Description

Description

When NemoClaw is deployed on a remote host (verified on Brev Ubuntu instance), the dashboard port forward (18789) is hard-bound to 127.0.0.1:18789. There is no environment variable, CLI flag, or config option to make it bind 0.0.0.0:18789 so other machines on the same network can reach the UI directly. Workarounds (socat, manual SSH -L tunnels) all hit secondary failures: the web GUI rejects with "origin not allowed" or "device identity required" because the dashboard was not designed for cross-host access. OpenShell gateway 8080 was previously fixed to bind 0.0.0.0 (visible in `docker ps`: 0.0.0.0:8080->30051/tcp). The same fix should be mirrored to the dashboard 18789 forward — currently this remains a gap reported by VDR.

Device A (verifier 1): MacBook (Apple M4)
Device B (verifier 2): Brev Ubuntu instance nemoclaw-0508 (hyperstack H100)
OS A:                  macOS 26.1 (Darwin 25.1.0, arm64)
OS B:                  Ubuntu (brev-pz811qnfg)
Architecture A:        arm64
Architecture B:        x86_64
Node.js:               v23.10.0 (Mac)
npm:                   11.3.0 (Mac)
Docker:                27.4.0 (build bde2b89, via colima on Mac)
OpenShell CLI:         0.0.36
NemoClaw:              v0.0.36
OpenClaw:              2026.4.24 (cbcfdf6)

1. On any host running NemoClaw with at least one onboarded sandbox, run:
   lsof -i :18789
2. Observe: the SSH-based forward listens on localhost:18789 (i.e. 127.0.0.1) — never *:18789 (0.0.0.0).
3. From a different machine on the same network, try to reach:
   http://:18789/
4. Connection refused — port is not exposed externally.
5. Search nemoclaw onboard --help, env vars (NEMOCLAW_DASHBOARD_*), and openshell forward command for any way to bind 0.0.0.0.
6. None exists.

- Provide an environment variable (e.g. NEMOCLAW_DASHBOARD_BIND=0.0.0.0) or CLI flag to bind dashboard 18789 to 0.0.0.0, mirroring the OpenShell gateway 8080 fix
- Web UI auth flow accepts connections from non-localhost origins when the remote bind is opted-in
- Remove the need for socat / manual SSH-tunnel workaround for SSH-deployed remote hosts

Mac (lsof -i :18789):
  COMMAND  PID  USER   FD  TYPE  DEVICE  SIZE/OFF  NODE  NAME
  ssh      7657 lynnh  3u  IPv4  ...      0t0      TCP   localhost:18789 (LISTEN)

Brev (lsof -i :18789):
  COMMAND  PID    USER       FD  TYPE  DEVICE  SIZE/OFF  NODE  NAME
  ssh      116385 shadeform  3u  IPv4  268141  0t0       TCP   localhost:18789 (LISTEN)

- Both hosts: dashboard tunnel binds localhost:18789 only — never 0.0.0.0:18789
- No NEMOCLAW_DASHBOARD_BIND or equivalent CLI flag / env var found
- Web GUI rejects external origin attempts with "origin not allowed" / "device identity required" (see related fixed bugs 6018684 / 6013831)

Mac:
  $ lsof -i :18789
  COMMAND  PID  USER   FD  TYPE  DEVICE  SIZE/OFF  NODE  NAME
  ssh      7657 lynnh  3u  IPv4  0x74547526df1beb77  0t0  TCP  localhost:18789 (LISTEN)

Brev:
  $ ssh nemoclaw-0508 'lsof -i :18789'
  COMMAND  PID     USER       FD  TYPE  DEVICE  SIZE/OFF  NODE  NAME
  ssh      116385  shadeform  3u  IPv4  268141  0t0       TCP   localhost:18789 (LISTEN)

Source: VDR — partial-fix gap; gateway side already binds 0.0.0.0 but dashboard left out
Related fixed bugs: 6018684 (#20 device identity), 6013831 (#795 origin not allowed), 6082047 (#1925 NEMOCLAW_DASHBOARD_PORT SSH tunnel)

Bug Details

[NVB#6158476]