lazyclaw 6.0.0 → 6.1.0

package/daemon/routes/skills.mjs

@@ -0,0 +1,260 @@
+// Daemon route handlers (skills), extracted verbatim from makeHandler (D5).
+// Each handler takes the per-request dispatch context `c` and returns the
+// HTTP response. Bodies are unchanged; only the dispatch wrapper is new.
+import { fs, nodePath, PROVIDERS, PROVIDER_INFO, maskApiKey, costFromUsage, RATE_CARD_SHAPE, composeSystemPrompt, listSkills, loadSkill, skillPath, installSkill, removeSkill, parseFrontmatter, skillsDefaultConfigDir, indexDb, skillSynth, sandboxListBackends, summarizeState, listWorkflowSessions, loadWorkflowState, aggregateNodeStats, validateConfig, validateRates, fileExists, readJson, readTextBody, writeJson, writeSseHead, writeSse, statusForProviderError, checkCostCap, accumulateMetricsFromCost, resolveProvider } from './_deps.mjs';
+
+export async function skillsList(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // List installed skills with their first-line summary so a UI
+          // can render them without a follow-up read for each one.
+          // ?filter=<substr>&limit=<N> mirror the v3.33 CLI flags.
+          const cfgDir = ctx.sessionsDirGetter();
+          let items = listSkills(cfgDir);
+          const filter = url.searchParams.get('filter');
+          if (filter) {
+            const f = filter.toLowerCase();
+            items = items.filter(s => s.name.toLowerCase().includes(f));
+          }
+          const limitStr = url.searchParams.get('limit');
+          if (limitStr) {
+            const n = parseInt(limitStr, 10);
+            if (Number.isFinite(n) && n > 0) items = items.slice(0, n);
+          }
+          // v5: include frontmatter fields the dashboard renders as badges.
+          // listSkills() currently only surfaces name/summary/etc., so we
+          // re-parse the body once per skill to extract trained_by /
+          // confidence / cross_cli_tested / group. Cheap (markdown files,
+          // already cached by the OS).
+          const out = items.map((s) => {
+            let meta = {};
+            try {
+              const body = loadSkill(s.name, cfgDir);
+              meta = parseFrontmatter(body).meta || {};
+            } catch { /* unreadable → empty meta */ }
+            const xcli = meta.cross_cli_tested;
+            return {
+              name: s.name,
+              bytes: s.bytes,
+              summary: s.summary,
+              description: meta.description || s.description || '',
+              group: meta.group || '',
+              trained_by: meta.trained_by || (meta.created_by === 'agent' ? 'agent' : ''),
+              confidence: meta.confidence !== undefined && meta.confidence !== ''
+                ? Number(meta.confidence)
+                : null,
+              cross_cli_tested: xcli === 'true' || xcli === true ? true
+                : (Array.isArray(xcli) ? xcli : null),
+              version: meta.version || s.version || '',
+              created_by: meta.created_by || '',
+            };
+          });
+          return writeJson(res, 200, out);
+}
+
+export async function skillsSuggestions(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Ring buffer of nudge.suggest_skill events. Dashboard polls this
+          // since the SSE bus is deferred to v5.1.
+          return writeJson(res, 200, { suggestions: nudgeSuggestionsRing.slice(0, 20) });
+}
+
+export async function skillsSynth(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Body: { sessionId: '<id>' [, outcome] [, trainedBy] [, model] }
+          // Runs mas/skill_synth.synthesizeSkill against the named session.
+          // We assemble a minimal agent stub from cfg.provider/model and an
+          // empty role — the synth pipeline expects an agent object, but
+          // most callers will want "use my default provider".
+          let body;
+          try { body = await readJson(req); }
+          catch (e) { return writeJson(res, 400, { error: e?.message || String(e) }); }
+          const sessionId = body && String(body.sessionId || '').trim();
+          if (!sessionId) return writeJson(res, 400, { error: 'sessionId is required' });
+          const cfg = ctx.readConfig();
+          const provider = body.provider || cfg.provider;
+          const model = body.model || cfg.model;
+          if (!provider) return writeJson(res, 400, { error: 'no provider configured — set cfg.provider or pass body.provider' });
+          // Pull the session turns and build a minimal task shape.
+          let turns;
+          try { turns = ctx.sessionsMod.loadTurns(sessionId, gwConfigDir); }
+          catch (e) { return writeJson(res, 404, { error: `session not found: ${sessionId}` }); }
+          if (!Array.isArray(turns) || turns.length === 0) {
+            return writeJson(res, 400, { error: `session "${sessionId}" has no turns` });
+          }
+          const task = {
+            id: sessionId,
+            title: turns[0]?.content?.slice(0, 80) || sessionId,
+            turns: turns.map((t) => ({
+              agent: t.role === 'user' ? 'user' : (t.role === 'system' ? 'system' : 'assistant'),
+              text: String(t.content || ''),
+            })),
+          };
+          const agent = { provider, model, role: '' };
+          try {
+            const apiKey = cfg['api-key'] || null;
+            const result = await skillSynth.synthesizeSkill({
+              agent, task, apiKey,
+              outcome: body.outcome || 'done',
+              trainedBy: body.trainedBy || null,
+              trainedOnModel: model || null,
+            });
+            if (!result) return writeJson(res, 200, { ok: false, message: 'synth produced no skill (model returned NONE)' });
+            // Mirror the CLI synth flow: installSynthesized() handles slug
+            // reservation, agent-overwrite protection, and FTS5 mirror.
+            const install = skillSynth.installSynthesized({
+              name: result.name,
+              description: result.description,
+              body: result.body,
+              sourceTask: sessionId,
+              createdBy: 'agent',
+            }, gwConfigDir);
+            return writeJson(res, 200, {
+              ok: true,
+              name: install?.skill || result.name,
+              description: result.description,
+              path: install?.path || null,
+            });
+          } catch (e) {
+            return writeJson(res, 500, { error: e?.message || String(e), code: e?.code });
+          }
+}
+
+export async function skillsSearch(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Mirror of `lazyclaw skills search`. ?q=<query> required;
+          // ?regex=true switches to regex mode. Returns
+          //   { query, regex, matches: [{ name, bytes, matchCount, excerpt }] }
+          // — same shape the CLI prints. A dashboard skill picker can
+          // hit this endpoint instead of pulling every skill body and
+          // searching client-side.
+          const q = url.searchParams.get('q');
+          if (!q) return writeJson(res, 400, { error: 'missing q query parameter' });
+          const useRegex = url.searchParams.get('regex') === 'true';
+          let matcher;
+          if (useRegex) {
+            try { matcher = new RegExp(q, 'gi'); }
+            catch (e) { return writeJson(res, 400, { error: `invalid regex: ${e.message}` }); }
+          }
+          const cfgDir = ctx.sessionsDirGetter();
+          const items = listSkills(cfgDir);
+          const matches = [];
+          for (const s of items) {
+            let body;
+            try { body = loadSkill(s.name, cfgDir); } catch { continue; }
+            let matchCount = 0;
+            let firstExcerpt = null;
+            if (useRegex) {
+              for (const m of body.matchAll(matcher)) {
+                matchCount++;
+                if (firstExcerpt === null) {
+                  const pos = m.index ?? 0;
+                  const start = Math.max(0, pos - 40);
+                  const end = Math.min(body.length, pos + m[0].length + 40);
+                  firstExcerpt = (start > 0 ? '…' : '') + body.slice(start, end) + (end < body.length ? '…' : '');
+                }
+              }
+            } else {
+              const lower = body.toLowerCase();
+              const ql = q.toLowerCase();
+              let pos = 0;
+              while (true) {
+                const i = lower.indexOf(ql, pos);
+                if (i < 0) break;
+                matchCount++;
+                if (firstExcerpt === null) {
+                  const start = Math.max(0, i - 40);
+                  const end = Math.min(body.length, i + ql.length + 40);
+                  firstExcerpt = (start > 0 ? '…' : '') + body.slice(start, end) + (end < body.length ? '…' : '');
+                }
+                pos = i + ql.length;
+              }
+            }
+            if (matchCount > 0) {
+              matches.push({ name: s.name, bytes: s.bytes, matchCount, excerpt: firstExcerpt });
+            }
+          }
+          return writeJson(res, 200, { query: q, regex: useRegex, matches });
+}
+
+export async function skillGet(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // GET /skills/<name> — full markdown body as text/markdown.
+          // 404 when the file is missing so the caller can branch.
+          // 400 when the name fails skillPath validation (path traversal,
+          // dotfile, etc.) — same protections as the CLI.
+          // m13 — decodeURIComponent before validation (see PUT below).
+          let name;
+          try { name = decodeURIComponent(skillMatch[1]); }
+          catch { return writeJson(res, 400, { error: 'malformed skill name' }); }
+          try {
+            const cfgDir = ctx.sessionsDirGetter();
+            const file = skillPath(name, cfgDir);
+            if (!(await fileExists(file))) return writeJson(res, 404, { error: 'skill not found', name });
+            const body = loadSkill(name, cfgDir);
+            res.writeHead(200, {
+              'content-type': 'text/markdown; charset=utf-8',
+              'content-length': Buffer.byteLength(body),
+            });
+            return res.end(body);
+          } catch (err) {
+            return writeJson(res, 400, { error: err?.message || String(err) });
+          }
+}
+
+export async function skillPut(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // PUT /skills/<name>  body = markdown text
+          //   201 on first write, 200 on overwrite (caller can branch on
+          //   the status if they care about idempotency vs newness).
+          //   400 on invalid name (skillPath validation) or oversize body.
+          // m13 — decodeURIComponent the segment before validation so
+          // a request like `PUT /skills/foo%2Fbar` is rejected as a path-
+          // separator (slash) rather than letting the literal-percent
+          // filename slip through.
+          let name;
+          try { name = decodeURIComponent(skillMatch[1]); }
+          catch { return writeJson(res, 400, { error: 'malformed skill name' }); }
+          const cfgDir = ctx.sessionsDirGetter();
+          let priorExists = false;
+          try {
+            // Validate name before reading the body so a bogus name fails
+            // fast and we don't waste bandwidth.
+            const file = skillPath(name, cfgDir);
+            priorExists = await fileExists(file);
+          } catch (err) {
+            return writeJson(res, 400, { error: err?.message || String(err) });
+          }
+          let body;
+          try { body = await readTextBody(req); }
+          catch (err) { return writeJson(res, 400, { error: err?.message || String(err) }); }
+          try {
+            const written = installSkill(name, body, cfgDir);
+            return writeJson(res, priorExists ? 200 : 201, {
+              ok: true, name, path: written, bytes: body.length, replaced: priorExists,
+            });
+          } catch (err) {
+            return writeJson(res, 400, { error: err?.message || String(err) });
+          }
+}
+
+export async function skillDelete(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // DELETE /skills/<name>  idempotent: 200 whether the file
+          // existed or not, mirroring DELETE /sessions/<id>. The body
+          // reports `removed: true|false` so callers can branch when
+          // they care.
+          // m13 — decodeURIComponent before validation (see PUT below).
+          let name;
+          try { name = decodeURIComponent(skillMatch[1]); }
+          catch { return writeJson(res, 400, { error: 'malformed skill name' }); }
+          const cfgDir = ctx.sessionsDirGetter();
+          try {
+            const file = skillPath(name, cfgDir);
+            const existed = await fileExists(file);
+            removeSkill(name, cfgDir);
+            return writeJson(res, 200, { ok: true, name, removed: existed });
+          } catch (err) {
+            return writeJson(res, 400, { error: err?.message || String(err) });
+          }
+}
+

package/daemon/routes/workflows.mjs

@@ -0,0 +1,224 @@
+// Daemon route handlers (workflows), extracted verbatim from makeHandler (D5).
+// Each handler takes the per-request dispatch context `c` and returns the
+// HTTP response. Bodies are unchanged; only the dispatch wrapper is new.
+import { fs, nodePath, PROVIDERS, PROVIDER_INFO, maskApiKey, costFromUsage, RATE_CARD_SHAPE, composeSystemPrompt, listSkills, loadSkill, skillPath, installSkill, removeSkill, parseFrontmatter, skillsDefaultConfigDir, indexDb, skillSynth, sandboxListBackends, summarizeState, listWorkflowSessions, loadWorkflowState, aggregateNodeStats, validateConfig, validateRates, fileExists, readJson, readTextBody, writeJson, writeSseHead, writeSse, statusForProviderError, checkCostCap, accumulateMetricsFromCost, resolveProvider } from './_deps.mjs';
+
+export async function workflowsAggregate(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // Mirror of CLI v3.48 `lazyclaw inspect --aggregate`. Per-node
+          // statistics across every persisted session in the state
+          // directory. Answers "which node tends to be slow / fail
+          // across all my runs?" — needs no workflow file, just state.
+          // ?filter=<substr> applies before aggregation (v3.50).
+          const stateDir = ctx.workflowStateDir();
+          const qFilter = url.searchParams.get('filter');
+          const qNode = url.searchParams.get('node');
+          try {
+            const stats = aggregateNodeStats(stateDir, { filter: qFilter });
+            // ?node=<id>: drill into one node's cross-session stats
+            // (mirrors CLI v3.52 --aggregate --node). 404 when the
+            // node never appeared in any session.
+            if (qNode) {
+              const nodeStat = stats.nodeStats[qNode];
+              if (!nodeStat) {
+                return writeJson(res, 404, {
+                  error: 'node not found across sessions',
+                  nodeId: qNode,
+                  knownNodes: Object.keys(stats.nodeStats),
+                });
+              }
+              return writeJson(res, 200, {
+                dir: stateDir,
+                filter: qFilter || null,
+                sessionCount: stats.sessionCount,
+                nodeId: qNode,
+                ...nodeStat,
+              });
+            }
+            return writeJson(res, 200, { dir: stateDir, filter: qFilter || null, ...stats });
+          } catch (err) {
+            if (err?.code === 'ENOENT') {
+              return writeJson(res, 200, { dir: stateDir, filter: qFilter || null, sessionCount: 0, nodeStats: {} });
+            }
+            return writeJson(res, 500, { error: err?.message || String(err) });
+          }
+}
+
+export async function workflowsList(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // List every persisted workflow session in the configured
+          // state dir, newest activity first. Mirrors `lazyclaw inspect`
+          // (no-arg) exactly so a dashboard can use the same renderer
+          // for CLI and HTTP outputs. Per-node `nodes` map is omitted —
+          // call /workflows/<sessionId> for full detail.
+          //
+          // ?status=done|resumable|failed|running mirrors the CLI's
+          // --status flag — one shared predicate so a UI can paginate
+          // by bucket without pulling the full list.
+          const stateDir = ctx.workflowStateDir();
+          const qStatus = url.searchParams.get('status');
+          if (qStatus) {
+            const valid = new Set(['done', 'resumable', 'failed', 'running']);
+            if (!valid.has(qStatus)) {
+              return writeJson(res, 400, {
+                error: `invalid status: ${qStatus}`,
+                expected: [...valid],
+              });
+            }
+          }
+          try {
+            let sessions = listWorkflowSessions(stateDir);
+            if (qStatus) {
+              sessions = sessions.filter(s => {
+                if (qStatus === 'done')      return s.summary.done;
+                if (qStatus === 'resumable') return s.summary.resumable;
+                if (qStatus === 'failed')    return s.summary.failed > 0;
+                if (qStatus === 'running')   return s.summary.running > 0;
+                return true;
+              });
+            }
+            // ?filter=<substr>&limit=<N> mirror v3.33 sessions/skills list flags.
+            const qFilter = url.searchParams.get('filter');
+            if (qFilter) {
+              const f = qFilter.toLowerCase();
+              sessions = sessions.filter(s => s.sessionId.toLowerCase().includes(f));
+            }
+            const qLimit = url.searchParams.get('limit');
+            if (qLimit) {
+              const n = parseInt(qLimit, 10);
+              if (Number.isFinite(n) && n > 0) sessions = sessions.slice(0, n);
+            }
+            return writeJson(res, 200, { dir: stateDir, status: qStatus || null, sessions });
+          } catch (err) {
+            if (err?.code === 'ENOENT') {
+              // Empty dir is a valid state (no workflows ever ran). The
+              // CLI distinguishes "missing dir" from "empty dir" — the
+              // daemon collapses both to an empty array so a fresh
+              // process doesn't 404 a UI poll loop.
+              return writeJson(res, 200, { dir: stateDir, status: qStatus || null, sessions: [] });
+            }
+            return writeJson(res, 500, { error: err?.message || String(err) });
+          }
+}
+
+export async function workflowGet(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // GET /workflows/<sessionId> — full state of a single
+          // workflow run. Same shape as `lazyclaw inspect <id>` (the
+          // engine's persisted object plus a derived summary block).
+          // 404 when the state file is missing.
+          const sid = workflowMatch[1];
+          const stateDir = ctx.workflowStateDir();
+          let state;
+          try {
+            state = loadWorkflowState(sid, stateDir);
+          } catch (err) {
+            return writeJson(res, 500, { error: err?.message || String(err) });
+          }
+          if (!state) return writeJson(res, 404, { error: 'workflow not found', sessionId: sid });
+          // ?node=<id> drills into one node's state — same shape as
+          // `lazyclaw inspect <session> --node <id>` (v3.41). The
+          // HTTP status reflects the node's lifecycle (mirrors the
+          // CLI exit codes): 200 success/pending/running, 410 Gone
+          // for failed (request was valid, but the resource is in a
+          // failed state), 404 for unknown node id.
+          // ?slowest=<N>: top N nodes by durationMs. Same shape as
+          // CLI v3.44 — pure state-file analysis, no deps needed.
+          const qSlowest = url.searchParams.get('slowest');
+          if (qSlowest) {
+            const n = parseInt(qSlowest, 10);
+            if (!Number.isFinite(n) || n <= 0) {
+              return writeJson(res, 400, {
+                error: `slowest must be a positive integer (got ${JSON.stringify(qSlowest)})`,
+              });
+            }
+            const entries = Object.entries(state.nodes || {}).map(([id, ns]) => ({
+              id,
+              status: ns?.status || 'pending',
+              durationMs: Number.isFinite(ns?.durationMs) ? ns.durationMs : 0,
+              attempts: ns?.attempts ?? 0,
+            }));
+            entries.sort((a, b) => (b.durationMs - a.durationMs) || a.id.localeCompare(b.id));
+            return writeJson(res, 200, {
+              sessionId: state.sessionId,
+              top: entries.slice(0, n),
+            });
+          }
+          const qNode = url.searchParams.get('node');
+          if (qNode) {
+            const ns = state.nodes?.[qNode];
+            if (!ns) {
+              return writeJson(res, 404, {
+                error: 'node not found',
+                sessionId: sid,
+                nodeId: qNode,
+                knownNodes: Object.keys(state.nodes || {}),
+              });
+            }
+            return writeJson(res, ns.status === 'failed' ? 410 : 200, {
+              sessionId: state.sessionId,
+              nodeId: qNode,
+              ...ns,
+            });
+          }
+          const { summary, failedNodes } = summarizeState(state);
+          // ?summary=true trims the per-node `nodes` map and `order`
+          // array, matching v3.17's CLI `inspect --summary` shape and
+          // the per-session shape that list-mode produces. A UI fetching
+          // this endpoint to render a status badge doesn't want the
+          // full per-node payload — `?summary=true` keeps the wire
+          // small for high-frequency polls.
+          const compact = url.searchParams.get('summary') === 'true';
+          const body = compact
+            ? {
+                sessionId: state.sessionId,
+                dir: stateDir,
+                summary,
+                failedNodes,
+                startedAt: state.startedAt,
+                updatedAt: state.updatedAt,
+              }
+            : {
+                sessionId: state.sessionId,
+                dir: stateDir,
+                summary,
+                failedNodes,
+                order: state.order,
+                nodes: state.nodes,
+                startedAt: state.startedAt,
+                updatedAt: state.updatedAt,
+              };
+          return writeJson(res, 200, body);
+}
+
+export async function workflowDelete(c) {
+  const { ctx, logger, metrics, gateway, costCap, cachedByName, gwConfigDir, nudgeSuggestionsRing, workflowStateDir, req, res, method, path, route, url, sessionMatch, providerMatch, providerTestMatch, sessionExportMatch, skillMatch, workflowMatch, configKeyMatch, ratesKeyMatch } = c;
+          // DELETE /workflows/<sessionId> — idempotent: 200 with
+          // `removed: true|false`. Same protection as the rest of the
+          // delete routes — only files inside the configured state dir
+          // are touched. The path matcher already rejects `..` and `/`,
+          // and we re-resolve via path.join so a sessionId that resolves
+          // outside the dir is rejected with 400.
+          const sid = workflowMatch[1];
+          const stateDir = ctx.workflowStateDir();
+          // Note: `path` is shadowed inside this handler by the URL path
+          // variable above — use `nodePath` (aliased import) for fs ops.
+          const file = nodePath.join(stateDir, `${sid}.json`);
+          // Confined-path check: file must resolve under stateDir. fs.realpathSync
+          // would resolve symlinks too, but the dir may not exist yet — use
+          // the resolved string-prefix check, which is enough since stateDir
+          // is operator-controlled.
+          const resolvedDir = nodePath.resolve(stateDir);
+          const resolvedFile = nodePath.resolve(file);
+          if (!resolvedFile.startsWith(resolvedDir + nodePath.sep) && resolvedFile !== resolvedDir) {
+            return writeJson(res, 400, { error: 'invalid sessionId' });
+          }
+          try {
+            const existed = fs.existsSync(resolvedFile);
+            if (existed) fs.unlinkSync(resolvedFile);
+            return writeJson(res, 200, { ok: true, sessionId: sid, removed: existed });
+          } catch (err) {
+            return writeJson(res, 500, { error: err?.message || String(err) });
+          }
+}
+

package/dotenv_min.mjs

@@ -0,0 +1,51 @@
+// dotenv_min.mjs — minimal .env loader shared by the CLI and the Ink slash
+// dispatcher. Loads <cfgDir>/.env into process.env (without overwriting
+// already-set vars) so Slack / provider tokens are available. Extracted from
+// cli.mjs `_loadDotenvIfAny` so the /task Slack-close flow can reuse it.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { writeTextSecure } from './secure_write.mjs';
+
+export function loadDotenvIfAny(cfgDir) {
+  const p = path.join(cfgDir, '.env');
+  if (!fs.existsSync(p)) return { path: p, loaded: 0 };
+  let loaded = 0;
+  const raw = fs.readFileSync(p, 'utf8');
+  for (const line of raw.split(/\r?\n/)) {
+    if (!line || line.trimStart().startsWith('#')) continue;
+    const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.*)$/);
+    if (!m) continue;
+    let val = m[2].trim();
+    if (val.length >= 2 && val.startsWith('"') && val.endsWith('"')) val = val.slice(1, -1);
+    if (process.env[m[1]] === undefined) { process.env[m[1]] = val; loaded++; }
+  }
+  return { path: p, loaded };
+}
+
+// Read-merge-write <cfgDir>/.env at 0600. Existing keys are preserved;
+// keys present in `vars` are overwritten. Values are written verbatim
+// (no quoting) — callers pass already-trimmed strings. Returns the path.
+// Mirror of loadDotenvIfAny so .env read + write live together.
+export function writeDotenvMerge(cfgDir, vars) {
+  const p = path.join(cfgDir, '.env');
+  const lines = [];
+  const seen = new Set();
+  const existing = fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : '';
+  for (const line of existing.split(/\r?\n/)) {
+    const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=/);
+    if (m && Object.prototype.hasOwnProperty.call(vars, m[1])) {
+      seen.add(m[1]);
+      lines.push(`${m[1]}=${vars[m[1]]}`);
+    } else {
+      lines.push(line);
+    }
+  }
+  for (const [k, v] of Object.entries(vars)) {
+    if (!seen.has(k)) lines.push(`${k}=${v}`);
+  }
+  let text = lines.join('\n').replace(/\n+$/, '');
+  if (text) text += '\n';
+  writeTextSecure(p, text);
+  return p;
+}

package/first_run.mjs

@@ -0,0 +1,24 @@
+// first_run.mjs — decide what onboarding the chat entrypoint runs.
+//
+//   'setup' — genuine fresh install (no provider, interactive): run the full
+//             5-step guided setup (provider+model, workspace, skills) instead
+//             of only the provider picker the Ink path used to run.
+//   'pick'  — explicit `chat --pick`: just re-pick provider/model.
+//   'none'  — provider already configured, or non-interactive (automation).
+//
+// Pure so it unit-tests without a TTY.
+export function firstRunMode({ hasProvider, flagPick, isTTY }) {
+  if (!isTTY) return 'none';
+  if (flagPick) return 'pick';
+  if (!hasProvider) return 'setup';
+  return 'none';
+}
+
+// A blank or 'mock' provider is a placeholder, not a real configured choice:
+// the mock provider returns canned replies and v5.3.2 stopped treating it as a
+// usable default. Treat both as "not configured" so the very first run always
+// lands in setup, and only a genuine saved provider skips it afterwards.
+const PLACEHOLDER_PROVIDERS = new Set(['', 'mock']);
+export function hasConfiguredProvider(provider) {
+  return !PLACEHOLDER_PROVIDERS.has(String(provider ?? '').trim().toLowerCase());
+}

package/goals_cron.mjs

@@ -0,0 +1,37 @@
+// goals_cron.mjs — attach/detach a cron schedule to a goal.
+//
+// Extracted from cli.mjs (_attachGoalCron / _detachGoalCron) so the Ink
+// /goal slash can actually schedule (and unschedule) a goal instead of just
+// recording the cron string and telling the user to re-run from the CLI.
+// Dependency-injected on readConfig / writeConfig and the cron module so the
+// core unit-tests with a fake cron and no real launchd/crontab writes.
+// `LAZYCLAW_SKIP_CRON_INSTALL` skips the backend install (config still written).
+
+export async function attachGoalCron({ readConfig, writeConfig, cron, name, schedule }) {
+  cron.parseCronSpec(schedule); // validate before touching state
+  const cfg = readConfig();
+  const jobName = `goal-${name}`;
+  const cmd = ['lazyclaw', 'goal', 'tick', name];
+  cron.upsertJob(cfg, jobName, schedule, cmd);
+  writeConfig(cfg);
+  if (process.env.LAZYCLAW_SKIP_CRON_INSTALL) return { jobName, skipped: true };
+  const backend = cron.pickBackend();
+  if (backend === 'launchd') cron.installLaunchdJob(jobName, schedule, cmd);
+  else cron.installCrontabJob(jobName, schedule, cmd);
+  return { jobName, skipped: false };
+}
+
+export async function detachGoalCron({ readConfig, writeConfig, cron, name }) {
+  const cfg = readConfig();
+  const jobName = `goal-${name}`;
+  if (!cfg.cron || !cfg.cron[jobName]) return false;
+  cron.removeJob(cfg, jobName);
+  writeConfig(cfg);
+  if (process.env.LAZYCLAW_SKIP_CRON_INSTALL) return true;
+  const backend = cron.pickBackend();
+  try {
+    if (backend === 'launchd') cron.uninstallLaunchdJob(jobName);
+    else cron.uninstallCrontabJob(jobName);
+  } catch { /* best-effort — cron sync recovers */ }
+  return true;
+}