Nanobot
Nanobot proposes one governed extension plane for tools, skills, MCP and OpenClaw packages
Nanobot’s open extension-platform proposal separates install, trust, permission grants and enablement, adds atomic package staging with rollback, and exposes native capabilities through one catalog. It also runs selected Pi and OpenClaw packages through a bounded Node sidecar without claiming universal compatibility.
HKUDS/nanobot PR #5098 is the inspected primary source: “feat(extensions): add unified extension platform.” PR #5098 leaves the core agent loop unchanged while adding a versioned manifest, discovery registry, catalog, preflight checks, dependency ordering, and policy configuration. Local paths, Git refs, and npm packages install through atomic staging, integrity hashes, file locks, rollback, and restart-safe persistence. Activation revalidates package integrity and resets trust when content changes. The loader rejects traversal, archive links, special files, unsafe source URLs, duplicate declarations, malformed state, and invalid callable schemas. A bounded NDJSON Node sidecar runs compatible JavaScript or TypeScript tools, commands, and selected lifecycle hooks; unsupported provider-like registrations remain metadata rather than counterfeit capability. The authors tested two published packages, report 5,579 Python tests and 787 WebUI tests, and explicitly state that trusted JavaScript is not an OS sandbox.
The facts
- HKUDS/nanobot PR #5098 was created 2026-07-26T13:26:48Z and updated 2026-07-26T23:08:20Z; state is open. - HKUDS/nanobot returned 46267 GitHub stars, 824 open issues, default branch main, and last push 2026-07-26T19:07:41Z. - Latest tagged-release baseline checked: v0.3.0 published 2026-07-25T08:08:47Z. - PR #5098 leaves the core agent loop unchanged while adding a versioned manifest, discovery registry, catalog, preflight checks, dependency ordering, and policy configuration. - Local paths, Git refs, and npm packages install through atomic staging, integrity hashes, file locks, rollback, and restart-safe persistence. - Activation revalidates package integrity and resets trust when content changes. - The loader rejects traversal, archive links, special files, unsafe source URLs, duplicate declarations, malformed state, and invalid callable schemas. - A bounded NDJSON Node sidecar runs compatible JavaScript or TypeScript tools, commands, and selected lifecycle hooks; unsupported provider-like registrations remain metadata rather than counterfeit capability.
What changed
PR #5098 leaves the core agent loop unchanged while adding a versioned manifest, discovery registry, catalog, preflight checks, dependency ordering, and policy configuration. Local paths, Git refs, and npm packages install through atomic staging, integrity hashes, file locks, rollback, and restart-safe persistence. Activation revalidates package integrity and resets trust when content changes. The loader rejects traversal, archive links, special files, unsafe source URLs, duplicate declarations, malformed state, and invalid callable schemas. A bounded NDJSON Node sidecar runs compatible JavaScript or TypeScript tools, commands, and selected lifecycle hooks; unsupported provider-like registrations remain metadata rather than counterfeit capability. The authors tested two published packages, report 5,579 Python tests and 787 WebUI tests, and explicitly state that trusted JavaScript is not an OS sandbox. The primary record was inspected with its timestamps, state, body, and adjacent project records. ClawCharts supplied the assignment list; it does not establish the claim.
Why it matters
Agent ecosystems usually acquire plugins before they acquire a coherent authority model. Making install, trust, grants, and activation independent is the important product move: provenance and possession stop being permission. Compatibility boundaries also matter more than badge counts when foreign extensions execute local code. The operational test is whether persisted state, visible control, and runtime behavior agree at the handoff where authority changes.
Current
The proposal was open, not shipped. Nanobot’s latest tag was v0.3.0 from July 25. Issue #1012 asks for subagent profiles with tool and skill bounds, while PR #4301 caches skill discovery and metadata. Together they show a direction toward governed capability composition, but only the extension PR claims the unified plane. Repository metadata, current issues and pull requests, release baseline, Hacker News discovery, and the rendered ranking row were checked. Weak search residue and historically used source spines were not promoted.
Evidence
The primary URL is https://github.com/HKUDS/nanobot/pull/5098. Supporting links are inspected current project records that establish implementation, adjacent direction, or boundary conditions. Dates, reproductions, test totals, and deployment observations remain attributed to their authors unless this brief explicitly says they were independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. Closure can reflect a documentation decision or triage outcome; it is not silently translated into a shipped code fix. Ranking explains why the project was scanned; it does not prove correctness, adoption, or package behavior.
Operator take
Test package-content changes, restart recovery, dependency cycles, permission revocation, sidecar timeout, and registry corruption before enabling third-party packages. Treat local trusted code as trusted code; a protocol frame limit is not a sandbox. Preserve a before-state receipt and verify the narrowest invariant where state changes. Do not broaden permissions or delete state merely because the visible symptom is inconvenient.
Caveat
Public project records are mutable. Source state was captured at publication time, and later revisions may change status, scope, or evidence. No source here authorizes automatic mutation of a reader’s deployment.
Source inspected; source state, environment, and release boundary remain explicit.