lazyclaw 5.4.3 → 6.0.0

package/mas/agent_turn.mjs

@@ -94,6 +94,7 @@ export async function runAgentTurn({
   maxIterations = DEFAULT_MAX_ITERATIONS,
   signal,
   approve,
+  security,
   // v5 (Group A — C3): trajectoryRef is OPT-OUT, not opt-in. A caller
   // that doesn't pass one but DOES pass a configDir gets a
   // default-stamped record so every production agent turn lands in
@@ -218,7 +219,7 @@ export async function runAgentTurn({
       try {
         result = await runTool({
           agent, tool: call.name, args: call.input,
-          taskId, configDir, cwd, approve,
+          taskId, configDir, cwd, approve, security,
         });
         if (result && result.ok === false) ok = false;
       } catch (err) {

package/mas/index_db.mjs

@@ -85,6 +85,16 @@ function prepareStatements(db) {
     insertMemory: db.prepare(
       `INSERT INTO fts_memories(content, topic, kind)
        VALUES (?, ?, ?)`),
+    // Upsert-by-natural-key deletes (skills/trajectories/memories only —
+    // these get re-indexed for the same key on every save/put, so a bare
+    // INSERT would accumulate duplicate FTS rows that skew bm25 and eat the
+    // recall k-budget). Sessions are NOT deduped this way: each turn has a
+    // unique (session_id,turn_idx) in normal flow, and a per-turn full-table
+    // DELETE would reintroduce O(n^2) on the hot write path; session dedup is
+    // handled by reindexAll rebuilding from scratch.
+    deleteSkill: db.prepare(`DELETE FROM fts_skills WHERE skill_name = ?`),
+    deleteTrajectory: db.prepare(`DELETE FROM fts_trajectories WHERE trajectory_id = ?`),
+    deleteMemory: db.prepare(`DELETE FROM fts_memories WHERE topic = ? AND kind = ?`),
     queries: {
       sessions: db.prepare(
         `SELECT 'sessions' AS scope, bm25(fts_sessions) AS bm25,
@@ -160,6 +170,7 @@ export function indexSessionTurn(row, configDir = defaultConfigDir()) {
 export function indexSkill(row, configDir = defaultConfigDir()) {
   try {
     const s = _stmts(configDir);
+    s.deleteSkill.run(String(row.skill_name || ''));   // upsert by skill_name
     s.insertSkill.run(
       redactSecrets(String(row.content || '')),
       String(row.skill_name || ''), String(row.trained_by || ''),
@@ -175,6 +186,7 @@ export function indexSkill(row, configDir = defaultConfigDir()) {
 export function indexTrajectory(row, configDir = defaultConfigDir()) {
   try {
     const s = _stmts(configDir);
+    s.deleteTrajectory.run(String(row.trajectory_id || ''));   // upsert by trajectory_id
     s.insertTrajectory.run(
       redactSecrets(String(row.content || '')),
       String(row.trajectory_id || ''), String(row.agent || ''),
@@ -190,6 +202,7 @@ export function indexTrajectory(row, configDir = defaultConfigDir()) {
 export function indexMemory(row, configDir = defaultConfigDir()) {
   try {
     const s = _stmts(configDir);
+    s.deleteMemory.run(String(row.topic || ''), String(row.kind || ''));   // upsert by (topic,kind)
     s.insertMemory.run(
       redactSecrets(String(row.content || '')),
       String(row.topic || ''), String(row.kind || ''),
@@ -287,6 +300,9 @@ export function integrityCheck(configDir = defaultConfigDir()) {
   return { ok: r === 'ok', result: r };
 }
 
+// Destructive primitive: drop the db (+ WAL sidecars) and recreate the empty
+// schema. Callers that want a *populated* index must use reindexAll — a bare
+// rebuild leaves recall returning zero hits.
 export function rebuild(configDir = defaultConfigDir()) {
   closeIndex(configDir);
   const p = dbPath(configDir);
@@ -300,3 +316,69 @@ export function rebuild(configDir = defaultConfigDir()) {
   }
   openIndex(configDir);
 }
+
+// Minimal frontmatter splitter (trained_by / group are the only keys reindex
+// needs); avoids importing skills.mjs and risking an import cycle.
+function _miniFrontmatter(raw) {
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(String(raw || ''));
+  if (!m) return { meta: {}, body: String(raw || '') };
+  const meta = {};
+  for (const line of m[1].split('\n')) {
+    const i = line.indexOf(':');
+    if (i > 0) meta[line.slice(0, i).trim()] = line.slice(i + 1).trim();
+  }
+  return { meta, body: m[2] };
+}
+
+// Rebuild AND repopulate the FTS index from the on-disk source of truth
+// (sessions JSONL, flat skill .md, memory core/episodic). This is what
+// `index rebuild` / doctor recovery must call — a bare rebuild() zeroes recall.
+// Shared by scripts/migrate-v5 and the daemon POST /index/rebuild route.
+export function reindexAll(configDir = defaultConfigDir()) {
+  rebuild(configDir);
+  // Sessions — flat <configDir>/sessions/<id>.jsonl, one turn per line.
+  const sessDir = path.join(configDir, 'sessions');
+  if (fs.existsSync(sessDir)) {
+    for (const f of fs.readdirSync(sessDir)) {
+      if (!f.endsWith('.jsonl')) continue;
+      const id = f.slice(0, -'.jsonl'.length);
+      let idx = 0;
+      const raw = fs.readFileSync(path.join(sessDir, f), 'utf8');
+      for (const line of raw.split('\n')) {
+        if (!line) continue;
+        try {
+          const o = JSON.parse(line);
+          indexSessionTurn({ session_id: id, turn_idx: idx++, role: o.role || 'user', ts: o.ts || 0, content: o.content || '' }, configDir);
+        } catch { /* skip malformed line */ }
+      }
+    }
+  }
+  // Skills — canonical flat <configDir>/skills/<name>.md (skip the .archive dir).
+  const skillsDir = path.join(configDir, 'skills');
+  if (fs.existsSync(skillsDir)) {
+    for (const f of fs.readdirSync(skillsDir)) {
+      if (!f.endsWith('.md')) continue;
+      const name = f.slice(0, -'.md'.length);
+      const { meta, body } = _miniFrontmatter(fs.readFileSync(path.join(skillsDir, f), 'utf8'));
+      indexSkill({
+        skill_name: name,
+        trained_by: meta.trained_by || 'legacy',
+        group_name: meta.group || (name.includes('-') ? name.split('-')[0] : 'legacy'),
+        content: body,
+      }, configDir);
+    }
+  }
+  // Memory — core.md + episodic/*.md.
+  const memDir = path.join(configDir, 'memory');
+  if (fs.existsSync(memDir)) {
+    const core = path.join(memDir, 'core.md');
+    if (fs.existsSync(core)) indexMemory({ topic: 'core', kind: 'core', content: fs.readFileSync(core, 'utf8') }, configDir);
+    const epi = path.join(memDir, 'episodic');
+    if (fs.existsSync(epi)) {
+      for (const f of fs.readdirSync(epi)) {
+        if (!f.endsWith('.md')) continue;
+        indexMemory({ topic: f.slice(0, -'.md'.length), kind: 'episodic', content: fs.readFileSync(path.join(epi, f), 'utf8') }, configDir);
+      }
+    }
+  }
+}

package/mas/learning.mjs

@@ -34,6 +34,7 @@ import * as userModeler from './user_modeler.mjs';
 import * as confidence from './confidence.mjs';
 import * as skills from '../skills.mjs';
 import { resolveTrainer } from '../providers/registry.mjs';
+import { hasClaudeCliSession } from '../providers/claude_cli_detect.mjs';
 
 export const TRIGGERS = Object.freeze([
   'post-task',
@@ -330,9 +331,24 @@ export async function _runPeriodicCuration(_ctx, logger) {
 
 // ── helpers ──────────────────────────────────────────────────────────
 
+let _trainerNoticed = false;
+
 function _safeResolveTrainer(cfg, agent) {
   try {
-    return resolveTrainer(cfg || { provider: agent?.provider, model: agent?.model });
+    const c = cfg || { provider: agent?.provider, model: agent?.model };
+    // Use real claude-cli session detection in production (the resolver's own
+    // default stub only checked an env var that `claude login` never sets).
+    const resolved = resolveTrainer(c, { detectClaudeCli: hasClaudeCliSession });
+    // Honesty: if the user asked for trainer.provider:'auto' but no claude-cli
+    // session was found, the learning loop bills the chat provider — say so once
+    // so the "$0 on Claude Pro" promise never fails silently.
+    if (!_trainerNoticed && c && c.trainer && c.trainer.provider === 'auto' && resolved.provider !== 'claude-cli') {
+      _trainerNoticed = true;
+      try {
+        process.stderr.write(`[trainer] no claude-cli session detected → learning will use "${resolved.provider || 'the chat provider'}" (billed per token). Run 'claude login', or set trainer.provider explicitly, to control cost.\n`);
+      } catch { /* stderr closed */ }
+    }
+    return resolved;
   } catch {
     return { provider: agent?.provider || '', model: agent?.model || '' };
   }

package/mas/mention_router.mjs

@@ -280,11 +280,11 @@ async function postTypingPlaceholder({ task, agentRecord, logger = () => {}, sen
   if (agentRecord?.iconEmoji)   sendOpts.icon_emoji = agentRecord.iconEmoji;
   try {
     const res = await slack.send(threadId, `_:hourglass_flowing_sand: thinking…_`, sendOpts);
-    return { ts: res?.ts || null, sender: owned ? slack : null, channel: task.slackChannel };
+    return { ts: res?.ts || null, sender: slack, owned, channel: task.slackChannel };
   } catch (err) {
     logger(`[router] slack typing post failed: ${err?.message || err}\n`);
     if (owned) await slack.stop().catch(() => {});
-    return { ts: null, sender: null };
+    return { ts: null, sender: null, owned: false };
   }
 }
 
@@ -360,12 +360,12 @@ async function autoSynthSkills({ task, agentsById, apiKey, baseUrl, fetchImpl, c
 }
 
 async function clearTypingPlaceholder(placeholder, logger) {
-  if (!placeholder?.ts || !placeholder?.channel) return;
+  if (!placeholder?.ts || !placeholder?.channel || !placeholder?.sender) return;
   const slack = placeholder.sender;
-  if (!slack) return;  // sender wasn't owned by us; skip
   try { await slack.deleteMessage(placeholder.channel, placeholder.ts); }
   catch (err) { logger(`[router] slack typing delete failed: ${err?.message || err}\n`); }
-  finally { await slack.stop().catch(() => {}); }
+  // Only stop a client we created here; a shared sender is closed once by run().
+  finally { if (placeholder.owned) await slack.stop().catch(() => {}); }
 }
 
 // Run agents in this team until the queue empties or budget runs out.
@@ -388,6 +388,11 @@ export async function runTaskTurn({
   maxAgentTurns = DEFAULT_MAX_AGENT_TURNS,
   signal,
   approve,
+  security,
+  // E3 — a long-lived caller (e.g. the daemon) can pass a pre-started
+  // SlackChannel to reuse across many task turns; run() then neither
+  // creates nor stops it. When omitted, run() opens + closes its own.
+  slackSender: providedSender,
 } = {}) {
   if (!task || !team || !agentsById) {
     throw new MentionRouterError('task, team, agentsById are required', 'ROUTER_BAD_INPUT');
@@ -410,11 +415,30 @@ export async function runTaskTurn({
     current = tasksMod.patchTask(current.id, { status: 'running' }, configDir);
   }
 
+  // E3 — open ONE Slack client for the whole run and reuse it for every
+  // thread post + typing placeholder, instead of constructing + starting +
+  // stopping a fresh SlackChannel (a network auth handshake) on each of the
+  // ~3-4 posts per agent turn. Posts fall back to a per-call owned client
+  // when no shared sender is available (no thread, or start failure).
+  let slackSender = providedSender || null;
+  let ownSlackSender = false;
+  if (!slackSender && current.slackChannel && current.slackThreadTs) {
+    try {
+      const { SlackChannel } = await import('../channels/slack.mjs');
+      slackSender = new SlackChannel({ requireInbound: false });
+      await slackSender.start(async () => '', {});
+      ownSlackSender = true;
+    } catch (err) {
+      logger(`[router] slack start failed, falling back to per-post clients: ${err?.message || err}\n`);
+      slackSender = null;
+    }
+  }
+
   // Seed: append the user message if provided, and (also) push it to
   // Slack so anyone reading the thread sees the prompt.
   if (userMessage && String(userMessage).trim()) {
     current = tasksMod.appendTurn(current.id, { agent: 'user', text: String(userMessage), ts: new Date().toISOString() }, configDir);
-    await postToThread({ task: current, agentRecord: null, text: `*User*: ${userMessage}`, logger });
+    await postToThread({ task: current, agentRecord: null, text: `*User*: ${userMessage}`, logger, sender: slackSender });
   }
 
   const queue = [team.lead];
@@ -437,7 +461,7 @@ export async function runTaskTurn({
     // up the turn before the LLM finishes. Cleared right after the
     // real reply lands so we never leave a stale placeholder in the
     // thread.
-    const typing = await postTypingPlaceholder({ task: current, agentRecord, logger });
+    const typing = await postTypingPlaceholder({ task: current, agentRecord, logger, sender: slackSender });
 
     let result;
     try {
@@ -450,7 +474,7 @@ export async function runTaskTurn({
         userMessage: '',
         history: ctx.history,
         taskId: current.id,
-        configDir, cwd, apiKey, fetchImpl, baseUrl, signal, approve,
+        configDir, cwd, apiKey, fetchImpl, baseUrl, signal, approve, security,
         // C9 — enable Anthropic prompt caching for the static system
         // prefix + tool definitions. Non-anthropic adapters ignore
         // the flag (it's a no-op for OpenAI/Gemini/claude-cli).
@@ -470,11 +494,11 @@ export async function runTaskTurn({
 
     // Slack mirror — only the user-visible text, with the agent name
     // prefixed so a human reader can follow who said what.
-    if (replyText) await postToThread({ task: current, agentRecord, text: replyText, logger });
+    if (replyText) await postToThread({ task: current, agentRecord, text: replyText, logger, sender: slackSender });
 
     if (replyText.includes(DONE_MARKER)) {
       current = tasksMod.patchTask(current.id, { status: 'done' }, configDir);
-      await postToThread({ task: current, agentRecord: null, text: `:white_check_mark: ${DONE_MARKER} — task closed by *${agentRecord.displayName || speaker}*.`, logger });
+      await postToThread({ task: current, agentRecord: null, text: `:white_check_mark: ${DONE_MARKER} — task closed by *${agentRecord.displayName || speaker}*.`, logger, sender: slackSender });
       stoppedBy = 'done';
       // Phase 18: fire one reflection LLM call per participating agent
       // whose memoryWrite is 'auto'. We pick "participating" off the
@@ -508,5 +532,9 @@ export async function runTaskTurn({
   }
 
   if (iterations >= maxAgentTurns) stoppedBy = 'budget';
+  // Close the Slack client once for the whole run — but only if WE opened
+  // it. A caller-provided sender is left running for the caller to reuse.
+  // All exit paths (done/budget/abort/idle) fall through to this return.
+  if (ownSlackSender && slackSender) await slackSender.stop().catch(() => {});
   return { task: current, iterations, stoppedBy };
 }

package/mas/provider_adapters.mjs

@@ -35,13 +35,37 @@ export async function resolveToolUseAdapter(provider) {
     case 'gemini':     return await import('../providers/tool_use/gemini.mjs');
     case 'claude-cli': return await import('../providers/tool_use/claude_cli.mjs');
     default:
-      throw new ProviderAdapterError(
-        `provider "${provider}" does not support text completion`,
-        'PROVIDER_ADAPTER_UNKNOWN',
-      );
+      return await _openAICompatAdapter(provider);
   }
 }
 
+// Any OpenAI-wire-compatible provider — the built-in compat vendors
+// (nim/openrouter/groq/together/xai/deepseek/mistral/fireworks) and custom
+// providers — can drive tool-use through the OpenAI adapter, just at a
+// different base URL. They advertise as first-class providers, so agents,
+// teams, and the trainer must work for them too (previously they threw
+// "does not support text completion"). We bind the provider's baseUrl so the
+// caller doesn't have to know it; an explicit baseUrl in the call still wins.
+async function _openAICompatAdapter(provider) {
+  let info;
+  try {
+    const reg = await import('../providers/registry.mjs');
+    info = reg.PROVIDER_INFO && reg.PROVIDER_INFO[provider];
+  } catch { info = null; }
+  if (!info || !(info.builtinOpenAICompat || info.custom || info.baseUrl)) {
+    throw new ProviderAdapterError(
+      `provider "${provider}" does not support text completion`,
+      'PROVIDER_ADAPTER_UNKNOWN',
+    );
+  }
+  const base = await import('../providers/tool_use/openai.mjs');
+  if (!info.baseUrl) return base; // custom without a stored baseUrl — caller supplies it
+  return {
+    ...base,
+    callOnce: (opts = {}) => base.callOnce({ baseUrl: info.baseUrl, ...opts }),
+  };
+}
+
 // Run one no-tools text completion through the provider's tool-use
 // adapter and return the model's text (or '' when it produced none).
 //

package/mas/scrub_env.mjs

@@ -0,0 +1,34 @@
+// scrub_env.mjs — strip secret-bearing variables from an environment copy.
+//
+// The bash tool inherits the parent process environment so commands behave
+// like a normal shell (PATH, HOME, locale, proxy settings, …). But the parent
+// env also carries provider API keys and channel tokens — including anything
+// loaded from <configDir>/.env by dotenv_min — and an agent's shell command is
+// model-controlled (and steerable via prompt injection). Passing the raw env
+// to a child lets a single `env | curl …` exfiltrate every credential.
+//
+// scrubEnv returns a COPY of `env` with keys that look like secrets removed,
+// while keeping the operational variables a command legitimately needs. An
+// explicit `allow` list opts specific keys back in for the rare command that
+// genuinely needs one.
+
+// Matches keys whose final _-segment is a secret-ish noun: FOO_API_KEY,
+// ANTHROPIC_API_KEY, *_TOKEN (incl. CLAUDE_CODE_OAUTH_TOKEN, GITHUB_TOKEN),
+// *_SECRET, *_PASSWORD/PASSWD, *_CREDENTIAL(S), *_PRIVATE_KEY, *_ACCESS_KEY.
+const SECRET_KEY_RE =
+  /(^|_)(API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATE_KEY|ACCESS_KEY|AUTH_TOKEN)$/i;
+
+export function isSecretKey(name) {
+  return SECRET_KEY_RE.test(String(name || ''));
+}
+
+export function scrubEnv(env = process.env, { allow = [] } = {}) {
+  const allowSet = new Set(allow);
+  const out = {};
+  for (const [k, v] of Object.entries(env || {})) {
+    if (allowSet.has(k)) { out[k] = v; continue; }
+    if (isSecretKey(k)) continue; // drop secrets
+    out[k] = v;
+  }
+  return out;
+}

package/mas/tool_runner.mjs

@@ -35,7 +35,7 @@ export function listToolSchemas(names) {
 export function isImplemented(name) { return registry.lookup(name) !== null; }
 export function knownTool(name)     { return registry.lookup(name) !== null; }
 
-export async function runTool({ agent, tool, args, taskId, configDir, cwd, approve } = {}) {
+export async function runTool({ agent, tool, args, taskId, configDir, cwd, approve, security } = {}) {
   if (!agent || !Array.isArray(agent.tools)) {
     throw new ToolError('agent record with .tools[] is required', 'TOOL_BAD_AGENT');
   }
@@ -44,12 +44,28 @@ export async function runTool({ agent, tool, args, taskId, configDir, cwd, appro
   if (!agent.tools.includes(tool)) {
     throw new ToolError(`agent "${agent.name}" is not allowed to call tool "${tool}" (whitelist=[${agent.tools.join(', ')}])`, 'TOOL_DENIED');
   }
-  if (typeof approve === 'function' && impl.sensitive) {
-    let verdict;
-    try { verdict = await approve({ tool, args, agent: agent.name }); }
-    catch (err) { verdict = { approved: false, reason: `approval error: ${err?.message || err}` }; }
-    if (!verdict || !verdict.approved) {
-      const result = { ok: false, error: `tool "${tool}" denied by operator${verdict?.reason ? `: ${verdict.reason}` : ''}`, code: 'TOOL_DENIED_APPROVAL' };
+  // Sensitive tools (shell exec, file writes, network egress, delegation)
+  // are fail-closed: they run only behind an approval hook, OR when the
+  // operator has explicitly opted into unattended execution. A missing
+  // approve hook used to mean "ungated" — that made a fresh interactive
+  // install run bash/write with no confirmation, i.e. remote-prompt-
+  // injection-to-RCE. The default is now deny.
+  if (impl.sensitive) {
+    if (typeof approve === 'function') {
+      let verdict;
+      try { verdict = await approve({ tool, args, agent: agent.name }); }
+      catch (err) { verdict = { approved: false, reason: `approval error: ${err?.message || err}` }; }
+      if (!verdict || !verdict.approved) {
+        const result = { ok: false, error: `tool "${tool}" denied by operator${verdict?.reason ? `: ${verdict.reason}` : ''}`, code: 'TOOL_DENIED_APPROVAL' };
+        audit.append({ taskId, agent: agent.name, tool, args, result, ok: false, configDir });
+        return result;
+      }
+    } else if (security && security.allowUnattendedSensitive === true) {
+      // Explicit, persisted opt-in to unattended sensitive execution.
+      // Never silent — record that the gate was bypassed by config.
+      audit.append({ taskId, agent: agent.name, tool, args, result: { ok: true, note: 'sensitive tool ran unattended (security.allowUnattendedSensitive)' }, ok: true, configDir });
+    } else {
+      const result = { ok: false, error: `tool "${tool}" is sensitive and requires operator approval, but no approval channel is configured. Run interactively, pass --approve-url, or set security.allowUnattendedSensitive=true to allow unattended use.`, code: 'TOOL_DENIED_NO_APPROVER' };
       audit.append({ taskId, agent: agent.name, tool, args, result, ok: false, configDir });
       return result;
     }

package/mas/tools/bash.mjs

@@ -1,14 +1,19 @@
 // Bash tool — runs a shell command, captures stdout/stderr/exit.
 //
-// Workspace is constrained to the lazyclaw process cwd (spec §5.2). We
-// don't sandbox further (per §10 #6 — destructive-pattern confirmation
-// is OFF by default); the audit log captures every invocation so post-hoc
-// forensics work.
+// The command runs with cwd defaulted to the lazyclaw process cwd, but this
+// is NOT an OS sandbox — absolute paths and `cd` escape it. Two real
+// protections apply instead: (1) bash is a `sensitive` tool, so the
+// fail-closed approval gate in tool_runner requires operator confirmation
+// (or an explicit security.allowUnattendedSensitive opt-in) before it runs;
+// (2) the child env is scrubbed of secrets (scrubEnv) so a command cannot
+// exfiltrate API keys / channel tokens inherited from the parent or
+// <configDir>/.env. Every invocation is still audit-logged for forensics.
 //
 // Timeout defaults to 30s so a runaway command can't stall the whole
 // agent turn. Override via args.timeoutMs (capped at 5 minutes).
 
 import { spawn } from 'node:child_process';
+import { scrubEnv } from '../scrub_env.mjs';
 
 export const NAME = 'bash';
 export const DESCRIPTION = 'Run a shell command in the agent\'s workspace. Returns {stdout, stderr, exitCode}. Timeout 30s by default.';
@@ -34,7 +39,7 @@ export async function exec(args, { cwd = process.cwd() } = {}) {
     MAX_TIMEOUT_MS
   );
   return new Promise((resolve) => {
-    const child = spawn('sh', ['-c', args.command], { cwd, env: process.env });
+    const child = spawn('sh', ['-c', args.command], { cwd, env: scrubEnv(process.env) });
     let stdout = '', stderr = '';
     let outBytes = 0, errBytes = 0;
     let truncated = false;

package/mas/tools/browser.mjs

@@ -3,6 +3,8 @@
 // return a structured error if it is missing at runtime. A persistent
 // headless Chromium context is reused across calls in the same process.
 
+import { isSafeUrl, isPrivateAddr } from './web.mjs';
+
 let _backend = null;
 export function __setBrowserBackend(b) { _backend = b; }
 
@@ -15,6 +17,16 @@ async function ensureCtx() {
   catch { throw new Error('browser: playwright not installed (npm i playwright)'); }
   const browser = await pw.chromium.launch({ headless: true });
   const context = await browser.newContext();
+  // Block in-page requests (redirects, subresources, JS-driven navigations)
+  // to loopback / private / link-local / metadata IPs — goto-time validation
+  // alone misses those. Cheap literal-IP check, no per-request DNS.
+  await context.route('**/*', (route) => {
+    try {
+      const h = new URL(route.request().url()).hostname.replace(/^\[|\]$/g, '');
+      if (h === 'localhost' || h === '0.0.0.0' || isPrivateAddr(h)) return route.abort('blockedbyclient');
+    } catch { /* unparseable → let Chromium handle it */ }
+    return route.continue();
+  });
   const page = await context.newPage();
   _ctx = {
     navigate: async (url) => { await page.goto(url, { waitUntil: 'domcontentloaded' }); return { url: page.url(), title: await page.title() }; },
@@ -39,6 +51,12 @@ const browser_navigate = {
   parameters: { type: 'object', properties: { url: { type: 'string' } }, required: ['url'] },
   async exec(args) {
     if (!safeHttp(args.url)) return { ok: false, error: 'browser_navigate: http(s) only' };
+    // Same DNS-resolving SSRF guard as web_fetch before driving Chromium at
+    // the URL — otherwise an agent could navigate to the dashboard, cloud
+    // metadata (169.254.169.254), or internal services and read them back
+    // via title / DOM / screenshot.
+    const safe = await isSafeUrl(args.url);
+    if (!safe.ok) return { ok: false, error: `browser_navigate: ${safe.error}` };
     try { const ctx = await ensureCtx(); return { ok: true, ...(await ctx.navigate(args.url)) }; }
     catch (e) { return { ok: false, error: `browser_navigate: ${e.message}` }; }
   },

package/mas/tools/learning.mjs

@@ -4,12 +4,12 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import * as skills from '../../skills.mjs';
 
 function resolveConfigDir(ctx) {
   return ctx?.configDir || process.env.LAZYCLAW_CONFIG_DIR || path.join(process.env.HOME || '.', '.lazyclaw');
 }
 
-function skillsDir(ctx) { return path.join(resolveConfigDir(ctx), 'skills'); }
 function memoryDir(ctx) { return path.join(resolveConfigDir(ctx), 'memory'); }
 function userMdPath(ctx) { return path.join(memoryDir(ctx), 'USER.md'); }
 
@@ -19,15 +19,26 @@ const skill_view = {
   parameters: { type: 'object', properties: { name: { type: 'string' } }, required: ['name'] },
   async exec(args, ctx) {
     if (!args?.name) return { ok: false, error: 'skill_view: name required' };
-    const file = path.join(skillsDir(ctx), args.name, 'SKILL.md');
-    if (!fs.existsSync(file)) return { ok: false, error: `skill_view: ${args.name} not installed` };
-    return { ok: true, name: args.name, content: fs.readFileSync(file, 'utf8') };
+    const configDir = resolveConfigDir(ctx);
+    if (!skills.skillExists(args.name, configDir)) return { ok: false, error: `skill_view: ${args.name} not installed` };
+    try {
+      const content = skills.loadSkill(args.name, configDir);
+      // Record the recall so the curator can age out never-used skills.
+      // Best-effort: a usage-write hiccup must never fail the tool call.
+      try {
+        const curator = await import('../../skills_curator.mjs');
+        curator.recordUsage(args.name, configDir, Date.now());
+      } catch { /* non-fatal */ }
+      return { ok: true, name: args.name, content };
+    } catch (err) {
+      return { ok: false, error: `skill_view: ${err?.message || err}` };
+    }
   },
 };
 
 const skill_create = {
   name: 'skill_create', category: 'learning', sensitive: true,
-  description: 'Create a new skill at <configDir>/skills/<name>/SKILL.md. Fails if already exists.',
+  description: 'Create a new skill at <configDir>/skills/<name>.md. Fails if already exists.',
   parameters: {
     type: 'object',
     properties: {
@@ -39,10 +50,8 @@ const skill_create = {
   async exec(args, ctx) {
     if (!args?.name || !args?.body) return { ok: false, error: 'skill_create: name + body required' };
     if (!/^[a-z0-9][a-z0-9-]*$/.test(args.name)) return { ok: false, error: 'skill_create: kebab-case name only' };
-    const dir = path.join(skillsDir(ctx), args.name);
-    const file = path.join(dir, 'SKILL.md');
-    if (fs.existsSync(file)) return { ok: false, error: `skill_create: ${args.name} already exists; use skill_edit` };
-    fs.mkdirSync(dir, { recursive: true });
+    const configDir = resolveConfigDir(ctx);
+    if (skills.skillExists(args.name, configDir)) return { ok: false, error: `skill_create: ${args.name} already exists; use skill_edit` };
     const fm = [
       '---',
       `name: ${args.name}`,
@@ -54,7 +63,7 @@ const skill_create = {
       '---',
       '',
     ].join('\n');
-    fs.writeFileSync(file, fm + args.body + (args.body.endsWith('\n') ? '' : '\n'));
+    const file = skills.installSkill(args.name, fm + args.body + (args.body.endsWith('\n') ? '' : '\n'), configDir);
     return { ok: true, name: args.name, file };
   },
 };
@@ -68,14 +77,15 @@ const skill_edit = {
     required: ['name', 'body'],
   },
   async exec(args, ctx) {
-    const file = path.join(skillsDir(ctx), args.name, 'SKILL.md');
-    if (!fs.existsSync(file)) return { ok: false, error: `skill_edit: ${args.name} not installed` };
-    const src = fs.readFileSync(file, 'utf8');
+    if (!args?.name || !args?.body) return { ok: false, error: 'skill_edit: name + body required' };
+    const configDir = resolveConfigDir(ctx);
+    if (!skills.skillExists(args.name, configDir)) return { ok: false, error: `skill_edit: ${args.name} not installed` };
+    const src = skills.loadSkill(args.name, configDir);
     const m = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/.exec(src);
     if (!m) return { ok: false, error: 'skill_edit: missing frontmatter' };
     let fm = m[1];
     fm = fm.replace(/version:\s*(\d+)/, (_, v) => `version: ${Number(v) + 1}`);
-    fs.writeFileSync(file, `---\n${fm}\n---\n${args.body}${args.body.endsWith('\n') ? '' : '\n'}`);
+    skills.installSkill(args.name, `---\n${fm}\n---\n${args.body}${args.body.endsWith('\n') ? '' : '\n'}`, configDir);
     return { ok: true, name: args.name };
   },
 };

package/mas/tools/recall.mjs

@@ -97,7 +97,11 @@ export async function exec(args, { configDir } = {}) {
     }
   } else {
     try {
-      openIndex(configDir);
+      // Skip the full-b-tree integrity_check on the read hot path. recall is
+      // the most frequent reader and every CLI subcommand / agent worker is a
+      // fresh process, so the check (which scales with index size) would be
+      // paid on essentially every recall. It belongs in `doctor`, not here.
+      openIndex(configDir, { runIntegrityCheck: false });
     } catch (err) {
       return { ok: false, error: `recall: openIndex failed — ${err?.message || err}` };
     }