fix(inference): propagate OpenClaw provider timeout

Dockerfile

@@ -1571,7 +1571,8 @@
 # (e.g. "text" or "text,image" for vision-capable models). OpenClaw's
 # model schema currently accepts "text" and "image". See #2421.
 ARG NEMOCLAW_INFERENCE_INPUTS=text
-# Per-request inference timeout (seconds) baked into agents.defaults.timeoutSeconds.
+# Per-request inference timeout (seconds) baked into agents.defaults.timeoutSeconds
+# and models.providers.<provider-id>.timeoutSeconds.
 # Increase for slow local inference (e.g., CPU Ollama). openclaw.json is
 # immutable at runtime (Landlock read-only), so this can only be changed by
 # rebuilding via `nemoclaw onboard`. Ref: issue #2281
@@ -1605,10 +1606,10 @@
 # CHAT_UI_URL is a non-loopback address (Brev Launchable, remote deployments)
 # since terminal-based pairing is impossible in those contexts.
 # Default: "0" (device auth enabled for local deployments — secure by default).
 ARG NEMOCLAW_DISABLE_DEVICE_AUTH=0
 # Internal audit provenance for the opt-out above. Standard onboarding rewrites
 # this to managed-onboard; direct image builders retain operator provenance.
 ARG NEMOCLAW_DEVICE_AUTH_OPT_OUT_SOURCE=operator
 # Compatibility build arg for older custom Dockerfiles and rebuild tooling.
 # NemoClaw-managed images intentionally do not consume it; gateway auth tokens
 # are generated at container startup and are never baked into image layers.
@@ -1642,7 +1643,7 @@
 # NEMOCLAW_MESSAGING_PLAN_B64 intentionally remains ARG-only: Docker exposes it
 # to build RUN processes without retaining the full plan in the final image env.
 # Direct ARG interpolation into inline source is a code injection vector (C-2).
 ENV NEMOCLAW_MODEL=${NEMOCLAW_MODEL} \
     NEMOCLAW_INFERENCE_PROVIDER_ID=${NEMOCLAW_INFERENCE_PROVIDER_ID} \
     NEMOCLAW_UPSTREAM_PROVIDER=${NEMOCLAW_UPSTREAM_PROVIDER} \
     NEMOCLAW_PRIMARY_MODEL_REF=${NEMOCLAW_PRIMARY_MODEL_REF} \

docs/inference/configure-inference-timeouts.mdx

@@ -36,7 +36,7 @@ An unset, blank, invalid, or negative value uses 30 seconds for OpenClaw gateway
 <AgentOnly variant="openclaw">
 
 Increase `NEMOCLAW_AGENT_TIMEOUT` for a slow model server, such as CPU-only local inference or modest vLLM hardware.
-NemoClaw writes this value to `agents.defaults.timeoutSeconds` during onboarding.
+NemoClaw writes this value to `agents.defaults.timeoutSeconds` and `models.providers.<provider-id>.timeoutSeconds` during onboarding.
 
 ```bash
 export NEMOCLAW_AGENT_TIMEOUT=1800

docs/reference/commands.mdx

@@ -4223,7 +4223,7 @@ OpenClaw-specific onboarding configuration:
 | `NEMOCLAW_WEB_SEARCH_PROVIDER` | `brave`, `tavily`, or `none` | Selects Brave Search or Tavily Search in non-interactive onboarding, or disables web search explicitly. When unset, `BRAVE_API_KEY` implicitly selects Brave before `TAVILY_API_KEY` can implicitly select Tavily. |
 | `BRAVE_API_KEY` | Brave Search API key | Supplies and implicitly selects Brave Search when no web search provider is set. NemoClaw validates the key and stores it in OpenShell rather than the sandbox. |
 | `TAVILY_API_KEY` | Tavily Search API key | Supplies and implicitly selects Tavily Search when no provider is set and no Brave key is available. NemoClaw validates the key and stores it in OpenShell rather than the sandbox. |
-| `NEMOCLAW_AGENT_TIMEOUT` | positive integer (seconds) | Overrides `agents.defaults.timeoutSeconds` in the built OpenClaw config. Raise for slow inference. |
+| `NEMOCLAW_AGENT_TIMEOUT` | positive integer (seconds) | Overrides `agents.defaults.timeoutSeconds` and `models.providers.<provider-id>.timeoutSeconds` in the built OpenClaw config. Raise for slow inference. |
 | `NEMOCLAW_MCP_SHADOW_DIAGNOSTICS` | literal `1` to enable | Forwards opt-in successful Streamable HTTP MCP timing diagnostics to a newly created or rebuilt OpenClaw sandbox. It does not change timeouts, retries, requests, or responses. Unset it and rebuild after evidence collection to restore failure-only logging. Other values are ignored. |
 | `NEMOCLAW_AUTO_PAIR_SLOW_INTERVAL_SECS` | positive number of seconds | Sets the post-pairing poll cadence for the in-sandbox OpenClaw auto-pair watcher. Defaults to `5` so late allowlisted CLI and browser scope upgrades are approved before clients time out. Raise only on load-sensitive gateways. |
 | `NEMOCLAW_AUTO_PAIR_FAST_REENTRY_POLLS` | positive integer | Sets how many fast polls run after the watcher observes a fresh allowlisted scope-upgrade request. Defaults to `5`; set lower only when you need to reduce gateway polling. |

scripts/generate-openclaw-config.mts

@@ -1409,6 +1409,7 @@ export function buildConfig(env: Env = process.env): JsonObject {
       baseUrl: inferenceBaseUrl,
       apiKey: "unused",
       api: inferenceApi,
+      timeoutSeconds: agentTimeout,
       models: providerModels,
     },
   };

src/lib/onboard/dockerfile-patch.ts

@@ -391,8 +391,8 @@ export function patchStagedDockerfile(
       `ARG NEMOCLAW_INFERENCE_INPUTS=${sanitizeDockerArg(inferenceInputs)}`,
     );
   }
-  // NEMOCLAW_AGENT_TIMEOUT — override agents.defaults.timeoutSeconds at build
-  // time. Lets users increase the per-request inference timeout without
+  // NEMOCLAW_AGENT_TIMEOUT overrides the agent-run and provider-request timeouts
+  // at build time. Users can increase the inference timeout without
   // editing the Dockerfile. Ref: issue #2281
   const agentTimeout = process.env.NEMOCLAW_AGENT_TIMEOUT;
   if (agentTimeout && POSITIVE_INT_RE.test(agentTimeout)) {

test/generate-openclaw-config.test.ts

@@ -760,10 +760,10 @@ describe("generate-openclaw-config.mts: config generation", () => {
     expect(config.tools?.toolSearch).toEqual(STRUCTURED_TOOL_SEARCH);
     expect(config.tools?.web?.search).toBeUndefined();
   });
-
-  it("propagates agent timeout", () => {
+  it("propagates the agent timeout to the run and provider request (#8468)", () => {
     const config = runConfigScript({ NEMOCLAW_AGENT_TIMEOUT: "300" });
     expect(config.agents.defaults.timeoutSeconds).toBe(300);
+    expect(config.models.providers["test-provider"].timeoutSeconds).toBe(300);
   });
 
   it("rejects invalid agent timeout values", () => {