Changelog — July 29, 2026

The v0.0.97 changelog entry landed (#7768), grouping the 43 PRs merged since v0.0.96. We covered much of the security half of that range yesterday — the libssh2 and CPython CVE backports, the claude-code browser-login policy fix — so this entry focuses on what's new since, plus seven further commits that landed on main today.

The headline is provider switching, and it's a two-part fix. nemoclaw inference set was failing outright when a direct compatible provider was absent or its endpoint had changed (#7746). It now inspects the provider binding before route selection, creates and verifies an absent provider before the first route attempt, and commits a verified update for an existing provider only after route selection — so a failure restores the prior selection instead of leaving you between two states. A newly created provider is removed if route selection fails.

The follow-up matters just as much (#7763): review caught that OpenShell was verifying an existing provider's old endpoint before NemoClaw replaced it. NemoClaw now reuses only the exact direct binding recorded for the sandbox, and refuses an endpoint replacement it could not roll back — because OpenShell redacts the previous endpoint, so there'd be nothing to restore. Refusing is the right call here; the alternative is a one-way change that looks reversible.

The rest of the batch:

• Managed MCP discovery accepts case-variant SSE media types (#7760). A spec-compliant Streamable HTTP server returning Text/Event-Stream; Charset=UTF-8 — legal, since media types are case-insensitive and may carry parameters — was breaking tool discovery. The official MCP SDK is pinned to 1.30.0 for its parsed media-type implementation, and a real initialize → notifications/initialized → tools/list fixture using that exact casing now runs in every reviewed runtime image build. Notably this is a generic contract fix, not a per-provider compatibility shim.
• Jetson GPU onboarding passes the DRI render-device group (#7762). Non-root CUDA initialization needs both video and render group membership; onboarding was carrying the former and not the latter. It now discovers real /dev/dri/renderD* character devices (rejecting symlinks), adds an owner GID only when its group permission actually grants access others don't already have, and passes the numeric GIDs through the existing --group-add recreation path. Read the honesty note before you count on it: no Jetson/IGX runner was available, so physical IGX Orin validation is still pending and this is the maintainer's best-guess fix. The sandbox CUDA proof stays fail-closed, so an insufficient fix rejects the recreation rather than shipping you a broken sandbox.
• A locked Hermes gateway can restart after a managed MCP update (#7761). The root-owned restart controller now recognizes the guard-generated nemoclaw-hermes-mcp-state-v1 record in the strict config hash, while still rejecting malformed, duplicate, unknown, or ambiguous records with GATEWAY_CONFIG_HASH_MISMATCH. Ships with a live regression covering managed add, shields restoration, real restart, integrity verification, and failed-reload rollback — including a scan confirming no bridge secret leaks into raw Hermes files or the startup log.
• Deep Agents Code onboarding rejects stale base inventories (#7810). A release base image can carry the expected distribution version but an obsolete security package inventory — which, after yesterday's CVE backports, is exactly the gap that would quietly hand you a vulnerable image. Base images must now match both, and the inventory probe moved into a shared module so the OpenClaw and Deep Agents gates can't drift apart.
• Post-recreate readiness waits aligned to 120s (#7784). start's post-recreate recovery gave up after 30s while connect allowed 120s to prove the same readiness — so on a cold start, recovery would abandon a sandbox that connect --probe-only then recovered successfully. The maintainer is candid that this reproduced 1-in-12 on a DGX Spark and could not be re-triggered deterministically, so it's a principled budget alignment rather than an empirically-timed value, and the upstream issue stays open.

Also in the v0.0.97 entry: the deferred two-Station vLLM evaluation stays deferred, the experimental Okta runtime-identity reference remains opt-in and outside normal onboarding, and pre-tag validation now derives test ledgers from commit E2E workflows.

Who should care: anyone who has hit inference set failing against a fresh sandbox, or managed MCP servers that connect but list no tools — both were real bugs with fixes now. If you run Jetson or IGX hardware, this is the CUDA fix you've been waiting on, but it's unvalidated on physical IGX Orin, so treat it as a candidate rather than a guarantee.

NemoClaw commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/switching-providers/, /nemoclaw/policy/

A navigation-and-terminals release. The feature people will actually feel:

• A prompt navigator rail on the chat transcript (#12632). A thin rail of ticks down the left edge shows one tick per prompt you sent; hover or focus it and a card expands listing those prompts with a short preview of each answer, and clicking jumps the transcript to that turn. It's in the sidebar, Kilo editor tabs, the sub-agent viewer, and Agent Manager — and, importantly, it never changes the readable width of the chat. Scrollback in a long agent session has been a genuine usability hole; this is the first thing that treats your own prompts as the index.
• Agent Manager terminals, properly (#12598, #12633). Terminals can now open in the VS Code terminal or an embedded side panel, chosen from the terminal button's dropdown; the side panel shares the right-hand inspector with the diff view and keeps running in the background when hidden. And you can have several: the panel header is a tab strip you click to switch, drag to reorder, and X to close, with + for another. Terminal numbers refill gaps left by closed terminals, and tabs pick up the live title from the shell or running program via OSC escape codes — so a dev server or build names its own tab.
• ⌘1-9 badges on Agent Manager cards (#12631) — hold the modifier (Ctrl on Windows/Linux) and every sidebar card shows which number jumps to which worktree, before you press it.

The fix list is unusually practical this time:

• kilo console now includes basic-auth credentials in the Local and Network Console URLs it prints (#12333). On a headless host — no DISPLAY/WAYLAND_DISPLAY, an SSH session, a CI runner — you can now copy the URL to a browser on another machine and actually reach the Console. If you run Kilo Code on a VPS, this is the release that unblocks you.
• A checkpoint that can't be fully restored no longer takes your work with it (#12587) — conversations and workspace files are left unchanged instead. Related: Windows snapshot diffs stay parseable and valid files survive a malformed stored patch (#12583).
• The phantom "Turn interrupted" warning is gone (#12639). Queueing a follow-up while the assistant works now closes the running turn as superseded rather than interrupted — it was never an error, it just looked like one.
• No more eager file watchers per worktree (#12593) — the VS Code backend stopped starting native watchers for every Agent Manager worktree, and terminals open faster with fewer delayed shell prompts (#12630).
• Settings changes sometimes failing to save and apply in VS Code (#12561); copy buttons dying after focus left VS Code (#12123); Kilo tabs creating, locking, or resizing editor panes (#12410); and the TUI now shows the Ctrl+T variant-cycling hint whenever the active model exposes reasoning variants (#12463).
• Upstream opencode v1.17.5 → v1.17.9 is folded in (#12460), carrying MCP server compatibility and schema-property improvements, long-running tool timeout fixes, OAuth callback shutdown and error escaping, agent step-limit enforcement, server credential-leak prevention, custom header passing, GLM-5.2 thinking variants, and prompt-caching optimization.

Kilo Code v7.4.17 → Affects: /kilocode/, /kilocode/setup/, /kilocode/orchestrator/, /kilocode/security/