ZeroClaw makes agents portable without loosening workspace authority

zeroclaw-labs/zeroclaw PR #9986 is the inspected primary source: “feat(agents): export an agent to a portable bundle.” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- zeroclaw-labs/zeroclaw PR #9986 was created 2026-08-13T23:57:19Z and was open at inspection; its title is “feat(agents): export an agent to a portable bundle.” - zeroclaw-labs/zeroclaw PR #9981 was created 2026-08-13T18:20:18Z and was open at inspection; its title is “feat(runtime): report the active shell dialect in the system prompt.” - zeroclaw-labs/zeroclaw PR #9977 was created 2026-08-13T17:04:58Z and was open at inspection; its title is “fix(tools): confine filesystem mutations to workspace.” - The repository reported 32569 stars, 698 open issues, default branch master, and last push 2026-08-13T21:53:47Z. - The latest tagged-release baseline checked was v0.8.4 published 2026-08-02T21:00:00Z.

What changed

zeroclaw-labs/zeroclaw PR #9986 reports: Summary **Base branch:** master (all contributions) **What changed and why:** Adds zeroclaw agents export --out, which writes a portable *agent bundle*: a manifest, the config closure that agent needs, and its workspace tree. Moving an agent between installs is currently a manual hand-copy of config fragments, which is exactly the operation where a credential or an over-permissive risk profile travels by accident. Puts the closure resolution and credential scrubbing in zeroclaw-config::agent_bundle as a pure function of &Config with no I/O, so the security-relevant half is unit-testable without a filesystem. src/alias_cli/export.rs is the I/O half (write files, copy workspace, report to the operator). Resolves granted MCP servers through the existing Config::mcp_servers_for_bundles rather than re-deriving a union, so a bundle's exclude keeps winning exactly as it does at runtime. Single source of truth for "what can this agent actually reach". Scrubs every #[secret] leaf via the schema's own mask_secrets, emits the paths under required_secrets in the manifest, and **aborts the export** if enc:/enc2: ciphertext survives into the closure. The scrub is verified, not assumed. Reports rather than silently omits: configuration that cannot travel lands in a dropped list with reasons, and

zeroclaw-labs/zeroclaw PR #9981 reports: Summary **Base branch:** master **What changed and why:** The system prompt named the OS family but never the shell, so on Windows the model could not tell cmd.exe from PowerShell and guessed per turn. Since #9182 made runtime.shell = "powershell" a real choice, both dialects are genuinely reachable and the OS string narrows nothing. The failure is quiet: a dialect mismatch fails on syntax, reads like an ordinary command error, and the model retries in the same wrong dialect. ## Runtime now carries Shell:, read from the runtime adapter that builds the command, so the reported shell cannot drift from the executed one. Shell-less runtimes omit the field entirely. A ## Shell section lists the command forms the dialect accepts (list / read / find / search). It renders when a registered tool takes a model-authored command — shell, cron_add, cron_update, schedule — because the cron and schedule tools take a command argument that runs through the same interpreter and the same dialect validation. POSIX gets the name and no list; its tool names are already what the model reaches for. Safety's deletion advice follows the dialect. trash is

zeroclaw-labs/zeroclaw PR #9977 reports: Summary **Base branch:** master (all contributions) **What changed and why:** Bind backup, retention, and file-write traversal to directory capabilities so symlink swaps cannot redirect later operations outside the authorized policy boundary. Validate backup names and trees before verify or restore, preserve retained file modes during atomic replacement, and refuse symlink traversal. Authorize file-write parents before creating directories, and require direct action and path-policy checks for backup and confirmed retention mutations. Stage retention deletions with no-replace renames so a changed candidate can be rejected or rolled back without overwriting a recreated path. **Scope boundary:** This PR does not change the security-policy schema, add a feature flag, make multi-file restore or purge transactional, or adopt the broader sandbox-policy design in #7821. **Blast radius:** Built-in backup, data_management, and file_write tool behavior; runtime construction of backup and retention tools; filesystem error text; target-specific file replacement and purge availability. **Linked issue(s):** None. Related PR: #7821. **Labels:** bug, dependencies, domain:security, risk:high, runtime, size:XL, tool, tool:file Testing (required) How you can test (when useful) **Reviewer testing requested?** N/A — focused automated tests exercise action-policy denial, symlink, hard-link, rollback, retained permissions, and pre-mutation rejection boundaries directly; per-candidate path

Why it matters

A bundle is not portable if shell assumptions change silently, and it is not safe if imported tools can mutate arbitrary host paths. Migration needs both environment truth and constrained authority. The operator test is whether visible state, retained state and authority still describe the same event after retries, switching or restart.

Current

The primary record was open when captured on 2026-08-14. The tagged-release baseline was v0.8.4 published 2026-08-02T21:00:00Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/zeroclaw-labs/zeroclaw/pull/9986. Supporting records are https://github.com/zeroclaw-labs/zeroclaw/pull/9981 and https://github.com/zeroclaw-labs/zeroclaw/pull/9977. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Version bundle metadata, declare shell semantics explicitly and verify imported agents against a fresh workspace with mutation attempts outside the boundary denied. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.