nanocoai/nanoclaw v2026.10.1-rc.2

on GitHub

NanoClaw 2026.10.1-rc.2 is the second release candidate for 2026.10.1. Installs on the beta channel get this candidate; stable stays on 2026.10.0 until 2026.10.1 is published. Since 2026.10.1-rc.1 it moves OneCLI to 1.45, where new agent groups get only their model key and other keys go to the groups you choose, makes the webhook server listen only on this machine by default, applies egress lockdown to agents that were already running, asks for Node's October 2026 security releases, and lets Claude agents read PDFs; Google Chat now checks that its webhooks come from your app. It also lets agents create other agents from templates, adds Cursor as an agent provider, and moves locally built agent images to Claude Code 2.1.296 with Claude Haiku 5.5. Setup waits for a slow first reply and says when that reply failed, approval cards appear in the thread you are waiting in, and fewer agent runs fail. Six changes need action from some installs, among them the OneCLI upgrade, the webhook address and two new Google Chat settings, so check the section below before you update.

⚠️ Before you update

• [BREAKING] Chat SDK channels move to adapter 4.41.1, which fixes Telegram messages with links that were never delivered. Affected: installs where grep -o '"@chat-adapter/[a-z]*"' package.json prints anything (Telegram, Slack, Discord, Google Chat, Teams, WhatsApp Cloud, GitHub, Linear). Fix: /update-nanoclaw refreshes installed channels; after a manual merge, rerun /add-<channel> for each one. Google Chat: @mentions in spaces now need GOOGLE_CHAT_BOT_USER_ID=users/<id> in .env (DMs work without it; without it the log says "Google Chat botUserId is not configured" at startup): once the app has replied to you in a DM, list that DM's messages with the Chat API (spaces.messages.list), copy the sender.name of a message whose sender type is BOT, and restart the service. Slack agent-to-agent rooms: a sibling bot now arrives as slack:bot:U… instead of slack:bot:B…, so approve each sibling bot once more. Check: each channel answers a test message. Rollback: pnpm exec tsx scripts/update-nanoclaw.ts rollback --id <transaction-id> (rolling back).
• [BREAKING] Iron Proxy installs that connected Codex with ChatGPT before this release must sign in to Codex again. Detect, from the NanoClaw folder (works while the service is stopped): f=data/session-materials/iron-control/codex.json; [ -f "$f" ] && grep -q '"mode":"chatgpt"' "$f" && ! grep -q '"accountId"' "$f" && echo affected. Once running, an affected install's Codex agents answer only with the failure notice ("Sorry, something went wrong and I couldn't answer") and the agent container log shows selected workspace missing from routing discovery. Why: Codex 0.156 and later check the login's workspace id, and older Iron logins never recorded it. Fix: pnpm exec tsx setup/index.ts --step provider-auth codex, then check that a Codex agent answers. OneCLI installs are affected only when the vault holds several ChatGPT logins or one without a recorded id; the host log then says "OneCLI login stand-in keeps its placeholder account id": delete the extra or stale login (onecli secrets list, then onecli secrets delete --id <id>), run the same command, and grant the new secret to each agent that had the old one, as docs/onecli-upgrades.md in your install describes. Rollback: return to the previous release.
• [BREAKING] Forks and hand-made templates: the template code moved and templates/ is now ignored by git. Affected: fork code that imports cloneRegistry, listTemplatesFromDir, copyTemplate or DEFAULT_TEMPLATES_SOURCE from setup/templates.ts (it stops compiling), forks that edit the GROUP_SCOPE_RESOURCES line or the stamper's ensureContainerConfig line, forks that point setup at their own template library, and anyone who keeps a hand-made template in templates/. Why: templates fetched by setup or by an agent are install state and must not block /update-nanoclaw, and setup now lists a library from its index.json. Fix: import cloneRegistry and listTemplatesFromDir from src/templates/library.ts and await cloneRegistry(); copyTemplate is gone, so call ensureTemplateLocal; a fork that changed DEFAULT_TEMPLATES_SOURCE edits LIBRARY_REPO (owner/repo) and LIBRARY_BRANCH in src/templates/library.ts instead; re-anchor fork edits on the new lines; keep a new hand-made template in git with git add -f templates/<ref>; give your own library an index.json at its root in the same shape as nanocoai/nanoclaw-templates ({ "schema": 1, "categories": { "<category>": [{ "ref": "<folder>", "name": "...", "description": "..." }] } }). Check: pnpm exec tsc --noEmit passes and setup's library picker lists your templates (building templates). Rollback: revert this release; fetched templates then show as untracked in git status, so delete them or git add the ones to keep.
• [BREAKING] OneCLI installs: upgrade the gateway to 1.45.0 and the onecli CLI to 2.11.0, where agents get only the keys you grant them. Detect: the gateway's /api/health reports a version older than 1.45.0, or unknown (Iron Proxy installs skip this). Why: OneCLI 1.44 replaced secret modes with per-agent grants, and 1.45 is the last version that converts existing installs, so do not skip past it. Fix: before restarting, follow docs/onecli-upgrades.md in your install (the same guide on GitHub); it backs up the gateway database, stops if the conversion would delete your rules, and covers the CLI binary. If you use /add-dial-tool, delete the Dial key first (see the Dial item below). Existing groups keep what the conversion gives them; new groups get only their model credential, and on a 1.42 gateway new groups still get every key until you upgrade. To give a group a tool, re-run that tool's skill (for example /add-vercel) and pick the group; with /add-tavily-tool, re-run its Phase 5 so paid-key upgrades attach the key. /add-vercel, /add-tavily-tool and /add-dial-tool refuse a gateway that is not 1.45. If your Claude key in OneCLI is not named Anthropic (or your Codex key Codex or openai), new groups get no key: run that provider's login again after upgrading (pnpm exec tsx setup/index.ts --step gateway-auth claude, or codex). Check: /api/health reports 1.45.0 and a new agent group answers. Rollback: restore the database backup the guide takes.
• [BREAKING] The webhook server now listens on 127.0.0.1 by default. Tunnels and reverse proxies on the same machine keep working. Affected: a proxy on another machine, or anything in Docker on Linux that calls back to the host, such as a Mattermost server; webhooks stop arriving, and the log shows Webhook server started host="127.0.0.1". Fix: set WEBHOOK_HOST=0.0.0.0 (or one interface's IP address; a name such as localhost stops the host at startup) in .env and restart. Check: a message on that channel gets an answer. Rollback: the same setting restores the old behavior.
• [BREAKING] Google Chat installs need two new settings, or the channel does not start. Google Chat now verifies that webhooks come from your Workspace add-on Chat app, using GOOGLE_CHAT_ENDPOINT_URL and GOOGLE_CHAT_PROJECT_NUMBER (digits) in .env; /update-nanoclaw brings the new adapter but cannot ask for them. Detect: the log says "Google Chat needs GOOGLE_CHAT_ENDPOINT_URL and GOOGLE_CHAT_PROJECT_NUMBER (digits) in .env to verify webhooks". Fix: re-run /add-gchat, which keeps your existing values and asks for the endpoint URL, the project number and the bot user id for @mentions in spaces, or set both values by hand and restart. The Chat app must be a Google Workspace add-on, and converting an app to one cannot be undone. Check: a test message gets an answer. Rollback: pnpm exec tsx scripts/update-nanoclaw.ts rollback --id <transaction-id>.
• /add-dial-tool users: delete the Dial key before upgrading OneCLI, then re-run /add-dial-tool. On OneCLI 1.45 it gives the Dial key only to the agent groups you choose, and new groups get Dial only when you add them; Dial is off for those few minutes instead of open to every agent. The upgrade guide has the delete command. NanoClaw's ONECLI_PROJECT_ID and the onecli CLI's project (onecli config set project, or ONECLI_PROJECT) must match or both be unset: when they differ, the re-run stops and writes nothing to OneCLI. An agent group name with a line break no longer changes which groups keep Dial.
• Update Node to its October 2026 security release. Setup now requires Node 22.23.4, 24.22.1 or 26.12.1 or newer and refuses the end-of-life 23 and 25; locally built agent images move to Node 22.23.4, pinned by digest, and hardened installs get it with a later image. NanoClaw keeps running on an older Node, but re-running setup stops. After /update-nanoclaw, run bash setup/install-node.sh, then re-run bash nanoclaw.sh so the service uses the new Node. If Node comes from nvm, fnm, volta or asdf, update it there. Groups with extra packages also need ncl groups restart --id <group-id> --rebuild.
• Egress lockdown now covers agents that were already running when it was turned on: they restart on the locked network when the host restarts. If the lockdown network exists but is not internal (only a network made by hand, or a setting that points at an ordinary one), agents no longer start and the host log says "Refusing to spawn with open egress". Fix: list what is attached with docker network inspect nanoclaw-egress, detach it (docker network disconnect nanoclaw-egress <container>), then docker network rm nanoclaw-egress; the next agent start recreates it as internal. Iron Proxy installs name it nanoclaw-egress-<slug>, and NANOCLAW_EGRESS_NETWORK can set another name.
• Locally built agent images move to Claude Code 2.1.296 and Agent SDK 0.3.296, where Claude Haiku 5.5 replaces Haiku 4.5. On the Anthropic API, Claude Code's background requests and groups set to haiku move to Haiku 5.5, which costs a tenth of Haiku 4.5's price for prompts up to 100K tokens. Hardened installs keep Claude Code 2.1.280 and Haiku 4.5 until an image for this release is listed.
• Hardened installs move to the image built from v2026.10.0. A pull now takes the image listed in agent-images.json on main for the newest release in the install's history, so a new hardened image reaches installs without a new release. Release candidates never get an image of their own, so this one uses v2026.10.0's (Claude Code 2.1.280, newer than the old pinned build), and the pull's "agent-runner lock drift" warning is expected. This candidate lists a newer build of that image, made on 2026-10-21, so /update-nanoclaw pulls it again. Run pnpm exec tsx setup/index.ts --step registry -- --refresh to move onto it (hardened runtime).
• Codex groups with no model set start new threads on GPT-6.1 Sol. /add-codex now pins @openai/codex 0.162.1; existing threads keep their model. To stay on the old one, run ncl groups config update --id <group-id> --model gpt-6-astra, then ncl groups restart --id <group-id>.

✨ New

• Agents can create other agents from templates. Ask for one in chat, pick from ncl templates list or the public library, and the agent builds it. Setup's template library list now shows what each template does (using templates).
• Cursor is an agent provider. The new /add-cursor skill runs Cursor's Agent SDK, and setup offers Cursor in the provider picker; it needs a locally built agent image (providers).
• Setup waits for a slow first reply instead of failing. The first-chat check waits 2 minutes, then asks whether to keep waiting, and shows each stage (sandbox, agent runtime, model) with its time, so local models that take minutes to load no longer fail setup. Runs without a terminal now stop after 2 minutes instead of 30 seconds.
• Agents on slow local models are no longer cut off mid-turn. Raise NANOCLAW_ABSOLUTE_CEILING_MS (default 30 minutes) or NANOCLAW_CLAIM_STUCK_MS (default 60 seconds) in .env; the host log names which one fired. Restart the service after a change; installs that set neither are unaffected (environment variables).

🛠️ Fixes

• Setup tells you when your assistant's first reply failed. Instead of saying the assistant is ready (for example after a bad API key), it shows the agent's error, names the log files and links the troubleshooting docs; pnpm run chat exits with code 4 on a failure notice. When an agent has no error of its own to share, every channel's failure notice now reads "Sorry, something went wrong and I couldn't answer" and links the troubleshooting docs.
• Agents no longer lose or repeat a reply around send_message. An agent that sent something with send_message and then left its answer unwrapped is shown what it already sent and asked to finish, and an exact repeat is not sent twice. On streaming providers, a reply sent with send_message and followed by plain closing text costs one extra model turn.
• Fewer failed agent runs. On Docker Desktop, a message that arrives while an agent is replying no longer fails the run, and "Permission denied" replies to admin-only commands are sent directly to the chat. On every install, ncl and agent tools no longer hit intermittent "database is locked" errors.
• Approval cards appear where you are waiting and are easier to read. When an agent in a thread of your own DM asks for approval, the card and its "Reject with reason" prompt appear in that thread. Cards show command arguments and agent-to-agent messages in a code block, and names and the install reason quoted on one line. An approval an agent asks for, or an ask_user_question, whose title and question together run over 2,000 characters is refused, and the agent is told the limit so it can shorten it; ask_user_question also returns an error within seconds of the host giving up on delivering its card, instead of waiting out its 300-second timeout.
• The background service finds the tools it was installed with. On macOS it now includes /opt/homebrew/bin and the Node.js folder, so Apple Silicon installs using Homebrew or Apple Container no longer crash at start; on Linux it includes the Node.js folder (for example from nvm). Existing installs get it by running pnpm exec tsx setup/index.ts --step service once.
• /update-nanoclaw no longer stops at its validate step on installs with Slack. The skill refresh now credits each channel import to the skill that adds it, so it stops looking for Slack skills that don't exist. The fix comes with the update itself.
• Discord: Approve on an approval card now approves. Button clicks were misread, so approvals were recorded as rejections and answers to questions came back garbled.
• Claude agents can read long PDFs you send them. Installs that build their own agent image get it from the image rebuild in /update-nanoclaw; groups that installed their own packages also need ncl groups restart --id <group-id> --rebuild. Hardened installs get it with a later image.
• Google Chat attachments reach the agent. On channels whose message ids contain /, such as Google Chat, files were dropped and the agent saw only the file name. When someone shares a file from Google Drive, the agent now says it can't open Drive files and asks for the file to be pasted or dragged into the chat.
• Resend email replies are sent. Agent replies and the "Connect yourself" hello failed with Invalid thread ID format; they now go out, and a reply lands in the email thread the person last wrote in. /update-nanoclaw brings it; after a manual merge, rerun /add-resend.
• Smaller fixes. An agent reads its own replies from other threads of the same chat as its own, not as another agent's; ncl groups delete also removes the group's host bookkeeping rows, and agents that could message it stop listing it right away; creating an agent from a template no longer fails when an agent that has not run yet holds that name; a Slack bot set up for channels only no longer sends you an FYI each time it turns away a DM; ncl messaging-groups delete also removes the group's wirings, its own sessions and pending approvals instead of failing with a foreign key error, and removing iMessage uses it; creating an agent refuses a name whose group folder would be invalid (too long, or reserved such as "Global") before anything is written, and says why; setup accepts Anthropic's newer API key types (sk-ant-usr, sk-ant-svc), which must be scoped to one workspace; Linux Signal setup installs signal-cli 0.14.9, which fixes sends to new contacts hanging (rerun setup/install-signal-cli.sh, then restart the service); and the /add-dashboard dashboard keeps updating when a transcript grows past about 512 MB and no longer re-reads every transcript each minute (rerun /add-dashboard to get it).

🔒 Security

• /add-resend installs a Resend adapter with no known advisories. The pin moves from 0.1.1 (4 moderate findings through uuid) to 0.3.0, and /update-nanoclaw moves existing email installs to it (after a manual merge, rerun /add-resend). The webhook now answers before the message is processed, so a message that fails is not retried, and replies are sent as HTML with a plain-text part that drops link targets.
• Signal setup checks the signal-cli download's sha256 before installing it.
• OneCLI setup keeps keys off the command line. Setup now gives keys to the onecli CLI through a private temporary file or stdin, and hides them in error messages. If setup ever failed while saving your Anthropic key or OneCLI API key, rotate that key and delete the old files in logs/setup-steps/ and logs/setup.log.

🔧 For custom installations

• Custom container code that reads inbound.db through openInboundDb() or getInboundDb() (mailbox/sqlite/connection.ts) must use readInbound((db) => ...): openInboundDb() is gone, and getInboundDb() now works only in tests.
• /add-codex ships its provider inside the skill, so installs and forks no longer need the providers branch; on an older core its instructions tell you to update core first. Codex archives pick up core's header fix (the thread-id line no longer renders as a heading).
• Provider skills can archive exchanges through core. Use container/agent-runner/src/provider-contracts/exchange-archive.ts; refreshing /add-codex deletes the old copy in providers/exchange-archive.ts, so a custom provider that imports it must switch.
• A gateway credential can target one exact path on a host. The provider credential seam moves to version 2: a custom provider skill that requires exactly version 1 must accept 1 or later, a skill that sets path must require 2, and a custom gateway must declare connectionPaths: true to accept path-scoped credentials.
• The agent image no longer installs cron-parser or its luxon dependency (about 4.9 MB); scheduling still runs on the host. Custom container code that imported them must add them back.
• Forks that pointed the versions.json agent-image pin at their own mirror must move that reference to NANOCLAW_AGENT_IMAGE_REF, because the agent-images.json list now comes first.
• Forks no longer run the agent-image refresh workflow, which failed every 6 hours outside nanocoai/nanoclaw.
• OpenCode: OPENCODE_NATIVE_ATTACHMENT_MAX_BYTES and OPENCODE_NATIVE_ATTACHMENT_MAX_COUNT are gone; they never took effect.

New Contributors

• @dependabot[bot] made their first contribution in #4066
• @bmultini made their first contribution in #4081
• @patrick-hofmann made their first contribution in #1938
• @refactornator made their first contribution in #1604
• @NechuBM made their first contribution in #4086
• @shachartal made their first contribution in #3570
• @carstenf made their first contribution in #4117
• @witek made their first contribution in #3451
• @nanoclaw-image-refresh[bot] made their first contribution in #4179

Contributors

Thanks to everyone who landed work in this release:

• build(deps): bump source-map-js from 1.2.1 to 1.2.2 by @dependabot[bot] in #4066
• chore(container): bump Claude Code to 2.1.296, the Agent SDK to 0.3.296 and Codex to 0.162.1 by @gavrielc in #4069
• feat(permissions): a decline can skip the owner FYI by @amit-shafnir in #4070
• fix(approvals): approval card joins the requester's thread in their own chat by @amit-shafnir in #4080
• fix(agent-runner): never lose or repeat a reply around send_message by @glifocat in #3918
• build(deps-dev): bump vitest from 4.1.4 to 4.1.11 by @dependabot[bot] in #4067
• test(update-skills): isolate registry-remote env overrides by @bmultini in #4081
• ci: pin workflow runners to ubuntu-26.04 by @glifocat in #4085
• test(setup): keep channel-skill fixtures out of the checkout by @glifocat in #4087
• fix(setup): bump signal-cli to 0.14.9 and verify the download by @glifocat in #4093
• build(deps-dev): clear 11 dev-only Dependabot alerts by @glifocat in #4089
• chore(agent-runner): drop unused cron-parser dependency by @glifocat in #4088
• fix(sweep): global env overrides for ABSOLUTE_CEILING_MS and CLAIM_STUCK_MS by @glifocat in #3646
• chore(skills): bump the Resend adapter pin to 0.3.0 by @glifocat in #4042
• fix(cross-session-context): the agent's own replies from other threads read as "you" by @amit-shafnir in #4092
• feat: create agents from templates in chat by @amit-shafnir in #4112
• feat(setup): the template library picker reads the index by @amit-shafnir in #4113
• fix(templates): a template create skips a folder an unspawned group holds by @amit-shafnir in #4120
• fix(agent-runner): retry inbound.db reads caught mid host write by @amit-shafnir in #4118
• fix(router): send the command-gate denial without writing outbound.db by @amit-shafnir in #4119
• fix: include /opt/homebrew/bin in launchd plist PATH by @patrick-hofmann in #1938
• fix(agent-runner): set busy_timeout before journal_mode on outbound open by @glifocat in #4101
• ci: check the signal-cli hash and open an issue for new releases by @glifocat in #4096
• fix: include Homebrew and node paths in service PATH by @refactornator in #1604
• fix(add-dashboard): read transcripts without loading whole files by @NechuBM in #4086
• ci(stale): add author-blocked stale policy; closing stays in dry run by @glifocat in #3656
• fix(setup): score the agent's failure notice as a failed first chat by @glifocat in #3980
• fix(approvals): keep untrusted text on one line in approval cards by @glifocat in #4090
• fix(channels): bump chat core + adapters to 4.41.1 — Telegram drops URLs with odd underscore counts by @shachartal in #3570
• feat(container): pull the hardened image published for each release by @amit-shafnir in #4139
• fix(approvals): post long approval cards in full as text blocks by @glifocat in #4135
• feat(gateways): let a credential connection target one path by @glifocat in #4106
• feat(agent-runner): add a shared exchange archive for provider contracts by @glifocat in #4105
• fix(cli): clear host rows and refresh destinations in ncl groups delete by @glifocat in #4110
• feat(skills): add /add-cursor with its own payload by @glifocat in #4107
• fix(interactive): stop waiting when a question card cannot be delivered by @glifocat in #4141
• fix(approvals): quote untrusted text in the remaining approval cards by @glifocat in #4136
• feat(setup): wait longer for the first reply and show its stages by @glifocat in #4108
• fix(codex): give gateway stand-ins the real ChatGPT workspace id by @glifocat in #4133
• feat(add-codex): ship the Codex runtime from the skill payload by @glifocat in #4104
• agent-images: list the v2026.10.0 hardened image by @amit-shafnir in #4149
• ci: open the agent-images.json PR for each promoted image, as the refresh App by @glifocat in #4010
• chore(release): v2026.10.1-rc.1 by @glifocat in #4158
• docs: provider code ships in skill payloads, not the providers branch by @glifocat in #4109
• ci: run the image refresh only in nanocoai/nanoclaw by @glifocat in #4157
• fix(cli): cascade dependent rows in ncl messaging-groups delete by @glifocat in #4103
• fix(agents): refuse a new agent whose group folder is invalid by @amit-shafnir in #4148
• fix(skills): clear messaging-group dependents in add-imessage removal by @glifocat in #4102
• fix(discord): Approve clicks recorded as reject (custom_id value suffix not stripped) by @carstenf in #4117
• fix(add-gchat): ask for the endpoint URL and project number by @glifocat in #4100
• fix(update-skills): attribute a barrel import to the skill that appends it by @witek in #3451
• agent-images: v2026.10.0 -> v2026.10.0-20261021T1608 by @nanoclaw-image-refresh[bot] in #4179
• fix(setup): accept Anthropic's newer API key types (sk-ant-usr, sk-ant-svc) by @glifocat in #4161
• refactor(add-opencode): drop the unreachable attachment file-part path by @glifocat in #4172
• fix(webhook): listen on 127.0.0.1 by default, add WEBHOOK_HOST by @glifocat in #4185
• fix(egress): apply lockdown to agents already running when it is turned on by @glifocat in #4160
• fix(container): add poppler-utils so Claude agents can read PDFs by @glifocat in #4174
• fix(host): stage attachments for message ids that contain '/' by @glifocat in #4170
• feat(add-onecli): OneCLI 1.45 grants; new groups get only their model credential by @glifocat in #4094
• fix(security): require Node's October 2026 security releases in setup and the agent image by @glifocat in #4183
• feat(add-dial-tool): scope Dial with OneCLI agent grants by @glifocat in #4095
• fix(add-dial-tool): one OneCLI project for the key and its grants; safe group names by @glifocat in #4189
• fix(onecli): don't pass secrets on the command line; redact failed-command errors by @glifocat in #4187
• chore(release): v2026.10.1-rc.2 by @glifocat in #4190

Full Changelog: v2026.10.0...v2026.10.1-rc.2