Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@agents/hermes/generate-config.ts`:
- Around line 199-205: The registry discovery in findRegistryRoot currently only
checks process.cwd() and misses the bundled manifests when the caller's working
directory differs; update findRegistryRoot to also check a path relative to this
file (use __dirname) — e.g., include join(__dirname, "..", "..",
"nemoclaw-blueprint", "model-specific-setup") or an appropriate __dirname-based
relative path in the roots array so the bundled manifests are discovered
regardless of caller cwd; keep the existing environment and image-root checks
and the filter logic intact.

In `@nemoclaw-blueprint/model-specific-setup/schema.json`:
- Line 1: schema.json is missing the required SPDX header for JSON sources; add
the repository's JSON-compatible SPDX metadata as the first property in the file
(e.g., a top-level "spdx" or "SPDX-License-Identifier" string field following
the project's SPDX pattern) so the file complies with the license-header rule,
or explicitly add this path to the license-header rule's exemptions if
intentional; update schema.json accordingly and ensure the header key/name
matches the project's existing JSON SPDX convention used elsewhere.

In `@scripts/generate-openclaw-config.py`:
- Around line 305-311: The loop over model_specific_setups silently merges
effects["openclawCompat"] into inference_compat and appends
effects["openclawPlugins"] into openclaw_plugins; change it to fail fast on
conflicting non-additive changes by checking collisions before mutating: when
merging openclawCompat, for each key in effects.get("openclawCompat", {}), if
the key already exists in inference_compat and the value differs, raise an error
(include manifest id and key); when handling effects.get("openclawPlugins", []),
ensure plugin uniqueness by checking plugin id (or filename) against existing
entries in openclaw_plugins and raise on duplicates instead of silently
appending; only allow merges that are purely additive (new keys/plugins) and
abort on conflicts.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nemoclaw-blueprint/model-specific-setup/schema.json`:
- Around line 14-16: The schema currently allows any "effects" regardless of
"agent", so update the JSON Schema to make "effects" conditional on the "agent"
value using an if/then (or dependentSchemas) guard: add an "if": {"properties":
{"agent": {"const":"openclaw"}}} with a corresponding "then" that
defines/permits only the "effects" shape valid for openclaw (and similarly an
"if" for "hermes" with its own "effects" structure/required properties such as
"hermesCompat"), or alternatively use "oneOf" with two full schemas each locking
"agent" to a single const and the matching "effects"; target the existing
"agent" and "effects" keys in the manifest schema so editor/CI validation
rejects cross-agent combinations.

In `@scripts/generate-openclaw-config.py`:
- Around line 176-202: The validator currently ensures
effects.openclawPlugins[*].path exists but does not verify
effects.openclawPlugins[*].loadPath, so typos will pass validation; update the
loop that iterates plugins (the block using plugins, plugin, index, source_path
and registry_root) to perform the same checks on plugin["loadPath"] as you do
for plugin["path"]: ensure loadPath is a non-empty string, not absolute, does
not contain ".." in its Path.parts, and that (registry_root.parent /
loadPath).exists() (or otherwise maps to the staged plugin location you expect);
raise a ValueError with the same style and
manifest_path/effects.openclawPlugins[{index}].loadPath context when any check
fails.

In `@src/lib/onboard-providers.ts`:
- Around line 312-316: The getSandboxInferenceConfig function still injects Kimi
compatibility keys; remove that Kimi special-case logic so this route no longer
mutates or injects compat keys itself and instead relies solely on the manifest
registry as the single source of truth (i.e., delete the branch/assignments that
add Kimi-specific keys based on provider/model/preferredInferenceApi and ensure
the function returns only values derived from the manifest/registry lookup or
passed parameters). Update any local references in getSandboxInferenceConfig
that expect those injected keys so they read from the manifest registry or the
existing SandboxInferenceConfig fields instead (keep function signature the
same: getSandboxInferenceConfig(model, provider, preferredInferenceApi) and
remove Kimi-specific mutations).

In `@test/generate-hermes-config.test.ts`:
- Around line 228-274: The test mutates the checked-in registry by writing a
broken manifest into registryDir; instead, create an isolated copy of the
script-relative registry before writing the invalid manifest and point the test
at that copy: copy the directory referenced by registryDir into a temp
subdirectory (e.g., under tmpDir), compute manifestPath inside the copied tree,
write the manifest there, then call runConfigScriptRaw with cwd/tmp path that
references the copied registry; ensure cleanup removes the copied registry and
manifest in the finally block. Use the existing registryDir, manifestPath and
runConfigScriptRaw identifiers to locate where to change behavior.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nemoclaw-blueprint/model-specific-setup/schema.json`:
- Around line 26-52: The current "match" object schema allows an empty object
(so { "match": {} } is valid); update the "match" schema to forbid empties by
adding a constraint such as "minProperties": 1 (or an equivalent anyOf/oneOf
that requires at least one of the properties). Locate the "match" object in
schema.json (the object with properties "modelIds", "providerKey",
"inferenceApi", "baseUrl") and add the "minProperties": 1 constraint so a
manifest must specify at least one matching key.

In `@scripts/generate-openclaw-config.py`:
- Around line 83-111: The code currently ignores an invalid
NEMOCLAW_MODEL_SPECIFIC_SETUP_DIR and falls back to defaults; update
_registry_roots/_find_registry_root so that when env contains
NEMOCLAW_MODEL_SPECIFIC_SETUP_DIR you validate Path(explicit).is_dir()
immediately and do not silently continue: if the explicit path exists and is a
directory, use it; if it exists but is not a directory or does not exist, raise
a ValueError (or RuntimeError) with a clear message mentioning
NEMOCLAW_MODEL_SPECIFIC_SETUP_DIR and the bad path so operators are alerted;
keep the rest of the roots logic unchanged for the non-explicit case.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nemoclaw-blueprint/model-specific-setup/schema.json`:
- Around line 22-24: The schema's string fields like "description" currently
only use "minLength": 1 which allows whitespace-only values; update those
properties (e.g., the "description" property and the other string fields noted
in ranges 31-50 and 74-80) to include a non-whitespace pattern such as requiring
at least one non-space character (pattern: ".*\\S.*" or equivalent) so the JSON
Schema rejects whitespace-only strings and stays consistent with the generators
and runtime validation.

---

Nitpick comments:
In `@scripts/generate-openclaw-config.py`:
- Around line 203-219: Restrict validation so effects.openclawPlugins[*].path
must be inside the azul subtree "openclaw-plugins/": after making source_path =
Path(plugin["path"]) and rejecting absolute paths or any .. parts, normalize it
(e.g. source_path = source_path.relative_to(source_path.anchor) or
source_path.resolve() against registry_root.parent) and ensure its first path
component equals "openclaw-plugins" (reject otherwise), and then check existence
under registry_root.parent / source_path; finally derive expected_load_path from
that normalized path (e.g. "/usr/local/share/nemoclaw/openclaw-plugins/..."
built from source_path.without leading slashes) and validate
plugin["loadPath"].rstrip("/") against that value (use manifest_path, index,
plugin variables for error messages).

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@nemoclaw-blueprint/model-specific-setup/schema.json`:
- Around line 69-88: The openclawPlugins schema currently allows arbitrary
non-whitespace strings for the "path" and "loadPath" properties; tighten these
to only permit safe relative paths under the OpenClaw staging tree by
disallowing leading slashes (absolute paths) and any ".." path segments and
restricting segment characters to a safe subset (alphanumerics, dot, underscore,
hyphen and forward slash). Update the "path" and "loadPath" property schemas in
the openclawPlugins item to use a pattern that rejects leading "/" and any ".."
segment (and optionally enforces a non-empty segment pattern), and add unit
tests that assert invalidation for examples like "/etc/passwd", "../secrets",
"subdir/../escape", and valid acceptance for "pluginA/main.js" and
"dir/sub_dir/plugin.so".

---

Nitpick comments:
In `@test/validate-config-schemas.test.ts`:
- Around line 294-301: Replace the single hard-coded Kimi fixture-based test in
the "model-specific-setup/schema.json" suite with a loop that enumerates all
committed JSON files under the glob
"nemoclaw-blueprint/model-specific-setup/**/*.json"; for each file, load it with
loadJSON, compile the schema with
compileSchema("nemoclaw-blueprint/model-specific-setup/schema.json") (or reuse
validate), and run the existing assertions (expectValid/expectInvalid) per-file;
additionally assert that path.dirname(file) === agent (i.e., the parent
directory name equals the agent string parsed from the file path) to enforce the
one-agent-per-manifest rule, and if no Hermes manifest is present include/keep a
minimal positive Hermes fixture so the Hermes rejection test still has a
baseline.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@nemoclaw-blueprint/model-specific-setup/schema.json`:
- Around line 80-88: The regex for the "path" and "loadPath" patterns currently
applies the traversal negative lookahead after the fixed prefix, allowing "../"
as the first segment; update both patterns in schema.json so the
(?!.*(?:^|/)\\.\\.(?:/|$)) negative lookahead appears at the very start of the
whole pattern (before the fixed "openclaw-plugins" or
"/usr/local/share/nemoclaw/openclaw-plugins/" prefix) to reject any leading ".."
segment, and add the two samples "openclaw-plugins/../escape" and
"/usr/local/share/nemoclaw/openclaw-plugins/../escape" to the negative test
matrix mentioned in the review so they return false.