Changelog — August 11, 2026

An error message printed the password you passed it. nemoclaw <sandbox> mcp add <name> --url <URL> printed the raw operator value in its parse-failure diagnostic, so a malformed credential-bearing URL echoed its embedded username and password to the terminal — and to anything that captured that output (#8707). The new message names the requirement without repeating the value: an absolute https:// URL with a literal hostname, and an explicit note that NemoClaw will not echo the rejected value because a malformed URL can embed credentials. Exit code stays 2.

What makes this worth reading rather than just noting: the same function already refused to echo in every other branch. It rejected a parseable URL carrying credentials with a value-free message, and rejected a query string "because URLs are persisted and displayed". Only the earliest branch — the one that runs before any parsing — escaped its own rule. That is the recurring shape of this class of bug: the policy is right, and one code path predates it. The value is dropped rather than redacted because the redactor on the actual print path leaves several malformed forms verbatim; redaction that only works on well-formed input is not redaction for a defect whose entire premise is malformed input.

A rebuild destroyed the sandbox and then couldn't recreate it. nemoclaw <name> rebuild --yes destroyed the sandbox during preflight, then exited 1 with "Brave Search requires BRAVE_API_KEY or a saved Brave Search credential in non-interactive mode" — leaving you with nothing (#8774). The recreate path required two proofs before reusing the web-search credential already registered with the sandbox's gateway, and one of them — a session-scoped staged receipt — is structurally unobtainable on rebuild, because rebuild overwrites the session before resuming. The reuse branch was therefore unreachable on every rebuild, and control fell through to a path that throws in non-interactive mode for a host key rebuild can never read. Reported on Ubuntu 24.04 / v0.0.105, but the code is platform-independent.

The vLLM installer now looks before it leaps. The single-host managed vLLM installer checks its serving port before it changes any managed install state (#8699). If another process holds the port, it stops before it persists a managed bearer key, records the selected model, starts storage prompts, creates the model cache, pulls the image, or creates the container. The diagnostic names the port, identifies the holding process where the probe can, and tells you to stop it and rerun. Docker remains the authoritative bind if something claims the port after preflight — this narrows the window, it doesn't eliminate the race.

WSL2 with a Windows-host Ollama no longer dead-ends. On WSL2 with Docker Desktop, a Windows-host Ollama daemon is reached at host.docker.internal. Non-interactive onboarding with NEMOCLAW_PROVIDER=install-windows-ollama collapsed to the running-daemon handler, which then applied a Linux systemd loopback override and exited 1 before creating the sandbox — an override targeting a local ollama.service that cannot possibly configure a daemon running on the Windows host (#8634). Onboarding now reuses the reachable Windows-host daemon and never touches a Linux systemd Ollama service. This restores behavior that was first fixed months ago and regressed.

Hermes-on-NemoClaw got two real fixes. Skill installs, updates and removals now take effect in a new chat session without a gateway restart — the guidance had assumed every non-OpenClaw agent needed a restart, even though the shipped Hermes plugin reloads skills at session start (#8535). Separately, the dashboard and the gateway now agree on one WhatsApp session path (/sandbox/.hermes/platforms/whatsapp/session); they had been resolving pairing state against different homes (#8229). If you have an existing sandbox whose credentials live only in the legacy dashboard-profile directory, rebuilding and re-pairing writes the new copy but leaves the old one in durable state — the supported cleanup is channels remove whatsapp then channels add whatsapp, which clears all three locations.

Automation surfaces got more honest. channels status gained --wait and --timeout, so a caller can block until Slack registration, policy coverage, runtime, Socket Mode and the account probe are all operational — or get a structured terminal or timeout result — instead of polling a point-in-time snapshot after a sandbox rebuild (#8566). The live account probe runs only after registry and policy checks pass, and readiness reports carry no tokens or free-text errors. And nemoclaw list --json and the global nemoclaw status --json reported agent as null for an OpenClaw sandbox while the text output and the sandbox-scoped JSON reported openclaw; all four surfaces now resolve the stored marker identically (#8710). If you have automation branching on that field, it was reading null from two of the four.

Install and recovery paths. Installer host preflight no longer hardcodes storage remediation off, so managed Docker overlayfs/containerd hosts reach onboarding and can build the documented fuse-overlayfs replacement image; external, invalid and non-remediable states stay blocked (#8768, #8748). The same pair fixes NVIDIA driver detection, which required exactly three numeric components and so rejected a valid two-part version like 595.84 on newer GPU hosts. Legacy supervisor recovery now retries an unreachable state backup up to five times with a two-second wait, because OpenShell exec can be ready before its SSH transport after a Docker restart — integrity, audit and cleanup failures stay terminal (#8787). And a failed openshell forward list is now classified list-failed rather than being coerced to an empty ownership map and read as no-entry, which had meant the sandbox-scoped forward stop ran precisely when ownership could not be established (#8529).

Under the floor. Docker gained a real, durable, provider-fenced stateMutation implementation, replacing an unsupported surface; Hermes Shields is the named managed-image consumer, and fencing is retained across publication, validation, rollback, activation and controller restart. Podman remains unregistered (#8658). Separately, the codebase-growth guardrails merged a few days ago were fully reverted as a release contingency (#8775) — repo-contract only, nothing user-facing.

Commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/skills/, /security/, /troubleshooting/

Seven minor features, and the theme is Agent Manager becoming a place you can actually live. Terminal handling gets a proper keyboard layer: Cmd+/ focuses a visible embedded terminal before hiding it, Cmd+Shift+T creates a side terminal only while the terminal area has focus, Cmd+Shift+[ and ] switch terminal tabs, and Cmd+Shift+M focuses the Agent Manager prompt instead of opening VS Code Problems. Cmd+W now hides the last side terminal instead of stopping its shell — a small change with an outsized quality-of-life effect if you have ever killed a long-running process by reflexively closing a pane (#12945).

Worktrees and model selection both got less guessy. In multi-project mode you can now choose the repository when creating or importing a worktree (#12931), and worktree prompts accept model, agent, variant and sandbox slash commands (#12859). Model search is now provider-aware with personalized usage suggestions (#12943), and you can browse an instance's model catalog before starting a session (#13014) rather than committing to a session to find out what's available.

Approval reasons moved, and /review grew modes. Tool approval reason indicators now appear after the tool output with an icon, and there is a display setting to hide them (#12995) — worth knowing about before you turn it off, since "why was this auto-approved?" is exactly the question you want answered when something surprises you. /review gained nested slash-command suggestions for staged, unpushed and quick modes (#12991).

Roughly fifty patch fixes underneath. The ones most likely to matter day to day: reasoning effort is now preserved across model switches, sandbox settings apply to existing sessions, negative pricing entries are handled, terminals accept input during shell startup, git polling load drops (twice), worktree session startup is faster, chat scrolling stops flickering, and identical worktree IDs no longer collide in the row list. Mermaid diagrams copy to the clipboard as PNG or SVG in VS Code, speech-to-text audio compresses to AAC, and the bundled OpenCode moves v1.17.9 → v1.17.13.

Release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/models/, /kilocode/orchestrator/, /kilocode/vs-claude-code/

Nothing new to configure, which after last week is a welcome shape for a release. The most consequential fix is a billing-adjacent one: feature flags were being evaluated without the user's subscription tier when a session started with an expired login token, which could wrongly prompt Max plan users to enable usage credits for Fable. If you saw that prompt and were confused by it, this is why — you were being asked to pay for something your plan already covered.

Two breakage fixes. Every Bash command failed under claude-code-action with allowed_non_write_users on GitHub-hosted runners — a total outage of the tool for that specific CI configuration, not a degradation. And /tui could bring back a conversation that had been rewound to before its first message, resurrecting history you had deliberately discarded.

The slash-command menu is easier to read. Blue now marks only the selected row rather than competing with other coloring, matched characters are bolded instead of recolored, and command names with emoji or accented characters keep their glyphs instead of being mangled. Plus fewer event-loop stalls on file-not-found suggestions and at-mention size checks — the kind of change you notice as the absence of a stutter rather than as a feature.

Release notes → Affects: /openclaw/, /openclaw/troubleshooting/, /openclaw/cost-optimisation/

Two access tiers, for approved defenders only. OpenAI's Daybreak security program now offers Daybreak Blue — general-purpose models such as GPT-5.6 Sol, for defensive security work — and Daybreak Red, with purpose-trained models including gpt-5.6-cyber, for explicitly authorized offensive engagements: exploit validation, penetration testing, red teaming. Both are on v1/responses. OpenAI's guidance is to start with Blue for most defensive tasks and to use the tiers to move from a security finding to a validated fix. This is access-gated to approved defenders, not a general availability change, but it is a notable direction for anyone building agents that touch security workflows — and it sharpens a question our security center already asks: an agent authorized to validate an exploit is an agent authorized to run one.

Also this week: the chat-latest snapshot on v1/chat/completions was repointed at the current ChatGPT model for Plus and Pro users. OpenAI still recommends pinning GPT-5.6 Sol for production — chat-latest is updated regularly, which is exactly what you don't want under a system prompt you have tuned.

Platform changelog → Affects: /chatgpt/, /chatgpt/pricing/, /chatgpt/api-vs-chat/, /security/