NanoClaw turns agent templates into versioned plugins

nanocoai/nanoclaw PR #3220 is the inspected primary source: “feat!: agent templates become Agent Plugins 1.0.0 directories.” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- nanocoai/nanoclaw PR #3220 was created 2026-08-10T07:25:49Z and was open at inspection; its title is “feat!: agent templates become Agent Plugins 1.0.0 directories.” - nanocoai/nanoclaw PR #3227 was created 2026-08-10T18:01:34Z and was open at inspection; its title is “refactor(host): declare single-writer file surfaces instead of inferring them.” - nanocoai/nanoclaw PR #3216 was created 2026-08-09T23:02:22Z and was closed at inspection; its title is “docs(hardened-image): note that install_packages covers apt and npm only.” - The repository reported 30485 stars, 882 open issues, default branch main, and last push 2026-08-10T22:06:05Z. - The latest tagged-release baseline checked was v2.1.54 published 2026-08-01T20:46:31Z.

What changed

nanocoai/nanoclaw PR #3220 reports: Type of Change [x] **Fix** - bug fix or security fix to source code (stamp-time symlink/caps/secret hardening) No template box fits the main shape: this is an engine change to the template feature (a format migration), not a skill. Fix is ticked for the security half; the rest is feature work on src/templates/. Description Problem.** Templates are a homemade folder format (context/instructions.md as the discovery marker,.mcp.json). They are portable to nothing, and the stamp path has real holes today: cpSync follows symlinks out of the template (a template shipping a symlink to ~/.ssh copies its contents into the group workspace), there are no size caps, and skill folders are never inspected. Change.** Templates become Agent Plugins 1.0.0 directories (flag-day; the legacy layout is detected only to emit a re-fetch migration error). plugin.json is the required manifest and discovery marker, validated against the published schema with the spec's exact fatal/non-fatal split. Skills and mcp.json follow the spec's per-component failure boundaries: skip + named report, never silently stripped. Everything NanoClaw-specific (persona, extra context, paused tasks, display

nanocoai/nanoclaw PR #3227 reports: refactor(host): declare single-writer file surfaces instead of inferring them Branch: hygiene/host-file-access (1 commit, based on main @ 5bfdf9af) Type of Change [x] **Simplification** — reduces or simplifies source code What The host and its agent containers share a filesystem. The session folder is mounted at /workspace, the group folder at /workspace/agent, and inside those trees ownership has always been one-directional: the host writes inbox/, inbound.db and tasks/; the container writes outbox/ and outbound.db; each side reads the other's. None of that was written down anywhere the runtime could act on. The mount table handed the container one writable view of each tree and left the finer structure implied, so every accessor re-established the split for itself — and did it differently. session-manager.ts checks one way, agent-route.ts another, group-init.ts a third, and several sites do not check at all because at that call site it never looked like there was anything to check. This PR states the split once, in the mount table, and lets the accessors stop restating it. How it works Mounts.** Each single-writer

nanocoai/nanoclaw PR #3216 reports: What Documents an existing limitation in the hardened-image guide: install_packages reaches apt and npm packages only (packages_apt, packages_npm). Why The guide presents install_packages as the answer to "Custom Dockerfile edits — replaced on the next refresh", but never states its scope. That reads as though anything a custom Dockerfile installed can be layered back on after switching to the pulled image. For a Dockerfile that installs by any other route, it can't. I hit this evaluating the switch on an install whose Dockerfile adds python3/pip packages (yt-dlp, youtube-transcript-api) that several agent groups depend on. There is no pip channel in the container config, so those packages can't be restored through the derived image — the switch would have quietly broken those groups. The derived-image path also can't help indirectly, since a refresh clears the pins and returns the group to the shared image. Change install_packages row in the "What changes" table → install_packages (apt and npm only) One paragraph after the derived-image explanation naming the cases that fall outside it (pip, curl | sh vendor

Why it matters

A plugin contract is credible only when the host knows who may write each file and which package managers exist inside the image. Version labels without ownership rules merely give drift a nicer directory name. The operator test is whether visible output, retained state and authority still describe the same event after retries, background work or restart.

Current

The primary record was open when captured on 2026-08-11. The tagged-release baseline was v2.1.54 published 2026-08-01T20:46:31Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/nanocoai/nanoclaw/pull/3220. Supporting records are https://github.com/nanocoai/nanoclaw/pull/3227 and https://github.com/nanocoai/nanoclaw/pull/3216. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Register module lifecycle and writers centrally, reject overlapping file claims, and make unsupported package installation fail before an agent edits host state. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.