## Summary
- Restore affected macOS OpenShell VM sandboxes by treating the VM
driver as a separate compatibility path from Docker/Kubernetes.
- Patch the macOS VM sandbox rootfs DNS to the gvproxy resolver
(`192.168.127.1`) so `inference.local` resolves from inside VM
sandboxes.
- Skip legacy Kubernetes/Docker DNS-proxy repair only for VM sandboxes
and fall back to OpenShell route reapply when appropriate.
- Gate VM sandbox-create early detach on NemoClaw startup output so
`Ready` alone cannot advance onboarding before the sandbox startup
command is actually running.
- Fix downstream Hermes/Discord issues exposed by the VM path:
locked-aware non-root Hermes config verification, guild-only Discord
authorization, regional `*.discord.gg` websocket policy, and stricter
Slack provider reuse checks.

## Direction / Scope Guardrail
This PR is **not** the strategic macOS driver direction. It is a narrow
compatibility bridge for already-created or explicitly selected
OpenShell VM sandboxes while NemoClaw is pinned to the OpenShell
behavior that exposed this regression.

Normal macOS onboarding should move back to Docker/Colima in #3454
(`fix(onboard): use Docker driver on macOS`). This PR should not default
`OPENSHELL_DRIVERS=vm`, should not add installer requirements for VM
helper assets, and should not make VM the preferred macOS runtime.

OpenShell #1375 has merged upstream and keeps VM driver selection
opt-in. Once NemoClaw can consume that OpenShell release path, the
durable direction is to rely on Docker/Colima for normal macOS
onboarding and keep this VM shim only for explicit/legacy VM cases until
it can be removed.

## Root Cause
Earlier PR text blamed `#3441`. That was too narrow and is not accurate
for the final fix. The reverted Docker bridge reachability probe was one
visible blocker, but it was not the underlying `inference.local`
failure, and that bridge-probe code is no longer part of this PR's final
diff.

The affected failure chain is a macOS VM-driver mismatch:

- Ubuntu uses the Docker/Kubernetes sandbox path, where NemoClaw's
legacy DNS proxy and bridge assumptions apply.
- The affected macOS flow used OpenShell's VM driver, where sandbox
networking is backed by the VM/gvproxy path rather than a
Docker/Kubernetes gateway container.
- The VM rootfs could end up with public DNS fallback resolvers
(`8.8.8.8` / `8.8.4.4`). Those can resolve public hostnames, but they
cannot resolve OpenShell/NemoClaw synthetic hostnames such as
`inference.local`.
- When `inference.local` failed, NemoClaw tried the legacy DNS repair
path, which produced misleading gateway-container warnings instead of
repairing VM DNS.
- Separately, the VM driver can report the sandbox `Ready` before
NemoClaw startup output appears. On macOS that allowed onboarding to
detach before dashboard/Hermes/OpenClaw startup was actually observable.

The Discord failures were downstream runtime issues exposed after the VM
sandbox got far enough to run. Discord may use regional websocket hosts
such as `gateway-us-east1-d.discord.gg`, and Hermes guild-only
configuration without explicit user IDs must permit guild members
instead of rejecting every Discord user as unauthorized.

## Tradeoff / Follow-up
The DNS portion of this PR is intentionally a narrow emergency
compatibility shim, not the ideal long-term owner boundary. It is Darwin
+ OpenShell VM-driver gated, best-effort, and disableable with
`NEMOCLAW_DISABLE_VM_DNS_MONKEYPATCH=1`, but it still depends on today's
OpenShell VM rootfs layout, init-script shape, and gvproxy resolver IP
(`192.168.127.1`). That is acceptable only as a compatibility bridge for
explicit/legacy VM sandboxes.

Durable follow-up is split by owner:

- NemoClaw: #3454 restores normal macOS onboarding to Docker/Colima.
- OpenShell: #1375 makes VM opt-in upstream; VM resolver setup should
ultimately be OpenShell-owned rather than a NemoClaw rootfs patch.
- Future OpenShell VM layouts, including ext4-style root disks, should
be diagnosed clearly by NemoClaw but not mounted or rewritten from
NemoClaw.

## Regression Risk
- macOS VM path: intentional behavior change. The VM DNS patch is gated
to `openshellDriver === "vm"` on Darwin, is best-effort, and can be
disabled with `NEMOCLAW_DISABLE_VM_DNS_MONKEYPATCH=1`.
- Normal macOS Docker path: intentionally out of scope here and owned by
#3454. This PR should not default macOS to VM.
- Linux/Docker path: low risk. The VM DNS patch does not run for Docker
sandboxes, and legacy DNS proxy repair remains available for non-VM
drivers.
- Discord policy: low risk. The change adds websocket-specific
`*.discord.gg` handling with credential rewrite; it does not broadly
open Discord REST beyond the existing Discord policy surface.
- Messaging reuse: lower risk than before. Slack reuse now requires both
`-slack-bridge` and `-slack-app`, avoiding partial provider reuse.

## Validation
- `npm run build:cli`
- `git diff --check`
- `npx vitest run src/lib/actions/sandbox/vm-dns-monkeypatch.test.ts
test/sandbox-connect-inference.test.ts test/onboard.test.ts
--fileParallelism=false`
- Focused suite result on current head: 262 tests passed.
- Manual macOS VM validation during debugging:
`https://inference.local/v1/models` and chat completions returned 200
from inside the VM sandbox after the DNS patch.
- Manual Discord validation during debugging: Hermes Discord responded
after the regional gateway websocket policy was applied.
- Current full nightly dispatch:
https://github.com/NVIDIA/NemoClaw/actions/runs/25861533504

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Non-interactive onboarding can reuse stored messaging channels to
speed setup
* Added WebSocket support for Discord gateways with credential rewrite
handling
* Create-stream option to require startup output before considering
sandboxes "ready"

* **Bug Fixes**
* Improved VM/macOS DNS setup and repair paths; refined sandbox driver
selection
  * More robust inference-route repair behavior for sandboxes

* **Tests**
* Expanded tests for messaging reuse, VM DNS patching, sandbox
creation/connect, and policy validation

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/NVIDIA/NemoClaw/pull/3445)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Co-authored-by: Carlos Villela <cvillela@nvidia.com>

## Summary
Refreshes the NemoClaw documentation for the local `main` changes
included in the 0.0.42 release. The update adds release notes, updates
the affected user-facing setup and troubleshooting pages, bumps docs
metadata to 0.0.42, and regenerates the matching user skills.

## Changes
- #3537 -> `docs/reference/commands.md`,
`docs/reference/troubleshooting.md`: Documented host-level status
fields, cloudflared state-specific recovery hints, and Local Ollama auth
proxy status diagnostics.
- #3454 -> `docs/get-started/prerequisites.md`,
`docs/get-started/quickstart.md`: Documented macOS Docker-driver
onboarding and removed the expectation that standard macOS setup needs a
VM driver helper.
- #3514 -> `docs/inference/use-local-inference.md`: Documented
compatible-endpoint retry behavior for reasoning-only smoke responses.
- #3448 -> `docs/reference/commands.md`,
`docs/manage-sandboxes/messaging-channels.md`: Documented canonical
channel names and policy preset hints after `channels add`.
- #3520 -> `docs/about/release-notes.md`: Captured clearer GPU recovery
and uninstall wording in the 0.0.42 release notes.
- #3313 -> `docs/get-started/quickstart.md`,
`docs/reference/troubleshooting.md`: Documented stronger dashboard port
detection and rollback when a forward cannot start.
- #3502 -> `docs/about/release-notes.md`: Captured batched onboarding
policy preset application in the 0.0.42 release notes.
- #3505 -> `docs/reference/troubleshooting.md`: Documented the top-level
Colima socket path.
- #3421 -> `docs/about/release-notes.md`: Captured idempotent installer
shim logging in the 0.0.42 release notes.
- Updated `docs/project.json`, `docs/versions1.json`, and regenerated
`.agents/skills/nemoclaw-user-*` outputs.

## Type of Change
- [ ] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [x] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Verification
- [ ] `npx prek run --all-files` passes
- [ ] `npm test` passes
- [ ] Tests added or updated for new or changed behavior
- [x] No secrets, API keys, or credentials committed
- [x] Docs updated for user-facing behavior changes
- [x] `make docs` builds without warnings (doc changes only)
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Release Notes - v0.0.42

* **Documentation**
  * Enhanced macOS onboarding guidance for Docker gateway setup
  * Improved dashboard port conflict handling with automatic rollback
* Better local Ollama inference diagnostics and authentication proxy
checks
  * Clarified status command output and recovery procedures
  * Refined messaging channel setup documentation

* **Chores**
  * Version bump to 0.0.42

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/NVIDIA/NemoClaw/pull/3540)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Carlos Villela <cvillela@nvidia.com>

…3728) (#4221)

## Summary

Fixes #3728. On macOS arm64 (and any other host where the Docker-driver
gateway path is enabled), `getSandboxRuntimeRegistryFields` recorded
`openshellDriver: "vm"` based purely on `process.platform === "darwin"`.
That mismatched the runtime — OpenShell's Docker-driver gateway always
starts with `OPENSHELL_DRIVERS=docker` (#3454) — and downstream code
keyed
off `openshellDriver === "vm"` to run the VM-only DNS monkeypatch and
emit
the misleading VM-driver warnings reported in the issue.

This change records `"docker"` on every Docker-driver host. The VM-only
log/warning paths are gated on `openshellDriver === "vm"`, so they now
stay silent for macOS Docker-driver sandboxes. Legacy/opt-in sandboxes
that were already written to disk with `openshellDriver: "vm"` still
trigger the existing VM-only compatibility shim.

## Changes

- `src/lib/onboard/sandbox-registry-metadata.ts` — drop the
  `process.platform === "darwin" ? "vm" : "docker"` branch; record
  `"docker"` whenever `isLinuxDockerDriverGatewayEnabled()` is true.
- `src/lib/onboard/sandbox-registry-metadata.test.ts` (new) — unit tests
  asserting macOS Docker-driver → `"docker"`, Linux Docker-driver →
  `"docker"`, and legacy Linux → `"kubernetes"`.
- `src/lib/onboard/vm-dns-monkeypatch.test.ts` — regression test that
  exercises the real `applyOpenShellVmDnsMonkeypatch` with
  `openshellDriver: "docker"` on a mocked darwin platform and verifies
  the onboard wrapper emits no logs or warnings.

## Test plan

- [x] `npm run typecheck:cli`
- [x] `npm run build:cli`
- [x] `npx vitest run src/lib/onboard/sandbox-registry-metadata.test.ts
src/lib/onboard/vm-dns-monkeypatch.test.ts
src/lib/actions/sandbox/vm-dns-monkeypatch.test.ts` — 18/18 pass
- [x] `cd nemoclaw && npm run build && npm test` — 457/457 pass
- [x] `npx @biomejs/biome check` clean on touched files
- [x] Linux host can't reproduce the macOS-specific behavior directly,
so
      the regression is covered by mocking `process.platform` (allowed
      by the issue brief).

Signed-off-by: Yimo Jiang <yimoj@nvidia.com>

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved Docker and Kubernetes driver selection for sandbox runtime
configuration.
  * Fixed DNS monkeypatch handling on macOS Docker-driver sandboxes.
* Corrected platform-specific driver assignment logic for Linux and
macOS environments.

* **Tests**
* Added comprehensive test coverage for driver selection across
different platforms and configurations.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/NVIDIA/NemoClaw/pull/4221?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Yimo Jiang <yimoj@nvidia.com>
Co-authored-by: Carlos Villela <cvillela@nvidia.com>