Track ordered NanoBot updates after the July ancestry bridge

[dajiaohuang]

NanoBot upstream history is connected through 053722a2a2722e846d68562519bfbb4bc1b8c393 by #10. This issue tracks the remaining updates through the pinned upstream revision b9e7c7f6fe67253fecc387df49604ae40e4bc6b4 as small, ordered, reviewable pull requests.

This is a selective semantic integration, not a blanket merge. Each batch must preserve SagaSmith's authoritative MCP boundaries, hosted worker behavior, Local Agent Kit contract, package identity, and Apache-2.0 licensing/third-party notices.

Ordered batches

• Security and correctness equivalence
• Session persistence and recovery
• Agent lifecycle, streaming, and reasoning behavior
• MCP readiness and OAuth lifecycle
• Channel package updates in bounded waves
• Portable plugin support
• WebUI functional slices
• Provider updates
• Native TUI and Herdr integration review
• Usage, retrieval, and subagent concurrency improvements

Per-PR acceptance gate

• Pin and cite the exact upstream commit(s) included.
• List reviewed upstream commits intentionally skipped or deferred.
• Adapt behavior to SagaSmith rather than overwriting product-specific contracts.
• Add or update focused regression tests.
• Run the full relevant Python, WebUI, and distribution checks for the changed surface.
• Keep licensing and third-party attribution intact.
• Use a separate PR for dependency-only upgrades or unrelated cleanup.

Current batch

• Fix GitStore same-size rewrite detection #15 semantically backports HKUDS/nanobot@9f5a56f1ec224ca794017d4ab3f5f2d0ad60e4fc so GitStore detects rapid same-size rewrites even when filesystem mtime is preserved.

• fix(search): bound find_files scans #16 semantically backports HKUDS/nanobot@649e3958c58bbf12342d2b254f3c40dea4d42f07 as the dedicated search-tool batch, preserving SagaSmith's current search schema and Grep/document surface while adding worker-thread cancellation, lexicographic early pagination, and bounded scans.

• fix(discord): route unauthorized DMs to pairing #17 semantically backports HKUDS/nanobot@6d406d93c902e209f56f9f0ec0872fcb8abb5aa6, restoring Discord first-contact DM pairing while preserving guild-side prefiltering and SagaSmith principal routing.

• fix(exec): validate allow patterns per shell segment #18 semantically integrates upstream exec-policy sequence bbca32fe through af582246, validating every top-level shell segment across POSIX, PowerShell, and cmd while deferring E2 path parsing.

• fix(mcp): preserve real task cancellation #19 semantically integrates the MCP cancellation sequence 86f65587 -> 297a9e59 -> d4f5abe0, preserving real task cancellation while containing leaked MCP SDK CancelledError.

• fix(exec): guard shell path boundaries #20 semantically integrates exec path-boundary commits 01c7323d and d3382d7e, including SagaSmith fail-closed handling for bare ~1 directory-stack paths.

• fix(image): harden provider URL downloads #21 semantically integrates provider-returned image URL hardening from 681edfa6, 4408cde0, cc3dbbe8, d73794bc, and b3d3a3e6, preserving SagaSmith MIME and download boundaries.

• fix(web): keep credential URLs away from Jina #22 semantically integrates the Jina credential-privacy sequence 31a71d6 through 5f916bbd and 76f629e9, preventing user-credential forwarding outside the trusted Jina boundary.

• fix(slack): validate file downloads against SSRF #23 semantically integrates Slack download SSRF hardening from a4acd839, validating initial and redirected URLs, pinning direct DNS connections, preserving trusted proxy egress, and stripping cross-origin authorization.

• fix(memory): prune encoded Dream sessions #28 semantically backports HKUDS/nanobot@791c7fd505e653b87801d858980c1e116f0b6852, pruning base64url-encoded Dream sessions while ignoring legacy and non-Dream session files.

Completed foundations

• Fix GitStore same-size rewrite detection #15 merged the GitStore same-size rewrite detection backport after all six CI checks passed.

• Connect imported NanoBot history through the July snapshot #10 connected the imported NanoBot ancestry without changing the product tree.

• Include the config package in built wheels #11 restored complete nanobot/config wheel contents and added installed-wheel verification.

• Reject oversized file reads before loading content #14 semantically backported HKUDS/nanobot@cdb2df49827b674fb5a685acc44dc3a8f99329dd, rejecting oversized reads before PDF, Office, image, or text content is loaded.

[dajiaohuang]

Security/correctness batch E1 is complete in #18 (squash commit 74346d8d68423d2db74056ec09a12952c4582a27).

This was a semantic integration of the ordered upstream sequence bbca32fe → f4a7079e → 12c52c11 → ab6ceef1 → d5658dbc → af582246, not a blanket merge. SagaSmith now evaluates allowPatterns for every top-level executable shell segment across POSIX, PowerShell, and cmd syntax, preserves background/redirection semantics, and fails closed for nested command substitution forms.

Validation:

• focused exec-policy suite: 43 passed
• affected security suite: 234 passed, 18 skipped
• full Python suite: 5,192 passed, 48 skipped
• Ruff, WebUI 480 tests/build, wheel/Hosted boundary checks: passed
• PR checks: 6/6 passed
• post-merge main run: https://github.com/SagaSmithAI/SagaSmith-agent/actions/runs/33091984881 (6/6 passed)

The E2 path-parsing commits 01c7323d and d3382d7e remain explicitly deferred to their own reviewable batch.

[dajiaohuang]

MCP correctness batch M1 is complete in #19 (final main merge node 16ac126).

This semantically integrates the ordered upstream sequence 86f6558707aa395e95bdf401bb416624adf78ec7 -> 297a9e59396825ef95202d0a7ac0b6fa215dc47c -> d4f5abe004c7c5bf03fb827c43644b03da083f35. Real asyncio task cancellation now propagates, while cancellation leaked by the MCP SDK during teardown remains contained. SagaSmith principal, authorization, session, and hosted-worker boundaries were unchanged.

Validation:

• focused MCP/loop regressions: passed
• full Python suite: 5,198 passed, 48 skipped
• Ruff and diff checks: passed
• PR checks: 6/6 passed

GitHub partially completed the first squash attempt by writing commit 81f2418 but leaving the PR open. The final merge node only reconciles ancestry: the squash, PR head, and final merge all have tree 03654ea925bc4cdac4e9a2e5452848ae54a4c3b7, and git diff between them is empty. Because that reconciliation changed no files, the push workflow path filter emitted no additional run; the six green PR checks cover the exact final tree.

[dajiaohuang]

Security/correctness batch E2 is complete in #20 (squash commit 8cfd09b).

This semantically integrates NanoBot 01c7323d and d3382d7e. Shell path extraction now preserves quoted and escaped punctuation, validates local file URIs and nested command strings, avoids misclassifying URLs/scp targets/Windows drive suffixes, and guards bare, named-user, assignment, and directory-stack tilde forms. SagaSmith additionally fails closed for bare ~1 and verifies that E1 allow-pattern matches cannot bypass containment in bash, PowerShell, or cmd.

Validation:

• focused post-rebase suite: 189 passed, 9 skipped
• affected suite: 341 passed, 26 skipped
• full Python suite: 5,052 passed, 59 skipped
• Ruff and diff checks: passed
• PR checks: 6/6 passed
• post-merge main run: https://github.com/SagaSmithAI/SagaSmith-agent/actions/runs/33095757667 (6/6 passed)

The next security slices remain separate: provider-returned image URL hardening, Jina credential privacy, and Slack file-download SSRF validation.

[dajiaohuang]

Security/privacy batches N1, W1, and N2 are complete.

• fix(image): harden provider URL downloads #21 merged as 511451d9cef3c2e2f1ee4cf6df44d16d312e734c, semantically integrating NanoBot 681edfa6f33b47d8bc0079e6c2d377a80cb92d39, 4408cde019eeba1ebf75ab1f4ebffaa425e278ae, cc3dbbe804ba3cc683baa096a923b868b011e75c, d73794bc688971428c5612bec90e19234ba81f2a, and b3d3a3e6c35496551e47a6681d12a0afc385f728 for provider-returned image URL hardening.
• fix(web): keep credential URLs away from Jina #22 merged as b614c38192fc94f303afe0c65da065b24999924f, semantically integrating NanoBot 31a71d6 → 5f916bbd → 76f629e9 for Jina credential privacy.
• fix(slack): validate file downloads against SSRF #23 merged as a86300dacc2bbd296a3437edd300d1f1f8cb4264, semantically integrating NanoBot a4acd8396647f4fe1e77aa5663d5cf0659506bec for Slack file-download SSRF and redirect hardening.

Validation:

• N1 focused suite: 129 passed; full Python suite: 5,252 passed, 56 skipped.
• W1 affected suite after final rebase: 167 passed; full Python suite: 5,279 passed, 56 skipped.
• N2 Slack/network suite after final rebase: 68 passed; pre-rebase full Python suite: 5,231 passed, 56 skipped.
• Ruff and diff checks passed for all three batches.
• Each PR passed all 6 required checks with no unresolved review thread.
• Post-merge main runs passed 6/6: runs 33098301991, 33099118734, and 33099734725.

The trusted-proxy path remains an explicit deployment trust boundary: direct downloads use pinned DNS transport, while configured environment proxies are treated as trusted egress. Cross-origin redirects strip Slack authorization. These choices preserve proxy deployments without weakening validation of each initial or redirected target URL.

[dajiaohuang]

Session persistence batch S1 is complete in #28 (squash commit 7b7caacb1d6ba2ef4b1dfa241787456da50bc607).

This semantically backports HKUDS/nanobot@791c7fd505e653b87801d858980c1e116f0b6852: Dream-session pruning now decodes the SessionManager base64url storage key before identifying dream: sessions, while legacy-looking and non-Dream files remain untouched.

Validation:

• focused regression tests: 6 passed
• full Python suite: 5,171 passed, 72 skipped; coverage 77.81%
• Ruff, WebUI lint, 480 WebUI tests, and production build passed
• clean wheel build plus installed Hosted-wheel boundary/entrypoint audit passed
• PR checks: 11/11 passed
• post-merge main workflow: https://github.com/SagaSmithAI/SagaSmith-agent/actions/runs/33182248275 (11/11 passed)

Adjacent upstream commits 8c9110fe, ed47cf15, and 6e462e62 remain deferred to separate ordered batches.