add-codex

The provider writes a SessionStart command hook (bun /app/src/memory/hook.ts) into ~/.codex/hooks.json and simultaneously disables hook trust, giving its own command automatic execution at every Codex session start.

hooks: [{ type: 'command', command: 'bun /app/src/memory/hook.ts', timeout: 10 }],

On every query the Codex provider (or its runtime contract callback) writes ~/.codex/config.toml and reconciles ~/.codex/hooks.json inside the container, registering a SessionStart command hook whose executable command string comes from the registered memory hook and is not shown in the reviewed units.

hooks: [{ type: 'command', command: memorySessionHook.command, timeout: 10 }],

Undeclared residue: the add-codex payload's host-contribution test hands the entire host process environment (hostEnv: process.env) to the codex provider container-config contribution, although the target declares credentials vault-only and no declaration covers host-env passthrough; what the contribution forwards into the container is not shown here.

hostEnv: process.env,

The Codex install skill instructs the agent to run scripts/provider-contract-verifier.ts, a validation script the artifact does not ship.

pnpm exec tsx scripts/provider-contract-verifier.ts --required-declared codex

The Codex install skill instructs the agent to run setup/index.ts --step provider-auth codex, a script the artifact does not ship, which performs the ChatGPT/OpenAI login and lands the credential in the gateway vault.

pnpm exec tsx setup/index.ts --step provider-auth codex

SKILL.md instructs the agent to copy the skill's payload — the provider runtime whose shipped tests pin danger-full-access sandboxing, a never approval policy, hook-trust bypass, and unconditional auto-approval — over the host, container, and setup source trees, overwriting each file, then append barrel imports and rebuild, wiring the permissive runtime into the agent host.

Copy the Codex payload from this skill's `payload/` into all three trees (additive — overwrite each file).

The iMessage skill instructs the agent to run setup/channels/imessage-configure.sh, a script the artifact does not ship, to upsert and delete backend-selector keys in the host .env file.

bash setup/channels/imessage-configure.sh local

The iMessage skill instructs the agent to execute scripts/photon-setup.ts, a script the artifact does not ship, which performs a device login and writes project credentials into .env and data/photon-auth.json.

pnpm exec tsx scripts/photon-setup.ts setup --phone {{owner_handle}} --embedded

Undeclared for this skill's Codex-provider purpose: newestClaudeTranscript enumerates ~/.claude/projects and stat-scans every .jsonl transcript to return the newest one for the /upload-trace diagnostics hook; the access is plainly visible (unexplained, not concealed), but the onward destination of the selected transcript is not shown in this batch.

const projects = path.join(os.homedir(), '.claude', 'projects');

Residue R53 (unexplained, disclosed): the container tool installer writes /root/.npmrc to opt the manifest's pinned global CLIs (agent-browser, @anthropic-ai/claude-code) into running postinstall build scripts during image build — an install-time code-execution surface undeclared by the add-codex skill's provider-wiring purpose, though pinned, selective, and openly commented.

require(

The upgrade-recovery documentation instructs coding agents to automatically run the upgrade-state override and restart after a self-reported successful upgrade, skipping human confirmation by default for an action that stamps the host's startup tripwire marker as trusted.

if the upgrade you just ran reported success, run the command above automatically and restart

Undeclared in the codex-provider description, the shipped apply engine runs git remote/ls-remote probes through a shell via execSync with the branch taken from SKILL.md from-branch directives and the remote from the NANOCLAW_CHANNELS_REMOTE env override — an undeclared shell-execution surface, and the C558-C560 leads do not contradict D48 because git remote probing is not a dependency build script.

return execSync(cmd, { cwd: root, stdio: ['ignore', 'pipe', 'ignore'] }).toString();

The skill-apply engine's run directive executes skill-authored shell commands through the injected exec after substituting prompt and captured variable values into the command line, so whatever a SKILL.md declares as a run is executed with host shell privileges.

const out = await exec(substitute(cmd, vars));

The engine's env-set directive appends skill-declared KEY=VALUE entries, with values interpolated from prompt or capture variables, into the project-root .env file, persisting credentials and configuration on the host at skill-directed root-relative paths.

const envPath = join(root, '.env');

refreshInstalledSkills headlessly re-executes the nc:run shell commands embedded in installed skills' SKILL.md files via execSync (and setup applies provider skills through the same directive engine), so any command authored in a skill document — potentially re-applied after resolution against a configured registry git remote — runs on the host.

return execSync(command, {

The setup wizard tells the operator that building the sandbox image records and sends nothing, yet immediately emits a phEmit('image_source_chosen') telemetry event recording that very choice (including the 'local' build path) before returning, contradicting its own on-screen disclosure 'Building sends nothing at all' and the option hint 'no account, nothing recorded'.

Building sends nothing at all.

When the operator picks the pre-built sandbox image, setup executes the bundled shell script setup/registry-login.sh via runInheritScript for device-flow registry authentication, running script content that is outside the reviewed units.

const code = await runInheritScript('bash', [REGISTRY_LOGIN_SCRIPT]);

Setup wizard steps emit phEmit telemetry events (agent_provider_chosen, channel_chosen, channel_other_named) recording the operator's choices with no declared destination in the add-codex description or the shown code — undeclared residue whose sink is unverified.

phEmit('agent_provider_chosen', { provider: choice });

The NanoClaw setup wizard emits lifecycle telemetry events (setup start, existing-install action, first-chat outcome, setup completion with duration) through an undeclared diagnostics module whose destination is not shown in the artifact, potentially sending usage metadata off-host.

phEmit('auto_started');

Setup reads the Slack bot token from process.env or the .env file (presence check) before offering Slack channel setup; no onward transfer of the token value is shown.

!(process.env.SLACK_BOT_TOKEN || readEnvKey('SLACK_BOT_TOKEN'))?.trim()

NanoClaw's setup manages a persistent background assistant daemon, printing launchctl bootout/bootstrap commands against ~/Library/LaunchAgents/${label}.plist and running a service step that starts NanoClaw in the background, so the daemon survives session end and reboot.

launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/${label}.plist

Undeclared residue (R13): the channel wizard reads and executes install skills from .claude/skills/add-<channel> via runSkill (steps that install adapters and collect credentials), a capability the add-codex declaration does not cover, though it is plainly visible in code.

const res = await runSkill(`.claude/skills/add-${channel}`, {

Undeclared residue (R12): the channel wizard reads and executes arbitrary companion skill directories under .claude/skills/<name> via runSkill, a capability the add-codex declaration does not cover, though it is plainly visible and warned about in code.

const res = await runSkill(`.claude/skills/${skill}`, {

Undeclared by the target's stated codex-provider purpose, the setup's install-claude.sh pipes the unpinned remote installer https://claude.ai/install.sh straight into /bin/bash, so setup-time code execution depends on whatever that mutable URL serves (R54, adjudicated unexplained: transparent but not covered by any declaration).

curl -fsSL https://claude.ai/install.sh | /bin/bash

The setup installs a docker credential helper that the docker CLI will invoke to hand over registry credentials, while the helper's actual credential handling is defined in setup/registry/credential-helper.mjs, which is not among the reviewed units.

Installs `docker-credential-nanoclaw` and points docker at it for exactly one

Undeclared by the target's stated purpose, the credential-helper installer performs a read-modify-write of the user's ~/.docker/config.json (a host config that can hold registry credentials) to route one registry through its own helper, which the comments state writes no secret itself.

Wiring is one `credHelpers` key in `~/.docker/config.json`, read-modify-write

Undeclared for this Codex-provider skill, the setup generates an executable docker credential helper onto PATH, runs it to verify, and rewrites ~/.docker/config.json credHelpers — the file that holds the machine's registry credentials.

writeExecutable(helperPath, renderHelper(fs.readFileSync(helperSourcePath(), 'utf-8'), process.execPath))

Setup auto-runs bundled prerequisite installers (Docker, Node, Claude CLI, signal-cli) whose sudo, curl|bash network installs, and latest-release downloads live inside single allowlisted script units, so one pre-approved script invocation executes network install pipelines that would otherwise not be matchable for pre-approval.

The script itself is the allowlisted unit; the pipes and sudo live inside

Undeclared for this Codex-provider skill, its setup fetches src/channels/github.ts from the tip of the mutable `channels` git branch at run time (adding a github.com upstream remote if missing via channels-remote.sh), writes it into the build tree and rebuilds, so unpinned remote code becomes part of the executed artifact.

git show refs/remotes/origin/channels:src/channels/github.ts > 

setup/install-node.sh writes node, npm, npx and pnpm symlinks into ~/.local/bin and prepends that directory to PATH, leaving persistent interpreter shims on the host after setup completes.

ln -sf ~/node/bin/node ~/.local/bin/node

Undeclared for this Codex-provider skill, its Node bootstrap runs the unpinned uvx nodeenv package and symlinks node/npm/npx/pnpm into ~/.local/bin, taking over the user's PATH.

ln -sf ~/node/bin/npx ~/.local/bin/npx

Undeclared for this Codex-provider skill, setup tooling extracts the user's Claude OAuth token out of captured PTY terminal output and prints it to stdout so shell callers can set it as a credential environment variable.

const CLAUDE_OAUTH_TOKEN = /sk-ant-oat[A-Za-z0-9_-]{80,500}AA/g;

When the Claude CLI is absent, the setup wizard offers and then executes the in-repo installer setup/install-claude.sh via bash, whose contents are not shown in these units, so the download-and-execute chain is unverifiable from the evidence.

const code = spawnSync('bash', ['setup/install-claude.sh'], {

Setup runs `claude setup-token` under script(1), scrapes the sk-ant-oat OAuth token out of the PTY capture file, injects it into process.env.CLAUDE_CODE_OAUTH_TOKEN, and a companion CLI (captured-token.ts) prints the recovered token to stdout for bash callers, handling the user's credential outside the CLI's own flow.

if (token) process.env.CLAUDE_CODE_OAUTH_TOKEN = token;

Undeclared residue: the failure-assist chain parses a model-suggested bash command (parseResponse) and executes it by spawning bash with setup/run-suggested.sh with no confirmation gate visible in the shown code, an execution capability the declared Codex-provider purpose does not declare; the helper script's gating is unverified.

spawn('bash', [script, command], {

Undeclared residue: the handoff prompt forwards setup-collected values (redaction is only a caller responsibility noted in comments) plus workspace file lists into an external Claude session, a data-sharing path the declared Codex-provider purpose does not declare; plausibly honest debugging context, so low contextual risk.

lines.push('Values collected so far (secrets redacted):');

Undeclared residue R15: setup emits telemetry (a persistent install UUID, platform, and caller-supplied event properties) to us.i.posthog.com by default, which the declared purpose never mentions and which sits against the bundled safety claim that no third-party service is involved; an opt-out env var exists, so unexplained rather than concealed.

void fetch(POSTHOG_URL, {

After a failed step and a retry confirm that defaults to yes, fail() re-executes the entire pnpm run setup:auto flow as a child process with a NANOCLAW_SKIP list, while spawnStep runs in-repo setup code via pnpm exec tsx setup/index.ts for every step.

spawnSync('pnpm', ['--silent', 'run', 'setup:auto'], {

reuseFromEnv reads KEY=value credentials from the project .env file and, after a masked per-value confirmation, injects them as skill prompt inputs for reuse by the apply engine.

env = parseEnv(readFileSync(join(projectRoot, '.env'), 'utf8'));

The setup driver's hostExec and hostExecStream execute arbitrary command strings taken from skill-document run directives via bash -c with the project bin/ prepended to PATH, so any directive text in a SKILL.md becomes host shell execution; the engine that produces the commands is not in this batch.

spawn('bash', ['-c', cmd], {

The skill driver offers to read and reuse credential material already stored in the project's .env file during skill setup, with no shown destination beyond the wrapped service's configuration.

Offer to reuse credentials already in `.env` instead of re-prompting.

The timezone fallback embeds the operator's free-text location description into a prompt piped to the claude CLI, sending that text off-host to the model service the CLI is configured with; the reply is validated before use.

User's description: ${input}

The setup progress logger's userInput() writes every prompt answer verbatim into plaintext logs/setup.log, so credential answers collected during setup (the clack collector masks secrets only on screen, and the driver offers to reuse .env credentials) can be persisted undeclared, contradicting the skill's vault-only credential handling description.

user-input → ${key} ===

The add-codex setup's register step rewrites the freshly registered group's CLAUDE.md agent-instruction file to swap in the assistant name — an agent rules-file write that is undeclared residue (R21, unexplained): nothing hides it, but the declared Codex-provider purpose never declares it.

const mdFile = path.join(projectRoot, 'groups', parsed.folder, 'CLAUDE.md');

The sign-in driver persists the account token to ~/.config/nanoclaw/registry-auth.json and invokes the docker credential-helper installer, reconfiguring host docker registry authentication toward the pinned registry (declared sign-in outcome, but the host-config write itself lives in an unshown file).

wireDockerCredentialHelper(record.registry);

persistCredential additionally flips the install's image source to 'hardened' via writeImageSource and wires docker's credential-helper configuration to the installed helper — host-config writes disclosed in comments but not covered by the skill's declared purpose.

writeImageSource('hardened');

Further call sites of the same undeclared sign-in network: probeSession sends the stored bearer token to the broker's /v1/session/probe, and startDeviceFlow, finishDeviceFlow and deviceLogin chain device authorization, token polling and enrollment posts (part of unexplained residue R22).

res = await http(`${api}/v1/session/probe`, bearerGet(token), PROBE_TIMEOUT_MS);

The setup sign-in driver performs undeclared network sign-in (unexplained residue R22): an OAuth device grant against api.workos.com plus broker enrollment posts carrying the machine's host id, OS/arch/version and the WorkOS IdP access token — capabilities the declared Codex-provider purpose never mentions, though the code documents them openly.

const DEFAULT_DEVICE_ENDPOINT = 'https://api.workos.com/user_management/authorize/device';

The registry refresh step executes the repository script container/pull.sh via bash with inherited stdio, and the contents of that script are not among the shown units, so what runs at that point is unverified.

spawnSync('bash', [path.join(projectRoot, 'container', 'pull.sh')], {

The docker credential helper reads the local registry bearer token from ~/.config/nanoclaw/registry-auth.json and POSTs it with host telemetry (host_id, os, arch, node version) to the configured broker's /v1/credentials endpoint to mint a registry password; the destination is the token-issuing broker validated as HTTPS, so this reads as the wrapped service's own credential flow rather than established exfiltration.

authorization: `Bearer ${auth.token}`,

Undeclared residue: the registry sign-in flow installs a docker credential-helper binary on PATH and wires the host's ~/.docker/config.json credHelpers for its registry host to it, a host-config persistence write the add-codex declaration does not cover; the installer body is requested.

routes only our registry here via a single `credHelpers` entry

Undeclared residue: setup symlinks its ncl CLI into ~/.local/bin so the command stays available on PATH across sessions, a host-level install step the codex-provider description does not declare.

fs.symlinkSync(source, target);

Undeclared residue (R25/R26): NanoClaw setup writes a per-checkout LaunchAgents plist (RunAtLoad/KeepAlive per the renderer) owner-only and loads, kickstarts, and verifies it with launchctl, giving the assistant persistent background execution that the skill's declared codex-provider purpose does not cover.

writeOwnerOnly(plistPath, plist);

Undeclared residue: setup kills host processes matching this checkout's dist/index.js via pkill and probes Docker with systemd-run/docker info to manage its background service — host command execution a codex-provider wiring skill does not declare.

pkill -f '${projectRoot}/dist/index

Undeclared residue: setup installs a systemd unit (Restart=always; WantedBy=multi-user.target when root) into ~/.config/systemd/user or /etc/systemd/system, enables and restarts it with systemctl, and enables loginctl linger, with an owner-only proxy env file (writeServiceProxyEnv) feeding the persistent service — none of it declared by the codex-provider description.

fs.writeFileSync(unitPath, unit);

Setup writes a systemd unit with Restart=always, enables it via systemctl, enables loginctl linger so the user service survives SSH logout, and restarts it, establishing persistent background execution of the NanoClaw host.

execSync('loginctl enable-linger', { stdio: 'ignore' });

Service setup calls cleanupUnhealthyPeers, which per the surrounding comments can launchctl-unload other NanoClaw installs' services judged unhealthy and remove registrations whose target binary is missing; the implementation is not among the shown units, so the health gating and blast radius are unverified.

const peerReport = cleanupUnhealthyPeers(projectRoot);

Undeclared residue: absent systemd, setup writes a 0755 start-nanoclaw.sh wrapper and executes it with /bin/bash to launch the assistant detached via setsid nohup, then polls the local admin socket (waitForNohupStartup) until the background host is up — background-service persistence not declared by the codex-provider description.

fs.writeFileSync(wrapperPath, lines.join(

Undeclared residue: setup/service.ts installs a persistent launchd/systemd service for the NanoClaw host (with peer-service unloading, owner-only proxy env writes, and a ~/.local/bin/ncl symlink), host persistence the add-codex Codex-provider declaration does not cover; the install function bodies are requested.

setupLaunchd(projectRoot, nodePath, homeDir);

Undeclared residue (R27/R28): setup reads and rewrites the project's .env (upsert/remove of keys including tokens, template path, and TZ) although the description says keys stay vault-only via the gateway, leaving local credential-bearing config access unexplained by the declared purpose.

fs.writeFileSync(fd, next);

Undeclared residue: setup spawns signal-cli to probe versions, list linked accounts, and run a link --name NanoClaw flow that registers this host as a linked device on the user's Signal account — messaging-account device linking a codex-provider skill does not declare.

spawn(cli, ['link', '--name', DEFAULT_DEVICE_NAME], {

Undeclared residue: the Slack setup worker POSTs to a remote service origin (job.serviceBase) with the job's identity bearer token to obtain installation status and a Slack bot token; the origin is constrained to https or localhost and the payload is minimal, but the destination depends on job data not shown here, so reach is not fully established.

Bearer ${job.identity.token}

Undeclared residue: the Slack worker persists a bot token delivered by the remote service into a private job file and passes it into the Slack channel-skill install, handling Slack credentials that have nothing to do with the declared codex provider purpose.

job.app.botToken = delivery.bot_token;

The uninstall flow scans only its own install slug, then — after per-group confirmations that default to keep, or a single --yes flag — executes a removal plan that recursively deletes this checkout's data, .env (copied to a backup first), and unrecoverable user content (groups/, store/, node_modules/), kills the host process via pkill -f and pid file, unloads launchd/systemd services, and force-removes Docker containers, images, volumes, and networks; deletion is user-gated and root actions are refused rather than escalated, so this is a plausible honest uninstaller with real data-loss impact if confirmed.

fs.rmSync(action.item.path, { recursive: true, force: true });

Undeclared residue: the uninstaller's backupEnv copies the project .env (Secrets / API keys) to .env.bak before deletion — credential-file access the declared Codex-provider purpose does not cover, though the copy stays on-host and is a visible safeguard, so it is unexplained rather than concealed.

fs.copyFileSync(envPath, backup);

Undeclared residue: the WhatsApp auth version step makes an outbound HTTPS request to the third-party tracker wppconnect.io to fetch the current WhatsApp Web version — undeclared network access unrelated to the declared Codex-provider purpose, though it is plainly visible and sends no local data beyond the request itself.

const res = await fetch(TRACKER_URL, { signal: AbortSignal.timeout(LOOKUP_TIMEOUT_MS) });

Residue R31: launchSlackJob snapshots the entire process environment (env '*') and hands it to a detached child worker; this environment access is not declared by the target's description, though it is plainly visible code and two internal variables are removed before the spawn.

const env = { ...process.env };

Undeclared for this skill's vault-only credential model: resolveProviderContribution passes the host's entire process environment (hostEnv: process.env, residue R32) into per-provider host-side adapters and spawn-surface realization, exposing every host env value to provider code paths the declared Codex-provider purpose does not cover.

hostEnv: process.env,

When the agent-to-agent module is not installed, deliverMessage's permission check permits an agent to send messages to any registered non-origin channel destination (only the origin chat is structurally constrained), delivering agent-composed content to external chats with no ACL row required.

we permit all non-origin channel sends

Container-agent-controlled file names in outbound message content (msg.content JSON) are passed to readOutboxFiles, which reads files from host disk and hands them to deliveryAdapter.deliver for off-host channel delivery, and the path resolution inside readOutboxFiles is not shown, so arbitrary-file exfiltration cannot be excluded.

readOutboxFiles(session.agent_group_id, session.id, msg.id, content.files as string[])

prepareClaudeMemorySettings creates or rewrites settings.json in the Claude state directory, seeding CLAUDE_DEFAULT_SETTINGS when absent or overwriting the current file with transformer output, an agent control-plane write whose payload content is not shown in the reviewed units.

dir.replaceFile(CLAUDE_SETTINGS_FILE, result.content);

Host code shipped with this target undeclared-ly seeds and rewrites the agent's Claude settings.json, injecting a PreCompact command hook (bun /app/src/compact-instructions.ts) and forcing auto-memory off — an agent control-plane write the add-codex provider-wiring description does not mention; it is plainly visible and does not change the provider default, so no listed contradiction holds, but the write itself is undeclared.

const PRE_COMPACT_COMMAND = 'bun /app/src/compact-instructions.ts';

The community-portal runtime, once signed in, reads the saved Slack install job and launches it locally (launchSlackJob) whenever its tick- or remote-push-woken check finds the job identity matching the account, so remote cell pushes trigger local worker execution.

if (await launchSlackJob(root)) log({ event: 'slack_install_resumed', deviceId: current.deviceId });

The runtime reads the install identity token and device key from the host home directory and supplies them to DeviceClient/CellLink, which authenticate over bearer routes and a WebSocket to the origin stored in the local file data/community-portal.json.

const account = local?.deviceId && local.origin ? await readInstallIdentity({ homeDir }) : null;

The mount validator matches the DEFAULT_BLOCKED_PATTERNS credential blocklist (.ssh, .aws, id_rsa, .netrc and others) only against the realPath of the mount root and never descends, so allowlisting a broad root such as ~ or ~/.config mounts every credential beneath it and exposes host credentials to the container agent.

is mounted regardless of what this list says.

An agent-initiated add_mcp_server request, after admin approval, writes an arbitrary stdio MCP server command/args/env into the container config and kills the container so the command runs at next start, gated by payload validation (SRC:b610e37aaafd96e8), plugin-owner rejection, and the admin-approval guard hold (SRC:f61f81c5fb5e0899).

await updateContainerConfigJson(agentGroup.id, 'mcp_servers', servers);

An agent-initiated install_packages request, after admin approval, appends arbitrary apt/npm package names into the container config, rebuilds the image, kills the container, and respawns it so the packages execute, with name validation (SRC:37a29f4a503b2c49) and a guard hold for agent actors (SRC:f61f81c5fb5e0899) as the only gates.

await buildAgentGroupImage(session.agent_group_id);

The host composer copies the agent-writable persona file verbatim into the group's CLAUDE.md at every container start, so agent-authored instructions persist into the system prompt of all future respawns, with O_NOFOLLOW on the persona read as the shown protection.

const persona = readGroupPersona(groupDir);

The shipped Claude provider contract makes the host create the agent's settings.json inside the claude-home state volume at group init from the unshown CLAUDE_DEFAULT_SETTINGS constant and rewrite existing settings via the unshown 'claude-settings' transformer (executed by initializeFile's writeNewFile/replaceFile), an agent control-plane write whose payload cannot be verified in this batch.

content: CLAUDE_DEFAULT_SETTINGS,

Undeclared residue: the template-library clone invocation sets a transient git config core.hooksPath=/dev/null (via -c, scoped to this single clone command), disabling git hooks during the fetch; it is defensive hardening rather than a persistent host config change, and it neither changes setup screens (D21) nor the provider default (D28), but no declaration covers it.

'core.hooksPath=/dev/null'

Undeclared residue: cloneRegistry spreads the entire host process environment (process.env) into the git child process used to clone the template library; the values are inherited by that subprocess only and are not logged or sent off-host, and no declaration covers the environment read.

const env = { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_LFS_SKIP_SMUDGE: '1' };

The restamp apply path deletes and rewrites the agent group's persona prepend file (and creates, updates, or removes template context files) from template content, replacing the instructions the stamped agent runs under.

fs.writeFileSync(personaFile,

The restamp apply path rewrites the agent group's MCP server configuration via updateContainerConfigJson('mcp_servers') and copies template skill directories into the group skills overlay, swapping the agent's tool and skill surface from template content.

if (mcpDirty) ops.push(async () => await updateContainerConfigJson(group.id, 'mcp_servers', next));

The restamp apply path creates, updates, and deletes scheduled task series through the group mailbox, pushing template-controlled prompts and scripts into the agent's task queue.

mailbox.updateTask(match.seriesId, {

The upgrade tripwire prints a stop block addressed to the coding agent instructing it to automatically run the unspecified FIX_COMMAND to clear the boot gate, and the module docstring states the message is deliberately written for that agent to act on automatically.

CODING AGENT: if you just ran /update-nanoclaw, /migrate-nanoclaw, or