debug

Check logs/nanoclaw.log for the container exit code and streamed stderr at debug level, then query the session's inbound.db and outbound.db. If messages_in has the message but messages_out is empty, the container died mid-run; check processing_ack and the heartbeat file mtime.

This happens when two NanoClaw service instances run simultaneously and the stale one has no channel adapters registered. Its delivery poll marks messages delivered without sending them. Find duplicates with ps aux, then stop and disable the stale systemd service.

Set LOG_LEVEL=debug when running pnpm run dev, or add it to the launchd plist or systemd unit environment. Debug level shows full mount configurations, the container spawn command, and streamed container stderr lines.

Secrets are injected per request by the OneCLI gateway, not via environment variables. A 401 usually means the agent is in selective secret mode and the secret was never assigned; run onecli agents list to check secretMode and set it to all if needed.

Run ncl groups restart --id <group-id> to restart all containers for an agent group. Add --rebuild to rebuild the image first after Dockerfile changes, or --message to wake the container immediately with a prompt.

Yes, run docker run --rm -it --entrypoint /bin/bash nanoclaw-agent:latest for an interactive shell. Verify /workspace, /workspace/agent, /home/node/.claude, and /app mounts exist and are owned by the node user.