fix(exec): allow scoped tmp cleanup commands

* fix(channels): complete dependency manifest migration

* docs(docker): clarify custom uid dependency installs

* fix(channels): keep dependency preinstall internal

* refactor(channels): move dependency installer to scripts

* fix(docker): limit runtime write access

.github/workflows/ci.yml

@@ -57,21 +57,26 @@ jobs:
       - name: Install dependencies
         run: uv sync --all-extras --dev
 
+      - name: Install channel dependencies
+        run: uv run --no-sync python -m scripts.install_channel_dependencies --all-channels
+
+      # Channel requirements live in manifests rather than uv.lock. Avoid a
+      # later uv run sync pruning the packages installed by the previous step.
       - name: Lint with ruff
         if: matrix.coverage
-        run: uv run ruff check nanobot tests conftest.py
+        run: uv run --no-sync ruff check nanobot tests conftest.py
 
       - name: Run tests with coverage
         if: matrix.coverage
         run: >-
-          uv run python -m pytest
+          uv run --no-sync python -m pytest
           --cov=nanobot --cov-report=term-missing:skip-covered
           --durations=25 --durations-min=1.0
 
       - name: Run compatibility tests
         if: ${{ !matrix.coverage }}
         run: >-
-          uv run python -m pytest
+          uv run --no-sync python -m pytest
           --durations=25 --durations-min=1.0
 
   webui:
@@ -105,3 +110,22 @@ jobs:
       - name: Build WebUI
         working-directory: webui
         run: bun run build
+
+  docker:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build image with default channel dependencies
+        run: docker build -t nanobot:test .
+
+      - name: Verify default WhatsApp dependencies
+        run: docker run --rm --entrypoint python nanobot:test -c "import neonize, segno"
+
+      - name: Verify runtime dependency permissions
+        run: >-
+          docker run --rm --user 1000:1000 --entrypoint sh nanobot:test -c
+          'test -w /app/.venv && test ! -w /app && test ! -w /app/nanobot &&
+          python -m scripts.install_channel_dependencies discord && python -c "import discord"'

Dockerfile

@@ -15,18 +15,38 @@ RUN apt-get update && \
 
 WORKDIR /app
 
+# Keep the runtime environment writable by the non-root nanobot user. Enabled
+# channels may install their manifest-declared dependencies at startup.
+ENV VIRTUAL_ENV=/app/.venv
+ENV PATH="/app/.venv/bin:$PATH"
+RUN uv venv --seed "$VIRTUAL_ENV"
+
 # Install Python dependencies first (cached layer). Hatch reads the custom build
 # hook from hatch_build.py even for this metadata-only install.
-ARG NANOBOT_EXTRAS=whatsapp
+ARG NANOBOT_EXTRAS=
 COPY pyproject.toml README.md LICENSE THIRD_PARTY_NOTICES.md hatch_build.py ./
 RUN mkdir -p nanobot && touch nanobot/__init__.py && \
-    NANOBOT_SKIP_WEBUI_BUILD=1 uv pip install --system --no-cache ".[$NANOBOT_EXTRAS]" && \
+    if [ -n "$NANOBOT_EXTRAS" ]; then \
+        NANOBOT_SKIP_WEBUI_BUILD=1 uv pip install \
+            --python "$VIRTUAL_ENV/bin/python" --no-cache ".[${NANOBOT_EXTRAS}]"; \
+    else \
+        NANOBOT_SKIP_WEBUI_BUILD=1 uv pip install \
+            --python "$VIRTUAL_ENV/bin/python" --no-cache .; \
+    fi && \
     rm -rf nanobot
 
 # Copy the full source and install
 COPY nanobot/ nanobot/
+COPY scripts/install_channel_dependencies.py scripts/
 COPY --from=webui-builder /app/nanobot/web/dist/ nanobot/web/dist/
-RUN NANOBOT_SKIP_WEBUI_BUILD=1 uv pip install --system --no-cache ".[$NANOBOT_EXTRAS]"
+RUN NANOBOT_SKIP_WEBUI_BUILD=1 uv pip install --python "$VIRTUAL_ENV/bin/python" --no-cache .
+
+# Preinstall selected channel dependencies from their manifests. A comma-separated
+# list keeps the image configurable while preserving WhatsApp in the default image.
+ARG NANOBOT_CHANNELS=whatsapp
+RUN for channel in $(printf '%s' "$NANOBOT_CHANNELS" | tr ',' ' '); do \
+        python -m scripts.install_channel_dependencies "$channel"; \
+    done
 
 # Render deploy template (see render.yaml): committed gateway config that wires
 # secrets through ${ANTHROPIC_API_KEY} / ${NANOBOT_WEB_TOKEN} env vars (resolved
@@ -34,10 +54,10 @@ RUN NANOBOT_SKIP_WEBUI_BUILD=1 uv pip install --system --no-cache ".[$NANOBOT_EX
 # won't shadow it. Only used when RENDER=true; ignored by local runs.
 COPY render-config.json ./
 
-# Create non-root user and config directory
+# Create the non-root user and hand ownership of the writable virtualenv to it.
 RUN useradd -m -u 1000 -s /bin/bash nanobot && \
     mkdir -p /home/nanobot/.nanobot && \
-    chown -R nanobot:nanobot /home/nanobot /app
+    chown -R nanobot:nanobot /home/nanobot /app/.venv
 
 COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN sed -i 's/\r$//' /usr/local/bin/entrypoint.sh && chmod +x /usr/local/bin/entrypoint.sh

docker-compose.yml

@@ -2,6 +2,8 @@ x-common-config: &common-config
   build:
     context: .
     dockerfile: Dockerfile
+    args:
+      NANOBOT_CHANNELS: ${NANOBOT_CHANNELS:-whatsapp}
   volumes:
     - ~/.nanobot:/home/nanobot/.nanobot
   cap_drop:

docs/channel-package-guide.md

@@ -235,7 +235,7 @@ Do not add a runtime module directly under `nanobot/channels/`, create a paralle
 
 `manifest.py` exports a typed `ChannelPlugin` whose `runtime` target is an absolute import target, such as `nanobot.channels.telegram.runtime:TelegramChannel`; using `f"{__package__}.runtime:TelegramChannel"` keeps it package-owned without repeating the package path. Discovery imports the manifest before it knows whether the optional platform dependency is installed, so `manifest.py` must not import `runtime.py` or any platform SDK. Import runtime symbols from `runtime.py` explicitly; `__init__.py` remains an inert package marker.
 
-The manifest owns the channel name, display name, setup contract, management adapter, optional connector target, optional dependency extra, capabilities, default activation, and optional WebUI entry path. The management adapter alone decides whether a channel is single-instance or multi-instance.
+The manifest owns the channel name, display name, setup contract, management adapter, optional connector target, dependency requirements, capabilities, default activation, and optional WebUI entry path. The management adapter alone decides whether a channel is single-instance or multi-instance.
 
 Interactive browser setup uses one small connector contract. Set `connector=f"{__package__}.connect:MyConnectStore"`; the target is loaded only when `/api/settings/channels/<name>/connect/{start,poll,cancel}` is called. The store exposes one async `handle(action, query)` method and keeps platform-specific parsing, sessions, and errors inside the channel package. The shared settings router only authenticates, dispatches, and applies a successful connection.
 
@@ -777,6 +777,7 @@ git clone https://github.com/HKUDS/nanobot.git
 cd nanobot
 python -m pip install -e .
 nanobot plugins list    # should show the package as "webhook"
+nanobot plugins enable webhook
 nanobot gateway         # test end-to-end
 ```
 

docs/chat-apps.md

@@ -46,8 +46,8 @@ The sections below explain what each chat platform requires and provide manual c
 
 > [!NOTE]
 > If you are upgrading from a version where chat app SDKs were installed by default,
-> install the channel extra in the same Python environment before enabling or
-> restarting that channel:
+> enable the channel in the same Python environment so nanobot installs its
+> manifest-declared dependencies:
 >
 > ```bash
 > nanobot plugins enable <channel>
@@ -185,7 +185,7 @@ Uses **Socket.IO WebSocket** by default, with HTTP polling fallback.
 nanobot plugins enable mochat
 ```
 
-Without this extra, Mochat still works through HTTP polling.
+Without these dependencies, Mochat still works through HTTP polling.
 
 **1. Ask nanobot to set up Mochat for you**
 

docs/configuration.md

@@ -204,6 +204,8 @@ These variables are process-level switches. Set them in the same terminal, servi
 | `NANOBOT_SKIP_WIZARD` | unset | Set to `1` to skip `nanobot onboard --wizard` after one-command install. |
 | `NANOBOT_SKIP_WEBUI_BUILD` | unset | Set to `1` to skip bundling the WebUI during package builds. |
 | `NANOBOT_FORCE_WEBUI_BUILD` | unset | Set to `1` to rebuild the bundled WebUI even when `nanobot/web/dist/index.html` already exists. |
+| `NANOBOT_EXTRAS` | unset | Docker build argument containing comma-separated Python extras such as `bedrock`. |
+| `NANOBOT_CHANNELS` | `whatsapp` | Docker build argument containing comma-separated channels whose manifest dependencies are preinstalled. |
 | `NANOBOT_API_URL` | `http://127.0.0.1:8765` | Gateway target for the Vite WebUI dev server proxy. |
 
 Internal variables such as `NANOBOT_RESTART_*` and `NANOBOT_PATH_*` are set by nanobot itself and are not a supported user configuration surface.

docs/deployment.md

@@ -62,6 +62,22 @@ Restart the deployed process after editing `config.json`. Long-running processes
 
 ### Docker Compose
 
+The default image preinstalls WhatsApp dependencies. To bake other enabled
+channels into an image (recommended for deployments without PyPI access), pass
+a comma-separated `NANOBOT_CHANNELS` build argument:
+
+```bash
+NANOBOT_CHANNELS=telegram,slack docker compose build
+```
+
+The image keeps nanobot in a virtual environment owned by its built-in non-root
+runtime user (UID 1000). If an enabled channel was not preinstalled, gateway
+startup can therefore install its manifest-declared dependencies. Rebuilding
+with `NANOBOT_CHANNELS` keeps that installation reproducible instead of relying
+on the container's writable layer. If you override the container with a
+different `--user`, bake every enabled channel into the image because that UID
+is not guaranteed write access to the virtual environment.
+
 ```bash
 docker compose run --rm nanobot-cli onboard   # first-time setup
 vim ~/.nanobot/config.json                     # add API keys
@@ -94,6 +110,12 @@ bwrap sandbox is enabled.
 # Build the image
 docker build -t nanobot .
 
+# Or preinstall a regular Python extra such as Bedrock support
+docker build --build-arg NANOBOT_EXTRAS=bedrock -t nanobot .
+
+# Or preinstall dependencies for a specific set of channels
+docker build --build-arg NANOBOT_CHANNELS=telegram,slack -t nanobot .
+
 # Initialize config (first time only)
 docker run -v ~/.nanobot:/home/nanobot/.nanobot --rm nanobot onboard
 

docs/guides/README.md

@@ -44,6 +44,7 @@ Use **Settings → Channels** in the WebUI for guided setup. These guides explai
 | Enable web search | [Configure web search](./configure-web-search.md) |
 | Add model fallback | [Configure model fallback](./configure-model-fallback.md) |
 | Add an OpenAI-compatible provider | [Configure an OpenAI-compatible provider](./configure-openai-compatible-provider.md) |
+| Improve Ollama tool prompt-cache reuse | [Configure Ollama prompt caching](./configure-ollama-prompt-cache.md) |
 | Add Langfuse tracing | [Configure Langfuse observability](./configure-langfuse-observability.md) |
 | Secure local tools | [Secure a local AI agent](./secure-local-ai-agent.md) |
 | Deploy the gateway | [Deploy nanobot gateway](./deploy-nanobot-gateway.md) |

docs/guides/configure-ollama-prompt-cache.md

@@ -0,0 +1,239 @@
+# How to Improve Ollama Tool-Calling Prompt Cache Reuse in nanobot
+
+Some Ollama model templates move or remove tool definitions as a conversation
+switches between user, assistant, and tool messages. nanobot can send a correct
+append-only chat request while the model template still renders a different token
+prefix. On slower local hardware, re-evaluating that prefix can add tens of seconds
+to an otherwise simple tool-using turn.
+
+This guide shows how to diagnose that specific pattern and create a derived
+`llama3.1:8b` tag with a prefix-stable tool template. It does not modify nanobot or
+overwrite the original Ollama model.
+
+## What you will build
+
+- a repeatable two-turn cache check
+- an optional derived `llama3.1:8b-prefix-stable-v1` Ollama tag
+- a nanobot model preset that uses the derived tag
+
+## When to use this
+
+Use this guide when all of the following are true:
+
+- direct Ollama responses are reasonably fast;
+- nanobot becomes slow after the model calls a tool;
+- Ollama logs show a long main prompt, a much shorter tool follow-up, and low
+  initial cache reuse on the next main prompt;
+- the model is `llama3.1:8b` with a template that renders concrete tools only for
+  the final user message.
+
+Do not apply this template to another model family without checking that model's
+tool-call format first.
+
+## Diagnose the rendered prompt
+
+Stop any existing Ollama process, then start a single-slot debug server. A single
+slot makes the cache sequence easier to read.
+
+**macOS or Linux**
+
+```bash
+OLLAMA_CONTEXT_LENGTH=16384 \
+OLLAMA_NUM_PARALLEL=1 \
+OLLAMA_DEBUG=1 \
+ollama serve
+```
+
+**Windows PowerShell**
+
+```powershell
+$env:OLLAMA_CONTEXT_LENGTH = "16384"
+$env:OLLAMA_NUM_PARALLEL = "1"
+$env:OLLAMA_DEBUG = "1"
+ollama serve
+```
+
+In another terminal, use a fresh session and explicitly request a tool so both
+turns exercise the agent loop:
+
+```bash
+nanobot agent --session cli:ollama-cache-check \
+  --message "Use the exec tool to calculate 2+2, then answer"
+nanobot agent --session cli:ollama-cache-check \
+  --message "Use the exec tool to calculate 4+7, then answer"
+```
+
+In the Ollama output, find each `new prompt` line and the first
+`cached n_tokens` line that follows it. Later increasing `cached n_tokens` lines
+are prompt-evaluation progress, not additional initial cache hits.
+
+A cache-unfriendly tool template may produce a pattern like this:
+
+```text
+turn 1 main:             2 / 8460 initially cached
+turn 1 tool follow-up: 3713 / 3758 initially cached
+turn 2 main:          3767 / 8519 initially cached
+```
+
+The cache is working, but the next main request can reuse only the shorter prompt.
+Hardware throughput determines how expensive the remaining evaluation is.
+
+To inspect the API request bodies as well, add
+`OLLAMA_DEBUG_LOG_REQUESTS=1` before starting Ollama. These logs can contain system
+prompts, workspace context, and user messages. Keep them local and disable request
+logging after diagnosis.
+
+## Why this happens with the stock template
+
+The tested `llama3.1:8b` template conditionally expands the tool definitions inside
+a user message:
+
+```gotemplate
+{{- if and $.Tools $last }}
+  ... render tool definitions ...
+{{- end }}
+```
+
+The first request ends with a user message, so the tools are rendered there. After
+nanobot appends an assistant tool call and its result, that user message is no
+longer last, so the same API request history renders without the concrete tool
+block. On the next user turn, the tools reappear at a new position.
+
+This is a model-template behavior. At the API boundary, nanobot continues to append
+the assistant tool call and tool result and sends the same tool definitions.
+
+## Create a prefix-stable derived model
+
+Create `PrefixStable.Modelfile` with the content below. The template keeps concrete
+tool definitions in the system block, where they remain in the same position across
+user and tool messages.
+
+```dockerfile
+FROM llama3.1:8b
+
+TEMPLATE """{{- if or .System .Tools }}<|start_header_id|>system<|end_header_id|>
+{{- if .System }}
+
+{{ .System }}
+{{- end }}
+{{- if .Tools }}
+
+Cutting Knowledge Date: December 2023
+
+When you receive a tool call response, use the output to format an answer to the original user question.
+
+You are a helpful assistant with tool calling capabilities.
+
+Given the following functions, respond with a JSON function call with the proper arguments when a tool is needed.
+
+Respond in the format {"name": function name, "parameters": dictionary of argument name and its value}. Do not use variables.
+
+{{ range .Tools }}
+{{- . }}
+{{ end }}
+{{- end }}<|eot_id|>
+{{- end }}
+{{- range $i, $_ := .Messages }}
+{{- $last := eq (len (slice $.Messages $i)) 1 }}
+{{- if eq .Role "user" }}<|start_header_id|>user<|end_header_id|>
+
+{{ .Content }}<|eot_id|>{{ if $last }}<|start_header_id|>assistant<|end_header_id|>
+
+{{ end }}
+{{- else if eq .Role "assistant" }}<|start_header_id|>assistant<|end_header_id|>
+{{- if .ToolCalls }}
+{{ range .ToolCalls }}
+{"name": "{{ .Function.Name }}", "parameters": {{ .Function.Arguments }}}{{ end }}
+{{- else }}
+
+{{ .Content }}
+{{- end }}{{ if not $last }}<|eot_id|>{{ end }}
+{{- else if eq .Role "tool" }}<|start_header_id|>ipython<|end_header_id|>
+
+{{ .Content }}<|eot_id|>{{ if $last }}<|start_header_id|>assistant<|end_header_id|>
+
+{{ end }}
+{{- end }}
+{{- end }}"""
+```
+
+Create the new tag:
+
+```bash
+ollama create llama3.1:8b-prefix-stable-v1 -f PrefixStable.Modelfile
+ollama list
+```
+
+Ollama reuses the existing model layers. The new tag adds a small template and
+manifest instead of copying the base weights.
+
+## Select the derived model in nanobot
+
+Merge this preset into `~/.nanobot/config.json` and select it:
+
+```json
+{
+  "providers": {
+    "ollama": {
+      "apiBase": "http://localhost:11434/v1"
+    }
+  },
+  "modelPresets": {
+    "ollamaPrefixStable": {
+      "label": "Ollama Llama 3.1 prefix-stable",
+      "provider": "ollama",
+      "model": "llama3.1:8b-prefix-stable-v1",
+      "maxTokens": 2048,
+      "contextWindowTokens": 16384,
+      "temperature": 0.1
+    }
+  },
+  "agents": {
+    "defaults": {
+      "modelPreset": "ollamaPrefixStable"
+    }
+  }
+}
+```
+
+Verify the selected model and repeat the two-turn check:
+
+```bash
+nanobot status
+nanobot agent --session cli:ollama-stable-check \
+  --message "Use the exec tool to calculate 2+2, then answer"
+nanobot agent --session cli:ollama-stable-check \
+  --message "Use the exec tool to calculate 4+7, then answer"
+```
+
+In one controlled test with Ollama 0.32.1, `llama3.1:8b`, and one slot, the second
+main request improved from `3767 / 8519` initially cached (44.22%) to
+`8505 / 8520` (99.82%). The number of re-evaluated tokens fell from 4752 to 15.
+Treat these numbers as a diagnostic example, not a performance guarantee.
+
+## Roll back
+
+Switch `agents.defaults.modelPreset` back to the original preset. When no config
+uses the derived tag, remove it with:
+
+```bash
+ollama rm llama3.1:8b-prefix-stable-v1
+```
+
+Removing the derived tag does not remove `llama3.1:8b`.
+
+## Limitations
+
+- The template above is specific to the tested `llama3.1:8b` tool-call format.
+- Ollama or the model publisher may update the stock template in a later release.
+- Validate multiple tool calls, tool errors, parallel calls, and long conversations
+  before using a custom template for unattended workloads.
+- A higher cache ratio reduces prompt evaluation, but model generation, tool
+  execution, process startup, and storage can still dominate end-to-end latency.
+- Multiple Ollama slots change cache scheduling and may produce different results.
+
+## Related nanobot docs
+
+- [Provider Cookbook: Ollama Local Model](../provider-cookbook.md#recipe-ollama-local-model)
+- [Providers and Models: Ollama](../providers.md#ollama)
+- [Troubleshooting](../troubleshooting.md)

docs/provider-cookbook.md

@@ -431,7 +431,13 @@ curl -sS http://localhost:11434/v1/models
 nanobot agent -m "Hello!"
 ```
 
-If you see `connection refused`, Ollama is not running or `apiBase` points to the wrong port. If the response is very slow, try a smaller local model or lower `contextWindowTokens`.
+If you see `connection refused`, Ollama is not running or `apiBase` points to the wrong port. If every response is slow, try a smaller local model or lower `contextWindowTokens`.
+
+If direct Ollama responses are fast but tool-using nanobot turns repeatedly evaluate
+thousands of prompt tokens, the model's chat template may be moving its tool
+definitions between requests. See
+[Improve Ollama Tool-Calling Prompt Cache Reuse](./guides/configure-ollama-prompt-cache.md)
+for a diagnostic procedure and an optional model-specific workaround.
 
 ## Recipe: vLLM or LM Studio
 

docs/providers.md

@@ -331,6 +331,13 @@ Start Ollama separately, then point nanobot at the OpenAI-compatible endpoint.
 
 Most Ollama setups do not require an API key.
 
+Ollama renders the OpenAI-compatible messages and tools through each model's chat
+template. If ordinary model responses are fast but tool-using turns show low prompt
+cache reuse, diagnose the rendered template before changing nanobot's context or
+memory settings. The
+[Ollama prompt-cache guide](./guides/configure-ollama-prompt-cache.md) explains the
+log pattern and a tested `llama3.1:8b` workaround.
+
 ### vLLM or Other Local OpenAI-Compatible Server
 
 ```json

nanobot/agent/tools/shell.py

@@ -40,6 +40,10 @@ from nanobot.security.workspace_policy import is_path_within
 
 _IS_WINDOWS = sys.platform == "win32"
 
+_RM_COMMAND_RE = re.compile(r"\brm\b")
+_SHELL_COMMAND_SEPARATOR_RE = re.compile(r"(?:&&|\|\||[;&|\r\n])")
+_SHELL_TOKEN_RE = re.compile(r'''"[^"]*"|'[^']*'|[^\s]+''')
+
 
 def _reap_pid(pid: int) -> None:
     """Best-effort ``waitpid`` to reap a child and prevent zombies.
@@ -210,7 +214,6 @@ class ExecTool(Tool):
         self.working_dir = working_dir
         self.sandbox = sandbox
         self.deny_patterns = (deny_patterns or []) + [
-            r"\brm\s+-[rf]{1,2}\b",          # rm -r, rm -rf, rm -fr
             r"\bdel\s+/[fq]\b",              # del /f, del /q
             r"\brmdir\s+/s\b",               # rmdir /s
             r"(?:^|[;&|]\s*)format(?!=)\b",   # format (as standalone command only)
@@ -704,6 +707,74 @@ class ExecTool(Tool):
                 env[key] = val
         return env
 
+    @classmethod
+    def _contains_unscoped_recursive_rm(cls, command: str) -> bool:
+        """Return whether ``command`` contains recursive rm outside a scoped /tmp target.
+
+        The exec guard deliberately remains conservative for recursive deletion, but
+        test and build scripts routinely clean their own named directories below
+        ``/tmp``.  Treat only static, direct ``/tmp/<name>`` targets as scoped cleanup.
+        Any ambiguous invocation (variables, traversal, broad globs, nested paths,
+        mixed targets) stays blocked.
+        """
+        for match in _RM_COMMAND_RE.finditer(command):
+            tail = command[match.end():]
+            segment = _SHELL_COMMAND_SEPARATOR_RE.split(tail, maxsplit=1)[0]
+            tokens = _SHELL_TOKEN_RE.findall(segment)
+            recursive = False
+            targets: list[str] = []
+            parsing_options = True
+            unsafe_redirect = False
+
+            for raw_token in tokens:
+                token = raw_token.strip().strip("\"'")
+                if not token:
+                    continue
+                if token == "--" and parsing_options:
+                    parsing_options = False
+                    continue
+                if parsing_options and token.startswith("--"):
+                    recursive = recursive or token == "--recursive"
+                    continue
+                if parsing_options and re.fullmatch(r"-[a-z]+", token):
+                    recursive = recursive or "r" in token[1:]
+                    continue
+
+                parsing_options = False
+                if token.startswith("#"):
+                    break
+                if re.match(r"^\d*[<>]", token):
+                    redirect_target = re.sub(r"^\d*[<>]+", "", token)
+                    if redirect_target and redirect_target != "/dev/null":
+                        unsafe_redirect = True
+                    continue
+                targets.append(token)
+
+            if recursive and (
+                unsafe_redirect
+                or not targets
+                or not all(cls._is_scoped_tmp_cleanup_target(target) for target in targets)
+            ):
+                return True
+
+        return False
+
+    @staticmethod
+    def _is_scoped_tmp_cleanup_target(raw_target: str) -> bool:
+        """Accept a static, specifically named descendant of the POSIX /tmp root."""
+        target = raw_target.strip().rstrip("\"'),")
+        if not target.startswith("/tmp/"):
+            return False
+
+        relative = target.removeprefix("/tmp/")
+        if not relative or any(char in relative for char in ("$", "`", "\\", "[", "{")):
+            return False
+        if "/" in relative or relative in {".", ".."}:
+            return False
+
+        literal_prefix = re.split(r"[*?]", relative, maxsplit=1)[0]
+        return any(char.isalnum() or char in "_-" for char in literal_prefix)
+
     def _guard_command(
         self,
         command: str,
@@ -723,6 +794,9 @@ class ExecTool(Tool):
             re.fullmatch(p, lower) for p in self.allow_patterns
         )
         if not explicitly_allowed:
+            if self._contains_unscoped_recursive_rm(lower):
+                return ToolResult.error("Error: Command blocked by deny pattern filter")
+
             for pattern in self.deny_patterns:
                 if re.search(pattern, lower):
                     return ToolResult.error("Error: Command blocked by deny pattern filter")

nanobot/skills/update-setup/SKILL.md

@@ -58,7 +58,7 @@ If the user selected `source (git clone)`, ask for the local checkout path:
 **Question 2 — Optional dependencies:**
 
 ```
-question: "Which optional dependencies do you need? List names separated by spaces, or reply 'none'. Available: api, azure, bedrock, langfuse, olostep. Channel dependencies are installed from their manifests when the WebUI gateway starts."
+question: "Which optional dependencies do you need? List names separated by spaces, or reply 'none'. Available: api, azure, bedrock, langfuse, olostep. Channel dependencies are installed from their manifests when the gateway starts."
 ```
 
 Parse the reply. If the user says "none" or similar, set extras to empty. Otherwise collect the valid names.

scripts/install_channel_dependencies.py

@@ -0,0 +1,36 @@
+"""Install channel manifest dependencies for repository build and CI jobs."""
+
+from __future__ import annotations
+
+import sys
+from collections.abc import Sequence
+
+from nanobot.channels.registry import discover_plugins
+from nanobot.optional_features import ensure_enabled_channel_dependencies
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    """Install selected channel dependencies without changing channel configuration."""
+    args = list(sys.argv[1:] if argv is None else argv)
+    if not args:
+        print("Pass channel names or --all-channels.", file=sys.stderr)
+        return 2
+    if "--all-channels" in args and args != ["--all-channels"]:
+        print("Pass channel names or --all-channels, not both.", file=sys.stderr)
+        return 2
+
+    plugins = discover_plugins()
+    names = set(plugins) if args == ["--all-channels"] else set(args)
+    unknown = sorted(names - set(plugins))
+    if unknown:
+        print(f"Unknown channels: {', '.join(unknown)}", file=sys.stderr)
+        return 2
+
+    failures = ensure_enabled_channel_dependencies(names, plugins)
+    for name, message in sorted(failures.items()):
+        print(f"{name}: {message}", file=sys.stderr)
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tests/channels/test_channel_plugins.py

@@ -1499,6 +1499,63 @@ def test_plugins_enable_skips_install_when_extra_is_present(monkeypatch, tmp_pat
     assert not config_path.exists()
 
 
+def test_repository_dependency_installer_selects_all_channel_manifests(monkeypatch):
+    from scripts import install_channel_dependencies as dependencies
+
+    plugins = {
+        "second": ChannelPlugin(
+            name="second",
+            display_name="Second",
+            runtime="missing.second.runtime:SecondChannel",
+            dependencies=("second-sdk>=2",),
+        ),
+        "first": ChannelPlugin(
+            name="first",
+            display_name="First",
+            runtime="missing.first.runtime:FirstChannel",
+            dependencies=("first-sdk>=1",),
+        ),
+    }
+    prepared: list[tuple[set[str], dict[str, ChannelPlugin]]] = []
+    monkeypatch.setattr(dependencies, "discover_plugins", lambda: plugins)
+    monkeypatch.setattr(
+        dependencies,
+        "ensure_enabled_channel_dependencies",
+        lambda names, discovered: prepared.append((names, discovered)) or {},
+    )
+
+    assert dependencies.main(["--all-channels"]) == 0
+    assert prepared == [(set(plugins), plugins)]
+
+
+def test_repository_dependency_installer_rejects_unknown_channel(monkeypatch, capsys):
+    from scripts import install_channel_dependencies as dependencies
+
+    monkeypatch.setattr(dependencies, "discover_plugins", lambda: {})
+
+    assert dependencies.main(["missing"]) == 2
+    assert "Unknown channels: missing" in capsys.readouterr().err
+
+
+def test_repository_dependency_installer_propagates_install_failure(monkeypatch, capsys):
+    from scripts import install_channel_dependencies as dependencies
+
+    plugin = ChannelPlugin(
+        name="demo",
+        display_name="Demo",
+        runtime="missing.demo.runtime:DemoChannel",
+    )
+    monkeypatch.setattr(dependencies, "discover_plugins", lambda: {"demo": plugin})
+    monkeypatch.setattr(
+        dependencies,
+        "ensure_enabled_channel_dependencies",
+        lambda _names, _plugins: {"demo": "dependency install failed"},
+    )
+
+    assert dependencies.main(["demo"]) == 1
+    assert "demo: dependency install failed" in capsys.readouterr().err
+
+
 def test_plugins_disable_channel_writes_config(monkeypatch, tmp_path):
     from typer.testing import CliRunner
 

tests/tools/test_exec_allow_patterns.py

@@ -2,28 +2,94 @@
 
 from __future__ import annotations
 
+import shlex
+import sys
+import tempfile
+from pathlib import Path
+
+import pytest
+
 from nanobot.agent.tools.shell import ExecTool
 
 
 def test_deny_patterns_block_rm_rf():
     """Baseline: rm -rf is blocked by default deny list."""
     tool = ExecTool()
-    result = tool._guard_command("rm -rf /tmp/build", "/tmp")
+    result = tool._guard_command("rm -rf /", "/tmp")
     assert result is not None
     assert "deny pattern filter" in result.lower()
 
 
+@pytest.mark.parametrize(
+    "command",
+    [
+        "rm -rf /tmp/nanobot-test",
+        "rm -fr /tmp/nanobot-test-*",
+        "rm --recursive --force /tmp/nanobot-test-cache",
+        "echo setup && rm -rf /tmp/nanobot-test; echo done",
+        "bash -lc 'pytest tests; rm -rf /tmp/nanobot-test'",
+        "rm -rf '/tmp/nanobot test' 2>/dev/null",
+    ],
+)
+def test_deny_patterns_allow_scoped_tmp_cleanup(command):
+    """Named, static /tmp descendants are safe enough for test cleanup."""
+    tool = ExecTool()
+    assert tool._guard_command(command, "/tmp") is None
+
+
+@pytest.mark.parametrize(
+    "command",
+    [
+        "rm -rf /tmp",
+        "rm -rf /tmp/*",
+        "rm -rf /tmp/nanobot-test/../../etc",
+        "rm -rf /tmp/nanobot-test/cache",
+        "rm -rf /tmp/$TARGET",
+        "rm -rf /tmp/nanobot-test /etc",
+        "rm -rf /tmp/nanobot-test >/etc/passwd",
+        "echo setup && rm -rf /etc",
+    ],
+)
+def test_deny_patterns_block_unscoped_recursive_rm(command):
+    """Broad, dynamic, traversing, or mixed recursive deletions remain blocked."""
+    tool = ExecTool()
+    result = tool._guard_command(command, "/tmp")
+    assert result is not None
+    assert "deny pattern filter" in result.lower()
+
+
+def test_deny_patterns_allow_non_recursive_rm_f():
+    """The recursive-delete guard must not mistake rm -f for rm -rf."""
+    tool = ExecTool()
+    assert tool._guard_command("rm -f /tmp/nanobot-test.log", "/tmp") is None
+
+
+@pytest.mark.asyncio
+@pytest.mark.skipif(sys.platform == "win32", reason="POSIX rm and /tmp syntax")
+async def test_exec_runs_scoped_tmp_cleanup():
+    """A real exec call can remove its own directly named temporary directory."""
+    with tempfile.TemporaryDirectory(prefix="nanobot-exec-cleanup-", dir="/tmp") as temp_dir:
+        target = Path(temp_dir)
+        (target / "scratch.txt").write_text("scratch")
+        tool = ExecTool(timeout=5)
+
+        result = await tool.execute(command=f"rm -rf {shlex.quote(temp_dir)}")
+
+        assert "deny pattern filter" not in result.lower()
+        assert not target.exists()
+
+
 def test_allow_patterns_bypass_deny():
     """allow_patterns take priority: matching command skips deny check."""
-    tool = ExecTool(allow_patterns=[r"rm\s+-rf\s+/tmp/.*"])
-    result = tool._guard_command("rm -rf /tmp/build", "/tmp")
+    tool = ExecTool(allow_patterns=[r"rm\s+-rf\s+/opt/build"])
+    result = tool._guard_command("rm -rf /opt/build", "/tmp")
     assert result is None
 
 
 def test_allow_patterns_must_match_to_bypass():
     """Non-matching allow_patterns do NOT bypass deny."""
-    tool = ExecTool(allow_patterns=[r"rm\s+-rf\s+/opt/"])
-    result = tool._guard_command("rm -rf /tmp/build", "/tmp")
+    tool = ExecTool(allow_patterns=[r"rm\s+-rf\s+/tmp/build"])
+    result = tool._guard_command("rm -rf /opt/build", "/tmp")
     assert result is not None
     assert "deny pattern filter" in result.lower()
 
@@ -34,7 +100,15 @@ def test_extra_deny_patterns_from_config():
     # ping is blocked by extra deny
     assert tool._guard_command("ping example.com", "/tmp") is not None
     # rm -rf still blocked by built-in deny
-    assert tool._guard_command("rm -rf /tmp/x", "/tmp") is not None
+    assert tool._guard_command("rm -rf /", "/tmp") is not None
+
+
+def test_extra_deny_patterns_can_block_scoped_tmp_cleanup():
+    """User-configured policy still takes precedence over the built-in exception."""
+    tool = ExecTool(deny_patterns=[r"\brm\b"])
+    result = tool._guard_command("rm -rf /tmp/nanobot-test", "/tmp")
+    assert result is not None
+    assert "deny pattern filter" in result.lower()
 
 
 def test_allow_patterns_bypass_extra_deny():
@@ -84,6 +158,6 @@ def test_deny_patterns_search_original_command_with_quoted_hash():
 
 def test_allow_patterns_fullmatch_allows_exact_command():
     """A full-command allow pattern can still exempt an exact denied command."""
-    tool = ExecTool(allow_patterns=[r"rm\s+-rf\s+/tmp/build"])
-    result = tool._guard_command("rm -rf /tmp/build", "/tmp")
+    tool = ExecTool(allow_patterns=[r"rm\s+-rf\s+/opt/build"])
+    result = tool._guard_command("rm -rf /opt/build", "/tmp")
     assert result is None

webui/src/components/CodeBlock.tsx

@@ -40,8 +40,6 @@ const CODE_FONT_STACK = [
 ].join(", ");
 
 const ANSI_LANGUAGES = new Set(["ansi", "ansi-output"]);
-const CODE_SURFACE_LIGHT = "#f4f4f5";
-const CODE_SURFACE_DARK = "#27272a";
 
 const LazyHighlightedCode = lazy(async () => {
   const [
@@ -81,15 +79,11 @@ const LazyHighlightedCode = lazy(async () => {
           language={language || "text"}
           style={transparentTheme}
           customStyle={{
-            background: chrome === "none"
-              ? "transparent"
-              : isDark
-                ? CODE_SURFACE_DARK
-                : CODE_SURFACE_LIGHT,
+            background: "transparent",
             margin: 0,
-            padding: chrome === "none" ? "0.75rem 1rem" : "1rem",
+            padding: chrome === "none" ? "0.75rem 1rem" : "1rem 3.5rem 1rem 1.25rem",
             fontFamily: CODE_FONT_STACK,
-            fontSize: chrome === "none" ? "13px" : "0.875rem",
+            fontSize: "13px",
             lineHeight: chrome === "none" ? 1.55 : 1.6,
             tabSize: 2,
           }}
@@ -148,10 +142,11 @@ function CodeTextBlock({
   return (
     <pre
       className={cn(
-        "m-0 overflow-x-auto p-4 font-mono text-sm leading-[1.6] text-foreground/90",
+        "m-0 overflow-x-auto bg-transparent font-mono text-[13px] text-foreground/90",
         showLineNumbers ? "whitespace-pre" : "whitespace-pre-wrap",
-        chrome === "default" ? "bg-zinc-100 dark:bg-zinc-800" : "bg-transparent",
-        chrome === "none" && "p-3 text-[13px] leading-[1.55]",
+        chrome === "default"
+          ? "py-4 pl-5 pr-14 leading-[1.6]"
+          : "p-3 leading-[1.55]",
         className,
       )}
       data-testid={testId}
@@ -193,6 +188,7 @@ export function CodeBlock({
   const hasChrome = chrome === "default";
   const renderAnsi = shouldRenderAnsi(language, code);
   const syntaxLanguage = normalizeCodeLanguage(language);
+  const copyLabel = copied ? t("code.copied") : t("code.copyAria");
 
   const onCopy = useCallback(() => {
     void copyTextToClipboard(renderAnsi ? stripAnsi(code) : code).then((ok) => {
@@ -205,44 +201,12 @@ export function CodeBlock({
   return (
     <div
       className={cn(
-        "not-prose overflow-hidden",
-        hasChrome && "rounded-lg border",
-        hasChrome && (isDark ? "border-white/10" : "border-black/10"),
+        "not-prose relative overflow-hidden",
+        hasChrome && "rounded-[18px] bg-secondary/70",
         className,
       )}
+      data-language={language || t("code.fallbackLanguage")}
     >
-      {hasChrome ? (
-        <div
-          className={cn(
-            "flex items-center justify-between px-4 pb-1.5 pt-2 text-xs font-medium",
-            isDark
-              ? "bg-zinc-800 text-zinc-300"
-              : "bg-zinc-100 text-zinc-600",
-          )}
-        >
-          <span className="lowercase font-mono">
-            {language || t("code.fallbackLanguage")}
-          </span>
-          <button
-            type="button"
-            onClick={onCopy}
-            className={cn(
-              "inline-flex items-center gap-1 rounded px-1.5 py-0.5 font-mono transition-colors",
-              isDark
-                ? "text-zinc-400 hover:bg-zinc-700 hover:text-zinc-200"
-                : "text-zinc-500 hover:bg-zinc-200 hover:text-zinc-700",
-            )}
-            aria-label={t("code.copyAria")}
-          >
-            {copied ? (
-              <Check className="h-3.5 w-3.5" />
-            ) : (
-              <Copy className="h-3.5 w-3.5" />
-            )}
-            <span>{copied ? t("code.copied") : t("code.copy")}</span>
-          </button>
-        </div>
-      ) : null}
       {renderAnsi ? (
         <CodeTextBlock
           code={code}
@@ -279,6 +243,25 @@ export function CodeBlock({
           testId="plain-code-fallback"
         />
       )}
+      {hasChrome ? (
+        <button
+          type="button"
+          onClick={onCopy}
+          className={cn(
+            "absolute right-2.5 top-2.5 z-10 inline-flex h-8 w-8 items-center justify-center rounded-full",
+            "text-muted-foreground/75 transition-colors hover:bg-background/70 hover:text-foreground",
+            "focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring/60",
+          )}
+          aria-label={copyLabel}
+          title={copyLabel}
+        >
+          {copied ? (
+            <Check className="h-4 w-4" aria-hidden />
+          ) : (
+            <Copy className="h-4 w-4" aria-hidden />
+          )}
+        </button>
+      ) : null}
     </div>
   );
 }

webui/src/components/thread/ThreadMessages.tsx

@@ -29,7 +29,7 @@ export function buildDisplayUnits(
   });
 }
 
-export function assistantCopyFlags(units: DisplayUnit[]): boolean[] {
+export function assistantForkFlags(units: DisplayUnit[]): boolean[] {
   const flags = new Array<boolean>(units.length).fill(true);
   let hasLaterUnitBeforeUser = false;
   for (let i = units.length - 1; i >= 0; i -= 1) {
@@ -63,7 +63,7 @@ export function ThreadMessages({
     () => unitIndexAfterMessageCount(units, forkBoundaryMessageCount),
     [forkBoundaryMessageCount, units],
   );
-  const copyFlags = useMemo(() => assistantCopyFlags(units), [units]);
+  const forkFlags = useMemo(() => assistantForkFlags(units), [units]);
   const liveActivityClusterIndices = useMemo(
     () => isStreaming ? currentActivityClusterIndices(units) : new Set<number>(),
     [isStreaming, units],
@@ -90,7 +90,7 @@ export function ThreadMessages({
             ? unit.message.id
             : undefined;
         const forkIndex =
-          unit.type === "message" && unit.message.role === "assistant" && copyFlags[index]
+          unit.type === "message" && unit.message.role === "assistant" && forkFlags[index]
             ? nextUserIndex
             : undefined;
         if (unit.type === "message" && unit.message.role === "user") nextUserIndex += 1;
@@ -112,11 +112,6 @@ export function ThreadMessages({
               ) : (
                 <MessageBubble
                   message={unit.message}
-                  showCopyAction={
-                    unit.message.role === "assistant"
-                      ? copyFlags[index]
-                      : true
-                  }
                   cliApps={cliApps}
                   mcpPresets={mcpPresets}
                   slashCommands={slashCommands}

webui/src/tests/code-block.test.tsx

@@ -48,8 +48,20 @@ describe("CodeBlock", () => {
 
     expect(screen.queryByTestId("highlighted-code")).not.toBeInTheDocument();
     expect(screen.getByText("const value = 1;")).toBeInTheDocument();
-    expect(screen.getByText("ts")).toBeInTheDocument();
+    expect(screen.queryByText("ts")).not.toBeInTheDocument();
     expect(screen.getByTestId("plain-code-fallback")).toHaveClass("text-foreground/90");
+    expect(screen.getByTestId("plain-code-fallback")).toHaveClass("bg-transparent");
+    expect(screen.getByTestId("plain-code-fallback")).toHaveClass("py-4", "pl-5", "pr-14");
+
+    const container = screen.getByTestId("plain-code-fallback").closest(".not-prose");
+    expect(container).toHaveClass("relative", "rounded-[18px]", "bg-secondary/70");
+    expect(container).not.toHaveClass("border");
+    expect(container).toHaveAttribute("data-language", "ts");
+
+    const copyButton = screen.getByRole("button", { name: "Copy code" });
+    expect(copyButton.parentElement).toBe(container);
+    expect(copyButton).toHaveClass("absolute", "h-8", "w-8", "rounded-full");
+    expect(copyButton).toHaveTextContent("");
   });
 
   it("can render without chat-style chrome for file previews", () => {
@@ -115,8 +127,11 @@ describe("CodeBlock", () => {
 
     expect(screen.queryByTestId("highlighted-code")).not.toBeInTheDocument();
     expect(screen.getByTestId("ansi-code")).toBeInTheDocument();
-    expect(screen.getByTestId("ansi-code").closest(".not-prose")).toBeTruthy();
-    expect(screen.getByText("ansi")).toBeInTheDocument();
+    expect(screen.getByTestId("ansi-code").closest(".not-prose")).toHaveAttribute(
+      "data-language",
+      "ansi",
+    );
+    expect(screen.queryByText("ansi")).not.toBeInTheDocument();
     expect(screen.getByText("PASS")).toHaveStyle({ color: "#0dbc79" });
     expect(screen.getByText("<script>alert(1)</script>")).toBeInTheDocument();
     expect(document.querySelector("script")).toBeNull();
@@ -183,7 +198,7 @@ describe("CodeBlock", () => {
       await user.click(screen.getByRole("button", { name: /copy/i }));
 
       await waitFor(() => expect(execCommand).toHaveBeenCalledWith("copy"));
-      expect(screen.getByText("Copied")).toBeInTheDocument();
+      expect(screen.getByRole("button", { name: "Copied" })).toBeInTheDocument();
     } finally {
       Reflect.deleteProperty(navigator, "clipboard");
       Reflect.deleteProperty(document, "execCommand");

webui/src/tests/markdown-text-renderer.test.tsx

@@ -163,7 +163,8 @@ describe("MarkdownTextRenderer", () => {
     );
 
     expect(screen.getByText("code without language")).toBeInTheDocument();
-    expect(screen.getByText("text")).toBeInTheDocument();
+    expect(screen.queryByText("text")).not.toBeInTheDocument();
+    expect(container.querySelector(".not-prose")).toHaveAttribute("data-language", "text");
     expect(container.querySelectorAll("pre")).toHaveLength(1);
   });
 

webui/src/tests/thread-messages.test.tsx

@@ -2,7 +2,7 @@ import { render, screen } from "@testing-library/react";
 import { afterEach, describe, expect, it, vi } from "vitest";
 
 import {
-  assistantCopyFlags,
+  assistantForkFlags,
   buildDisplayUnits,
   ThreadMessages,
   unitKeysForDisplay,
@@ -747,7 +747,7 @@ describe("ThreadMessages", () => {
     expect(screen.queryByText("Worked for 0s")).not.toBeInTheDocument();
   });
 
-  it("shows copy only on the last assistant slice before the next user turn", () => {
+  it("shows copy on every assistant slice while keeping fork on the last slice", () => {
     const messages: UIMessage[] = [
       {
         id: "early",
@@ -771,19 +771,26 @@ describe("ThreadMessages", () => {
       },
     ];
 
-    render(<ThreadMessages messages={messages} isStreaming={false} />);
+    render(
+      <ThreadMessages
+        messages={messages}
+        isStreaming={false}
+        onForkFromMessage={vi.fn()}
+      />,
+    );
 
-    expect(screen.getAllByRole("button", { name: "Copy" })).toHaveLength(1);
+    expect(screen.getAllByRole("button", { name: "Copy" })).toHaveLength(2);
+    expect(screen.getAllByRole("button", { name: "Fork" })).toHaveLength(1);
     expect(screen.getByText("final reply")).toBeInTheDocument();
   });
 
-  it("shows copy only on the second assistant when two text slices appear before user", () => {
+  it("shows copy on adjacent assistant text slices", () => {
     const messages: UIMessage[] = [
       { id: "a1", role: "assistant", content: "part one", createdAt: 1 },
       { id: "a2", role: "assistant", content: "part two", createdAt: 2 },
     ];
     render(<ThreadMessages messages={messages} isStreaming={false} />);
-    expect(screen.getAllByRole("button", { name: "Copy" })).toHaveLength(1);
+    expect(screen.getAllByRole("button", { name: "Copy" })).toHaveLength(2);
   });
 
   it("uses turn ids as activity grouping boundaries when available", () => {
@@ -810,7 +817,7 @@ describe("ThreadMessages", () => {
     ]);
   });
 
-  it("computes final assistant copy flags with user-boundary semantics", () => {
+  it("computes final assistant fork flags with user-boundary semantics", () => {
     const units = buildDisplayUnits([
       { id: "u1", role: "user", content: "one", createdAt: 1 },
       { id: "a1", role: "assistant", content: "draft", createdAt: 2 },
@@ -827,7 +834,7 @@ describe("ThreadMessages", () => {
       { id: "a3", role: "assistant", content: "next", createdAt: 6 },
     ]);
 
-    const flags = assistantCopyFlags(units);
+    const flags = assistantForkFlags(units);
     const assistantFlags = units
       .map((unit, index) =>
         unit.type === "message" && unit.message.role === "assistant"