Nanobot
Nanobot puts plugins, computer use and chat sandboxes on one boundary
Nanobot proposes portable Agent Plugin packages for skills, opt-in browser and desktop tools, and per-session filesystem sandboxes for non-WebUI channels. Each stays disabled or narrow by default; together they define how new capability enters a multi-chat agent without silently sharing process, network or files.
HKUDS/nanobot PR #5288 is the inspected primary source: “feat(plugins): integrate Agent Plugins with CLI Apps.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- HKUDS/nanobot PR #5288 was created 2026-08-07T12:24:18Z and was open at inspection; its title is “feat(plugins): integrate Agent Plugins with CLI Apps.” - HKUDS/nanobot PR #4276 was created 2026-06-10T09:53:17Z and was open at inspection; its title is “feat(tools): model-agnostic computer use (computer_use + browser tools).” - HKUDS/nanobot PR #5283 was created 2026-08-07T06:06:32Z and was open at inspection; its title is “feat(workspace): per-session sandbox isolation for non-WebUI channels.” - The repository reported 46749 stars, 787 open issues, default branch main, and last push 2026-08-08T00:38:09Z. - The latest tagged-release baseline checked was v0.3.0 published 2026-07-25T08:08:47Z.
What changed
HKUDS/nanobot PR #5288 reports: Why Agent Plugins v1 is a vendor-neutral package format for portable Agent Skills and MCP servers. nanobot already has a CLI Apps catalog backed by CLI-Anything, but those installs previously wrote an ad hoc workspace skill. Using one package boundary keeps manual plugins and catalog-installed apps on the same discovery path. References: https://agent-plugins.org/specification https://github.com/HKUDS/CLI-Anything What changed discover Agent Plugins v1 packages under /plugins/* validate root plugin.json metadata and direct-child skills/*/SKILL.md enforce resolved-path containment for plugin packages and skills preserve deterministic precedence: workspace skills, plugin skills, built-ins expose plugin skills through the existing catalog, progressive loading, and $skill-name invocation package CLI Apps installed from the WebUI as conformant skills-only Agent Plugins normalize catalog skill identity, migrate the legacy workspace-skill path, and remove the package on uninstall refresh plugin discovery when skills are listed, so installs and removals are visible without restarting nanobot document the package layout and CLI Apps boundary Boundary This PR supports the portable
HKUDS/nanobot PR #4276 reports: What Adds opt-in computer control as native nanobot tools: computer_use — screenshot plus mouse and keyboard control through either a desktop PyAutoGUI backend or a Playwright browser backend. browser — DOM automation by stable element refs, so ordinary tool-calling models do not need to guess pixel coordinates. Original implementation by @LarFii. The original authored commit remains intact; the follow-up maintainer commit adapts it to current main. Current-main integration Uses the existing multimodal provider pipeline. Chat Completions image normalization stays at the OpenAI-compatible provider boundary; runner.py is untouched. Shares one lazy Chromium process per enabled tool while isolating each nanobot session in its own browser context. Closes browser contexts and processes through the existing tool-registry shutdown edge. Keeps both tools out of subagent scope. Safety Both tools are disabled by default. Browser navigation, redirects, subresources, and WebSockets pass through the shared SSRF policy. allowedDomains restricts top-level navigation; private, loopback, link-local, metadata, and unsupported URL targets are
HKUDS/nanobot PR #5283 reports: What Adds an opt-in per_session_sandbox mode: each non-WebUI session gets its own isolated filesystem sandbox under /workspaces/ /, created lazily on the first turn and operated in **restricted** mode so agent file tools stay within that directory. Sessions no longer share a single global workspace. Why For multi-tenant / multi-chat deployments (IM channels etc.), a single shared workspace means sessions can trample each other's files. This gives each session an automatic, isolated working directory without manual project selection — while leaving WebUI's manual project picker untouched. How to enable Default off; existing behavior unchanged. Behavior **Default off** → zero behavior change (regression-protected). **On, non-WebUI channel** → lazily creates /workspaces/ /, restricted mode, agent file ops confined there. **WebUI (websocket)** → keeps manual project selection, unaffected. **No-session messages (system, etc.)** → safely degrades to default workspace. **Session history** (sessions/) stays on the data-home root — preserves the data-home / sandbox role separation. Changes nanobot/security/workspace_access.py — WorkspaceScopeResolver
Why it matters
Extension packaging is not the security boundary. The useful part is that package discovery, network policy, browser context and workspace scope are being specified as separate controls with explicit gaps. The operator test is whether the visible result, retained state and authority still describe the same event after retries, background work or restart.
Current
The primary record was open when captured on 2026-08-08. The release baseline was v0.3.0 published 2026-07-25T08:08:47Z. Repository metadata, source bodies, pull requests, issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/HKUDS/nanobot/pull/5288. Supporting records are https://github.com/HKUDS/nanobot/pull/4276 and https://github.com/HKUDS/nanobot/pull/5283. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Keep MCP process launch behind approval, use OS network isolation for hostile pages, add sandbox cleanup, and test two concurrent sessions for cross-file and cross-browser leakage. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.