Nydusfile DSL¶

The Nydusfile is a declarative, statically verifiable DSL for controlling spawning. No conditionals, no loops, no side effects.

Grammar¶

Nydusfile := Directive*
Directive := FROM | SOURCE | REDACT | EXCLUDE
           | LABEL | ADD | SET | REMOVE

Note: Registry-qualified FROM lines such as FROM nydus/openclaw:0.3.0 use example name and version strings. Your Nest server defines what is actually published. For a local base egg, build from eggs/base/ (for example openclaw/0.0.1) and use FROM ./base.egg, or point FROM at any path returned by nydus spawn.

Example¶

FROM nydus/openclaw:0.3.0
SOURCE openclaw ./my-agent/
REDACT true
ADD skill ./custom-summarizer/
ADD memory "Working on Project X with Snowflake"
ADD secret SNOWFLAKE_API_KEY
SET memory.label=persona "Prefers responses in Korean"
REMOVE skill outdated-workflow
REMOVE file *.log
EXCLUDE state
LABEL SOUL.md persona

Directives reference¶

FROM¶

FROM <egg-reference>

Versioned base egg from the Nest registry or a local .egg path. The base egg’s contents are the starting point. ADD/SET/REMOVE modify it.

Only accepts egg references, not source types. Use SOURCE instead of FROM openclaw.

Note: When both FROM and SOURCE are present, FROM provides the base template and SOURCE supplies fresh extraction. ADD/SET/REMOVE modify the base egg before merging.

Examples:

FROM nydus/openclaw:0.3.0
FROM ./base.egg

SOURCE¶

SOURCE <agent_type> <path>

Declares a single input source (at most one per Nydusfile). Source types: openclaw, zeroclaw, letta.

REDACT¶

REDACT true|false

Enable or disable secret scanning and PII redaction. Defaults to true when omitted. See Security for details.

EXCLUDE¶

EXCLUDE <memory-label>

Repeatable. Names a memory label to omit from the final Egg: Memory[persona], Memory[flow], Memory[context], or Memory[state]. Matching is case-insensitive.

Source files are still read and appear in the archive’s raw/ snapshot. Only structured memory for those buckets is dropped. Skills are not affected.

LABEL¶

LABEL <pattern> <label>

Repeatable. Override the memory label assigned to records from matching source files. Label must be one of: persona, flow, context, state. Duplicate patterns are rejected at parse time.

ADD¶

ADD <bucket> <content-or-path>
ADD <bucket> "<inline text>"

Add content to a bucket (skill, memory, secret). Accepts a file path, quoted inline string, or secret name.

SET¶

SET <bucket>.<selector> "<value>"

Override matching records in memory or skill. Not supported for secret (use REMOVE + ADD instead). All matching records are updated.

REMOVE¶

Two forms:

Merger (requires FROM). Mutates the base egg before SOURCE merge:

REMOVE <bucket> <identifier>

Source file drop (requires SOURCE). Omits files from extraction:

REMOVE file <glob-pattern>

Glob patterns match source file keys (e.g. SOUL.md, skills/*.md). Applied after read, before redaction and parse.

Nydusfile is required¶

A Nydusfile must exist in the working directory before running nydus spawn. If none is found, the command exits with an error. Create one with at least a SOURCE directive:

SOURCE openclaw ./

Static verification¶

Check	Description
FROM shape valid	Value is not a bare source type
FROM resolves	Base egg exists (local or registry)
SOURCE types valid	Known spawner, at most one SOURCE
ADD/SET target valid	References `skill`, `memory`, or `secret`
LABEL value valid	Known label (`persona`, `flow`, `context`, `state`)
LABEL pattern unique	Same pattern cannot have two labels
PII safety warning	Warning if REDACT is `false`
Merge ops require base	ADD/SET/REMOVE (merger) require FROM
REMOVE file requires SOURCE	File drops need a SOURCE tree
At least one input	Must have FROM or SOURCE