{"id":"update-nanoclaw","name":"update-nanoclaw","summary":"公式アップストリームからカスタマイズされたNanoClawチェックアウトをトランザクション形式で更新し、ライブマウントソースを公開せずに、フォークセーフなスキルリフレッシュ、可変状態スナップショット、移行ゲート、正確なコードアップグレードマーカー、サービス再起動検出、ヘルスチェック、自動ローカルロールバックを利用でき…","body":"# Update NanoClaw\n\nUpdate a customized install through an isolated, resumable transaction. The\nlive checkout is not touched until the staged result has passed validation.\n\nUse ordinary conversation for decisions and confirmations. Do not depend on\nClaude Code, Codex, OpenCode, or any provider-specific question/skill tool.\n\n## Safety contract\n\n- Require a clean live checkout.\n- Stage Git integration, dependency installation, installed-skill refresh, and\n  tests in a separate worktree.\n- Resolve registry branches from the remote that actually carries them.\n- Stop the detected service and drain this install's active containers before\n  changing source mounted into agent containers.\n- Snapshot `.env`, `data/`, `groups/`, `store/`, and manual-service state before\n  cutover. Sockets and other ephemeral special files are intentionally omitted.\n- Gate every breaking migration and external version-pin move.\n- Stamp the exact Git commit/tree only after all required work succeeds.\n- Restart through the detected launchd, user-systemd, system-systemd, or nohup\n  mode; require process state, `data/ncl.sock`, and `bin/ncl groups list`.\n- Refuse cutover while an unmanaged `pnpm dev`/Node host is running. Stop that\n  process explicitly, update offline, then start it again manually.\n- On build or health failure, restore Git and the mutable-state snapshot, rebuild\n  the previous image, restart the previous service, and health-check it.\n\n## 1. Load the newest controller without changing the live tree\n\nConfirm the live tree is clean:\n\n```bash\ngit status --porcelain\n```\n\nStop if it prints anything.\n\nUse the official remote if one already exists. Otherwise add it as `upstream`:\n\n```bash\nif git remote get-url upstream >/dev/null 2>&1; then\n  upstream_remote=upstream\nelif git remote get-url origin 2>/dev/null | grep -Eq '(^|[:/])nanocoai/nanoclaw(.git)?$'; then\n  upstream_remote=origin\nelse\n  git remote add upstream https://github.com/nanocoai/nanoclaw.git\n  upstream_remote=upstream\nfi\ngit fetch \"$upstream_remote\" --prune\n```\n\nSelect `main` when present, otherwise `master`:\n\n```bash\nif git show-ref --verify --quiet \"refs/remotes/$upstream_remote/main\"; then\n  upstream_ref=\"$upstream_remote/main\"\nelif git show-ref --verify --quiet \"refs/remotes/$upstream_remote/master\"; then\n  upstream_ref=\"$upstream_remote/master\"\nelse\n  echo \"Official remote has neither main nor master\" >&2\n  exit 1\nfi\n```\n\nMaterialize the newest controller from that ref. This is the self-update seam:\nan older local skill still executes the newest safety code before any mutation.\n\n```bash\ncontroller_dir=\"$(mktemp -d)\"\ngit archive \"$upstream_ref\" \\\n  scripts/update-nanoclaw.ts scripts/update scripts/update-skills.ts \\\n  scripts/skill-apply.ts scripts/skill-directives.ts src/install-slug.ts \\\n  | tar -x -C \"$controller_dir\"\n```\n\n## 2. Choose the Git strategy and prepare\n\nDefault to `merge`. Use `rebase` only when the user explicitly wants linear\nhistory. Use `cherry-pick` only with an explicit comma-separated commit list.\n\n```bash\npnpm exec tsx \"$controller_dir/scripts/update-nanoclaw.ts\" prepare \\\n  --project-root \"$PWD\" --upstream-ref \"$upstream_ref\" --strategy merge\n```\n\nThe JSON result is `nanoclaw-update/v1`. Record its `id`, `stageRoot`, backup\nbranch/tag, changed files, and requirements. The live `HEAD` is still unchanged.\n\nIf `phase` is `conflict`, resolve conflicts only inside `stageRoot`, preserving\nintentional local customizations. Complete the merge/rebase/cherry-pick there,\ncommit it, then run:\n\n```bash\npnpm exec tsx \"$stageRoot/scripts/update-nanoclaw.ts\" resume \\\n  --project-root \"$PWD\" --id \"$id\"\n```\n\nShow the user the upstream commits, changed-file buckets, requirements, and any\nresolved conflicts. To stop with no live mutation:\n\n```bash\npnpm exec tsx \"$stageRoot/scripts/update-nanoclaw.ts\" abandon \\\n  --project-root \"$PWD\" --id \"$id\"\n```\n\n## 3. Validate the staged result\n\n```bash\npnpm exec tsx \"$stageRoot/scripts/update-nanoclaw.ts\" validate \\\n  --project-root \"$PWD\" --id \"$id\"\n```\n\nValidation performs a fork-safe structured refresh of every installed channel\nand provider, commits refreshed payloads in the staging branch, installs frozen\ndependencies, runs the host build and full host tests, and runs the container\ndependency/typecheck leg when Bun is available. A provider skill that declares\nBun dependencies does not require Bun on the host: refresh runs the exact Bun\nversion pinned by `container/Dockerfile` through pnpm. Any selected skill\nrefresh or validation failure blocks cutover and the completion stamp.\n\nFix only failures caused by the staged update, inside `stageRoot`, commit the\nfix, and re-run validation. Do not mutate the live checkout to repair staging.\n\n## 4. Confirm and cut over\n\nBefore downtime, show the exact changed files, required migrations, detected\nbackup tag, and rollback command. Ask for one confirmation to begin cutover.\n\n```bash\npnpm exec tsx \"$stageRoot/scripts/update-nanoclaw.ts\" cutover \\\n  --project-root \"$PWD\" --id \"$id\"\n```\n\nCutover stops the detected service, waits for this install's labeled agent\ncontainers to exit, snapshots mutable state, resets the live branch to the\nvalidated target, installs frozen dependencies, builds the host, and updates\nthe agent image when `container/` changed. Hardened-image installs use `pull`;\nlocal-image installs build locally. The service remains stopped while required\nmigrations are pending.\n\n## 5. Complete every requirement\n\nProcess requirements one at a time.\n\n- For a referenced local guide, read it from the cut-over checkout and follow\n  its detect, fix, verify, and rollback sections.\n- For a referenced `/<skill>`, read that skill's current `SKILL.md` and follow\n  it directly. Do not require a harness-specific skill invocation feature.\n- For OneCLI pin moves, follow `docs/onecli-upgrades.md`; record the exact old\n  version or rollback command because OneCLI is outside the Git snapshot.\n\nIf a migration intentionally changes tracked files, review and commit those\nchanges before acknowledging it. Finish refuses a dirty cut-over checkout.\n\nAfter verification, acknowledge the requirement:\n\n```bash\npnpm exec tsx \"$stageRoot/scripts/update-nanoclaw.ts\" ack \\\n  --project-root \"$PWD\" --id \"$id\" \\\n  --requirement \"$requirement_id\" --status succeeded\n```\n\nFor an external component, also pass a concise exact rollback instruction:\n\n```bash\n... ack ... --rollback \"restore onecli-gateway to <old-version>\"\n```\n\nUse `--status failed` when verification fails. A pending or failed requirement\nblocks finish; never offer “restart anyway.” The state snapshot is the recovery\npath for forward local migrations.\n\n## 6. Finish and health-check\n\n```bash\npnpm exec tsx \"$stageRoot/scripts/update-nanoclaw.ts\" finish \\\n  --project-root \"$PWD\" --id \"$id\"\n```\n\nFinish stamps the exact version/commit/tree, restarts the service mode detected\nbefore cutover, and waits for the process, CLI socket, and a real CLI request.\nOnly `phase: complete` is success.\n\nAfter success, remove the staging worktree and its temporary branch from the\nlive checkout. This keeps the backup branch/tag and mutable snapshot intact for\nrollback:\n\n```bash\npnpm exec tsx scripts/update-nanoclaw.ts cleanup --id \"$id\"\n```\n\nIf health fails, the controller restores the previous Git commit and mutable\nstate, rebuilds the previous image, restarts the old service, and verifies it.\nIf an external component was changed, also execute the recorded external\nrollback instruction and verify that component; Git cannot restore it.\n\n## 7. Report and retain one rollback point\n\nReport:\n\n- transaction id and final phase;\n- old, target, and official upstream commits;\n- backup branch/tag and mutable snapshot location;\n- conflicts resolved;\n- registry remotes and refreshed skills;\n- validation and image result;\n- completed migrations and external rollback instructions;\n- detected service mode and health result; and\n- remaining diff from official upstream.\n\nManual rollback remains available while the snapshot is retained:\n\n```bash\npnpm exec tsx scripts/update-nanoclaw.ts rollback --id \"$id\"\n```\n\nDo not describe the Git tag alone as full rollback. The transaction snapshot is\nwhat restores SQLite and other mutable local state. Keep the newest successful\ntransaction until the next update completes. Then preview older terminal\ntransactions that are safe to prune:\n\n```bash\npnpm exec tsx scripts/update-nanoclaw.ts prune --id \"$id\" --dry-run\n```\n\nShow the `removed` list and ask for confirmation. If confirmed, run the same\ncommand without `--dry-run`. Pruning keeps the selected transaction, every\nnewer transaction, and every nonterminal transaction. It removes older terminal\nsnapshots and their staging/backup Git references. Never delete transaction\ndirectories directly.","author":"@nanocoai","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/nanocoai/nanoclaw/tree/main/.claude/skills/update-nanoclaw","license":"MIT","category":null,"lang":"en","tokens":1997,"stars":0,"calls30d":2,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":[]}}