nanobot v0.3.0

v0.3.0
Added 11
  • nanobot webui command prepares the local WebUI channel, starts the gateway, opens the browser, and leads first-time users into guided setup
  • Inline subagents can consult inside the active task with explicitly authorized work continuing through verification
  • /goal command opts a task into sustained execution with clearer permission, cancellation, timeout, heartbeat, and local-trigger behavior
  • OpenCode Zen and OpenCode Go providers
  • Kimi Coding provider
  • Grok OAuth with hosted X Search provider
Changed 7
  • WebUI chats now read as topics with quoted follow-ups, document attachments, multimodal tool results, and file diffs visible in conversation
  • Model presets can be switched from the composer
  • Native desktop hosts can open a system folder picker
  • Settings work better across narrow screens and dark mode
  • Configuration can reload without tearing down the process
  • Typed runtime context keeps provider-owned state out of ad hoc loop logic
  • Traditional Chinese language substantially improved in WebUI
Fixed 2
  • Chained-command allowlist bypasses are now blocked
  • SSRF checks pin validated DNS
Security 3
  • Credentials are redacted from MCP URLs
  • Remote API binds require authentication
  • Attachment ingress is constrained

🐈 nanobot v0.3.0 is here: 260 PRs merged and 38 new contributors. The agent gained agency.

The fastest way to experience the release is one command:

nanobot webui

It prepares the local WebUI, starts the gateway, and opens the browser workbench. On a fresh install, guided setup helps you choose a provider and configure access without beginning in a JSON file. The published package already includes the WebUI, so there is no separate frontend build.

The product story is a WebUI that now feels like the front door to nanobot. Chats read as topics; documents, quoted follow-ups, multimodal tool results, file diffs, code previews, and model fallback are visible in the conversation. Model presets can be switched from the composer, native desktop hosts can open a system folder picker, settings work better across narrow screens and dark mode, and the interface now includes Brazilian Portuguese plus substantially improved Traditional Chinese.

Underneath that experience is agency with boundaries. nanobot can consult inline subagents, carry explicitly authorized work through verification, route turn state through a clearer runtime context, and switch model presets per session. Long-running behavior is deliberate: /goal opts a task into sustained execution, while ordinary conversations remain ordinary conversations.

The foundation is a runtime built for real deployment. Configuration can reload without tearing down the process, channels have clearer package boundaries, gateway restart and shutdown paths are sturdier, and Docker and Render deployment are easier to reproduce. Provider-scoped proxies, OpenCode, Kimi Coding, Grok OAuth with hosted X Search, Parallel Search, Serper, Mattermost, and the native Neonize WhatsApp channel broaden where nanobot can run and what it can reach.

Highlights
  • One command to the workbench - nanobot webui prepares the local channel, starts the gateway, opens the browser, and leads first-time users into guided setup.
  • A stronger browser workbench - Topic-style chats, composer model switching, quoted follow-ups, document attachments, native folder selection, responsive settings, and clearer fallback state.
  • Agent coordination without core sprawl - Inline subagents can consult inside the active task, authorized work can continue through verification, and typed runtime context keeps provider-owned state out of ad hoc loop logic.
  • Explicit long-running goals - Sustained execution is gated behind /goal, with clearer permission, cancellation, timeout, heartbeat, and local-trigger behavior.
  • Files and tool activity you can inspect - Syntax-highlighted previews, live file-edit diffs, better code-copy behavior, structured tool errors, richer MCP artifacts, and preserved multimodal tool output.
  • A more operational runtime - Live configuration reloads, bounded session and exec state, safer restart/shutdown, cleaner cancellation ownership, more reliable scheduled work, and faster CI.
  • Broader providers and search - OpenCode Zen/Go, Kimi Coding, Grok OAuth, provider-scoped proxies, Copilot Enterprise overrides, Parallel Search, Serper, and steadier authentication fallback.
  • Channels as maintainable extensions - Native Neonize WhatsApp, Mattermost, improved Feishu/Telegram/Discord/Matrix/QQ behavior, optional channel dependencies, and clearer setup flows.
  • Security tightened at the edges - Chained-command allowlist bypasses are blocked, SSRF checks pin validated DNS, credentials are redacted from MCP URLs, remote API binds require authentication, and attachment ingress is constrained.
  • Documentation and delivery caught up - Workflow-oriented docs, an automation guide, one-click Render deployment, stronger Docker controls, community-maintained project language, and a refreshed SVG identity.
Upgrade Notes
  • WhatsApp now uses Neonize instead of the old Node.js/Baileys bridge. Remove bridgeUrl and bridgeToken, run nanobot plugins enable whatsapp, and link the account again with nanobot channels login whatsapp. The old bridge authentication data is not reused. allowFrom entries should use the sender ID without a leading +.
  • Sustained goals are now explicit. Use /goal when a task should keep working across continuation turns. Normal chats no longer inherit long-running goal behavior implicitly.
  • Remote exposure requires authentication. Configurations that bind the API or WebUI gateway beyond loopback must provide the corresponding API or Web token. Localhost setup continues to use the guided short-lived token flow.
Community

Thank you to everyone who shaped v0.3.0: 260 merged PRs, 38 first-time contributors, and a month of careful review across the agent core, WebUI, providers, channels, security, documentation, and deployment. The Agency Release is not about making nanobot act without limits. It is about giving a small, inspectable agent the coordination, evidence, and operational discipline to finish more of the work you intentionally hand it.

What's Changed
New Contributors

Full Changelog: https://github.com/HKUDS/nanobot/compare/v0.2.2...v0.3.0

View original

Upgraded? How did it go?

Discussion