lazyclaw 6.3.0 → 6.4.0

package/commands/chat.mjs

@@ -6,8 +6,10 @@
 import path from 'node:path';
 import {
   configPath, readConfig, writeConfig,
+  persistActiveModel, persistActiveProvider,
   _resolveAuthKey, _resolveBaseUrl, readVersionFromRepo,
 } from '../lib/config.mjs';
+import { renderRecord } from '../lib/render.mjs';
 import { ensureRegistry, requireRegistry, getRegistry } from '../lib/registry_boot.mjs';
 import { SUBCOMMANDS, parseArgs, AGENT_REG_SUBS } from '../lib/args.mjs';
 import {
@@ -16,10 +18,20 @@ import {
   _quickPrompt, _renderBanner, _renderV5Banner,
 } from '../tui/pickers.mjs';
 import { firstRunMode as _firstRunMode, hasConfiguredProvider } from '../first_run.mjs';
-import { applyChatWindow as _applyChatWindow, CHAT_WINDOW_TURNS, CHAT_WINDOW_TOKEN_BUDGET } from '../chat_window.mjs';
+import { applyChatWindow as _applyChatWindow, estimateMessagesTokens, CHAT_WINDOW_TURNS, CHAT_WINDOW_TOKEN_BUDGET } from '../chat_window.mjs';
 import { makeRunTurn as _chatRunTurnFactory } from '../tui/run_turn.mjs';
-import { dispatchSlash as _dispatchSlash, parseSlashLine as _parseSlashLine } from '../tui/slash_dispatcher.mjs';
+import { hudStatus as _hudStatus } from '../tui/hud.mjs';
+import { dispatchSlash as _dispatchSlash, parseSlashLine as _parseSlashLine, _makeInkApprove } from '../tui/slash_dispatcher.mjs';
 import { SLASH_COMMANDS } from '../tui/slash_commands.mjs';
+import { wrapInteractiveProv, makeLegacyApprove } from './chat_hardening.mjs';
+
+// /new, /reset and /clear must signal the Ink REPL to wipe the screen +
+// scrollback via the 'NEW' sentinel (handled in tui/repl.mjs). _newReset itself
+// returns a human string for the string-rendering consumers, so the Ink handler
+// translates these commands here. Exported so the contract is unit-testable.
+export function _isInkResetCmd(cmd) {
+  return /^\/(new|reset|clear)$/i.test(String(cmd || ''));
+}
 
 // Legacy (non-Ink) slash routing for dispatcher-style, ctx-only commands.
 // The Ink REPL routes every slash through _dispatchSlash/SLASH_HANDLERS, but
@@ -89,9 +101,20 @@ export async function cmdChat(flags = {}) {
     }
     activeProvName = 'claude-cli';
   }
-  let prov = lookupProv(activeProvName);
+  let prov = wrapInteractiveProv(lookupProv(activeProvName));  // transient-retry the chat hot path
   if (!prov) { console.error(`unknown provider: ${activeProvName}`); process.exit(2); }
 
+  // First-turn key preflight: warn up front when the active provider needs an
+  // API key but none resolves, instead of letting the first turn fail opaquely.
+  // Cheap (no network); TTY-only so pipelines aren't spammed.
+  if (process.stdout.isTTY) {
+    const _meta = (getRegistry().PROVIDER_INFO || {})[activeProvName] || {};
+    if (_meta.requiresApiKey && !_resolveAuthKey(cfg, activeProvName)) {
+      process.stdout.write(`  ⚠ no API key found for ${activeProvName} — the first message will fail until you set one.\n`);
+      process.stdout.write(`    fix: /provider (pick + paste a key) · or  lazyclaw auth add ${activeProvName}\n`);
+    }
+  }
+
   // Top-of-session banner so the user can see at a glance what they're
   // talking to. Cheap (no provider call) and TTY-only.
   // v5 ink splash + REPL when stdin is a real TTY and the user has not
@@ -107,8 +130,7 @@ export async function cmdChat(flags = {}) {
       // narrow-terminal fallback: <60 cols falls back to v4
       if ((process.stdout.columns || 80) < 60) throw new Error('narrow-terminal');
 
-      // Tool + skill groups for the splash panel — shared with the setup
-      // wizard via tui/splash_props.mjs so both surfaces render the same panel.
+      // Tool + skill groups for the splash panel — shared with the setup wizard.
       const { gatherToolAndSkillGroups } = await import('../tui/splash_props.mjs');
       const { tools: toolGroups, skills: skillGroups } =
         await gatherToolAndSkillGroups(path.dirname(configPath()));
@@ -123,13 +145,9 @@ export async function cmdChat(flags = {}) {
       };
       void renderSplashToString; // surfaced for tests; runtime uses <Splash/>
 
-      // C7 — minimal chat-session state for the ink path so runTurn can
-      // talk to the provider (the legacy readline path below sets up the
-      // same shape — kept duplicated here intentionally so the ink branch
-      // remains self-contained and the legacy path stays byte-identical).
-      // Slash commands aren't wired into the ink REPL yet (v5.1 follow-up);
-      // until then, system-prompt composition / --session resume happen
-      // identically to the legacy path.
+      // C7 — minimal chat-session state for the ink path so runTurn can talk to
+      // the provider. The legacy readline path below sets up the same shape
+      // (kept duplicated so each branch stays self-contained).
       let _inkSandboxSpec = null;
       if (flags.sandbox) {
         const sb = await import('../sandbox.mjs');
@@ -203,8 +221,7 @@ export async function cmdChat(flags = {}) {
           }).catch(() => {});
         } catch { /* swallow */ }
       };
-      // v5.4: chars-sent counter for the Ink chat path. Mirrors the legacy
-      // path's `charsSent` so /usage in Ink reports the same number.
+      // v5.4: chars-sent counter for the Ink path (mirrors legacy `charsSent`).
       let _inkCharsSent = 0;
       const _inkCtx = {
         cfg,
@@ -219,11 +236,15 @@ export async function cmdChat(flags = {}) {
         getMessages: () => _inkMessages,
         setMessages: (next) => { _inkMessages = Array.isArray(next) ? next : []; },
         getProv: () => prov,
-        setProv: (next) => { prov = next; },
+        setProv: (next) => { prov = wrapInteractiveProv(next); },
         getActiveProvName: () => activeProvName,
-        setActiveProvName: (name) => { activeProvName = name; },
+        // Persist provider/model picks so they survive a restart (was
+        // in-memory only — a model chosen via /model reverted to cfg.model on
+        // the next launch). persistActiveProvider leaves orchestrator routing
+        // to /orchestrator on|off.
+        setActiveProvName: (name) => { activeProvName = name; persistActiveProvider(cfg, name); },
         getActiveModel: () => activeModel,
-        setActiveModel: (name) => { activeModel = name; },
+        setActiveModel: (name) => { activeModel = name; persistActiveModel(cfg, name); },
         getSessionId: () => _inkSessionId,
         setSessionId: (id) => { _inkSessionId = id; },
         getCharsSent: () => _inkCharsSent,
@@ -235,8 +256,7 @@ export async function cmdChat(flags = {}) {
         resolveAuthKey: (providerName) => _resolveAuthKey(cfg, providerName),
         resolveBaseUrl: (providerName) => _resolveBaseUrl(providerName),
         onCharsSent: (n) => { _inkCharsSent += Number(n) || 0; },
-        // P2 — let /provider add register a custom OpenAI-compatible endpoint
-        // by read-merge-writing config.json from inside the Ink session.
+        // P2 — /provider add read-merge-writes config.json from the Ink session.
         readConfig: () => readConfig(),
         writeConfig: (next) => writeConfig(next),
       };
@@ -253,6 +273,7 @@ export async function cmdChat(flags = {}) {
           ? api.openPicker(opts)
           : Promise.resolve(null);
       };
+      _inkCtx.approve = _makeInkApprove(_inkCtx); // agentic sensitive tools → Ink approval modal
       // Route streamed chunks through ReplApp's injected writeFn: chunks
       // land in React state (liveAssistant) → live region → committed to
       // the <Static/> scrollback on turn-complete, so Ink owns all output.
@@ -271,9 +292,38 @@ export async function cmdChat(flags = {}) {
         const { cmd, args } = _parseSlashLine(line);
         // Thread the REPL's abort signal so Esc/Ctrl-C can stop a /loop.
         _inkCtx.loopSignal = signal || null;
-        return _dispatchSlash(cmd, args, _inkCtx, (chunk) => {
+        const result = await _dispatchSlash(cmd, args, _inkCtx, (chunk) => {
           try { process.stdout.write(chunk); } catch { /* swallow */ }
         });
+        // _newReset (/new, /reset, /clear) returns a human string, but repl.mjs
+        // only wipes the screen + scrollback on the 'NEW' sentinel. Translate
+        // here (mirrors the 'EXIT' sentinel) so the real /new actually clears.
+        if (_isInkResetCmd(cmd)) return 'NEW';
+        return result;
+      };
+      // v6.x slash-argument completion (two surfaces, see tui/slash_args.mjs):
+      //   onArgList     → inline candidates rendered in the popup (login, hud,
+      //                   memory, config, channels, subcommands, names, …).
+      //   onArgComplete → Tab opens the drill-in modal for 2-step provider→model
+      //                   specs (/model, /trainer set, /orchestrator planner).
+      // Both resolve through _inkCtx (its openPicker IS ReplApp's modal; its
+      // cfgDir/registry feed the inline lists).
+      const { argSpecFor: _argSpecFor, runArgCompleter: _runArgCompleter, listArgCandidates: _listArgCandidates } = await import('../tui/slash_args.mjs');
+      const { SLASH_COMMANDS: _ARG_CATALOG } = await import('../tui/slash_commands.mjs');
+      const _argRegistry = await import('../providers/registry.mjs');
+      const _inkArgComplete = async (buffer) => {
+        try {
+          const spec = _argSpecFor(buffer, _ARG_CATALOG);
+          if (!spec || spec.kind !== 'modal') return null;
+          return await _runArgCompleter(spec, _inkCtx, _argRegistry);
+        } catch { return null; }
+      };
+      const _inkArgList = (buffer) => {
+        try {
+          const spec = _argSpecFor(buffer, _ARG_CATALOG);
+          if (!spec || spec.kind !== 'inline') return [];
+          return _listArgCandidates(spec, _inkCtx, _argRegistry);
+        } catch { return []; }
       };
       // v5.4.1: splash renders INSIDE the alt-buffer (not pre-printed to
       // primary). The v5.4.0 pre-print made the screen go blank during
@@ -282,19 +332,21 @@ export async function cmdChat(flags = {}) {
       const ink = render(/* @__PURE__ */ React.createElement(ReplApp, {
         splashProps,
         statusInfo: { provider: activeProvName, model: activeModel },
-        // P3 — live status: read the current provider/model + token gauge so
-        // the StatusBar refreshes after a /provider or /model switch and each
-        // turn, instead of showing the values captured at mount.
+        // P3 — live status: provider/model + history-based ctx gauge (not the
+        // provider's self-reported per-call usage) + the HUD field bundle.
         getStatus: () => ({
           provider: activeProvName,
           model: activeModel,
-          ctxUsed: _inkRunningUsage ? _inkRunningUsage.totalTokens : undefined,
+          ctxUsed: estimateMessagesTokens(_inkMessages),
           ctxTotal: Number((cfg.chat || {}).windowTokens) || CHAT_WINDOW_TOKEN_BUDGET,
+          hud: _hudStatus(cfg, _inkRunningUsage),
         }),
         runTurnFactory: _inkRunTurnFactory,
         onSlashCommand: _inkSlashHandler,
+        onArgComplete: _inkArgComplete,
+        onArgList: _inkArgList,
         pickerRef: _inkPickerRef,
-      }), { exitOnCtrlC: true, patchConsole: true });
+      }), { exitOnCtrlC: false, patchConsole: true }); // false → editor 2-stage Ctrl+C
       await ink.waitUntilExit();
       // /setup → full wizard (then shell). /config single step → run JUST
       // that step now that Ink released stdin, then re-enter chat.
@@ -302,16 +354,21 @@ export async function cmdChat(flags = {}) {
       else if (_inkCtx.requestConfigStep) {
         await (await import('./config_step.mjs')).runConfigStep(_inkCtx.requestConfigStep);
         return cmdChat(flags);
+      } else if (_inkCtx.requestLogin) {
+        // Connect a keyless CLI provider in the foreground (Ink freed stdin), re-enter.
+        await (await import('../providers/cli_login.mjs')).runCliLoginInteractive(_inkCtx.requestLogin);
+        return cmdChat(flags);
       }
       return;
     } catch (e) {
-      // Fall through to legacy path on any ink failure (missing import,
-      // narrow terminal, sandboxed stdout).
-      if (process.env.LAZYCLAW_DEBUG) console.error('[ink] fallback:', e.message);
+      // Fall through to the legacy readline path on any ink failure. ALWAYS
+      // say why, in one dim line — the silent downgrade made real-terminal
+      // failures (node incompat, <60-col windows) undiagnosable from reports.
+      process.stderr.write(`\x1b[2m(ink UI unavailable: ${e?.message || e} — using the legacy reader)\x1b[0m\n`);
     }
   }
   // ─── legacy v4 path (unchanged) ─────────────────────────────────
-  _printChatBanner(activeProvName, activeModel, readVersionFromRepo());
+  await _printChatBanner(activeProvName, activeModel, readVersionFromRepo());
 
   const readline = await import('node:readline');
   // Use terminal:true when we're attached to a TTY so the prompt shows
@@ -481,8 +538,7 @@ export async function cmdChat(flags = {}) {
     getSessionId: () => sessionId,
     persistTurn,
     accumulateUsage,
-    resolveAuthKey: (providerName) => _resolveAuthKey(cfg, providerName),
-    onCharsSent: (n) => { charsSent += n; },
+    resolveAuthKey: (providerName) => _resolveAuthKey(cfg, providerName), onCharsSent: (n) => { charsSent += n; }, approve: makeLegacyApprove(),
   };
   const runTurn = _chatRunTurnFactory({
     ctx: _legacyCtx,
@@ -528,7 +584,7 @@ export async function cmdChat(flags = {}) {
                 return;
               }
               activeProvName = picked.provider;
-              prov = next;
+              prov = wrapInteractiveProv(next);
               if (picked.model) activeModel = picked.model;
               process.stdout.write(`provider → ${activeProvName}${picked.model ? ` · model → ${picked.model}` : ''}\n`);
             }
@@ -541,7 +597,7 @@ export async function cmdChat(flags = {}) {
           return true;
         }
         activeProvName = arg;
-        prov = next;
+        prov = wrapInteractiveProv(next);
         process.stdout.write(`provider → ${arg}\n`);
         return true;
       }
@@ -574,7 +630,7 @@ export async function cmdChat(flags = {}) {
             return true;
           }
           activeProvName = parsed.provider;
-          prov = next;
+          prov = wrapInteractiveProv(next);
         }
         activeModel = parsed.model || arg;
         process.stdout.write(`model → ${activeModel}${parsed.provider ? ` (provider → ${parsed.provider})` : ''}\n`);
@@ -958,10 +1014,11 @@ export async function cmdChat(flags = {}) {
               process.stdout.write(`• ${a.name} — ${a.displayName} — ${provLine} — tools=[${(a.tools || []).join(',')}]\n`);
             }
           } else if (sub === 'show') {
-            if (!aname) { process.stdout.write('usage: /agent show <name>\n'); return true; }
+            if (!aname) { process.stdout.write('usage: /agent show <name> [json]\n'); return true; }
             const a = agentsMod.getAgent(aname, cfgDir);
             if (!a) process.stdout.write(`no agent "${aname}"\n`);
-            else process.stdout.write(JSON.stringify(a, null, 2) + '\n');
+            else if (rest[1] === 'json') process.stdout.write(JSON.stringify(a, null, 2) + '\n');
+            else process.stdout.write(renderRecord(a, { fields: ['name', 'displayName', 'provider', 'model', 'role', 'tools', 'tags', 'iconEmoji', 'memoryWrite', 'skillWrite', 'createdAt', 'updatedAt'] }) + '\n');
           } else if (sub === 'add') {
             if (!aname) { process.stdout.write('usage: /agent add <name> [role text…]\n'); return true; }
             const roleText = rest.slice(1).join(' ').trim();
@@ -1209,7 +1266,8 @@ export async function cmdChat(flags = {}) {
     try { process.stdin.pause(); } catch (_) {}
     try { process.stdin.unref(); } catch (_) {}
   }
-  // /config in the legacy path: re-run the wizard after the readline loop closes.
+  // /config legacy path: re-run the wizard after the readline loop closes.
+  // (Inline login is Ink-only — legacy ctx has no openPicker — so no requestLogin.)
   if (_legacyCtx.requestSetup) await (await import('./setup.mjs')).cmdSetup(undefined, [], {});
 }
 

package/commands/chat_hardening.mjs

@@ -0,0 +1,23 @@
+// commands/chat_hardening.mjs — chat-path reliability helpers, extracted from
+// commands/chat.mjs to keep that file under its file-size ceiling.
+//
+// 1. wrapInteractiveProv: wrap the active chat provider with the same
+//    transient-retry the daemon composes, so a 429/529/5xx before the first
+//    chunk is retried instead of surfacing as a chat "error: ..." line. The
+//    wrapper never retries a mid-stream error (would duplicate output).
+// 2. makeLegacyApprove: the readline approval hook for the legacy / non-TTY
+//    chat path, so agentic sensitive tools have a fail-closed human gate.
+
+import { withRateLimitRetry } from '../providers/retry.mjs';
+import { makeReadlineApprove } from '../tui/terminal_approve.mjs';
+
+// Guard-safe: returns the falsy input unchanged so the caller's
+// unknown-provider check still fires (withRateLimitRetry(undefined) would
+// otherwise produce a truthy "undefined+retry" wrapper).
+export function wrapInteractiveProv(prov) {
+  return prov ? withRateLimitRetry(prov) : prov;
+}
+
+export function makeLegacyApprove() {
+  return makeReadlineApprove();
+}

package/commands/daemon.mjs

@@ -1,9 +1,70 @@
 // Daemon + dashboard lifecycle commands (cmdDashboard, cmdDaemon) plus the
 // _killPortOccupant helper, extracted from cli.mjs in Phase D3.
 import path from 'node:path';
+import fs from 'node:fs';
 import { ensureRegistry } from '../lib/registry_boot.mjs';
 import { configPath, readConfig, writeConfig, readVersionFromRepo } from '../lib/config.mjs';
 import { assertUnattendedSafe, installCrashHandlers } from '../lib/gateway_guard.mjs';
+import { isProcessAlive } from '../loops.mjs';
+
+// The bare `lazyclaw daemon` runs in the foreground, so a started daemon
+// records its pid + the actually-bound port here. status/stop read it back;
+// the start path writes it after bind and removes it on graceful shutdown.
+export function _daemonPidfilePath(configDir) {
+  return path.join(configDir, 'daemon.pid');
+}
+
+// Parse the pidfile into { pid, port } or null if missing/garbage. Never
+// throws — a corrupt pidfile is treated the same as "no daemon".
+export function readDaemonPidfile(pidfilePath) {
+  try {
+    const raw = fs.readFileSync(pidfilePath, 'utf8');
+    const obj = JSON.parse(raw);
+    const pid = parseInt(obj?.pid, 10);
+    if (!Number.isFinite(pid)) return null;
+    const port = Number.isFinite(parseInt(obj?.port, 10)) ? parseInt(obj.port, 10) : null;
+    return { pid, port };
+  } catch { return null; }
+}
+
+// Inspect the daemon pidfile and report liveness. A pidfile pointing at a
+// dead pid is stale (the daemon crashed without removing it), so we clean it
+// up here to keep `status` self-healing.
+export function daemonStatus({ configDir }, deps = {}) {
+  const isAlive = deps.isAlive || isProcessAlive;
+  const pf = _daemonPidfilePath(configDir);
+  const rec = readDaemonPidfile(pf);
+  if (!rec) return { running: false, pid: null, port: null };
+  if (isAlive(rec.pid)) return { running: true, pid: rec.pid, port: rec.port };
+  // Stale pidfile — remove it so the next start/status starts clean.
+  try { fs.rmSync(pf); } catch { /* already gone */ }
+  return { running: false, pid: null, port: null };
+}
+
+// SIGTERM the recorded daemon, falling back to SIGKILL only if it ignores the
+// graceful signal. Returns { running, pid, port, killed, exitCode }; a missing
+// or dead pidfile is "not running" (exit 0), never an error.
+export function daemonStop({ configDir }, deps = {}) {
+  const isAlive = deps.isAlive || isProcessAlive;
+  const kill = deps.kill || ((pid, sig) => process.kill(pid, sig));
+  const pf = _daemonPidfilePath(configDir);
+  const rec = readDaemonPidfile(pf);
+  if (!rec || !isAlive(rec.pid)) {
+    try { fs.rmSync(pf); } catch { /* nothing to clean */ }
+    return { running: false, pid: rec ? rec.pid : null, port: rec ? rec.port : null, killed: false, exitCode: 0 };
+  }
+  try { kill(rec.pid, 'SIGTERM'); } catch { /* raced with exit */ }
+  // Short grace window, then SIGKILL the holdout. This is best-effort and
+  // synchronous so the CLI exits deterministically; the daemon's own
+  // graceful-shutdown hook usually wins well inside the window.
+  if (isAlive(rec.pid)) {
+    const until = Date.now() + 1500;
+    while (isAlive(rec.pid) && Date.now() < until) { /* spin briefly */ }
+    if (isAlive(rec.pid)) { try { kill(rec.pid, 'SIGKILL'); } catch { /* gone */ } }
+  }
+  try { fs.rmSync(pf); } catch { /* removed by the daemon already */ }
+  return { running: true, pid: rec.pid, port: rec.port, killed: true, exitCode: 0 };
+}
 
 // Fail closed before binding the HTTP surface: the daemon/dashboard serve
 // POST /inbound + /agent, so the global unattended-sensitive override must
@@ -134,6 +195,35 @@ export async function cmdDashboard(flags = {}) {
 }
 
 export async function cmdDaemon(flags) {
+  // cli.mjs dispatches `daemon` with only the parsed flags, so the lifecycle
+  // subcommand (status|stop|logs) is recovered from argv here. The first
+  // non-flag positional after `daemon` is the subcommand; absent it, we start
+  // the server as before.
+  const { parseArgs } = await import('../lib/args.mjs');
+  const sub = parseArgs(process.argv.slice(3)).positional[0];
+  const cfgDirEarly = path.dirname(configPath());
+  if (sub === 'status') {
+    const st = daemonStatus({ configDir: cfgDirEarly });
+    process.stdout.write(JSON.stringify(st) + '\n');
+    process.exit(0);
+  }
+  if (sub === 'stop') {
+    const r = daemonStop({ configDir: cfgDirEarly });
+    if (!r.running) process.stdout.write('lazyclaw daemon: not running\n');
+    else process.stdout.write(`lazyclaw daemon: stopped pid ${r.pid}${r.killed ? '' : ''}\n`);
+    process.exit(r.exitCode);
+  }
+  if (sub === 'logs') {
+    // The foreground daemon writes its boot line + access logs to stdout; a
+    // logfile only exists when it was installed as an OS service (see
+    // lib/service_install.mjs servicePaths). Point the user at whichever is
+    // applicable. No tail-follower — keep it simple.
+    const { servicePaths } = await import('../lib/service_install.mjs');
+    const logfile = servicePaths('daemon', { configDir: cfgDirEarly }).logfile;
+    if (fs.existsSync(logfile)) process.stdout.write(logfile + '\n');
+    else process.stdout.write(`No service logfile at ${logfile}.\nThe foreground daemon logs to stdout (run \`lazyclaw daemon --log info\`).\n`);
+    process.exit(0);
+  }
   await ensureRegistry();
   _bootGuard('daemon');
   const sessionsMod = await import('../sessions.mjs');
@@ -245,6 +335,13 @@ export async function cmdDaemon(flags) {
     costCap: costCapOrNull,
   }) + '\n');
   if (!once) {
+    // Record pid + the ACTUAL bound port (d.port, not the requested port,
+    // which may be 0) so `daemon status`/`daemon stop` can find us without
+    // an lsof on the port. Removed on graceful shutdown below.
+    const pidfile = _daemonPidfilePath(cfgDir);
+    try { fs.writeFileSync(pidfile, JSON.stringify({ pid: process.pid, port: d.port })); }
+    catch { /* non-fatal: the daemon still runs, just isn't stoppable by pidfile */ }
+    const removePidfile = () => { try { fs.rmSync(pidfile); } catch { /* already gone */ } };
     // Forward SIGINT/SIGTERM to a graceful shutdown with a hard timeout
     // (default 10 s, override with --shutdown-timeout-ms). Second signal
     // bypasses the wait and exits immediately — the orchestrator's "I
@@ -253,7 +350,7 @@ export async function cmdDaemon(flags) {
     const timeoutMs = flags['shutdown-timeout-ms'] ? parseInt(flags['shutdown-timeout-ms'], 10) : 10_000;
     // Always-on: make an unhandled crash observable + drain sockets, then
     // exit non-zero so a service manager restarts us (vs. silent death).
-    installCrashHandlers({ label: 'daemon', logger, stop: () => gracefulShutdown(d.server, timeoutMs) });
+    installCrashHandlers({ label: 'daemon', logger, stop: () => { removePidfile(); return gracefulShutdown(d.server, timeoutMs); } });
     let shuttingDown = false;
     const shutdown = async () => {
       if (shuttingDown) {
@@ -263,6 +360,7 @@ export async function cmdDaemon(flags) {
       shuttingDown = true;
       if (logger) logger.info('shutdown.begin', { timeoutMs });
       const result = await gracefulShutdown(d.server, timeoutMs);
+      removePidfile();
       if (logger) logger.info('shutdown.end', result);
       process.exit(result.forced ? 1 : 0);
     };

package/commands/gateway.mjs

@@ -14,6 +14,8 @@
 import path from 'node:path';
 import fs from 'node:fs';
 import { randomBytes } from 'node:crypto';
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
 import { configPath, readConfig, writeConfig, readVersionFromRepo } from '../lib/config.mjs';
 import { ensureRegistry } from '../lib/registry_boot.mjs';
 import { loadDotenvIfAny } from '../dotenv_min.mjs';
@@ -22,6 +24,13 @@ import { makeInboundHandler } from '../lib/inbound_client.mjs';
 
 export const GATEWAY_CHANNELS = ['slack', 'telegram', 'matrix'];
 
+// In-tree plugin channels (channels-<name>/index.mjs). These are NOT builtins:
+// each ships as a @lazyclaw/channel-* package that exports
+// register({ addChannel }) and wires a factory returning a channels/base.mjs
+// Channel (start/send/stop). The gateway loads the ENABLED ones at runtime so
+// `channels enable discord` is actually reachable instead of a no-op.
+export const PLUGIN_CHANNELS = ['discord', 'email', 'signal', 'voice', 'whatsapp'];
+
 // Default per-channel constructors. Each receives { handler, logger,
 // allowlist }, must return a started channel exposing send()/stop().
 // Injectable so tests can run the full gateway with stub transports.
@@ -47,15 +56,113 @@ const DEFAULT_FACTORIES = {
   },
 };
 
+// Resolve an enabled plugin channel into the same gateway transport factory
+// shape the builtins use: ({ handler, logger, allowlist }) -> a STARTED
+// channel exposing send()/stop(). Dynamically imports channels-<name>/index.mjs
+// and runs its register({ addChannel }) hook to capture the channel factory.
+//
+// A plugin that does not conform — import fails, no register export, never
+// registers the requested name — is SKIPPED (returns null) so the gateway can
+// log a warning and keep the other channels running. A factory that hands back
+// the wrong shape is caught lazily, when the returned transport factory is
+// invoked, so runGateway's per-channel try/catch turns it into a skip+warn.
+// Resolve an in-tree adapter's runtime dependency from <cfgDir>/node_modules
+// (where `lazyclaw channels install <name>` puts it), falling back to a bare
+// import (dep installed alongside lazyclaw). The adapters do a bare
+// `import('discord.js')` which Node resolves from the adapter's own location —
+// NOT the config dir — so without this an installed dep is never found.
+export function _makeDepLoader(cfgDir) {
+  return async (specifier) => {
+    if (cfgDir) {
+      try {
+        // Anchor resolution inside <cfgDir>/node_modules. The anchor file need
+        // not exist; createRequire only uses its directory as the base.
+        const req = createRequire(path.join(cfgDir, 'node_modules', '_anchor_.js'));
+        const resolved = req.resolve(specifier);
+        return await import(pathToFileURL(resolved).href);
+      } catch { /* fall through to a bare import */ }
+    }
+    return import(specifier);
+  };
+}
+
+// Map the .env-derived credentials into each in-tree adapter's constructor opts
+// (the gateway loads .env into process.env at boot). discord/whatsapp also fall
+// back to env internally, but email has NO env fallback and threw
+// IMAP_CONFIG_MISSING when the gateway passed only { allowlist }.
+export function _pluginChannelOpts(name, env = process.env, cfgDir = '') {
+  switch (name) {
+    case 'discord':
+      return { token: env.DISCORD_BOT_TOKEN || null };
+    case 'email':
+      return {
+        imap: {
+          host: env.EMAIL_IMAP_HOST, user: env.EMAIL_IMAP_USER, password: env.EMAIL_IMAP_PASS,
+          port: env.EMAIL_IMAP_PORT ? Number(env.EMAIL_IMAP_PORT) : undefined,
+          tls: env.EMAIL_IMAP_TLS ? env.EMAIL_IMAP_TLS !== 'false' : undefined,
+        },
+        smtp: {
+          host: env.EMAIL_SMTP_HOST || env.EMAIL_IMAP_HOST, port: env.EMAIL_SMTP_PORT ? Number(env.EMAIL_SMTP_PORT) : undefined,
+          user: env.EMAIL_SMTP_USER || env.EMAIL_IMAP_USER, pass: env.EMAIL_SMTP_PASS || env.EMAIL_IMAP_PASS,
+        },
+      };
+    case 'whatsapp':
+      return { dataPath: path.join(cfgDir || '.', 'whatsapp') };
+    case 'signal':
+      return { account: env.SIGNAL_ACCOUNT || null };
+    case 'voice':
+      return { apiKey: env.OPENAI_API_KEY || null };
+    default:
+      return {};
+  }
+}
+
+// `importer` is injectable for tests. cfgDir + env let the factory resolve the
+// adapter's runtime dep from the config dir and thread credentials in.
+export async function _loadPluginChannel(name, { importer, cfgDir = '', env = process.env } = {}) {
+  const load = importer || ((n) => import(`../channels-${n}/index.mjs`));
+  let mod;
+  try {
+    mod = await load(name);
+  } catch {
+    return null; // missing optional dep / module: skip, do not crash the gateway.
+  }
+  if (!mod || typeof mod.register !== 'function') return null;
+  let channelFactory = null;
+  try {
+    mod.register({ addChannel: (n, factory) => { if (n === name) channelFactory = factory; } });
+  } catch {
+    return null;
+  }
+  if (typeof channelFactory !== 'function') return null;
+  const loadDep = _makeDepLoader(cfgDir);
+  return async ({ handler, logger, allowlist }) => {
+    const ch = channelFactory({ allowlist, loadDep, ..._pluginChannelOpts(name, env, cfgDir) });
+    if (!ch || typeof ch.start !== 'function' || typeof ch.send !== 'function' || typeof ch.stop !== 'function') {
+      throw new Error(`plugin channel "${name}" does not conform to the channel interface (start/send/stop)`);
+    }
+    await ch.start(handler, { poll: true, logger });
+    return ch;
+  };
+}
+
 // Which channels should the gateway run? --channels a,b wins; otherwise the
-// enabled cfg.channels sections that we have a built-in transport for.
+// enabled cfg.channels sections we can actually run — a built-in transport OR
+// an in-tree plugin channel.
 export function _selectChannels(cfg, flags = {}) {
+  const runnable = (n) => GATEWAY_CHANNELS.includes(n) || PLUGIN_CHANNELS.includes(n);
   if (flags.channels) {
     return String(flags.channels).split(',').map((s) => s.trim().toLowerCase()).filter(Boolean)
-      .filter((n) => GATEWAY_CHANNELS.includes(n));
+      .filter(runnable);
   }
   const configured = (cfg.channels && typeof cfg.channels === 'object') ? cfg.channels : {};
-  return GATEWAY_CHANNELS.filter((n) => configured[n] && configured[n].enabled !== false);
+  const isEnabled = (n) => configured[n] && configured[n].enabled !== false;
+  // Builtins first (in their canonical order, preserving existing behavior),
+  // then enabled plugin channels.
+  return [
+    ...GATEWAY_CHANNELS.filter(isEnabled),
+    ...PLUGIN_CHANNELS.filter(isEnabled),
+  ];
 }
 
 // The whole gateway, with injectable deps so tests can drive it end-to-end
@@ -129,7 +236,19 @@ export async function runGateway(flags = {}, deps = {}) {
       provider: flags.provider, model: flags.model,
     });
     try {
-      const ch = await factories[name]({
+      // Builtin transport, else resolve an enabled in-tree plugin channel and
+      // adapt it to the same factory shape. A plugin that won't load is skipped
+      // (factory === null) rather than crashing the gateway.
+      let factory = factories[name];
+      if (!factory) {
+        factory = await _loadPluginChannel(name, { importer: deps.pluginImporter, cfgDir, env: process.env });
+        if (!factory) {
+          skipped.push({ name, error: 'plugin channel did not conform (no usable register/factory)' });
+          log(`[gateway] ${name}: skipped (plugin channel did not load or does not conform)\n`);
+          continue;
+        }
+      }
+      const ch = await factory({
         handler,
         logger: (line) => log(line),
         allowlist: allowlistArr.length ? allowlistArr : null,