NVIDIA · apurvvkumaria · Aug 11, 2026 · Aug 4, 2026 · Aug 4, 2026 · Aug 4, 2026
diff --git a/agents/hermes/Dockerfile b/agents/hermes/Dockerfile
@@ -6,7 +6,7 @@
 # Layers PR-specific code (plugin, config, startup script) on top of the
 # pre-built Hermes base image. Mirrors the OpenClaw Dockerfile structure.
 
-ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:57c091ab9b31c924eac0050e66c834c37df875154a254964302a31b119b50b96
+ARG BASE_IMAGE=ghcr.io/nvidia/nemoclaw/hermes-sandbox-base@sha256:3d54b928baef9df403227e846f73079d13ca8424a27cd5268ca97bac3f030b27
 ARG NEMOCLAW_CORPORATE_CA_B64=
 ARG NEMOCLAW_MANAGED_IMAGE_CAPABILITY_UNION=0
 

diff --git a/agents/hermes/whatsapp-proxy.patch b/agents/hermes/whatsapp-proxy.patch
@@ -2,8 +2,22 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 # Routes the pinned Hermes v2026.7.20 WhatsApp bridge through the OpenShell
-# proxy. Remove this patch when the minimum supported Hermes release passes
-# an HTTPS proxy agent to Baileys natively.
+# proxy and keeps dashboard pairing state in the gateway's session directory.
+# Remove the web_server.py hunk when the minimum supported Hermes release stores
+# Dashboard pairing state in the gateway session directory natively.
+# Remove the scripts/whatsapp-bridge hunks when that release routes the WhatsApp
+# bridge through HTTPS_PROXY natively.
+diff --git a/hermes_cli/web_server.py b/hermes_cli/web_server.py
+index d0c78a6b3..5f6d801b5 100644
+--- a/hermes_cli/web_server.py
++++ b/hermes_cli/web_server.py
+@@ -8110,5 +8110,3 @@ def _normalize_whatsapp_allowed_users(value: Any) -> str:
+ def _whatsapp_session_path() -> Path:
+-    from hermes_constants import get_hermes_dir
+-
+-    return get_hermes_dir("platforms/whatsapp/session", "whatsapp/session")
++    return Path("/sandbox/.hermes/platforms/whatsapp/session")
+
 diff --git a/scripts/whatsapp-bridge/bridge.js b/scripts/whatsapp-bridge/bridge.js
 index 4b5733d16..22f1ec3e1 100644
 --- a/scripts/whatsapp-bridge/bridge.js

diff --git a/docs/manage-sandboxes/set-up-whatsapp.mdx b/docs/manage-sandboxes/set-up-whatsapp.mdx
@@ -33,25 +33,22 @@ NemoClaw validates the gateway URL before pairing and renders the WhatsApp QR co
 If pairing exits with a gateway close such as `1008`, rerun the login command once, then check `$$nemoclaw <sandbox> channels status --channel whatsapp` to diagnose the gateway and session path separately from QR rendering.
 </AgentOnly>
 <AgentOnly variant="hermes">
-Hermes can pair from the Dashboard profile while the gateway reads the default `platforms/whatsapp/session` path.
-After scanning a dashboard QR code, run `$$nemoclaw <sandbox> channels status --channel whatsapp`.
-If the report says `dashboard-home has WhatsApp credentials, but the Hermes gateway session path is empty`, point the gateway at the dashboard session with the supported config command:
+Hermes dashboard pairing and the gateway share `/sandbox/.hermes/platforms/whatsapp/session`.
+After scanning a dashboard QR code, run `$$nemoclaw <sandbox> channels status --channel whatsapp` to confirm that the shared session is available to the gateway.
+
+If `channels status` reports credentials only under the legacy `profiles/dashboard-home` path, the sandbox has credentials from an image that wrote dashboard sessions to that path.
+Rebuilding and pairing again writes new credentials to the shared path, but it leaves the legacy credentials in durable state, and sandbox startup treats that copy as migration input.
+Clear every WhatsApp session path first with the supported removal command, then re-add the channel:
 
 ```bash
-$$nemoclaw <sandbox> shields down --reason "repair Hermes WhatsApp session path"
-$$nemoclaw <sandbox> config set --key platforms.whatsapp.extra.session_path --value /sandbox/.hermes/profiles/dashboard-home/platforms/whatsapp/session --restart --config-accept-new-path
-$$nemoclaw <sandbox> shields up
+$$nemoclaw <sandbox> channels remove whatsapp
+$$nemoclaw <sandbox> channels add whatsapp
 ```
 
-Keep Shields down until `config set` finishes, then restore the restrictive posture with `shields up`.
-The `--config-accept-new-path` flag lets the command write the `platforms.whatsapp.extra.session_path` configuration key when the generated config does not already contain it.
-Dashboard pairing writes session credentials under `profiles/dashboard-home`; this bounded compatibility repair redirects the gateway to that session path while it still reads the default path otherwise.
-The repair stays documented until Hermes dashboard pairing state and gateway startup converge on one shared session path; NemoClaw can redirect the configured path but does not rewrite Hermes pairing state.
-Before removing the override, run `$$nemoclaw <sandbox> channels status --channel whatsapp` after dashboard pairing and gateway startup and confirm the report no longer shows a dashboard-home session with an empty gateway session path.
-Remove the override only after Hermes uses one shared WhatsApp session path for dashboard pairing and gateway startup.
-Do not edit `/sandbox/.hermes/.env` or `/sandbox/.hermes/config.yaml` by hand.
-Manual edits can cause the Hermes config-integrity guard to reject restart with `hash-mismatch`.
-Supervisor quarantine happens after repeated relaunch failures or other integrity failures.
+`channels remove` clears `/sandbox/.hermes/platforms/whatsapp`, the dashboard profile session at `/sandbox/.hermes/profiles/dashboard-home/platforms/whatsapp/session`, and the legacy migration source at `/sandbox/.hermes/dashboard-home/platforms/whatsapp/session`.
+The sandbox must be running for that cleanup to succeed; `channels remove` refuses to proceed when it cannot reach the sandbox.
+Pair again from the dashboard so the credentials are written to `/sandbox/.hermes/platforms/whatsapp/session`.
+Rerun `$$nemoclaw <sandbox> channels status --channel whatsapp` and confirm that the gateway session path holds the credentials and that the report no longer lists a `profiles/dashboard-home` session.
 </AgentOnly>
 
 ## Protect Paired Session State
@@ -60,9 +57,13 @@ Supervisor quarantine happens after repeated relaunch failures or other integrit
 The sandbox stores mutable session credentials in durable `whatsapp` state.
 </AgentOnly>
 <AgentOnly variant="hermes">
-The sandbox stores mutable session credentials in durable `platforms/whatsapp` state for the gateway and `profiles/dashboard-home/platforms/whatsapp` state for Dashboard pairing.
+The sandbox stores mutable session credentials in durable `platforms/whatsapp` state for both dashboard pairing and the gateway.
 </AgentOnly>
 The credentials survive rebuilds without re-pairing.
+<AgentOnly variant="hermes">
+A sandbox that also holds legacy `profiles/dashboard-home` or `dashboard-home` credentials keeps both copies across a rebuild, because both paths are part of the durable state that a rebuild restores.
+Run `$$nemoclaw <sandbox> channels remove whatsapp` to clear every WhatsApp session path, then re-add the channel and pair again.
+</AgentOnly>
 This is the runtime tradeoff of enabling WhatsApp without a host bridge: a paired sandbox can use that WhatsApp account until you unpair it or clear the durable state.
 
 NemoClaw cannot detect cross-sandbox WhatsApp conflicts the way it does for token-based channels.

diff --git a/docs/reference/commands.mdx b/docs/reference/commands.mdx
@@ -2494,7 +2494,9 @@ For an OpenClaw WhatsApp sandbox, `--channel whatsapp` probes the sandbox to sep
 A paired channel with no observed inbound delivery exits non-zero with verdict `idle` so an unhealthy bridge cannot pass as healthy.
 The detailed WhatsApp probe stays focused on QR/session runtime diagnostics and does not include rendered-config comparison lines.
 For a Hermes WhatsApp sandbox, `--channel whatsapp` probes only whether the default gateway session path and the `profiles/dashboard-home` session path contain `creds.json`.
-If the dashboard path has credentials and the gateway path is empty, the report prints the supported `config set` command for the `platforms.whatsapp.extra.session_path` configuration key, including the new-configuration-key opt-in when generated configs do not already contain that key.
+If the dashboard path has credentials and the gateway path is empty, the report tells you to run `$$nemoclaw <sandbox> channels remove whatsapp` and then `$$nemoclaw <sandbox> channels add whatsapp`, because a rebuild restores the legacy session instead of dropping it.
+Pair again from the dashboard so credentials use `/sandbox/.hermes/platforms/whatsapp/session`.
+Rerun `$$nemoclaw <sandbox> channels status --channel whatsapp`.
 NemoClaw does not treat a Hermes session file as live inbound-health evidence.
 
 For Telegram, `--channel telegram` probes the sandbox to report the gateway process, Bot API reachability, and inbound delivery alongside the config comparison.