nanobot-render AGENTS.md

Repository instructions for nanobot-render, a Python agent framework with a React and TypeScript web interface.

In plain words
What is it for?
Use them when changing nanobot-render, running Python or web-interface checks, building the web interface, or starting its gateway.
Why use it?
They give coding agents the project context, development commands, test and lint commands, and a high-level view of how messages move through the system.

Instructions file for CodexOpenCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/render-examples/nanobot-render/agents-md
Clone the repo
git clone --depth 1 https://github.com/render-examples/nanobot-render

Made for: Codex, OpenCode.

Per session 1,248 This file is loaded in full into every session.
When invoked 1,248 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin 92% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01248 $0.01248
Opus 5 $0.00624 $0.00624
Sonnet 5 $0.00250 $0.00250
Haiku 4.5 $0.00125 $0.00125

Measured yesterday against content hash 4b62dfb59b8a, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

nanobot-render AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

92% identical to nanobot AGENTS.md — 9 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

AGENTS.md · 82 lines

How it starts

The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.

This file provides guidance to AI coding agents working with this repository.

Project Overview

nanobot is a lightweight, open-source AI agent framework written in Python with a React/TypeScript WebUI. It centers around a small agent loop that receives messages from chat channels, invokes an LLM provider, executes tools, and manages session memory.

Development Commands

# Python: run single test / lint
pytest tests/test_openai_api.py::test_function -v
ruff check nanobot/

# WebUI: dev server (proxies API/WS to gateway :8765), build, test
# Build outputs to ../nanobot/web/dist (bundled into the Python wheel)
cd webui && bun run dev      # or NANOBOT_API_URL=... bun run dev
cd webui && bun run build
cd webui && bun run test

# Gateway
nanobot gateway

High-Level Architecture

Core Data Flow

Messages flow through an async MessageBus (nanobot/bus/queue.py) that decouples chat channels from the agent core:

  1. Channels (nanobot/channels/) receive messages from external platforms and publish InboundMessage events to the bus.
  2. AgentLoop (nanobot/agent/loop.py) consumes inbound messages, builds context, and coordinates the turn.
  3. AgentRunner (nanobot/agent/runner.py) handles the actual LLM conversation loop: send messages to the provider, receive tool calls, execute tools, and stream responses.
  4. Responses are published as OutboundMessage events back to the appropriate channel.

Key Subsystems

  • Agent Loop (nanobot/agent/loop.py, runner.py): The core processing engine. AgentLoop manages session keys, hooks, and context building. AgentRunner executes the multi-turn LLM conversation with tool execution.
  • LLM Providers (nanobot/providers/): Provider implementations (Anthropic, OpenAI-compatible, OpenAI Responses API, Azure, Bedrock, GitHub Copilot, OpenAI Codex, etc.) built on a common base (base.py). Includes image generation (image_generation.py) and audio transcription (transcription.py). factory.py and registry.py handle instantiation and model discovery.
  • Channels (nanobot/channels/): Platform integrations (Telegram, Discord, Slack, Feishu, Matrix, WhatsApp, QQ, WeChat, WeCom, DingTalk, Email, MoChat, MS Teams, WebSocket). manager.py discovers and coordinates them. Channels are auto-discovered via pkgutil scan + entry-point plugins.
  • Tools (nanobot/agent/tools/): Agent capabilities exposed to the LLM: filesystem (read/write/edit/list), shell execution (with sandbox backends), web search/fetch, MCP servers, cron, notebook editing, subagent spawning, long-running tasks / sustained goals (long_task.py), image generation, and self-modification. Tools are auto-discovered via pkgutil scan + entry-point plugins.
  • Memory (nanobot/agent/memory.py): Session history persistence with Dream two-phase memory consolidation. Uses atomic writes with fsync for durability.
  • Session Management (nanobot/session/): Per-session history, context compaction, TTL-based auto-compaction (manager.py), and sustained goal state tracking (goal_state.py).
  • Config (nanobot/config/schema.py, loader.py): Pydantic-based configuration loaded from ~/.nanobot/config.json. Supports camelCase aliases for JSON compatibility.
  • WebUI (webui/): Vite-based React SPA that talks to the gateway over a WebSocket multiplex protocol. The dev server proxies /api, /webui, /auth, and WebSocket traffic to the gateway.
  • API Server (nanobot/api/server.py): OpenAI-compatible HTTP API (/v1/chat/completions, /v1/models) for programmatic access.
  • Command Router (nanobot/command/): Slash command routing and built-in command handlers.
  • Heartbeat (nanobot/templates/HEARTBEAT.md): Periodic task list checked via cron jobs (legacy dedicated service removed).
  • Pairing (nanobot/pairing/): DM sender approval store with persistent pairing codes per channel.
  • Skills (nanobot/skills/): Built-in skill definitions (long-goal, cron, github, image-generation, etc.) loaded into agent context.
  • Security (nanobot/security/): PTH file guard and other security measures activated at CLI entry.

Read the full file on GitHub · 82 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 82 lines · 1,248 tokens per session scan A 4b62dfb59b8a

Subscribe to this mod's changes

nanobot-render AGENTS.md is an instructions file published in the GitHub repository render-examples/nanobot-render (5 stars, last pushed 1mo ago), licensed MIT. It adds 1,248 tokens to every session, about $0.0062 per session on Opus 5. A static security scan graded it A with 0 findings. It is 92% identical to nanobot AGENTS.md, differing in 9 lines, and is treated as a copy.