fix: align auth profile provider key with openclaw.json model config

write_auth_profile() in nemoclaw-start.sh hardcoded provider: 'nvidia',
but openclaw.json (generated at image build time) uses provider key
'inference' for NVIDIA providers via getSandboxInferenceConfig(). OpenClaw
couldn't match credentials to the model config and fell back to Anthropic
defaults.

- nemoclaw-start.sh: read provider key from openclaw.json instead of
  hardcoding 'nvidia'
- write-auth-profile.ts: same fix for the TypeScript variant
- Dockerfile: align default NEMOCLAW_PROVIDER_KEY and
  NEMOCLAW_PRIMARY_MODEL_REF with getSandboxInferenceConfig() output

Fixes #1332

Author: Kash6

Dockerfile

@@ -48,8 +48,8 @@ RUN chmod 755 /usr/local/bin/nemoclaw-start
 # Build args for config that varies per deployment.
 # nemoclaw onboard passes these at image build time.
 ARG NEMOCLAW_MODEL=nvidia/nemotron-3-super-120b-a12b
-ARG NEMOCLAW_PROVIDER_KEY=nvidia
-ARG NEMOCLAW_PRIMARY_MODEL_REF=nvidia/nemotron-3-super-120b-a12b
+ARG NEMOCLAW_PROVIDER_KEY=inference
+ARG NEMOCLAW_PRIMARY_MODEL_REF=inference/nvidia/nemotron-3-super-120b-a12b
 ARG CHAT_UI_URL=http://127.0.0.1:18789
 ARG NEMOCLAW_INFERENCE_BASE_URL=https://inference.local/v1
 ARG NEMOCLAW_INFERENCE_API=openai-completions

scripts/nemoclaw-start.sh

@@ -120,17 +120,36 @@ write_auth_profile() {
     return
   fi
 
+  # Read the provider key from openclaw.json so the auth profile matches
+  # the provider key used in the model config. Hardcoding 'nvidia' breaks
+  # when getSandboxInferenceConfig() maps nvidia-prod/nvidia-nim to
+  # 'inference'. See: https://github.com/NVIDIA/NemoClaw/issues/1332
   python3 - <<'PYAUTH'
 import json
 import os
+
+# Resolve provider key from openclaw.json — must match the key in
+# config.models.providers so OpenClaw can find the credentials.
+provider_key = 'inference'  # safe default matching getSandboxInferenceConfig
+config_path = os.path.expanduser('~/.openclaw/openclaw.json')
+try:
+    with open(config_path) as f:
+        config = json.load(f)
+    providers = config.get('models', {}).get('providers', {})
+    keys = list(providers.keys())
+    if keys:
+        provider_key = keys[0]
+except Exception:
+    pass  # fall through to default
+
 path = os.path.expanduser('~/.openclaw/agents/main/agent/auth-profiles.json')
 os.makedirs(os.path.dirname(path), exist_ok=True)
 json.dump({
-    'nvidia:manual': {
+    f'{provider_key}:manual': {
         'type': 'api_key',
-        'provider': 'nvidia',
+        'provider': provider_key,
         'keyRef': {'source': 'env', 'id': 'NVIDIA_API_KEY'},
-        'profileId': 'nvidia:manual',
+        'profileId': f'{provider_key}:manual',
     }
 }, open(path, 'w'))
 os.chmod(path, 0o600)

scripts/write-auth-profile.ts

@@ -2,21 +2,45 @@
 // SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 
-const path = join(homedir(), ".openclaw", "agents", "main", "agent", "auth-profiles.json");
+// Read the provider key from openclaw.json so the auth profile matches
+// the provider key used in the model config. Hardcoding 'nvidia' breaks
+// when getSandboxInferenceConfig() maps nvidia-prod/nvidia-nim to 'inference'.
+// See: https://github.com/NVIDIA/NemoClaw/issues/1332
+function resolveProviderKey(): string {
+  const configPath = join(homedir(), ".openclaw", "openclaw.json");
+  if (existsSync(configPath)) {
+    try {
+      const config = JSON.parse(readFileSync(configPath, "utf-8"));
+      const providers = config?.models?.providers;
+      if (providers && typeof providers === "object") {
+        const keys = Object.keys(providers);
+        if (keys.length > 0) {
+          return keys[0];
+        }
+      }
+    } catch {
+      // Fall through to default
+    }
+  }
+  return "inference";
+}
+
+const providerKey = resolveProviderKey();
+const authPath = join(homedir(), ".openclaw", "agents", "main", "agent", "auth-profiles.json");
 const profile = {
-  "nvidia:manual": {
+  [`${providerKey}:manual`]: {
     type: "api_key",
-    provider: "nvidia",
+    provider: providerKey,
     keyRef: { source: "env", id: "NVIDIA_API_KEY" },
-    profileId: "nvidia:manual",
+    profileId: `${providerKey}:manual`,
   },
 };
 
-mkdirSync(dirname(path), { recursive: true });
-writeFileSync(path, JSON.stringify(profile));
-chmodSync(path, 0o600);
-console.log(`Wrote auth profile to ${path}`);
+mkdirSync(dirname(authPath), { recursive: true });
+writeFileSync(authPath, JSON.stringify(profile));
+chmodSync(authPath, 0o600);
+console.log(`Wrote auth profile to ${authPath} (provider: ${providerKey})`);