v2.2.0

• Stamped plugins update in place through ncl groups create --template <ref>. When a group already carries the template's plugin, the same command becomes an in-place update instead of minting a duplicate agent: a dry run prints a plan of every plugin-owned surface (plugin files, skills, MCP servers, persona, context files, tasks), flagging locally customized files whose edits would be lost; --yes applies, --id picks among several stamped groups, --new deliberately stamps another agent. Agent state the plugin does not own (memory, plugin-data/, user-added MCP servers, task pause/resume state, wiring) is never touched. Plugin-stamped MCP servers now carry an ownership marker and refuse direct edits via ncl groups config add-mcp-server / remove-mcp-server or the agent's add_mcp_server tool: update the plugin and restamp instead.
• [BREAKING] Agent templates are now Agent Plugins 1.0.0 directories. plugin.json replaces context/instructions.md as the required file; MCP servers move to a spec-shaped mcp.json; persona, extra context, and tasks move under the ai.nanoco.nanoclaw/ extension dir. Templates become portable to other plugin clients, and any conformant third-party plugin stamps as a NanoClaw agent. Migration: re-fetch templates from the registry (the pre-plugin layout fails with a migration error); to convert a local custom template, see docs/templates.md.
• Plugin MCP servers may declare a working directory. cwd in mcp.json (fixed forms ./p, ${PLUGIN_ROOT}[/p], ${PLUGIN_DATA}[/p]) now launches the server in that directory instead of being skipped: resolved to an absolute container path at runtime, consumed natively by providers that support it and via a cd-then-exec launch shim on Claude. A stdio server that omits cwd runs from the plugin root (the spec default).
• Setup can stamp the first agent from a template. The wizard offers the NanoClaw template library (or local templates/) when creating the first agent; --template-path <ref> or the advanced screen presets the pick. A rerun over a partial install updates the stamped agent in place (dry-run plan + confirm) instead of duplicating it, the pick persists across wizard re-execs and reruns, and a template failure warns and continues instead of aborting setup.
• Remote MCP servers can use Streamable HTTP. Register them with ncl groups config add-mcp-server --name <name> --url <url> or the existing admin-approved add_mcp_server tool. Local stdio MCP commands keep their current command / args / env behavior; remote credentials remain OneCLI-managed: URLs with userinfo, fragments, or credential-looking query parameters are rejected. HTTPS is required except for localhost / host.docker.internal.
• [BREAKING] Host modules now use one lifecycle registry. Custom modules that import onShutdown() or getShutdownCallbacks() from response-registry.ts must move to the host lifecycle API. Migration: follow the host lifecycle migration guide to detect affected code, update it, verify the cutover, or roll back.
• Agent-to-agent messaging no longer loses to Claude Code's built-in SendMessage. That built-in addresses the SDK's own in-session subagents, so an agent that had just run create_agent reached for it by name and got No agent named 'x' is currently addressable — reading as "the group was never provisioned" while mcp__nanoclaw__send_message (the real path) was never called. SendMessage joins AskUserQuestion in SDK_DISALLOWED_TOOLS, so the PreToolUse hook now blocks it and points at the nanoclaw equivalent.
• [BREAKING] Existing Claude installs should review the hardened agent image. Local builds remain supported, but the Echo-built image is recommended for patched sandbox components. Migration: follow the hardened-image guide to detect your current image source, switch, verify, or roll back.
• Release publication tolerates GitHub API propagation. The Release workflow now retries bounded post-publication read-backs when the new Release is not listed yet or its immutable state is not visible yet. Exact title, body, tag, or SHA mismatches still fail immediately.
• The add-tavily-tool skill adds Tavily Search and Extract as keyless remote MCP tools for selected agent groups, bridged through a pinned mcp-remote.
• Scheduled tasks now run with their effective scheduled occurrence as the task time, plus a task-only current_time (weekday included, in the agent group's timezone) instead of the creation timestamp.
• Accumulated messages stay available as context without spuriously triggering warm-container follow-up turns; group-scoped agents can inspect their wirings and request approved engagement-policy updates; invalid engagement regexes are rejected.
• Hosted iMessage setup now provisions the line's user row directly and prints the assigned number to text once; that first message is the opt-in the delivery plane checks, and re-runs reuse the existing row.
• Resolved approval cards keep their title and request details, replace buttons with the decision and actor (or a timeout status), and survive host restarts and delayed resolution.
• Setup failure assist now offers diagnosis through the provider the operator picked instead of always offering to install Claude.
• ensureUserDm gains an opt-in privacy-safe logging mode for security-sensitive flows: user IDs, handles, messaging-group IDs, and raw adapter errors are omitted while non-identifying channel context is kept.
• The stale add-gcal-tool, add-gmail-tool, and get-qodo-rules skills were removed.
• The recommended hardened agent image is repinned to hardened-2026-08-13.
• The package description now says personal AI assistant: NanoClaw is provider-agnostic, not Claude-only.
• Docs: skills define a single-responsibility integration rule, and the hardened-image guide states that install_packages covers apt and npm packages only.

New Contributors

• @dim0627 made their first contribution in #3187
• @zvi-fried made their first contribution in #3211
• @stumpjumper made their first contribution in #3216
• @manisrinivasan2k1 made their first contribution in #3190

Contributors

Thanks to everyone who landed work in this release:

• fix(setup): dispatch failure assist to the picked provider by @glifocat in #3170
• fix(release): retry post-publish readback by @glifocat in #3176
• Preserve resolved approval card content by @Koshkoshinsk in #3143
• fix(imessage): opt in via first message to the assigned line by @glifocat in #3181
• Fix engagement consistency and expose self-serve wiring controls by @Koshkoshinsk in #3137
• fix(update): surface hardened image migration by @gabi-simons in #3180
• versions: repin the agent image to hardened-2026-08-02 by @gavrielc in #3182
• fix(agent-runner): give scheduled tasks current run time by @Koshkoshinsk in #3154
• fix(agent-runner): disallow built-in SendMessage so agent-to-agent messaging works by @dim0627 in #3187
• chore(skills): remove stale qodo and Google MCP skills by @glifocat in #3172
• docs(skills): define single-responsibility integration rule by @zvi-fried in #3211
• refactor(db): add module migration registry by @zvi-fried in #3212
• refactor(host): unify module lifecycle hooks by @zvi-fried in #3214
• refactor(channels): register question renderers by @zvi-fried in #3213
• feat(permissions): add opt-in privacy-safe DM logs by @zvi-fried in #3222
• docs(hardened-image): note that install_packages covers apt and npm only by @stumpjumper in #3216
• feat: support remote Streamable HTTP MCP servers by @amit-shafnir in #3092
• feat: add Tavily MCP tool skill by @manisrinivasan2k1 in #3190
• feat!: agent templates become Agent Plugins 1.0.0 directories by @amit-shafnir in #3220
• feat(setup): template setup flow in the wizard and first-agent stamping by @amit-shafnir in #2909
• versions: repin the agent image to hardened-2026-08-13 by @gavrielc in #3236
• chore(release): v2.2.0 by @glifocat in #3237

Full Changelog: v2.1.54...v2.2.0