lazyclaw 5.4.4 → 6.0.1

package/mas/mention_router.mjs

@@ -280,11 +280,11 @@ async function postTypingPlaceholder({ task, agentRecord, logger = () => {}, sen
   if (agentRecord?.iconEmoji)   sendOpts.icon_emoji = agentRecord.iconEmoji;
   try {
     const res = await slack.send(threadId, `_:hourglass_flowing_sand: thinking…_`, sendOpts);
-    return { ts: res?.ts || null, sender: owned ? slack : null, channel: task.slackChannel };
+    return { ts: res?.ts || null, sender: slack, owned, channel: task.slackChannel };
   } catch (err) {
     logger(`[router] slack typing post failed: ${err?.message || err}\n`);
     if (owned) await slack.stop().catch(() => {});
-    return { ts: null, sender: null };
+    return { ts: null, sender: null, owned: false };
   }
 }
 
@@ -360,12 +360,12 @@ async function autoSynthSkills({ task, agentsById, apiKey, baseUrl, fetchImpl, c
 }
 
 async function clearTypingPlaceholder(placeholder, logger) {
-  if (!placeholder?.ts || !placeholder?.channel) return;
+  if (!placeholder?.ts || !placeholder?.channel || !placeholder?.sender) return;
   const slack = placeholder.sender;
-  if (!slack) return;  // sender wasn't owned by us; skip
   try { await slack.deleteMessage(placeholder.channel, placeholder.ts); }
   catch (err) { logger(`[router] slack typing delete failed: ${err?.message || err}\n`); }
-  finally { await slack.stop().catch(() => {}); }
+  // Only stop a client we created here; a shared sender is closed once by run().
+  finally { if (placeholder.owned) await slack.stop().catch(() => {}); }
 }
 
 // Run agents in this team until the queue empties or budget runs out.
@@ -388,6 +388,11 @@ export async function runTaskTurn({
   maxAgentTurns = DEFAULT_MAX_AGENT_TURNS,
   signal,
   approve,
+  security,
+  // E3 — a long-lived caller (e.g. the daemon) can pass a pre-started
+  // SlackChannel to reuse across many task turns; run() then neither
+  // creates nor stops it. When omitted, run() opens + closes its own.
+  slackSender: providedSender,
 } = {}) {
   if (!task || !team || !agentsById) {
     throw new MentionRouterError('task, team, agentsById are required', 'ROUTER_BAD_INPUT');
@@ -410,11 +415,30 @@ export async function runTaskTurn({
     current = tasksMod.patchTask(current.id, { status: 'running' }, configDir);
   }
 
+  // E3 — open ONE Slack client for the whole run and reuse it for every
+  // thread post + typing placeholder, instead of constructing + starting +
+  // stopping a fresh SlackChannel (a network auth handshake) on each of the
+  // ~3-4 posts per agent turn. Posts fall back to a per-call owned client
+  // when no shared sender is available (no thread, or start failure).
+  let slackSender = providedSender || null;
+  let ownSlackSender = false;
+  if (!slackSender && current.slackChannel && current.slackThreadTs) {
+    try {
+      const { SlackChannel } = await import('../channels/slack.mjs');
+      slackSender = new SlackChannel({ requireInbound: false });
+      await slackSender.start(async () => '', {});
+      ownSlackSender = true;
+    } catch (err) {
+      logger(`[router] slack start failed, falling back to per-post clients: ${err?.message || err}\n`);
+      slackSender = null;
+    }
+  }
+
   // Seed: append the user message if provided, and (also) push it to
   // Slack so anyone reading the thread sees the prompt.
   if (userMessage && String(userMessage).trim()) {
     current = tasksMod.appendTurn(current.id, { agent: 'user', text: String(userMessage), ts: new Date().toISOString() }, configDir);
-    await postToThread({ task: current, agentRecord: null, text: `*User*: ${userMessage}`, logger });
+    await postToThread({ task: current, agentRecord: null, text: `*User*: ${userMessage}`, logger, sender: slackSender });
   }
 
   const queue = [team.lead];
@@ -437,7 +461,7 @@ export async function runTaskTurn({
     // up the turn before the LLM finishes. Cleared right after the
     // real reply lands so we never leave a stale placeholder in the
     // thread.
-    const typing = await postTypingPlaceholder({ task: current, agentRecord, logger });
+    const typing = await postTypingPlaceholder({ task: current, agentRecord, logger, sender: slackSender });
 
     let result;
     try {
@@ -450,7 +474,7 @@ export async function runTaskTurn({
         userMessage: '',
         history: ctx.history,
         taskId: current.id,
-        configDir, cwd, apiKey, fetchImpl, baseUrl, signal, approve,
+        configDir, cwd, apiKey, fetchImpl, baseUrl, signal, approve, security,
         // C9 — enable Anthropic prompt caching for the static system
         // prefix + tool definitions. Non-anthropic adapters ignore
         // the flag (it's a no-op for OpenAI/Gemini/claude-cli).
@@ -470,11 +494,11 @@ export async function runTaskTurn({
 
     // Slack mirror — only the user-visible text, with the agent name
     // prefixed so a human reader can follow who said what.
-    if (replyText) await postToThread({ task: current, agentRecord, text: replyText, logger });
+    if (replyText) await postToThread({ task: current, agentRecord, text: replyText, logger, sender: slackSender });
 
     if (replyText.includes(DONE_MARKER)) {
       current = tasksMod.patchTask(current.id, { status: 'done' }, configDir);
-      await postToThread({ task: current, agentRecord: null, text: `:white_check_mark: ${DONE_MARKER} — task closed by *${agentRecord.displayName || speaker}*.`, logger });
+      await postToThread({ task: current, agentRecord: null, text: `:white_check_mark: ${DONE_MARKER} — task closed by *${agentRecord.displayName || speaker}*.`, logger, sender: slackSender });
       stoppedBy = 'done';
       // Phase 18: fire one reflection LLM call per participating agent
       // whose memoryWrite is 'auto'. We pick "participating" off the
@@ -508,5 +532,9 @@ export async function runTaskTurn({
   }
 
   if (iterations >= maxAgentTurns) stoppedBy = 'budget';
+  // Close the Slack client once for the whole run — but only if WE opened
+  // it. A caller-provided sender is left running for the caller to reuse.
+  // All exit paths (done/budget/abort/idle) fall through to this return.
+  if (ownSlackSender && slackSender) await slackSender.stop().catch(() => {});
   return { task: current, iterations, stoppedBy };
 }

package/mas/provider_adapters.mjs

@@ -35,13 +35,37 @@ export async function resolveToolUseAdapter(provider) {
     case 'gemini':     return await import('../providers/tool_use/gemini.mjs');
     case 'claude-cli': return await import('../providers/tool_use/claude_cli.mjs');
     default:
-      throw new ProviderAdapterError(
-        `provider "${provider}" does not support text completion`,
-        'PROVIDER_ADAPTER_UNKNOWN',
-      );
+      return await _openAICompatAdapter(provider);
   }
 }
 
+// Any OpenAI-wire-compatible provider — the built-in compat vendors
+// (nim/openrouter/groq/together/xai/deepseek/mistral/fireworks) and custom
+// providers — can drive tool-use through the OpenAI adapter, just at a
+// different base URL. They advertise as first-class providers, so agents,
+// teams, and the trainer must work for them too (previously they threw
+// "does not support text completion"). We bind the provider's baseUrl so the
+// caller doesn't have to know it; an explicit baseUrl in the call still wins.
+async function _openAICompatAdapter(provider) {
+  let info;
+  try {
+    const reg = await import('../providers/registry.mjs');
+    info = reg.PROVIDER_INFO && reg.PROVIDER_INFO[provider];
+  } catch { info = null; }
+  if (!info || !(info.builtinOpenAICompat || info.custom || info.baseUrl)) {
+    throw new ProviderAdapterError(
+      `provider "${provider}" does not support text completion`,
+      'PROVIDER_ADAPTER_UNKNOWN',
+    );
+  }
+  const base = await import('../providers/tool_use/openai.mjs');
+  if (!info.baseUrl) return base; // custom without a stored baseUrl — caller supplies it
+  return {
+    ...base,
+    callOnce: (opts = {}) => base.callOnce({ baseUrl: info.baseUrl, ...opts }),
+  };
+}
+
 // Run one no-tools text completion through the provider's tool-use
 // adapter and return the model's text (or '' when it produced none).
 //

package/mas/scrub_env.mjs

@@ -0,0 +1,34 @@
+// scrub_env.mjs — strip secret-bearing variables from an environment copy.
+//
+// The bash tool inherits the parent process environment so commands behave
+// like a normal shell (PATH, HOME, locale, proxy settings, …). But the parent
+// env also carries provider API keys and channel tokens — including anything
+// loaded from <configDir>/.env by dotenv_min — and an agent's shell command is
+// model-controlled (and steerable via prompt injection). Passing the raw env
+// to a child lets a single `env | curl …` exfiltrate every credential.
+//
+// scrubEnv returns a COPY of `env` with keys that look like secrets removed,
+// while keeping the operational variables a command legitimately needs. An
+// explicit `allow` list opts specific keys back in for the rare command that
+// genuinely needs one.
+
+// Matches keys whose final _-segment is a secret-ish noun: FOO_API_KEY,
+// ANTHROPIC_API_KEY, *_TOKEN (incl. CLAUDE_CODE_OAUTH_TOKEN, GITHUB_TOKEN),
+// *_SECRET, *_PASSWORD/PASSWD, *_CREDENTIAL(S), *_PRIVATE_KEY, *_ACCESS_KEY.
+const SECRET_KEY_RE =
+  /(^|_)(API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|CREDENTIALS|PRIVATE_KEY|ACCESS_KEY|AUTH_TOKEN)$/i;
+
+export function isSecretKey(name) {
+  return SECRET_KEY_RE.test(String(name || ''));
+}
+
+export function scrubEnv(env = process.env, { allow = [] } = {}) {
+  const allowSet = new Set(allow);
+  const out = {};
+  for (const [k, v] of Object.entries(env || {})) {
+    if (allowSet.has(k)) { out[k] = v; continue; }
+    if (isSecretKey(k)) continue; // drop secrets
+    out[k] = v;
+  }
+  return out;
+}

package/mas/tool_runner.mjs

@@ -35,7 +35,7 @@ export function listToolSchemas(names) {
 export function isImplemented(name) { return registry.lookup(name) !== null; }
 export function knownTool(name)     { return registry.lookup(name) !== null; }
 
-export async function runTool({ agent, tool, args, taskId, configDir, cwd, approve } = {}) {
+export async function runTool({ agent, tool, args, taskId, configDir, cwd, approve, security } = {}) {
   if (!agent || !Array.isArray(agent.tools)) {
     throw new ToolError('agent record with .tools[] is required', 'TOOL_BAD_AGENT');
   }
@@ -44,12 +44,28 @@ export async function runTool({ agent, tool, args, taskId, configDir, cwd, appro
   if (!agent.tools.includes(tool)) {
     throw new ToolError(`agent "${agent.name}" is not allowed to call tool "${tool}" (whitelist=[${agent.tools.join(', ')}])`, 'TOOL_DENIED');
   }
-  if (typeof approve === 'function' && impl.sensitive) {
-    let verdict;
-    try { verdict = await approve({ tool, args, agent: agent.name }); }
-    catch (err) { verdict = { approved: false, reason: `approval error: ${err?.message || err}` }; }
-    if (!verdict || !verdict.approved) {
-      const result = { ok: false, error: `tool "${tool}" denied by operator${verdict?.reason ? `: ${verdict.reason}` : ''}`, code: 'TOOL_DENIED_APPROVAL' };
+  // Sensitive tools (shell exec, file writes, network egress, delegation)
+  // are fail-closed: they run only behind an approval hook, OR when the
+  // operator has explicitly opted into unattended execution. A missing
+  // approve hook used to mean "ungated" — that made a fresh interactive
+  // install run bash/write with no confirmation, i.e. remote-prompt-
+  // injection-to-RCE. The default is now deny.
+  if (impl.sensitive) {
+    if (typeof approve === 'function') {
+      let verdict;
+      try { verdict = await approve({ tool, args, agent: agent.name }); }
+      catch (err) { verdict = { approved: false, reason: `approval error: ${err?.message || err}` }; }
+      if (!verdict || !verdict.approved) {
+        const result = { ok: false, error: `tool "${tool}" denied by operator${verdict?.reason ? `: ${verdict.reason}` : ''}`, code: 'TOOL_DENIED_APPROVAL' };
+        audit.append({ taskId, agent: agent.name, tool, args, result, ok: false, configDir });
+        return result;
+      }
+    } else if (security && security.allowUnattendedSensitive === true) {
+      // Explicit, persisted opt-in to unattended sensitive execution.
+      // Never silent — record that the gate was bypassed by config.
+      audit.append({ taskId, agent: agent.name, tool, args, result: { ok: true, note: 'sensitive tool ran unattended (security.allowUnattendedSensitive)' }, ok: true, configDir });
+    } else {
+      const result = { ok: false, error: `tool "${tool}" is sensitive and requires operator approval, but no approval channel is configured. Run interactively, pass --approve-url, or set security.allowUnattendedSensitive=true to allow unattended use.`, code: 'TOOL_DENIED_NO_APPROVER' };
       audit.append({ taskId, agent: agent.name, tool, args, result, ok: false, configDir });
       return result;
     }

package/mas/tools/bash.mjs

@@ -1,14 +1,19 @@
 // Bash tool — runs a shell command, captures stdout/stderr/exit.
 //
-// Workspace is constrained to the lazyclaw process cwd (spec §5.2). We
-// don't sandbox further (per §10 #6 — destructive-pattern confirmation
-// is OFF by default); the audit log captures every invocation so post-hoc
-// forensics work.
+// The command runs with cwd defaulted to the lazyclaw process cwd, but this
+// is NOT an OS sandbox — absolute paths and `cd` escape it. Two real
+// protections apply instead: (1) bash is a `sensitive` tool, so the
+// fail-closed approval gate in tool_runner requires operator confirmation
+// (or an explicit security.allowUnattendedSensitive opt-in) before it runs;
+// (2) the child env is scrubbed of secrets (scrubEnv) so a command cannot
+// exfiltrate API keys / channel tokens inherited from the parent or
+// <configDir>/.env. Every invocation is still audit-logged for forensics.
 //
 // Timeout defaults to 30s so a runaway command can't stall the whole
 // agent turn. Override via args.timeoutMs (capped at 5 minutes).
 
 import { spawn } from 'node:child_process';
+import { scrubEnv } from '../scrub_env.mjs';
 
 export const NAME = 'bash';
 export const DESCRIPTION = 'Run a shell command in the agent\'s workspace. Returns {stdout, stderr, exitCode}. Timeout 30s by default.';
@@ -34,7 +39,7 @@ export async function exec(args, { cwd = process.cwd() } = {}) {
     MAX_TIMEOUT_MS
   );
   return new Promise((resolve) => {
-    const child = spawn('sh', ['-c', args.command], { cwd, env: process.env });
+    const child = spawn('sh', ['-c', args.command], { cwd, env: scrubEnv(process.env) });
     let stdout = '', stderr = '';
     let outBytes = 0, errBytes = 0;
     let truncated = false;

package/mas/tools/browser.mjs

@@ -3,6 +3,8 @@
 // return a structured error if it is missing at runtime. A persistent
 // headless Chromium context is reused across calls in the same process.
 
+import { isSafeUrl, isPrivateAddr } from './web.mjs';
+
 let _backend = null;
 export function __setBrowserBackend(b) { _backend = b; }
 
@@ -15,6 +17,16 @@ async function ensureCtx() {
   catch { throw new Error('browser: playwright not installed (npm i playwright)'); }
   const browser = await pw.chromium.launch({ headless: true });
   const context = await browser.newContext();
+  // Block in-page requests (redirects, subresources, JS-driven navigations)
+  // to loopback / private / link-local / metadata IPs — goto-time validation
+  // alone misses those. Cheap literal-IP check, no per-request DNS.
+  await context.route('**/*', (route) => {
+    try {
+      const h = new URL(route.request().url()).hostname.replace(/^\[|\]$/g, '');
+      if (h === 'localhost' || h === '0.0.0.0' || isPrivateAddr(h)) return route.abort('blockedbyclient');
+    } catch { /* unparseable → let Chromium handle it */ }
+    return route.continue();
+  });
   const page = await context.newPage();
   _ctx = {
     navigate: async (url) => { await page.goto(url, { waitUntil: 'domcontentloaded' }); return { url: page.url(), title: await page.title() }; },
@@ -39,6 +51,12 @@ const browser_navigate = {
   parameters: { type: 'object', properties: { url: { type: 'string' } }, required: ['url'] },
   async exec(args) {
     if (!safeHttp(args.url)) return { ok: false, error: 'browser_navigate: http(s) only' };
+    // Same DNS-resolving SSRF guard as web_fetch before driving Chromium at
+    // the URL — otherwise an agent could navigate to the dashboard, cloud
+    // metadata (169.254.169.254), or internal services and read them back
+    // via title / DOM / screenshot.
+    const safe = await isSafeUrl(args.url);
+    if (!safe.ok) return { ok: false, error: `browser_navigate: ${safe.error}` };
     try { const ctx = await ensureCtx(); return { ok: true, ...(await ctx.navigate(args.url)) }; }
     catch (e) { return { ok: false, error: `browser_navigate: ${e.message}` }; }
   },

package/mas/tools/learning.mjs

@@ -4,12 +4,12 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import * as skills from '../../skills.mjs';
 
 function resolveConfigDir(ctx) {
   return ctx?.configDir || process.env.LAZYCLAW_CONFIG_DIR || path.join(process.env.HOME || '.', '.lazyclaw');
 }
 
-function skillsDir(ctx) { return path.join(resolveConfigDir(ctx), 'skills'); }
 function memoryDir(ctx) { return path.join(resolveConfigDir(ctx), 'memory'); }
 function userMdPath(ctx) { return path.join(memoryDir(ctx), 'USER.md'); }
 
@@ -19,15 +19,26 @@ const skill_view = {
   parameters: { type: 'object', properties: { name: { type: 'string' } }, required: ['name'] },
   async exec(args, ctx) {
     if (!args?.name) return { ok: false, error: 'skill_view: name required' };
-    const file = path.join(skillsDir(ctx), args.name, 'SKILL.md');
-    if (!fs.existsSync(file)) return { ok: false, error: `skill_view: ${args.name} not installed` };
-    return { ok: true, name: args.name, content: fs.readFileSync(file, 'utf8') };
+    const configDir = resolveConfigDir(ctx);
+    if (!skills.skillExists(args.name, configDir)) return { ok: false, error: `skill_view: ${args.name} not installed` };
+    try {
+      const content = skills.loadSkill(args.name, configDir);
+      // Record the recall so the curator can age out never-used skills.
+      // Best-effort: a usage-write hiccup must never fail the tool call.
+      try {
+        const curator = await import('../../skills_curator.mjs');
+        curator.recordUsage(args.name, configDir, Date.now());
+      } catch { /* non-fatal */ }
+      return { ok: true, name: args.name, content };
+    } catch (err) {
+      return { ok: false, error: `skill_view: ${err?.message || err}` };
+    }
   },
 };
 
 const skill_create = {
   name: 'skill_create', category: 'learning', sensitive: true,
-  description: 'Create a new skill at <configDir>/skills/<name>/SKILL.md. Fails if already exists.',
+  description: 'Create a new skill at <configDir>/skills/<name>.md. Fails if already exists.',
   parameters: {
     type: 'object',
     properties: {
@@ -39,10 +50,8 @@ const skill_create = {
   async exec(args, ctx) {
     if (!args?.name || !args?.body) return { ok: false, error: 'skill_create: name + body required' };
     if (!/^[a-z0-9][a-z0-9-]*$/.test(args.name)) return { ok: false, error: 'skill_create: kebab-case name only' };
-    const dir = path.join(skillsDir(ctx), args.name);
-    const file = path.join(dir, 'SKILL.md');
-    if (fs.existsSync(file)) return { ok: false, error: `skill_create: ${args.name} already exists; use skill_edit` };
-    fs.mkdirSync(dir, { recursive: true });
+    const configDir = resolveConfigDir(ctx);
+    if (skills.skillExists(args.name, configDir)) return { ok: false, error: `skill_create: ${args.name} already exists; use skill_edit` };
     const fm = [
       '---',
       `name: ${args.name}`,
@@ -54,7 +63,7 @@ const skill_create = {
       '---',
       '',
     ].join('\n');
-    fs.writeFileSync(file, fm + args.body + (args.body.endsWith('\n') ? '' : '\n'));
+    const file = skills.installSkill(args.name, fm + args.body + (args.body.endsWith('\n') ? '' : '\n'), configDir);
     return { ok: true, name: args.name, file };
   },
 };
@@ -68,14 +77,15 @@ const skill_edit = {
     required: ['name', 'body'],
   },
   async exec(args, ctx) {
-    const file = path.join(skillsDir(ctx), args.name, 'SKILL.md');
-    if (!fs.existsSync(file)) return { ok: false, error: `skill_edit: ${args.name} not installed` };
-    const src = fs.readFileSync(file, 'utf8');
+    if (!args?.name || !args?.body) return { ok: false, error: 'skill_edit: name + body required' };
+    const configDir = resolveConfigDir(ctx);
+    if (!skills.skillExists(args.name, configDir)) return { ok: false, error: `skill_edit: ${args.name} not installed` };
+    const src = skills.loadSkill(args.name, configDir);
     const m = /^---\n([\s\S]*?)\n---\n([\s\S]*)$/.exec(src);
     if (!m) return { ok: false, error: 'skill_edit: missing frontmatter' };
     let fm = m[1];
     fm = fm.replace(/version:\s*(\d+)/, (_, v) => `version: ${Number(v) + 1}`);
-    fs.writeFileSync(file, `---\n${fm}\n---\n${args.body}${args.body.endsWith('\n') ? '' : '\n'}`);
+    skills.installSkill(args.name, `---\n${fm}\n---\n${args.body}${args.body.endsWith('\n') ? '' : '\n'}`, configDir);
     return { ok: true, name: args.name };
   },
 };

package/mas/tools/recall.mjs

@@ -97,7 +97,11 @@ export async function exec(args, { configDir } = {}) {
     }
   } else {
     try {
-      openIndex(configDir);
+      // Skip the full-b-tree integrity_check on the read hot path. recall is
+      // the most frequent reader and every CLI subcommand / agent worker is a
+      // fresh process, so the check (which scales with index size) would be
+      // paid on essentially every recall. It belongs in `doctor`, not here.
+      openIndex(configDir, { runIntegrityCheck: false });
     } catch (err) {
       return { ok: false, error: `recall: openIndex failed — ${err?.message || err}` };
     }

package/mas/tools/web.mjs

@@ -11,20 +11,40 @@ const PRIVATE_V4 = [
   /^127\./, /^169\.254\./, /^0\./, /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./,
 ];
 
-async function isSafeUrl(url) {
+// True for an address (or literal-IP host) that must never be reached from a
+// tool: RFC1918 / loopback / link-local v4, IPv6 loopback (::1), link-local
+// (fe80::/10), unique-local (fc00::/7), unspecified (::), and IPv4-mapped
+// private v6 (::ffff:a.b.c.d). Pure/synchronous — no DNS.
+export function isPrivateAddr(addr) {
+  const a = String(addr || '').toLowerCase().replace(/^\[|\]$/g, '');
+  if (PRIVATE_V4.some((re) => re.test(a))) return true;
+  if (a === '::1' || a === '::' || a === '0:0:0:0:0:0:0:1') return true;
+  if (/^fe[89ab][0-9a-f]:/.test(a)) return true;       // fe80::/10 link-local
+  if (/^f[cd][0-9a-f]{2}:/.test(a)) return true;        // fc00::/7 unique-local
+  const mapped = a.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (mapped && PRIVATE_V4.some((re) => re.test(mapped[1]))) return true;
+  return false;
+}
+
+export async function isSafeUrl(url) {
   let u;
   try { u = new URL(url); } catch { return { ok: false, error: 'bad URL' }; }
   if (u.protocol !== 'http:' && u.protocol !== 'https:') return { ok: false, error: `scheme ${u.protocol} blocked` };
   const host = u.hostname.replace(/^\[|\]$/g, '');
   if (host === 'localhost' || host === '0.0.0.0') return { ok: false, error: 'loopback blocked (SSRF)' };
-  if (PRIVATE_V4.some(re => re.test(host))) return { ok: false, error: 'private address blocked (SSRF)' };
-  if (host.includes(':')) return { ok: false, error: 'IPv6 disabled' };
+  // Literal IP host (v4 or v6): block private/loopback directly, no DNS.
+  if (host.includes(':')) {
+    if (isPrivateAddr(host)) return { ok: false, error: 'private address blocked (SSRF)' };
+    return { ok: true }; // public IPv6 literal
+  }
+  if (PRIVATE_V4.some((re) => re.test(host))) return { ok: false, error: 'private address blocked (SSRF)' };
   if (!/^[a-z0-9.-]+$/i.test(host)) return { ok: false, error: 'bad host' };
+  // Resolve and reject any A/AAAA that lands on a private/loopback address
+  // (anti-rebinding for the entry URL).
   try {
     const addrs = await dns.lookup(host, { all: true });
     for (const a of addrs) {
-      if (PRIVATE_V4.some(re => re.test(a.address))) return { ok: false, error: 'resolves to private address (SSRF)' };
-      if (a.address === '127.0.0.1' || a.address === '::1') return { ok: false, error: 'resolves to loopback (SSRF)' };
+      if (isPrivateAddr(a.address)) return { ok: false, error: 'resolves to private address (SSRF)' };
     }
   } catch (e) {
     return { ok: false, error: `dns: ${e.message}` };
@@ -51,12 +71,28 @@ const web_fetch = {
     if (!safe.ok) return { ok: false, error: `web_fetch: ${safe.error}` };
     const maxBytes = Math.min(args.maxBytes || 2_000_000, 5_000_000);
     try {
-      const res = await fetch(args.url, {
-        method: args.method || 'GET',
-        headers: args.headers || {},
-        body: args.body,
-        redirect: 'follow',
-      });
+      // Follow redirects manually, re-validating every hop. undici's
+      // redirect:'follow' would chase a 30x into a private IP (or a
+      // DNS-rebind) without re-checking — the classic SSRF-via-redirect.
+      let current = args.url;
+      let res;
+      for (let hop = 0; hop <= 5; hop++) {
+        res = await fetch(current, {
+          method: args.method || 'GET',
+          headers: args.headers || {},
+          body: args.body,
+          redirect: 'manual',
+        });
+        if (res.status >= 300 && res.status < 400 && res.headers.get('location')) {
+          if (hop === 5) return { ok: false, error: 'web_fetch: too many redirects' };
+          const next = new URL(res.headers.get('location'), current).toString();
+          const ns = await isSafeUrl(next);
+          if (!ns.ok) return { ok: false, error: `web_fetch: redirect ${ns.error}` };
+          current = next;
+          continue;
+        }
+        break;
+      }
       const buf = Buffer.from(await res.arrayBuffer());
       const truncated = buf.length > maxBytes;
       return {

package/mas/trajectory_store.mjs

@@ -147,10 +147,13 @@ export async function get(id, opts = {}) {
   for (const bucket of fs.readdirSync(root)) {
     const file = recordPath(configDir, bucket, id);
     if (fs.existsSync(file)) {
-      const raw = fs.readFileSync(file, 'utf8').trim();
-      const rec = JSON.parse(raw);
-      cachePush(id, rec);
-      return rec;
+      // Guard the parse like the sibling listByTaskId does — a truncated record
+      // (crash during _trajPut) must return null, not throw an uncaught error.
+      try {
+        const rec = JSON.parse(fs.readFileSync(file, 'utf8').trim());
+        cachePush(id, rec);
+        return rec;
+      } catch { return null; }
     }
   }
   return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lazyclaw",
-  "version": "5.4.4",
+  "version": "6.0.1",
   "description": "Lazy, elegant terminal CLI for chatting with Claude / OpenAI / Gemini / Ollama, orchestrating multi-step LLM workflows, and running multi-agent Slack teams with cross-task memory. Banner-on-launch, slash-command ghost autocomplete, persistent sessions, local HTTP gateway.",
   "keywords": [
     "claude",
@@ -31,7 +31,9 @@
     "lazyclaw": "cli.mjs"
   },
   "scripts": {
-    "test": "node --test tests/phaseC-*.test.mjs && playwright test",
+    "test": "node --test tests/*.test.mjs && playwright test",
+    "lint:size": "node scripts/lint-file-size.mjs",
+    "lint:pack": "node scripts/check-pack.mjs",
     "test:bench": "node scripts/bench-providers.mjs",
     "test:bench:index": "node --test tests/index_store.bench.mjs",
     "test:perf": "node --test tests/phaseH-perf.test.mjs tests/index_store.bench.mjs",
@@ -41,6 +43,18 @@
   "files": [
     "cli.mjs",
     "daemon.mjs",
+    "daemon/",
+    "lib/",
+    "commands/",
+    "first_run.mjs",
+    "dotenv_min.mjs",
+    "goals_cron.mjs",
+    "secure_write.mjs",
+    "channels-discord/",
+    "channels-email/",
+    "channels-signal/",
+    "channels-voice/",
+    "channels-whatsapp/",
     "sessions.mjs",
     "skills.mjs",
     "logger.mjs",

package/providers/auth_store.mjs

@@ -0,0 +1,22 @@
+// providers/auth_store.mjs — persist an api key for a provider into the
+// authProfiles config shape that _resolveAuthKey reads (cfg.authProfiles
+// [provider] = [{ label, key }], cfg.authActiveProfile[provider] = label).
+//
+// Extracted as a tiny DI'd helper so the Ink /provider key-entry flow can
+// store a key without re-implementing the config shape. No disk — readConfig/
+// writeConfig are injected.
+
+export function setAuthKey({ readConfig, writeConfig, provider, key, label = 'default' }) {
+  const cfg = readConfig();
+  cfg.authProfiles = cfg.authProfiles && typeof cfg.authProfiles === 'object' ? cfg.authProfiles : {};
+  cfg.authActiveProfile = cfg.authActiveProfile && typeof cfg.authActiveProfile === 'object' ? cfg.authActiveProfile : {};
+  const arr = Array.isArray(cfg.authProfiles[provider]) ? cfg.authProfiles[provider].slice() : [];
+  const idx = arr.findIndex((p) => p && p.label === label);
+  const entry = { label, key: String(key) };
+  if (idx >= 0) arr[idx] = { ...arr[idx], ...entry };
+  else arr.push(entry);
+  cfg.authProfiles[provider] = arr;
+  cfg.authActiveProfile[provider] = label;
+  writeConfig(cfg);
+  return cfg;
+}

package/providers/claude_cli.mjs

@@ -65,7 +65,14 @@ const _CLI_MODEL_ALIASES = {
 function resolveModelAlias(model) {
   if (!model) return '';
   const lower = String(model).toLowerCase();
-  return _CLI_MODEL_ALIASES[lower] ?? '';
+  if (_CLI_MODEL_ALIASES[lower]) return _CLI_MODEL_ALIASES[lower];
+  // Unknown but already a bare short alias (e.g. a new tier the table doesn't
+  // enumerate yet, like a future "opusplus") → pass it through rather than
+  // dropping to '' (which makes the CLI silently ignore the user's model
+  // choice). Full canonical ids (with digits/dashes) stay mapped-or-dropped,
+  // because passing a full id to `claude --model` hangs the CLI (FF1).
+  if (/^[a-z]+$/.test(lower)) return lower;
+  return '';
 }
 
 // Flatten the chat-style messages array into a single -p prompt the
@@ -152,6 +159,19 @@ export const claudeCliProvider = {
     };
     if (opts.signal) opts.signal.addEventListener('abort', onAbort);
 
+    // child_process reports spawn failures (ENOENT when `claude` isn't on
+    // PATH, EACCES, ...) ASYNCHRONOUSLY via an 'error' event — the
+    // synchronous try/catch around spawn above never sees them. Without a
+    // listener Node escalates the unhandled 'error' event to an
+    // uncaughtException and crashes the whole process; on a box with no
+    // claude binary (e.g. CI) this took down `providers test` for the CLI
+    // and the daemon entirely. Capture it and surface it through the stream
+    // as a normal, catchable error so callers report it per-provider.
+    let spawnError = null;
+    const spawnErrorPromise = new Promise((resolve) => {
+      proc.once('error', (err) => { spawnError = err; resolve(); });
+    });
+
     let stderr = '';
     proc.stderr.setEncoding('utf8');
     proc.stderr.on('data', (chunk) => { stderr += chunk; });
@@ -203,7 +223,13 @@ export const claudeCliProvider = {
           if (text) yield text;
         } catch (_) { /* incomplete tail — drop */ }
       }
-      await exitPromise;
+      // Wait for either a clean exit or an async spawn error. On ENOENT
+      // the process never starts, so 'close' never fires — racing against
+      // spawnErrorPromise keeps this from hanging forever.
+      await Promise.race([exitPromise, spawnErrorPromise]);
+      if (spawnError) {
+        throw spawnError.code === 'ENOENT' ? new CliMissingError() : spawnError;
+      }
       if (exitInfo && exitInfo.code !== 0 && !opts.signal?.aborted) {
         throw new CliExitError(exitInfo.code, exitInfo.signal, stderr);
       }