diff --git a/ci/platform-matrix.json b/ci/platform-matrix.json index 9f9c2ffcd16..bfbcee9d550 100644 --- a/ci/platform-matrix.json +++ b/ci/platform-matrix.json @@ -1,7 +1,7 @@ { "$comment": "Single source of truth for NemoClaw launch claims and platform support. Covers platforms, inference providers, supported agents, messaging integrations, and deployment paths. Scripts read this to generate README and docs tables. QA/CI update platform/provider rows; the engineering owner reviews other rows. Docs are derived.", "version": "1.1", - "updated": "2026-06-12", + "updated": "2026-06-25", "project_status": { "stage": "alpha", @@ -302,6 +302,11 @@ "name": "WhatsApp", "status": "caveated", "notes": "Supported by both OpenClaw and Hermes (see `messaging_platforms` in `agents/openclaw/manifest.yaml` and `agents/hermes/manifest.yaml`). Pairing happens in the sandbox through WhatsApp Web by scanning a QR code at first run; the Hermes flow exposes this as `hermes whatsapp` and persists session credentials under `~/.hermes/platforms/whatsapp/session` (`agents/hermes/manifest.yaml:69-71`). Sandbox egress goes through the `whatsapp` policy preset, which carries the WebSocket / Noise / h1-ALPN caveats documented in `nemoclaw-blueprint/policies/presets/whatsapp.yaml`. No Meta Business API integration today; that path is out of scope for this matrix." + }, + { + "name": "Microsoft Teams", + "status": "experimental", + "notes": "Supported by both OpenClaw and Hermes through the manifest-first messaging channel contract. Requires Bot Framework app credentials, a tenant ID, and a public HTTPS endpoint that reaches the sandbox webhook path `/api/messages`. Sandbox egress goes through the `teams` policy preset, and only one active Teams sandbox can use a given local `MSTEAMS_PORT` forward." } ], diff --git a/docs/about/release-notes.mdx b/docs/about/release-notes.mdx index 16aff24b20a..49783bf0a69 100644 --- a/docs/about/release-notes.mdx +++ b/docs/about/release-notes.mdx @@ -15,6 +15,26 @@ NVIDIA NemoClaw is available in early preview starting March 16, 2026. Use this page to track the highlights of the latest release. For more detailed release notes, refer to the [NemoClaw GitHub announcements](https://github.com/NVIDIA/NemoClaw/discussions/categories/announcements?discussions_q=is%3Aopen+category%3AAnnouncements). +## v0.0.68 + +NemoClaw v0.0.68 improves onboarding recovery, messaging setup, agent-specific CLI behavior, local inference defaults, and release validation: + +- Installer and onboarding paths now stop on real setup failures and recover more cleanly after interrupted runs. + Scripted installs propagate onboarding exit codes, interrupted installer runs start fresh when no sandbox exists to resume, and resume behavior stays tied to onboarding sessions with a real sandbox. + For more information, refer to [NemoClaw Quickstart with OpenClaw](../get-started/quickstart) and [Troubleshooting](../reference/troubleshooting). +- Messaging setup adds experimental Microsoft Teams channel onboarding for OpenClaw and Hermes, including Bot Framework credentials, webhook forwarding, the `teams` network policy preset, and local webhook port conflict checks. + NemoClaw also treats `messaging_platforms: []` as an explicit deny-all declaration and rejects `channels add` before policy, provider, registry, credential, or rebuild mutations when the selected agent does not support messaging. + For more information, refer to [Messaging Channels](../manage-sandboxes/messaging-channels) and [Platform Support and Launch Claims](../reference/platform-support). +- Agent-specific CLI commands now route more accurately and fail earlier with clearer local guidance. + `sessions export` routes by sandbox agent kind, Hermes `gateway-token` points users to `dashboard-url`, bare OpenClaw `agent` invocations print wrapper help locally, and omitted extra-agent `workspace` and `agentDir` fields use canonical OpenClaw paths. + For more information, refer to [NemoClaw CLI Commands Reference](../reference/commands). +- LangChain Deep Agents Code sandboxes now stay alive with a stable entrypoint, use their own product branding, reject unsupported messaging mutations, and preserve the hosted-compatible default model ID without doubling the provider namespace. + For more information, refer to [Quickstart with LangChain Deep Agents Code](../get-started/quickstart-langchain-deepagents-code), [NemoClaw Inference Options](../inference/inference-options), and [Platform Support and Launch Claims](../reference/platform-support). +- DGX Spark express install now selects managed local vLLM by default, while hosted NVIDIA inference setup preserves the provider, namespace, and model ID shape used by the compatible endpoint path. + For more information, refer to [NemoClaw Quickstart with OpenClaw](../get-started/quickstart), [NemoClaw Inference Options](../inference/inference-options), and [Platform Support and Launch Claims](../reference/platform-support). +- Platform-support docs now rely on the canonical support matrix, so users and agents see one source of truth for supported platforms, inference providers, agents, messaging integrations, deployment paths, capabilities, and out-of-scope items. + For more information, refer to [Platform Support and Launch Claims](../reference/platform-support). + ## v0.0.67 NemoClaw v0.0.67 improves onboarding recovery, messaging reliability, OpenClaw agent workflows, and AI-agent documentation routing: diff --git a/docs/manage-sandboxes/messaging-channels.mdx b/docs/manage-sandboxes/messaging-channels.mdx index 6403b77aafd..bcab813b198 100644 --- a/docs/manage-sandboxes/messaging-channels.mdx +++ b/docs/manage-sandboxes/messaging-channels.mdx @@ -3,9 +3,9 @@ # SPDX-License-Identifier: Apache-2.0 title: "Messaging Channels" sidebar-title: "Set Up Messaging Channels" -description: "Connect Telegram, Discord, Slack, WeChat, or WhatsApp to your sandboxed OpenClaw or Hermes agent using OpenShell-managed channel messaging." -description-agent: "Explains how Telegram, Discord, Slack, WeChat, and WhatsApp reach sandboxed OpenClaw and Hermes agents through OpenShell-managed processes and NemoClaw channel commands. Use when setting up messaging channels, chat interfaces, or integrations without relying on nemoclaw tunnel start for bridges." -keywords: ["nemoclaw messaging channels", "nemoclaw telegram", "nemoclaw discord", "nemoclaw slack", "nemoclaw wechat", "nemoclaw whatsapp", "openshell channel messaging"] +description: "Connect Telegram, Discord, Slack, WeChat, WhatsApp, or Microsoft Teams to your sandboxed OpenClaw or Hermes agent using OpenShell-managed channel messaging." +description-agent: "Explains how Telegram, Discord, Slack, WeChat, WhatsApp, and Microsoft Teams reach sandboxed OpenClaw and Hermes agents through OpenShell-managed processes and NemoClaw channel commands. Use when setting up messaging channels, chat interfaces, or integrations without relying on nemoclaw tunnel start for bridges." +keywords: ["nemoclaw messaging channels", "nemoclaw telegram", "nemoclaw discord", "nemoclaw slack", "nemoclaw wechat", "nemoclaw whatsapp", "nemoclaw teams", "openshell channel messaging"] content: type: "how_to" skill: @@ -13,15 +13,16 @@ skill: --- import { AgentOnly } from "../_components/AgentGuide"; -Telegram, Discord, Slack, WeChat, and WhatsApp reach your OpenClaw or Hermes agent through OpenShell-managed processes and gateway constructs. +Telegram, Discord, Slack, WeChat, WhatsApp, and Microsoft Teams reach your OpenClaw or Hermes agent through OpenShell-managed processes and gateway constructs. For token-based channels, NemoClaw registers credentials with OpenShell providers. WeChat captures a token through a host-side QR scan during onboarding. WhatsApp pairs inside the sandbox through a QR scan and intentionally stores mutable session state there. +Microsoft Teams uses Bot Framework credentials plus a public HTTPS webhook that forwards to the sandbox. NemoClaw bakes the selected channel configuration into the sandbox image and keeps runtime delivery under OpenShell control. -WeChat and WhatsApp are experimental. -Both rely on QR-based pairing flows that are more fragile than token-based bots, and the upstream client libraries can change behavior without notice. +WeChat, WhatsApp, and Microsoft Teams are experimental. +WeChat and WhatsApp rely on QR-based pairing flows that are more fragile than token-based bots, and Microsoft Teams requires an externally reachable webhook path that depends on your host networking setup. Interfaces, defaults, and supported features can change, and NVIDIA does not recommend these channels for production use. @@ -47,7 +48,7 @@ For details, refer to [Commands](../reference/commands). ## Prerequisites - A machine where you can run `$$nemoclaw onboard` (local or remote host that runs the gateway and sandbox). -- A token for each token-based messaging platform you want to enable, a personal WeChat account on your phone for the host-side QR scan during onboarding, or a phone you can use to scan the QR code for WhatsApp pairing. +- A token or app credential set for each credential-based messaging platform you want to enable, a personal WeChat account on your phone for the host-side QR scan during onboarding, or a phone you can use to scan the QR code for WhatsApp pairing. - A network policy preset for each enabled channel, or equivalent custom egress rules. ## Channel Requirements @@ -59,6 +60,7 @@ For details, refer to [Commands](../reference/commands). | Slack | `SLACK_BOT_TOKEN`, `SLACK_APP_TOKEN` | `SLACK_ALLOWED_USERS` for DM and channel `@mention` user allowlisting, `SLACK_ALLOWED_CHANNELS` for channel ID allowlisting | | WeChat (experimental) | None. Captured through host-side QR scan during `$$nemoclaw onboard` | `WECHAT_ALLOWED_IDS` for DM allowlisting | | WhatsApp (experimental) | None. Pair through QR after rebuild | None | +| Microsoft Teams (experimental) | `MSTEAMS_APP_ID`, `MSTEAMS_APP_PASSWORD`, `MSTEAMS_TENANT_ID` | `TEAMS_ALLOWED_USERS` for Microsoft Entra ID object ID allowlisting, `MSTEAMS_PORT` for the local webhook port, `TEAMS_REQUIRE_MENTION` for OpenClaw group and channel mention mode | Telegram uses a bot token from [BotFather](https://t.me/BotFather). Open Telegram, send `/newbot` to [@BotFather](https://t.me/BotFather), follow the prompts, and copy the token. @@ -100,6 +102,18 @@ Slack Socket Mode allows one active connection per app-level token. If another sandbox on the same gateway already uses the same Slack app token, onboarding and `channels add slack` warn before continuing in interactive mode and abort in non-interactive mode. Use `--force` only when you intentionally want to move the Slack Socket Mode session to the new sandbox. +Microsoft Teams (experimental) uses the Bot Framework webhook path. +Create or configure a Teams app whose messaging endpoint is a public HTTPS URL ending in `/api/messages`, and point that URL at the host port NemoClaw forwards for the sandbox. +The default local webhook port is `3978`; set `MSTEAMS_PORT` or `TEAMS_PORT` before onboarding or `channels add teams` when you need another port. +No two active Teams sandboxes can share the same local webhook port, so NemoClaw blocks the second enablement and asks you to choose a different `MSTEAMS_PORT` or stop the other sandbox. + +Teams requires an app ID, client secret, and tenant ID. +Set `MSTEAMS_APP_ID`, `MSTEAMS_APP_PASSWORD`, and `MSTEAMS_TENANT_ID`, or use the aliases `TEAMS_CLIENT_ID`, `TEAMS_CLIENT_SECRET`, and `TEAMS_TENANT_ID`. +The client secret is stored as the `-teams-bridge` OpenShell provider and reaches the sandbox as an OpenShell placeholder, not as a raw value baked into the image. +Use `TEAMS_ALLOWED_USERS` or `MSTEAMS_ALLOWED_USERS` to list comma-separated Microsoft Entra ID object IDs that may interact with the bot. +For OpenClaw group and channel messages, `TEAMS_REQUIRE_MENTION` defaults to `1`, so the bot replies only when mentioned. +Direct messages are unaffected by mention mode. + WeChat (experimental) delivers messages over Tencent's iLink gateway through the upstream `@tencent-weixin/openclaw-weixin` plugin installed into WeChat-enabled OpenClaw sandbox images and the built-in Hermes iLink WeChat adapter. The supported mode in this release is **personal WeChat** (`bot_type=3`). WeChat Official Account and WeCom/Enterprise WeChat are not wired up. @@ -136,7 +150,7 @@ Pair only one sandbox per WhatsApp account at a time. ## Enable Channels During Onboarding -When the wizard reaches **Messaging channels**, it lists Telegram, Discord, Slack, WeChat, and WhatsApp. +When the wizard reaches **Messaging channels**, it lists Telegram, Discord, Slack, WeChat, WhatsApp, and Microsoft Teams when the selected agent supports them. Press a channel number to toggle it on or off, then press **Enter** when done. If you select no channels, pressing **Enter** skips messaging setup. If a token-based channel token is not already in the environment or credential store, the wizard prompts for it and saves it. @@ -161,6 +175,11 @@ export SLACK_BOT_TOKEN= export SLACK_APP_TOKEN= export SLACK_ALLOWED_USERS= export SLACK_ALLOWED_CHANNELS= +export MSTEAMS_APP_ID= +export MSTEAMS_APP_PASSWORD= +export MSTEAMS_TENANT_ID= +export TEAMS_ALLOWED_USERS= +export MSTEAMS_PORT=3978 ``` This release does not support non-interactive WeChat configuration because the iLink QR handshake requires a human to scan the QR on a paired phone. @@ -172,7 +191,7 @@ Then run onboarding: $$nemoclaw onboard ``` -Complete the rest of the wizard so the blueprint can create OpenShell providers where needed (for example `-telegram-bridge` or `-wechat-bridge`), bake channel configuration into the image (`NEMOCLAW_MESSAGING_CHANNELS_B64`), and start the sandbox. +Complete the rest of the wizard so the blueprint can create OpenShell providers where needed (for example `-telegram-bridge`, `-teams-bridge`, or `-wechat-bridge`), bake channel configuration into the image (`NEMOCLAW_MESSAGING_CHANNELS_B64`), and start the sandbox. ## Add Channels After Onboarding @@ -191,10 +210,11 @@ $$nemoclaw my-assistant channels add discord $$nemoclaw my-assistant channels add slack $$nemoclaw my-assistant channels add wechat $$nemoclaw my-assistant channels add whatsapp +$$nemoclaw my-assistant channels add teams ``` `channels add` collects whatever each channel needs. -It prompts for Telegram, Discord, and Slack tokens, runs an interactive host-side QR scan for WeChat, and collects nothing for WhatsApp because pairing happens in-sandbox after rebuild. +It prompts for Telegram, Discord, Slack, and Microsoft Teams tokens and configuration, runs an interactive host-side QR scan for WeChat, and collects nothing for WhatsApp because pairing happens in-sandbox after rebuild. It registers bridge providers with the OpenShell gateway when it captures tokens, records the channel in the sandbox registry, and asks whether to rebuild immediately. The command accepts mixed-case input such as `Telegram`, then stores and prints the canonical lowercase channel name. `channels add` requires the matching built-in network policy preset YAML to be present. @@ -206,8 +226,8 @@ It flags `gateway-providers` as residual because the in-flight upsert can leave Verify the gateway bridge before relying on the channel. Restore the preset YAML and re-run `$$nemoclaw channels add `. Choose the rebuild so the running sandbox image picks up the new channel. -For Telegram, Discord, and Slack, `channels add` also checks the rebuilt runtime for the selected bridge and reports startup, credential, or missing-plugin warnings before returning. -If you need optional channel settings such as `TELEGRAM_ALLOWED_IDS`, `TELEGRAM_REQUIRE_MENTION`, `TELEGRAM_GROUP_POLICY`, `DISCORD_SERVER_ID`, `DISCORD_USER_ID`, `DISCORD_REQUIRE_MENTION`, `SLACK_ALLOWED_USERS`, or `SLACK_ALLOWED_CHANNELS`, export them before the rebuild starts. +For Telegram, Discord, Slack, and Microsoft Teams, `channels add` also checks the rebuilt runtime for the selected bridge and reports startup, credential, or missing-plugin warnings before returning. +If you need optional channel settings such as `TELEGRAM_ALLOWED_IDS`, `TELEGRAM_REQUIRE_MENTION`, `TELEGRAM_GROUP_POLICY`, `DISCORD_SERVER_ID`, `DISCORD_USER_ID`, `DISCORD_REQUIRE_MENTION`, `SLACK_ALLOWED_USERS`, `SLACK_ALLOWED_CHANNELS`, `TEAMS_ALLOWED_USERS`, `MSTEAMS_PORT`, or `TEAMS_REQUIRE_MENTION`, export them before the rebuild starts. You can omit `TELEGRAM_REQUIRE_MENTION` and `DISCORD_REQUIRE_MENTION` when you want the default mention-only mode. You can omit `TELEGRAM_GROUP_POLICY` when you want OpenClaw Telegram group access to stay open. Telegram Bot API `sendMessage` calls prove outbound delivery from the bot; to test inbound agent replies, send a message from the Telegram client as an allowed user. @@ -238,6 +258,20 @@ DISCORD_BOT_TOKEN= \ $$nemoclaw my-assistant channels add discord ``` +For Microsoft Teams, create the Teams app and public HTTPS endpoint first, then provide the app credentials and local webhook port when you add the channel: + +```bash +MSTEAMS_APP_ID= \ + MSTEAMS_APP_PASSWORD= \ + MSTEAMS_TENANT_ID= \ + TEAMS_ALLOWED_USERS= \ + MSTEAMS_PORT=3978 \ + $$nemoclaw my-assistant channels add teams +``` + +After the rebuild starts the Teams webhook forward, route your public HTTPS endpoint to `http://127.0.0.1:3978/api/messages` or the port you selected with `MSTEAMS_PORT`. +If `channels add teams` reports that another sandbox already uses the same Teams webhook port, choose another `MSTEAMS_PORT` for one sandbox or stop and remove the conflicting sandbox. + ### `channels add wechat` `channels add wechat` (experimental) follows the same shape as the other channels with two differences driven by the iLink QR handshake. @@ -270,6 +304,7 @@ To remove a channel and clear its stored credentials, run: ```bash $$nemoclaw my-assistant channels remove telegram $$nemoclaw my-assistant channels remove wechat +$$nemoclaw my-assistant channels remove teams ``` `channels remove wechat` clears the bot token, deletes the `-wechat-bridge` OpenShell provider, and drops `wechat` from the sandbox's enabled-channel set. @@ -312,6 +347,7 @@ For WeChat, each sandbox must own a distinct iLink `accountId` (bot identity). Running two sandboxes against the same WeChat account causes one of them to lose messages. If you enable a messaging channel and another sandbox already uses the same token, onboarding prompts you to confirm before continuing in interactive mode and exits non-zero in non-interactive mode. For Slack, NemoClaw checks both the bot token and the Socket Mode app token so duplicate Socket Mode sessions do not compete silently. +For Microsoft Teams, NemoClaw also checks the local webhook port because active Teams sandboxes cannot share the same forwarded port. If NemoClaw only has legacy channel metadata and cannot compare credential hashes, it keeps the conservative warning. Re-run `channels add ` with the intended token to refresh the stored non-secret hash. `$$nemoclaw status` reports cross-sandbox overlaps so you can resolve duplicates before messages start dropping. @@ -325,13 +361,13 @@ Use `$$nemoclaw tunnel stop` or its deprecated alias `$$nemoclaw stop` when you Use `$$nemoclaw tunnel stop` when you want to stop host auxiliary services and also ask NemoClaw to stop the Hermes gateway inside the selected sandbox. -Stopping the in-sandbox gateway stops Telegram, Discord, Slack, WeChat, and WhatsApp polling for that sandbox until you restart the sandbox or gateway. +Stopping the in-sandbox gateway stops Telegram, Discord, Slack, WeChat, WhatsApp, and Microsoft Teams delivery for that sandbox until you restart the sandbox or gateway. ## Confirm Delivery After the sandbox is running, send a message to the configured bot or app. If delivery fails, use `openshell term` on the host, check gateway logs, and verify network policy allows the channel API. -Use the matching policy preset (`telegram`, `discord`, `slack`, `wechat`, or `whatsapp`) or review [Common Integration Policy Examples](../network-policy/integration-policy-examples). +Use the matching policy preset (`telegram`, `discord`, `slack`, `wechat`, `whatsapp`, or `teams`) or review [Common Integration Policy Examples](../network-policy/integration-policy-examples). ## Tunnel Command diff --git a/docs/reference/commands-nemohermes.mdx b/docs/reference/commands-nemohermes.mdx index 3c00b60933f..8d916fe1265 100644 --- a/docs/reference/commands-nemohermes.mdx +++ b/docs/reference/commands-nemohermes.mdx @@ -1118,9 +1118,8 @@ The host destination defaults to `./sessions-.jsonl`; `--out` picks a d ```bash nemohermes my-assistant sessions export -nemohermes my-assistant sessions export main --agent main -nemohermes my-assistant sessions export agent:work:telegram:t-1 --include-trajectory -nemohermes my-assistant sessions export --format tar --out ./bundles/alpha.tgz --json +nemohermes my-assistant sessions export --agent hermes --out ./sessions-my-assistant.jsonl +nemohermes my-assistant sessions export --json ``` | Flag | Description | diff --git a/docs/reference/commands.mdx b/docs/reference/commands.mdx index 7aa45781adc..84f4d56b7bc 100644 --- a/docs/reference/commands.mdx +++ b/docs/reference/commands.mdx @@ -1414,6 +1414,8 @@ Hermes stores session history in a SQLite database, so the command refuses posit `--agent` accepts only `hermes` as a no-op alias on a Hermes sandbox and rejects any other value. The host destination defaults to `./sessions-.jsonl`; `--out` picks a different path. + + ```bash $$nemoclaw my-assistant sessions export $$nemoclaw my-assistant sessions export main --agent main @@ -1421,6 +1423,17 @@ $$nemoclaw my-assistant sessions export agent:work:telegram:t-1 --include-trajec $$nemoclaw my-assistant sessions export --format tar --out ./bundles/alpha.tgz --json ``` + + + +```bash +$$nemoclaw my-assistant sessions export +$$nemoclaw my-assistant sessions export --agent hermes --out ./sessions-my-assistant.jsonl +$$nemoclaw my-assistant sessions export --json +``` + + + | Flag | Description | |------|-------------| | `--agent ` | OpenClaw: agent id when `` are aliases rather than the canonical `agent::` form. Hermes: accepts only `hermes` as a no-op alias and rejects any other value. | diff --git a/docs/reference/platform-support.mdx b/docs/reference/platform-support.mdx index ad66a3a2a74..fa3036f0674 100644 --- a/docs/reference/platform-support.mdx +++ b/docs/reference/platform-support.mdx @@ -117,6 +117,7 @@ NemoClaw configures messaging channels during onboarding. The OpenShell gateway | Telegram | Tested | Configured through an OpenShell-managed channel during onboarding. | | WeChat | Tested with limitations | Channel hook available. Verify regional account access before relying on this path. | | WhatsApp | Tested with limitations | Supported by both OpenClaw and Hermes (see `messaging_platforms` in `agents/openclaw/manifest.yaml` and `agents/hermes/manifest.yaml`). Pairing happens in the sandbox through WhatsApp Web by scanning a QR code at first run; the Hermes flow exposes this as `hermes whatsapp` and persists session credentials under `~/.hermes/platforms/whatsapp/session` (`agents/hermes/manifest.yaml:69-71`). Sandbox egress goes through the `whatsapp` policy preset, which carries the WebSocket / Noise / h1-ALPN caveats documented in `nemoclaw-blueprint/policies/presets/whatsapp.yaml`. No Meta Business API integration today; that path is out of scope for this matrix. | +| Microsoft Teams | Experimental | Supported by both OpenClaw and Hermes through the manifest-first messaging channel contract. Requires Bot Framework app credentials, a tenant ID, and a public HTTPS endpoint that reaches the sandbox webhook path `/api/messages`. Sandbox egress goes through the `teams` policy preset, and only one active Teams sandbox can use a given local `MSTEAMS_PORT` forward. | {/* integration-status:end */} ## Capabilities