NanoClaw 2026.10.0-rc.2

NanoClaw 2026.10.0-rc.2 is the second release candidate for 2026.10.0, the first release with calendar version numbers and the first one /update-nanoclaw installs by default: updates now follow published releases instead of the tip of main. Installs on the beta channel get this candidate; stable stays on 2.4.0 until 2026.10.0 is published. Since 2026.10.0-rc.1 it pins the fixed WhatsApp library, holds OneCLI gateway upgrades on 1.42.0, stops macOS updates from failing when the service is slow to stop, and lets the agent browser load HTTPS pages behind Iron Proxy. It also makes updates and rollbacks more dependable, lets Iron Proxy reach a keyless local model over plain HTTP, routes the service through an outbound proxy when you have one, and shows Claude's own reason when a run fails. Iron Proxy installs need one setup rerun, so check the section below before you update.

Before you update

• [BREAKING] OneCLI installs: upgrade the OneCLI gateway to exactly 1.42.0, which closes a credential-injection bypass. /update-nanoclaw never upgrades a running gateway, so this step stops the update until it is done. Follow docs/onecli-upgrades.md in your install (the same guide on GitHub): its detect step says when it does not apply (Iron Proxy installs skip it); otherwise save 1.42.0 as the gateway version, upgrade, confirm that the running image is 1.42.0, and note the old version for its rollback step. Do not go past 1.42.0: OneCLI 1.43 and later break assigning credentials to agents and are not supported yet. New installs already get 1.42.0.
• /update-nanoclaw now installs the newest release, not the tip of main. The channel is set by NANOCLAW_UPDATE_CHANNEL in .env: stable (the default) follows releases, edge follows main as before, and beta takes release candidates when there are any. Your first update after this release still runs your current update steps, so it lands on the tip of main, which is this release only until new changes merge; from then on, updates follow the channel. An install that is already newer than the latest release is never moved back: the updater asks whether to keep following main or wait for the next release, and saves the answer. To choose yourself later, run pnpm exec tsx scripts/update-nanoclaw.ts set-channel --channel edge (or stable).
• Iron Proxy installs: rerun the Iron setup once after updating. It rebuilds the proxy on upstream v0.52.0 (expired proxy certificates are regenerated, host rules match case-insensitively), moves the approval bridge to @grpc/grpc-js 1.14.5 (fixes GHSA-m9gg-hp2v-232j and GHSA-f596-whhp-79r4), and lets git clone/fetch and the agent browser authenticate through the proxy. Run pnpm exec tsx .claude/skills/add-iron-proxy/scripts/setup.ts --with-control. The agent browser now trusts the gateway's certificate, so HTTPS pages behind Iron load: installs that build their own agent image get it from the image rebuild in /update-nanoclaw, while installs that pull the hardened image get it only with the next image (until then the browser stays broken there; the agent still starts). OneCLI installs need nothing.

New

• Updates follow release channels. Choose stable, beta or edge per install; the channel and the exact release are recorded in data/upgrade-state.json, so support can see what an install tracks.
• With Iron Proxy, a keyless model on the same machine works over plain HTTP. Enter http://host.docker.internal:<port>/v1 and restart; setup checks that the port answers like a model server, only that port and the OpenAI inference routes are reachable, and requests to it no longer ask for approval on every call. Models that need a key still need https:// on a public DNS name.
• The service can reach the internet through an outbound proxy. It now uses HTTPS_PROXY, HTTP_PROXY or ALL_PROXY and NO_PROXY from your setup shell or .env; a OneCLI gateway on a local address is added to NO_PROXY automatically. Needs Node 22.21+ or 24.5+, and setup warns if your Node ignores the proxy.
• A failed Claude run tells you why. For known failures such as an invalid API key, the chat shows Claude's short message (for example "Invalid API key Fix external API key") and who can fix it, instead of "The agent run failed".

Fixes

• /update-nanoclaw is more dependable. A failed update no longer deletes half of data/ when it rolls back: the snapshot is swapped in by rename, and if a restore still fails nothing is deleted and the error prints the commands that finish it. It works again from 2.4.0 (it stopped with "Cannot find module"), detects the installed gateway even when pnpm prints a warning, keeps Iron Proxy running across the update, and no longer reports success while the old service is still running. A rollback now stops the host that is actually running and stops agent containers before restoring your data. Updates that bring a new tsx or esbuild no longer crash at the end of cutover on installs with a gateway (the fix is in the update controller, so it covers the update that brings it). A fresh install can now be updated without manual commits: setup commits the files it adds as local setup: apply <skill> commits (set NANOCLAW_SETUP_COMMIT=0 to skip them). When an update changes only your gateway's skill files, it now refreshes the gateway's host code too.
• Claude turns are cheaper again. New Claude groups no longer default to the Concise output style, which stopped the prompt cache from reading the conversation back, so every turn paid to cache it again; the concise instruction now lives in the agent's CLAUDE.md. A group that already has Concise keeps it: set outputStyle to default (or delete the key) in data/v2-sessions/<agent-group-id>/.claude-shared/settings.json.
• Agents behave better in chats. The typing indicator stays on while Claude writes a long answer, agents no longer trade "The agent run failed" messages with each other forever, and they read each turn's subject from their own message and history, asking when a bare "this" is ambiguous. Deleting an agent with ncl groups delete now stops its container within about a minute.
• Setup is clearer when something goes wrong. A failing skill step shows its own reason, Codex and OpenCode installs are no longer offered the Claude CLI, a failed host restart says why the host is not ready, and the setup log records whether the assistant answered the first test message. OpenCode setup checks a local model URL against your gateway at the prompt, Iron Proxy setup skips a malformed allowlist entry and says how to fix it, and on arm64 Linux it stops early, with the command to turn on emulation, when Docker cannot run the Iron Control image. Setup's OneCLI step works under a strict 077 umask, and uninstalling removes the Iron Control database so a reinstall in the same folder starts clean.
• OneCLI gateway upgrades now stay on 1.42.0. The upgrade guide saves the version in ~/.onecli/.env and checks which image is running, so a later restart cannot move the gateway to a newer release; 1.43 and later are not supported yet. /add-dial-tool now stops with a clear message on gateway 1.42 or later, before it stores the Dial key, instead of failing partway.
• Updates on macOS no longer fail and roll back when the service is slow to stop. The updater now waits for NanoClaw to exit fully before it continues, instead of failing with "Bootstrap failed: 5: Input/output error".
• Smaller fixes. OpenCode agents avoid a Bun hang in the memory hook; send_card no longer breaks requests to llama.cpp-served models (non-ASCII link URLs are encoded automatically); OneCLI credential errors during setup name the credential being set up instead of always saying "OpenCode"; a scheduled-task pre-script that hits its 30 s timeout now stops its child processes too; logging a circular object or a BigInt no longer crashes the host; ncl approvals help and ncl dropped-messages help list exactly the values the host writes; CLAUDE_CODE_AUTO_COMPACT_WINDOW set in .env or the service environment now reaches Claude agents (it was ignored); WhatsApp linking no longer hangs when WhatsApp rate-limits setup, and stops at once with the reason if the current WhatsApp Web version cannot be fetched; Node 26 no longer prints a module.register() warning; the OneCLI upgrade guide checks the gateway at the address in ONECLI_URL, so it works on Linux installs where the gateway listens on the Docker bridge; and the /add-imessage local backend on a Mac opens chat.db again (if you installed it before, rerun /add-imessage and choose local).

Security

• WhatsApp uses Baileys 7.0.0-rc14, which fixes a critical message-spoofing flaw (GHSA-qvv5-jq5g-4cgg). /update-nanoclaw moves existing WhatsApp installs to the fixed version, and linked devices do not need to link again.
• Host logs keep a value's own redaction (its toJSON()) even when the logged data also holds a BigInt or a circular reference.
• Setup's debugging helper asks before it runs commands or edits files. Claude's headless helper is read-only.
• Outbound proxy settings, which can include a password, are kept in an owner-only file instead of the service definition. If you use an authenticated proxy, rerun setup's service step (pnpm exec tsx setup/index.ts --step service) to move it out of your existing service file.
• Discord's local event relay only accepts events from NanoClaw's own Discord connection, so other programs on the same machine can no longer send it fake button clicks. No action needed.

For custom installations

• Version numbers are now calendar-based (YYYY.M.PATCH). 2026.10.0 follows 2.4.0 and sorts after it, so tools that compare versions keep working; a dependency range such as ^2 will not match it. Release tags stay vX.Y.Z and annotated.
• Forks that merge main by hand can keep doing so; to keep /update-nanoclaw on main instead of releases, run pnpm exec tsx scripts/update-nanoclaw.ts set-channel --channel edge once.
• Provider contracts can list exact model endpoints. A provider skill sets modelAuthorities to host:port pairs that skip the gateway's default approval, as modelDomains does for whole domains.
• The published agent image is unchanged in this release. Installs that pull the image keep the 2026-08-25 build; the agent-runner dependency refresh in this release reaches them with the next image, built from this release's tag. Installs that build the image locally get it now.

New Contributors

• @barnuri made their first contribution in https://github.com/nanocoai/nanoclaw/pull/3895
• @daviddl9 made their first contribution in https://github.com/nanocoai/nanoclaw/pull/3969
• @drsmk238 made their first contribution in https://github.com/nanocoai/nanoclaw/pull/3989

Contributors

Thanks to everyone who landed work in this release:

• fix(cli): list every approval status and drop reason the host writes by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3882
• feat(agent-runner): explain inbound message blocks in the chat system prompt by @Koshkoshinsk in https://github.com/nanocoai/nanoclaw/pull/3890
• fix: seed Claude's default output style, not Concise, which defeated prompt caching by @gavrielc in https://github.com/nanocoai/nanoclaw/pull/3917
• fix(agent-runner): keep send_card url pattern parseable by llama.cpp grammars by @barnuri in https://github.com/nanocoai/nanoclaw/pull/3895
• fix(iron-proxy): skip invalid allowed-hosts entries instead of aborting setup by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3915
• fix(cli): drop unknown_sender_public from the dropped-messages reason list by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3889
• test(community-portal): wait for the journal to clear instead of sleeping by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3892
• fix(agent-runner): keep the heartbeat alive while Claude streams a long block by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3893
• fix(setup): keep the Claude CLI offer to Claude installs by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3884
• test(webhook): recover on the fixture-owned port by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3803
• fix(update): load the update controller without setup/ or node_modules by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3913
• fix(agent-runner): never answer a failure notice with another by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3908
• fix(opencode): run the memory hook with async spawn so bun test cannot wedge by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3841
• fix(setup): log the first-chat ping result and the real OpenCode auth duration by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3905
• fix(setup): never clip a readiness probe to the deadline by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3887
• fix(setup): detect installed gateways without parsing nested pnpm output by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3910
• test(delivery): seed one session past the cap in the drain test by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3945
• fix(skill-apply): show a failed step's own error instead of a generic bounce by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3946
• fix(update): keep gateway-owned containers through cutover and residue reaping by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3948
• test(agent-runner): spawn bun children asynchronously so CI stops hanging in spawnSync by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3959
• fix(add-onecli): name the credential, not the provider, in adapter errors by @glifocat in https://github.com/nanocoai/nanoclaw/pull/3960