Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@agents/hermes/plugin/__init__.py`:
- Around line 435-441: The handler currently treats a missing wait_timeout_ms as
0 due to using params.get("wait_timeout_ms") with _clamp_wait_timeout, causing
schema defaults to be ignored; change _handle_check_network_access to read the
raw param (e.g., params.get("wait_timeout_ms")) and if it is None explicitly set
timeout_ms = DEFAULT_ACCESS_WAIT_MS before passing through _clamp_wait_timeout,
then call _get_access_request(request_id, timeout) as before; make the analogous
fix for the other handler instance that uses the same pattern (the block around
lines where the same get/_clamp_wait_timeout usage appears) so schema-defaulted
90s is applied in code via DEFAULT_ACCESS_WAIT_MS.

In `@docs/network-policy/provider-access-requests.md`:
- Around line 1-15: The frontmatter is missing the required topics field; add a
top-level topics key to the YAML frontmatter (alongside title, description,
keywords, tags, content.type, difficulty, audience, and status) and populate it
with an array of relevant topic strings (e.g., ["provider-access",
"network-policy"] or similar) so the page passes validation and follows the
documented frontmatter schema.

In `@docs/reference/nemoclaw-openshell-integration.md`:
- Around line 192-195: Replace the CLI code fence and example to use the console
language tag and include a leading $ prompt: change the opening fence currently
using bash (the CLI example around the curl command) to ```console and prefix
the curl invocation with "$ " so the snippet shows "$ curl -x \"$HTTPS_PROXY\"
\\" followed by the same headers and URL; ensure the closing fence remains
triple backticks.
- Line 1: This doc titled "NemoClaw Provider and Resource Access Flow" is
missing required frontmatter and the SPDX license header; add YAML frontmatter
containing title, description, keywords, topics, tags, content_type, difficulty,
audience, and status at the top of the file and then add the SPDX license header
(e.g., SPDX-License-Identifier: Apache-2.0) immediately after the frontmatter;
ensure the frontmatter values reflect the document (use the existing title
string for title) and follow the project's frontmatter field names and ordering
so tooling and linting recognize the page.
- Around line 3-11: The document contains multiple sentences on the same line
(e.g., text mentioning "NemoClaw", "OpenClaw", "provider access", and "network
access") which violates the docs rule of one sentence per line; fix by reflowing
the paragraph so each sentence is on its own line—split lines like "NemoClaw
gives OpenClaw agents..." and the subsequent bullet explanations into
single-sentence lines and apply the same one-sentence-per-line pattern to the
rest of the file.

In `@nemoclaw/src/access-client.ts`:
- Around line 946-960: The current catch around the requestJson call for
"/v1/providers" swallows all errors and returns env-only providers; change it to
only perform that fallback when the failure clearly indicates the endpoint is
absent (e.g., HTTP 404 or a specific "endpoint missing" error from
requestJson/parseAttachedProvidersResponse), and rethrow or propagate any other
errors (500s, timeouts, parse failures) so real outages surface. Concretely, in
the try/catch that wraps requestJson (and uses parseAttachedProvidersResponse
and mergeAttachedProviders), inspect the caught error for an HTTP status === 404
or the library's "not found" sentinel and return the env-only result in that
case; otherwise throw the error upward.
- Around line 685-710: The socket "end" handler in requestJsonViaHttpProxy() is
passing the raw body (variable body) straight to parseResponse(), which breaks
when the proxy sent Transfer-Encoding: chunked; detect chunked encoding by
checking the parsed header string (e.g., look for a Transfer-Encoding header
containing "chunked") and, if present, decode the chunked framing into the
actual payload before calling parseResponse(). Update the logic in the
socket.on("end") block (where header, body, statusCode, and parseResponse() are
used) to perform chunked decoding (consume each "<chunk-size>\\r\\n<data>\\r\\n"
block until a zero-size chunk) and then call parseResponse(decodedBody) instead
of parseResponse(body). Ensure you still handle non-chunked bodies unchanged and
preserve existing error handling for malformed headers/status codes.

In `@nemoclaw/src/index.ts`:
- Around line 852-856: The schemas' wait_timeout_ms property currently sets
default: 0 while runtime logic falls back to DEFAULT_ACCESS_WAIT_MS when the
field is absent, causing non-deterministic behavior; update each schema
occurrence of wait_timeout_ms (the ones constrained by MAX_ACCESS_WAIT_MS) to
use default: DEFAULT_ACCESS_WAIT_MS (keeping minimum/maximum intact) so the
schema default matches the runtime fallback, and verify the code paths that read
wait_timeout_ms (the execute/request handling logic) still respect the numeric
bounds.

In `@src/lib/onboard.ts`:
- Around line 1795-1805: The new wrapper function
ensureProviderProfilesAvailable (which calls
providerProfileOnboard.ensureNemoClawProviderProfiles with runOpenshell and
note, checks result.status and logs messages, and calls
policies.clearProviderProfileCache) must be moved out of this file to avoid
increasing onboard.ts length; extract this logic into a new module (e.g.,
provider-profiles.ts) and export a function with the same name, or remove the
extra logging here and call the underlying
providerProfileOnboard.ensureNemoClawProviderProfiles directly from onboard.ts;
ensure you keep the same behavior by preserving calls to
providerProfileOnboard.ensureNemoClawProviderProfiles, note, and
policies.clearProviderProfileCache and update imports/exports accordingly so
callers of ensureProviderProfilesAvailable continue to work.

In `@src/lib/onboard/provider-profiles.ts`:
- Around line 116-123: The current branch treats any non-zero result from the
OpenShell `list-profiles` call (checked via `list.status`) as "unsupported",
hiding real runtime failures; change the logic in the function that calls
`list-profiles` (the block using `list.status`) to only return
status:"unsupported" when the output/exit pattern clearly indicates the CLI is
absent or shows the expected "unsupported" signature, and otherwise throw an
error that includes `list.stdout` and `list.stderr` (and the exit `list.status`)
so callers can surface timeouts/process errors; update the conditional around
`list.status` to inspect the command signature (e.g., known missing-CLI text)
before returning unsupported and use a thrown Error with context for all other
non-zero cases.

In `@src/lib/policy/index.ts`:
- Around line 100-109: The listing logic (mergeProviderProfilePresets) preserves
built-in presets on name collisions but loadPreset currently prefers
provider-generated content (loadOpenShellProviderPreset), causing inconsistent
behavior; make collision resolution consistent by changing loadPreset to prefer
the built-in preset first (i.e., check the built-in preset source before calling
loadOpenShellProviderPreset) or alternatively change mergeProviderProfilePresets
to prefer provider presets—pick one canonical source and apply it consistently;
also update the analogous load logic around the 195-208 region so both listing
(mergeProviderProfilePresets/listOpenShellProviderPresets) and loading
(loadPreset/loadOpenShellProviderPreset) use the same precedence.

---

Outside diff comments:
In `@docs/reference/nemoclaw-openshell-integration.md`:
- Line 221: Add a "Next Steps" section to the bottom of the
nemoclaw-openshell-integration.md page: create a new header "## Next Steps" and
list 3–5 related documentation links (for example: Getting Started, Architecture
Overview, CLI Reference, Troubleshooting) with short one-line descriptions;
ensure links use the repo's relative doc paths and match existing link style
used elsewhere in docs so the section follows the docs/** page structure
guidelines.

---

Nitpick comments:
In `@agents/hermes/plugin/__init__.py`:
- Around line 671-707: Run the Hermes end-to-end test suite to validate the new
tool registration for openshell_network_access: execute the Hermes E2E jobs
(multi-agent onboarding, health probes, inference routing) and verify
policy.local and sandbox wiring behave correctly when ctx.register_tool
registers the openshell_network_access function with handler
_handle_network_access; check that schema fields (action, user_intent, resource,
access, reason, duration, request_id, task_id, wait_timeout_ms) accept expected
values and enforce defaults/limits (especially MAX_ACCESS_WAIT_MS and
DEFAULT_ACCESS_WAIT_MS), confirm enum constraints work for
action/access/duration, and ensure the tool triggers correct policy/local
sandbox decisions and no regressions in agent onboarding or health probes.

In `@Dockerfile`:
- Around line 32-33: This change adds/updates the Docker COPY step for
scripts/install-provider-tools.sh in the Dockerfile and touches other runtime
layers (lines near the COPY and blocks at 62-67, 254-255), so before merging run
the recommended E2E matrix to validate sandbox/runtime behavior: execute the
GitHub Actions workflow with the cloud-e2e, sandbox-survival-e2e, hermes-e2e,
and rebuild-openclaw-e2e jobs using the command `gh workflow run
nightly-e2e.yaml --ref <branch> -f
jobs=cloud-e2e,sandbox-survival-e2e,hermes-e2e,rebuild-openclaw-e2e` and confirm
all jobs pass.

In `@docs/network-policy/provider-access-requests.md`:
- Around line 33-40: The H2/H3 sections (notably "Access Types" and "Provider
Access Flow" and others referenced) start directly with tables/lists and the
bottom "Related Pages" should be "Next Steps"; add a one-sentence introductory
lead under each H2/H3 that briefly describes the purpose of the section before
the table or list, and rename the final "Related Pages" section to "Next Steps"
while ensuring it contains the same links — update section headers "Access
Types", "Provider Access Flow", and the final "Related Pages" heading
accordingly across the referenced blocks so every section begins with an
introductory sentence and the bottom section follows the "Next Steps"
convention.

In `@src/lib/onboard.ts`:
- Line 9751: The change adds a call to ensureProviderProfilesAvailable() in
src/lib/onboard.ts which affects core onboarding sequencing; before merging, run
the full onboarding E2E matrix and ensure all tests pass: cloud-e2e,
sandbox-operations-e2e, rebuild-openclaw-e2e, channels-stop-start-e2e,
messaging-compatible-endpoint-e2e, hermes-discord-e2e, hermes-slack-e2e, and
openshell-gateway-upgrade-e2e; if any test fails, revert or adjust the
ensureProviderProfilesAvailable() insertion and re-run until the suite is green.

In `@src/lib/policy/index.ts`:
- Around line 84-100: listPresets() currently calls
listOpenShellProviderPresets() (via mergeProviderProfilePresets) which shells
out to openshell; change listPresets() to avoid invoking external providers
during local file validation by returning only on-disk presets or by adding an
optional parameter to listPresets(e.g., includeProviderPresets = false) so
callers like loadPresetFromFile() can request only disk-based names; update
mergeProviderProfilePresets or its usage so provider presets are merged only
when explicitly requested (e.g., from CLI code paths that already need provider
info) and remove the implicit call to listOpenShellProviderPresets() in the
default listPresets() path.