lazyclaw 5.4.4 → 6.0.0

package/mas/tools/web.mjs

@@ -11,20 +11,40 @@ const PRIVATE_V4 = [
   /^127\./, /^169\.254\./, /^0\./, /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./,
 ];
 
-async function isSafeUrl(url) {
+// True for an address (or literal-IP host) that must never be reached from a
+// tool: RFC1918 / loopback / link-local v4, IPv6 loopback (::1), link-local
+// (fe80::/10), unique-local (fc00::/7), unspecified (::), and IPv4-mapped
+// private v6 (::ffff:a.b.c.d). Pure/synchronous — no DNS.
+export function isPrivateAddr(addr) {
+  const a = String(addr || '').toLowerCase().replace(/^\[|\]$/g, '');
+  if (PRIVATE_V4.some((re) => re.test(a))) return true;
+  if (a === '::1' || a === '::' || a === '0:0:0:0:0:0:0:1') return true;
+  if (/^fe[89ab][0-9a-f]:/.test(a)) return true;       // fe80::/10 link-local
+  if (/^f[cd][0-9a-f]{2}:/.test(a)) return true;        // fc00::/7 unique-local
+  const mapped = a.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (mapped && PRIVATE_V4.some((re) => re.test(mapped[1]))) return true;
+  return false;
+}
+
+export async function isSafeUrl(url) {
   let u;
   try { u = new URL(url); } catch { return { ok: false, error: 'bad URL' }; }
   if (u.protocol !== 'http:' && u.protocol !== 'https:') return { ok: false, error: `scheme ${u.protocol} blocked` };
   const host = u.hostname.replace(/^\[|\]$/g, '');
   if (host === 'localhost' || host === '0.0.0.0') return { ok: false, error: 'loopback blocked (SSRF)' };
-  if (PRIVATE_V4.some(re => re.test(host))) return { ok: false, error: 'private address blocked (SSRF)' };
-  if (host.includes(':')) return { ok: false, error: 'IPv6 disabled' };
+  // Literal IP host (v4 or v6): block private/loopback directly, no DNS.
+  if (host.includes(':')) {
+    if (isPrivateAddr(host)) return { ok: false, error: 'private address blocked (SSRF)' };
+    return { ok: true }; // public IPv6 literal
+  }
+  if (PRIVATE_V4.some((re) => re.test(host))) return { ok: false, error: 'private address blocked (SSRF)' };
   if (!/^[a-z0-9.-]+$/i.test(host)) return { ok: false, error: 'bad host' };
+  // Resolve and reject any A/AAAA that lands on a private/loopback address
+  // (anti-rebinding for the entry URL).
   try {
     const addrs = await dns.lookup(host, { all: true });
     for (const a of addrs) {
-      if (PRIVATE_V4.some(re => re.test(a.address))) return { ok: false, error: 'resolves to private address (SSRF)' };
-      if (a.address === '127.0.0.1' || a.address === '::1') return { ok: false, error: 'resolves to loopback (SSRF)' };
+      if (isPrivateAddr(a.address)) return { ok: false, error: 'resolves to private address (SSRF)' };
     }
   } catch (e) {
     return { ok: false, error: `dns: ${e.message}` };
@@ -51,12 +71,28 @@ const web_fetch = {
     if (!safe.ok) return { ok: false, error: `web_fetch: ${safe.error}` };
     const maxBytes = Math.min(args.maxBytes || 2_000_000, 5_000_000);
     try {
-      const res = await fetch(args.url, {
-        method: args.method || 'GET',
-        headers: args.headers || {},
-        body: args.body,
-        redirect: 'follow',
-      });
+      // Follow redirects manually, re-validating every hop. undici's
+      // redirect:'follow' would chase a 30x into a private IP (or a
+      // DNS-rebind) without re-checking — the classic SSRF-via-redirect.
+      let current = args.url;
+      let res;
+      for (let hop = 0; hop <= 5; hop++) {
+        res = await fetch(current, {
+          method: args.method || 'GET',
+          headers: args.headers || {},
+          body: args.body,
+          redirect: 'manual',
+        });
+        if (res.status >= 300 && res.status < 400 && res.headers.get('location')) {
+          if (hop === 5) return { ok: false, error: 'web_fetch: too many redirects' };
+          const next = new URL(res.headers.get('location'), current).toString();
+          const ns = await isSafeUrl(next);
+          if (!ns.ok) return { ok: false, error: `web_fetch: redirect ${ns.error}` };
+          current = next;
+          continue;
+        }
+        break;
+      }
       const buf = Buffer.from(await res.arrayBuffer());
       const truncated = buf.length > maxBytes;
       return {

package/mas/trajectory_store.mjs

@@ -147,10 +147,13 @@ export async function get(id, opts = {}) {
   for (const bucket of fs.readdirSync(root)) {
     const file = recordPath(configDir, bucket, id);
     if (fs.existsSync(file)) {
-      const raw = fs.readFileSync(file, 'utf8').trim();
-      const rec = JSON.parse(raw);
-      cachePush(id, rec);
-      return rec;
+      // Guard the parse like the sibling listByTaskId does — a truncated record
+      // (crash during _trajPut) must return null, not throw an uncaught error.
+      try {
+        const rec = JSON.parse(fs.readFileSync(file, 'utf8').trim());
+        cachePush(id, rec);
+        return rec;
+      } catch { return null; }
     }
   }
   return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lazyclaw",
-  "version": "5.4.4",
+  "version": "6.0.0",
   "description": "Lazy, elegant terminal CLI for chatting with Claude / OpenAI / Gemini / Ollama, orchestrating multi-step LLM workflows, and running multi-agent Slack teams with cross-task memory. Banner-on-launch, slash-command ghost autocomplete, persistent sessions, local HTTP gateway.",
   "keywords": [
     "claude",
@@ -31,7 +31,8 @@
     "lazyclaw": "cli.mjs"
   },
   "scripts": {
-    "test": "node --test tests/phaseC-*.test.mjs && playwright test",
+    "test": "node --test tests/*.test.mjs && playwright test",
+    "lint:size": "node scripts/lint-file-size.mjs",
     "test:bench": "node scripts/bench-providers.mjs",
     "test:bench:index": "node --test tests/index_store.bench.mjs",
     "test:perf": "node --test tests/phaseH-perf.test.mjs tests/index_store.bench.mjs",

package/providers/auth_store.mjs

@@ -0,0 +1,22 @@
+// providers/auth_store.mjs — persist an api key for a provider into the
+// authProfiles config shape that _resolveAuthKey reads (cfg.authProfiles
+// [provider] = [{ label, key }], cfg.authActiveProfile[provider] = label).
+//
+// Extracted as a tiny DI'd helper so the Ink /provider key-entry flow can
+// store a key without re-implementing the config shape. No disk — readConfig/
+// writeConfig are injected.
+
+export function setAuthKey({ readConfig, writeConfig, provider, key, label = 'default' }) {
+  const cfg = readConfig();
+  cfg.authProfiles = cfg.authProfiles && typeof cfg.authProfiles === 'object' ? cfg.authProfiles : {};
+  cfg.authActiveProfile = cfg.authActiveProfile && typeof cfg.authActiveProfile === 'object' ? cfg.authActiveProfile : {};
+  const arr = Array.isArray(cfg.authProfiles[provider]) ? cfg.authProfiles[provider].slice() : [];
+  const idx = arr.findIndex((p) => p && p.label === label);
+  const entry = { label, key: String(key) };
+  if (idx >= 0) arr[idx] = { ...arr[idx], ...entry };
+  else arr.push(entry);
+  cfg.authProfiles[provider] = arr;
+  cfg.authActiveProfile[provider] = label;
+  writeConfig(cfg);
+  return cfg;
+}

package/providers/claude_cli.mjs

@@ -65,7 +65,14 @@ const _CLI_MODEL_ALIASES = {
 function resolveModelAlias(model) {
   if (!model) return '';
   const lower = String(model).toLowerCase();
-  return _CLI_MODEL_ALIASES[lower] ?? '';
+  if (_CLI_MODEL_ALIASES[lower]) return _CLI_MODEL_ALIASES[lower];
+  // Unknown but already a bare short alias (e.g. a new tier the table doesn't
+  // enumerate yet, like a future "opusplus") → pass it through rather than
+  // dropping to '' (which makes the CLI silently ignore the user's model
+  // choice). Full canonical ids (with digits/dashes) stay mapped-or-dropped,
+  // because passing a full id to `claude --model` hangs the CLI (FF1).
+  if (/^[a-z]+$/.test(lower)) return lower;
+  return '';
 }
 
 // Flatten the chat-style messages array into a single -p prompt the
@@ -152,6 +159,19 @@ export const claudeCliProvider = {
     };
     if (opts.signal) opts.signal.addEventListener('abort', onAbort);
 
+    // child_process reports spawn failures (ENOENT when `claude` isn't on
+    // PATH, EACCES, ...) ASYNCHRONOUSLY via an 'error' event — the
+    // synchronous try/catch around spawn above never sees them. Without a
+    // listener Node escalates the unhandled 'error' event to an
+    // uncaughtException and crashes the whole process; on a box with no
+    // claude binary (e.g. CI) this took down `providers test` for the CLI
+    // and the daemon entirely. Capture it and surface it through the stream
+    // as a normal, catchable error so callers report it per-provider.
+    let spawnError = null;
+    const spawnErrorPromise = new Promise((resolve) => {
+      proc.once('error', (err) => { spawnError = err; resolve(); });
+    });
+
     let stderr = '';
     proc.stderr.setEncoding('utf8');
     proc.stderr.on('data', (chunk) => { stderr += chunk; });
@@ -203,7 +223,13 @@ export const claudeCliProvider = {
           if (text) yield text;
         } catch (_) { /* incomplete tail — drop */ }
       }
-      await exitPromise;
+      // Wait for either a clean exit or an async spawn error. On ENOENT
+      // the process never starts, so 'close' never fires — racing against
+      // spawnErrorPromise keeps this from hanging forever.
+      await Promise.race([exitPromise, spawnErrorPromise]);
+      if (spawnError) {
+        throw spawnError.code === 'ENOENT' ? new CliMissingError() : spawnError;
+      }
       if (exitInfo && exitInfo.code !== 0 && !opts.signal?.aborted) {
         throw new CliExitError(exitInfo.code, exitInfo.signal, stderr);
       }

package/providers/claude_cli_detect.mjs

@@ -0,0 +1,46 @@
+// claude_cli_detect.mjs — detect a usable claude-cli subscription session.
+//
+// resolveTrainer's `auto` branch routes the $0 learning loop to claude-cli
+// only when a Pro/Max session is detected. The original detector keyed solely
+// on an exported CLAUDE_CODE_OAUTH_TOKEN env var — which a normal `claude
+// login` never sets (it writes the OS keychain / ~/.claude) — so `auto`
+// silently fell back to the paid chat provider for real subscribers. This
+// detector also accepts the credential store and the `claude` binary on PATH.
+// Pure + offline (no network); the binary probe is the only subprocess and is
+// bounded by a short timeout.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { execFileSync } from 'node:child_process';
+
+export function detectClaudeCliSession({ env = process.env, home = os.homedir() } = {}) {
+  // 1. Explicit token (CI / headless) — definitive.
+  if (env.CLAUDE_CODE_OAUTH_TOKEN) {
+    return { available: true, source: 'env', reason: 'CLAUDE_CODE_OAUTH_TOKEN set' };
+  }
+  // 2. Credential store written by `claude login` (Linux / non-keychain).
+  for (const rel of ['.claude/.credentials.json', '.claude.json', '.config/claude/.credentials.json']) {
+    try { if (fs.existsSync(path.join(home, rel))) return { available: true, source: 'credentials', reason: rel }; }
+    catch { /* ignore unreadable */ }
+  }
+  // 3. `claude` on PATH. On macOS the login lives in the Keychain with no
+  //    credential file, so binary presence is the best offline signal we have.
+  //    If it turns out not to be logged in, the trainer call fails (best-effort,
+  //    swallowed) — no billing — rather than silently charging the paid path.
+  try {
+    execFileSync('claude', ['--version'], { stdio: 'ignore', timeout: 4000 });
+    return { available: true, source: 'binary', reason: 'claude on PATH' };
+  } catch { /* ENOENT / nonzero / timeout */ }
+  return { available: false, source: 'none', reason: 'no env token, credential store, or claude binary' };
+}
+
+let _cache = null; // memoize per-process — detection does not change mid-run
+
+// Boolean for the hot resolveTrainer path. Explicit opts bypass the cache
+// (tests inject env/home); the no-arg call memoizes.
+export function hasClaudeCliSession(opts) {
+  if (opts) return detectClaudeCliSession(opts).available;
+  if (_cache === null) _cache = detectClaudeCliSession().available;
+  return _cache;
+}

package/providers/custom_provider.mjs

@@ -0,0 +1,70 @@
+// providers/custom_provider.mjs — register a custom OpenAI-compatible
+// endpoint (NIM / OpenRouter / Together / Groq / vLLM / LM Studio / …).
+//
+// Extracted from cli.mjs `_addCustomProviderInteractive` so the persistence +
+// live-probe logic is shared between the legacy readline wizard and the Ink
+// provider picker (which lost this affordance in v5.4). The original mixed
+// raw-ANSI prompts with the persistence; this is the IO-free core, dependency-
+// injected on registry + config readers/writers so it unit-tests with no disk
+// or network. The caller owns collecting name/baseUrl/apiKey and rendering.
+
+export function validateCustomBaseUrl(raw) {
+  const s = String(raw || '').trim();
+  if (!s) throw new Error('baseUrl is required');
+  if (!/^https?:\/\//i.test(s)) throw new Error('baseUrl must start with http:// or https://');
+  return s.replace(/\/+$/, '');
+}
+
+/**
+ * Validate, persist, hot-register, and best-effort probe a custom provider.
+ *
+ * @param {object} deps
+ * @param {object} deps.registry      registry module — needs validateCustomProviderName,
+ *                                     registerCustomProviders, fetchOpenAICompatModels,
+ *                                     and (optional) isBuiltinOpenAICompatName
+ * @param {()=>object} deps.readConfig
+ * @param {(cfg:object)=>void} deps.writeConfig
+ * @param {string} deps.name
+ * @param {string} deps.baseUrl
+ * @param {string} [deps.apiKey]
+ * @returns {Promise<{name:string, baseUrl:string, builtinOverride:boolean, probe:{ok:boolean,count:number,error:?string,models:string[]}}>}
+ */
+export async function addCustomProvider({ registry, readConfig, writeConfig, name, baseUrl, apiKey }) {
+  const vName = registry.validateCustomProviderName(name); // throws on bad name
+  const vUrl = validateCustomBaseUrl(baseUrl);
+  const builtinOverride = typeof registry.isBuiltinOpenAICompatName === 'function'
+    && !!registry.isBuiltinOpenAICompatName(vName);
+
+  // Persist to cfg.customProviders[], overwriting an existing same-name entry.
+  const cfg = readConfig();
+  cfg.customProviders = Array.isArray(cfg.customProviders) ? cfg.customProviders : [];
+  const idx = cfg.customProviders.findIndex((p) => p && p.name === vName);
+  const entry = { name: vName, baseUrl: vUrl, apiKey: apiKey ? String(apiKey) : undefined };
+  if (idx >= 0) cfg.customProviders[idx] = { ...cfg.customProviders[idx], ...entry };
+  else cfg.customProviders.push(entry);
+  writeConfig(cfg);
+  registry.registerCustomProviders(cfg);
+
+  // Best-effort live model probe. Registration still succeeds on failure —
+  // the model picker's free-text/refetch row covers it.
+  const probe = { ok: false, count: 0, error: null, models: [] };
+  try {
+    const list = await registry.fetchOpenAICompatModels({ baseUrl: vUrl, apiKey: entry.apiKey || '' });
+    probe.ok = true;
+    probe.models = Array.isArray(list) ? list.slice(0, 50) : [];
+    probe.count = probe.models.length;
+    if (probe.models.length) {
+      const updated = readConfig();
+      const i = (updated.customProviders || []).findIndex((p) => p && p.name === vName);
+      if (i >= 0) {
+        updated.customProviders[i].suggestedModels = probe.models;
+        if (!updated.customProviders[i].defaultModel) updated.customProviders[i].defaultModel = probe.models[0];
+        writeConfig(updated);
+        registry.registerCustomProviders(updated);
+      }
+    }
+  } catch (e) {
+    probe.error = e && e.message ? e.message : String(e);
+  }
+  return { name: vName, baseUrl: vUrl, builtinOverride, probe };
+}

package/providers/model_catalogue.mjs

@@ -0,0 +1,86 @@
+// providers/model_catalogue.mjs — shared OpenAI-compatible model-catalogue
+// resolution.
+//
+// Extracted from cli.mjs (`_modelCatalogueFor` / `_fetchModelsForProvider`)
+// so BOTH the legacy readline picker (cli.mjs) and the Ink slash dispatcher
+// (tui/slash_dispatcher.mjs) can offer the same live `/v1/models` fetch
+// without duplicating the provider -> endpoint resolution. v5.4's Ink port
+// dropped this affordance from `/model`; this module restores it for both
+// paths from one place.
+//
+// Dependency-injected (no cli.mjs internals) so it stays import-light and
+// unit-testable with no network.
+
+/**
+ * Whether a provider exposes an OpenAI-compatible `/v1/models` catalogue we
+ * can live-fetch. True for openai, ollama, any builtin OpenAI-compat vendor
+ * (nim / openrouter / groq / together / xai / deepseek / mistral /
+ * fireworks), and any provider carrying an explicit `baseUrl` (custom
+ * endpoints). False for anthropic / gemini / claude-cli / mock /
+ * orchestrator.
+ *
+ * @param {object} meta       PROVIDER_INFO[providerId]
+ * @param {string} providerId
+ * @returns {boolean}
+ */
+export function supportsLiveFetch(meta, providerId) {
+  const m = meta || {};
+  return !!m.baseUrl
+    || providerId === 'openai'
+    || providerId === 'ollama'
+    || !!m.builtinOpenAICompat;
+}
+
+/**
+ * Resolve `{ baseUrl, apiKey }` for a provider's OpenAI-compatible
+ * `/v1/models` endpoint. Returns `null` when the provider has no such
+ * catalogue (anthropic / gemini / claude-cli / mock / orchestrator).
+ *
+ * @param {object} deps
+ * @param {object} deps.cfg            on-disk config (for cfg.customProviders / cfg['api-key'])
+ * @param {object} deps.registryMod    provides PROVIDER_INFO
+ * @param {(providerId:string)=>string} deps.resolveAuthKey  env/profile key resolver
+ * @param {string} deps.providerId
+ * @returns {{baseUrl:string, apiKey:string}|null}
+ */
+export function modelCatalogueFor({ cfg, registryMod, resolveAuthKey, providerId } = {}) {
+  const info = (registryMod && registryMod.PROVIDER_INFO) || {};
+  const meta = info[providerId] || {};
+  const key = (id) => (typeof resolveAuthKey === 'function' ? resolveAuthKey(id) : '') || '';
+
+  if (meta.custom && meta.baseUrl) {
+    const list = (cfg && cfg.customProviders) || [];
+    const entry = list.find((p) => p && p.name === providerId) || {};
+    return { baseUrl: meta.baseUrl, apiKey: entry.apiKey || (cfg && cfg['api-key']) || '' };
+  }
+  // Built-in OpenAI-compatible vendors expose a baseUrl; the auth-key
+  // resolver already knows the env-var fallback chain.
+  if (meta.builtinOpenAICompat && meta.baseUrl) {
+    return { baseUrl: meta.baseUrl, apiKey: key(providerId) };
+  }
+  if (providerId === 'openai') {
+    return { baseUrl: 'https://api.openai.com/v1', apiKey: key('openai') };
+  }
+  if (providerId === 'ollama') {
+    const host = process.env.OLLAMA_HOST || 'http://127.0.0.1:11434';
+    return { baseUrl: `${host.replace(/\/$/, '')}/v1`, apiKey: '' };
+  }
+  return null;
+}
+
+/**
+ * Live-fetch the provider's `/v1/models` list. Throws when the provider has
+ * no OpenAI-compatible catalogue. Returns a string[] of model ids.
+ *
+ * @param {object} deps  same shape as {@link modelCatalogueFor}
+ * @returns {Promise<string[]>}
+ */
+export async function fetchModelsForProvider(deps) {
+  const c = modelCatalogueFor(deps);
+  const providerId = deps && deps.providerId;
+  if (!c) {
+    throw new Error(`provider "${providerId}" does not expose an OpenAI-compatible /v1/models endpoint`);
+  }
+  const { fetchOpenAICompatModels } = await import('./openai_compat.mjs');
+  return fetchOpenAICompatModels({ baseUrl: c.baseUrl, apiKey: c.apiKey });
+}

package/providers/orchestrator.mjs

@@ -36,7 +36,10 @@
 // step), workers = [planner] (degenerates to a single-agent chain that
 // still benefits from plan + synthesis structure).
 
-import { PROVIDERS, PROVIDER_INFO } from './registry.mjs';
+// This module must NOT statically import ./registry.mjs — that formed a static
+// import cycle (registry → orchestrator → registry). Provider lookup is now
+// injected via makeOrchestratorProvider({ lookup }), so the dependency is
+// one-directional (registry → orchestrator only).
 
 function _parseSpec(spec) {
   if (!spec || typeof spec !== 'string') return { provider: '', model: '' };
@@ -45,11 +48,12 @@ function _parseSpec(spec) {
   return { provider: spec.slice(0, colon).trim(), model: spec.slice(colon + 1).trim() };
 }
 
-function _lookupProvider(spec) {
+function _lookupProvider(spec, lookup) {
   const { provider, model } = _parseSpec(spec);
-  const prov = PROVIDERS[provider];
+  const found = (typeof lookup === 'function' ? lookup(provider) : null) || {};
+  const prov = found.prov;
   if (!prov) return null;
-  const info = PROVIDER_INFO[provider] || {};
+  const info = found.info || {};
   return {
     name: provider,
     model: model || info.defaultModel || '',
@@ -115,6 +119,9 @@ Rules:
 export function makeOrchestratorProvider(opts = {}) {
   const cfgGetter = typeof opts.cfgGetter === 'function' ? opts.cfgGetter : () => ({});
   const keyResolver = typeof opts.keyResolver === 'function' ? opts.keyResolver : () => '';
+  // Injected provider lookup: (provider) => { prov, info }. Supplied by the
+  // registry so orchestrator never imports registry (breaks the static cycle).
+  const lookup = typeof opts.lookup === 'function' ? opts.lookup : () => ({});
 
   return {
     name: 'orchestrator',
@@ -134,7 +141,7 @@ export function makeOrchestratorProvider(opts = {}) {
       // the user's stated intent. Do a real passthrough instead.
       const hasWorkers = Array.isArray(o.workers) && o.workers.length > 0;
       if (!cfg.orchestrator || !hasWorkers) {
-        const direct = _lookupProvider(fallbackSpec);
+        const direct = _lookupProvider(fallbackSpec, lookup);
         if (!direct || direct.name === 'orchestrator') {
           yield `⚠ orchestrator: not configured and fallback provider \`${fallbackSpec}\` is not registered. ` +
             `Set \`cfg.orchestrator.planner\` + \`cfg.orchestrator.workers\`, or set \`cfg.provider\` to a real backend.\n`;
@@ -153,7 +160,7 @@ export function makeOrchestratorProvider(opts = {}) {
       const workerSpecs = o.workers.map(String);
       const maxSubtasks = Number.isFinite(o.maxSubtasks) && o.maxSubtasks > 0 ? Math.min(10, o.maxSubtasks) : 5;
 
-      const planner = _lookupProvider(plannerSpec);
+      const planner = _lookupProvider(plannerSpec, lookup);
       if (!planner) {
         yield `⚠ orchestrator: planner provider "${plannerSpec}" is not registered. ` +
           `Set cfg.orchestrator.planner to a valid "provider:model" (e.g. "claude-cli:claude-opus-4-7").\n`;
@@ -166,7 +173,7 @@ export function makeOrchestratorProvider(opts = {}) {
         yield `⚠ orchestrator: planner cannot be "orchestrator" — set cfg.orchestrator.planner to a real provider (e.g. "claude-cli:claude-opus-4-7").\n`;
         return;
       }
-      const workers = workerSpecs.map(_lookupProvider).filter(Boolean).filter(w => w.name !== 'orchestrator');
+      const workers = workerSpecs.map((s) => _lookupProvider(s, lookup)).filter(Boolean).filter(w => w.name !== 'orchestrator');
       if (workers.length === 0) {
         yield `⚠ orchestrator: no usable workers (cfg.orchestrator.workers is empty, all unknown, or only references "orchestrator" itself).\n`;
         return;
@@ -306,8 +313,22 @@ export function makeOrchestratorProvider(opts = {}) {
           }
           return { sub, worker, chunks, error };
         }
-        const settled = await Promise.all(
-          trimmed.map((sub, i) => _runSubtask(sub, workers[i % workers.length])),
+        // Bounded worker pool (E1): run at most `concurrency` subtasks at
+        // once instead of firing all of them via one Promise.all. A large
+        // plan would otherwise open N simultaneous provider streams —
+        // over-subscribing rate limits and buffering every worker's chunks
+        // at the same time. Results are stored by index so the plan-order
+        // flush below is unchanged; for plans with <= concurrency subtasks
+        // every subtask still starts immediately (identical to before).
+        const settled = new Array(trimmed.length);
+        let nextIdx = 0;
+        async function _poolWorker() {
+          for (let i = nextIdx++; i < trimmed.length; i = nextIdx++) {
+            settled[i] = await _runSubtask(trimmed[i], workers[i % workers.length]);
+          }
+        }
+        await Promise.all(
+          Array.from({ length: Math.min(concurrency, trimmed.length) }, () => _poolWorker()),
         );
         // Flush in plan order so the synthesis prompt + user view see
         // subtask 1, then 2, etc.

package/providers/rates.mjs

@@ -35,11 +35,21 @@
  * @returns {{ cost: number, currency: string, breakdown: object } | null}
  */
 export function costFromUsage(call, rates) {
-  if (!call || !rates) return null;
+  if (!call) return null;
+  const u = call.usage || {};
+  // Prefer a provider-reported dollar cost when present. claude-cli / codex-cli
+  // / gemini-cli emit total_cost_usd from the CLI's own `result` event, so this
+  // makes spend observable — and the daemon cost cap enforceable — for the
+  // subscription path even when the user has authored no rate card (the card
+  // ships zero-filled). Rate-card arithmetic is the fallback for API providers.
+  const reported = Number(u.totalCostUsd);
+  if (Number.isFinite(reported) && reported > 0) {
+    return { cost: round6(reported), currency: 'USD', breakdown: { reported: round6(reported) } };
+  }
+  if (!rates) return null;
   const key = `${call.provider}/${call.model}`;
   const r = rates[key];
   if (!r) return null;
-  const u = call.usage || {};
   const million = 1_000_000;
   const inputCost = ((Number(u.inputTokens) || 0) / million) * (Number(r.inputPer1M) || 0);
   const outputCost = ((Number(u.outputTokens) || 0) / million) * (Number(r.outputPer1M) || 0);

package/providers/registry.mjs

@@ -12,6 +12,7 @@ import { openaiProvider } from './openai.mjs';
 import { ollamaProvider } from './ollama.mjs';
 import { geminiProvider } from './gemini.mjs';
 import { claudeCliProvider } from './claude_cli.mjs';
+import { hasClaudeCliSession } from './claude_cli_detect.mjs';
 import { makeOpenAICompatProvider, fetchOpenAICompatModels } from './openai_compat.mjs';
 import { makeOrchestratorProvider } from './orchestrator.mjs';
 
@@ -83,11 +84,10 @@ export function parseProviderModel(spec) {
 }
 
 function _defaultDetectClaudeCli() {
-  // Phase A stub: real Pro/Max session detection arrives in Phase B
-  // (it requires reading the claude-cli OAuth token cache). Until
-  // then, treat presence of CLAUDE_CODE_OAUTH_TOKEN as a positive
-  // signal so users can opt-in explicitly.
-  return Boolean(process.env.CLAUDE_CODE_OAUTH_TOKEN);
+  // Real Pro/Max session detection: env token, credential store, or the
+  // `claude` binary on PATH (a normal `claude login` does NOT export
+  // CLAUDE_CODE_OAUTH_TOKEN). See providers/claude_cli_detect.mjs.
+  return hasClaudeCliSession();
 }
 
 export function resolveTrainer(cfg, opts = {}) {
@@ -298,7 +298,10 @@ export const PROVIDERS = {
 // it via `lazyclaw providers list`; `registerOrchestrator(...)` from
 // cli.mjs::ensureRegistry wires in the live cfg + auth-key resolver so
 // sendMessage can reach env vars / authProfiles / customProviders.
-PROVIDERS.orchestrator = makeOrchestratorProvider();
+// Inject the provider lookup so orchestrator never imports this module back
+// (one-directional dep). The closure reads PROVIDERS/PROVIDER_INFO lazily.
+const _orchestratorLookup = (p) => ({ prov: PROVIDERS[p], info: PROVIDER_INFO[p] });
+PROVIDERS.orchestrator = makeOrchestratorProvider({ lookup: _orchestratorLookup });
 
 // Wire each OpenAI-compat builtin into PROVIDERS as a callable provider.
 // Insertion is between Tier 2 (anthropic) and Tier 4 (ollama) by reordering
@@ -463,7 +466,7 @@ for (const [name, def] of Object.entries(OPENAI_COMPAT_BUILTINS)) {
  * — idempotent (overwrites the previous registration in place).
  */
 export function registerOrchestrator({ cfgGetter, keyResolver } = {}) {
-  PROVIDERS.orchestrator = makeOrchestratorProvider({ cfgGetter, keyResolver });
+  PROVIDERS.orchestrator = makeOrchestratorProvider({ cfgGetter, keyResolver, lookup: _orchestratorLookup });
 }
 
 /**

package/sandbox/confiners/landlock.mjs

@@ -1,14 +1,20 @@
 // sandbox/confiners/landlock.mjs — Linux Landlock helper.
 //
 // Landlock is enforced from *inside* the process via the
-// landlock_create_ruleset() syscall. With no native bindings available
-// in plain Node, we currently emit the argv unchanged and let
-// downstream tooling (e.g. a future `lazyclaw-landlock-shim` binary)
-// install the ruleset. Returns argv unchanged on non-Linux.
+// landlock_create_ruleset() syscall, which needs a native binding / preloader
+// shim that lazyclaw does not ship yet. The previous implementation returned
+// the argv UNCHANGED, so selecting `confiner: landlock` ran the command with
+// ZERO confinement while reporting itself available — a false security
+// guarantee that is worse than `none`. Until a real enforcer ships we report
+// unavailable and refuse to build an argv, so the request fails closed instead
+// of silently running unconfined.
 
-export function available() { return process.platform === 'linux'; }
+export function available() { return false; }
 
-export function buildArgv(argv, _opts = {}) {
-  // Pass-through. Spec §0.1 C8 leaves room for a preloader binary.
-  return [...argv];
+export function buildArgv() {
+  throw new Error(
+    'landlock confiner is not implemented (no enforcement shim is shipped) — ' +
+    'it would run the command unconfined. Use confiner bubblewrap or firejail ' +
+    'on Linux, or set confiner:none deliberately.',
+  );
 }

package/sandbox/confiners/seatbelt.mjs

@@ -9,6 +9,22 @@ export function available() {
   catch { return false; }
 }
 
+// Escape a path for an SBPL double-quoted string literal. Without this a path
+// containing `"` (or a backslash) could close the string and inject arbitrary
+// SBPL directives — e.g. re-enabling `(allow network*)` or widening file
+// access — neutering the sandbox. Reject control characters outright; escape
+// backslash and double-quote.
+function sbplPath(p) {
+  const s = String(p);
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 0x20 || c === 0x7f) {
+      throw new Error('seatbelt: path contains control characters; refusing to build profile');
+    }
+  }
+  return s.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
 export function buildArgv(argv, opts = {}) {
   const readOnly = opts.readOnly || [];
   const readWrite = opts.readWrite || [process.cwd()];
@@ -21,8 +37,8 @@ export function buildArgv(argv, opts = {}) {
     '(allow signal)',
     '(allow sysctl-read)',
     allowNet ? '(allow network*)' : '(deny network*)',
-    ...readOnly.map(p => `(allow file-read* (subpath "${p}"))`),
-    ...readWrite.map(p => `(allow file-read* file-write* (subpath "${p}"))`),
+    ...readOnly.map(p => `(allow file-read* (subpath "${sbplPath(p)}"))`),
+    ...readWrite.map(p => `(allow file-read* file-write* (subpath "${sbplPath(p)}"))`),
   ].join('\n');
   return ['sandbox-exec', '-p', profile, ...argv];
 }