lazyclaw 5.4.4 → 6.0.1

package/providers/claude_cli_detect.mjs

@@ -0,0 +1,46 @@
+// claude_cli_detect.mjs — detect a usable claude-cli subscription session.
+//
+// resolveTrainer's `auto` branch routes the $0 learning loop to claude-cli
+// only when a Pro/Max session is detected. The original detector keyed solely
+// on an exported CLAUDE_CODE_OAUTH_TOKEN env var — which a normal `claude
+// login` never sets (it writes the OS keychain / ~/.claude) — so `auto`
+// silently fell back to the paid chat provider for real subscribers. This
+// detector also accepts the credential store and the `claude` binary on PATH.
+// Pure + offline (no network); the binary probe is the only subprocess and is
+// bounded by a short timeout.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { execFileSync } from 'node:child_process';
+
+export function detectClaudeCliSession({ env = process.env, home = os.homedir() } = {}) {
+  // 1. Explicit token (CI / headless) — definitive.
+  if (env.CLAUDE_CODE_OAUTH_TOKEN) {
+    return { available: true, source: 'env', reason: 'CLAUDE_CODE_OAUTH_TOKEN set' };
+  }
+  // 2. Credential store written by `claude login` (Linux / non-keychain).
+  for (const rel of ['.claude/.credentials.json', '.claude.json', '.config/claude/.credentials.json']) {
+    try { if (fs.existsSync(path.join(home, rel))) return { available: true, source: 'credentials', reason: rel }; }
+    catch { /* ignore unreadable */ }
+  }
+  // 3. `claude` on PATH. On macOS the login lives in the Keychain with no
+  //    credential file, so binary presence is the best offline signal we have.
+  //    If it turns out not to be logged in, the trainer call fails (best-effort,
+  //    swallowed) — no billing — rather than silently charging the paid path.
+  try {
+    execFileSync('claude', ['--version'], { stdio: 'ignore', timeout: 4000 });
+    return { available: true, source: 'binary', reason: 'claude on PATH' };
+  } catch { /* ENOENT / nonzero / timeout */ }
+  return { available: false, source: 'none', reason: 'no env token, credential store, or claude binary' };
+}
+
+let _cache = null; // memoize per-process — detection does not change mid-run
+
+// Boolean for the hot resolveTrainer path. Explicit opts bypass the cache
+// (tests inject env/home); the no-arg call memoizes.
+export function hasClaudeCliSession(opts) {
+  if (opts) return detectClaudeCliSession(opts).available;
+  if (_cache === null) _cache = detectClaudeCliSession().available;
+  return _cache;
+}

package/providers/custom_provider.mjs

@@ -0,0 +1,70 @@
+// providers/custom_provider.mjs — register a custom OpenAI-compatible
+// endpoint (NIM / OpenRouter / Together / Groq / vLLM / LM Studio / …).
+//
+// Extracted from cli.mjs `_addCustomProviderInteractive` so the persistence +
+// live-probe logic is shared between the legacy readline wizard and the Ink
+// provider picker (which lost this affordance in v5.4). The original mixed
+// raw-ANSI prompts with the persistence; this is the IO-free core, dependency-
+// injected on registry + config readers/writers so it unit-tests with no disk
+// or network. The caller owns collecting name/baseUrl/apiKey and rendering.
+
+export function validateCustomBaseUrl(raw) {
+  const s = String(raw || '').trim();
+  if (!s) throw new Error('baseUrl is required');
+  if (!/^https?:\/\//i.test(s)) throw new Error('baseUrl must start with http:// or https://');
+  return s.replace(/\/+$/, '');
+}
+
+/**
+ * Validate, persist, hot-register, and best-effort probe a custom provider.
+ *
+ * @param {object} deps
+ * @param {object} deps.registry      registry module — needs validateCustomProviderName,
+ *                                     registerCustomProviders, fetchOpenAICompatModels,
+ *                                     and (optional) isBuiltinOpenAICompatName
+ * @param {()=>object} deps.readConfig
+ * @param {(cfg:object)=>void} deps.writeConfig
+ * @param {string} deps.name
+ * @param {string} deps.baseUrl
+ * @param {string} [deps.apiKey]
+ * @returns {Promise<{name:string, baseUrl:string, builtinOverride:boolean, probe:{ok:boolean,count:number,error:?string,models:string[]}}>}
+ */
+export async function addCustomProvider({ registry, readConfig, writeConfig, name, baseUrl, apiKey }) {
+  const vName = registry.validateCustomProviderName(name); // throws on bad name
+  const vUrl = validateCustomBaseUrl(baseUrl);
+  const builtinOverride = typeof registry.isBuiltinOpenAICompatName === 'function'
+    && !!registry.isBuiltinOpenAICompatName(vName);
+
+  // Persist to cfg.customProviders[], overwriting an existing same-name entry.
+  const cfg = readConfig();
+  cfg.customProviders = Array.isArray(cfg.customProviders) ? cfg.customProviders : [];
+  const idx = cfg.customProviders.findIndex((p) => p && p.name === vName);
+  const entry = { name: vName, baseUrl: vUrl, apiKey: apiKey ? String(apiKey) : undefined };
+  if (idx >= 0) cfg.customProviders[idx] = { ...cfg.customProviders[idx], ...entry };
+  else cfg.customProviders.push(entry);
+  writeConfig(cfg);
+  registry.registerCustomProviders(cfg);
+
+  // Best-effort live model probe. Registration still succeeds on failure —
+  // the model picker's free-text/refetch row covers it.
+  const probe = { ok: false, count: 0, error: null, models: [] };
+  try {
+    const list = await registry.fetchOpenAICompatModels({ baseUrl: vUrl, apiKey: entry.apiKey || '' });
+    probe.ok = true;
+    probe.models = Array.isArray(list) ? list.slice(0, 50) : [];
+    probe.count = probe.models.length;
+    if (probe.models.length) {
+      const updated = readConfig();
+      const i = (updated.customProviders || []).findIndex((p) => p && p.name === vName);
+      if (i >= 0) {
+        updated.customProviders[i].suggestedModels = probe.models;
+        if (!updated.customProviders[i].defaultModel) updated.customProviders[i].defaultModel = probe.models[0];
+        writeConfig(updated);
+        registry.registerCustomProviders(updated);
+      }
+    }
+  } catch (e) {
+    probe.error = e && e.message ? e.message : String(e);
+  }
+  return { name: vName, baseUrl: vUrl, builtinOverride, probe };
+}

package/providers/model_catalogue.mjs

@@ -0,0 +1,86 @@
+// providers/model_catalogue.mjs — shared OpenAI-compatible model-catalogue
+// resolution.
+//
+// Extracted from cli.mjs (`_modelCatalogueFor` / `_fetchModelsForProvider`)
+// so BOTH the legacy readline picker (cli.mjs) and the Ink slash dispatcher
+// (tui/slash_dispatcher.mjs) can offer the same live `/v1/models` fetch
+// without duplicating the provider -> endpoint resolution. v5.4's Ink port
+// dropped this affordance from `/model`; this module restores it for both
+// paths from one place.
+//
+// Dependency-injected (no cli.mjs internals) so it stays import-light and
+// unit-testable with no network.
+
+/**
+ * Whether a provider exposes an OpenAI-compatible `/v1/models` catalogue we
+ * can live-fetch. True for openai, ollama, any builtin OpenAI-compat vendor
+ * (nim / openrouter / groq / together / xai / deepseek / mistral /
+ * fireworks), and any provider carrying an explicit `baseUrl` (custom
+ * endpoints). False for anthropic / gemini / claude-cli / mock /
+ * orchestrator.
+ *
+ * @param {object} meta       PROVIDER_INFO[providerId]
+ * @param {string} providerId
+ * @returns {boolean}
+ */
+export function supportsLiveFetch(meta, providerId) {
+  const m = meta || {};
+  return !!m.baseUrl
+    || providerId === 'openai'
+    || providerId === 'ollama'
+    || !!m.builtinOpenAICompat;
+}
+
+/**
+ * Resolve `{ baseUrl, apiKey }` for a provider's OpenAI-compatible
+ * `/v1/models` endpoint. Returns `null` when the provider has no such
+ * catalogue (anthropic / gemini / claude-cli / mock / orchestrator).
+ *
+ * @param {object} deps
+ * @param {object} deps.cfg            on-disk config (for cfg.customProviders / cfg['api-key'])
+ * @param {object} deps.registryMod    provides PROVIDER_INFO
+ * @param {(providerId:string)=>string} deps.resolveAuthKey  env/profile key resolver
+ * @param {string} deps.providerId
+ * @returns {{baseUrl:string, apiKey:string}|null}
+ */
+export function modelCatalogueFor({ cfg, registryMod, resolveAuthKey, providerId } = {}) {
+  const info = (registryMod && registryMod.PROVIDER_INFO) || {};
+  const meta = info[providerId] || {};
+  const key = (id) => (typeof resolveAuthKey === 'function' ? resolveAuthKey(id) : '') || '';
+
+  if (meta.custom && meta.baseUrl) {
+    const list = (cfg && cfg.customProviders) || [];
+    const entry = list.find((p) => p && p.name === providerId) || {};
+    return { baseUrl: meta.baseUrl, apiKey: entry.apiKey || (cfg && cfg['api-key']) || '' };
+  }
+  // Built-in OpenAI-compatible vendors expose a baseUrl; the auth-key
+  // resolver already knows the env-var fallback chain.
+  if (meta.builtinOpenAICompat && meta.baseUrl) {
+    return { baseUrl: meta.baseUrl, apiKey: key(providerId) };
+  }
+  if (providerId === 'openai') {
+    return { baseUrl: 'https://api.openai.com/v1', apiKey: key('openai') };
+  }
+  if (providerId === 'ollama') {
+    const host = process.env.OLLAMA_HOST || 'http://127.0.0.1:11434';
+    return { baseUrl: `${host.replace(/\/$/, '')}/v1`, apiKey: '' };
+  }
+  return null;
+}
+
+/**
+ * Live-fetch the provider's `/v1/models` list. Throws when the provider has
+ * no OpenAI-compatible catalogue. Returns a string[] of model ids.
+ *
+ * @param {object} deps  same shape as {@link modelCatalogueFor}
+ * @returns {Promise<string[]>}
+ */
+export async function fetchModelsForProvider(deps) {
+  const c = modelCatalogueFor(deps);
+  const providerId = deps && deps.providerId;
+  if (!c) {
+    throw new Error(`provider "${providerId}" does not expose an OpenAI-compatible /v1/models endpoint`);
+  }
+  const { fetchOpenAICompatModels } = await import('./openai_compat.mjs');
+  return fetchOpenAICompatModels({ baseUrl: c.baseUrl, apiKey: c.apiKey });
+}

package/providers/orchestrator.mjs

@@ -36,7 +36,10 @@
 // step), workers = [planner] (degenerates to a single-agent chain that
 // still benefits from plan + synthesis structure).
 
-import { PROVIDERS, PROVIDER_INFO } from './registry.mjs';
+// This module must NOT statically import ./registry.mjs — that formed a static
+// import cycle (registry → orchestrator → registry). Provider lookup is now
+// injected via makeOrchestratorProvider({ lookup }), so the dependency is
+// one-directional (registry → orchestrator only).
 
 function _parseSpec(spec) {
   if (!spec || typeof spec !== 'string') return { provider: '', model: '' };
@@ -45,11 +48,12 @@ function _parseSpec(spec) {
   return { provider: spec.slice(0, colon).trim(), model: spec.slice(colon + 1).trim() };
 }
 
-function _lookupProvider(spec) {
+function _lookupProvider(spec, lookup) {
   const { provider, model } = _parseSpec(spec);
-  const prov = PROVIDERS[provider];
+  const found = (typeof lookup === 'function' ? lookup(provider) : null) || {};
+  const prov = found.prov;
   if (!prov) return null;
-  const info = PROVIDER_INFO[provider] || {};
+  const info = found.info || {};
   return {
     name: provider,
     model: model || info.defaultModel || '',
@@ -115,6 +119,9 @@ Rules:
 export function makeOrchestratorProvider(opts = {}) {
   const cfgGetter = typeof opts.cfgGetter === 'function' ? opts.cfgGetter : () => ({});
   const keyResolver = typeof opts.keyResolver === 'function' ? opts.keyResolver : () => '';
+  // Injected provider lookup: (provider) => { prov, info }. Supplied by the
+  // registry so orchestrator never imports registry (breaks the static cycle).
+  const lookup = typeof opts.lookup === 'function' ? opts.lookup : () => ({});
 
   return {
     name: 'orchestrator',
@@ -134,7 +141,7 @@ export function makeOrchestratorProvider(opts = {}) {
       // the user's stated intent. Do a real passthrough instead.
       const hasWorkers = Array.isArray(o.workers) && o.workers.length > 0;
       if (!cfg.orchestrator || !hasWorkers) {
-        const direct = _lookupProvider(fallbackSpec);
+        const direct = _lookupProvider(fallbackSpec, lookup);
         if (!direct || direct.name === 'orchestrator') {
           yield `⚠ orchestrator: not configured and fallback provider \`${fallbackSpec}\` is not registered. ` +
             `Set \`cfg.orchestrator.planner\` + \`cfg.orchestrator.workers\`, or set \`cfg.provider\` to a real backend.\n`;
@@ -153,7 +160,7 @@ export function makeOrchestratorProvider(opts = {}) {
       const workerSpecs = o.workers.map(String);
       const maxSubtasks = Number.isFinite(o.maxSubtasks) && o.maxSubtasks > 0 ? Math.min(10, o.maxSubtasks) : 5;
 
-      const planner = _lookupProvider(plannerSpec);
+      const planner = _lookupProvider(plannerSpec, lookup);
       if (!planner) {
         yield `⚠ orchestrator: planner provider "${plannerSpec}" is not registered. ` +
           `Set cfg.orchestrator.planner to a valid "provider:model" (e.g. "claude-cli:claude-opus-4-7").\n`;
@@ -166,7 +173,7 @@ export function makeOrchestratorProvider(opts = {}) {
         yield `⚠ orchestrator: planner cannot be "orchestrator" — set cfg.orchestrator.planner to a real provider (e.g. "claude-cli:claude-opus-4-7").\n`;
         return;
       }
-      const workers = workerSpecs.map(_lookupProvider).filter(Boolean).filter(w => w.name !== 'orchestrator');
+      const workers = workerSpecs.map((s) => _lookupProvider(s, lookup)).filter(Boolean).filter(w => w.name !== 'orchestrator');
       if (workers.length === 0) {
         yield `⚠ orchestrator: no usable workers (cfg.orchestrator.workers is empty, all unknown, or only references "orchestrator" itself).\n`;
         return;
@@ -306,8 +313,22 @@ export function makeOrchestratorProvider(opts = {}) {
           }
           return { sub, worker, chunks, error };
         }
-        const settled = await Promise.all(
-          trimmed.map((sub, i) => _runSubtask(sub, workers[i % workers.length])),
+        // Bounded worker pool (E1): run at most `concurrency` subtasks at
+        // once instead of firing all of them via one Promise.all. A large
+        // plan would otherwise open N simultaneous provider streams —
+        // over-subscribing rate limits and buffering every worker's chunks
+        // at the same time. Results are stored by index so the plan-order
+        // flush below is unchanged; for plans with <= concurrency subtasks
+        // every subtask still starts immediately (identical to before).
+        const settled = new Array(trimmed.length);
+        let nextIdx = 0;
+        async function _poolWorker() {
+          for (let i = nextIdx++; i < trimmed.length; i = nextIdx++) {
+            settled[i] = await _runSubtask(trimmed[i], workers[i % workers.length]);
+          }
+        }
+        await Promise.all(
+          Array.from({ length: Math.min(concurrency, trimmed.length) }, () => _poolWorker()),
         );
         // Flush in plan order so the synthesis prompt + user view see
         // subtask 1, then 2, etc.

package/providers/rates.mjs

@@ -35,11 +35,21 @@
  * @returns {{ cost: number, currency: string, breakdown: object } | null}
  */
 export function costFromUsage(call, rates) {
-  if (!call || !rates) return null;
+  if (!call) return null;
+  const u = call.usage || {};
+  // Prefer a provider-reported dollar cost when present. claude-cli / codex-cli
+  // / gemini-cli emit total_cost_usd from the CLI's own `result` event, so this
+  // makes spend observable — and the daemon cost cap enforceable — for the
+  // subscription path even when the user has authored no rate card (the card
+  // ships zero-filled). Rate-card arithmetic is the fallback for API providers.
+  const reported = Number(u.totalCostUsd);
+  if (Number.isFinite(reported) && reported > 0) {
+    return { cost: round6(reported), currency: 'USD', breakdown: { reported: round6(reported) } };
+  }
+  if (!rates) return null;
   const key = `${call.provider}/${call.model}`;
   const r = rates[key];
   if (!r) return null;
-  const u = call.usage || {};
   const million = 1_000_000;
   const inputCost = ((Number(u.inputTokens) || 0) / million) * (Number(r.inputPer1M) || 0);
   const outputCost = ((Number(u.outputTokens) || 0) / million) * (Number(r.outputPer1M) || 0);

package/providers/registry.mjs

@@ -12,6 +12,7 @@ import { openaiProvider } from './openai.mjs';
 import { ollamaProvider } from './ollama.mjs';
 import { geminiProvider } from './gemini.mjs';
 import { claudeCliProvider } from './claude_cli.mjs';
+import { hasClaudeCliSession } from './claude_cli_detect.mjs';
 import { makeOpenAICompatProvider, fetchOpenAICompatModels } from './openai_compat.mjs';
 import { makeOrchestratorProvider } from './orchestrator.mjs';
 
@@ -83,11 +84,10 @@ export function parseProviderModel(spec) {
 }
 
 function _defaultDetectClaudeCli() {
-  // Phase A stub: real Pro/Max session detection arrives in Phase B
-  // (it requires reading the claude-cli OAuth token cache). Until
-  // then, treat presence of CLAUDE_CODE_OAUTH_TOKEN as a positive
-  // signal so users can opt-in explicitly.
-  return Boolean(process.env.CLAUDE_CODE_OAUTH_TOKEN);
+  // Real Pro/Max session detection: env token, credential store, or the
+  // `claude` binary on PATH (a normal `claude login` does NOT export
+  // CLAUDE_CODE_OAUTH_TOKEN). See providers/claude_cli_detect.mjs.
+  return hasClaudeCliSession();
 }
 
 export function resolveTrainer(cfg, opts = {}) {
@@ -298,7 +298,10 @@ export const PROVIDERS = {
 // it via `lazyclaw providers list`; `registerOrchestrator(...)` from
 // cli.mjs::ensureRegistry wires in the live cfg + auth-key resolver so
 // sendMessage can reach env vars / authProfiles / customProviders.
-PROVIDERS.orchestrator = makeOrchestratorProvider();
+// Inject the provider lookup so orchestrator never imports this module back
+// (one-directional dep). The closure reads PROVIDERS/PROVIDER_INFO lazily.
+const _orchestratorLookup = (p) => ({ prov: PROVIDERS[p], info: PROVIDER_INFO[p] });
+PROVIDERS.orchestrator = makeOrchestratorProvider({ lookup: _orchestratorLookup });
 
 // Wire each OpenAI-compat builtin into PROVIDERS as a callable provider.
 // Insertion is between Tier 2 (anthropic) and Tier 4 (ollama) by reordering
@@ -463,7 +466,7 @@ for (const [name, def] of Object.entries(OPENAI_COMPAT_BUILTINS)) {
  * — idempotent (overwrites the previous registration in place).
  */
 export function registerOrchestrator({ cfgGetter, keyResolver } = {}) {
-  PROVIDERS.orchestrator = makeOrchestratorProvider({ cfgGetter, keyResolver });
+  PROVIDERS.orchestrator = makeOrchestratorProvider({ cfgGetter, keyResolver, lookup: _orchestratorLookup });
 }
 
 /**

package/sandbox/confiners/landlock.mjs

@@ -1,14 +1,20 @@
 // sandbox/confiners/landlock.mjs — Linux Landlock helper.
 //
 // Landlock is enforced from *inside* the process via the
-// landlock_create_ruleset() syscall. With no native bindings available
-// in plain Node, we currently emit the argv unchanged and let
-// downstream tooling (e.g. a future `lazyclaw-landlock-shim` binary)
-// install the ruleset. Returns argv unchanged on non-Linux.
+// landlock_create_ruleset() syscall, which needs a native binding / preloader
+// shim that lazyclaw does not ship yet. The previous implementation returned
+// the argv UNCHANGED, so selecting `confiner: landlock` ran the command with
+// ZERO confinement while reporting itself available — a false security
+// guarantee that is worse than `none`. Until a real enforcer ships we report
+// unavailable and refuse to build an argv, so the request fails closed instead
+// of silently running unconfined.
 
-export function available() { return process.platform === 'linux'; }
+export function available() { return false; }
 
-export function buildArgv(argv, _opts = {}) {
-  // Pass-through. Spec §0.1 C8 leaves room for a preloader binary.
-  return [...argv];
+export function buildArgv() {
+  throw new Error(
+    'landlock confiner is not implemented (no enforcement shim is shipped) — ' +
+    'it would run the command unconfined. Use confiner bubblewrap or firejail ' +
+    'on Linux, or set confiner:none deliberately.',
+  );
 }

package/sandbox/confiners/seatbelt.mjs

@@ -9,6 +9,22 @@ export function available() {
   catch { return false; }
 }
 
+// Escape a path for an SBPL double-quoted string literal. Without this a path
+// containing `"` (or a backslash) could close the string and inject arbitrary
+// SBPL directives — e.g. re-enabling `(allow network*)` or widening file
+// access — neutering the sandbox. Reject control characters outright; escape
+// backslash and double-quote.
+function sbplPath(p) {
+  const s = String(p);
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 0x20 || c === 0x7f) {
+      throw new Error('seatbelt: path contains control characters; refusing to build profile');
+    }
+  }
+  return s.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
 export function buildArgv(argv, opts = {}) {
   const readOnly = opts.readOnly || [];
   const readWrite = opts.readWrite || [process.cwd()];
@@ -21,8 +37,8 @@ export function buildArgv(argv, opts = {}) {
     '(allow signal)',
     '(allow sysctl-read)',
     allowNet ? '(allow network*)' : '(deny network*)',
-    ...readOnly.map(p => `(allow file-read* (subpath "${p}"))`),
-    ...readWrite.map(p => `(allow file-read* file-write* (subpath "${p}"))`),
+    ...readOnly.map(p => `(allow file-read* (subpath "${sbplPath(p)}"))`),
+    ...readWrite.map(p => `(allow file-read* file-write* (subpath "${sbplPath(p)}"))`),
   ].join('\n');
   return ['sandbox-exec', '-p', profile, ...argv];
 }

package/scripts/loop-worker.mjs

@@ -85,7 +85,13 @@ const max = Number(args.max) || loopEngine.LOOP_MAX_DEFAULT;
 loops.patchMeta(loopId, { status: 'running', startedAt: new Date().toISOString() }, cfgDir);
 
 const ac = new AbortController();
+// When a signal arrives, onTerm writes the authoritative 'killed' result and
+// owns the exit. `terminating` stops the normal-completion path (which the
+// aborted runLoop returns into within the same ~50ms window) from racing a
+// second writeResult onto the same file.
+let terminating = false;
 function onTerm(sig) {
+  terminating = true;
   ac.abort();
   loops.patchMeta(loopId, { status: 'killed', finishedAt: new Date().toISOString(), signal: sig }, cfgDir);
   loops.writeResult(loopId, { stoppedBy: 'kill', signal: sig }, cfgDir);
@@ -149,12 +155,17 @@ try {
     onIteration,
     signal: ac.signal,
   });
-  const finalStatus = result.stoppedBy === 'abort' ? 'killed' : 'completed';
-  loops.patchMeta(loopId, { status: finalStatus, finishedAt: new Date().toISOString() }, cfgDir);
-  loops.writeResult(loopId, result, cfgDir);
-  process.exit(0);
+  if (!terminating) {
+    const finalStatus = result.stoppedBy === 'abort' ? 'killed' : 'completed';
+    loops.patchMeta(loopId, { status: finalStatus, finishedAt: new Date().toISOString() }, cfgDir);
+    loops.writeResult(loopId, result, cfgDir);
+    process.exit(0);
+  }
+  // else: a signal is terminating us — onTerm wrote the result and owns exit.
 } catch (err) {
-  loops.patchMeta(loopId, { status: 'failed', finishedAt: new Date().toISOString() }, cfgDir);
-  loops.writeResult(loopId, { error: err?.message || String(err), stack: err?.stack }, cfgDir);
-  process.exit(1);
+  if (!terminating) {
+    loops.patchMeta(loopId, { status: 'failed', finishedAt: new Date().toISOString() }, cfgDir);
+    loops.writeResult(loopId, { error: err?.message || String(err), stack: err?.stack }, cfgDir);
+    process.exit(1);
+  }
 }

package/scripts/migrate-v5.mjs

@@ -20,7 +20,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
-import { openIndex, rebuild, indexSessionTurn, indexSkill, indexMemory } from '../mas/index_db.mjs';
+import { reindexAll } from '../mas/index_db.mjs';
 import { parseFrontmatter } from '../skills.mjs';
 
 function defaultConfigDir() {
@@ -96,67 +96,11 @@ function upgradeAllSkills(configDir) {
   return { upgraded: n };
 }
 
+// Rebuild + repopulate the FTS index. The walk now lives in index_db.reindexAll
+// (shared with the daemon POST /index/rebuild route) so a "rebuild" is always a
+// repopulate, never a silent zeroing.
 function rebuildIndex(configDir) {
-  rebuild(configDir);
-  openIndex(configDir);
-
-  // Sessions.
-  const sessDir = path.join(configDir, 'sessions');
-  if (fs.existsSync(sessDir)) {
-    for (const f of fs.readdirSync(sessDir)) {
-      if (!f.endsWith('.jsonl')) continue;
-      const id = f.slice(0, -'.jsonl'.length);
-      const raw = fs.readFileSync(path.join(sessDir, f), 'utf8');
-      let idx = 0;
-      for (const line of raw.split('\n')) {
-        if (!line) continue;
-        try {
-          const obj = JSON.parse(line);
-          indexSessionTurn({
-            session_id: id, turn_idx: idx++, role: obj.role || 'user',
-            ts: obj.ts || 0, content: obj.content || '',
-          }, configDir);
-        } catch { /* skip malformed */ }
-      }
-    }
-  }
-
-  // Skills.
-  const skillsDir = path.join(configDir, 'skills');
-  if (fs.existsSync(skillsDir)) {
-    for (const f of fs.readdirSync(skillsDir)) {
-      if (!f.endsWith('.md')) continue;
-      const name = f.slice(0, -'.md'.length);
-      const raw = fs.readFileSync(path.join(skillsDir, f), 'utf8');
-      const { meta, body } = parseFrontmatter(raw);
-      indexSkill({
-        skill_name: name,
-        trained_by: meta.trained_by || 'legacy',
-        group_name: meta.group || (name.includes('-') ? name.split('-')[0] : 'legacy'),
-        content: body,
-      }, configDir);
-    }
-  }
-
-  // Memory (core + episodic).
-  const memDir = path.join(configDir, 'memory');
-  if (fs.existsSync(memDir)) {
-    const corePath = path.join(memDir, 'core.md');
-    if (fs.existsSync(corePath)) {
-      indexMemory({ topic: 'core', kind: 'core',
-        content: fs.readFileSync(corePath, 'utf8') }, configDir);
-    }
-    const epi = path.join(memDir, 'episodic');
-    if (fs.existsSync(epi)) {
-      for (const f of fs.readdirSync(epi)) {
-        if (!f.endsWith('.md')) continue;
-        indexMemory({
-          topic: f.slice(0, -'.md'.length), kind: 'episodic',
-          content: fs.readFileSync(path.join(epi, f), 'utf8'),
-        }, configDir);
-      }
-    }
-  }
+  reindexAll(configDir);
 }
 
 export async function migrateV5(opts = {}) {

package/secure_write.mjs

@@ -0,0 +1,46 @@
+// secure_write.mjs — atomic file writes with owner-only (0600/0700) perms,
+// for files that hold secrets: config.json (plaintext API keys / auth
+// profiles), workflow state (transcript content), any .env the tool writes.
+//
+// Lifted from gateway/device_auth.mjs::writeAtomic: set restrictive modes on
+// create AND re-assert with chmod after rename, because the active umask can
+// clear bits at mkdir/open time and a pre-existing file keeps its old (looser)
+// mode otherwise. chmod is best-effort (a no-op / unsupported on some
+// filesystems and on Windows); the {mode} on write is the primary guard.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const SECURE_DIR_MODE = 0o700;
+export const SECURE_FILE_MODE = 0o600;
+
+function chmodQuiet(p, mode) {
+  try { fs.chmodSync(p, mode); } catch { /* unsupported FS / platform — mode on write stands */ }
+}
+
+export function writeTextSecure(filePath, text) {
+  const dir = path.dirname(filePath);
+  fs.mkdirSync(dir, { recursive: true, mode: SECURE_DIR_MODE });
+  chmodQuiet(dir, SECURE_DIR_MODE);
+  const tmp = `${filePath}.tmp`;
+  fs.writeFileSync(tmp, text, { mode: SECURE_FILE_MODE });
+  chmodQuiet(tmp, SECURE_FILE_MODE);
+  fs.renameSync(tmp, filePath);
+  chmodQuiet(filePath, SECURE_FILE_MODE);
+}
+
+export function writeJsonSecure(filePath, obj) {
+  writeTextSecure(filePath, JSON.stringify(obj, null, 2));
+}
+
+// Tighten an existing secrets file to 0600 if it is currently group/other
+// accessible. Best-effort + idempotent — used to migrate already-deployed
+// world-readable config.json the first time it is read. Returns true if it
+// changed the mode.
+export function tightenIfLoose(filePath) {
+  try {
+    const st = fs.statSync(filePath);
+    if ((st.mode & 0o077) !== 0) { fs.chmodSync(filePath, SECURE_FILE_MODE); return true; }
+  } catch { /* missing / unreadable → nothing to tighten */ }
+  return false;
+}

package/tui/modal_filter.mjs

@@ -0,0 +1,59 @@
+// tui/modal_filter.mjs — pure (react-free) primitives for the Ink modal
+// picker. Split out from modal_picker.mjs so the filtering / windowing /
+// pick-resolution logic is unit-testable without pulling in react + ink
+// (which are only present in the running TUI). modal_picker.mjs re-exports
+// these for back-compat.
+
+// Pure filter — prefix > substring > subsequence. Stable order within each
+// tier (original list order is the tiebreaker).
+//
+// `pinned` rows bypass the filter entirely and are always appended after
+// the matches. This keeps sentinel rows (e.g. "↻ fetch live models",
+// "… type a custom model id") on screen while the user types an id that
+// matches no listed model — the typed filter doubles as the custom-id
+// buffer for the free-text row.
+export function filterModalItems(query, items) {
+  const q = String(query || '').trim().toLowerCase();
+  const list = Array.isArray(items) ? items : [];
+  if (!q) return list.slice();
+  const prefix = [], substr = [], subseq = [], pinned = [];
+  for (const it of list) {
+    if (it && it.pinned) { pinned.push(it); continue; }
+    const hay = `${it.label || it.id || ''} ${it.desc || ''}`.toLowerCase();
+    if (hay.startsWith(q)) prefix.push(it);
+    else if (hay.includes(q)) substr.push(it);
+    else if (_isSubseq(q, hay)) subseq.push(it);
+  }
+  return [...prefix, ...substr, ...subseq, ...pinned];
+}
+
+function _isSubseq(needle, hay) {
+  let i = 0;
+  for (const ch of hay) {
+    if (ch === needle[i]) i++;
+    if (i === needle.length) return true;
+  }
+  return false;
+}
+
+// Pure window computation — slide a window of `maxRows` items so that
+// `selectedIndex` is always visible. Mirrors the pattern in
+// tui/slash_popup.mjs._computeWindow.
+export function _computeWindow(idx, total, maxRows) {
+  const n = Math.max(0, total);
+  const m = Math.max(1, maxRows);
+  if (n <= m) return { start: 0, end: n };
+  let start = Math.max(0, Math.min(n - m, idx - Math.floor(m / 2)));
+  return { start, end: start + m };
+}
+
+// Pure pick resolver — maps the highlighted row + current filter buffer to
+// what openPicker resolves with. A `freeText` row resolves to
+// `{ id, query }` so the caller can use the typed filter as a custom value
+// (e.g. an unlisted model id); every other row resolves to its plain id.
+// No selection resolves to null (caller treats as cancel).
+export function resolveModalPick(pickedItem, query) {
+  if (!pickedItem) return null;
+  if (pickedItem.freeText) return { id: pickedItem.id, query: String(query || '') };
+  return pickedItem.id;
+}