lazyclaw 6.0.1 → 6.1.0

package/README.ko.md

@@ -1,44 +1,107 @@
 # lazyclaw (한국어 안내)
 
-> 영문 정본은 `README.md`. 본 문서는 핵심만 한국어로 안내한다.
+> 영문 정본은 [`README.md`](./README.md). 본 문서는 핵심만 한국어로.
 
-## 설치
+**터미널 에이전트 — 학습은 네 Claude 구독으로 $0, 응답은 모든 채널로.**
+
+터미널에서 대화하면 백그라운드 학습 루프가 대화를 재사용 가능한 스킬로 증류(claude-cli 구독 = API 청구 없음). Slack·Telegram·Discord·Matrix·Email·Signal·WhatsApp·Voice 연결. 어려운 작업은 planner + workers로 분산. 작고 읽을 수 있는 Node 코어.
+
+## 빠른 시작
+
+```bash
+npm install -g lazyclaw     # 또는: npx lazyclaw
+lazyclaw                    # 새 설치 → 가이드 셋업 후 chat
+```
+
+**첫 실행 = phased 위저드** (Hermes식 — 깔끔한 대화 1개 먼저, 그 다음 레이어링):
+1. **Provider + model** — 화살표 picker (`claude-cli`는 키 불요)
+2. **Verify** — 1-토큰 ping으로 응답 확인
+3. **Context window** — 턴당 유지할 히스토리 (선택)
+4. **Channel** — Slack/Telegram/Matrix/HTTP 빌트인, 나머지는 플러그인 (선택)
+5. **Workspace / skills / webhook** (선택)
+6. **Orchestration** — planner + workers 켜기 (선택)
+
+언제든 `lazyclaw setup` 또는 chat에서 `/config`로 재실행.
+
+## $0 자가 학습
+
+`provider`(chat)와 `trainer`(학습 루프)를 분리. Claude Pro/Max 구독이 학습을 돌리는 동안 chat은 아무 backend나. 매 턴 후 fire-and-forget 루프가 trajectory 기록 + 스킬 증류(`trained_by` 태그). `trainer: { provider: "auto" }`면 claude-cli 세션 자동 감지 → **$0**.
+
+```jsonc
+{ "provider": "openai", "model": "gpt-4.1",
+  "trainer": { "provider": "auto" } }   // 학습은 네 Claude 구독으로 $0
+```
+
+## 어디서나 대화
+
+모든 리스너는 상시 데몬의 **공유 세션 스토어**로 forward → chat·대시보드·전 채널이 메모리 하나를 쓰는 단일 에이전트(컨텍스트가 채널 간 따라옴).
+
+```bash
+lazyclaw service install                         # 1) 상시 데몬(공유 brain)
+
+# 2) 리스너를 데몬에 연결 (Slack Socket Mode: .env에 SLACK_BOT_TOKEN + SLACK_APP_TOKEN)
+lazyclaw slack listen                            # inbound를 데몬으로 forward, 스레드 응답
+lazyclaw slack listen --provider orchestrator    # …오케스트레이션 응답
+lazyclaw slack listen --daemon-url http://127.0.0.1:19600   # 비기본 데몬
+lazyclaw channels                                # 설정된 채널 보기
+lazyclaw channels enable|disable slack
+```
+
+리스너는 thin forwarder: 채널 소켓을 소유(Slack Socket Mode는 공개 URL 불요, app-level `xapp-` 토큰)하고 각 메시지를 데몬 `/inbound`로 POST → 데몬이 영속 세션에 바인딩 후 provider 실행. **데몬이 떠 있어야 함**(`lazyclaw service install` 또는 `lazyclaw daemon`); 타깃은 `--daemon-url`/`LAZYCLAW_DAEMON_URL`로 override. 위저드 채널 단계나 chat `/channels`로 설정.
+
+## 상시 가동 (always-on)
+
+**한 프로세스, 모든 채널:** `lazyclaw gateway` = 데몬 코어 + 설정된 채널 transport(Slack Socket Mode/Telegram long-poll/Matrix sync)를 단일 프로세스로. 채널이 in-process라 `/handoff`가 타깃 채널에 resume 마커 통지 가능(통지 실패 시 handoff 롤백).
 
 ```bash
-npm install -g lazyclaw
+lazyclaw gateway                          # 데몬 코어 + 활성 채널 전부, 한 프로세스
+lazyclaw gateway --channels slack         # 채널 명시
+lazyclaw service install gateway          # 재부팅에도 살아있게
 ```
 
-Node.js 18+ 필요. `better-sqlite3` native dep 가 빌드된다
-(darwin/linux/win64 × x64/arm64 prebuilt 제공).
+gateway는 **기본 인증** — 첫 실행 시 bearer 토큰을 만들어 `~/.lazyclaw/gateway.token`(0600, 로그 안 남김)에 영속. 자기 채널은 자동 사용, 외부 호출자는 파일에서 읽음(`--auth-token`/`--no-auth`로 override).
+
+분리 실행도 가능: 데몬만(`lazyclaw service install`) + 채널별 `* listen` forwarder.
 
-## 첫 실행
+인바운드 메시지는 **idempotent** — 채널 native id(Slack `channel:ts`, Telegram `chat:message_id`, Matrix `event_id`)로 dedup, 재전송/리스너 재시작 replay는 기록된 응답 반환(provider 재실행 없음). 세션 바인딩된 채널 턴은 chat REPL과 동일한 post-task **학습 루프**에 공급(trainer `auto` → Claude 구독 $0).
+
+> ⚠️ `security.allowUnattendedSensitive=true`이면 채널 리스너/데몬이 **부팅 거부** — 이 플래그는 모든 inbound에 대해 fail-closed tool 승인 게이트를 우회하므로 상시 표면 + 이 플래그 = RCE 경로. 민감 tool 승인은 인터랙티브로 유지.
+
+## 멀티 에이전트 오케스트레이션
+
+provider를 `orchestrator`로 → **Plan → Delegate → Synthesise**. planner가 분해, workers가 병렬 실행, planner가 병합.
 
 ```bash
-lazyclaw                  # 인터랙티브 splash + REPL
-lazyclaw migrate v5       # v4 install 이 있는 경우
+lazyclaw orchestrator set-planner claude-cli:claude-sonnet-4-6
+lazyclaw orchestrator workers add claude-cli:claude-sonnet-4-6
+lazyclaw orchestrator on
 ```
 
-## v5.0 핵심 변경
+chat에서 `/orchestrator` (빈 입력 = on/off picker) 또는 `/orchestrator on|off|planner <spec>|worker add <spec>`.
 
-- **Trainer provider 분리** — `provider` (chat) 와 `trainer`
-  (skill synthesis) 를 독립 설정. Claude Pro/Max 사용자는 학습 비용
-  $0 (`docs/trainer-recipes.md`).
-- **FTS5 recall** — `~/.lazyclaw/index.db` 단일 SQLite + FTS5 corpus.
-  cross-CLI trajectory recall 제공 (`lazyclaw recall <query>`).
-- **Persona 7-layer compose** — workspace 별 SOUL.md, Hermes skin
-  import (`docs/persona-cookbook.md`).
-- **Sandbox 6-backend** — local / docker / ssh / singularity / modal
-  / daytona.
+## chat에서 직접 조작 (슬래시)
 
-## 마이그레이션
+| 슬래시 | 기능 |
+|---|---|
+| `/config` | chat 나가고 setup 위저드 재실행 |
+| `/provider` · `/model` | 검색 picker로 provider/model 선택 |
+| `/channels [<name> on\|off]` | 채널 보기 / 토글 |
+| `/orchestrator [on\|off\|…]` | 멀티에이전트 보기 / 토글 (빈 입력=picker) |
+| `/context [turns N\|tokens N]` | 히스토리 윈도우 조절 |
+| `/skill` · `/personality` · `/memory` · `/loop` · `/goal` | 스킬·페르소나·메모리·루프·목표 |
 
-자세한 절차는 `docs/migration-v4-to-v5.md` 참고.
+`/help`로 전체 목록. 고스트 자동완성, 한글 IME는 박스 안에서 조합.
 
-## 자주 쓰는 명령
+## 대시보드
 
 ```bash
-lazyclaw recall "<query>"             # FTS5 검색
-lazyclaw rates --trainer-only         # trainer 비용 추적
-lazyclaw persona use <name>           # persona 활성화
-lazyclaw-export --format openai-ft    # trajectory export
+lazyclaw dashboard          # http://127.0.0.1:19600 로컬 웹 UI (17 탭, 다크 앰버)
 ```
+
+## 설정 / 보안
+
+설정은 `~/.lazyclaw/config.json`(plain JSON), 시크릿은 `~/.lazyclaw/.env`(0600, 로그 안 남김). 디렉터리 이동 `LAZYCLAW_CONFIG_DIR=/path`.
+
+> ⚠️ `config.json`은 shell rc처럼 신뢰 코드 — `$(...)` 값은 로드 시 실행됨. 신뢰 못 할 스니펫 붙여넣기 금지. 민감 tool(shell/write/network)은 기본 fail-closed(승인 hook 필요).
+
+Node 18+ (Slack Socket Mode는 22+). macOS / Linux / WSL 1급.

package/README.md

@@ -1,268 +1,199 @@
 # lazyclaw
 
-<img src="docs/assets/sleepy-sloth-source.png" alt="lazyclaw sloth" width="120" align="right">
+**A terminal agent that learns on your Claude subscription — for $0 — and reaches you on every channel.**
 
-**A terminal agent whose learning loop runs free on your Claude Pro subscription.**
-
-Chat with any provider. Train the skill bank, user model, and reflection pass on `claude-cli` — $0. One SQLite + FTS5 store remembers every session. Hand the same conversation off between TUI, Slack, Discord, Telegram, Matrix, Email, and Voice.
+Chat in the terminal. Let the background learning loop distil your conversations into reusable skills on `claude-cli` (your Pro/Max subscription — no API bill). Wire it to Slack, Telegram, Discord, Matrix, Email, Signal, WhatsApp, or Voice. Fan a hard task out to a planner + workers. One small, auditable Node core — no daemon you can't read.
 
 [![npm](https://img.shields.io/npm/v/lazyclaw.svg)](https://www.npmjs.com/package/lazyclaw)
 [![Node](https://img.shields.io/badge/node-%E2%89%A518-blue.svg)](https://nodejs.org/)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 
 ```bash
-npx lazyclaw onboard   # 15 seconds to a working CLI
+npx lazyclaw          # first run walks you through setup, then drops into chat
 ```
 
-<img src="docs/screenshots/help.png" alt="lazyclaw subcommand reference" width="820">
+<img width="1871" height="1146" alt="image" src="https://github.com/user-attachments/assets/365d05ac-cd24-4451-96b1-01fe82582a2b" />
 
 *한국어: [README.ko.md](./README.ko.md)*
 
 ---
 
-## Why lazyclaw
-
-Four things no other terminal agent CLI does together:
+## What it is
 
-1. **Split chat and trainer providers.** Pay-per-token for chat, $0 subscription for the learning loop. Or vice versa.
-2. **Recall across every CLI.** One FTS5 index over sessions, skills, trajectories, and memory.
-3. **Cross-channel handoff.** `/handoff slack <channel-id>` moves the live conversation; context follows.
-4. **Six sandbox backends, one API.** `local` / `docker` / `ssh` / `singularity` / `modal` / `daytona`.
+lazyclaw is a single-binary-feel Node CLI in the "claw" family (Hermes → OpenClaw → nanoclaw). It is **TUI-first**: `lazyclaw` with no arguments opens a chat REPL with a sloth splash, slash commands, and ghost-text autocomplete. Underneath, every turn feeds a learning loop, and the same agent answers from any messaging channel you connect.
 
-## What's new in 5.0.x
+You can read the whole thing. No hosted service, no telemetry, config in plain JSON at `~/.lazyclaw/`, secrets in `~/.lazyclaw/.env` (0600).
 
-The 5.0.3 → 5.0.9 maintenance line is mostly a launcher and splash overhaul. `lazyclaw` with no arguments now drops you straight into chat — the arrow-key picker has moved to `lazyclaw menu`. The splash itself is responsive: a Larry-3D gradient wordmark, braille-rendered sloth hero, a tool catalog driven by `mas/tools/registry.mjs` (no more hand-edited lists), grouped skills, and a Hermes-style status bar that auto-collapses to a single column on narrow terminals.
+## Quick start
 
-Per-release notes live in [CHANGELOG.md](./CHANGELOG.md).
+```bash
+npm install -g lazyclaw     # or: npx lazyclaw
+lazyclaw                    # fresh install → guided setup, then chat
+```
 
-## Known limitations (v5.1 roadmap)
+The first run is a **phased wizard** (Hermes-style — get one clean chat working first, then layer the rest):
 
-Calibrate expectations before reading the rest:
+1. **Provider + model** — arrow-key picker (`claude-cli` is keyless; gemini/openai/anthropic take an API key).
+2. **Verify** — a one-token ping confirms the provider answers.
+3. **Context window** — how much history to keep per turn (optional).
+4. **Channel** — Slack / Telegram / Matrix / HTTP built in; Discord / Email / Signal / Voice / WhatsApp via plugins (optional).
+5. **Workspace / skills / webhook** (optional).
+6. **Orchestration** — turn on the planner + workers pipeline (optional).
 
-- Recall today is reachable via `lazyclaw loop --recall "<query>" ...` and `lazyclaw goal ... --recall "<query>"`; the `/recall` slash command and top-level `lazyclaw recall ...` CLI shape both ship in v5.1.
-- `lazyclaw sandbox` exposes `list | test | add | use`; the `sandbox run --backend ...` shape lands in v5.1.
-- `codex-cli` and `gemini-cli` provider modules are tracked but not yet registered in the main runtime.
-- The E2E matrix in `tests/e2e/phaseH-e2e-matrix.spec.ts` still has a number of flows marked `test.skip` pending v5.1 wiring; the min-green-set is documented at the top of that file.
+Re-run it any time with `lazyclaw setup`, or `/config` from inside chat.
 
-## Install
+<img src="docs/screenshots/onboard.png" alt="lazyclaw provider picker" width="680">
 
-```bash
-# Try it (no install)
-npx lazyclaw onboard && lazyclaw chat
+## $0 self-learning
 
-# Keep it
-npm install -g lazyclaw
+lazyclaw splits two provider slots: **`provider`** (chat — the hot path) and **`trainer`** (the learning loop — skill synthesis, reflection, the user model). They are independent, so a Claude Pro/Max subscription can power the learning while chat runs anywhere — or both run on one backend.
 
-# Hack on it
-git clone https://github.com/cmblir/lazyclaw && cd lazyclaw
-npm install && npm link
-```
+After every turn, a fire-and-forget loop records the trajectory and distils reusable skills, tagged `trained_by`. With `trainer: { provider: "auto" }` it auto-detects your `claude-cli` session and runs the loop for free; otherwise it mirrors the chat provider.
 
-```bash
-lazyclaw version
+```jsonc
+// ~/.lazyclaw/config.json
+{
+  "provider": "openai",            // chat: pay-per-token (or claude-cli, ollama, …)
+  "model": "gpt-4.1",
+  "trainer": { "provider": "auto" }  // learning: $0 on your Claude subscription
+}
 ```
 
-Output reports the current installed version, Node version, and platform. See [CHANGELOG.md](./CHANGELOG.md) for release notes.
+| Setup | `provider` | `trainer` | Cost |
+|---|---|---|---|
+| Subscription only | `claude-cli` | `auto` | **$0** |
+| Hybrid (recommended) | `openai` / any | `auto` | chat only |
+| Pure API | `openai` / any | `openai` | both metered |
 
-Requires **Node 18+**. macOS / Linux / WSL are first-class. Native PowerShell runs but ghost-text and the ANSI banner fall back to plain prompts.
+## Talk to it anywhere
 
-## First run
+Connect a channel and **the same agent** answers there — every listener forwards into the always-on daemon's shared session store, so chat, the dashboard, and all channels are one agent with one memory (and context follows across channels). Slack, Telegram, Matrix, and HTTP are built in; Discord, Email, Signal, Voice, and WhatsApp install as `@lazyclaw/channel-*` plugins.
 
 ```bash
-lazyclaw onboard         # arrow-key picker; defaults to claude-cli (no key)
-# → writes ~/.lazyclaw/config.json
-```
+lazyclaw service install              # 1) the always-on daemon (the shared brain)
 
-<img src="docs/screenshots/onboard.png" alt="lazyclaw onboard --non-interactive" width="720">
+# 2) point a listener at it (Slack Socket Mode: SLACK_BOT_TOKEN + SLACK_APP_TOKEN in ~/.lazyclaw/.env)
+lazyclaw slack listen                 # forwards inbound to the daemon, replies in-thread
+lazyclaw slack listen --provider orchestrator   # …and orchestrate the reply
+lazyclaw slack listen --daemon-url http://127.0.0.1:19600   # non-default daemon
 
-```bash
-lazyclaw                 # no-arg → chat (since v5.0.6)
-lazyclaw menu            # arrow-key launcher (formerly the no-arg default)
-lazyclaw status          # → { provider, model, hasApiKey }
-lazyclaw doctor          # validates config + provider registry + index.db
+lazyclaw channels                     # view configured channels
+lazyclaw channels enable|disable slack
+lazyclaw channels install @lazyclaw/channel-discord
 ```
 
-Move the config dir with `LAZYCLAW_CONFIG_DIR=/elsewhere`. For automation, add `--non-interactive --provider X --model Y [--api-key Z]`.
+A listener is a thin forwarder: it owns the channel socket (Slack Socket Mode needs no public URL, just an app-level `xapp-` token) and POSTs each message to the daemon's `/inbound`, which binds the conversation to a persistent session and runs the provider. It needs a reachable daemon (`lazyclaw service install`, or `lazyclaw daemon`); override the target with `--daemon-url` / `LAZYCLAW_DAEMON_URL`. Set it all up from the wizard's channel step, or `/channels` in chat.
 
-## The trainer split — $0 learning on your Claude Pro subscription
+## Run it always-on
 
-v5 separates two provider slots in your config: `provider` (chat — the hot path) and `trainer.provider` (skill synthesis, user-model updates, reflection — bursty, cheap). They are wired independently, so a Pro/Max subscription can power the learning loop while chat runs through any provider, paid or local. lazyclaw is the **only** terminal agent CLI that splits these two roles.
+**One process, every channel:** `lazyclaw gateway` runs the daemon core *and* your configured channel transports (Slack Socket Mode / Telegram long-poll / Matrix sync) in a single process — and because the channels live in-process, `/handoff` can notify the target channel with a resume marker (a failed notify rolls the handoff back).
 
-```jsonc
-// ~/.lazyclaw/config.json
-{
-  "provider": "openai",                  // chat: pay-per-token
-  "model": "gpt-4.1",
-  "trainer": {
-    "provider": "claude-cli",            // trainer: $0 on Pro/Max
-    "model": "claude-haiku-4-5",
-    "schedule": "nightly",
-    "budget": { "maxCallsPerDay": 200, "usdPerDay": 0.50 }
-  }
-}
+```bash
+lazyclaw gateway                          # daemon core + every enabled channel, one process
+lazyclaw gateway --channels slack         # explicit channel set
+lazyclaw service install gateway          # …and keep it alive across reboots
 ```
 
-The canonical default is `trainer.provider = "auto"` — resolves to `claude-cli` when a Pro/Max session is detected, else mirrors the chat provider.
+The gateway is **authenticated by default**: it mints a bearer token on first run and persists it to `~/.lazyclaw/gateway.token` (0600, never logged). Its own channels use it automatically; external callers read it from the file (`--auth-token`/`--no-auth` to override).
 
-**Three configs covering the common cases:**
+Or run pieces separately: the daemon is the agent core — one provider path and one session/memory store on `127.0.0.1` — and `* listen` commands are standalone single-channel forwarders.
 
-| Setup | `provider` | `trainer.provider` | Cost |
-|---|---|---|---|
-| Subscription only | `claude-cli` | `claude-cli` | $0 |
-| Hybrid (recommended) | `openai` / any | `claude-cli` | chat-only |
-| Pure API | `openai` / any | `openai` / any | both metered |
+```bash
+lazyclaw service install                 # daemon only: launchd (macOS) · systemd user unit (Linux) · pidfile fallback
+lazyclaw service status
+lazyclaw service uninstall
+```
 
-Full JSONC examples and the `auto` resolution rules: [docs/trainer-recipes.md](./docs/trainer-recipes.md).
+The backend is auto-detected (override with `--backend launchd|systemd|fallback`); flags pass through, e.g. `lazyclaw service install gateway --port 19600 --auth-token "$TOK" --channels slack`.
 
-## Provider matrix
+Inbound channel messages are **idempotent**: each message's native id (Slack `channel:ts`, Telegram `chat:message_id`, Matrix `event_id`) is deduplicated by the daemon — a redelivery or listener-restart replay returns the recorded reply instead of running the provider twice. And every session-bound channel turn feeds the same post-task **learning loop** as the chat REPL (trainer `auto` → your Claude subscription, $0).
 
-| Chat provider | Trainer provider | Auth |
-|---|---|---|
-| `claude-cli` | `claude-cli` | subscription (Pro/Max) |
-| `anthropic` | `anthropic` | API key |
-| `openai` | `openai` | API key |
-| `gemini` | `gemini` | API key |
-| `ollama` | `ollama` | local (no key) |
-| `nim` / `openrouter` / `groq` / `together` / `xai` / `deepseek` / `mistral` / `fireworks` | — | API key (OpenAI-compatible) |
+> [!NOTE]
+> A channel listener or the daemon refuses to start while `security.allowUnattendedSensitive=true` — that flag bypasses the fail-closed tool-approval gate for *every* inbound message, so an always-on surface plus that flag is a remote-code-execution path. Keep sensitive-tool approval interactive.
 
-Plus two meta-providers, usable in either slot:
-- `orchestrator` — composes any of the above into a multi-agent pipeline ([docs/multi-agent.md](./docs/multi-agent.md))
-- `custom` — any OpenAI-compatible v1 endpoint with your own base URL + key
+## Multi-agent orchestration
 
-<img src="docs/screenshots/providers.png" alt="lazyclaw providers info — model list + capabilities" width="720">
+Set the provider to `orchestrator` and a hard request becomes **Plan → Delegate → Synthesise**: a planner decomposes the task, workers run the subtasks in parallel, then the planner merges the results. Workers are real agents with the tool registry.
 
-## What it ships
+```bash
+lazyclaw orchestrator set-planner claude-cli:claude-sonnet-4-6
+lazyclaw orchestrator workers add claude-cli:claude-sonnet-4-6
+lazyclaw orchestrator on            # route chats through the pipeline
+```
 
-### Tool registry — 12 categories plus MCP
+From chat: `/orchestrator` opens an on/off picker, or `/orchestrator on|off|planner <spec>|worker add <spec>`. Details: [docs/multi-agent.md](./docs/multi-agent.md).
 
-A single registry (`mas/tools/registry.mjs`) aggregates every first-party tool across twelve categories:
+## Drive it from chat
 
-`agents` · `browser` · `coding` · `exec` · `fs` · `git` · `iot` · `learning` · `media` · `net` · `os` · `scheduling`
+The REPL has slash commands for everything you'd otherwise edit config for — point-and-pick, no JSON:
 
-Tools flagged `sensitive: true` (writes, network egress, shell exec, sensitive git ops) route through an approval hook before execution. The splash renderer, the agent toolset resolver, and the runtime all read from the same registry, so a new tool group lights up everywhere at once. External servers extend the registry over stdio MCP.
+| Slash | Does |
+|---|---|
+| `/config` | leave chat and re-run the setup wizard |
+| `/provider` · `/model` | pick provider / model from a searchable list |
+| `/channels [<name> on\|off]` | view / toggle channels |
+| `/orchestrator [on\|off\|…]` | view / toggle multi-agent (picker on bare call) |
+| `/context [turns N\|tokens N]` | resize the chat history window |
+| `/skill` · `/personality` · `/memory` · `/loop` · `/goal` | skills, personas, memory, loops, goals |
 
-### Channels that hand off
+`/help` lists them all. Ghost-text autocomplete completes commands as you type; CJK/Hangul input composes inside the box.
 
-First-class channels for Slack, Discord, Telegram, Matrix, Email, and Voice. Signal and WhatsApp ship as full implementations with external runtime dependencies (`signal-cli` for Signal; `whatsapp-web.js` browser automation with QR-on-first-run for WhatsApp). Move a live conversation between any two with `/handoff <target> <externalId>` — no other agent CLI does cross-channel handoff.
+## The dashboard
 
 ```bash
-lazyclaw channels install @lazyclaw/channel-discord
-# inside Slack:   /handoff discord <channel-id>
-# inside Discord: /handoff tui <thread-id>
+lazyclaw dashboard          # local web UI on http://127.0.0.1:19600
 ```
 
-Slack is built-in and does not need `channels install`. The plugin loader expects `@lazyclaw/channel-<name>` npm package names.
-
-### Personas that compose
-
-Swap personality per channel without losing session memory. Layers compose top-down: global SOUL → workspace SOUL → active personality → agent role → user model (USER.md) → skill bank → memory core → recent trajectory tail. See [docs/persona-cookbook.md](./docs/persona-cookbook.md).
-
-### Loops and scheduled goals
-
-Durable foreground or `--detach` loops; cron-scheduled goals with channel fan-out. State lives in `~/.lazyclaw/loops/<id>/` and survives restart. See [docs/loop-goal-preflight.md](./docs/loop-goal-preflight.md).
+A framework-free SPA over the daemon's JSON API: Chat, Sessions, Workflows, Skills, Providers, Rates, Metrics, Doctor, Config, Status, Agents, Teams, Tasks, Trainer, Recall, Sandbox, Channels — 17 tabs, dark amber theme.
 
-### A TUI that ghosts the right answer
+## Providers
 
-Ink-based UI with a responsive splash (Larry-3D gradient wordmark, sloth braille hero, grouped subcommand catalog, registry-backed tool list, filename-grouped skills, Hermes-style status bar — auto-collapses to single-column on narrow terminals), Cursor-style ghost autocomplete (`→` accepts, `Tab` cycles), interrupt-and-redirect REPL, and multiline editor.
+| Chat / trainer | Auth |
+|---|---|
+| `claude-cli` | subscription (Pro/Max) — keyless |
+| `anthropic` · `openai` · `gemini` | API key |
+| `ollama` | local, no key |
+| `nim` · `openrouter` · `groq` · `together` · `xai` · `deepseek` · `mistral` · `fireworks` | OpenAI-compatible API key |
+| `custom` | any OpenAI-compatible v1 endpoint (your base URL + key) |
+| `orchestrator` | meta-provider — planner + workers over any of the above |
 
-## Command reference
+<img src="docs/screenshots/providers.png" alt="lazyclaw providers info" width="680">
 
-| Command | Purpose |
-|---|---|
-| `lazyclaw` | No-arg → drops into chat (since v5.0.6) |
-| `lazyclaw menu` | Arrow-key launcher (formerly the no-arg default) |
-| `lazyclaw onboard` | Arrow-key setup; writes `~/.lazyclaw/config.json` |
-| `lazyclaw status` | Print active provider / model / masked key |
-| `lazyclaw doctor` | Validate config, provider registry, FTS5 index |
-| `lazyclaw chat` | Interactive REPL with ghost autocomplete + slash commands |
-| `lazyclaw agent "<prompt>"` | One-shot generate; supports stdin |
-| `lazyclaw run \| resume \| inspect` | DAG / sequential / persistent workflow jobs (`--dir <state-dir>`) |
-| `lazyclaw config get\|set\|list\|edit\|validate` | Dotted-key config access |
-| `lazyclaw sandbox list\|test\|add\|use` | Manage sandbox backends |
-| `lazyclaw channels install\|list\|remove` | Channel plugin lifecycle (`@lazyclaw/channel-<name>`) |
-| `lazyclaw trajectories export --format ...` | Export to atropos / axolotl / openai-ft / jsonl |
-| `lazyclaw personality use\|list\|show` | Activate / inspect personas |
-| `lazyclaw dashboard` | Local web UI on `127.0.0.1:19600` |
-| `lazyclaw migrate v5` | v4 → v5 with backup |
-| `lazyclaw recall` | (v5.1) Top-level recall over the FTS5 index — today, use `loop`/`goal` with `--recall "<query>"` |
-| `lazyclaw version` / `lazyclaw help` | Version + subcommand help |
-
-In-REPL slash commands include `/help`, `/status`, `/provider`, `/model`, `/skill`, `/loop`, `/goal`, `/memory`, `/agent`, `/team`, `/handoff`, `/personality`, `/exit`. Depth lives in `lazyclaw <cmd> --help` and the docs below.
-
-## Migrating from v4
-
-> [!IMPORTANT]
-> `lazyclaw migrate v5` backs up your existing `~/.lazyclaw/` to `backup-v4-<ts>/` before rewriting anything. Don't skip the backup — the SQLite schema and skill frontmatter both change shape.
-
-- **What changed**: split `trainer` provider block, new `~/.lazyclaw/index.db` (SQLite + FTS5), per-day JSONL trajectory sink, persona file directory, kebab-case provider IDs (`claude-cli`, `gemini-cli`, ...), additive SKILL.md frontmatter (`group`, `trained_by`, `confidence`, `cross_cli_tested`).
-- **Migrate**:
-  ```bash
-  npm install -g lazyclaw@5
-  lazyclaw migrate v5
-  ```
-- **Rollback**: restore `~/.lazyclaw/backup-v4-<ts>/` and `npm install -g lazyclaw@4`.
-
-Full guide: [docs/migration-v4-to-v5.md](./docs/migration-v4-to-v5.md).
-
-## CLI vs Channels — quick reference
-
-| Capability | TUI | Slack / Discord / Telegram |
-|---|---|---|
-| Start a chat | `lazyclaw chat` | `@lazyclaw <message>` |
-| Hand off to another surface | `/handoff slack <channel-id>` | `/handoff tui <thread-id>` |
-| Recall across history | `lazyclaw loop --recall "<query>" ...` (slash + top-level v5.1) | `lazyclaw loop --recall "<query>" ...` (channel-side `/recall` v5.1) |
-| Switch persona | `/personality use terse` | `/personality use terse` |
-| Switch model | `/model <name>` | `/model <name>` |
-| Show status | `lazyclaw status` | `@lazyclaw status` |
-
-Channel plugins implement a shared `channels/base.mjs` contract, so the surface you address them through is interchangeable.
-
-## Configuration
+## What else it ships
 
-```jsonc
-// ~/.lazyclaw/config.json
-{
-  "provider": "claude-cli",
-  "model": "claude-opus-4-7",
-  "trainer": {
-    "provider": "auto",                  // "auto" | claude-cli | anthropic | openai | gemini | ollama
-    "model": "claude-haiku-4-5",
-    "schedule": "nightly",
-    "budget": { "maxCallsPerDay": 200, "usdPerDay": 0.50 }
-  },
-  "sandbox": { "backend": "local" },     // local | docker | ssh | singularity | modal | daytona
-  "channels": { "slack": { "enabled": true } },
-  "persona": { "active": "default" },
-  "orchestra": { "learning": { "crossCliDampenFactor": 0.85 } }
-}
-```
+- **Tool registry** — 12 categories (`agents`, `browser`, `coding`, `exec`, `fs`, `git`, `iot`, `learning`, `media`, `net`, `os`, `scheduling`) plus stdio MCP. Sensitive tools (shell, write, network) are **fail-closed** behind an approval hook by default.
+- **Durable recall** — one SQLite + FTS5 index over sessions, skills, trajectories, and memory; rebuildable from the corpus.
+- **Loops & goals** — durable foreground/`--detach` loops and cron-scheduled goals that survive restart.
+- **Personas** — layered SOUL / workspace / personality / role / user-model / skills compose into the system prompt.
+- **Sandboxes** — `local` / `docker` / `ssh` / `singularity` / `modal` / `daytona` behind one API.
 
-Override the config directory with `LAZYCLAW_CONFIG_DIR=/path`. Workflow state moves with `LAZYCLAW_WORKFLOW_STATE_DIR=/path`. Channel tokens live exclusively in `~/.lazyclaw/.env`. Full schema in `lazyclaw config --help` and the docs.
+## Configuration & security
 
-## Security and privacy
+Config is plain JSON at `~/.lazyclaw/config.json`; channel + provider secrets live in `~/.lazyclaw/.env` (written 0600, never logged). Move the dir with `LAZYCLAW_CONFIG_DIR=/path`.
 
 > [!WARNING]
-> **`~/.lazyclaw/config.json` is trusted code.** Values resolved with `$(...)` execute at config load. Treat the file like a shell rc — never paste an untrusted snippet without reading it first.
+> Treat `~/.lazyclaw/config.json` like a shell rc — values resolved with `$(...)` execute at load. Don't paste an untrusted snippet without reading it.
+
+Sensitive tools deny by default unless an approval hook grants them; `config.json` and workflow state are written owner-only; secrets are scrubbed from the `bash` tool's child env and redacted from trajectories and synthesised skills.
 
-- **Trainer transcripts stay local.** Skill synthesis and user-model writes go through your configured trainer provider only; there is no hosted lazyclaw service.
-- **Sandbox backends enforce different blast radii.** `local` runs as you; `docker` / `singularity` / `daytona` isolate; `ssh` / `modal` move execution off-host. Pick per task.
-- **Secrets are redacted** from trajectories and synthesised skills (`sk-...`, `ghp_...`, `AKIA...`, bearer tokens, `*_KEY=...`, PEM blocks). Channel tokens live in `~/.lazyclaw/.env` and are never logged.
+## Install / hack
 
-## Documentation
+```bash
+npm install -g lazyclaw                 # install
+git clone https://github.com/cmblir/lazyclaw && cd lazyclaw && npm install && npm link   # hack
+node --test tests/*.test.mjs            # run the suite
+```
 
-- [docs/migration-v4-to-v5.md](./docs/migration-v4-to-v5.md) — full v4 → v5 walkthrough + rollback
-- [docs/trainer-recipes.md](./docs/trainer-recipes.md) — $0, hybrid, offline, and `auto` trainer configs
-- [docs/persona-cookbook.md](./docs/persona-cookbook.md) — layered persona compose stack + skin import
-- [docs/multi-agent.md](./docs/multi-agent.md) — orchestrator pipeline + Slack team data model
-- [docs/loop-goal-preflight.md](./docs/loop-goal-preflight.md) — durable loops and cron-scheduled goals
-- [docs/agent-memory.md](./docs/agent-memory.md) — per-agent memory, reflection, and skill synthesis
-- [CHANGELOG.md](./CHANGELOG.md) — release notes (Keep a Changelog)
-- [README.ko.md](./README.ko.md) — Korean companion
+Requires **Node 18+** (Node 22+ for Slack Socket Mode). macOS / Linux / WSL are first-class.
 
-## Community
+## Docs
 
-Source and issues: [cmblir/lazyclaw](https://github.com/cmblir/lazyclaw). PRs welcome.
+- [docs/multi-agent.md](./docs/multi-agent.md) — orchestrator pipeline + Slack teams
+- [docs/trainer-recipes.md](./docs/trainer-recipes.md) — $0, hybrid, and `auto` trainer configs
+- [docs/persona-cookbook.md](./docs/persona-cookbook.md) — persona compose stack
+- [docs/loop-goal-preflight.md](./docs/loop-goal-preflight.md) — loops + scheduled goals
+- [CHANGELOG.md](./CHANGELOG.md) — release notes · [README.ko.md](./README.ko.md) — Korean
 
 ## License
 
-[MIT](./LICENSE)
+[MIT](./LICENSE) · Source & issues: [cmblir/lazyclaw](https://github.com/cmblir/lazyclaw)

package/channels/handoff.mjs

@@ -4,6 +4,16 @@
 // Pure function over (threads store, live channel map) — the CLI slash
 // and the daemon HTTP route both call this.
 
+// The note rides inside a message posted INTO a channel, and /handoff callers
+// control it — strip control characters (no ANSI/newline injection into
+// channel messages) and bound the length. Session ids are internal state and
+// never belong in user-visible text.
+function sanitizeNote(note) {
+  // eslint-disable-next-line no-control-regex
+  const cleaned = String(note || '').replace(/[\x00-\x1f\x7f]/g, ' ').trim();
+  return cleaned.length > 200 ? cleaned.slice(0, 200) + '…' : cleaned;
+}
+
 export async function runHandoff({ threads, channels, threadId, target, externalId, note = '' }) {
   const cur = threads.findByThread(threadId);
   if (!cur) {
@@ -23,7 +33,8 @@ export async function runHandoff({ threads, channels, threadId, target, external
   const next = threads.handoff(threadId, { channel: target, externalId });
 
   // 2. Notify source (best-effort) so the human knows where the convo went.
-  const tail = note ? ` — ${note}` : '';
+  const cleanNote = sanitizeNote(note);
+  const tail = cleanNote ? ` — ${cleanNote}` : '';
   if (channels[srcChannel] && typeof channels[srcChannel].send === 'function') {
     try {
       await channels[srcChannel].send(srcExternal,
@@ -33,9 +44,10 @@ export async function runHandoff({ threads, channels, threadId, target, external
     }
   }
 
-  // 3. Notify target with a resume marker.
+  // 3. Notify target with a resume marker. (No session id — internal state
+  // never belongs in user-visible channel text.)
   await channels[target].send(externalId,
-    `resumed from ${srcChannel} (session ${next.sessionId})${tail}`);
+    `resumed from ${srcChannel}${tail}`);
 
   return next;
 }
@@ -62,8 +74,9 @@ export async function handoffWithRollback({ threads, threadId, target, externalI
   const next = threads.handoff(threadId, { channel: target, externalId: String(externalId) });
   if (typeof send === 'function') {
     try {
-      const tail = note ? ` — ${note}` : '';
-      await send(String(externalId), `resumed from ${prior.channel} (session ${next.sessionId})${tail}`);
+      const cleanNote = sanitizeNote(note);
+      const tail = cleanNote ? ` — ${cleanNote}` : '';
+      await send(String(externalId), `resumed from ${prior.channel}${tail}`);
     } catch (e) {
       // Target never got the resume marker — roll the binding back so the
       // session isn't stranded on a channel that can't be reached.