Description
Description
docs/reference/commands.md (rendered at
https://docs.nvidia.com/nemoclaw/latest/reference/commands.html) is the
"CLI Commands Reference" page, but on NemoClaw v0.0.44 it has three drift
defects against the real CLI:
(a) `nemoclaw shields up`, ` shields down`, and
` shields status` are completely missing from commands.md, even
though all three subcommands are implemented, fully working, and
explicitly recommended in the bottom of `nemoclaw --help`
("Run `nemoclaw shields up` to lock config for sensitive
workloads.").
They are documented in detail in
docs/manage-sandboxes/runtime-controls.md, but a user reading the
"CLI Commands Reference" sees no mention of them at all.
(b) `nemoclaw config get` (the sanitized agent-config reader) is
also missing from commands.md, even though it is a real subcommand
and is the documented way to inspect a sandbox's sanitized config.
(c) commands.md line 159 tells the user to "re-enable web search with
`nemoclaw config web-search`" — but this command does NOT exist on
v0.0.44. Both `nemoclaw config web-search` and `nemoclaw config
web-search` return "Unknown command: config" / fall back to the
`config get` usage line. The instruction is dead.
The valid ``-level actions enumerated by the CLI itself
(`nemoclaw help` error output) are:
connect, status, doctor, logs, policy-add, policy-remove, policy-list,
hosts-add, hosts-list, hosts-remove, skill, snapshot, share, rebuild,
recover, shields, config, channels, gateway-token, destroy
Of these, every action is documented in commands.md EXCEPT `shields` and
`config`. All other documented sections cross-check correctly against
`--help` output (verified sample: policy-add, destroy, inference set, debug,
gc).
Environment
Device: ipp2-1558 (10.176.178.100), x86_64 server, 32 vCPU / 125 GB RAM, NVIDIA A100 80GB PCIe
OS: Ubuntu 24.04.4 LTS (Linux 6.17.0-23-generic)
Architecture: x86_64
Node.js: v22.x (installed via nvm by NemoClaw installer)
npm: bundled
Docker: 29.5.0
OpenShell CLI: 0.0.39
NemoClaw: v0.0.44
OpenClaw: N/A (docs-only bug; sandbox was onboarded with --agent hermes for unrelated verification)
Steps to Reproduce
1. Open https://docs.nvidia.com/nemoclaw/latest/reference/commands.html and
scroll through every "### nemoclaw ..." heading.
2. Confirm there is no section for `shields up`, `shields down`,
`shields status`, or `config get`:
curl -s https://docs.nvidia.com/nemoclaw/latest/reference/commands.html \
| grep -oE 'h3[^>]*>[^ shields status
nemoclaw shields up
nemoclaw shields down
nemoclaw config get
nemoclaw config get --key model --format yaml
4. Confirm the ``-level action list mentions both:
nemoclaw help # prints valid actions list
5. Try to run the command referenced in commands.md line 159:
nemoclaw config web-search
nemoclaw config web-search
Expected Result
(a) commands.md contains a "### nemoclaw shields up", "### nemoclaw
shields down", "### nemoclaw shields status" subsection
OR a single "### nemoclaw shields" subsection with the same
cross-link to manage-sandboxes/runtime-controls.html that other commands
use when their full discussion lives elsewhere.
(b) commands.md contains a "### nemoclaw config get" subsection
(with the `--key` and `--format` flags).
(c) Every command name typed in commands.md prose resolves to a real CLI
command. The reference at line 159 either names the actual command
that re-enables Brave web search after a credentials fix, or is
rewritten to point to `nemoclaw policy-add brave` /
re-running `nemoclaw onboard`, whichever is currently correct.
Actual Result
Step 2 (doc grep): zero hits — commands.md has no shields section, no
config section.
Step 3 (real CLI on v0.0.44):
$ nemoclaw test shields status
Shields: NOT CONFIGURED (default mutable state)
Config is mutable. Run `nemoclaw shields up` to opt into lockdown.
$ nemoclaw test config get
(Usage banner with --key, --format flags — works.)
Step 4 (valid actions list):
Valid actions: connect, status, doctor, logs, policy-add, policy-remove,
policy-list, hosts-add, hosts-list, hosts-remove, skill, snapshot, share,
rebuild, recover, shields, config, channels, gateway-token, destroy
→ `shields` and `config` are present in the live CLI but absent from the
docs.
Step 5 (broken reference at line 159):
$ nemoclaw config web-search
Unknown command: config
Run 'nemoclaw help' for usage.
$ nemoclaw test config web-search
Usage: nemoclaw test config get [--key dotpath] [--format json|yaml]
→ the command in the doc does not exist; the `config` subcommand only
supports `get`.
Logs
Not captured — documentation accuracy bug, no runtime logs.
Suggested Fix
Three edits to docs/reference/commands.md:
(a) Add a new "### `nemoclaw shields up`" / "shields down" /
"shields status" trio (or a single "### `nemoclaw shields`"
section with subheadings), following the same format as the other
`` sections. The body can be short and link to the existing
detailed coverage in manage-sandboxes/runtime-controls.html, e.g.:
### `nemoclaw shields up`
Lock the sandbox config and apply the captured restrictive policy.
See {doc}`../manage-sandboxes/runtime-controls` for the full
mutability matrix, the `shields down --timeout/--reason/--policy`
flags, and the `shields status` output format.
(b) Add a "### `nemoclaw config get`" section documenting the
`--key ` and `--format json|yaml` flags.
(c) Fix line 159. Replace
After fixing the key, re-enable web search with `nemoclaw config web-search`.
with whichever command actually re-enables Brave web search on v0.0.44
(most likely `nemoclaw policy-add brave` or a re-run of
`nemoclaw onboard`). If the intent was to expose `config web-search`
as a real subcommand and it has not yet been implemented, file a
separate CLI tracking bug and replace the line with the supported
workaround in the meantime.
Bug Details
| Field |
Value |
| Priority |
Unprioritized |
| Action |
Dev - Open - To fix |
| Disposition |
Open issue |
| Module |
Machine Learning - NemoClaw |
| Keyword |
NemoClaw, NemoClaw_Docs, NEMOCLAW_GH_SYNC_APPROVAL |
[NVB#6186610]
Description
Description
docs/reference/commands.md (rendered at https://docs.nvidia.com/nemoclaw/latest/reference/commands.html) is the "CLI Commands Reference" page, but on NemoClaw v0.0.44 it has three drift defects against the real CLI: (a) `nemoclaw shields up`, ` shields down`, and ` shields status` are completely missing from commands.md, even though all three subcommands are implemented, fully working, and explicitly recommended in the bottom of `nemoclaw --help` ("Run `nemoclaw shields up` to lock config for sensitive workloads."). They are documented in detail in docs/manage-sandboxes/runtime-controls.md, but a user reading the "CLI Commands Reference" sees no mention of them at all. (b) `nemoclaw config get` (the sanitized agent-config reader) is also missing from commands.md, even though it is a real subcommand and is the documented way to inspect a sandbox's sanitized config. (c) commands.md line 159 tells the user to "re-enable web search with `nemoclaw config web-search`" — but this command does NOT exist on v0.0.44. Both `nemoclaw config web-search` and `nemoclaw config web-search` return "Unknown command: config" / fall back to the `config get` usage line. The instruction is dead. The valid ``-level actions enumerated by the CLI itself (`nemoclaw help` error output) are: connect, status, doctor, logs, policy-add, policy-remove, policy-list, hosts-add, hosts-list, hosts-remove, skill, snapshot, share, rebuild, recover, shields, config, channels, gateway-token, destroy Of these, every action is documented in commands.md EXCEPT `shields` and `config`. All other documented sections cross-check correctly against `--help` output (verified sample: policy-add, destroy, inference set, debug, gc).Environment Steps to Reproduce1. Open https://docs.nvidia.com/nemoclaw/latest/reference/commands.html and scroll through every "### nemoclaw ..." heading. 2. Confirm there is no section for `shields up`, `shields down`, `shields status`, or `config get`: curl -s https://docs.nvidia.com/nemoclaw/latest/reference/commands.html \ | grep -oE 'h3[^>]*>[^ shields status nemoclaw shields up nemoclaw shields down nemoclaw config get nemoclaw config get --key model --format yaml 4. Confirm the ``-level action list mentions both: nemoclaw help # prints valid actions list 5. Try to run the command referenced in commands.md line 159: nemoclaw config web-search nemoclaw config web-searchExpected Result(a) commands.md contains a "### nemoclaw shields up", "### nemoclaw shields down", "### nemoclaw shields status" subsection OR a single "### nemoclaw shields" subsection with the same cross-link to manage-sandboxes/runtime-controls.html that other commands use when their full discussion lives elsewhere. (b) commands.md contains a "### nemoclaw config get" subsection (with the `--key` and `--format` flags). (c) Every command name typed in commands.md prose resolves to a real CLI command. The reference at line 159 either names the actual command that re-enables Brave web search after a credentials fix, or is rewritten to point to `nemoclaw policy-add brave` / re-running `nemoclaw onboard`, whichever is currently correct.Actual ResultStep 2 (doc grep): zero hits — commands.md has no shields section, no config section. Step 3 (real CLI on v0.0.44): $ nemoclaw test shields status Shields: NOT CONFIGURED (default mutable state) Config is mutable. Run `nemoclaw shields up` to opt into lockdown. $ nemoclaw test config get (Usage banner with --key, --format flags — works.) Step 4 (valid actions list): Valid actions: connect, status, doctor, logs, policy-add, policy-remove, policy-list, hosts-add, hosts-list, hosts-remove, skill, snapshot, share, rebuild, recover, shields, config, channels, gateway-token, destroy → `shields` and `config` are present in the live CLI but absent from the docs. Step 5 (broken reference at line 159): $ nemoclaw config web-search Unknown command: config Run 'nemoclaw help' for usage. $ nemoclaw test config web-search Usage: nemoclaw test config get [--key dotpath] [--format json|yaml] → the command in the doc does not exist; the `config` subcommand only supports `get`.Logs Suggested FixThree edits to docs/reference/commands.md: (a) Add a new "### `nemoclaw shields up`" / "shields down" / "shields status" trio (or a single "### `nemoclaw shields`" section with subheadings), following the same format as the other `` sections. The body can be short and link to the existing detailed coverage in manage-sandboxes/runtime-controls.html, e.g.: ### `nemoclaw shields up` Lock the sandbox config and apply the captured restrictive policy. See {doc}`../manage-sandboxes/runtime-controls` for the full mutability matrix, the `shields down --timeout/--reason/--policy` flags, and the `shields status` output format. (b) Add a "### `nemoclaw config get`" section documenting the `--key ` and `--format json|yaml` flags. (c) Fix line 159. Replace After fixing the key, re-enable web search with `nemoclaw config web-search`. with whichever command actually re-enables Brave web search on v0.0.44 (most likely `nemoclaw policy-add brave` or a re-run of `nemoclaw onboard`). If the intent was to expose `config web-search` as a real subcommand and it has not yet been implemented, file a separate CLI tracking bug and replace the line with the supported workaround in the meantime.Bug Details
[NVB#6186610]