ZeroClaw
ZeroClaw confines shell state to the agent that owns it
ZeroClaw’s per-agent environment proposal gives each shell a workspace-confined HOME; related work makes skill activation provider-aware and projects each agent’s backend and memory count in the dashboard. The common move is from global runtime state to explicit agent ownership.
zeroclaw-labs/zeroclaw PR #9875 is the inspected primary source: “feat(agents): per-agent env vars and workspace-confined HOME for the shell tool.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- zeroclaw-labs/zeroclaw PR #9875 was created 2026-08-10T00:06:18Z and was open at inspection; its title is “feat(agents): per-agent env vars and workspace-confined HOME for the shell tool.” - zeroclaw-labs/zeroclaw PR #8965 was created 2026-07-11T05:24:00Z and was open at inspection; its title is “feat(skills): declarative auto-activation with provider switch and image-turn tool blocking.” - zeroclaw-labs/zeroclaw PR #9069 was created 2026-07-14T14:00:21Z and was open at inspection; its title is “fix(dashboard): per-agent backend + memory count (stack 7/7).” - The repository reported 32544 stars, 705 open issues, default branch master, and last push 2026-08-09T14:26:56Z. - The latest tagged-release baseline checked was v0.8.4 published 2026-08-02T21:00:00Z.
What changed
zeroclaw-labs/zeroclaw PR #9875 reports: Summary **Base branch:** master **What changed and why:** Adds [agents..env] so we can inject explicit KEY=VALUE pairs into an agent's subprocesses. Today the only option is risk_profiles..shell-env-passthrough, but the values always come from the daemon's env, so there is no way to give an agent a different value from the daemon. Adds env.home_mode so an agent's HOME can be confined to its own workspace. Previously every agent's spawned tools shared the daemon's real HOME, so git, npm, etc. used dotfiles and caches in the user's home directory, and were subject to all of the filesystem access restrictions there. Adds both onto SecurityPolicy (env_vars, home_override) rather than into ShellTool directly, so the other spawn-based tools can adopt them later without reworking config. Extends ensure_no_escalation_beyond in both directions: a delegated subagent cannot add or retarget an env var its parent didn't grant, and cannot _drop_ a HOME confinement its parent set (dropping it falls back to the real $HOME, so None is the least-confined value, not a neutral one). Adds SecurityPolicy::rebind_workspace and routes bounded delegation
zeroclaw-labs/zeroclaw PR #8965 reports: **This branch is stacked on #9563 and must be rebased once that lands.** One review warning is answered with a proposal rather than a change; see "Open review items". Split status Per the review request to separate the channel/media repair from the feature, this branch is two commits with two independent rollback units: | Commit | Content | Reviewable as | |---|---|---| | 8b9b2b5f, bce33ddc, 7775f0b5 | typed media envelope from Telegram, media classification, pipeline dedup | **#9563**, open separately against master | | 6b602065, da616a7d | declarative skill auto-activation | this PR | The media commits are the parent of the activation commits, so the dependency runs one way and the two review cleanly in sequence. This branch is rebased onto #9563's current head, so it carries that PR's review fixes too, and the whole stack is rebased onto current master. It was 135 commits behind and conflicting, which is why CI had stopped running on it. GitHub cannot express the stack as a base-branch pointer here: a cross-fork PR's base must exist in
zeroclaw-labs/zeroclaw PR #9069 reports: **Update (2026-08-03):** This head was re-cut and rebased onto current master. The count/error semantics changed in response to review: a failed handle now reports a **distinct unavailable state** (not a misleading 0), an unknown?agent= alias is **rejected with 404** (not silently answered with install-wide data), and the label and count are derived from **one** resolved handle. The identity-shaped test fixture alias was replaced with a neutral placeholder (user_a). Every statement below describes this exact head. Summary **Base branch:** master (all contributions) **What changed and why:** Part 7/7 (final) of the Hindsight memory stack - the dashboard/status slice. The dashboard memory count now dispatches to each agent's **active per-agent backend**, so a hindsight agent's own bank total is reported instead of a bucketed 0, and the reported backend label is the real per-agent backend. **What changed and why (one handle for label and count):** memory_backend (via Memory::name()) and memory_count are derived from the **same resolved handle**. Previously an install-wide Hindsight fallback combined with a default per-agent enum could render a sqlite label next to a
Why it matters
Per-agent configuration is cosmetic if shell HOME, tool activation and operator telemetry still collapse into one process-wide bucket. Isolation needs to survive all three surfaces. The operator test is whether visible output, retained state and authority still describe the same event after retries, background work or restart.
Current
The primary record was open when captured on 2026-08-10. The tagged-release baseline was v0.8.4 published 2026-08-02T21:00:00Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/zeroclaw-labs/zeroclaw/pull/9875. Supporting records are https://github.com/zeroclaw-labs/zeroclaw/pull/8965 and https://github.com/zeroclaw-labs/zeroclaw/pull/9069. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Resolve environment at the final tool boundary, block incompatible tools before model dispatch, and verify the dashboard reports the same backend and memory owner the runtime used. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.