nanobot

Developer Tools

Ultra-lightweight, open-source, self-hosted personal AI agent framework in Python with WebUI, tools, memory, MCP, multi-agent workflows, automation, and chat apps

Latest v0.3.0 · by HKUDSWebsiteHKUDS/nanobot

Release activity

Release activity — 10 releases across 10 days since Mar 16, 2026. Each cell is one day; darker means more releases that day. Nothing is recorded before Mar 16, 2026. Older weeks are hidden at this screen width.
MayJunJulAug
SundayNo releases on Apr 26, 2026No releases on May 3, 2026No releases on May 10, 2026No releases on May 17, 2026No releases on May 24, 2026No releases on May 31, 2026No releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026
MondayNo releases on Apr 27, 2026No releases on May 4, 2026No releases on May 11, 2026No releases on May 18, 2026No releases on May 25, 20261 release on Jun 1, 2026No releases on Jun 8, 2026No releases on Jun 15, 2026No releases on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026
TuesdayNo releases on Apr 28, 2026No releases on May 5, 2026No releases on May 12, 2026No releases on May 19, 2026No releases on May 26, 2026No releases on Jun 2, 2026No releases on Jun 9, 2026No releases on Jun 16, 20261 release on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026
Wednesday1 release on Apr 29, 2026No releases on May 6, 2026No releases on May 13, 2026No releases on May 20, 2026No releases on May 27, 2026No releases on Jun 3, 2026No releases on Jun 10, 2026No releases on Jun 17, 2026No releases on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 2026No releases on Jul 29, 2026No releases on Aug 5, 2026
ThursdayNo releases on Apr 30, 2026No releases on May 7, 2026No releases on May 14, 2026No releases on May 21, 2026No releases on May 28, 2026No releases on Jun 4, 2026No releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026
FridayNo releases on May 1, 2026No releases on May 8, 2026No releases on May 15, 2026No releases on May 22, 2026No releases on May 29, 2026No releases on Jun 5, 2026No releases on Jun 12, 2026No releases on Jun 19, 2026No releases on Jun 26, 2026No releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 2026No releases on Jul 24, 2026No releases on Jul 31, 2026No releases on Aug 7, 2026
SaturdayNo releases on May 2, 2026No releases on May 9, 20261 release on May 16, 2026No releases on May 23, 2026No releases on May 30, 2026No releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 20261 release on Jul 25, 2026No releases on Aug 1, 2026No releases on Aug 8, 2026

10 releases since Mar 16, 2026

Changelog

v0.3.0

Added 11
  • nanobot webui command prepares the local WebUI channel, starts the gateway, opens the browser, and leads first-time users into guided setup
  • Inline subagents can consult inside the active task with explicitly authorized work continuing through verification
  • /goal command opts a task into sustained execution with clearer permission, cancellation, timeout, heartbeat, and local-trigger behavior
  • OpenCode Zen and OpenCode Go providers
  • Kimi Coding provider
  • Grok OAuth with hosted X Search provider
Changed 7
  • WebUI chats now read as topics with quoted follow-ups, document attachments, multimodal tool results, and file diffs visible in conversation
  • Model presets can be switched from the composer
  • Native desktop hosts can open a system folder picker
  • Settings work better across narrow screens and dark mode
  • Configuration can reload without tearing down the process
  • Typed runtime context keeps provider-owned state out of ad hoc loop logic
  • Traditional Chinese language substantially improved in WebUI
Fixed 2
  • Chained-command allowlist bypasses are now blocked
  • SSRF checks pin validated DNS
Security 3
  • Credentials are redacted from MCP URLs
  • Remote API binds require authentication
  • Attachment ingress is constrained

🐈 nanobot v0.3.0 is here: 260 PRs merged and 38 new contributors. The agent gained agency.

The fastest way to experience the release is one command:

nanobot webui

It prepares the local WebUI, starts the gateway, and opens the browser workbench. On a fresh install, guided setup helps you choose a provider and configure access without beginning in a JSON file. The published package already includes the WebUI, so there is no separate frontend build.

The product story is a WebUI that now feels like the front door to nanobot. Chats read as topics; documents, quoted follow-ups, multimodal tool results, file diffs, code previews, and model fallback are visible in the conversation. Model presets can be switched from the composer, native desktop hosts can open a system folder picker, settings work better across narrow screens and dark mode, and the interface now includes Brazilian Portuguese plus substantially improved Traditional Chinese.

Underneath that experience is agency with boundaries. nanobot can consult inline subagents, carry explicitly authorized work through verification, route turn state through a clearer runtime context, and switch model presets per session. Long-running behavior is deliberate: /goal opts a task into sustained execution, while ordinary conversations remain ordinary conversations.

The foundation is a runtime built for real deployment. Configuration can reload without tearing down the process, channels have clearer package boundaries, gateway restart and shutdown paths are sturdier, and Docker and Render deployment are easier to reproduce. Provider-scoped proxies, OpenCode, Kimi Coding, Grok OAuth with hosted X Search, Parallel Search, Serper, Mattermost, and the native Neonize WhatsApp channel broaden where nanobot can run and what it can reach.

Highlights
  • One command to the workbench - nanobot webui prepares the local channel, starts the gateway, opens the browser, and leads first-time users into guided setup.
  • A stronger browser workbench - Topic-style chats, composer model switching, quoted follow-ups, document attachments, native folder selection, responsive settings, and clearer fallback state.
  • Agent coordination without core sprawl - Inline subagents can consult inside the active task, authorized work can continue through verification, and typed runtime context keeps provider-owned state out of ad hoc loop logic.
  • Explicit long-running goals - Sustained execution is gated behind /goal, with clearer permission, cancellation, timeout, heartbeat, and local-trigger behavior.
  • Files and tool activity you can inspect - Syntax-highlighted previews, live file-edit diffs, better code-copy behavior, structured tool errors, richer MCP artifacts, and preserved multimodal tool output.
  • A more operational runtime - Live configuration reloads, bounded session and exec state, safer restart/shutdown, cleaner cancellation ownership, more reliable scheduled work, and faster CI.
  • Broader providers and search - OpenCode Zen/Go, Kimi Coding, Grok OAuth, provider-scoped proxies, Copilot Enterprise overrides, Parallel Search, Serper, and steadier authentication fallback.
  • Channels as maintainable extensions - Native Neonize WhatsApp, Mattermost, improved Feishu/Telegram/Discord/Matrix/QQ behavior, optional channel dependencies, and clearer setup flows.
  • Security tightened at the edges - Chained-command allowlist bypasses are blocked, SSRF checks pin validated DNS, credentials are redacted from MCP URLs, remote API binds require authentication, and attachment ingress is constrained.
  • Documentation and delivery caught up - Workflow-oriented docs, an automation guide, one-click Render deployment, stronger Docker controls, community-maintained project language, and a refreshed SVG identity.
Upgrade Notes
  • WhatsApp now uses Neonize instead of the old Node.js/Baileys bridge. Remove bridgeUrl and bridgeToken, run nanobot plugins enable whatsapp, and link the account again with nanobot channels login whatsapp. The old bridge authentication data is not reused. allowFrom entries should use the sender ID without a leading +.
  • Sustained goals are now explicit. Use /goal when a task should keep working across continuation turns. Normal chats no longer inherit long-running goal behavior implicitly.
  • Remote exposure requires authentication. Configurations that bind the API or WebUI gateway beyond loopback must provide the corresponding API or Web token. Localhost setup continues to use the guided short-lived token flow.
Community

Thank you to everyone who shaped v0.3.0: 260 merged PRs, 38 first-time contributors, and a month of careful review across the agent core, WebUI, providers, channels, security, documentation, and deployment. The Agency Release is not about making nanobot act without limits. It is about giving a small, inspectable agent the coordination, evidence, and operational discipline to finish more of the work you intentionally hand it.

What's Changed
New Contributors

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.2.2...v0.3.0

View originalPermalink
How v0.3.0 went

v0.2.2

Added 10
  • WebUI gained prompt navigation capability
  • WebUI now displays token usage rendering
  • WebUI activity durations are now shown with clearer timing information
  • SDK documentation now teaches from first principles for easier embedding in custom applications
  • Web search now covers Firecrawl, Exa, Bocha, Keenable, and Volcengine providers
  • Transcription expanded with OpenRouter, StepFun, SiliconFlow, Xiaomi MiMo, and AssemblyAI support
Changed 5
  • WebUI transcript storage now uses segmentation instead of single monolithic files for improved durability of large conversations
  • Python SDK now has safer concurrent run() behavior with isolated calls
  • SDK hooks are now cleaner with explicit per-run hook handling
  • MCP lifecycle handling is now safer with better cleanup
  • Mistral reasoning handling has been improved
Fixed 5
  • Fork and replay paths now preserve assistant replies more reliably
  • Active turns remain anchored while the model works without getting revived on refresh
  • Stream stalls can now retry or fall back without returning truncated answers
  • Malformed history is now skipped during processing
  • Recent-history context is now token-capped

🐈 nanobot v0.2.2 is here — 140 PRs merged, 21 new contributors. The agent got sturdier!

The headline is durability. WebUI conversations now survive more of real life: transcripts are segmented instead of living in one fragile file, forked chats preserve replies more reliably, active turns scroll and replay more predictably, startup paths block less, and gateway shutdown is much calmer. Long sessions, stale providers, slow routes, broken config files, malformed history, stream stalls, and empty provider responses all got less likely to derail the work.

The second story is nanobot becoming a real Python runtime. The SDK is no longer just a thin convenience layer around the agent loop: concurrent run() calls are isolated, hooks are cleaner, MCP lifecycle handling is safer, runtime controls are broader, and the docs now teach the SDK from first principles. If you want to embed nanobot inside your own application, v0.2.2 is the first release where that path feels intentional.

The third story is the workbench getting broader and easier to live in. The WebUI gained automation management, prompt navigation, token usage visibility, mobile polish, better update checks, richer activity timing, and a faster settings surface. The ecosystem expanded with Firecrawl as a keyless Web Data app, Exa / Bocha / Keenable / Volcengine search, more transcription providers, custom image generation, better Mistral and Kimi handling, and many channel fixes across Telegram, Feishu, WhatsApp, Slack, Email, QQ, DingTalk, and more.

Highlights

  • More durable WebUI sessions — Segmented transcript storage keeps large conversations readable without throwing away old turns, fork/replay paths preserve assistant replies more reliably, session deletion cleans up legacy files, refreshes no longer revive stale content, and active turns stay anchored while the model works. The WebUI also got prompt navigation, better mobile layout, clearer activity durations, token usage rendering, safer startup fetches, and on-demand version checks.

  • Python SDK as a first-class runtime — The SDK now has safer concurrent run() behavior, explicit runtime controls, cleaner per-run hook handling, better MCP cleanup, improved facade lifecycle behavior, and more beginner-friendly documentation. This makes nanobot easier to embed in scripts, services, evaluations, and custom agent products.

  • Gateway and onboarding polish — The gateway gained background/service controls, cleaner foreground shutdown, safer Ctrl+C behavior, and better MCP stdio cleanup. The onboarding flow was simplified around provider-first Quick Start, more neutral provider selection, safer WebUI setup, rollback on WebSocket failure, and better keyboard navigation.

  • Search, speech, and provider coverage — Web search now covers Firecrawl, Exa, Bocha, Keenable, and Volcengine paths; transcription expanded with shared voice input plus OpenRouter, StepFun, SiliconFlow, Xiaomi MiMo, and AssemblyAI support. Providers got better Mistral reasoning handling, Kimi K2.7 thinking, OpenAI-compatible query/body controls, custom image generation, OpenAI image edits, safer Anthropic tool IDs, and stronger retry/fallback behavior.

  • Reliability hardening across the agent core — Recent-history context is token-capped, idle auto-compact is on by default, Dream explains empty runs, malformed history is skipped, history cursors stay monotonic, tool schema estimates are cached, unknown builtin tool parameters are rejected, provider fallback logs the primary error, and stream stalls can retry or fall back without returning a truncated answer.

  • Channels that behave more like real apps — Telegram gained richer message support with safer fallback detection; Feishu got streaming recovery, WebSocket card reading, table extraction, lazy SDK loading, and QR login; WhatsApp got read receipts, forwarded-message handling, and LID mapping; Slack allowlisted channels can require mentions; Email gained attachments and IMAP post-actions; QQ / Napcat, DingTalk, Weixin, Matrix, and others received targeted fixes.

  • Security and workspace boundaries — Unsafe MCP HTTP URLs are rejected before probing, local provider endpoints bypass env proxies while cloud endpoints still respect them, workspace write policy is clearer, git commands work from workspace subdirectories without relaxing path guards, bwrap gets a sane HOME, and stripped image inputs no longer leak misleading local paths.

Community

Huge thanks to everyone who shipped v0.2.2 — 140 PRs, 21 first-time contributors, and a lot of careful review work. This release is less about one big switch and more about making nanobot dependable enough to keep open every day: steadier sessions, cleaner extension points, broader providers, and fewer sharp edges when real work gets long.

What's Changed
New Contributors

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.2.1...v0.2.2

View originalPermalink
How v0.2.2 went

v0.2.1

Added 13
  • WebUI now includes live file edit visibility, improved activity rendering, and cleaner source link display
  • WebUI gained project workspaces and access controls
  • Context-window settings and model controls added to WebUI
  • Slash command actions integrated into WebUI
  • CLI Apps introduced as a way to connect CLI-native tools
  • Extension registry created as a first-class home for integrations
Changed 5
  • Thought and response ordering now matches the model's real turn structure in WebUI
  • Goal iteration budget extended for multi-turn work
  • Sustained goals no longer trip the runner
  • Session locks prevent overlapping turns from stepping on each other
  • Gateway cold start reduced from seconds to sub-second territory
Fixed 3
  • AutoCompact and consolidation races fixed
  • Archive retention now avoids duplicate archives and message loss
  • WebSocket token issuance now requires authentication
Security 1
  • Redirect targets are validated before web fetches

🐈 nanobot v0.2.1 is here — 84 PRs merged, 17 new contributors. The agent got a real workbench.

The headline is the WebUI becoming the place where work actually happens. The chat surface is smoother, faster, and easier to trust: live file edits show up as activity, tool traces render more cleanly, source links get readable favicons, markdown and code blocks behave better, new chats survive refreshes, and Thought / response ordering now matches the model's real turn structure. Settings, sidebar controls, model switching, context-window control, slash commands, project workspaces, and access modes all moved closer to a single coherent control surface.

The second story is long-running work getting more durable. Sustained goals no longer trip the runner, goal iteration budget is higher, session locks prevent overlapping turns from stepping on each other, AutoCompact and consolidation races were fixed, heartbeat moved onto cron, and session archive retention got several data-loss fixes. In practice, this means fewer mysterious interruptions, fewer duplicate archives, and a much better chance that a long agent workflow keeps its thread of intent.

The third story is nanobot becoming easier to plug into real stacks. CLI Apps and MCP now share a more unified extension path; preset setup and capability mentions make tools easier to discover; the extension registry gives integrations a first-class home. Provider coverage expanded across Ant Ling, Skywork, Novita, Step Plan, StepFun, Zhipu image generation, OpenAI/Codex image generation, Ollama image generation, and richer OpenAI-compatible configuration. Channels also grew with Signal, Telegram webhook mode, Discord model slash commands, Matrix verification fixes, and safer Weixin / Teams / Matrix behavior.

Highlights

  • WebUI as a daily workbench — The WebUI is no longer just a packaged chat surface. It now has better activity rendering, live file edit visibility, cleaner source links, stronger markdown/code rendering, improved sidebar performance, project workspaces, access controls, context-window settings, model controls, slash command actions, and a more polished native-host feel. The final Thought / response ordering fix makes streamed agent work read in the order it actually happened. (#3877, #3899, #3906, #3951, #3953, #3987, #4007, #4045, #4108, #4121, #4137)

  • Long-running agent stability — Goal mode and multi-turn work got sturdier: sustained goals keep the runner alive, goal iteration budget is extended, process_direct now has per-session locking, streaming/session concurrency bugs were tightened, AutoCompact and consolidator races were fixed, and archive retention now avoids duplicate archives and message loss. (#3881, #3999, #4041, #4104, #4127, #4129)

  • CLI Apps, MCP, and extension workflows — CLI Apps landed as a way to connect CLI-native tools, then got unified with MCP concepts through preset setup, capability mentions, stale install recovery, registry logos, and an extension registry source. The result is a clearer path from "I have a useful local tool" to "nanobot can invoke it in a workflow." (#3963, #3979, #3991, #4046)

  • More providers, richer model routing — The provider surface widened with Ant Ling, Skywork, Novita, Step Plan, OpenAI API type selection, extraBody, and multiple image-generation providers including StepFun, OpenAI/Codex, Ollama, and Zhipu. Several follow-up fixes preserve tool-call IDs, improve quota/billing errors, handle provider transport edge cases, and keep thinking/reasoning controls honest across OpenAI-compatible routes. (#3900, #3910, #3916, #3927, #3946, #3954, #3971, #3974, #3984, #3988, #4048)

  • Channels and deployment polish — Signal support, Telegram webhook mode, Discord model slash commands, Docker/WebUI deployment fixes, and clearer secret/deployment docs make nanobot easier to run outside a local terminal. Gateway cold start also dropped dramatically, from seconds to sub-second territory. (#3872, #3918, #3935, #3996, #4031)

  • Security and reliability hardening — WebSocket token issuance now requires auth, redirect targets are validated before web fetches, IPv6-mapped IPv4 addresses are normalized in SSRF checks, Teams replies trust service URLs, Matrix inbound media downloads are bounded, and shell/exec behavior was tightened on Windows and URL-heavy commands. (#3928, #3933, #4051, #4086, #4103, #4106, #4047)

  • Internationalization and docs — The WebUI locale set was filled out across zh-TW, ja, and remaining keys, the README positioning and news section were refreshed, multi-language doc links were surfaced, local provider setup is easier to find, and AGENTS.md gives coding agents a clearer way into the repo. (#3930, #3962, #3964, #4131)

Community

Huge thanks to everyone who shipped v0.2.1 — 84 PRs, 29 contributors, and a warm welcome to 17 first-time contributors. This release feels less like one big feature drop and more like nanobot becoming something you can keep open all day: steadier, clearer, and much easier to extend.

What's Changed
New Contributors

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.2.0...v0.2.1

View originalPermalink
How v0.2.1 went

v0.2.0

Added 14
  • Add `/goal` command and `long_task` tool to mark threads as sustained objectives with goal pinned in Runtime Context across compactions and tool chains
  • Add image-generation tool with WebUI image mode to render generated images inline with rounded previews
  • Ship WebUI inside the wheel with `pip install nanobot-ai`, including redesigned settings and BYOK flow
  • Localize slash palette in WebUI
  • Gate LAN access to WebUI with token via `tokenIssueSecret`
  • Stream reasoning live to chat in WebUI
Changed 7
  • Automatically widen wall-clock timeout while a goal is active
  • Switch streaming requests to idle timeout instead of hard wall clock so models are not cut off mid-thought
  • Redesign WebUI settings and BYOK flow
  • Move archived conversation summary into system prompt for KV cache stability
  • Rewrite `_process_message` as a functional state machine
  • Convert tools to self-describing plugin architecture
  • Back-fill DeepSeek reasoning history instead of dropping it
Removed 2
  • Remove `ask_user` in favor of structured `message`-tool choices
  • Retire `GlobTool` in favor of `read_file` glob support
Security 3
  • Fix SSRF vulnerability
  • Confine media path access
  • Soften workspace boundaries

🐈 nanobot v0.2.0 is here 🎉 — 105 PRs merged, 20 new contributors. The agent learned to hold a goal.

The headline is /goal. Mark a thread as a sustained objective with long_task, and the active goal stays pinned in Runtime Context every turn — surviving compaction, surviving long tool chains, surviving the model's own forgetfulness — until you call complete_goal. The wall-clock timeout widens automatically while a goal is active; streaming requests fall back to an idle timeout instead of a hard wall, so a model that's still thinking doesn't get killed mid-thought.

The second story is the WebUI growing up. After several releases as a source-only preview, it now ships inside the wheel — pip install nanobot-ai and you have it. Settings and BYOK got a full redesign, the slash palette is localized, LAN access is gated by a token, reasoning streams live to the chat, and a brand-new image-generation tool turns "draw me X" into an inline preview without leaving the conversation.

The third story is the engine room. The agent loop got a real refactor — AgentLoop.from_config() for clean embedding, _process_message rewritten as a functional state machine, archived summary moved into the system prompt for KV cache stability, tools converted to a self-describing plugin architecture, ask_user and GlobTool retired in favor of cleaner replacements. Five new providers (AWS Bedrock Converse, NVIDIA NIM, LongCat, Atomic Chat, MiMo) join the lineup with fallback_models as a safety net so a single flaky endpoint can't take a turn down. Plus four [security] fixes — SSRF, media path confinement, softer workspace boundaries — and chat-native pairing so DM approvals finally happen in the chat instead of in a config file.

Highlights

  • /goal and long-running tasks — agent with a memory of why — The new long_task tool, paired with /goal and complete_goal, marks a thread as a sustained objective. The active goal is mirrored in Runtime Context every turn so the agent stays anchored even after compaction, the WebUI surfaces the goal in the chat header, and the LLM wall timeout is automatically widened while a goal is active so longer reasoning passes don't get killed mid-thought. Core agents and subagents both honor the longer budget; streaming requests fall back to an idle timeout instead of a hard wall clock so a model that's still emitting tokens won't be prematurely cut off. (#3788, #3855)

  • Image generation, end to end — A new image-generation tool plus a WebUI image mode let you go from prompt to picture without leaving the chat. Generated images render inline with rounded previews; replay-window and dedup paths were tightened so images don't double-deliver across long sessions, and the consolidation pass now respects the replay window when hiding history. (#3695, #3687)

  • WebUI shipped in the wheel + a year's worth of polish — pip install nanobot-ai now bundles the WebUI: enable the WebSocket channel, run nanobot gateway, open the browser. No cd webui && bun run build required. After several releases under a "preview" label, the WebUI is now a packaged surface. Inside it: redesigned settings and BYOK flow (including BYOK web search), localized slash palette, model preset badge that stays in sync across slash commands and config reloads, streamed reasoning rendered live, image previews, LAN access gated by tokenIssueSecret, default-to-new-chat on load, scroll preservation on settings return, a crypto.randomUUID shim for non-secure-context LAN use, and dropped eager markdown preload to cut first-paint cost. (#3653, #3661, #3703, #3709, #3656, #3658, #3733, #3759, #3782)

  • Five new providers and a fallback safety net — Native AWS Bedrock Converse lands as a first-class provider (#3574), with a follow-up that preserves Bedrock tool config across history (#3758). NVIDIA NIM (#3707), LongCat via OpenAI-compatible routing (#3114), Atomic Chat as a local OpenAI-compatible target (#3750), and MiMo with proper thinking-control wiring (#3734, #3851) round out the lineup. On top of the wider stack, fallback_models lets you list secondary models that take over when the primary fails (#3756), DeepSeek reasoning history is back-filled instead of dropped (#3616, #3560), Codex prompt cache keys stabilized (#3793), and Anthropic auto-falls back to streaming on long-request errors (#3579).

  • Model presets and runtime switching — ModelPresetConfig lets you name model + provider bundles in config and swap between them at runtime via /model (or the WebUI badge). Presets sync across slash commands, config reloads, and settings changes, so the model badge always matches what the next turn will hit. (#3714)

  • Core refactor — a cleaner agent loop, a smaller surface — AgentLoop.from_config() centralizes loop assembly so embedders stop reaching into private internals (#3708). _process_message was rewritten as a functional state machine with explicit transitions instead of nested branches (#3715). The archived conversation summary moved into the system prompt to keep KV caches stable across compactions (#3711). Tools became a self-describing plugin architecture (#3729). ask_user was removed in favor of structured message-tool choices (#3757), and GlobTool was retired in favor of read_file glob support (#3841). Vulture- and coverage-verified dead code was excised (#3755, #3719). Logging now preserves tracebacks and carries channel context (#3651, #3678). Ruff F rules are fully enforced in CI (#3672), and the agent test suite was expanded and restructured (#3766). New CLAUDE.md and .agent/ guides give AI contributors a stable on-ramp (#3534, #3860).

  • Pairing, DM approvals, and security hardening — Chat-native pairing (#3774) lets you approve DMs from inside chat instead of editing config. On the safety front: SSRF blocked in DingTalk outbound media (#3569), Feishu downloaded-media filenames confined to safe paths (#3789), local media attachments confined for the message tool (#3842), SSRF guard recovery softened so a transient miss doesn't poison subsequent turns (#3635), and workspace boundary violations get a retry-throttled soft warning instead of crashing the loop (#3614). Telegram silently ignores unauthorized senders instead of leaking error responses (#3629).

  • Memory, dream, and session durability — Cron jobs.json gained atomic writes with corrupt-store detection (#3606). Dream cursor only advances on completed batches (#3631) and restores correctly with memory state on resume (#3660). Replay-window hidden history is now properly consolidated (#3687). Workspace and tool-state changes survive restarts more reliably end-to-end.

  • Channel and platform fixes — Feishu group threads honor reply chains and topic isolation (#3547, #3704, #3747, #3775), Matrix skips pre-startup events and stops the sync loop on irrecoverable auth (#3575, #3578), WhatsApp voice messages download cleanly (#3607), Wecom preserves real filenames (#3751), Telegram quiets unauthorized senders (#3629), and Weixin raises on send failures so messages don't silently drop (#3659). On Windows: UNC path support in shell extraction (#3764). On the CLI: surrogate code points sanitized before the message bus (#3697), retry-wait messages no longer garble interactive output (#3705, #3609), and nanobot provider logout lands as a proper command (#3612).

  • Smaller things you'll feel — Configurable bot_name / bot_icon (#3730), configurable toolHintMaxLength (#3641), real SSE streaming restored on the OpenAI-compatible API (#3677), Whisper transcription retries on transient failures (#3646), sequential MCP server connects to stop CPU spin (#3640), MCP HTTP probe before connect (#3740), Brave search backoff under rate limits (#3840), sender_id in Runtime Context for user-aware responses (#3549), runtime context appended after user content for cache stability (#3844), origin_message_id outbound deduplication (#3561), and a Python SDK RunResult that finally exposes tools_used and messages (#3620).

Community

Heartfelt thanks to everyone who shipped v0.2.0 — 105 PRs, 33 contributors, and a huge welcome to 20 first-time contributors. Every review, patch, and bug report helped; this release is a shared win. 🎉

What's Changed
New Contributors

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.1.5.post3...v0.2.0

View originalPermalink
How v0.2.0 went

v0.1.5.post3

Added 16
  • Feishu group topics now isolate sessions so messages in one topic do not leak into another
  • Discord threads inherit their parent channel's allowChannels and get session isolation
  • Slack thread context is preserved on proactive replies
  • MSTeams conversation references gained TTL-based pruning and auto-cleanup for Web Chat refs
  • Per-channel override for sendProgress and sendToolHints instead of global switches
  • New ask_user tool lets the agent pause and ask users to choose mid-task
Changed 3
  • History.jsonl now uses atomic writes with fsync and directory sync
  • GitHub Copilot routes GPT-5 and o-series models correctly
  • Gemini routing picks up reasoning_effort none and Gemma
Fixed 4
  • Shell injection vector via path_append on non-Windows platforms
  • Workspace directory violations now stop the agent loop instead of logging a warning
  • resolve_config_env_vars no longer strips excluded fields
  • Anthropic image_url blocks inside tool_result content are converted correctly

🐈 nanobot v0.1.5.post3 is here 🎉 — 57 PRs merged, 12 new contributors. The agent learned to talk in threads.

If v0.1.5.post2 was about reach and polish, v0.1.5.post3 is about conversations becoming first-class citizens of their platform. Feishu group topics get isolated sessions. Discord threads inherit parent allowlists and keep their own context. Telegram can render inline keyboard choices. MSTeams prunes stale conversation references so outbound messages stop failing silently. And across all channels, sendProgress and sendToolHints can now be overridden per channel — quiet the noisy ones, keep the verbose ones. Underneath, DeepSeek-V4 is supported end to end: thinking mode and legacy session compatibility ship together, with follow-up fixes for incomplete reasoning history and non-string message content so long threads stay stable. A new ask_user tool lets the agent pause and ask you to choose mid-task. Olostep and Hugging Face joined the provider lineup, and a pair of timeout env vars (NANOBOT_LLM_TIMEOUT_S and NANOBOT_OPENAI_COMPAT_TIMEOUT_S) keep hung requests from holding your session hostage. The WebUI continued to evolve — image uploads, video rendering, ask-user choices, model settings — but remains source-preview only, not bundled into the wheel.

Highlights

  • Threads everywhere — Feishu, Discord, Slack, MSTeams — Each channel grew up this release. Feishu group topics now isolate sessions so messages in one topic don't leak into another; streaming cards and tool hints follow the original topic. Discord threads inherit their parent channel's allowChannels and get session isolation, which also means slash commands respect the allowlist. Slack stopped losing thread context on proactive replies. MSTeams conversation references gained TTL-based pruning (refTtlDays), auto-cleanup for Web Chat refs, and a touch interval to keep active refs alive. The theme is consistent: conversations belong to their thread, not to the channel at large. (#3449, #3397, #3440, #3462, #3475, #3447, #3487)

  • Per-channel progress and interaction controls — sendProgress and sendToolHints used to be global on-or-off switches. Now you can place them inside any individual channel config to override the global default — keep Telegram quiet while WebSocket stays verbose. The agent also learned to ask users structured questions mid-task via the new ask_user tool: in WebUI these render as buttons, in other channels they fall back to text. Telegram got inline keyboards (inline_keyboards: true) for rendering message tool button choices. The /history [n] command lets you review recent messages without scrolling. (#3487, #2791, #3398, #3454, #3466)

  • DeepSeek-V4 and the wider provider stack — This release makes DeepSeek-V4 a first-class target: thinking mode and legacy session compatibility land in one go (#3420), so you can point the agent at V4 without abandoning older conversations. Real-world transcripts exposed two gaps that got dedicated follow-ups — truncated or incomplete reasoning history (#3453) and heterogeneous (non-string) message content (#3458) — so tool-heavy sessions don’t fall over mid-run. On top of that, Hugging Face Inference Providers arrived as a first-class provider (#3496), Olostep joined web search (#3505), OpenAI-compatible endpoints gained extraBody for vLLM guided decoding and friends (#3491), and the timeout pair NANOBOT_LLM_TIMEOUT_S / NANOBOT_OPENAI_COMPAT_TIMEOUT_S split outer turn limits from inner HTTP bounds (#3428, #3478). GitHub Copilot routes GPT-5 and o-series models correctly (#3380); Gemini routing picks up reasoning_effort="none" and Gemma (#3515).

  • Memory and session hardening — consolidationRatio (0.1–0.95) lets you tune how aggressively token-triggered consolidation compresses context. maxMessages (default 120) caps the replay window without touching persistence. History.jsonl gained atomic writes with fsync and directory sync, closing the last data-loss window on unexpected shutdowns. A raw_archive bloat path and several stuck-consolidation edges were sealed. Sessions now fsync on graceful shutdown. The result: memory is both more tunable and more durable. (#3285, #3482, #3508, #3369, #3412, #3415, #3459)

  • macOS LaunchAgent and deployment — A new docs/deployment.md section walks through deploying nanobot gateway as a macOS LaunchAgent — plist, launchctl bootstrap/enable/kickstart, log paths, and the inevitable port-conflict gotcha when you forget to stop a manual gateway. Useful for anyone who wants the agent online at login without keeping a terminal open. (#3441)

  • Security and reliability fixes — A shell injection vector via path_append on non-Windows platforms was closed. Workspace directory violations now stop the agent loop instead of logging a warning. resolve_config_env_vars stopped stripping excluded fields. Anthropic image_url blocks inside tool_result content get converted correctly. MCP capability names are sanitized for model API compatibility. Windows MCP stdio launchers avoid WinError 193. Structured tool-event payloads give channels richer progress data. Document parsers lazy-import to cut cold-start time. Twenty-odd smaller fixes across providers, channels, and the agent loop round out the release. (#3366, #3493, #3383, #3387, #3470, #3379, #3399, #3423)

Community

Heartfelt thanks to everyone who shipped v0.1.5.post3 — 57 PRs, 27 contributors, and a huge welcome to 12 first-time contributors. Every review, patch, and bug report helped; this release is a shared win. 🎉

What's Changed
New Contributors

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.1.5.post2...v0.1.5.post3

View originalPermalink
How v0.1.5.post3 went

v0.1.5.post2

Added 8
  • Windows and Python 3.14 are now first-class supported platforms with full CI matrix coverage and runtime fixes
  • The read_file tool now extracts text from DOCX, XLSX, and PPTX files including tables and grouped shapes
  • OpenAI-compatible API /v1/chat/completions endpoint now emits SSE chunks when stream=true
  • Microsoft Teams channel support
  • MiniMax thinking endpoint with reasoning_effort to reasoning_split mapping
  • LM Studio provider support with nullable API keys for local servers
  • MyTool for agent introspection of its own runtime configuration with sensitive field hiding
  • WebUI with WebSocket chat flow, i18n locale switcher, and dark-mode code-block theming available as source preview in webui/
Changed 7
  • Session files now use atomic writes with corrupt-file repair to prevent history loss during bad shutdowns
  • Memory cursor recovery now handles non-integer corruption
  • Auto-compact skips sessions with active tasks and unifies summary injection across consolidation paths
  • Telegram channel gained mid-stream splitting for long replies and improved markdown rendering
  • Discord stopped treating bot-to-bot messages as self-loops and added channel-based allow-lists
  • Email channel now deduplicates SPF/DKIM-rejected messages and ignores self-sent mailbox messages
  • WebSocket channel now multiplexes multiple chat_ids over a single connection
Fixed 5
  • Providers now gain a circuit breaker for Responses API fallback
  • ZhiPu rate limit 1302 recognition
  • Cron tool schema now works with OpenAI Codex and Responses
  • Retry heartbeats no longer spill into user channels
  • Subagent follow-ups now persist in session history

🐈 nanobot v0.1.5.post2 is here 🎉 — 67 PRs merged, 12 new contributors. The agent's world got bigger and steadier.

If v0.1.5.post1 was about the agent learning to manage itself, v0.1.5.post2 is about reach and polish. Windows and Python 3.14 joined the supported matrix. The read_file tool learned to understand DOCX, XLSX, and PPTX. Microsoft Teams arrived as a channel. The OpenAI-compatible API started streaming via SSE. And beneath all of that, ~50 smaller fixes across cron, memory, retry, session files, and provider quirks kept turning "it works" into "it's solid." A dedicated browser UI also started taking shape in the repo — source preview for now.

Highlights

  • Windows + Python 3.14 — first-class support — A full CI matrix covering Windows runners and Python 3.14 landed, along with install markers and runtime fixes for the quirks those platforms expose. If you've been running nanobot on WSL because "Windows didn't quite work," you can stop. (#3194)

  • Office documents, natively readable — The read_file tool now extracts text from DOCX, XLSX, and PPTX — tables and grouped shapes included, workbook handles closed safely. Combined with the earlier PDF support, the agent can open whatever format your colleague just emailed you without bouncing through a converter. (#3336, #3269, #3353)

  • OpenAI-compatible API — SSE streaming — /v1/chat/completions now emits SSE chunks when stream=true, wiring up the existing on_stream / on_stream_end callbacks. Any client built for the OpenAI API — LangChain, LlamaIndex, your own frontend — gets live deltas from nanobot instead of waiting for the whole response. The endpoint also stopped terminating streams with a success marker after a backend failure, so errors surface honestly. (#3222, #3262)

  • Microsoft Teams, MiniMax thinking, LM Studio, MyTool — Microsoft Teams joined the channel roster. MiniMax got a dedicated Anthropic-style thinking endpoint plus a reasoning_effort → reasoning_split mapping fix. LM Studio is now supported via nullable API keys for local servers that don't expect one. The new MyTool lets the agent introspect its own runtime configuration — and hides sensitive nested config fields in check output so self-inspection doesn't leak secrets. (#3197, #3160, #3363, #3186, #3177, #3261)

  • Reliability — the unglamorous half of a release — Session files now use atomic writes with corrupt-file repair, so a bad shutdown no longer eats your history. Memory cursor recovery handles non-integer corruption. Auto-compact skips sessions with active tasks and unifies summary injection across consolidation paths. Providers gain a circuit breaker for Responses API fallback and recognize ZhiPu 1302 rate limits. Cron stops leaking intermediate progress, its tool schema works with OpenAI Codex/Responses, and retry heartbeats no longer spill into user channels. Subagent follow-ups persist in session history. Half of these you'll never notice — which is exactly the point. (#3312, #3340, #3081, #3304, #3302, #3356, #3320, #3295, #3229, #3242)

  • Channels — quieter and sharper — Telegram gained mid-stream splitting for long replies and better markdown rendering for modern LLM output. Discord stopped treating bot-to-bot messages as self-loops and added channel-based allow-lists. Email deduplicates SPF/DKIM-rejected messages to stop log spam and ignores self-sent mailbox messages. WeCom parses mixed inbound messages correctly. Each individually small; together they mean fewer "why did my bot do that" moments. (#3329, #3355, #3280, #3171, #3325, #3228, #3161)

  • WebUI — early preview, source only — A dedicated webui/ has landed in the repo with a WebSocket chat flow, i18n locale switcher, Apple-inspired typography with CJK support, and live dark-mode code-block theming. The underlying WebSocket channel also learned to multiplex multiple chat_ids over a single connection. Heads up: this is source-preview only — the WebUI is intentionally not bundled into the published wheel yet. If you want to try it, clone the repo and run it from webui/. A packaged release will follow once the UX settles. (#3310, #3272, #3314, #3306)

Community

v0.1.5.post2 is what a release looks like when the foundation is done and people start finishing things. A Windows CI matrix from @JiajunBernoulli. Native Office document extraction from @aiguozhi123456. Session atomic writes from the same author, catching a real data-loss edge case. A Telegram mid-stream split that makes long replies actually readable. Twelve new contributors, and a lot of returning ones quietly landing the things that were on everyone's wish list. The agent runs on Windows. It reads your documents. It keeps its history even when the power blinks. And there's a UI taking shape in webui/ for whoever wants to peek. That's a post release doing post-release work — and then some.

What's Changed
New Contributors

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.1.5.post1...v0.1.5.post2

View originalPermalink
How v0.1.5.post2 went

v0.1.5.post1

Added 7
  • Dream's consolidation flow can now recognize repeated workflows and promote them into standalone workspace skills
  • Auto compact feature that proactively summarizes older context during idle periods while preserving recent messages
  • WebSocket channel that runs a WebSocket server with streaming events, token-based auth, per-connection sessions, and TLS support
  • Anthropic's adaptive reasoning mode allowing Claude to decide when and how much to think
  • MCP resources and prompts are now exposed as read-only tools that the agent can query directly
  • Notebook editing tool added
  • Kagi joined the web search provider lineup
Changed 11
  • Follow-up messages sent while the agent is working are now injected into the active turn instead of queuing, and on streaming channels the reply continues in the same live response
  • Telegram channel now supports location sharing
  • Discord channel gained streaming replies and proxy support
  • Feishu channel added done-emoji lifecycle, inline tool hints, and Lark global domain config
  • QQ and WeCom channels received full media support
  • Slack's message tool now resolves #channel_name and @user to real IDs
Fixed 4
  • Retry amplification where a failed send would trigger cascading retries across all channels
  • StepFun Plan API reasoning fields now fall back correctly
  • Tool-call arguments are now normalized for strict providers that reject malformed JSON
  • Cron jobs no longer drop due to reentrant store reloads during execution, fixed-interval task duplication from concurrent store replacement, job config not reloading, and manual run state not being preserved

🐈 nanobot v0.1.5.post1 is here 🎉 — 80 PRs merged, 25 new contributors. The agent learned to manage itself.

If v0.1.5 was about making the building livable, v0.1.5.post1 is about the building learning to take care of itself. The agent now compresses its own context before it gets too long, injects follow-up messages mid-turn instead of making you wait, discovers reusable skills from its own workflows, and opens a WebSocket so anything can talk to it. Meanwhile, 40+ bug fixes across cron, memory, retry, and channels turned "it works most of the time" into "it works."

Highlights

  • Mid-turn injection — follow-ups don't wait in line — If you send another message while the agent is still working, it no longer queues behind a lock. The follow-up gets injected into the active turn, and on streaming channels the reply continues in the same live response. This makes long tool-call chains feel interactive instead of one-way. Edge-case draining on error paths was hardened in a follow-up pass. (#3042, #3110)

  • Dream learns skills, not just facts — Dream's consolidation flow can now recognize repeated workflows and promote them into standalone workspace skills under skills/. Combined with disabledSkills config for excluding skills you don't want, the agent's skill surface is now something that grows organically and stays manageable. (#3048, #2959)

  • Auto compact — the agent manages its own context — Sessions no longer grow until they hit the wall. Auto compact watches for idle periods, then proactively summarizes older context while preserving recent live messages — so when you come back, the agent remembers what matters without dragging along everything that doesn't. This isn't the old "nuke the session" approach; it's surgical compression that keeps the conversation feeling continuous. Pair it with idleCompactAfterMinutes in config for fine-grained control. (#3007, #3081, #3093)

  • WebSocket channel — connect anything — A new websocket channel runs a WebSocket server with streaming (delta + stream_end events), token-based auth (static or issued), per-connection sessions, and TLS support. Web apps, CLIs, Chrome extensions, scripts — anything that can open a socket can now talk to the agent in real time. (#2964)

  • Channels got deeper — Telegram gained location sharing. Discord got streaming replies and proxy support. Feishu added done-emoji lifecycle, inline tool hints, and Lark global domain config. QQ and WeCom received full media support. Slack's message tool now resolves #channel_name and @user to real IDs. The API endpoint accepts file uploads via JSON base64 and multipart, with automatic document extraction (PDF, DOCX, XLSX, PPTX) across all channels. And retry amplification — where a failed send would trigger cascading retries — was fixed across every channel. (#2910, #2939, #2960, #2993, #3046, #3044, #3138, #2938, #3053)

  • Providers — adaptive thinking and Kimi — Anthropic's adaptive reasoning mode landed, letting Claude decide when and how much to think. Kimi thinking-capable models (kimi-k2.5, k2.6-code-preview) now get automatic extra_body.thinking injection via reasoningEffort. StepFun Plan API reasoning fields fall back correctly. Non-Claude providers get proper role alternation enforcement. And tool-call arguments are normalized for strict providers that reject malformed JSON. (#2882, #3124, #2903, #2637, #3154)

  • MCP, tools, and search — MCP resources and prompts are now exposed as read-only tools — the agent can query them directly. Multiple MCP servers connect in isolated tasks instead of racing each other. The notebook editing tool arrived. Kagi joined the web search provider lineup. And the exec tool got tighter: Windows support landed, allowed_env_keys lets you selectively forward env vars, internal state files are write-protected, and working_dir outside the workspace is rejected. (#2907, #3019, #3017, #2945, #2893, #2962, #3061)

  • Cron stopped dropping jobs — Four separate cron fixes addressed reentrant store reloads during job execution, fixed-interval tasks duplicating due to concurrent store replacement, job config not reloading, and manual run state not being preserved. If you rely on scheduled tasks, this release is the one where they become boring. (#3038, #3034, #2895, #2930)

Community

Welcome to our 25 new contributors who made their first contribution in this release: @Bahtya, @LeoFYH, @xwind, @Xerxes-cn, @BalorLC3, @invictus-z, @zijiefang, @kronk307, @stutiredboy, @SHLE1, @RohitDayanand, @justforyoudear, @XJPeng12, @linziyanleo, @chenyahui, @JonasGao, @weitongtong, @danielphang, @mterhar, @ramonpaolo, @nikube, @yeyitech, @ravs-cyberrock, @samyzhh, and @razzh7.

v0.1.5.post1 reflects something we keep seeing in the commit log: the best contributions aren't always the flashiest ones. A cron race condition caught by @weitongtong. A retry amplification loop spotted by @Bahtya. A channel error path that silently swallowed messages, fixed by @yanghan-cyber. These are the changes that make an agent trustworthy — not because it can do more, but because it stops doing things wrong. 80 PRs later, nanobot is quieter, steadier, and a little more grown-up. That's worth celebrating.

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.1.5...v0.1.5.post1

What's Changed
New Contributors

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.1.5...v0.1.5.post1

View originalPermalink
How v0.1.5.post1 went

v0.1.5

Added 20
  • Official website at nanobot.wiki with multilingual documentation in English, Chinese, Japanese, Korean, Spanish, and French
  • Long-running tasks now handle CancelledError without orphaning subprocesses
  • Retry classification uses structured error metadata instead of regex-on-error-text
  • Dream two-stage memory system separating live conversation history from consolidated long-term knowledge
  • Git-versioned memory storage for recovery of every memory state
  • Jinja2 templating for controlling agent response and memory summary shaping
Changed 9
  • Containers run as non-root by default
  • API port binds to localhost by default
  • SDK-level auto-retries disabled to prevent request amplification
  • Azure retries no longer double-dip
  • Legacy HISTORY.md files migrate automatically to new memory system
  • Tool class refactored with proper JSON Schema for parameters
Fixed 6
  • Exec tool no longer leaks host environment variables to the LLM
  • Dashscope and ModelArk proper thinking parameter control
  • WhatsApp bridge gained automatic local auth
  • Feishu auto-removes reactions after processing
  • Telegram splits oversized streamed replies
  • WeChat multimodal alignment continued

🐈 nanobot v0.1.5 is here 🎉 — 66 PRs merged, 27 new contributors, and the first release with its own home.

We're excited to announce that nanobot now has an official website at nanobot.wiki, with multilingual documentation in English, Chinese, Japanese, Korean, Spanish, and French. Building it reminded us why we do this: nanobot has always belonged to the open-source community, and a proper home — one that speaks your language — felt overdue. Every doc page, every translation, every example is open and contribution-ready. That's not going to change.

Now, about the release itself. If v0.1.4.post6 was about decomposing the foundation, v0.1.5 is about making the building livable. The agent can now run for hours without losing its mind. Memory got a proper architecture. And running nanobot in production went from "possible" to "comfortable." This is the release where nanobot stops being a prototype and starts being infrastructure.

Highlights

  • Long-running tasks got more reliable — Long-running tasks received a ground-up reliability pass. The runtime now handles CancelledError without orphaning subprocesses, retry classification uses structured error metadata instead of regex-on-error-text (so a 429 quota exhaustion stops immediately while a rate limit waits and retries), SDK-level auto-retries were disabled to prevent request amplification, and Azure retries no longer double-dip. If your agent runs cron jobs, orchestrates tools overnight, or handles bursty traffic — this is the release that makes those sessions stick. (#2733, #2762, #2759, #2761, #2765)

  • Memory got an architecture — meet Dream — The new two-stage memory system separates live conversation history from consolidated long-term knowledge. Dream runs as a background consolidation pass — think of it as the agent sleeping on what it learned — backed by git-versioned storage so every memory state is recoverable. Legacy HISTORY.md files migrate automatically. Jinja2 templating arrived alongside Dream, giving you control over how the agent shapes its responses and memory summaries. This isn't a feature bolted on — it's the memory system nanobot should have had from day one. (#2717, #2779, and 10+ follow-up hardening commits)

  • Running nanobot in production got real — exec calls are now sandboxed via bwrap and containers run as non-root by default. The exec tool no longer leaks host environment variables to the LLM. API port binds to localhost by default. Config secrets support ${VAR} interpolation so you never have to hardcode a key again. A new nanobot-api Docker service gives you an isolated OpenAI-compatible endpoint out of the box. WhatsApp bridge gained automatic local auth. These aren't glamorous changes — they're the reason you'll sleep through the night after deploying. (#1940, #2831, #2830, #2841, #2715)

  • Three new providers, and GPT-5 is ready — GPT-5 model family support landed with proper temperature handling. Xiaomi MiMo joined for on-device inference fans. Baidu Qianfan arrived for the Chinese ecosystem. Dashscope and ModelArk got proper thinking parameter control. And reasoning_content (chain-of-thought from DeepSeek-R1, Kimi, MiMo) is now visible and preserved through the full message pipeline. nanobot keeps meeting users wherever their models are. (#2788, #2495, #2811, #2840, #2770)

  • Channels kept getting better — Email now extracts attachments with MIME filtering and filename sanitization. WhatsApp gained voice transcription via Groq/OpenAI Whisper. Feishu auto-removes reactions after processing and supports video downloads. Telegram renders tool hints as collapsible blockquotes, supports DM threads, and splits oversized streamed replies. WeChat multimodal alignment continued. Langfuse integration landed for production observability. And /status now shows web search provider usage alongside cache hit rates. (#2815, #2530, #2812, #2810, #2793, #2520, #2659, #2832, #2703)

  • Developer experience, quietly — Built-in grep and glob tools give the agent native code search. The Tool class was refactored with proper JSON Schema for parameters. The Python SDK facade enables programmatic per-session isolation. The CLI gained --config for multi-instance setups. Web search was unified under WebToolsConfig with toggle controls. And the test suite grew to 1,142 tests, all green. (#2754, #2780, #2653, #2740, #2643)

Community

Welcome to our 27 new contributors who made their first contribution in this release.

v0.1.5 is shaped by a simple conviction: an AI agent framework earns trust not by adding features, but by being the kind of software you'd run unattended on a Friday night. Memory that doesn't forget. Retries that don't amplify. Sandboxes that don't leak. Every contributor who hardened a boundary, caught a race condition, or added a test — you made nanobot more trustworthy today than it was yesterday. That's the only metric that matters.

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.1.4.post6...v0.1.5

What's Changed
New Contributors

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.1.4.post6...v0.1.5

View originalPermalink
How v0.1.5 went

v0.1.4.post6

Added 7
  • Email content is tagged with [EMAIL-CONTEXT] to prevent LLM prompt injection from email bodies
  • WeChat (Weixin) joined as a full channel with HTTP long-poll, QR code login, and plugin 1.0.3 compatibility
  • Mistral and OVMS providers arrived
  • Step Fun provider joined the ecosystem
  • Per-session concurrent dispatch capability
  • Native multimodal sensory capabilities added to agent
  • Onboard wizard became full-featured with timezone configuration
Changed 13
  • Agent runtime was decomposed into composable pieces with a shared AgentRunner, unified lifecycle hooks in HookContext, and refactored command routing into a plugin-friendly structure
  • Replaced litellm with native OpenAI and Anthropic SDKs for direct upstream communication
  • Prompt cache optimization for Anthropic and proper max_completion_tokens handling for OpenAI o1
  • Gemini thought signature is now preserved
  • Streaming output now flows end-to-end from provider to channel to CLI as a first-class path
  • Feishu gained CardKit streaming support and queued stream deltas are coalesced to reduce API calls
Security 1
  • Fixed email injection and spoofing vulnerability by verifying SPF/DKIM through Authentication-Results headers with verify_dkim and verify_spf enabled by default

🐈 nanobot v0.1.4.post6 is here — 57 PRs merged, 27 new contributors, and a release that's less about adding surface area than about rethinking what's underneath.

Some releases are about what you can do. This one is about how cleanly you can do it. The agent runtime got formally decomposed, a major dependency was removed, streaming went end-to-end, and a security vulnerability was closed. Beneath the feature work, v0.1.4.post6 is a structural turning point — the kind of release that makes the next release possible.

Highlights

  • The agent runtime was decomposed into composable pieces — A shared AgentRunner was extracted, lifecycle hooks were unified into a formal HookContext, and subagent progress is now preserved even on failure. Command routing was refactored into a plugin-friendly structure, and process_direct was unified to return OutboundMessage consistently. This isn't just cleanup — it's the foundation for pluggable agent behaviors, custom execution strategies, and third-party lifecycle integrations that are coming next. (#2524, #2541, #2388, #2338)

  • litellm was replaced with native OpenAI + Anthropic SDKs — The entire provider layer was rewritten to talk directly to upstream SDKs instead of routing through litellm. Prompt cache optimization for Anthropic, proper max_completion_tokens handling for OpenAI o1, and Gemini thought signature preservation all came along for the ride. If you've ever debugged a litellm traceback at 2am, you understand why this matters. (#2448, #1109, #2468, #2550, #2453)

  • Streaming went end-to-end — From provider to channel to CLI, streaming output now flows as a first-class path. Feishu gained CardKit streaming support, queued stream deltas are coalesced to reduce API calls, and the channel manager handles stream boundaries correctly. This is the difference between "the bot is typing..." and actually watching it think. (#2365, #2545, #2497)

  • A security vulnerability was patched — Email injection and spoofing via missing authentication verification has been fixed. Inbound emails now verify SPF/DKIM through Authentication-Results headers, with verify_dkim and verify_spf enabled by default. Email content is tagged with [EMAIL-CONTEXT] to prevent LLM prompt injection from email bodies. See the advisory for details. (GHSA-4gmr-2vc8-7qh3)

  • WeChat support landed as a full channel — WeChat (Weixin) joined the channel family with HTTP long-poll, QR code login, and plugin 1.0.3 compatibility. Alongside it, Telegram, QQ, WhatsApp, and Feishu all received cross-channel enhancements including retry mechanisms with exponential backoff. (#2412, #2428, #2386, #2478)

  • Provider coverage kept expanding — Mistral and OVMS providers arrived, Step Fun (阶跃星辰) joined the ecosystem, and custom provider error reporting got much more honest — raw API errors instead of opaque JSONDecodeError. nanobot continues to meet users wherever their models live. (#2199, #2472, #2289, #2139)

  • The agent got smarter about resources — Per-session concurrent dispatch landed, native multimodal sensory capabilities were added, token estimation now counts all message fields, and memory consolidation properly reserves completion headroom. The agent loop also handles CancelledError gracefully and records subagent results with correct roles. (#2393, #2304, #2344, #2378, #2239, #2104)

  • Feishu and Telegram both leveled up — Feishu gained streaming cards, code block parsing in post messages, and fixes for markdown rendering and media types. Telegram got HTTP(S) URL media support, separated connection pools to prevent pool exhaustion, and quieter network error logging. Small individually, substantial together. (#2545, #2246, #1814, #1755, #1793, #2247, #2272)

  • CLI and onboarding became more capable — A full-featured onboard wizard arrived, --dir enables multiple instances, /status shows runtime info, -h works everywhere, and timezone is now configurable. The kind of polish that makes first-run experience feel intentional. (#2101, #1763, #1985, #2123, #2477, #1136, #2266)

  • Infrastructure hardened across the board — Zombie processes are reaped on shell timeout, cron job stores are scoped to workspaces, MCP tool schemas handle nullable params correctly, Docker builds include openssh-client, and the test suite was reorganized into a cleaner structure. The kind of work that prevents the bug report you'd otherwise file next month. (#2362, #2204, #2230, #2287, #1911, #2427, #2367)

Community

A warm welcome to our 27 new contributors in this release.

v0.1.4.post6 is shaped by a belief that the most important work in open source isn't always the most visible. Replacing a core dependency, decomposing a runtime, closing a security hole — none of these make for flashy demos, but all of them make nanobot a project you can build on with more confidence tomorrow than yesterday. Thank you to everyone who contributed code, fixes, docs, and ideas. The foundation is getting stronger.

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.1.4.post5...v0.1.4.post6

What's Changed
New Contributors

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.1.4.post5...v0.1.4.post6

View originalPermalink
How v0.1.4.post6 went

v0.1.4.post5

Added 7
  • Async background consolidation for memory
  • Channel plugin architecture
  • Ollama support for local models
  • VolcEngine and BytePlus joined the provider ecosystem
  • Support for openrouter/* models
  • Langsmith integration for better conversation tracking
  • Feishu reply and quote support
Changed 6
  • Consolidation inputs are passed through more faithfully
  • save_memory is enforced more consistently
  • Channel discovery is now automatic
  • Built-in channel and config boundaries are cleaner
  • Web search providers are now configurable with fallback behavior
  • Filesystem and shell tooling improvements for pagination, fallback matching, and output behavior
Fixed 6
  • Agent loops are less likely to crash
  • MCP connections now handle cancellation better
  • Orphaned tool results are preserved correctly
  • Async CLI and subagent output behaves more cleanly
  • Payloads are validated before persistence
  • Built-in skill packaging

🐈 nanobot v0.1.4.post5 is here — 57 PRs merged, 29 new contributors, and a release cycle shaped less by spectacle than by something quieter: careful refinement where it matters most.

This is the kind of release that makes a project feel more trustworthy in daily use. The edges got smoother, the failure modes got softer, and the platform got broader. Across channels, providers, memory, MCP, CLI, and infrastructure, nanobot is becoming not just more capable, but more dependable — more like a tool you can actually live with.

Highlights

  • Reliability took center stage — A lot of this release is about making nanobot fail more gracefully. Agent loops are less likely to crash, MCP connections now handle cancellation better, orphaned tool results are preserved correctly, and async CLI/subagent output behaves more cleanly. (#1999, #1953, #2075, #1930, #2039)

  • Memory became more practical — Async background consolidation landed, consolidation inputs are passed through more faithfully, payloads are validated before persistence, and save_memory is enforced more consistently. This is a meaningful step toward memory that feels less magical and more reliable. (#1961, #1962, #1868, #1810, #1909)

  • The channel layer keeps maturing — Channel plugin architecture arrived, channel discovery is now automatic, and built-in channel/config boundaries are cleaner. That kind of structural work matters: it makes growth easier without making the system brittle. (#1982, #1888)

  • Provider support keeps expanding outward — Ollama support landed for local models, VolcEngine and BytePlus joined the ecosystem, openrouter/* models are supported, and web search providers are now configurable with fallback behavior. nanobot is increasingly meeting users where they already are. (#1863, #1608, #2026, #398)

  • Observability and tooling got stronger — Langsmith integration brings better conversation tracking, built-in skill packaging got fixed up, and smarter filesystem/shell tooling improves pagination, fallback matching, and output behavior. The system is becoming easier to inspect and easier to trust. (#1920, #1416, #1895)

  • Feishu saw major polish — Reply/quote support landed, tool calls can now render in code blocks, group mention behavior improved, Groq Whisper audio compatibility was fixed, and broader multimedia handling got much better. Feishu support feels substantially more complete after this cycle. (#1963, #1966, #1768, #1741, #2034)

  • Telegram got meaningfully better in groups and media workflows — Group response behavior is now configurable, reply-to-message context works across text and media, and media filename collision bugs were cleaned up. These are small details individually, but together they make conversations feel much more natural. (#1389, #1900, #1796)

  • Enterprise and collaboration channels improved too — WeCom channel support landed, Slack thread behavior was clarified, QQ legacy plain-text replies were restored, and DingTalk gained both voice recognition text retrieval and multimedia improvements. (#1327, #1784, #1941, #1859, #2034)

  • CLI and runtime behavior are more predictable — Gateway port defaults now respect config, restart flows are more portable, Windows compatibility got attention, and shell/workspace guards became stricter around home-expanded and tilde-based paths. This is the kind of work users only notice when it’s missing — which is exactly why it matters. (#1797, #1785, #1958, #1479, #1827, #1845)

  • A lot of sharp edges disappeared — Hidden files are no longer synced by accident, non-vision models won’t receive image_url, heartbeat and cron got less noisy, and version IDs now show up in logs. These aren’t flashy changes, but they make nanobot feel more settled, more deliberate, and more production-ready. (#1856, #1901, #1973, #2058)

Community

A huge welcome to our 29 new contributors in this release.

Open source grows in two ways: through bold new ideas, and through the patient work of noticing rough edges and smoothing them out. v0.1.4.post5 has plenty of both. Thank you to everyone who contributed features, fixes, refactors, docs, and infrastructure improvements — nanobot is becoming stronger not all at once, but through many careful hands moving it forward together.

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.1.4.post4...v0.1.4.post5

What's Next

Looking ahead, we’ll continue moving nanobot toward a more modular, plugin-oriented ecosystem. As a first step, we plan to experiment and iterate in the channel layer first — using channels as the proving ground for a more extensible architecture before expanding that approach further across the project.

We’ll also keep using the nightly branch for faster testing, earlier feedback, and quicker iteration on new ideas. If you’re interested in helping shape that future, we’d warmly welcome contributions there. You can find the contribution workflow and guidelines in CONTRIBUTING.md.

And one more small note: v0.1.4.post5 will likely be the last release in the 0.1.4 line. It closes out this cycle with a lot of polish and hard-earned stability — and also makes room for what comes next.

The next main version is already taking shape, and we think it will be worth the wait. 😉

What's Changed
New Contributors

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.1.4.post4...v0.1.4.post5

View originalPermalink
How v0.1.4.post5 went

More in Developer Tools

View all
yt-dlp

A feature-rich command-line audio/video downloader

yt-dlp
tmux

tmux release notes.

tmux
Claude Code

Anthropic's agentic coding tool for the terminal, IDE and web.

Anthropic
cli

cli release notes.

cli
Shadowrocket

Rule based proxy utility client for iPhone/iPad.

Shadow Launch Technology Limited
AWS CLI

One tool to manage every AWS service from the command line, and script them.

Amazon Web Services

Discussion