From affdf34e5fa98918635eec0badc9840e9f80dc81 Mon Sep 17 00:00:00 2001 From: harjoth Date: Sat, 25 Jul 2026 23:11:48 -0700 Subject: [PATCH 1/2] docs(reference): correct NEMOCLAW_CONFIG_ACCEPT_NEW_PATH and document config set The environment variable row described the variable as accepting a new sandbox config path when the stored path differs from the discovered one. It actually gates writing a config key dotpath that does not yet exist in the sandbox config, and it applies only to `config set`, not onboarding. Move the row from Onboarding Behavior Flags to Lifecycle Behavior Flags, correct the description, and add a `config set` reference section so the matching `--config-accept-new-path` flag is documented. Signed-off-by: harjoth --- docs/reference/commands.mdx | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/docs/reference/commands.mdx b/docs/reference/commands.mdx index 06c1a775d56..cc412e19904 100644 --- a/docs/reference/commands.mdx +++ b/docs/reference/commands.mdx @@ -1058,6 +1058,33 @@ $$nemoclaw my-assistant config get --key model --format yaml | `--key ` | Print one value from the sanitized config | | `--format json\|yaml` | Output format. Defaults to JSON | +#### `$$nemoclaw config set` + +Write one value into the agent configuration in a sandbox. +The command validates every HTTP and HTTPS URL in the value, including URLs nested inside JSON objects or arrays. +It pins an HTTP host to the validated IP address. +Config changes are unavailable while shields are up, so lower shields with `$$nemoclaw shields down` first. + +```bash +$$nemoclaw my-assistant config set --key agents.defaults.model.primary --value nvidia/nemotron +$$nemoclaw my-assistant config set --key agents.defaults.timeoutSeconds --value 600 --restart +``` + +| Flag | Description | +|------|-------------| +| `--key ` | Dotpath to update in the config. Required | +| `--value ` | Value to write. The command parses a JSON value when it can, and otherwise writes the text as a string. Required | +| `--restart` | Restart a supported OpenClaw or Hermes gateway after writing | +| `--config-accept-new-path` | Write a dotpath that does not already exist in the config | + +The command treats a dotpath that does not already exist in the config as a possible typo. +An interactive run asks for confirmation before writing the new dotpath. +A run without a TTY, or a run with `NEMOCLAW_NON_INTERACTIVE=1`, refuses the write. +Pass `--config-accept-new-path`, or set `NEMOCLAW_CONFIG_ACCEPT_NEW_PATH=1`, to write the new dotpath without the confirmation. + +The command refuses to write `gateway` or any dotpath under `gateway.`, which holds credentials. +Use `$$nemoclaw config rotate-token` for those changes. + #### `$$nemoclaw shields` Manage the sandbox config lockdown posture from the host. @@ -3668,7 +3695,6 @@ Set them before running `$$nemoclaw onboard`. | `NEMOCLAW_SKIP_TELEGRAM_REACHABILITY` | `1` to enable | Skips the Telegram bot reachability probe during onboard (useful in restricted networks). | | `NEMOCLAW_SKIP_SLACK_AUTH_VALIDATION` | `1`, `true`, `yes`, or `on` to enable | Skips the live Slack `auth.test` and `apps.connections.open` credential probes during onboard and `channels add slack`. Use only in restricted networks or hermetic test environments; Slack token format checks still apply. | -| `NEMOCLAW_CONFIG_ACCEPT_NEW_PATH` | `1` to enable | Accepts a new sandbox config path without an interactive prompt when the stored path differs from the discovered one. | | `NEMOCLAW_RESOURCE_PROFILE` | profile name or `default` | Selects a sandbox CPU/RAM resource profile from the blueprint during onboarding. `default` means no resource preference, so NemoClaw passes no OpenShell CPU or memory flags. Unknown names fail fast. | | `NEMOCLAW_CPU` | percentage or Kubernetes CPU quantity | Overrides the selected profile's CPU size passed to OpenShell `--cpu`. Percentages resolve against detected capacity. | | `NEMOCLAW_RAM` | percentage or Kubernetes memory quantity | Overrides the selected profile's memory size passed to OpenShell `--memory`. Percentages resolve against detected capacity. | @@ -3827,6 +3853,7 @@ The following flags change defaults for commands that manage existing sandboxes. | Variable | Format | Effect | |----------|--------|--------| | `NEMOCLAW_CLEANUP_GATEWAY` | `1`, `true`, or `yes` to enable; `0`, `false`, or `no` to disable | Overrides the platform default (macOS unattended: cleanup; Linux/Windows: preserve) for whether `$$nemoclaw destroy` removes the shared gateway when destroying the last sandbox. Command-line `--cleanup-gateway` and `--no-cleanup-gateway` still take precedence. | +| `NEMOCLAW_CONFIG_ACCEPT_NEW_PATH` | Exactly `1` to opt in (`true`, `yes`, `on` are not accepted) | Allows `$$nemoclaw config set` to write a dotpath that does not already exist in the sandbox config, without the interactive confirmation. Equivalent to passing `--config-accept-new-path`, and it takes precedence over `NEMOCLAW_NON_INTERACTIVE=1`. Without it, a run without a TTY refuses the write instead. | | `NEMOCLAW_CONFIRM_LEGACY_MANAGED_RECREATE` | Exact JSON array of sandbox names | Confirms to the installer that the exact listed set of pre-fingerprint OpenClaw or Hermes sandboxes used NemoClaw-managed images, allowing recovery onto the current managed image. The normalized names must exactly match the installer's printed array. Set it only after verifying every named sandbox. Recorded custom-image evidence remains blocked. | | `NEMOCLAW_DISABLE_INFERENCE_ROUTE_REPAIR` | `1` to enable | Skips the automatic DNS-proxy repair for stale `inference.local` routes during `$$nemoclaw connect` and `$$nemoclaw connect --probe-only`. Use only as a troubleshooting escape hatch. | | `NEMOCLAW_DISABLE_SUPERVISOR_RELAUNCH` | `1` to enable | Skips the automatic trusted container recreation during `$$nemoclaw recover` when two managed scans find no supervisor while PID 1 remains stable. Use only as a troubleshooting escape hatch; recovery then falls back to the rebuild or re-onboard guidance. | From 472bb6d8c539b535144f8f5cd5c1e5435a507a68 Mon Sep 17 00:00:00 2001 From: harjoth Date: Sat, 25 Jul 2026 23:36:35 -0700 Subject: [PATCH 2/2] docs(reference): quote the accepted NEMOCLAW_CONFIG_ACCEPT_NEW_PATH value Address CodeRabbit review feedback on #7572. The gate compares the raw environment string, so document the accepted value as "1". Signed-off-by: harjoth --- docs/reference/commands.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/commands.mdx b/docs/reference/commands.mdx index cc412e19904..75307134e01 100644 --- a/docs/reference/commands.mdx +++ b/docs/reference/commands.mdx @@ -3853,7 +3853,7 @@ The following flags change defaults for commands that manage existing sandboxes. | Variable | Format | Effect | |----------|--------|--------| | `NEMOCLAW_CLEANUP_GATEWAY` | `1`, `true`, or `yes` to enable; `0`, `false`, or `no` to disable | Overrides the platform default (macOS unattended: cleanup; Linux/Windows: preserve) for whether `$$nemoclaw destroy` removes the shared gateway when destroying the last sandbox. Command-line `--cleanup-gateway` and `--no-cleanup-gateway` still take precedence. | -| `NEMOCLAW_CONFIG_ACCEPT_NEW_PATH` | Exactly `1` to opt in (`true`, `yes`, `on` are not accepted) | Allows `$$nemoclaw config set` to write a dotpath that does not already exist in the sandbox config, without the interactive confirmation. Equivalent to passing `--config-accept-new-path`, and it takes precedence over `NEMOCLAW_NON_INTERACTIVE=1`. Without it, a run without a TTY refuses the write instead. | +| `NEMOCLAW_CONFIG_ACCEPT_NEW_PATH` | Exactly `"1"` to opt in (`true`, `yes`, `on` are not accepted) | Allows `$$nemoclaw config set` to write a dotpath that does not already exist in the sandbox config, without the interactive confirmation. Equivalent to passing `--config-accept-new-path`, and it takes precedence over `NEMOCLAW_NON_INTERACTIVE=1`. Without it, a run without a TTY refuses the write instead. | | `NEMOCLAW_CONFIRM_LEGACY_MANAGED_RECREATE` | Exact JSON array of sandbox names | Confirms to the installer that the exact listed set of pre-fingerprint OpenClaw or Hermes sandboxes used NemoClaw-managed images, allowing recovery onto the current managed image. The normalized names must exactly match the installer's printed array. Set it only after verifying every named sandbox. Recorded custom-image evidence remains blocked. | | `NEMOCLAW_DISABLE_INFERENCE_ROUTE_REPAIR` | `1` to enable | Skips the automatic DNS-proxy repair for stale `inference.local` routes during `$$nemoclaw connect` and `$$nemoclaw connect --probe-only`. Use only as a troubleshooting escape hatch. | | `NEMOCLAW_DISABLE_SUPERVISOR_RELAUNCH` | `1` to enable | Skips the automatic trusted container recreation during `$$nemoclaw recover` when two managed scans find no supervisor while PID 1 remains stable. Use only as a troubleshooting escape hatch; recovery then falls back to the rebuild or re-onboard guidance. |