chore(deps): upgrade OpenShell runtime and SDK to 0.1.5

.agents/references/provider-profile-inventory.md

@@ -39,7 +39,8 @@ IPv6 endpoints remain excluded. Literal private IPv4 endpoints retain their sing
 
 The dual-stack boundary has a distinct profile and provider identity. Existing IPv4-only receipts
 remain valid for verification and cleanup; resume and rebuild retain their recorded permissions.
-To use IPv6 after upgrading, reselect the local provider with `nemoclaw <sandbox> inference set --provider <provider> --model <model>`.
+For OpenClaw and Hermes, reselect the local provider with `nemoclaw inference set --sandbox <sandbox> --provider <provider> --model <model>` to use IPv6 after upgrading.
+Deep Agents Code and Pi require sandbox recreation to change inference.
 If onboarding has not finished, resume with `nemoclaw onboard --resume`; if it retains the old
 attachment, reselect local inference before retrying the proof. Do not overwrite or delete an
 attached profile to change its permissions. Reselection uses the existing ownership and cleanup

.github/workflows/base-image.yaml

@@ -59,6 +59,7 @@ on:
       - "src/lib/extra-agents-validation.ts"
       - "src/lib/core/json-types.ts"
       - "src/lib/core/ports.ts"
+      - "src/lib/inference/native-provider/catalog.ts"
       - "src/lib/messaging/**"
       - "src/lib/onboard/**"
       - "src/lib/security/credential-hash.ts"

.github/workflows/managed-images.yaml

@@ -54,6 +54,7 @@ on:
       - "src/lib/extra-agents-validation.ts"
       - "src/lib/core/json-types.ts"
       - "src/lib/core/ports.ts"
+      - "src/lib/inference/native-provider/catalog.ts"
       - "src/lib/messaging/**"
       - "src/lib/onboard/**"
       - "src/lib/security/credential-hash.ts"
@@ -1869,7 +1870,7 @@ jobs:
       # correctly. Start the published digest through its declared entrypoint
       # with no command, matching a real launch,
       # and prove PID 1 drops to the sandbox user, hardens its resource limits,
-      # and persists the trusted proxy environment before it holds the sandbox
+      # and persists the TLS environment before it holds the sandbox
       # open.
       - name: Exercise the Pi candidate through its declared entrypoint
         shell: bash
@@ -1966,20 +1967,15 @@ jobs:
             )) process.exit(1);
           ' "$merged_ca"
           docker exec --user 999:999 "$entrypoint_container" /bin/bash -ceu '
-            unset HTTP_PROXY HTTPS_PROXY NO_PROXY http_proxy https_proxy no_proxy
             unset SSL_CERT_FILE CURL_CA_BUNDLE REQUESTS_CA_BUNDLE GIT_SSL_CAINFO NODE_EXTRA_CA_CERTS
             source /tmp/nemoclaw-proxy-env.sh
-            proxy_url=http://10.200.0.1:3128
-            for proxy_variable in HTTP_PROXY HTTPS_PROXY http_proxy https_proxy; do
-              if [ "${!proxy_variable}" != "$proxy_url" ]; then
-                echo "ERROR: an independent Pi shell did not load $proxy_variable from the runtime environment." >&2
-                exit 1
-              fi
-            done
-            no_proxy_value=localhost,127.0.0.1,::1,10.200.0.1
-            for no_proxy_variable in NO_PROXY no_proxy; do
-              if [ "${!no_proxy_variable}" != "$no_proxy_value" ]; then
-                echo "ERROR: an independent Pi shell did not load $no_proxy_variable from the runtime environment." >&2
+            for proxy_variable in \
+              HTTP_PROXY HTTPS_PROXY NO_PROXY http_proxy https_proxy no_proxy \
+              ALL_PROXY all_proxy OPENAI_PROXY grpc_proxy GRPC_PROXY NODE_USE_ENV_PROXY \
+              NEMOCLAW_PROXY_HOST NEMOCLAW_PROXY_PORT
+            do
+              if [ "${!proxy_variable+x}" = x ]; then
+                echo "ERROR: an independent Pi shell retained $proxy_variable after loading the runtime environment." >&2
                 exit 1
               fi
             done

.github/workflows/podman-cpu-proof.yaml

@@ -138,7 +138,7 @@ jobs:
       E2E_SOURCE_REVISION: ${{ github.event.pull_request.head.sha }}
       E2E_TARGET_ID: podman-cpu-lifecycle
       NEMOCLAW_RUN_LIVE_E2E: "1"
-      NEMOCLAW_OPENSHELL_PIN_VERSION: "0.0.116"
+      NEMOCLAW_OPENSHELL_PIN_VERSION: "0.1.5"
       PODMAN_APT_VERSION: "5.7.0+ds2-3build1"
     steps:
       - name: Checkout

.github/workflows/pr-self-hosted.yaml

@@ -75,9 +75,10 @@ jobs:
                   or .filename == ".github/workflows/sandbox-images.yaml"
                   or .filename == "package.json"
                   or .filename == "package-lock.json"
-                  or .filename == "src/lib/actions/sandbox/openshell-child-visible-credentials.v0.0.116.json"
+                  or .filename == "src/lib/actions/sandbox/openshell-child-visible-credentials.v0.1.5.json"
                   or .filename == "src/lib/actions/sandbox/runtime/hermes-lifecycle.ts"
                   or .filename == "src/lib/hermes-managed-route.ts"
+                  or .filename == "src/lib/inference/native-provider/catalog.ts"
                   or .filename == "src/lib/providerless-inference.ts"
                   or .filename == "src/lib/tool-disclosure.ts"
                   or .filename == "test/e2e/live/hermes-root-entrypoint-smoke.test.ts"