What is the right mechanism for modifying the .env for a Hermes agent?

[jhthompson12]

nemoclaw v0.0.112-5-gc9515609e

I think i am missing something about how to actually edit the .env for a Hermes agent.

I see the nemohermes sandbox config set <name> --key <dotpath> --value <value> that should be used to update the agent's /sandbox/.hermes/config.yaml instead of using direct edits.

but what is the equivalent for updating /sandbox/.hermes/.env with nemohermes?

for example, I need to add something like this line to my /sandbox/.hermes/.env to enable Firecrawl web search and scrape through a self-hosted firecrawl instance:

API_SERVER_PORT=18642
API_SERVER_HOST=127.0.0.1
API_SERVER_KEY=b538b9ddcf38aa0c7

# self-hosted Firecrawl host 
FIRECRAWL_API_URL=http://firecrawl-service

but after making direct modifications to /sandbox/.hermes/.env I am no longer able to restart the hermes gateway with nemohermes hm-4 gateway restart:

  Restarting Hermes Agent gateway in 'hm-4'...
  Failure layer: relaunch quarantined - gateway restart failed for 'hm-4'.
  GATEWAY_HEALTH_TIMEOUT
  NEMOCLAW_CONTROL_STAGE=await-replacement
  NEMOCLAW_SUPERVISOR_PID=36
  NEMOCLAW_GATEWAY_PID=0
  NEMOCLAW_START_LOG=[gateway] Hermes gateway respawned (pid 158051)
  NEMOCLAW_START_LOG=[gateway] Hermes auxiliary repair failed; retrying while the exact gateway remains supervised
  NEMOCLAW_START_LOG=[SECURITY] Hermes automatic respawn is quarantined until MCP integrity is restored by rebuilding the sandbox
  Hermes gateway log tail (sanitized):
  │  Press Ctrl+C to stop                                   │
  └─────────────────────────────────────────────────────────┘
  WARNING gateway.run: No env user allowlists configured. Messaging platforms default to pairing/allowlist policies and will deny unknown senders unless you configure platform allowlists (e.g., TELEGRAM_ALLOWED_USERS=your_id) or explicitly opt in with GATEWAY_ALLOW_ALL_USERS=true plus dm_policy/group_policy: open on the platform.
  WARNING gateway.run: Shutdown context: signal=SIGTERM under_systemd=no parent_pid=36 parent_name=bash loadavg_1m=0.65 parent_cmdline='bash /usr/local/bin/nemoclaw-start'
  ┌─────────────────────────────────────────────────────────┐
  │           ⚕ Hermes Gateway Starting...                 │
  ├─────────────────────────────────────────────────────────┤
  │  Messaging platforms + cron scheduler                    │
  │  Press Ctrl+C to stop                                   │
  └─────────────────────────────────────────────────────────┘
  The in-sandbox supervisor quarantined gateway relaunch after a startup refusal. Retrying the restart cannot clear it.
  Restore the registered configuration and refresh its integrity metadata with `nemoclaw hm-4 rebuild --yes`.
  Then make intended changes through supported commands such as `nemoclaw hm-4 config set` or `nemoclaw inference set --sandbox hm-4`, which update the configuration and its hashes together.

but im not able to find anything in the documentation about the right way to modify /sandbox/.hermes/.env

[apurvvkumaria]

You are not missing a command. NemoClaw does not currently provide a supported command for arbitrary changes to /sandbox/.hermes/.env.

nemohermes <name> config set changes config.yaml only. NemoClaw generates and manages .env together with its integrity metadata. Direct edits cannot be adopted through gateway restart.

For hm-4, rebuild the sandbox to clear the quarantine, then verify its status:

nemohermes hm-4 rebuild --yes
nemohermes hm-4 status

Retrying gateway restart, recover, or connect will not clear relaunch quarantined.

Do not change API_SERVER_HOST, API_SERVER_PORT, or API_SERVER_KEY to configure Firecrawl. NemoClaw manages those values and generates API_SERVER_KEY. The value posted here and in #10557 is credential material, so please redact it. The rebuild generates a replacement token. Retrieve it when needed with:

nemohermes hm-4 gateway-token --quiet

Treat that output like a password.

At commit c9515609e, the supported Hermes web-search paths are Tavily Search and, with Nous Portal authentication, the Nous-managed web gateway. NemoClaw does not currently support FIRECRAWL_API_URL for an operator-managed Firecrawl service.

Thanks for opening #10557. Before NemoClaw can support this integration, that issue needs a maintainer decision and defined endpoint routing, network policy, credential handling, rebuild lifecycle, compatibility, and validation.

References: Understand Runtime Changes, NemoHermes Commands Reference, and quarantine recovery guidance.

[jhthompson12]

Thank you, @apurvvkumaria!

I will stick with openclaw inside NemoClaw for now then since, unfortunately, I'm stuck using a self-hosted firecrawl service for Internet search and scrape.

While using openclaw within nemoclaw I have been making direct edits to openclaw.json and have not run into the same gateway restart issues that I saw with Nemohermes. Should I actually be using nemoclaw <name> config set to make edits to openclaw.json?