Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/inference/model-prompts.ts`:
- Around line 194-225: The prompt currently maps Enter to "Other..." when the
saved default model is outside the visibleOptions, because defaultChoice
math/regression causes the parsed index to fall through to manual entry; fix by,
after computing index (the parsed choice), add an early branch that if index ===
defaultIndex then return defaultModel (before the visibleOptions bounds checks
and the "Other..." branch). Update the code paths around deps.promptFn parsing
(the index variable) and the subsequent conditional sequence so
promptFullRemoteModelList/promptManualModelId are only reached when the user
explicitly selected those, while Enter (or a number equal to defaultIndex+1)
returns defaultModel.

In `@src/lib/oauth-device-code.ts`:
- Around line 7-10: Update the module header in oauth-device-code.ts to correct
the persistence contract: state explicitly that Hermes OAuth/API-key material
MUST NOT be durably persisted to host-side NemoClaw storage (e.g., ~/.nemoclaw);
instead describe that onboarding mints short-lived agent keys for the OpenShell
inference provider from ephemeral tokens and that the sandbox only ever receives
the OpenShell inference placeholder (never raw Hermes/Nous OAuth tokens or API
keys). Ensure the header replaces the current wording that implies refresh
tokens are stored under ~/.nemoclaw with the new invariant forbidding durable
host persistence.
- Around line 125-137: postForm currently calls fetchImpl without an AbortSignal
so long-running sockets can hang; implement a reusable timeout helper that
returns an AbortController/AbortSignal (e.g., createRequestTimeout(timeoutMs):
{signal, clear}) and use it in postForm to pass signal into fetchImpl and clear
the timeout after completion, and also update mintAgentKeyWithAccessToken to use
the same helper so token polling/refresh requests are bounded by timeoutSeconds;
reference postForm and mintAgentKeyWithAccessToken when applying the change and
ensure existing fetch headers/behavior are preserved and the timeout is cleaned
up on success or error.

In `@src/lib/onboard.ts`:
- Around line 6646-6653: The hermesAuthMethod variable can retain stale Hermes
data when the user backs out to pick another provider; when handling the Hermes
branch (the selected.key === "hermesProvider" block) and the user chooses
BACK_TO_SELECTION (before continue selectionLoop), explicitly reset
hermesAuthMethod (e.g., set to undefined or null) so it cannot leak into
non-Hermes selections, and likewise ensure any code path that switches away from
Hermes clears hermesAuthMethod to avoid returning Hermes metadata for
OpenAI/Ollama selections.
- Around line 1532-1557: When running non-interactively, promptHermesAuthMethod
currently defaults to OAuth even if a Nous API key is present; change
promptHermesAuthMethod so that if getRequestedHermesAuthMethod() returns null
but an API key env var is exported (e.g. process.env.NOUS_API_KEY or
process.env.NEMOCLAW_PROVIDER_KEY), the default method becomes
HERMES_AUTH_METHOD_API_KEY instead of HERMES_AUTH_METHOD_OAUTH; update the
non-interactive branch to choose method = requested || (apiKeyPresent ?
HERMES_AUTH_METHOD_API_KEY : HERMES_AUTH_METHOD_OAUTH) and keep the note(...)
call using hermesAuthMethodLabel(method).

In `@test/hermes-provider-foundation.test.ts`:
- Around line 44-48: The spawnSync invocations in the test (the call using
spawnSync(process.execPath, [scriptPath], { cwd: repoRoot, encoding: "utf-8",
env: buildHermeticEnv(tmpDir) })) can hang; add a bounded timeout option to
their options object (e.g., timeout: 30000) so the child is killed after a
reasonable period and the test fails deterministically; apply the same change to
the other spawnSync usages in this file (the other result = spawnSync(...)
occurrences) ensuring the timeout value is included in each options literal (and
optionally set killSignal or cwd/encoding/env unchanged).
- Around line 10-17: The helper buildHermeticEnv currently only strips DISCORD_*
and TELEGRAM_* but still inherits ambient NEMOCLAW_* and other credential/config
vars that make tests flaky; update buildHermeticEnv to remove any env keys
matching NEMOCLAW_* plus common credential/config prefixes (e.g. NEMOCLAW_,
AWS_, GCP_, GOOGLE_, GCLOUD_, AZURE_, and keys ending with _CREDENTIALS or
containing "SECRET" or "TOKEN") by iterating Object.keys(env) and deleting keys
that match those patterns so the spawned helper runs with a fully hermetic
environment.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/agent/defs.ts`:
- Around line 262-270: readInference currently tolerates malformed manifest
fields and silently returns undefined/filtered arrays; change it to fail fast by
validating the shape of the "inference" object and throwing a descriptive Error
when fields are wrong. Specifically, inside readInference (which uses
readObject/readString/readStringArray), check that provider_type is a string and
provider_options is an array of strings; if either check fails throw an Error
referencing the ManifestRecord (or record.id if available) and the offending key
(provider_type or provider_options) so callers can detect bad manifests
immediately. Ensure AgentInference is only returned when both validations pass.

In `@src/lib/onboard.ts`:
- Around line 6699-6710: The call to nousModels.getHermesProviderModelOptions()
can reject and currently aborts onboarding; wrap that call in a try/catch, log
or surface a non-fatal warning, and on failure set hermesProviderModels to a
safe fallback (e.g., undefined or an empty array) so
promptRemoteModel(remoteConfig.label, selected.key, defaultModel, null, {
otherShowsFullList: true, remoteModelOptions: { [selected.key]:
hermesProviderModels }, topLevelModelLimit: 10 }) still runs and falls back to
the documented full/custom model behavior; ensure the catch does not rethrow and
that promptRemoteModel receives a well-formed remoteModelOptions (omit the key
or pass an empty list) so the existing fallback paths remain available.
- Around line 7480-7538: The code only calls
ensureHermesProviderApiKeyCredentials/ensureHermesProviderOAuthCredentials when
isHermesProviderRegistered(...) is false, which leaves existing Hermes
registrations stale when the auth method or NOUS_API_KEY changes; update the
logic so credential reconciliation always runs (or runs when the
resolvedHermesAuthMethod or credentialEnv differs) by invoking
ensureHermesProviderApiKeyCredentials or ensureHermesProviderOAuthCredentials
regardless of isHermesProviderRegistered, using resolvedHermesAuthMethod,
resolveHermesNousApiKey, and runOpenshell to refresh credentials; keep the
existing error handling (hermesAuthMethodLabel, process.exit, retry) and only
skip re-applying the provider registration when you can detect no change.

In `@test/onboard.test.ts`:
- Around line 2793-2827: The test currently deletes process.env.NOUS_API_KEY and
process.env.OPENAI_API_KEY which makes the "not forwarded" assertion weak;
instead seed sentinel values (e.g., process.env.NOUS_API_KEY = "SENTINEL_NOUS"
and process.env.OPENAI_API_KEY = "SENTINEL_OPENAI") before requiring/setuping
the script that calls setupInference, then update the assertions that inspect
the captured commands (via parseStdoutJson, CommandEntry and the commands array)
to assert that none of the command.env values or command.command/argv strings
contain those sentinel tokens (and still assert no provider create/update
occurred and expected commands exist). This ensures secrets were present in the
environment but never forwarded to child commands.

---

Nitpick comments:
In `@src/lib/agent/defs.ts`:
- Around line 88-89: The AgentDefinition interface currently declares readonly
inferenceProviderOptions?: string[] but the accessor always returns an array, so
change the type to readonly inferenceProviderOptions: string[] to tighten the
contract; update any constructors/defaults or places that create AgentDefinition
instances (e.g., the factory or new AgentDefinition(...) calls and any object
literals) to provide an empty array when none are specified, and remove
redundant undefined checks where callers use inferenceProviderOptions, ensuring
code paths that assumed undefined now treat it as an empty array.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/lib/inference/config.ts`:
- Line 47: DEFAULT_HERMES_PROVIDER_MODEL is set from
HERMES_PROVIDER_MODEL_OPTIONS[0], which couples the default to array order;
change it to an explicit, named default value instead (e.g., the intended model
string or an exported constant) rather than indexing the array. Replace the
assignment to DEFAULT_HERMES_PROVIDER_MODEL so it references the explicit model
identifier you want as the default (or uses a find by model name on
HERMES_PROVIDER_MODEL_OPTIONS if you must derive it), and keep the symbol names
DEFAULT_HERMES_PROVIDER_MODEL and HERMES_PROVIDER_MODEL_OPTIONS to locate/verify
the change.