diff --git a/docs/get-started/quickstart-hermes.mdx b/docs/get-started/quickstart-hermes.mdx
index c70f30d8446..0da30189f7a 100644
--- a/docs/get-started/quickstart-hermes.mdx
+++ b/docs/get-started/quickstart-hermes.mdx
@@ -3,8 +3,8 @@
# SPDX-License-Identifier: Apache-2.0
title: "NemoClaw Quickstart with Hermes"
sidebar-title: "Quickstart with Hermes"
-description: "Install NemoClaw, select the Hermes agent, and launch a sandboxed Hermes dashboard and API endpoint."
-description-agent: "Installs NemoClaw, selects the Hermes agent, and launches a sandboxed Hermes dashboard and API endpoint. Use when users ask for Hermes setup, NemoHermes onboarding, or running Hermes inside OpenShell."
+description: "Install NemoClaw, launch a Hermes sandbox, and run your first Hermes prompt."
+description-agent: "Installs NemoClaw, selects Hermes, launches a sandbox, and runs the first prompt. Use when setting up NemoHermes or running Hermes inside OpenShell."
keywords: ["nemohermes quickstart", "hermes agent nemoclaw", "run hermes openshell sandbox"]
content:
type: "get_started"
@@ -14,242 +14,286 @@ skill:
import { StarterPromptFallback } from "../_components/StarterPrompt";
import { StarterPromptButton } from "../_components/StarterPromptButton";
-Use NemoHermes to create an OpenShell sandbox that runs Hermes instead of the default OpenClaw agent.
-The `nemohermes` command is an alias for `nemoclaw` with the Hermes agent pre-selected.
+Create a sandboxed Hermes agent, then chat with it from the dashboard or terminal.
+The `nemohermes` command is the NemoClaw CLI with Hermes pre-selected.
-Review the [Prerequisites](prerequisites) before starting.
-Install Docker, start it, and verify that the current shell can reach it before Hermes onboarding builds the sandbox image.
-On Linux, the installer can install Docker, start the service, and add your user to the `docker` group.
-If it changes group membership, run the printed `newgrp docker` recovery command before rerunning the installer.
-On macOS, start Docker Desktop or Colima before you run the installer.
-The first Hermes build can take several minutes because NemoClaw builds the Hermes sandbox base image if it is not already cached.
+## Set Up with a Coding Agent
-## Start from Your Coding Agent
-
-Copy the starter prompt into Cursor, Claude Code, Codex, Copilot, or another local coding agent when you want the assistant to install NemoClaw with you.
-The prompt points your agent to [AI Agent Docs](../resources/agent-skills), this quickstart, the Markdown docs, and the optional `nemoclaw-user-guide` skill.
-It also asks your agent to confirm Hermes as the selected agent before it builds the install or onboard command, and to use the checked-in local credential helper and form after you approve the exact command that will receive the credentials.
+Copy this starter prompt into Cursor, Claude Code, Codex, Copilot, or another local coding agent when you want it to guide the installation.
+The prompt points the agent to [AI Agent Docs](../resources/agent-skills), this quickstart, the Markdown docs, and the optional `nemoclaw-user-guide` skill.
+It asks the agent to confirm Hermes before it runs commands that create a sandbox or receive credentials and to use the checked-in local credential helper and form only after you approve the exact command that receives credentials.
-## Install and Onboard
-
-Start the installer with `NEMOCLAW_AGENT=hermes` set in your shell.
-The installer installs the CLI, selects the `nemohermes` alias, and runs the guided onboarding flow.
-
-```bash
-export NEMOCLAW_AGENT=hermes
-curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
-```
-
-The hosted installer follows the last-known-good (`lkg`) release tag by default, so this command installs the maintained Hermes-capable build without a version override.
-To expose the Hermes dashboard from a headless host through a remote URL or tunnel, set `CHAT_UI_URL` before onboarding.
-Use the externally reachable origin for the dashboard port `18789`.
-NemoClaw derives the forwarded dashboard port from this value, binds the forward for remote access when the origin is non-loopback, and prints the final dashboard URL in the ready summary.
-The OpenAI-compatible API remains available separately on port `8642`.
-
-```bash
-export NEMOCLAW_AGENT=hermes
-export CHAT_UI_URL="https://hermes.example.com:18789"
-curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
-```
-
-For SSH local port forwarding to `127.0.0.1:18789`, leave `CHAT_UI_URL` unset.
-Do not append an OpenClaw `#token=` fragment to the Hermes dashboard URL.
-Hermes API clients authenticate with the bearer token from the generated Hermes environment instead of an OpenClaw dashboard URL token.
-
-If NemoClaw is already installed, start Hermes onboarding directly.
-
-```bash
-nemohermes onboard
-```
-
-## Respond to the Wizard
-
-The onboard wizard asks for an inference provider, model, any required credential, and sandbox name before it prints the review summary.
-After you confirm, NemoClaw registers inference, prompts for optional Tavily Search and supported messaging channels, builds and starts the sandbox, sets up Hermes, then applies the selected network policy tier and presets.
-At any prompt, press Enter to accept the default shown in `[brackets]`, type `back` to return to the previous prompt, or type `exit` to quit.
-
-The default Hermes sandbox name is `hermes`.
-Use a distinct sandbox name, such as `my-hermes`, so you can run Hermes and OpenClaw sandboxes side by side.
-NemoClaw prevents same-name reuse when an existing sandbox uses a different agent.
-
-```text
-Sandbox name [hermes]: my-hermes
-```
-
-Choose the inference provider that matches where you want Hermes model traffic to go.
-The provider options and credential environment variables are the same as the standard NemoClaw quickstart.
-For provider-specific prompts, refer to the [Inference Options](../inference/inference-options) page.
-The Hermes wizard offers Tavily Search as its web search provider.
-Hermes does not support the NemoClaw Brave Search path.
-If you enable Tavily Search, enter `TAVILY_API_KEY` when prompted.
-NemoClaw validates the key, stores it in a sandbox-scoped OpenShell provider, writes `web.backend: tavily` into the Hermes configuration, and writes only an OpenShell resolver placeholder into the generated environment.
-If you authenticate Hermes through Nous Portal OAuth, the wizard can also prompt for managed Nous tool gateways such as web search, image generation, audio, browser automation, or managed code execution.
-Those choices add the matching Hermes policy presets to the sandbox.
-If you select both Tavily Search and the managed Nous web gateway, Tavily becomes the Hermes web search and extract backend.
-NemoClaw removes `nous-web` from the effective managed-tool selection while preserving selected Nous image, audio, browser, and code tools.
-API-key mode is inference-only and does not enable managed tool gateways.
-
-After provider and model selection, review the summary and confirm the build.
-NemoClaw writes Hermes configuration into `/sandbox/.hermes`, routes model traffic through `inference.local`, and starts the Hermes gateway inside the sandbox.
-The Hermes image includes runtime dependencies for the supported NemoClaw messaging integrations, API service, and health endpoint.
-The base image does not include unsupported Hermes integrations.
-
-
-Hermes uses an agent-specific baseline policy that allows the Hermes binary and Python runtime to reach the required Nous Research service endpoints, PyPI, NVIDIA inference endpoints, and selected messaging APIs.
-
-
-## Use Non-Interactive Setup
-
-For CI or scripted installs, set the required environment variables before running the installer.
-The following example uses NVIDIA Endpoints and creates a sandbox named `my-hermes`.
-
-```bash
-export NEMOCLAW_AGENT=hermes
-export NEMOCLAW_NON_INTERACTIVE=1
-export NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1
-export NEMOCLAW_SANDBOX_NAME=my-hermes
-export NEMOCLAW_WEB_SEARCH_PROVIDER=tavily
-export TAVILY_API_KEY=
-export NVIDIA_INFERENCE_API_KEY=
-curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
-```
-
-Use the provider variables from [Inference Options](../inference/inference-options) when you choose a different provider.
-Set `NEMOCLAW_WEB_SEARCH_PROVIDER=none` when you want to disable web search explicitly.
-When the selector is unset, Hermes enables Tavily automatically when `TAVILY_API_KEY` is available and ignores `BRAVE_API_KEY` because Brave Search is unsupported for Hermes.
-Changing or disabling Tavily requires a sandbox recreation because the backend, credential attachment, and policy selection are build-time inputs.
-Rerun onboarding with the new selection and accept the recreation, or pass `--recreate-sandbox`.
-If a scripted installer rerun finds a failed onboarding session, choose whether to discard the saved state with `--fresh` or retry it with `nemohermes onboard --resume`.
-For the recovery commands, refer to [Previous onboarding session failed](../reference/troubleshooting#previous-onboarding-session-failed).
-
-## Connect to Hermes
-
-When onboarding completes, NemoClaw prints the sandbox name, model, lifecycle commands, the Hermes dashboard URL, and the OpenAI-compatible API URL.
-When Tavily is enabled, onboarding reads the generated Hermes configuration to confirm `web.backend: tavily` and sends a real search request through OpenShell's request-body credential rewrite path.
-This verification reports a warning instead of aborting onboarding when the configuration or egress path needs attention.
-Hermes exposes its built-in browser dashboard on port `18789`.
-NemoClaw also forwards the OpenAI-compatible API on port `8642` for local clients, and the summary announces both URLs.
-NemoClaw builds the Hermes dashboard assets into the sandbox image, so the dashboard starts without running `npm` as the sandbox user under `/opt/hermes`.
-Dashboard chat uses the prebuilt `/opt/hermes/ui-tui` bundle.
-If you need to recover the Hermes dashboard manually, use `hermes dashboard --tui --skip-build` so recovery does not try to rebuild assets under root-owned install paths.
-Set `NEMOCLAW_HERMES_DASHBOARD_TUI=1` before onboarding only if you want Hermes' optional in-browser TUI tab.
-
-```text
-──────────────────────────────────────────────────
-NemoHermes is ready
-
-Sandbox: my-hermes
-Model: nvidia/nemotron-3-super-120b-a12b (NVIDIA Endpoints)
-
-Access
-
- Hermes Agent Dashboard
- Port 18789 must be forwarded before opening this URL.
- http://127.0.0.1:18789/
-
- Hermes Agent OpenAI-compatible API
- Port 8642 must be forwarded before connecting.
- http://127.0.0.1:8642/v1
-
-Terminal:
- nemohermes my-hermes connect
-
-Manage later
-
- Status: nemohermes my-hermes status
- Logs: nemohermes my-hermes logs --follow
- Model: nemohermes inference set --model --provider --sandbox my-hermes
- Policies: nemohermes my-hermes policy-add
- Credentials: nemohermes credentials reset && nemohermes onboard
-──────────────────────────────────────────────────
-```
-
-To chat with the agent from a terminal, follow these steps.
-
-1. Connect to the sandbox and start the Hermes CLI.
-
- ```bash
- nemohermes my-hermes connect
- ```
+If you prefer to control setup directly, use the interactive installer in [Create Your First Sandboxed Agent](#create-your-first-sandboxed-agent).
-2. Inside the sandbox, run the Hermes CLI.
+## Create Your First Sandboxed Agent
- ```bash
- hermes
- ```
+If you use the coding-agent prompt in the preceding section, you can skip this procedure or keep it as reference.
+The prompt directs your coding agent to this quickstart, so it has the full setup context.
-## Open the Dashboard
-
-The onboard flow starts the dashboard port forward automatically.
-Open the dashboard from the host.
-
-```bash
-nemohermes my-hermes dashboard-url --quiet
-```
-
-Expected output:
-
-```text
-http://127.0.0.1:18789/
-```
-
-Hermes handles dashboard sessions itself, so this URL does not include an OpenClaw `#token=` fragment.
-
-## Check the API Endpoint
-
-The onboard flow also starts the API port forward automatically.
-Check the health endpoint from the host to confirm that the Hermes API is reachable.
-
-```bash
-curl -sf http://127.0.0.1:8642/health
-```
-
-If the command cannot connect after a reboot or terminal restart, start the forward again.
-
-```bash
-openshell forward start --background 8642 my-hermes
-```
-
-Configure an OpenAI-compatible client with the base URL `http://127.0.0.1:8642/v1`.
-Hermes uses API header authentication for client requests.
-Do not append an OpenClaw `#token=` URL fragment to the Hermes endpoint.
-
-Treat the dashboard as a local management UI.
-Avoid exposing it on shared or public networks unless you put it behind your own access controls.
-
-## Manage the Sandbox
-
-Use the same lifecycle commands as a standard NemoClaw sandbox.
-The `nemohermes` alias keeps help text and recovery messages aligned with Hermes, while targeting the same registered sandbox.
-`nemoclaw list` shows the agent type for each sandbox so you can distinguish Hermes and OpenClaw entries.
-
-```bash
-nemohermes my-hermes status
-nemohermes my-hermes logs --follow
-nemohermes my-hermes snapshot create --name before-change
-nemohermes my-hermes rebuild
-```
-
-To change the active model or provider without rebuilding the sandbox, use `nemohermes inference set`.
-It updates the OpenShell inference route and patches `/sandbox/.hermes/config.yaml` without restarting Hermes.
-
-```bash
-nemohermes inference set --model --provider
-```
-
-To remove the sandbox when you are done, destroy it explicitly.
+
+Review the [Prerequisites](prerequisites) before you begin.
+
-```bash
-nemohermes my-hermes destroy
-```
+
+
+ Select Hermes, then run the hosted installer.
+
+ ```bash
+ export NEMOCLAW_AGENT=hermes
+ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
+ ```
+
+
+
+ Choose an inference provider and model, provide its credential when prompted, and give the sandbox a name such as `my-hermes`.
+ For a first run, skip optional web search and messaging setup, then accept the suggested network policy tier.
+
+
+
+ Wait for the ready summary, then check the sandbox state.
+
+ ```bash
+ nemohermes my-hermes status
+ ```
+
+
+
+ Open the Hermes dashboard from the host.
+
+ ```bash
+ nemohermes my-hermes dashboard-url --quiet
+ ```
+
+ Alternatively, connect to the sandbox and start the Hermes CLI.
+
+ ```bash
+ nemohermes my-hermes connect
+ hermes
+ ```
+
+
+
+## Considerations
+
+Use these details when your first-run path needs more control.
+
+
+
+ The Hermes wizard supports the same inference provider choices as the OpenClaw quickstart.
+ Refer to [Inference Options](../inference/inference-options) for provider requirements, model choices, and local-server setup.
+
+ Hermes supports Tavily for web search, not the NemoClaw Brave Search path.
+ Select it during onboarding and provide `TAVILY_API_KEY` when prompted.
+ The wizard can also configure supported messaging channels and managed Nous tool gateways when you authenticate through Nous Portal OAuth.
+ Refer to [Messaging Channels](../manage-sandboxes/messaging-channels) and [Network Policies](../network-policy/approve-network-requests) before enabling those services.
+
+
+
+ For a scripted installation, provide the required values before running the installer.
+
+ ```bash
+ export NEMOCLAW_AGENT=hermes
+ export NEMOCLAW_NON_INTERACTIVE=1
+ export NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1
+ export NEMOCLAW_SANDBOX_NAME=my-hermes
+ export NVIDIA_INFERENCE_API_KEY=
+ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
+ ```
+
+ If NemoClaw is already installed, run `nemohermes onboard`.
+ Use `nemohermes onboard --resume` to continue an interrupted onboarding session or `nemohermes onboard --fresh` to discard it and start again.
+ Refer to [Previous onboarding session failed](../reference/troubleshooting#previous-onboarding-session-failed) for recovery details.
+
+
+
+ Hermes forwards its dashboard on port `18789` and its OpenAI-compatible API on port `8642`.
+ For a remote dashboard origin or tunnel, set `CHAT_UI_URL` to the externally reachable dashboard origin before onboarding.
+ Otherwise, leave it unset and use SSH port forwarding for remote access.
+
+ ```bash
+ ssh -L 18789:127.0.0.1:18789 @
+ ssh -L 8642:127.0.0.1:8642 @
+ ```
+
+ Configure API clients with the base URL `http://127.0.0.1:8642/v1` after forwarding port `8642`.
+ Hermes handles dashboard and API authentication itself, so do not append an OpenClaw `#token=` fragment to either URL.
+ Treat the dashboard as a local management UI and protect it before you expose it on a shared network.
+
+
+
+ Use the `nemohermes` alias for lifecycle, logs, backups, rebuilds, and model changes.
+
+ ```bash
+ nemohermes my-hermes logs --follow
+ nemohermes my-hermes snapshot create --name before-change
+ nemohermes inference set --model --provider --sandbox my-hermes
+ ```
+
+ Use `nemohermes my-hermes destroy` only when you intend to remove the sandbox.
+ Refer to [Manage NemoClaw sandboxes](../manage-sandboxes/lifecycle) for the full lifecycle workflow.
+
+
+
+ Install Docker, start it, and confirm the current shell can reach it before Hermes onboarding builds the sandbox image.
+ On Linux, the installer can install Docker, start the service, and add your user to the `docker` group.
+ If it changes group membership, run the printed `newgrp docker` command before rerunning the installer.
+ On macOS, start Docker Desktop or Colima before you run the installer.
+ The first Hermes build can take several minutes because NemoClaw builds the Hermes sandbox base image when it is not already cached.
+
+ The hosted installer follows the maintained last-known-good (`lkg`) release tag by default.
+ To expose the Hermes dashboard from a headless host through a remote URL or tunnel, set `CHAT_UI_URL` before onboarding to the externally reachable origin for dashboard port `18789`.
+ NemoClaw derives the forwarded dashboard port from this value, binds the forward for remote access when the origin is non-loopback, and prints the final dashboard URL in the ready summary.
+ The OpenAI-compatible API remains available separately on port `8642`.
+
+ ```bash
+ export NEMOCLAW_AGENT=hermes
+ export CHAT_UI_URL="https://hermes.example.com:18789"
+ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
+ ```
+
+ Leave `CHAT_UI_URL` unset when you use SSH local port forwarding to `127.0.0.1:18789`.
+ Hermes API clients authenticate with the bearer token from the generated Hermes environment, not an OpenClaw dashboard URL token.
+
+
+
+ The wizard asks for an inference provider, model, required credential, and sandbox name before it prints the review summary.
+ After confirmation, NemoClaw registers inference, prompts for optional Tavily Search and supported messaging channels, builds and starts the sandbox, sets up Hermes, and applies the selected network policy tier and presets.
+ At any prompt, press Enter to accept the default shown in `[brackets]`, type `back` to return to the previous prompt, or type `exit` to quit.
+
+ The default Hermes sandbox name is `hermes`.
+ Use a distinct name, such as `my-hermes`, when you run Hermes and OpenClaw sandboxes side by side.
+ NemoClaw prevents same-name reuse when an existing sandbox uses a different agent.
+
+ ```text
+ Sandbox name [hermes]: my-hermes
+ ```
+
+ The provider options and credential variables match the standard NemoClaw quickstart.
+ Refer to [Inference Options](../inference/inference-options) for provider-specific prompts.
+ Hermes offers Tavily Search and does not support the NemoClaw Brave Search path.
+ When you enable Tavily Search, provide `TAVILY_API_KEY`.
+ NemoClaw validates the key, stores it in a sandbox-scoped OpenShell provider, writes `web.backend: tavily` into the Hermes configuration, and writes only an OpenShell resolver placeholder into the generated environment.
+
+ When you authenticate through Nous Portal OAuth, the wizard can also prompt for managed Nous tool gateways such as web search, image generation, audio, browser automation, and managed code execution.
+ Those choices add matching Hermes policy presets to the sandbox.
+ If you select Tavily Search and the managed Nous web gateway, Tavily becomes the Hermes web search and extract backend.
+ NemoClaw removes `nous-web` from the effective managed-tool selection while preserving selected Nous image, audio, browser, and code tools.
+ API-key mode is inference-only and does not enable managed tool gateways.
+
+ After you select a provider and model, review the summary and confirm the build.
+ NemoClaw writes Hermes configuration into `/sandbox/.hermes`, routes model traffic through `inference.local`, and starts the Hermes gateway inside the sandbox.
+ The Hermes image includes runtime dependencies for supported NemoClaw messaging integrations, the API service, and its health endpoint.
+ The base image does not include unsupported Hermes integrations.
+
+
+ Hermes uses an agent-specific baseline policy that allows the Hermes binary and Python runtime to reach required Nous Research service endpoints, PyPI, NVIDIA inference endpoints, and selected messaging APIs.
+
+
+
+
+ For CI or scripted installs, provide every required variable before you run the installer.
+ This NVIDIA Endpoints example creates `my-hermes` with Tavily Search.
+
+ ```bash
+ export NEMOCLAW_AGENT=hermes
+ export NEMOCLAW_NON_INTERACTIVE=1
+ export NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1
+ export NEMOCLAW_SANDBOX_NAME=my-hermes
+ export NEMOCLAW_WEB_SEARCH_PROVIDER=tavily
+ export TAVILY_API_KEY=
+ export NVIDIA_INFERENCE_API_KEY=
+ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
+ ```
+
+ Use the provider variables from [Inference Options](../inference/inference-options) when you choose another provider.
+ Set `NEMOCLAW_WEB_SEARCH_PROVIDER=none` to disable web search explicitly.
+ When the selector is unset, Hermes enables Tavily automatically when `TAVILY_API_KEY` is available and ignores `BRAVE_API_KEY`.
+ Changing or disabling Tavily requires sandbox recreation because the backend, credential attachment, and policy selection are build-time inputs.
+ Rerun onboarding with the new selection and accept recreation, or pass `--recreate-sandbox`.
+
+
+
+ The ready summary prints the sandbox name, model, lifecycle commands, Hermes dashboard URL, and OpenAI-compatible API URL.
+ When Tavily is enabled, onboarding reads the generated Hermes configuration to confirm `web.backend: tavily` and sends a real search request through OpenShell's request-body credential rewrite path.
+ This verification reports a warning instead of aborting onboarding when the configuration or egress path needs attention.
+
+ Hermes exposes its browser dashboard on port `18789` and forwards its OpenAI-compatible API on port `8642` for local clients.
+ The dashboard assets are built into the sandbox image, so the dashboard starts without running `npm` as the sandbox user under `/opt/hermes`.
+ Dashboard chat uses the prebuilt `/opt/hermes/ui-tui` bundle.
+ To recover the dashboard manually, use `hermes dashboard --tui --skip-build` so recovery does not try to rebuild assets under root-owned installation paths.
+ Set `NEMOCLAW_HERMES_DASHBOARD_TUI=1` before onboarding only when you want Hermes' optional in-browser TUI tab.
+
+ ```text
+ ──────────────────────────────────────────────────
+ NemoHermes is ready
+
+ Sandbox: my-hermes
+ Model: nvidia/nemotron-3-super-120b-a12b (NVIDIA Endpoints)
+
+ Access
+
+ Hermes Agent Dashboard
+ Port 18789 must be forwarded before opening this URL.
+ http://127.0.0.1:18789/
+
+ Hermes Agent OpenAI-compatible API
+ Port 8642 must be forwarded before connecting.
+ http://127.0.0.1:8642/v1
+ ──────────────────────────────────────────────────
+ ```
+
+ The onboard flow starts both port forwards automatically.
+ The Hermes dashboard URL does not include an OpenClaw `#token=` fragment.
+ `nemohermes my-hermes dashboard-url --quiet` returns `http://127.0.0.1:18789/` when the default local forward is active.
+ Check the API health endpoint from the host.
+
+ ```bash
+ curl -sf http://127.0.0.1:8642/health
+ ```
+
+ If that command cannot connect after a reboot or terminal restart, restart the forward.
+
+ ```bash
+ openshell forward start --background 8642 my-hermes
+ ```
+
+ Configure OpenAI-compatible clients with `http://127.0.0.1:8642/v1`.
+ Hermes uses API header authentication for client requests.
+ Do not append an OpenClaw `#token=` fragment to the endpoint.
+
+
+
+ The `nemohermes` alias keeps help text and recovery messages aligned with Hermes while targeting the same registered sandbox.
+ `nemoclaw list` shows the agent type for each sandbox so you can distinguish Hermes and OpenClaw entries.
+
+ ```bash
+ nemohermes my-hermes status
+ nemohermes my-hermes logs --follow
+ nemohermes my-hermes snapshot create --name before-change
+ nemohermes my-hermes rebuild
+ ```
+
+ `nemohermes inference set` changes the active model or provider without rebuilding the sandbox.
+ It updates the OpenShell inference route and patches `/sandbox/.hermes/config.yaml` without restarting Hermes.
+
+ ```bash
+ nemohermes inference set --model --provider
+ ```
+
+
+
+## Troubleshooting
+
+If the installer changes your Linux Docker group membership, run the printed `newgrp docker` command before you rerun it.
+If `nemohermes` is unavailable after installing, reload your shell profile or follow the [Hermes troubleshooting](../reference/troubleshooting#nemohermes-command-not-found-immediately-after-install) steps.
## Next Steps
-- [Inference Options](../inference/inference-options) explains how to choose a provider and model.
-- The [Commands](../reference/commands) page explains the full `nemohermes` alias behavior.
-- [Backup and Restore](../manage-sandboxes/backup-restore) explains how to preserve sandbox state before destructive operations.
+- [Inference Options](../inference/inference-options) explains how to choose or change a model and provider.
+- [Commands](../reference/commands) explains the `nemohermes` alias and its options.
+- [Backup and Restore](../manage-sandboxes/backup-restore) explains how to preserve sandbox state.
- [Monitor Sandbox Activity](../monitoring/monitor-sandbox-activity) explains how to inspect OpenShell events and sandbox logs.
diff --git a/docs/get-started/quickstart-langchain-deepagents-code.mdx b/docs/get-started/quickstart-langchain-deepagents-code.mdx
index 57e4061d2b6..9bd60c2ee55 100644
--- a/docs/get-started/quickstart-langchain-deepagents-code.mdx
+++ b/docs/get-started/quickstart-langchain-deepagents-code.mdx
@@ -3,8 +3,8 @@
# SPDX-License-Identifier: Apache-2.0
title: "Quickstart with LangChain Deep Agents Code"
sidebar-title: "Quickstart with Deep Agents"
-description: "Create and operate a NemoClaw sandbox for LangChain Deep Agents Code with managed inference and backend-neutral OTLP tracing."
-description-agent: "Creates and operates a NemoClaw sandbox that runs LangChain Deep Agents Code with managed inference and backend-neutral OTLP trace export through a host-side collector, including LangSmith. Use when installing or testing dcode, enabling observability, or configuring a local OpenTelemetry collector for LangSmith."
+description: "Install NemoClaw, launch a LangChain Deep Agents Code sandbox, and run your first prompt."
+description-agent: "Installs NemoClaw, launches a LangChain Deep Agents Code sandbox, and runs the first prompt. Use when installing or testing dcode for the first time."
keywords: ["langchain deep agents code nemoclaw", "dcode openshell sandbox", "langchain coding agent", "dcode otlp tracing"]
topics: ["get-started", "terminal-runtime", "langchain-deepagents-code", "observability"]
tags: ["deep-agents-code", "dcode", "managed-inference", "otlp"]
@@ -17,57 +17,94 @@ content:
import { StarterPromptFallback } from "../_components/StarterPrompt";
import { StarterPromptButton } from "../_components/StarterPromptButton";
-Use NemoClaw for Deep Agents to create an OpenShell sandbox that runs LangChain Deep Agents Code.
+Create a sandboxed LangChain Deep Agents Code agent, then run your first prompt.
The `nemo-deepagents` command is an alias for `nemoclaw` with the `langchain-deepagents-code` agent pre-selected.
-Review the [Prerequisites](prerequisites) before starting.
-Install Docker, start it, and verify that the current shell can reach it before Deep Agents onboarding builds the sandbox image.
-On Linux, the installer can install Docker, start the service, and add your user to the `docker` group.
-If it changes group membership, run the printed `newgrp docker` recovery command before rerunning the installer.
-On macOS, start Docker Desktop or Colima before you run the installer.
-
-## Start from Your Coding Agent
+## Set Up with a Coding Agent
-Copy the starter prompt into Cursor, Claude Code, Codex, Copilot, or another local coding agent when you want the assistant to install NemoClaw with you.
-The prompt points your agent to [AI Agent Docs](../resources/agent-skills), this quickstart, the Markdown docs, and the optional `nemoclaw-user-guide` skill.
-It also asks your agent to confirm LangChain Deep Agents Code as the selected agent before it builds the install or onboard command, and to use the checked-in local credential helper and form after you approve the exact command that will receive the credentials.
+Copy this starter prompt into Cursor, Claude Code, Codex, Copilot, or another local coding agent when you want it to guide the installation.
+The prompt points the agent to [AI Agent Docs](../resources/agent-skills), this quickstart, the Markdown docs, and the optional `nemoclaw-user-guide` skill.
+It asks the agent to confirm LangChain Deep Agents Code before it runs commands that create a sandbox or receive credentials and to use the checked-in local credential helper and form only after you approve the exact command that receives credentials.
-## Install and Onboard
+If you prefer to control setup directly, use the interactive installer in [Create Your First Sandboxed Agent](#create-your-first-sandboxed-agent).
-Start the installer with `NEMOCLAW_AGENT=langchain-deepagents-code` set in your shell.
-The installer installs the CLI, selects the `nemo-deepagents` alias, and runs the guided onboarding flow.
+## Create Your First Sandboxed Agent
-```bash
-export NEMOCLAW_AGENT=langchain-deepagents-code
-curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
-```
+If you use the coding-agent prompt in the preceding section, you can skip this procedure or keep it as reference.
+The prompt directs your coding agent to this quickstart, so it has the full setup context.
+
+
+Review the [Prerequisites](prerequisites) before you begin.
+
+
+
+
+ Select Deep Agents, then run the hosted installer.
+
+ ```bash
+ export NEMOCLAW_AGENT=langchain-deepagents-code
+ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
+ ```
+
+
+
+ Choose an inference provider and model, provide its credential when prompted, and give the sandbox a name such as `my-deepagents`.
+ Accept the suggested network policy tier for a first run.
+
+
+
+ Wait for the ready summary, then check the sandbox state.
+
+ ```bash
+ nemo-deepagents my-deepagents status
+ ```
+
+
+
+ Connect to the sandbox and launch the Deep Agents terminal UI.
-The hosted installer follows the last-known-good (`lkg`) release tag by default, so this command installs the maintained Deep Agents-capable build without a version override.
-If NemoClaw is already installed, start Deep Agents onboarding directly.
+ ```bash
+ nemo-deepagents my-deepagents connect
+ dcode
+ ```
+
+
-## Onboard
+## Considerations
-Run onboarding with the Deep Agents alias, or use `nemoclaw --agent` with either the canonical agent ID or a short alias.
+Use these details after the first sandbox is running.
+
+
+
+
+### Installation and Onboarding Details
+
+The hosted installer follows the last-known-good (`lkg`) release tag by default, so the install command selects the maintained Deep Agents-capable build without a version override.
+If NemoClaw is already installed, run `nemo-deepagents onboard` to start Deep Agents onboarding directly.
+
+On Linux, install Docker, start it, and confirm that the current shell can reach it before onboarding builds the sandbox image.
+The installer can install Docker, start the service, and add your user to the `docker` group.
+If it changes group membership, run the printed `newgrp docker` command before rerunning the installer.
+On macOS, start Docker Desktop or Colima before you run the installer.
+
+You can use the canonical agent ID or a short alias instead of `nemo-deepagents`.
```bash
-nemo-deepagents onboard
-# Equivalent:
nemoclaw onboard --agent langchain-deepagents-code
-# Also accepted:
nemoclaw onboard --agent dcode
nemoclaw onboard --agent deepagents
nemoclaw onboard --agent langchain
```
-The onboard wizard asks for an inference provider, model, any required credential, sandbox name, and policy tier before it prints the review summary.
+The wizard asks for an inference provider, model, required credential, sandbox name, and policy tier before it prints the review summary.
At any prompt, press Enter to accept the default shown in `[brackets]`, type `back` to return to the previous prompt, or type `exit` to quit.
The default Deep Agents sandbox name is `deepagents-code`.
-Use a distinct sandbox name, such as `my-deepagents`, so you can run Deep Agents, Hermes, and OpenClaw sandboxes side by side.
-For provider-specific prompts, refer to [Inference Options](../inference/inference-options).
+Use a distinct name, such as `my-deepagents`, when you run Deep Agents, Hermes, and OpenClaw sandboxes side by side.
+Refer to [Inference Options](../inference/inference-options) for provider-specific prompts.
The image installs hash-locked Deep Agents Code `0.1.34` with NVIDIA provider support.
After the terminal smoke checks, onboarding runs `dcode --version` and compares the result with the version required by the agent manifest.
@@ -84,7 +121,10 @@ The image launcher normalizes the runtime proxy environment for interactive, log
Managed interactive sessions keep Deep Agents Code's optional first-run name prompt, skip its dependency and model selection screens, then open the TUI with the model selected during NemoClaw onboarding.
Press Enter at the name prompt to continue without setting a name.
-## Choose the Default Sandbox
+
+
+
+### Choose the Default Sandbox
When you manage multiple sandboxes, use the Deep Agents alias to promote a registered Deep Agents Code sandbox to the default.
@@ -95,7 +135,7 @@ nemo-deepagents use
The command updates NemoClaw's host-side registry.
It does not modify the sandbox or the `dcode` configuration.
-## Use the Harness
+### Use the Harness
Connect to the sandbox, then launch the terminal UI.
@@ -132,7 +172,7 @@ It has no approval UI and automatically approves non-shell tool requests, includ
The managed headless path still disables shell execution, startup commands, interpreter tool calling, executable hooks, unmanaged MCP configuration, nested remote sandboxes, remote async subagents, and alternate model routes.
Use the interactive TUI when you need to inspect each destructive tool request before it runs.
-### Configure Thread Auto-Approval
+#### Configure Thread Auto-Approval
Managed Deep Agents sandboxes keep interactive thread auto-approval disabled by default.
In this mode, the TUI auto-approval choice and `dcode -y` fail closed.
@@ -175,14 +215,17 @@ The command prints the sandbox name, NemoClaw harness, active `dcode` agent, con
`dcode --help` lists the managed aliases before the upstream Deep Agents Code help.
The sandbox name resolves when you run the command from a `nemoclaw connect` shell, which loads the NemoClaw runtime environment.
-## Python Environment
+
+
+
+### Python Environment
Deep Agents Code runs from a NemoClaw-managed Python virtual environment at `/opt/venv`.
The sandbox puts `/opt/venv/bin` on `PATH` before the system Python directories, so `python3` and `pip3` resolve to that managed environment.
NemoClaw keeps `/opt/venv` read-only to protect the installed harness.
For project-specific Python dependencies, create a separate virtual environment under `/sandbox` and activate it before installing packages.
-## State and Backup
+### State and Backup
Deep Agents Code state lives under `/sandbox/.deepagents`.
NemoClaw snapshot and rebuild flows preserve the app state directory and skills when those paths exist.
@@ -203,7 +246,10 @@ After backup, NemoClaw rechecks the target, route, and retained build inputs bef
If the final check fails, NemoClaw restores the previous MCP state and keeps the existing sandbox intact.
Rebuild also preserves the standalone Deep Agents Code `tavily` preset, the recorded observability choice unless explicitly overridden, and recorded custom policies from their exact stored content.
-## Optional Tavily Egress
+
+
+
+### Optional Tavily Egress
Deep Agents Code does not currently have a NemoClaw-managed web-search feature.
If your project code or a manually configured tool needs Tavily, opt the sandbox Python egress path into Tavily explicitly.
@@ -249,9 +295,10 @@ This does not unregister the gateway-wide `tavily-search` provider; its credenti
When no sandbox needs the provider, destroy those sandboxes or detach it from each one with `openshell sandbox provider detach tavily-search`, then remove it globally with `nemo-deepagents credentials reset tavily-search --yes`.
OpenShell rejects provider deletion while any sandbox still has it attached.
-## Export Traces Through a Local Collector
+
-NemoClaw can export Deep Agents Code traces to an OTLP/HTTP collector that you operate on the host.
+
+ NemoClaw can export Deep Agents Code traces to an OTLP/HTTP collector that you operate on the host.
The sandbox always targets one local collector address, while the collector owns the remote backend, credentials, TLS, batching, retry, and optional filtering.
Changing from LangSmith to another OTLP-compatible backend does not require a sandbox rebuild or policy change.
@@ -628,6 +675,9 @@ For additional collector diagnostics, refer to [Troubleshooting the OpenTelemetr
| Debug exporter logs traces but the LangSmith project is empty | Inspect the same collector log for remote exporter errors, then verify the endpoint, project, workspace ID, and API key. |
| Agent succeeds while every trace check fails | This is expected fail-open behavior. Troubleshoot the policy, receiver bind, collector health, and remote exporter independently rather than using the agent exit status as delivery evidence. |
+
+
+
## Troubleshooting
Use normal sandbox lifecycle commands through either `nemo-deepagents` or `nemoclaw`:
diff --git a/docs/get-started/quickstart.mdx b/docs/get-started/quickstart.mdx
index 5e64ab47b18..5c35825c1e5 100644
--- a/docs/get-started/quickstart.mdx
+++ b/docs/get-started/quickstart.mdx
@@ -3,8 +3,8 @@
# SPDX-License-Identifier: Apache-2.0
title: "NemoClaw Quickstart with OpenClaw"
sidebar-title: "Quickstart with OpenClaw"
-description: "Install NemoClaw, launch a sandbox, and run your first agent prompt."
-description-agent: "Installs NemoClaw, launches a sandbox, and runs the first agent prompt. Use when onboarding, installing, or launching a NemoClaw sandbox for the first time."
+description: "Install NemoClaw, launch a sandbox, and run your first OpenClaw prompt."
+description-agent: "Installs NemoClaw, launches an OpenClaw sandbox, and runs the first prompt. Use when onboarding, installing, or launching an OpenClaw sandbox for the first time."
keywords: ["nemoclaw quickstart", "install nemoclaw openclaw sandbox"]
content:
type: "get_started"
@@ -14,357 +14,390 @@ skill:
import { StarterPromptFallback } from "../_components/StarterPrompt";
import { StarterPromptButton } from "../_components/StarterPromptButton";
-Follow these steps to get started with NemoClaw and your first sandboxed OpenClaw agent.
+Create a sandboxed OpenClaw agent, then send it a first prompt.
-
-Review the [Prerequisites](prerequisites) before following this guide.
-
-
-## Start from Your Coding Agent
+## Set Up with a Coding Agent
-Copy the starter prompt into Cursor, Claude Code, Codex, Copilot, or another local coding agent when you want the assistant to install NemoClaw with you.
-The prompt points your agent to [AI Agent Docs](../resources/agent-skills), this quickstart, the Markdown docs, and the optional `nemoclaw-user-guide` skill.
-It also tells your agent to collect choices before launching interactive commands and to use the checked-in local credential helper and form after you approve the exact command that will receive the credentials.
+Copy this starter prompt into Cursor, Claude Code, Codex, Copilot, or another local coding agent when you want it to guide the installation.
+The prompt points the agent to [AI Agent Docs](../resources/agent-skills), this quickstart, the Markdown docs, and the optional `nemoclaw-user-guide` skill.
+It asks the agent to collect your choices before it starts interactive commands and to use the checked-in local credential helper and form only after you approve the exact command that receives credentials.
-## Install NemoClaw and Onboard an OpenClaw Agent
-
-Run the installer script.
-The script installs Node.js if it is not already present, then runs the guided onboard wizard to create a sandbox, configure inference, and apply security policies.
-
-
-NemoClaw creates a fresh OpenClaw instance inside the sandbox during the onboarding process.
-
-
-```bash
-curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
-```
-
-The hosted installer follows the last-known-good (`lkg`) release tag by default, so this command installs the maintained OpenClaw build without a version override.
-The third-party software notice runs before the installer installs Node.js or the NemoClaw CLI.
-The piped installer can prompt through your terminal when a TTY is available.
-In non-TTY contexts, such as CI, an SSH command with piped stdin, or a shell script, pass explicit acceptance to the `bash` side of the pipe:
-
-```bash
-curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1 bash
-```
-
-You can also pass the installer flag through `bash -s`.
-
-```bash
-curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash -s -- --yes-i-accept-third-party-software
-```
-
-To run both installation and onboarding without prompts, also set non-interactive mode and the provider variables your chosen inference path requires:
-
-```bash
-curl -fsSL https://www.nvidia.com/nemoclaw.sh | \
- NEMOCLAW_NON_INTERACTIVE=1 \
- NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1 \
- NEMOCLAW_PROVIDER=build \
- NVIDIA_INFERENCE_API_KEY= \
- NEMOCLAW_SANDBOX_NAME=my-gpt-claw \
- bash
-```
-
-The example above uses the NVIDIA Endpoints path. Set `NEMOCLAW_PROVIDER` and the matching API key variable for your chosen path (see [Choose an Inference Provider](#choose-an-inference-provider)), and set `NEMOCLAW_SANDBOX_NAME` so the run does not depend on a default left behind by a previous, possibly interrupted, onboard session.
-
-If a scripted installer rerun finds a failed onboarding session, choose whether to discard the saved state with `--fresh` or retry it with `nemoclaw onboard --resume`.
-For the recovery commands, refer to [Previous onboarding session failed](../reference/troubleshooting#previous-onboarding-session-failed).
-
-Do not place `NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1` before `curl`.
-In `NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1 curl ... | bash`, the variable applies only to `curl`, so the installer process cannot see the acceptance.
-
-If you use nvm or fnm to manage Node.js, the installer might not update your current shell's PATH.
-If `nemoclaw` is not found after install, run `source ~/.bashrc` (or `source ~/.zshrc` for zsh) or open a new terminal.
-
-On Linux, the installer checks Docker before it installs NemoClaw.
-If Docker is missing, the installer downloads the official Docker convenience script, asks for `sudo`, installs Docker, and starts the Docker service when systemd is available.
-If you installed Docker but your current shell cannot use the Docker socket yet, the installer adds your user to the `docker` group when needed and exits with a recovery command.
+If you prefer to control setup directly, use the interactive installer in [Create Your First Sandboxed Agent](#create-your-first-sandboxed-agent).
-On macOS, the installer uses the Docker-driver OpenShell gateway path with Docker Desktop or Colima.
+## Create Your First Sandboxed Agent
-```bash
-newgrp docker
-curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
-```
-
-On DGX Spark, DGX Station, and Windows WSL, an interactive installer offers express install after you accept the third-party software notice.
-Express install switches onboarding to non-interactive mode, allows `sudo` password prompts for required host changes, and selects the managed local inference path for that platform.
-On DGX Spark and DGX Station, express install selects managed vLLM; DGX Spark uses `qwen3.6-35b-a3b-nvfp4` by default, and DGX Station uses `deepseek-v4-flash` by default.
-Unless `NEMOCLAW_POLICY_TIER` is set, it applies sandbox policy in `suggested` mode with the `balanced` tier by default.
-That tier uses the base sandbox policy plus supported package, model, web-search, and local-inference presets.
-On DGX Spark, express install uses `my-spark-assistant` as the sandbox name unless `NEMOCLAW_SANDBOX_NAME` is already set.
-On WSL, express install selects the Windows-host Ollama setup path.
-Set `NEMOCLAW_NO_EXPRESS=1` to skip the express prompt, or set `NEMOCLAW_PROVIDER` before launching the installer when you want to choose a provider yourself.
-
-The installer auto-launches `nemoclaw onboard` when it can locate the freshly installed binary.
-If it cannot locate the binary, or if blocking host preflight checks fail, it does not launch the wizard automatically.
-In that case, the installer prints the relevant diagnostics and a `To finish setup, run:` block with the explicit `nemoclaw onboard` command.
+If you use the coding-agent prompt in the preceding section, you can skip this procedure or keep it as reference.
+The prompt directs your coding agent to this quickstart, so it has the full setup context.
-The onboard flow builds the sandbox image with `NEMOCLAW_DISABLE_DEVICE_AUTH=1` so the dashboard is immediately usable during setup.
-This is a build-time setting baked into the sandbox image, not a runtime knob.
-If you export `NEMOCLAW_DISABLE_DEVICE_AUTH` after onboarding finishes, it has no effect on an existing sandbox.
+Review the [Prerequisites](prerequisites) before you begin.
-### Respond to the Onboard Wizard
-
-After the installer launches `nemoclaw onboard`, the wizard runs preflight checks, starts or reuses the OpenShell gateway, asks for an inference provider and model, collects any required credential, then asks for the sandbox name.
-It prints a review summary before it registers the provider with OpenShell.
-After you confirm, NemoClaw registers inference, prompts for optional web search and messaging channels, builds and starts the sandbox, sets up OpenClaw, then applies the selected network policy tier and presets.
-At any prompt, press Enter to accept the default shown in `[brackets]`, type `back` to return to the previous prompt, or type `exit` to quit.
-If registered sandboxes already exist, the installer prepares the current NemoClaw CLI without replacing OpenShell, then requires a fresh backup of every registered sandbox before it changes the gateway.
-After the host upgrade, it runs `nemoclaw upgrade-sandboxes --auto` to rebuild stale sandboxes and restore validated backups for registered sandboxes that are not Ready.
-Successful recovery completes the existing-sandbox upgrade and skips generic onboarding, so the installer does not create an extra sandbox or ask for a new provider credential.
-If the recovery pass exits 0 but a recorded sandbox is not found on its own recorded gateway (for example after `nemoclaw uninstall` removed the gateway and Docker image while preserving `sandboxes.json`), the installer finishes with `Installation completed with warnings` and remediation guidance instead of claiming the sandbox was recovered.
-For pre-fingerprint OpenClaw and Hermes registry entries, the installer asks you to confirm that every listed sandbox used a NemoClaw-managed image before it permits recovery onto the current managed image.
-In non-interactive runs, set `NEMOCLAW_CONFIRM_LEGACY_MANAGED_RECREATE` to the exact JSON array of names printed by the installer, such as `["my-assistant","preserve-hermes"]`, only after you verify every named sandbox used a managed image.
-Legacy managed-image confirmation never overrides recorded custom-image evidence.
-A custom OpenClaw sandbox can be recovered only when the selected validated backup independently carries complete authoritative image-plugin provenance; otherwise recovery stops before deletion.
-If any backup is skipped or fails, the installer exits with a nonzero status before it changes the gateway.
-If an automatic rebuild fails or a non-Ready recovery is blocked or fails, the installer exits with a nonzero status and does not start generic onboarding.
-
-The inference provider prompt presents a numbered list.
-
-```text
- 1) NVIDIA Endpoints
- 2) OpenRouter
- 3) OpenAI
- 4) Other OpenAI-compatible endpoint
- 5) Anthropic
- 6) Other Anthropic-compatible endpoint
- 7) Google Gemini
- 8) Local Ollama (localhost:11434)
- 9) Model Router (experimental)
- Choose [1]:
-```
-
-Pick the option that matches where you want inference traffic to go.
-The provider you choose determines the follow-up prompts and the API key environment variable to set.
-For the full list of providers and validation behavior, refer to [Inference Options](../inference/inference-options).
-Local Ollama appears when NemoClaw detects a usable local Ollama path or can offer an install or start action for your platform.
-A configured blueprint router profile makes the Model Router option appear.
-
-
-Export the API key before launching the installer so the wizard does not have to ask for it.
-For example, run `export NVIDIA_INFERENCE_API_KEY=` before `curl ... | bash`.
-If you entered a key incorrectly, refer to [Reset a Stored Credential](../manage-sandboxes/lifecycle#reset-a-stored-credential) to clear and re-enter it.
-
-
-### Choose an Inference Provider
-
-Pick the option that matches where you want inference traffic to go.
-For full provider behavior, curated models, validation details, and local-runtime setup notes, refer to [Inference Options](../inference/inference-options).
-For Ollama, vLLM, NIM, and compatible local servers, refer to [Use a Local Inference Server](../inference/use-local-inference).
-
-| Option | Use when | Credential variable |
-|---|---|---|
-| NVIDIA Endpoints | You want hosted models from `build.nvidia.com`, including hosted Nemotron models. | `NVIDIA_INFERENCE_API_KEY` |
-| OpenRouter | You want OpenRouter as a managed hosted OpenAI-compatible provider. | `OPENROUTER_API_KEY` |
-| OpenAI | You want the OpenAI API at `https://api.openai.com/v1`. | `OPENAI_API_KEY` |
-| Other OpenAI-compatible endpoint | You have LocalAI, llama.cpp, vLLM, NIM, SGLang, an enterprise gateway, or another `/v1/chat/completions` endpoint. | `COMPATIBLE_API_KEY` |
-| Anthropic | You want the Anthropic Messages API. | `ANTHROPIC_API_KEY` |
-| Other Anthropic-compatible endpoint | You have a Claude proxy, Bedrock-compatible gateway, or self-hosted `/v1/messages` endpoint. | `COMPATIBLE_ANTHROPIC_API_KEY` |
-| Google Gemini | You want Google's OpenAI-compatible Gemini endpoint. | `GEMINI_API_KEY` |
-| Local Ollama | You want a host-local Ollama model. | None |
-| Model Router | You want NemoClaw to start the host-side model router. | `NVIDIA_INFERENCE_API_KEY` |
-
-Export the relevant key before launching the installer when possible.
-If your compatible endpoint does not require authentication, set its credential variable to any non-empty placeholder.
-
-### Review the Configuration Before the Sandbox Build
-
-After you enter the sandbox name, the wizard prints a review summary and asks for final confirmation before registering the provider, prompting for optional integrations, and building the sandbox image.
-For example, if you picked an OpenAI-compatible endpoint, the summary looks like the following:
-
-```text
- ──────────────────────────────────────────────────
- Review configuration
- ──────────────────────────────────────────────────
- Provider: compatible-endpoint
- Model: openai/openai/gpt-5.5
- API key: configured for OpenShell gateway registration
- Web search: disabled
- Managed tools: none
- Messaging: none
- Sandbox name: my-gpt-claw
- Note: Sandbox build typically takes 5–15 minutes on this host.
- ──────────────────────────────────────────────────
- Web search and messaging channels will be prompted next.
- Apply this configuration? [Y/n]:
-```
-
-The default is `Y`.
-Press Enter one time to continue.
-Answer `n` to abort cleanly, fix the entries, and re-run `nemoclaw onboard`.
-
-Non-interactive runs (`NEMOCLAW_NON_INTERACTIVE=1`) print the summary for log clarity but skip the prompt.
-
-### Configure Web Search and Messaging
-
-After you confirm the summary, NemoClaw registers the selected provider with the OpenShell gateway and sets the `inference.local` route.
-The wizard then asks whether to enable web search and offers Brave Search or Tavily Search.
-Enter `BRAVE_API_KEY` for Brave Search or `TAVILY_API_KEY` for Tavily Search when prompted.
-NemoClaw validates the selected key before it builds the sandbox, registers a sandbox-scoped OpenShell provider, and writes only an OpenShell resolver placeholder into the OpenClaw configuration.
-OpenShell replaces the placeholder with the real key at egress.
-
-For non-interactive onboarding, select the provider explicitly and export its key.
-
-```bash
-export NEMOCLAW_WEB_SEARCH_PROVIDER=tavily
-export TAVILY_API_KEY=
-nemoclaw onboard --non-interactive
-```
-
-Set `NEMOCLAW_WEB_SEARCH_PROVIDER=none` to disable web search explicitly.
-When you leave the selector unset, OpenClaw chooses Brave Search when `BRAVE_API_KEY` is available, then Tavily Search when only `TAVILY_API_KEY` is available.
-Brave Search wins when both keys are available so existing non-interactive setups keep their previous behavior.
-
-The web search provider is part of the sandbox image and agent configuration.
-If you change or disable it later, rerun onboarding with the new selection and accept the sandbox recreation, or pass `--recreate-sandbox`.
-NemoClaw backs up the supported workspace state before recreation and restores it into the replacement sandbox.
-
-The wizard also offers messaging channels such as Telegram, Discord, Slack, WeChat, and WhatsApp.
-Press a channel number to toggle it, then press Enter to continue.
-If you leave all channels unselected, pressing Enter skips messaging setup.
-If you select a channel, NemoClaw validates the token format before it bakes the channel configuration into the sandbox.
-For example, Slack bot tokens must start with `xoxb-`.
-WeChat and WhatsApp are experimental.
-Review [Messaging Channels](../manage-sandboxes/messaging-channels) before enabling them.
-
-### Choose Network Policy Presets
-
-After the sandbox image builds and OpenClaw starts inside the sandbox, NemoClaw asks which network policy tier to apply.
-Web search and messaging selections happen before this point so the sandbox image and the policy suggestions stay aligned.
-The default **Balanced** tier includes common development presets such as npm, PyPI, Hugging Face, and Homebrew, plus the `brave` or `tavily` preset when you selected that web search provider.
-Apply the `weather` preset explicitly if your agent needs read-only weather lookups.
-OpenClaw sandboxes also receive the `openclaw-pricing` preset automatically so session-cost records can populate without manual configuration.
-Use the arrow keys or `j` and `k` to move, Space to select, and Enter to confirm.
-
-The preset selector lets you include more destinations, such as GitHub, Jira, Slack, Telegram, or local inference.
-Press `r` to toggle a selected preset between read-only and read-write when the preset supports both modes.
-
-When the install completes, a summary confirms the running environment.
-Before printing the summary, NemoClaw verifies that the sandbox gateway and dashboard port forward are reachable.
-When web search is enabled, NemoClaw also checks the selected OpenClaw provider configuration and sends a real search request through the sandbox egress path.
-This check reports a warning instead of aborting onboarding when the provider or egress path needs attention.
-NemoClaw reports inference route and messaging bridge checks as warnings when they need more time or additional configuration.
-The `Model` and provider line reflects the inference option you picked during onboarding.
-The example below shows the result if you picked an OpenAI-compatible endpoint during onboarding.
-
-```text
-──────────────────────────────────────────────────
-NemoClaw is ready
-
-Sandbox: my-gpt-claw
-Model: openai/openai/gpt-5.5 (Other OpenAI-compatible endpoint)
-
-Start chatting
-
- Browser:
- http://127.0.0.1:18789/
-
- Terminal:
- nemoclaw my-gpt-claw connect
- then run: openclaw tui
-
-Authenticated dashboard URL, if needed:
- nemoclaw my-gpt-claw dashboard-url --quiet
-
-Manage later
-
- Status: nemoclaw my-gpt-claw status
- Logs: nemoclaw my-gpt-claw logs --follow
- Model: nemoclaw inference set --model --provider --sandbox my-gpt-claw
- Policies: nemoclaw my-gpt-claw policy-add
- Credentials: nemoclaw credentials reset && nemoclaw onboard
-──────────────────────────────────────────────────
-
-[INFO] === Installation complete ===
-```
-
-If you picked a different option, the `Model` line shows that provider's model and label instead.
-For example, you might see `gpt-5.4 (OpenAI)`, `claude-sonnet-4-6 (Anthropic)`, `gemini-2.5-flash (Google Gemini)`, `llama3.1:8b (Local Ollama)`, `nvidia-routed (Model Router)`, or ` (Other OpenAI-compatible endpoint)`.
-
-## Confirm Onboarding Finished Before You Chat
+
+
+ Run the hosted installer in a terminal.
-The sandbox exists only after `nemoclaw onboard` completes.
-The installer auto-launches the wizard, but some paths do not run it for you: remote or Brev hosts where the installer cannot locate the freshly installed binary, or any host where a blocking preflight check fails.
-In those cases the installer prints a `To finish setup, run:` block instead of starting the wizard, and the sandbox does not exist yet.
+ ```bash
+ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
+ ```
-If you did not see the **NemoClaw is ready** summary above, run onboarding explicitly before you connect or chat:
+ Accept the third-party software notice when prompted.
+
-```bash
-nemoclaw onboard
-```
+
+ The wizard creates the sandbox.
+ Choose an inference provider and model, provide its credential when prompted, and enter a sandbox name such as `my-gpt-claw`.
+ For a first run, skip optional web search and messaging setup, then accept the suggested network policy tier.
+
-To confirm the sandbox exists, run `nemoclaw status`.
-Do not run `nemoclaw connect` or `openclaw tui` until onboarding has created the sandbox; otherwise the connect step fails because no sandbox exists.
+
+ Wait for the ready summary, then check the sandbox state.
-## Run Your First Agent Prompt
+ ```bash
+ nemoclaw my-gpt-claw status
+ ```
+
-Chat with the agent from the terminal or the browser.
+
+ Use either the dashboard or the terminal.
-### Open the OpenClaw UI in a Browser to Chat with the Agent
+ ```bash
+ nemoclaw my-gpt-claw dashboard-url --quiet
+ ```
-The onboard wizard starts a background port forward to the sandbox dashboard, then prints the dashboard URL in the install summary.
-The default host port is `18789`.
-If that port is already taken, NemoClaw uses the next free dashboard port, such as `18790`, and prints that port in the final URL.
-If the chosen port becomes occupied after the sandbox build starts, onboarding rolls back the newly created sandbox and asks you to retry instead of printing an unreachable dashboard URL.
-The install transcript does not print the gateway token.
-If the browser requires authentication, use the `dashboard-url --quiet` command to print a complete URL explicitly.
+ Open the printed URL in your browser, or connect from the terminal and start the OpenClaw TUI.
-```text
-nemoclaw my-gpt-claw dashboard-url --quiet
-```
-
-Open the dashboard URL in your browser.
-If the browser asks for authentication, run `nemoclaw my-gpt-claw dashboard-url --quiet` and open the returned URL.
-Treat the authenticated URL like a password.
-
-#### Open the Dashboard When You SSH'd into a Remote Host
-
-The dashboard URL binds to `127.0.0.1` on the machine that runs `nemoclaw`.
-If you SSH'd into a remote DGX Spark or GPU host, that loopback address is not reachable from your workstation browser until you forward the port.
-When NemoClaw detects an SSH session, the install summary and `dashboard-url` output add a copy-pastable `ssh -L` example:
+ ```bash
+ nemoclaw my-gpt-claw connect
+ openclaw tui
+ ```
+
+
-```text
-Remote access (SSH session detected):
- On your workstation, run:
- ssh -L 18790:127.0.0.1:18790 @
- Then open the dashboard URL above in your local browser.
-```
+## Considerations
-Run that `ssh -L` command in a second terminal on your workstation, then open the dashboard URL locally.
-The forwarded port matches the one NemoClaw printed, so substitute `18789` (or whichever port the summary shows) if it differs.
-For Brev tunnels or binding the dashboard to all interfaces instead of forwarding, see [Remote Dashboard Access](../deployment/deploy-to-remote-gpu#remote-dashboard-access).
+Use these details when your first-run path needs more control.
-### Chat with the Agent from the Terminal
+
+
+ The hosted installer follows the maintained last-known-good release by default and can prompt through an interactive terminal.
+ In CI, a shell script, or another non-TTY context, pass the third-party software acceptance to `bash`.
-Connect to the sandbox and use the OpenClaw CLI.
+ ```bash
+ curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1 bash
+ ```
-```bash
-nemoclaw my-gpt-claw connect
-# inside the sandbox:
-openclaw tui
-```
+ For a non-interactive first run, also set the provider, credential, and sandbox name.
+
+ ```bash
+ curl -fsSL https://www.nvidia.com/nemoclaw.sh | \
+ NEMOCLAW_NON_INTERACTIVE=1 \
+ NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1 \
+ NEMOCLAW_PROVIDER=build \
+ NVIDIA_INFERENCE_API_KEY= \
+ NEMOCLAW_SANDBOX_NAME=my-gpt-claw \
+ bash
+ ```
+
+ The example uses NVIDIA Endpoints.
+ Set `NEMOCLAW_PROVIDER` and the matching credential variable for another provider, then use a sandbox name that does not depend on a previous onboarding session.
+ Do not place `NEMOCLAW_ACCEPT_THIRD_PARTY_SOFTWARE=1` before `curl`, because the installer process cannot read it there.
+ Refer to the [Commands reference](../reference/commands#nemoclaw-onboard) for the full non-interactive configuration.
+
+
+
+ The wizard supports NVIDIA Endpoints, OpenRouter, OpenAI, OpenAI-compatible endpoints, Anthropic, Anthropic-compatible endpoints, Google Gemini, local Ollama, and configured model-router profiles.
+ Export the relevant API key before starting the installer when you do not want the wizard to prompt for it.
+ Refer to [Inference Options](../inference/inference-options) for provider requirements, model choices, and local-server setup.
+
+ Web search and messaging are optional build-time choices.
+ Add them when you need them, then rerun onboarding and accept sandbox recreation when you change those choices later.
+ Refer to [Messaging Channels](../manage-sandboxes/messaging-channels) and [Network Policies](../network-policy/approve-network-requests) before enabling them.
+
+
+
+ On Linux, the installer checks Docker and can install it when it is missing.
+ If the installer adds you to the `docker` group, run the printed `newgrp docker` command before you rerun it.
+ On macOS, start Docker Desktop or Colima first.
+
+ DGX Spark, DGX Station, and Windows WSL offer an interactive express-install path that chooses a managed local inference option for the platform.
+ Refer to [Platform Support](../reference/platform-support) and [Inference Options](../inference/inference-options) for the current platform behavior.
+
+ If `nemoclaw` is not found after installation and you use nvm or fnm, open a new terminal or reload your shell profile.
+
+
+
+ The installer starts `nemoclaw onboard` automatically when preflight checks pass and it can find the new binary.
+ If it prints `To finish setup, run:`, run the supplied `nemoclaw onboard` command before you try to connect.
+
+ To retry an interrupted onboarding session, run:
+
+ ```bash
+ nemoclaw onboard --resume
+ ```
+
+ To discard its saved state and start again, run:
+
+ ```bash
+ nemoclaw onboard --fresh
+ ```
+
+ The installer handles existing registered sandboxes as an upgrade and recovery workflow instead of creating an additional sandbox.
+ Refer to [Previous onboarding session failed](../reference/troubleshooting#previous-onboarding-session-failed) before changing a failed or existing installation.
+
+
+
+ The dashboard binds to `127.0.0.1` on the host running NemoClaw.
+ When you connect over SSH, forward the dashboard port from your workstation, substituting the port from the ready summary.
+
+ ```bash
+ ssh -L 18789:127.0.0.1:18789 @
+ ```
+
+ The complete dashboard URL contains a gateway token fragment that authenticates the browser session.
+ Treat an authenticated dashboard URL as a password.
+ Refer to [Remote Dashboard Access](../deployment/deploy-to-remote-gpu#remote-dashboard-access) for Brev tunnels and other remote-access options.
+
+
+
+ The installer script installs Node.js when it is not already present, then starts the guided onboarding wizard to create the sandbox, configure inference, and apply security policies.
+ NemoClaw creates a fresh OpenClaw instance inside that sandbox.
+
+ The third-party software notice runs before the installer installs Node.js or the NemoClaw CLI.
+ A piped installer can prompt through a terminal when a TTY is available.
+ You can also pass the acceptance flag through `bash -s`.
+
+ ```bash
+ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash -s -- --yes-i-accept-third-party-software
+ ```
+
+ If you use nvm or fnm and `nemoclaw` is not found after installation, run `source ~/.bashrc` or `source ~/.zshrc`, or open a new terminal.
+
+ On Linux, the installer checks Docker before it installs NemoClaw.
+ When Docker is missing, it downloads the official Docker convenience script, prompts for `sudo`, installs Docker, and starts the Docker service when systemd is available.
+ If the current shell cannot use the Docker socket, the installer adds your user to the `docker` group and exits with a recovery command.
+
+ On macOS, NemoClaw uses the Docker-driver OpenShell gateway path with Docker Desktop or Colima.
+
+ ```bash
+ newgrp docker
+ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash
+ ```
+
+ On DGX Spark, DGX Station, and Windows WSL, interactive installation offers express install after you accept the third-party software notice.
+ Express install switches onboarding to non-interactive mode, allows `sudo` password prompts for required host changes, and selects the managed local inference path for that platform.
+ DGX Spark uses managed vLLM with `qwen3.6-35b-a3b-nvfp4` by default, and DGX Station uses `deepseek-v4-flash` by default.
+ Unless `NEMOCLAW_POLICY_TIER` is set, express install applies policy in `suggested` mode with the `balanced` tier, including the base sandbox policy and supported package, model, web-search, and local-inference presets.
+ DGX Spark uses `my-spark-assistant` as the sandbox name unless `NEMOCLAW_SANDBOX_NAME` is set.
+ Windows WSL selects the Windows-host Ollama setup path.
+ Set `NEMOCLAW_NO_EXPRESS=1` to skip the express prompt, or set `NEMOCLAW_PROVIDER` before launching the installer to choose a provider yourself.
+
+ The installer auto-launches `nemoclaw onboard` when it can find the new binary.
+ If it cannot find the binary or blocking host preflight checks fail, it prints diagnostics and a `To finish setup, run:` block with the explicit `nemoclaw onboard` command.
+
+
+ Onboarding builds the sandbox image with `NEMOCLAW_DISABLE_DEVICE_AUTH=1` so the dashboard is usable during setup.
+ This build-time setting is baked into the image and setting it after onboarding does not affect an existing sandbox.
+
+
+
+
+ The wizard runs preflight checks, starts or reuses the OpenShell gateway, asks for an inference provider and model, collects required credentials, and asks for a sandbox name.
+ It prints a review summary before it registers the provider with OpenShell.
+ After confirmation, NemoClaw registers inference, prompts for optional web search and messaging channels, builds and starts the sandbox, sets up OpenClaw, and applies the selected network policy tier and presets.
+ At any prompt, press Enter to accept the default shown in `[brackets]`, type `back` to return to the previous prompt, or type `exit` to quit.
+
+ If registered sandboxes already exist, the installer prepares the current NemoClaw CLI without replacing OpenShell, requires a fresh backup of every registered sandbox before it changes the gateway, and runs `nemoclaw upgrade-sandboxes --auto` after the host upgrade.
+ Successful recovery rebuilds stale sandboxes, restores validated backups for registered sandboxes that are not Ready, and skips generic onboarding rather than creating an additional sandbox or requesting a new provider credential.
+ If the recovery pass exits 0 but a recorded sandbox is not found on its own recorded gateway, such as after `nemoclaw uninstall` removed the gateway and Docker image while preserving `sandboxes.json`, the installer finishes with `Installation completed with warnings` and remediation guidance instead of claiming the sandbox was recovered.
+ For pre-fingerprint OpenClaw and Hermes registry entries, confirm that every listed sandbox used a NemoClaw-managed image before recovery onto the current managed image.
+ In non-interactive runs, set `NEMOCLAW_CONFIRM_LEGACY_MANAGED_RECREATE` to the exact JSON array of printed names only after you verify every named sandbox used a managed image.
+ Legacy managed-image confirmation never overrides recorded custom-image evidence.
+ A custom OpenClaw sandbox can be recovered only when the selected validated backup independently carries complete authoritative image-plugin provenance.
+ If a backup is skipped or fails, or automatic rebuild fails or is blocked, the installer exits nonzero before generic onboarding begins.
+
+ The inference prompt presents these choices.
+
+ ```text
+ 1) NVIDIA Endpoints
+ 2) OpenRouter
+ 3) OpenAI
+ 4) Other OpenAI-compatible endpoint
+ 5) Anthropic
+ 6) Other Anthropic-compatible endpoint
+ 7) Google Gemini
+ 8) Local Ollama (localhost:11434)
+ 9) Model Router (experimental)
+ Choose [1]:
+ ```
+
+ Local Ollama appears when NemoClaw detects a usable local Ollama path or can offer an install or start action for your platform.
+ A configured blueprint router profile makes the Model Router option appear.
+
+
+ Export the API key before you launch the installer when you do not want the wizard to ask for it.
+ For example, run `export NVIDIA_INFERENCE_API_KEY=` before the installer.
+ Refer to [Reset a Stored Credential](../manage-sandboxes/lifecycle#reset-a-stored-credential) if you need to clear and re-enter a key.
+
+
+ | Option | Use when | Credential variable |
+ |---|---|---|
+ | NVIDIA Endpoints | You want hosted models from `build.nvidia.com`, including hosted Nemotron models. | `NVIDIA_INFERENCE_API_KEY` |
+ | OpenRouter | You want OpenRouter as a managed hosted OpenAI-compatible provider. | `OPENROUTER_API_KEY` |
+ | OpenAI | You want the OpenAI API at `https://api.openai.com/v1`. | `OPENAI_API_KEY` |
+ | Other OpenAI-compatible endpoint | You have LocalAI, llama.cpp, vLLM, NIM, SGLang, an enterprise gateway, or another `/v1/chat/completions` endpoint. | `COMPATIBLE_API_KEY` |
+ | Anthropic | You want the Anthropic Messages API. | `ANTHROPIC_API_KEY` |
+ | Other Anthropic-compatible endpoint | You have a Claude proxy, Bedrock-compatible gateway, or a self-hosted `/v1/messages` endpoint. | `COMPATIBLE_ANTHROPIC_API_KEY` |
+ | Google Gemini | You want Google's OpenAI-compatible Gemini endpoint. | `GEMINI_API_KEY` |
+ | Local Ollama | You want a host-local Ollama model. | None |
+ | Model Router | You want NemoClaw to start the host-side model router. | `NVIDIA_INFERENCE_API_KEY` |
+
+ If a compatible endpoint does not require authentication, set its credential variable to any non-empty placeholder.
+
+ After you enter a sandbox name, the wizard asks for final confirmation before it registers the provider, prompts for integrations, and builds the sandbox image.
+
+ ```text
+ ──────────────────────────────────────────────────
+ Review configuration
+ ──────────────────────────────────────────────────
+ Provider: compatible-endpoint
+ Model: openai/openai/gpt-5.5
+ API key: configured for OpenShell gateway registration
+ Web search: disabled
+ Managed tools: none
+ Messaging: none
+ Sandbox name: my-gpt-claw
+ Note: Sandbox build typically takes 5–15 minutes on this host.
+ ──────────────────────────────────────────────────
+ Web search and messaging channels will be prompted next.
+ Apply this configuration? [Y/n]:
+ ```
+
+ The default is `Y`.
+ Press Enter to continue, or answer `n` to abort cleanly, correct the entries, and rerun `nemoclaw onboard`.
+ Non-interactive runs print the summary for log clarity but skip the prompt.
+
+
+
+ After confirmation, NemoClaw registers the selected provider with the OpenShell gateway and sets the `inference.local` route.
+ The wizard asks whether to enable web search and offers Brave Search or Tavily Search.
+ Provide `BRAVE_API_KEY` for Brave Search or `TAVILY_API_KEY` for Tavily Search when prompted.
+ NemoClaw validates the selected key before it builds the sandbox, registers a sandbox-scoped OpenShell provider, and writes only an OpenShell resolver placeholder into the OpenClaw configuration.
+ OpenShell replaces the placeholder with the real key at egress.
+
+ For non-interactive onboarding, select the provider explicitly and export its key.
+
+ ```bash
+ export NEMOCLAW_WEB_SEARCH_PROVIDER=tavily
+ export TAVILY_API_KEY=
+ nemoclaw onboard --non-interactive
+ ```
+
+ Set `NEMOCLAW_WEB_SEARCH_PROVIDER=none` to disable web search explicitly.
+ When the selector is unset, OpenClaw chooses Brave Search when `BRAVE_API_KEY` is available, then Tavily Search when only `TAVILY_API_KEY` is available.
+ Brave Search wins when both keys are available.
+ Changing or disabling web search requires re-running onboarding with the new selection and accepting sandbox recreation, or passing `--recreate-sandbox`.
+ NemoClaw backs up supported workspace state before recreation and restores it into the replacement sandbox.
+
+ The wizard also offers Telegram, Discord, Slack, WeChat, and WhatsApp.
+ Press a channel number to toggle it, then press Enter to continue.
+ Leave every channel unselected to skip messaging setup.
+ When you select a channel, NemoClaw validates the token format before it bakes the channel configuration into the sandbox.
+ For example, Slack bot tokens must start with `xoxb-`.
+ WeChat and WhatsApp are experimental.
+ Refer to [Messaging Channels](../manage-sandboxes/messaging-channels) before enabling them.
+
+ After the sandbox image builds and OpenClaw starts, NemoClaw asks which network policy tier to apply.
+ Web search and messaging selections happen first so the sandbox image and policy suggestions stay aligned.
+ The default Balanced tier includes common development presets, such as npm, PyPI, Hugging Face, and Homebrew, plus the matching `brave` or `tavily` preset.
+ Add the `weather` preset explicitly for read-only weather lookups.
+ OpenClaw sandboxes also receive the `openclaw-pricing` preset automatically so session-cost records can populate without manual configuration.
+ Use the arrow keys or `j` and `k` to move, Space to select, and Enter to confirm.
+ The selector can include destinations such as GitHub, Jira, Slack, Telegram, or local inference.
+ Press `r` to switch a selected preset between read-only and read-write when it supports both modes.
+
+ Before it prints the ready summary, NemoClaw checks that the sandbox gateway and dashboard port forward are reachable.
+ When web search is enabled, it also checks the selected provider configuration and sends a real search request through sandbox egress.
+ Web search, inference-route, and messaging-bridge checks report warnings instead of aborting onboarding when they need more time or configuration.
+
+ ```text
+ ──────────────────────────────────────────────────
+ NemoClaw is ready
+
+ Sandbox: my-gpt-claw
+ Model: openai/openai/gpt-5.5 (Other OpenAI-compatible endpoint)
+
+ Start chatting
+
+ Browser:
+ http://127.0.0.1:18789/
+
+ Terminal:
+ nemoclaw my-gpt-claw connect
+ then run: openclaw tui
+
+ Authenticated dashboard URL, if needed:
+ nemoclaw my-gpt-claw dashboard-url --quiet
+
+ Manage later
+
+ Status: nemoclaw my-gpt-claw status
+ Logs: nemoclaw my-gpt-claw logs --follow
+ Model: nemoclaw inference set --model --provider --sandbox my-gpt-claw
+ Policies: nemoclaw my-gpt-claw policy-add
+ Credentials: nemoclaw credentials reset && nemoclaw onboard
+ ──────────────────────────────────────────────────
+ ```
+
+ A different provider displays its selected model and label, such as `gpt-5.4 (OpenAI)`, `claude-sonnet-4-6 (Anthropic)`, `gemini-2.5-flash (Google Gemini)`, `llama3.1:8b (Local Ollama)`, `nvidia-routed (Model Router)`, or ` (Other OpenAI-compatible endpoint)`.
+
+
+
+ The sandbox exists only after `nemoclaw onboard` completes.
+ If you do not see the `NemoClaw is ready` summary, run onboarding explicitly before you connect or chat.
+
+ ```bash
+ nemoclaw onboard
+ ```
+
+ Do not run `nemoclaw connect` or `openclaw tui` until onboarding has created the sandbox.
+
+ The wizard starts a background dashboard port forward and prints its URL in the ready summary.
+ The default host port is `18789`.
+ When that port is occupied, NemoClaw uses the next free dashboard port, such as `18790`, and prints it in the final URL.
+ If the selected port becomes occupied after the sandbox build begins, onboarding rolls back the new sandbox and asks you to retry rather than print an unreachable URL.
+ The installation transcript does not print the gateway token.
+ Use `nemoclaw my-gpt-claw dashboard-url --quiet` to print the complete authenticated URL explicitly.
+
+ When NemoClaw detects an SSH session, the ready summary and `dashboard-url` output include a copyable SSH forwarding example.
+
+ ```text
+ Remote access (SSH session detected):
+ On your workstation, run:
+ ssh -L 18790:127.0.0.1:18790 @
+ Then open the dashboard URL above in your local browser.
+ ```
+
+ Run the SSH command in a second terminal on your workstation and substitute the port printed by NemoClaw.
+ For Brev tunnels or binding the dashboard to all interfaces instead of forwarding, refer to [Remote Dashboard Access](../deployment/deploy-to-remote-gpu#remote-dashboard-access).
+
+
+
+## Troubleshooting
+
+If onboarding does not finish with a ready summary, do not run `connect` yet.
+Run `nemoclaw onboard`, then use [Troubleshooting](../reference/troubleshooting) for preflight, Docker, credential, provider, and network-policy errors.
## Next Steps
-Use these topics to learn more about NemoClaw.
-
- [NemoClaw Overview](../about/overview) explains what NemoClaw is and what it supports.
- [Architecture Overview](../about/how-it-works) explains how NemoClaw works.
-- [Ecosystem](../about/ecosystem) explains how OpenClaw, OpenShell, and NemoClaw relate in the wider stack, and when to use NemoClaw versus OpenShell.
-- [AI Agent Docs](../resources/agent-skills) lets your AI coding assistant fetch NemoClaw Markdown docs.
-
-Use these topics to work with NemoClaw.
-
-- [Manage NemoClaw sandboxes](../manage-sandboxes/lifecycle) covers port forwards, rebuilds, upgrades, and uninstall.
-- [Inference Options](../inference/inference-options) explains how to use a different model or endpoint.
+- [Ecosystem](../about/ecosystem) explains how OpenClaw, OpenShell, and NemoClaw relate and when to use NemoClaw instead of OpenShell.
+- [Manage NemoClaw sandboxes](../manage-sandboxes/lifecycle) covers port forwards, rebuilds, upgrades, and removal.
+- [Inference Options](../inference/inference-options) explains how to choose or change a model and provider.
- [Network Policies](../network-policy/approve-network-requests) explains how to manage egress approvals.
-- [Troubleshooting](../reference/troubleshooting) covers common error messages and resolution steps.
+- [AI Agent Docs](../resources/agent-skills) lets your AI coding assistant fetch NemoClaw Markdown docs.