Nanobot
Nanobot turns session history into a bounded reference surface
Nanobot proposes cross-session search and mentions that pass a stable session key to read-only tools instead of injecting another transcript automatically. Related WebUI work accelerates JSONL session loading and adds trusted-proxy bootstrap authentication, making session discovery useful without making every chat globally visible by accident.
HKUDS/nanobot PR #5210 is the inspected primary source: “feat(webui): support trusted proxy bootstrap auth.” The two related records below were inspected as supporting context, not treated as independent confirmation.
The facts
- HKUDS/nanobot PR #5210 was created 2026-08-01T15:22:47Z and was open at inspection; its title is “feat(webui): support trusted proxy bootstrap auth.” - HKUDS/nanobot PR #5194 was created 2026-07-31T14:42:30Z and was open at inspection; its title is “perf(webui): accelerate JSONL session list and thread loading.” - HKUDS/nanobot PR #5211 was created 2026-08-01T15:48:02Z and was open at inspection; its title is “feat(session): add cross-session search and mentions.” - The repository reported 46502 stars, 774 open issues, default branch main, and last push 2026-08-01T16:34:50Z. - The latest tagged-release baseline checked was v0.3.0 published 2026-07-25T08:08:47Z.
What changed
HKUDS/nanobot PR #5210 reports: Summary Adds an opt-in trusted upstream-proxy authentication path for /webui/bootstrap, for deployments such as Cloudflare Tunnel + Cloudflare Access. Trusted-proxy mode is intentionally tokenless: Requires both the direct TCP peer to match explicitly configured IPv4/IPv6 CIDRs and a non-empty configured assertion header. Uses only connection.remote_address; forwarded client headers never establish trust. Requires assertionHeader to identify a proxy-generated authentication assertion. Routing/client metadata headers such as Host, Forwarded, X-Forwarded-*, X-Real-IP, and CF-Connecting-IP are rejected by configuration. The proxy assertion authenticates /webui/bootstrap, the WebSocket handshake, and REST API routes. Trusted-proxy bootstrap returns connection metadata only: no WebSocket bootstrap token, no REST api_token, and no token query parameter. Preserves
HKUDS/nanobot PR #5194 reports: Summary Reuse the WebUI activity directory and default workspace scope once per /api/sessions request. Cache the recognized workspace-scope snapshot in the rebuildable session-list index while keeping authority decisions on the active SessionStore. Bind index signatures to the snapshot actually scanned, so concurrent session saves cannot leave stale scope metadata cached. Load canonical session history for /webui-thread only when a legacy transcript needs missing-user backfill or an explicitly incomplete turn needs recovery. Parse each selected transcript chunk once per request and keep the active JSONL tail bounded at a measured 2 MiB / 1 MiB rotation target. Append new manifest metadata without reparsing archived segments during
HKUDS/nanobot PR #5211 reports: Summary add read-only search_sessions and read_session tools over persisted conversations let WebUI users type @ and select another chat in the existing mention palette group Nanobot conversations separately with natural titles and collision-safe mention names send a structured stable session key, validate it against SessionManager, and persist it for replay expose only a bounded reference to the model; the target transcript is read on demand with read_session Design boundaries no session mutation or delegated turns no automatic target-history injection no Dream, memory, compaction, or Quick Chat changes no database, embedding index, or global prompt historical content is bounded, runtime/private/tool records are filtered, and returned text
Why it matters
Cross-session recall is a product feature and an authorization boundary. Stable references, bounded reads and filtered runtime records are safer than pasting whole histories into a prompt, but proxy trust and index performance must agree with the same session scope. This is an operator boundary: persisted state, execution ownership and visible controls must describe the same event. A workaround that broadens access, deletes state or hides the symptom would trade a visible defect for an unmeasured one.
Current
The primary record was open when captured on 2026-08-02. The release baseline was v0.3.0 published 2026-07-25T08:08:47Z. Current repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/HKUDS/nanobot/pull/5210. Supporting records are https://github.com/HKUDS/nanobot/pull/5194 and https://github.com/HKUDS/nanobot/pull/5211. Their source bodies, timestamps and states were captured in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Issue closure would not by itself prove a deployed fix. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Verify authorization before search and read, treat returned history as untrusted data, bound scans on large JSONL stores, and only honor bootstrap identity from explicitly configured proxy addresses. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.