add-ollama-tool

The extendTool seam lets installed feature modules additively modify registered base tools' input schemas and descriptions and copy call-argument keys verbatim into outbound system-action payloads the host processes, without touching base tool source.

Arg keys copied verbatim from the call args into any system-action

extendTool in mcp-tools/server.ts lets any imported module append to an already-registered tool's description, merge extra input-schema properties, and copy additional call arguments verbatim into outbound payloads, so the tool metadata an agent finally sees depends on which modules are installed and cannot be fully reviewed statically.

def.tool.description = def.tool.description ? `${def.tool.description} ${descriptionSuffix}` : descriptionSuffix;

At boot the runner writes a memory scaffold into the host-backed /workspace/agent so the files persist across ephemeral containers, and registers a session-start hook (bun /app/src/memory/hook.ts) that re-injects this memory content into every new context window — persistence and recurring context injection undeclared by the declared Ollama-skill purpose.

the host-backed, RW group dir, so it persists across the

The Claude provider runtime writes a SessionStart entry into the agent's settings.json registering the command 'bun /app/src/memory/hook.ts', giving that script automatic execution at session start via the agent control plane.

command: 'bun /app/src/memory/hook.ts',

The runner writes a SessionStart hook into the Claude settings.json that executes 'bun /app/src/memory/hook.ts' at every new, cleared, or compacted session start, and the hook script's own behavior is not in the served content.

command: 'bun /app/src/memory/hook.ts',

When an inbound chat message matches the /upload-trace command, the runner calls uploadTrace(providerName), which reads the newest Claude session transcript from ~/.claude/projects and uploads that conversation trace to Hugging Face, sending conversation content off-host on command.

log('Uploading session trace to Hugging Face');

The container runner handles a mailbox '/upload-trace' command by calling uploadTrace() and logging 'Uploading session trace to Hugging Face', sending the agent's session trace to an external third-party service — a capability undeclared by the declared Ollama-skill purpose, contradicting the adjacent comment that the only command the runner handles directly is /clear.

log('Uploading session trace to Hugging Face');

The runner dynamically imports scheduling/task-script.js and executes pre-task scripts attached to mailbox task rows for both initial batches and follow-up messages, running content sourced from the message database before each provider call — undeclared by the declared Ollama-skill purpose.

const { applyPreTaskScripts } = await import('./scheduling/task-script.js');

The runner registers a Claude SessionStart hook by writing hooks.SessionStart into the Claude settings.json with command `bun /app/src/memory/hook.ts` (matcher startup|clear|compact, 10s timeout), executing at every new context window a file that is not part of the reviewable consumed content.

hooks: [{ type: 'command', command: hook.command, timeout: 10 }],

Undeclared residue R3 (unexplained, not concealed): newestClaudeTranscript enumerates ~/.claude/projects and returns the newest conversation transcript path, reading sensitive agent conversation history that the declared Ollama-MCP purpose does not cover.

dirs = fs.readdirSync(projects);

Pre-task scripts are taken verbatim from the script field of inbound task message rows, written to a /tmp file, and executed under bash in a detached process group with the container's full environment, so any party able to write task rows gains arbitrary command execution in the container.

const script = typeof content.script === 'string' ? (content.script as string) : null;

The agent-runner runs an arbitrary bash script embedded in each task message's content.script field, written to /tmp/task-script-<taskId>.sh and spawned under bash in a detached process group with the full process environment and no content validation, gating the task on the script's JSON wakeAgent output.

const child = spawn('bash', [scriptPath], { detached: true, env: process.env, stdio: ['ignore', 'pipe', 'pipe'] });

The /upload-trace command handler sends the agent session's transcript to a remote Hugging Face dataset via curl through a proxy that injects the user's HF token, and its setup path deliberately widens the created secret's scope to all of huggingface.co.

upload this session's transcript to the user's

When the poll loop handles the admin-gated /upload-trace command, container/agent-runner/src/upload-trace.ts reads the session's provider transcript file and commits its base64 contents to a huggingface.co dataset ({user}/nanoclaw-traces) via the Hub commit API.

https://huggingface.co/api/datasets/${repo}/commit/main

buildAgentGroupImage interpolates stored packages_apt and packages_npm values into a Dockerfile executed by docker build on the host without re-validating package-name syntax, so any stored value carrying shell or Dockerfile syntax would run as build-time commands on the host.

apt-get install -y ${aptPackages.join(' ')}

The migration writes a PreCompact command hook (bun /app/src/compact-instructions.ts) into the agent's settings.json during reconcile, an agent control-plane write that adds an executable hook to agent sessions.

preCompact.push({ hooks: [{ type: 'command', command: PRE_COMPACT_COMMAND }] });

The Claude provider contract and the host realization write and reconcile the container agent's auto-loaded settings.json (an agent control-plane file on a read-write mounted state volume), with content taken from the CLAUDE_DEFAULT_SETTINGS constant and a registered transformer whose write behavior is not shown in this bundle, leaving a host-to-agent-settings persistence chain whose payload is unverifiable here.

dir.writeNewFile(CLAUDE_SETTINGS_FILE, Buffer.from(CLAUDE_DEFAULT_SETTINGS));

Residue adjudicated unexplained: host group initialization force-writes the Claude agent control-plane file settings.json, installing a PreCompact command hook that executes bundled code (bun /app/src/compact-instructions.ts) and forcing auto-memory off — an undeclared control-plane write the declared add-Ollama-MCP-server purpose does not need.

const PRE_COMPACT_COMMAND = 'bun /app/src/compact-instructions.ts';

The mount validator applies its credential deny-list only to the resolved mount root and never descends, so an operator-allowed root such as the home directory mounts credential files beneath it (.ssh, .aws, .netrc, id_rsa) into the container despite the block list.

is mounted regardless of what this list says

composeGroupProjectDoc copies stored MCP server `instructions` verbatim into the agent-facing project document while the host's re-validation (sanitizeStoredMcpServers/parseMcpServerConfig) constrains that field only to be a string, so any stored, agent-influenced instruction text becomes standing system-prompt content with no content filter.

if (mcp.instructions) push(`MCP Server: ${name}`, mcp.instructions, true);

Undeclared residue: the shipped NanoClaw project-doc composer writes a per-group CLAUDE.md agent instruction document on the host at every container start, an agent control-plane write that the declared add-an-Ollama-MCP-server purpose does not cover.

File written into the group directory, e.g. `CLAUDE.md`.

Undeclared residue: the shipped Claude provider contract has the host create-if-missing and then reconcile the container agent's settings.json from the constant CLAUDE_DEFAULT_SETTINGS (content not shown in this batch), an agent control-plane write the declared Ollama-only purpose does not cover.

relativePath: 'settings.json',