIA_API_KEY`. | Nemotron 3 Super 120B, Nemotron 3 Ultra 550B, GLM-5.1, MiniMax M2.7, GPT-OSS 120B, DeepSeek V4 Pro |
+| NVIDIA Endpoints | Routes to models hosted on [build.nvidia.com](https://build.nvidia.com). You can also enter any model ID from the catalog. Set `NVIDIA_INFERENCE_API_KEY`. | Nemotron 3 Super 120B, Nemotron 3 Ultra 550B, GLM-5.1, MiniMax M2.7, GPT-OSS 120B, DeepSeek V4 Pro |
 | OpenAI | Routes to the OpenAI API. Set `OPENAI_API_KEY`. | `gpt-5.4`, `gpt-5.4-mini`, `gpt-5.4-nano`, `gpt-5.4-pro-2026-03-05` |
 | Other OpenAI-compatible endpoint | Routes to any server that implements `/v1/chat/completions`. NemoClaw uses `/v1/chat/completions` at runtime by default; set `NEMOCLAW_PREFERRED_API=openai-responses` to allow `/v1/responses` for proxies that implement it, such as some llama.cpp builds. The wizard prompts for a base URL and model name. Works with OpenRouter, LocalAI, llama.cpp, or any compatible proxy. When you enable Telegram messaging, onboarding also runs a bounded sandbox-side smoke check through `https://inference.local/v1/chat/completions`. Set `COMPATIBLE_API_KEY`. | You provide the model name. |
 | Anthropic | Routes to the Anthropic Messages API. Set `ANTHROPIC_API_KEY`. | `claude-sonnet-4-6`, `claude-haiku-4-5`, `claude-opus-4-6` |
@@ -98,12 +98,12 @@ models:
   - name: nano
     litellm_model: "openai/nvidia/nvidia/Nemotron-3-Nano-30B-A3B"
     cost_per_m_input_tokens: 0.05
-    api_base: "https://inference-api.nvidia.com"
+    api_base: "https://integrate.api.nvidia.com"
 
   - name: super
-    litellm_model: "openai/nvidia/nvidia/nemotron-3-super-v3"
+    litellm_model: "openai/nvidia/nemotron-3-super-120b-a12b"
     cost_per_m_input_tokens: 0.10
-    api_base: "https://inference-api.nvidia.com"
+    api_base: "https://integrate.api.nvidia.com"
 ```
 
 The `tolerance` parameter controls the accuracy-cost tradeoff.
@@ -127,7 +127,7 @@ The sandbox never sees raw API keys.
 To use the router in scripted setup, set:
 
 ```bash
-NEMOCLAW_PROVIDER=routed NVIDIA_API_KEY=<your-key> nemoclaw onboard --non-interactive
+NEMOCLAW_PROVIDER=routed NVIDIA_INFERENCE_API_KEY=<your-key> nemoclaw onboard --non-interactive
 ```
 
 ### Host Python Requirement
@@ -171,7 +171,7 @@ For setup instructions, refer to [Use a Local Inference Server](../SKILL.md).
 NemoClaw validates the selected provider and model before creating the sandbox.
 If credential validation fails, the wizard asks whether to re-enter the API key, choose a different provider, retry, or exit.
 The wizard retries transient upstream validation failures before it reports a provider failure.
-The `nvapi-` prefix check applies only to `NVIDIA_API_KEY`.
+The `nvapi-` prefix check applies only to `NVIDIA_INFERENCE_API_KEY`.
 Other provider credentials, such as `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GEMINI_API_KEY`, and compatible endpoint keys, use provider-aware validation during retry.
 
 | Provider type | Validation method |
@@ -369,6 +369,20 @@ NEMOCLAW_PROVIDER=install-vllm \
 NemoClaw accepts `HUGGING_FACE_HUB_TOKEN` as an alternative.
 The token check runs on the host before any docker pull, so a missing or empty token aborts onboarding before bandwidth is spent on a 401.
 
+### Add Managed-vLLM Serve Arguments
+
+For advanced vLLM options that are not in the NemoClaw registry yet, export `NEMOCLAW_VLLM_EXTRA_ARGS_JSON` as a JSON array of individual non-blank `vllm serve` tokens.
+NemoClaw trims and validates the array before pulling images or downloading models, shell-quotes each token, and appends the tokens after the registry defaults.
+
+```bash
+NEMOCLAW_PROVIDER=install-vllm \
+  NEMOCLAW_VLLM_EXTRA_ARGS_JSON='["--max-num-seqs","2","--disable-log-requests"]' \
+  nemoclaw onboard --non-interactive
+```
+
+Use this for operator-owned tuning only.
+If the selected vLLM image does not support an argument, the managed container exits and NemoClaw prints the vLLM log tail.
+
 ## NVIDIA NIM (Experimental)
 
 NemoClaw can pull, start, and manage a NIM container on hosts with a NIM-capable NVIDIA GPU.
@@ -390,7 +404,7 @@ NVIDIA hosts NIM container images on `nvcr.io`, and `docker pull` requires NGC r
 If Docker is not already logged in to `nvcr.io`, onboard prompts for an [NGC API key](https://org.ngc.nvidia.com/setup/api-key) and runs `docker login nvcr.io` over `--password-stdin` so the key is never written to disk or shell history.
 The prompt masks the key during input and retries one time on a bad key before failing.
 In non-interactive mode, onboard exits with login instructions if Docker is not already authenticated; run `docker login nvcr.io` yourself, then re-run `nemoclaw onboard --non-interactive`.
-If `NGC_API_KEY` or `NVIDIA_API_KEY` is already exported, NemoClaw passes it into the managed NIM container through the process environment instead of command-line arguments.
+If `NGC_API_KEY` or `NVIDIA_INFERENCE_API_KEY` is already exported, NemoClaw passes it into the managed NIM container through the process environment instead of command-line arguments.
 If the NIM container exits before the health endpoint becomes ready, onboarding stops early and prints the last container log lines.
 After NIM becomes healthy, NemoClaw reads `/v1/models` and uses the served model id for validation when it differs from the catalog name.
 Unsafe served ids are rejected instead of being written into the sandbox config.

.agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md

@@ -92,6 +92,19 @@ In the Omni demo, the OpenClaw gateway runs as `/usr/local/bin/node`, so the NVI
 
 Refer to Customize the Network Policy (use the `nemoclaw-user-manage-policy` skill) for policy update workflows.
 
+## Sub-Agent Gateway Connectivity
+
+Spawned sub-agents connect back to the OpenClaw gateway over WebSocket at `OPENCLAW_GATEWAY_URL`.
+Inside the sandbox this connection runs through the enforced process tree, where the OpenShell proxy always blocks loopback destinations.
+NemoClaw therefore points `OPENCLAW_GATEWAY_URL` at the sandbox's own interface address (for example `ws://10.200.0.2:18790`) and allowlists that endpoint in the base sandbox policy (`openclaw_gateway_dialback`).
+
+If `sessions_spawn` returns `gateway closed (1006 abnormal closure (no close frame))` and the gateway log shows no connection attempt, the dial-back path is blocked.
+Check the following:
+
+1. `OPENCLAW_GATEWAY_URL` in the gateway process environment targets the sandbox interface address, not `127.0.0.1`.
+2. The active policy allows that address and port. Custom `NEMOCLAW_DASHBOARD_PORT` or proxy subnet values need a matching `openshell policy update`.
+3. Do not point the dial-back at `127.0.0.1` — the proxy denies loopback regardless of policy.
+
 ## Add Delegation Instructions
 
 OpenClaw handles `sessions_spawn`, but the primary agent still needs task instructions.

.agents/skills/nemoclaw-user-configure-security/references/credential-storage.md

@@ -44,7 +44,7 @@ That directory is created with mode `0700` and contains no credential material.
 When a NemoClaw command needs a credential value during a single run (for example to forward it to an `openshell provider` registration), it reads from `process.env` first.
 This means you can:
 
-- Prefix any command with the credential to override the gateway-stored value: `NVIDIA_API_KEY=nvapi-... nemoclaw onboard`
+- Prefix any command with the credential to override the gateway-stored value: `NVIDIA_INFERENCE_API_KEY=nvapi-... nemoclaw onboard`
 - Use short-lived or rotated credentials in CI by exporting them once per pipeline run
 - Avoid registering credentials in the gateway entirely if your environment supplies them
 
@@ -57,7 +57,7 @@ Export the credential only when you want to create, replace, or rotate the store
 A typical deploy invocation looks like:
 
 ```bash
-NVIDIA_API_KEY=nvapi-... \
+NVIDIA_INFERENCE_API_KEY=nvapi-... \
     HF_TOKEN=hf_... \
     TELEGRAM_BOT_TOKEN=... \
     nemoclaw deploy my-instance
@@ -98,7 +98,7 @@ If `~/.nemoclaw/credentials.json` remains after a rebuild or other credential lo
 The simplest way to replace a stored value is to rerun onboarding with the new value in your environment:
 
 ```bash
-NVIDIA_API_KEY=nvapi-new-value nemoclaw onboard
+NVIDIA_INFERENCE_API_KEY=nvapi-new-value nemoclaw onboard
 ```
 
 To remove a credential from the gateway entirely:

.agents/skills/nemoclaw-user-deploy-remote/references/install-openclaw-plugins.md

@@ -55,6 +55,48 @@ nemoclaw onboard --from ./my-plugin-sandbox/Dockerfile
 
 If you need a second sandbox alongside an existing one, use a dedicated build directory and rerun onboarding with the sandbox name and ports you intend to use.
 
+## Build Performance
+
+Custom plugin images are normal Docker builds, so build time depends on the build context size and the Docker layer cache rather than on NemoClaw.
+
+Keep the build context small and dedicated.
+The Dockerfile's parent directory is staged as the build context before the Docker build starts, so a broad directory can make onboarding look stuck while Docker is only preparing context.
+A small build directory stages quickly:
+
+```text
+my-plugin-sandbox/        # fast: only what the image needs
+├── Dockerfile
+├── .dockerignore
+└── my-plugin/
+```
+
+A Dockerfile placed in a large tree stages slowly:
+
+```text
+~/                        # slow: stages the whole home directory
+├── Dockerfile
+├── Downloads/
+├── datasets/
+└── models/
+```
+
+Distinguish cold builds from warm rebuilds.
+The first build on a fresh host is a cold build that downloads the base image and package indexes, so it is the slowest run.
+Later warm rebuilds reuse cached layers when the base image and earlier layers are unchanged.
+
+Order Dockerfile instructions from least-changing to most-changing so warm rebuilds reuse cached dependency layers:
+
+1. Base image.
+2. System package installs.
+3. Dependency manifests such as `package.json`.
+4. Dependency install such as `npm ci`.
+5. Application source.
+
+Pin the base image to an explicit tag or digest so warm rebuilds resolve the same cached base instead of pulling a new one.
+
+When a build feels slow, set `NEMOCLAW_TRACE=1` before onboarding to capture phase timings that separate context staging, Docker build, image upload, and sandbox readiness.
+For the full `--from` build-context rules and trace details, refer to CLI Commands Reference (use the `nemoclaw-user-reference` skill).
+
 ## Network Access
 
 Plugins still run inside the sandbox policy boundary.

.agents/skills/nemoclaw-user-get-started/SKILL.md

@@ -115,7 +115,7 @@ A configured blueprint router profile makes the Model Router option appear.
 **Tip:**
 
 Export the API key before launching the installer so the wizard does not have to ask for it.
-For example, run `export NVIDIA_API_KEY=<your-key>` before `curl ... | bash`.
+For example, run `export NVIDIA_INFERENCE_API_KEY=<your-key>` before `curl ... | bash`.
 If you entered a key incorrectly, refer to Reset a Stored Credential (use the `nemoclaw-user-manage-sandboxes` skill) to clear and re-enter it.
 
 ### Choose an Inference Provider
@@ -126,14 +126,14 @@ For Ollama, vLLM, NIM, and compatible local servers, refer to Use a Local Infere
 
 | Option | Use when | Credential variable |
 |---|---|---|
-| NVIDIA Endpoints | You want hosted models from `build.nvidia.com`, including hosted Nemotron models. | `NVIDIA_API_KEY` |
+| NVIDIA Endpoints | You want hosted models from `build.nvidia.com`, including hosted Nemotron models. | `NVIDIA_INFERENCE_API_KEY` |
 | OpenAI | You want the OpenAI API at `https://api.openai.com/v1`. | `OPENAI_API_KEY` |
 | Other OpenAI-compatible endpoint | You have OpenRouter, LocalAI, llama.cpp, vLLM, NIM, SGLang, an enterprise gateway, or another `/v1/chat/completions` endpoint. | `COMPATIBLE_API_KEY` |
 | Anthropic | You want the Anthropic Messages API. | `ANTHROPIC_API_KEY` |
 | Other Anthropic-compatible endpoint | You have a Claude proxy, Bedrock-compatible gateway, or self-hosted `/v1/messages` endpoint. | `COMPATIBLE_ANTHROPIC_API_KEY` |
 | Google Gemini | You want Google's OpenAI-compatible Gemini endpoint. | `GEMINI_API_KEY` |
 | Local Ollama | You want a host-local Ollama model. | None |
-| Model Router | You want NemoClaw to start the host-side model router. | `NVIDIA_API_KEY` |
+| Model Router | You want NemoClaw to start the host-side model router. | `NVIDIA_INFERENCE_API_KEY` |
 
 Export the relevant key before launching the installer when possible.
 If your compatible endpoint does not require authentication, set its credential variable to any non-empty placeholder.

.agents/skills/nemoclaw-user-get-started/references/quickstart-hermes.md

@@ -82,17 +82,17 @@ export NEMOCLAW_AGENT=hermes
 export NEMOCLAW_NON_INTERACTIVE=1
 export NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1
 export NEMOCLAW_SANDBOX_NAME=my-hermes
-export NVIDIA_API_KEY=<your-key>
+export NVIDIA_INFERENCE_API_KEY=<your-key>
 curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
 ```
 
 Use the provider variables from Inference Options (use the `nemoclaw-user-configure-inference` skill) when you choose a different provider.
 
 ## Connect to Hermes
 
-When onboarding completes, NemoClaw prints the sandbox name, model, lifecycle commands, and Hermes dashboard URL.
+When onboarding completes, NemoClaw prints the sandbox name, model, lifecycle commands, the Hermes dashboard URL, and the OpenAI-compatible API URL.
 Hermes exposes its built-in browser dashboard on port `18789`.
-NemoClaw also forwards the OpenAI-compatible API on port `8642` for local clients.
+NemoClaw also forwards the OpenAI-compatible API on port `8642` for local clients, and the summary now announces both URLs.
 NemoClaw builds the Hermes dashboard assets into the sandbox image, so the dashboard starts without running `npm` as the sandbox user under `/opt/hermes`.
 Dashboard chat uses the prebuilt `/opt/hermes/ui-tui` bundle.
 If you need to recover the Hermes dashboard manually, use `hermes dashboard --tui --skip-build` so recovery does not try to rebuild assets under root-owned install paths.
@@ -111,6 +111,10 @@ Access
   Port 18789 must be forwarded before opening this URL.
   http://127.0.0.1:18789/
 
+  Hermes Agent OpenAI-compatible API
+  Port 8642 must be forwarded before connecting.
+  http://127.0.0.1:8642/v1
+
 Terminal:
   nemohermes my-hermes connect
 

.agents/skills/nemoclaw-user-manage-policy/references/approve-network-requests.md

@@ -53,7 +53,8 @@ From the NemoClaw repository root, run the walkthrough script after you have onb
 ```
 
 This script opens a split tmux session with the TUI on the left and the agent on the right.
-The walkthrough requires tmux and the `NVIDIA_API_KEY` environment variable, and it assumes an existing sandbox to attach to.
+The walkthrough requires tmux and the `NVIDIA_INFERENCE_API_KEY` environment variable.
+It assumes an existing sandbox to attach to.
 
 ## Related Topics