NemoClaw v0.0.121 is out

[rsliter]

NemoClaw v0.0.121 is out

NemoClaw v0.0.121 gives you more control over managed MCP tools and makes sandbox recovery more predictable. Denied-tool policies persist across lifecycle operations, while downloads and rebuilds preserve fail-closed checks around state and identity.

This release also improves everyday operation across messaging, Hermes, native Podman, and local inference. Hermes rebuilds preserve supported operator configuration, Windows and WSL Ollama flows get safer recovery, and delayed managed startup no longer fails at the earlier discovery deadline.

Skill operations now use agent-owned state instead of a separate inventory. Updated command documentation, dependency validation, and image-publication handling accompany these changes. The complete shipped range is v0.0.120...v0.0.121.

MCP and Skills

• Deny managed MCP tools by exact name or glob pattern. Use repeatable --deny-tool, mcp update, or --clear-deny-tools to maintain the policy across restart and rebuild. #11135
• Failed MCP discovery now reports failure instead of a successful empty result. Malformed JSON, JSON-RPC envelopes, and tool lists report a protocol failure. #11087, #11269
• Skill listing, installation, and removal use native agent state where supported, avoiding a second inventory that can drift. #11093
• MCP provider lifecycle operations use the shared adapter boundary, keeping provider ownership and recovery handling consistent. #11224

Sandbox and Runtime Recovery

• Directory downloads reject symbolic links and special files before transferring data or creating the destination. #10654
• Rebuild recovery can recover an interrupted backup after a killed container, while stale Hermes local fallback images remain rejected. #11142, #11094
• Retained-sandbox destruction requires verified absence and sufficient resource identity before cleanup proceeds. #10867
• Managed startup recovery tolerates delayed container discovery within a bounded deadline without retrying identity or integrity failures. This carries forward @harjothkhara's contribution in #11123. #11236
• Native Podman onboarding and later lifecycle operations no longer enter Docker-owned readiness, diagnostics, or cleanup paths. #11014
• Snapshot restore now clearly explains that --to is unavailable for snapshots from managed images, before changing the destination. #10619

Hermes and Messaging

• Hermes rebuilds preserve supported settings written through config set and report which settings were restored or dropped. #10780
• Legacy Hermes rebuild recovery preserves declared state when constrained privileged backup is required, without relaxing unrelated qualification checks. #10535
• Hermes repairs restored state permissions through verified paths, keeps mutable configuration out of relaunch policy, and initializes the Kanban schema atomically. #10872, #11110, #11177
• Invalid Hermes dashboard URLs retain actionable diagnostics. #11227
• Messaging provider setup uses typed lifecycle results, and Google Chat refresh profiles are canonicalized. #11009, #11126
• Channel stop/start preserves credentials and configuration, while absent placeholder credentials are omitted from removal operations. #11188, #11193

Inference, Installation, and Onboarding

• Windows Ollama flows resist DNS rebinding and preserve verified Docker Desktop transport during restart recovery. #10889, #10855
• Qualified RTX Spark N1x systems rank Ollama models using available memory. WSL validation retains its timeout floor and recovery guidance. #11187, #10528
• Persistent Linux-local Ollama probe timeouts now suggest applicable stale-runner recovery. The change preserves @deepujain's original contribution in #10704. #11192
• Inference status distinguishes configured models from live routes and requires verified llama.cpp route ownership. Compatible custom providers can expose a reusable endpoint when stored metadata is safe and complete. #10471, #10261, #11207, #10833
• GPU onboarding recovers failed handoff checkpoints. Managed vLLM stops retrying a rejected pinned image, and Gemini HTTP 400 errors provide provider-specific guidance. #11124, #11048, #11171
• The installer can select a qualified alternate gateway port when the systemd user manager is unavailable. This replays @HOYALIM's original contribution in #10936, preserving collision and ownership checks. #11217
• macOS gateway discovery recognizes Homebrew 6 labels, and readiness avoids repeated Homebrew trust operations. #11121, #11125

Dependency and Release Maintenance

• Agent manifest parsing requires patched js-yaml 4.3.2 and rejects oversized empty-merge sequences. #11264
• Image publication responds to root dependency changes and respects same-run provenance during reruns. #11273, #10450
• Reviewed OpenShell 0.0.116 replacement identities and templates prepare the trust transition without activating the runtime cutover. #11253
• Command docs clarify MCP protocol failures and mutually exclusive doctor --json and --text flags. #11183, #11243

Thank You

Thank you to @VishnuR23 for clarifying managed snapshot restore behavior, @deepujain for Ollama recovery and deterministic readiness coverage, @HOYALIM for the original alternate-port installer contribution, and @harjothkhara for the original delayed-startup recovery contribution.