fix(security): harden local credential capture

docs/_components/StarterPrompt.tsx

@@ -89,20 +89,32 @@ Instead, collect the required choices from me first, one clickable selection at
 
 ## Handle Tokens Securely and Visually
 
-When you need an API key, bot token, app token, or other secret, prefer the checked-in NemoClaw local credential form instead of chat.
-
-- Ask permission before opening a local credential form.
-- Do not generate, rewrite, or redesign credential-form HTML. Use the repository form template from this URL exactly: https://raw.githubusercontent.com/NVIDIA/NemoClaw/c9aac7dc12bacdaa4d38af552b893021049ee836/docs/resources/local-credential-form.html
-- Fetch that template or use the local repo copy when available, verify its SHA-256 digest is \`cc746703ab514cf33d7131915f16e8dc19346b26a4d953c5125be81449d6e6f6\`, write the exact bytes into a private temporary directory, then serve it from a helper bound to \`127.0.0.1\` on a random local port.
-- Treat that immutable URL and digest as one reviewed trust boundary. Stop if verification fails; do not substitute a different URL, template, or digest.
-- Open the served loopback URL, not the raw GitHub URL, in your coding-agent UI's browser. Configure fields with query parameters such as \`?fields=NVIDIA_INFERENCE_API_KEY:secret\` or \`?fields=NEMOCLAW_ENDPOINT_URL:text,NEMOCLAW_MODEL:text,COMPATIBLE_API_KEY:secret\`.
-- Implement only the tiny loopback helper around the template: serve the HTML file, accept its \`POST /submit\` JSON payload, keep submitted values in memory, and expose no external network listener. When serving the HTML response, include the HTTP header \`Content-Security-Policy: frame-ancestors 'none'\` because browsers do not enforce that directive from a meta tag.
-- Use \`:secret\` fields for secret values and \`:text\` fields for non-secret IDs such as server IDs, allowlists, endpoint URLs, and sandbox names.
-- Keep submitted secrets only in memory long enough to run the approved command. Do not print them, write them to logs, commit them, or paste them into chat.
-- If you must write a temporary file for the helper, use a private temporary directory, restrict permissions when possible, and delete it immediately after use.
-- Show me a redacted summary before running commands, such as \`TELEGRAM_BOT_TOKEN=********\`, and ask permission to continue.
-- After the command finishes, shut down the local helper and delete the temporary HTML file.
-- If your environment cannot serve a loopback helper, use the local terminal, a secure secret prompt, or the local app prompt that needs the credential. Do not fall back to generated form HTML.
+When you need an API key, bot token, app token, or other secret, prefer the checked-in NemoClaw local credential helper and form instead of chat.
+
+- Before starting credential collection, determine the exact environment-variable names and exact command argv that will receive them. Explain the command in plain language, say that the form's final confirmation runs that already-approved command immediately, and ask my permission.
+- Do not generate, rewrite, or redesign the helper or form. Use this reviewed pair exactly:
+  - Helper: https://raw.githubusercontent.com/NVIDIA/NemoClaw/786856661c24aa25c0843bfe1e5bd72f21e927a2/scripts/local-credential-helper.mts (SHA-256 \`04cd84bf261635cd483669f198671636e38da423fbef059d7d052824879a5f85\`)
+  - Form: https://raw.githubusercontent.com/NVIDIA/NemoClaw/786856661c24aa25c0843bfe1e5bd72f21e927a2/docs/resources/local-credential-form.html (SHA-256 \`5512a256e0ad7c63a26ab82cf4f5924e98652097172ab8a5dc9d9358dd4f6ae8\`)
+- Fetch both files, or use local repository copies when available, and verify both SHA-256 digests before use. Put fetched copies in a private temporary directory with access restricted to the current user.
+- Treat the two immutable URL and digest pairs as one reviewed trust boundary. Stop if either verification fails; do not substitute another URL, helper, form, or digest.
+- The helper requires Node.js 22.16 or newer. If that runtime is unavailable, use a secure local terminal prompt or local app prompt instead; never ask for the value in chat and never fall back to generated helper or form code.
+- Use one explicit execution profile. Choose \`--execution-profile isolated\` for stateless commands; it runs from a private temporary home and working directory that is deleted after the child exits. Choose \`--execution-profile account-home --cwd <approved-absolute-directory>\` only when the command must persist account state, such as a NemoClaw install or onboarding run. Explain that account-home mode trusts existing configuration under the operating-system account home and the approved working directory, and ask my permission for both paths.
+- Use the helper's repeated \`--field NAME:type\` arguments, followed by a literal \`--\` and the exact approved argv. For example:
+- Resolve the approved executable to an absolute native executable or interpreter path before asking permission. The helper rejects PATH-based executable lookup and removes recognized ambient credential-shaped and process-control variables, including configuration roots, source/executable selectors, proxy-routing and TLS-trust overrides, and \`NPM_CONFIG_*\` and \`PIP_*\` package-source settings before applying the selected execution profile and overlaying only the fields collected for the approved command. Approve explicit paths for nested tools when the command needs a non-default PATH. If the command needs a trusted proxy, custom CA, package registry, Python package index, project directory, config file, or profile, select non-secret settings and pre-existing trusted paths in the exact approved argv using the tool's explicit flags. Never put credentials in argv. Use a pre-existing trusted absolute wrapper when the tool requires authenticated configuration or profile discovery that cannot be selected safely through argv. On native Windows, do not target a \`.cmd\` or \`.bat\` file directly; use the absolute \`cmd.exe\` path and make its arguments part of the approved argv.
+
+\`\`\`shell
+node --experimental-strip-types <private-dir>/local-credential-helper.mts --execution-profile isolated --form <private-dir>/local-credential-form.html --field NVIDIA_INFERENCE_API_KEY:secret -- <absolute-approved-executable> <approved-args...>
+\`\`\`
+
+- Use \`:secret\` for every secret. Use \`:text\` only for non-secret IDs, allowlists, endpoint URLs, model names, and sandbox names. The helper must reject credential-looking \`:text\` fields and process-control environment names.
+- Keep real credentials out of argv. The helper supplies accepted values only through the child process environment and invokes the frozen argv without adding a shell.
+- Open only the one-time \`http://127.0.0.1\` URL printed by the helper in the coding-agent UI's browser. Do not paste that URL or its fragment capability into chat.
+- In the form, enter the values and choose **Preview Credentials**. Preview is local-only: it clears the inputs and shows a redacted summary without sending a request. Choose **Edit** to discard that snapshot and re-enter every value.
+- Choose **Confirm and Run Approved Command** only after the redacted summary matches the command I already approved. That click makes the form's sole credential-bearing request; the helper accepts at most one valid submission, closes its listener, and starts the exact approved argv.
+- If the form says the outcome is unknown, do not retry or resubmit. Inspect the coding-agent terminal to determine whether the command ran, then start a fresh helper session only if needed.
+- Keep submitted secrets only in memory long enough to start the approved command. Do not print them, write them to logs, commit them, or paste them into chat.
+- Treat in-memory handling as exposure minimization, not guaranteed erasure. The helper wipes mutable request buffers and promptly drops its JavaScript references, but Node.js strings and the approved child process environment cannot be reliably zeroed.
+- After the command finishes, delete any fetched helper and form copies and their private temporary directory.
 
 Use this provider mapping for non-interactive setup:
 
@@ -118,7 +130,8 @@ Use this provider mapping for non-interactive setup:
 | Local Ollama | \`ollama\` | Optional \`NEMOCLAW_MODEL\`; set \`NEMOCLAW_YES=1\` only if I approve model download |
 | Model Router | \`routed\` | \`NVIDIA_INFERENCE_API_KEY\` |
 
-When you have the approved values, run the installer with the environment variables on the \`bash\` side of the pipe, not before \`curl\`.
+For a credentialed \`curl | bash\` install, make the exact approved argv invoke \`<absolute-bash-path> -c\` with a script that copies each credential into a non-exported shell variable, unsets the exported credential before starting \`curl\`, and supplies it only in the environment assignments on the \`bash\` side of the pipe. Use variable references in that script, never real credential values in argv.
+Because the NemoClaw installer persists account files, use the explicitly approved \`account-home\` profile for that helper run. Pass \`--disable\` as the first argument to the fetching \`curl\` so it does not load a curl config; the account home and absolute working directory remain disclosed trusted boundaries for the installer-side \`bash\`.
 Do not offer the Hermes Provider option for OpenClaw or Deep Agents.
 
 For example, for an approved Local Ollama setup:

docs/get-started/quickstart-hermes.mdx

@@ -28,7 +28,7 @@ The first Hermes build can take several minutes because NemoClaw builds the Herm
 
 Copy the starter prompt into Cursor, Claude Code, Codex, Copilot, or another local coding agent when you want the assistant to install NemoClaw with you.
 The prompt points your agent to [AI Agent Docs](../resources/agent-skills), this quickstart, the Markdown docs, and the optional `nemoclaw-user-guide` skill.
-It also asks your agent to confirm Hermes as the selected agent before it builds the install or onboard command, and to reuse the checked-in local credential form for secrets.
+It also asks your agent to confirm Hermes as the selected agent before it builds the install or onboard command, and to use the checked-in local credential helper and form after you approve the exact command that will receive the credentials.
 
 <StarterPromptButton />
 

docs/get-started/quickstart-langchain-deepagents-code.mdx

@@ -30,7 +30,7 @@ On macOS, start Docker Desktop or Colima before you run the installer.
 
 Copy the starter prompt into Cursor, Claude Code, Codex, Copilot, or another local coding agent when you want the assistant to install NemoClaw with you.
 The prompt points your agent to [AI Agent Docs](../resources/agent-skills), this quickstart, the Markdown docs, and the optional `nemoclaw-user-guide` skill.
-It also asks your agent to confirm LangChain Deep Agents Code as the selected agent before it builds the install or onboard command.
+It also asks your agent to confirm LangChain Deep Agents Code as the selected agent before it builds the install or onboard command, and to use the checked-in local credential helper and form after you approve the exact command that will receive the credentials.
 
 <StarterPromptButton />
 

docs/get-started/quickstart.mdx

@@ -24,7 +24,7 @@ Review the [Prerequisites](prerequisites) before following this guide.
 
 Copy the starter prompt into Cursor, Claude Code, Codex, Copilot, or another local coding agent when you want the assistant to install NemoClaw with you.
 The prompt points your agent to [AI Agent Docs](../resources/agent-skills), this quickstart, the Markdown docs, and the optional `nemoclaw-user-guide` skill.
-It also tells your agent to collect choices before launching interactive commands and to reuse the checked-in local credential form for secrets.
+It also tells your agent to collect choices before launching interactive commands and to use the checked-in local credential helper and form after you approve the exact command that will receive the credentials.
 
 <StarterPromptButton />
 

docs/index.mdx

@@ -45,7 +45,7 @@ Install NemoClaw and run the onboard wizard to get started.
 ### From Your Coding Agent
 
 Copy the starter prompt and paste it into your local coding agent, such as Cursor, Claude Code, Codex, Copilot, or another assistant that can run local commands with your approval.
-The prompt tells your agent to use NemoClaw skills when available, bootstrap the docs-routing skill when it is missing, fetch the Markdown docs, ask whether you want OpenClaw, Hermes, or Deep Agents, collect choices one question at a time, and reuse the checked-in local credential form instead of asking you to paste secrets into chat.
+The prompt tells your agent to use NemoClaw skills when available, bootstrap the docs-routing skill when it is missing, fetch the Markdown docs, ask whether you want OpenClaw, Hermes, or Deep Agents, collect choices one question at a time, and use the checked-in local credential helper and form after you approve the exact command that will receive the credentials.
 
 <StarterPromptButton />
 

docs/resources/agent-skills.mdx

@@ -20,7 +20,7 @@ Use this page when you want your agent to help with installation, inference conf
 ## Give Your Agent the Starter Prompt
 
 The fastest path is to copy the starter prompt from the NemoClaw home page and paste it into your local coding agent.
-The prompt tells the agent to use NemoClaw skills when available, bootstrap the docs-routing skill when missing, use the Markdown docs, ask one question at a time, run commands only with permission, and reuse the checked-in local credential form for secrets.
+The prompt tells the agent to use NemoClaw skills when available, bootstrap the docs-routing skill when missing, use the Markdown docs, ask one question at a time, run commands only with permission, and use the checked-in local credential helper and form after you approve the exact command that will receive the credentials.
 NemoClaw keeps the prompt text in a shared docs source so the copy button and manual fallback render the same content.
 
 <StarterPromptButton />