Nanobot
Nanobot hardens credential, shell and history boundaries
Nanobot keeps credential-bearing URLs away from a remote reader, expands shell-path guards to cover redirection and grouping syntax and moves session history outside the agent workspace. The cluster redraws three places where convenience could cross a trust boundary.
HKUDS/nanobot PR #5258 is the inspected primary source: “fix(web): keep credential-bearing URLs away from the remote Jina reader.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- HKUDS/nanobot PR #5258 was created 2026-08-05T12:59:25Z and was closed at inspection; its title is “fix(web): keep credential-bearing URLs away from the remote Jina reader.” - HKUDS/nanobot PR #5218 was created 2026-08-03T04:55:03Z and was closed at inspection; its title is “fix(tools): treat redirection and grouping delimiters in ExecTool path guard.” - HKUDS/nanobot PR #5279 was created 2026-08-07T02:49:14Z and was closed at inspection; its title is “fix(session): store session history outside the agent workspace.” - The repository reported 46901 stars, 699 open issues, default branch main, and last push 2026-08-12T18:07:37Z. - The latest tagged-release baseline checked was v0.3.0 published 2026-07-25T08:08:47Z.
What changed
HKUDS/nanobot PR #5258 reports: Summary keep credential-bearing URLs away from the remote Jina reader: userinfo and token/signature-style query parameters are fetched through the existing local readability path inspect the complete local redirect chain before allowing the original URL to be forwarded, so a plain short URL cannot hide a signed or token-bearing redirect strip fragments before forwarding and treat both & and legacy; query separators as credential boundaries redact WebFetch diagnostics to the URL origin and exception type, keeping userinfo, paths, queries, fragments, and exception-carried request URLs out of logs document that the remote reader receives ordinary URLs and that useJinaReader: false is required when every URL must remain local Root cause WebFetchTool.execute() validates URLs against the SSRF guard, but _fetch_jina() then forwards the complete user URL to a third-party service. Query-string credentials and signed URLs could therefore be disclosed to that service. The first guard also needed to cover credential-bearing redirects and every error-log path, otherwise the same URL could still be disclosed locally through diagnostics. Design notes matching is by decoded, case-insensitive parameter name and is
HKUDS/nanobot PR #5218 reports: Summary When restrict_to_workspace=True, ExecTool extracts local absolute paths from shell commands and rejects paths outside the workspace. The previous POSIX expression missed paths adjacent to redirection/grouping operators, while simply widening that expression truncated valid quoted or escaped punctuation and misclassified remote/URL strings. This change makes path extraction shell-token aware and keeps the workspace boundary fail-closed. What changes Parses shell grouping and redirection boundaries with shlex, including glued forms such as cat</outside/file. Preserves quoted and escaped spaces, parentheses, commas, and other punctuation that are part of a real path. Recursively checks command strings passed through -c, -lc, and --command. Keeps malformed quoting conservative instead of silently skipping path checks. Avoids treating HTTPS URLs, URL query values, scp-style host:/path, or the POSIX suffix of C:/Windows as local POSIX paths. Treats decoded file:// URIs as local filesystem access and applies the same workspace boundary. Continues to block POSIX double-slash absolute paths. Compatibility Existing POSIX absolute paths, home paths, Windows drive paths, UNC paths, and valid paths inside the workspace retain their behavior. The added cases either close a
HKUDS/nanobot PR #5279 reports: Summary Closes the session-history reachability problem raised in #5278. Session transcripts currently live under /sessions/, inside the same filesystem boundary exposed to workspace-scoped agent tools. This change stores transcripts under /sessions/ / instead, while keeping each workspace isolated. What changes Uses an opaque, stable workspace identity so sessions survive workspace renames and moves; copied live workspaces receive a separate identity. Keeps custom --config and Python SDK instances in their own config data directory rather than the process-global default. Migrates existing in-workspace JSONL sessions with a locked copy, fsync, digest verification, and source stability check before removing the old copy. Preserves both versions of a conflicting valid session and selects the newest one instead of silently overwriting data. Fails closed for symlinked state, namespace, and migration paths. Recovers a deleted workspace identity marker when its external namespace can be identified safely. Adds nanobot sessions restore-workspace to copy canonical sessions back before an explicit downgrade, without deleting the external store. Upgrade and rollback Stop all processes using the workspace before upgrading. The first start migrates existing /sessions/*.jsonl
Why it matters
A reader proxy, shell parser and workspace are all authority surfaces. Treating them as neutral plumbing lets credentials leave the host, path guards miss compound commands or session history become editable task material. The operator test is whether visible output, retained state and authority still describe the same event after retries, background work or restart.
Current
The primary record was closed when captured on 2026-08-13. The tagged-release baseline was v0.3.0 published 2026-07-25T08:08:47Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/HKUDS/nanobot/pull/5258. Supporting records are https://github.com/HKUDS/nanobot/pull/5218 and https://github.com/HKUDS/nanobot/pull/5279. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Strip credentials before any remote fetch, parse command structure rather than substrings, and keep conversation state in a store the agent workspace cannot rewrite. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.