fix: align auth profile provider key with openclaw.json model config

[Kash6]

Summary

write_auth_profile() in nemoclaw-start.sh hardcoded provider: 'nvidia', but openclaw.json (generated at image build time) uses provider key 'inference' for NVIDIA providers via getSandboxInferenceConfig(). OpenClaw couldn't match credentials to the model config and fell back to Anthropic defaults.

Related Issue

Fixes #1332

Changes

• nemoclaw-start.sh: read provider key from openclaw.json instead of hardcoding 'nvidia'
• write-auth-profile.ts: same fix for the TypeScript variant
• Dockerfile: align default NEMOCLAW_PROVIDER_KEY and NEMOCLAW_PRIMARY_MODEL_REF with getSandboxInferenceConfig() output

Type of Change

• Code change for a new feature, bug fix, or refactor.
• Code change with doc updates.
• Doc only. Prose changes without code sample modifications.
• Doc only. Includes code sample changes.

Testing

• npx prek run --all-files passes (or equivalently make check).
• npm test passes.
• make docs builds without warnings. (for doc-only changes)

Checklist

General

• I have read and followed the contributing guide.
• I have read and followed the style guide. (for doc-only changes)

Code Changes

• Formatters applied — npx prek run --all-files auto-fixes formatting (or make format for targeted runs).
• Tests added or updated for new or changed behavior.
• No secrets, API keys, or credentials committed.
• Doc pages updated for any user-facing behavior changes (new commands, changed defaults, new features, bug fixes that contradict existing docs).

Doc Changes

• Follows the style guide. Try running the update-docs agent skill to draft changes while complying with the style guide. For example, prompt your agent with "/update-docs catch up the docs for the new changes I made in this PR."
• New pages include SPDX license header and frontmatter, if creating a new page.
• Cross-references and links verified.

---

Signed-off-by: Akash akashmehta556@gmail.com

Summary by CodeRabbit

• Chores
  • Updated the default model provider from nvidia to inference in build and runtime configuration.
  • Improved startup to generate authentication profiles dynamically from the active provider configuration instead of using a hardcoded provider, improving compatibility with different provider setups.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6c58e99c-bf22-49cb-8118-692268dd45cf

📥 Commits

Reviewing files that changed from the base of the PR and between 059bab9 and c71774d.

📒 Files selected for processing (3)

• Dockerfile
• scripts/nemoclaw-start.sh
• scripts/write-auth-profile.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• scripts/nemoclaw-start.sh
• scripts/write-auth-profile.ts

---

📝 Walkthrough

Walkthrough

Build-time defaults and runtime propagation for the NemoClaw provider/model were changed from a hardcoded nvidia prefix to inference, and the auth-profile generation was changed to dynamically resolve the provider key from ~/.openclaw/openclaw.json (falling back to inference) when writing auth-profiles.json.

Changes

Cohort / File(s)	Summary
Dockerfile Build Arguments Dockerfile	Changed build ARG defaults: NEMOCLAW_PROVIDER_KEY from nvidia → inference; NEMOCLAW_PRIMARY_MODEL_REF from nvidia/nemotron-3-super-120b-a12b → inference/nvidia/nemotron-3-super-120b-a12b. Propagated ARGs to ENV so generated ~/.openclaw/openclaw.json uses the new keys.
Startup script changes scripts/nemoclaw-start.sh	write_auth_profile() now derives provider_key at runtime from ~/.openclaw/openclaw.json (first key in models.providers), defaulting to inference if missing; writes auth profile under <provider_key>:manual and uses NVIDIA_API_KEY for keyRef.
Auth profile generator scripts/write-auth-profile.ts	Reads and parses ~/.openclaw/openclaw.json to resolve providerKey (first key under models.providers, fallback inference); emits ${providerKey}:manual profile with matching provider and profileId; updates variable names/logging for resolved provider.

Sequence Diagram(s)

sequenceDiagram
    participant Builder as Docker Build
    participant Container as Runtime Container
    participant StartScript as nemoclaw-start.sh
    participant OpenClaw as ~/.openclaw/openclaw.json
    participant AuthFile as agents/main/agent/auth-profiles.json

    Builder->>Container: Build image with ARGs (NEMOCLAW_PROVIDER_KEY=inference,\nNEMOCLAW_PRIMARY_MODEL_REF=inference/...)
    Container->>StartScript: On container start, run start script
    StartScript->>OpenClaw: Read/parse openclaw.json (models.providers)
    alt providers present
        OpenClaw-->>StartScript: return first provider key
    else missing/unreadable
        Note right of StartScript: fallback to "inference"
    end
    StartScript->>AuthFile: Write `${providerKey}:manual` auth profile\n(using NVIDIA_API_KEY for keyRef)
    AuthFile-->>StartScript: Ack write

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 I sniffed the config by the claw-lit tree,
From nvidia roots to inference free.
I hopped and wrote a profile true,
Provider found — then stamped it blue.
Hooray, no hardcode — a rabbit’s glee! 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: aligning auth profile provider keys with openclaw.json model configuration to resolve a provider mismatch bug.
Linked Issues check	✅ Passed	The PR addresses all coding requirements from issue #1332: updating nemoclaw-start.sh and write-auth-profile.ts to read provider keys from openclaw.json instead of hardcoding 'nvidia', and aligning Dockerfile defaults with getSandboxInferenceConfig() output.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing the provider key mismatch issue: Dockerfile defaults, nemoclaw-start.sh logic, and write-auth-profile.ts logic are all essential to resolving the reported problem.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[wscurran]

✨ Thanks for submitting this pull request, which proposes a way to fix an auth configuration mismatch between nemoclaw-start.sh and openclaw.json. This could help ensure proper provider credential mapping, especially in DGX Spark environments.

---

Possibly related open issues:

• #1332 Nemoclaw not recognising the inference provider specified by openshell

[Kash6]

@wscurran thanks for your acknowledgement, Can I get another review? Just updated with the latest branch and would like to merge this.