lazyclaw 6.3.1 → 6.4.0

package/mas/tools/delegation.mjs

@@ -2,9 +2,21 @@
 // Both lazy-import providers/orchestrator.mjs / mas/agent_turn.mjs to
 // avoid pulling those into every process that imports the registry.
 
+// events.mjs is featherweight (zero-dep pub/sub), so a static import is fine —
+// it does not pull agent_turn/orchestrator into the registry load path.
+import { emit as emitEvent } from '../events.mjs';
+
 let _dispatcher = null;
 export function __setDispatcher(fn) { _dispatcher = fn; }
 
+// Test seam for dispatchSpawn's turn runner, mirroring __setDispatcher.
+// When set, dispatchSpawn calls it with the SAME args it would hand
+// runAgentTurn ({ agent: <record>, userMessage, configDir }) so tests can
+// assert a resolved agent RECORD (with .provider) reaches the runner —
+// without spinning up a real provider.
+let _turnRunner = null;
+export function __setTurnRunner(fn) { _turnRunner = fn; }
+
 async function dispatchDelegate(job) {
   if (_dispatcher) return _dispatcher(job);
   const orch = await import('../../providers/orchestrator.mjs').catch(() => null);
@@ -14,12 +26,27 @@ async function dispatchDelegate(job) {
   return orch.dispatchWorker(job);
 }
 
+// job = { agent: '<name>', prompt, configDir }
+// runAgentTurn expects an agent RECORD (reads .provider/.tools), not a name
+// string. Resolve the name → record via getAgent first, then invoke the
+// runner with the shape it actually consumes and surface the final text.
 async function dispatchSpawn(job) {
+  const agentName = String(job?.agent || '');
   const at = await import('../agent_turn.mjs').catch(() => null);
-  if (!at || typeof at.runAgentTurn !== 'function') {
+  const runner = _turnRunner || (at && typeof at.runAgentTurn === 'function' ? at.runAgentTurn : null);
+  if (!runner) {
     return { ok: false, error: 'task_spawn: agent_turn.runAgentTurn unavailable' };
   }
-  return at.runAgentTurn(job);
+  const agents = await import('../../agents.mjs').catch(() => null);
+  if (!agents || typeof agents.getAgent !== 'function') {
+    return { ok: false, error: 'task_spawn: agents.getAgent unavailable' };
+  }
+  const record = agents.getAgent(agentName, job?.configDir);
+  if (!record) {
+    return { ok: false, error: `task_spawn: unknown agent ${agentName}` };
+  }
+  const result = await runner({ agent: record, userMessage: job?.prompt, configDir: job?.configDir, sandbox: job?.sandbox });
+  return { ok: true, text: result?.text || '', stoppedBy: result?.stoppedBy, iterations: result?.iterations };
 }
 
 const task_spawn = {
@@ -30,9 +57,12 @@ const task_spawn = {
     properties: { agent: { type: 'string' }, prompt: { type: 'string' } },
     required: ['agent', 'prompt'],
   },
-  async exec(args) {
+  async exec(args, ctx = {}) {
     if (!args?.agent || !args?.prompt) return { ok: false, error: 'task_spawn: agent + prompt required' };
-    return dispatchSpawn({ agent: args.agent, prompt: args.prompt });
+    // Live A→B delegation event for the dashboard (caller → spawned agent).
+    emitEvent('delegate', { taskId: ctx.taskId, from: ctx.agent?.name, to: args.agent });
+    // Propagate the outer turn's sandbox so a spawned sub-agent stays confined.
+    return dispatchSpawn({ agent: args.agent, prompt: args.prompt, configDir: ctx.configDir, sandbox: ctx.sandbox });
   },
 };
 

package/mas/tools/git.mjs

@@ -2,6 +2,7 @@
 // sensitive writes (commit/push). All shell out to git in ctx.cwd.
 
 import { spawnSync } from 'node:child_process';
+import { spawnSyncSandboxed } from '../../sandbox.mjs';
 
 function git(cwd, args, opts = {}) {
   // M11 / C12 — detect a missing git binary (Windows without
@@ -10,8 +11,17 @@ function git(cwd, args, opts = {}) {
   // {ok:false} with a cryptic spawn error, which made the
   // "lazyclaw doctor" path the only reliable signal. Now any agent
   // touching this tool also gets a one-line diagnostic.
+  //
+  // CAPABILITY-ONLY sandbox seam: when opts.sandbox is truthy the git
+  // invocation is routed through the synchronous sandbox dispatcher
+  // (default-on isolation, step iii). No current caller threads a spec, so
+  // the bare spawnSync path below is byte-identical to the historical call.
   const exe = process.env.GIT_EXECUTABLE || 'git';
-  const r = spawnSync(exe, args, { cwd, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 });
+  const r = opts.sandbox
+    ? (opts._spawnSyncSandboxed || spawnSyncSandboxed)(
+        opts.sandbox, exe, args, { cwd, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 },
+      )
+    : spawnSync(exe, args, { cwd, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 });
   if (r.error && r.error.code === 'ENOENT') {
     return {
       ok: false,
@@ -29,7 +39,7 @@ const git_status = {
   name: 'git_status', category: 'git', sensitive: false,
   description: 'Run `git status` in the workspace.',
   parameters: { type: 'object', properties: {} },
-  async exec(_args, ctx) { return git(ctx?.cwd, ['status']); },
+  async exec(_args, ctx) { return git(ctx?.cwd, ['status'], { sandbox: ctx?.sandbox, _spawnSyncSandboxed: ctx?._spawnSyncSandboxed }); },
 };
 
 const git_diff = {
@@ -40,7 +50,7 @@ const git_diff = {
     const ar = ['diff'];
     if (args?.staged) ar.push('--staged');
     if (args?.path) ar.push('--', args.path);
-    return git(ctx?.cwd, ar);
+    return git(ctx?.cwd, ar, { sandbox: ctx?.sandbox, _spawnSyncSandboxed: ctx?._spawnSyncSandboxed });
   },
 };
 
@@ -50,7 +60,7 @@ const git_log = {
   parameters: { type: 'object', properties: { limit: { type: 'number' } } },
   async exec(args, ctx) {
     const n = Math.max(1, Math.min(args?.limit || 10, 100));
-    const r = git(ctx?.cwd, ['log', `-n${n}`, '--pretty=format:%H%x09%an%x09%aI%x09%s']);
+    const r = git(ctx?.cwd, ['log', `-n${n}`, '--pretty=format:%H%x09%an%x09%aI%x09%s'], { sandbox: ctx?.sandbox, _spawnSyncSandboxed: ctx?._spawnSyncSandboxed });
     if (!r.ok) return r;
     const commits = r.stdout.trim().split('\n').filter(Boolean).map(line => {
       const [hash, author, date, subject] = line.split('\t');
@@ -64,7 +74,7 @@ const git_blame = {
   name: 'git_blame', category: 'git', sensitive: false,
   description: 'Run `git blame <path>`.',
   parameters: { type: 'object', properties: { path: { type: 'string' } }, required: ['path'] },
-  async exec(args, ctx) { return git(ctx?.cwd, ['blame', '--', args.path]); },
+  async exec(args, ctx) { return git(ctx?.cwd, ['blame', '--', args.path], { sandbox: ctx?.sandbox, _spawnSyncSandboxed: ctx?._spawnSyncSandboxed }); },
 };
 
 const git_branch = {
@@ -72,7 +82,7 @@ const git_branch = {
   description: 'List branches.',
   parameters: { type: 'object', properties: {} },
   async exec(_args, ctx) {
-    const r = git(ctx?.cwd, ['branch', '--all', '--format=%(refname:short)%09%(upstream:short)%09%(HEAD)']);
+    const r = git(ctx?.cwd, ['branch', '--all', '--format=%(refname:short)%09%(upstream:short)%09%(HEAD)'], { sandbox: ctx?.sandbox, _spawnSyncSandboxed: ctx?._spawnSyncSandboxed });
     if (!r.ok) return r;
     const branches = r.stdout.trim().split('\n').filter(Boolean).map(line => {
       const [name, upstream, head] = line.split('\t');
@@ -96,12 +106,12 @@ const git_commit = {
   },
   async exec(args, ctx) {
     if (Array.isArray(args.paths) && args.paths.length) {
-      const a = git(ctx?.cwd, ['add', '--', ...args.paths]);
+      const a = git(ctx?.cwd, ['add', '--', ...args.paths], { sandbox: ctx?.sandbox, _spawnSyncSandboxed: ctx?._spawnSyncSandboxed });
       if (!a.ok) return a;
     }
     const ar = ['commit', '-m', args.message];
     if (args.amend) ar.splice(1, 0, '--amend');
-    return git(ctx?.cwd, ar);
+    return git(ctx?.cwd, ar, { sandbox: ctx?.sandbox, _spawnSyncSandboxed: ctx?._spawnSyncSandboxed });
   },
 };
 
@@ -120,7 +130,7 @@ const git_push = {
     if (args?.force) ar.push('--force-with-lease');
     if (args?.remote) ar.push(args.remote);
     if (args?.branch) ar.push(args.branch);
-    return git(ctx?.cwd, ar);
+    return git(ctx?.cwd, ar, { sandbox: ctx?.sandbox, _spawnSyncSandboxed: ctx?._spawnSyncSandboxed });
   },
 };
 

package/mas/tools/ha.mjs

@@ -8,6 +8,7 @@ function deferred(name) {
 
 const ha_call_service = {
   name: 'ha_call_service', category: 'iot', sensitive: true,
+  unavailable: true, // not implemented (deferred to v5.1) — hidden from tool schemas until wired
   description: 'STUB — Home Assistant service call deferred to v5.1.',
   parameters: {
     type: 'object',
@@ -22,6 +23,7 @@ const ha_call_service = {
 
 const ha_get_state = {
   name: 'ha_get_state', category: 'iot', sensitive: true,
+  unavailable: true, // not implemented (deferred to v5.1) — hidden from tool schemas until wired
   description: 'STUB — Home Assistant state read deferred to v5.1.',
   parameters: {
     type: 'object',

package/mas/tools/learning.mjs

@@ -13,6 +13,38 @@ function resolveConfigDir(ctx) {
 function memoryDir(ctx) { return path.join(resolveConfigDir(ctx), 'memory'); }
 function userMdPath(ctx) { return path.join(memoryDir(ctx), 'USER.md'); }
 
+// Best-effort FTS5 mirrors (spec §4.4) — same shape skill_synth /
+// user_modeler use: dynamic import, openIndex, then index*. An index
+// failure NEVER fails the tool; index_db's own write hooks already log
+// to index-failures.jsonl, so we swallow here.
+async function _indexSkillSafe(row, configDir) {
+  try {
+    const idx = await import('../index_db.mjs');
+    idx.openIndex(configDir);
+    idx.indexSkill(row, configDir);
+  } catch { /* non-fatal */ }
+}
+
+async function _indexMemorySafe(row, ctx) {
+  try {
+    const configDir = resolveConfigDir(ctx);
+    const idx = await import('../index_db.mjs');
+    idx.openIndex(configDir);
+    idx.indexMemory(row, configDir);
+  } catch { /* non-fatal */ }
+}
+
+// Minimal frontmatter key reader — skill_edit only needs trained_by/group
+// off the existing frontmatter block to keep the FTS metadata stable.
+function _parseFm(fm) {
+  const meta = {};
+  for (const line of String(fm || '').split('\n')) {
+    const i = line.indexOf(':');
+    if (i > 0) meta[line.slice(0, i).trim()] = line.slice(i + 1).trim();
+  }
+  return meta;
+}
+
 const skill_view = {
   name: 'skill_view', category: 'learning', sensitive: false,
   description: 'Return the body of an installed skill (by name).',
@@ -64,6 +96,15 @@ const skill_create = {
       '',
     ].join('\n');
     const file = skills.installSkill(args.name, fm + args.body + (args.body.endsWith('\n') ? '' : '\n'), configDir);
+    // FTS5 write-through (spec §4.4): mirror the new skill so recall finds
+    // it without waiting for a reindexAll. Best-effort — an index error must
+    // never fail the create. trained_by is always 'user' for this tool.
+    await _indexSkillSafe({
+      skill_name: args.name,
+      trained_by: 'user',
+      group_name: args.group || (args.name.includes('-') ? args.name.split('-')[0] : 'legacy'),
+      content: args.body,
+    }, configDir);
     return { ok: true, name: args.name, file };
   },
 };
@@ -86,6 +127,16 @@ const skill_edit = {
     let fm = m[1];
     fm = fm.replace(/version:\s*(\d+)/, (_, v) => `version: ${Number(v) + 1}`);
     skills.installSkill(args.name, `---\n${fm}\n---\n${args.body}${args.body.endsWith('\n') ? '' : '\n'}`, configDir);
+    // FTS5 write-through (spec §4.4): re-index the edited body so recall
+    // surfaces the new content. Preserve the skill's existing frontmatter
+    // trained_by / group; best-effort, never fails the edit.
+    const meta = _parseFm(fm);
+    await _indexSkillSafe({
+      skill_name: args.name,
+      trained_by: meta.trained_by || 'user',
+      group_name: meta.group || (args.name.includes('-') ? args.name.split('-')[0] : 'legacy'),
+      content: args.body,
+    }, configDir);
     return { ok: true, name: args.name };
   },
 };
@@ -107,12 +158,16 @@ const memory_write = {
     fs.mkdirSync(dir, { recursive: true });
     if (args.kind === 'recent') {
       fs.appendFileSync(path.join(dir, 'recent.jsonl'), JSON.stringify({ ts: Date.now(), content: args.content }) + '\n');
+      // recent.jsonl is not an FTS scope (no fts_recent table); skip indexing.
     } else if (args.kind === 'core') {
       fs.writeFileSync(path.join(dir, 'core.md'), args.content);
+      // FTS5 write-through (spec §4.4): mirror core memory so recall finds it.
+      await _indexMemorySafe({ topic: 'core', kind: 'core', content: args.content }, ctx);
     } else if (args.kind === 'episodic') {
       if (!args.topic) return { ok: false, error: 'memory_write: topic required for episodic' };
       fs.mkdirSync(path.join(dir, 'episodic'), { recursive: true });
       fs.writeFileSync(path.join(dir, 'episodic', `${args.topic}.md`), args.content);
+      await _indexMemorySafe({ topic: args.topic, kind: 'episodic', content: args.content }, ctx);
     } else {
       return { ok: false, error: `memory_write: unknown kind ${args.kind}` };
     }

package/mas/tools/media.mjs

@@ -5,11 +5,23 @@
 // "configure X" error otherwise.
 
 import fs from 'node:fs';
+import path from 'node:path';
 import { fetch } from 'undici';
 
+// Confine a model-supplied path to the working directory. image_describe
+// UPLOADS the bytes to a third party (OpenAI), so — unlike `read` — it must
+// not be coaxed into exfiltrating an arbitrary host file (~/.ssh/id_rsa,
+// /etc/passwd). Returns the resolved path or null when it escapes cwd.
+function confineToCwd(p, cwd) {
+  const root = path.resolve(cwd || process.cwd());
+  const resolved = path.resolve(root, String(p || ''));
+  if (resolved !== root && !resolved.startsWith(root + path.sep)) return null;
+  return resolved;
+}
+
 const image_describe = {
   name: 'image_describe', category: 'media', sensitive: true,
-  description: 'Describe an image. Requires OPENAI_API_KEY (gpt-4o vision) or ANTHROPIC_API_KEY (claude vision).',
+  description: 'Describe an image at a path inside the working directory. Requires OPENAI_API_KEY (gpt-4o vision).',
   parameters: {
     type: 'object',
     properties: { path: { type: 'string' }, prompt: { type: 'string' } },
@@ -17,8 +29,10 @@ const image_describe = {
   },
   async exec(args, ctx) {
     const env = ctx?.env || process.env;
-    if (!fs.existsSync(args.path)) return { ok: false, error: `image_describe: file not found ${args.path}` };
-    const b64 = fs.readFileSync(args.path).toString('base64');
+    const safePath = confineToCwd(args.path, ctx?.cwd);
+    if (!safePath) return { ok: false, error: `image_describe: path escapes the working directory: ${args.path}` };
+    if (!fs.existsSync(safePath)) return { ok: false, error: `image_describe: file not found ${args.path}` };
+    const b64 = fs.readFileSync(safePath).toString('base64');
     const prompt = args.prompt || 'Describe this image briefly.';
     if (env.OPENAI_API_KEY) {
       try {
@@ -39,6 +53,9 @@ const image_describe = {
 
 const image_generate = {
   name: 'image_generate', category: 'media', sensitive: true,
+  // Working tool: the OPENAI_API_KEY path makes a real images/generations call
+  // (gpt-image-1); only the FAL_KEY path is unimplemented. NOT a stub — stays
+  // advertised so the 'media' toolset works on OpenAI-key deployments.
   description: 'Generate an image. Requires OPENAI_API_KEY (DALL-E) or FAL_KEY.',
   parameters: {
     type: 'object',
@@ -67,6 +84,7 @@ const image_generate = {
 
 const tts_speak = {
   name: 'tts_speak', category: 'media', sensitive: true,
+  unavailable: true, // not implemented (deferred to v5.1) — hidden from tool schemas until wired
   description: 'STUB — TTS reply deferred to v5.1 per spec §0.2.',
   parameters: { type: 'object', properties: { text: { type: 'string' } }, required: ['text'] },
   async exec() {

package/mas/tools/os.mjs

@@ -6,12 +6,28 @@ import { spawn, spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { spawnSandboxed, spawnSyncSandboxed } from '../../sandbox.mjs';
 
 function platformOf(ctx) { return ctx?.platform || process.platform; }
 
+// Strip the sandbox-control keys (and our async-only `stdin` helper) from the
+// options bag before forwarding to the (sandboxed) spawner, so only real
+// child_process options reach it. The bare path keeps the historical `opts`
+// object verbatim for byte-stability.
+function spawnOptsOf(opts) {
+  const { sandbox, _spawnSandboxed, _spawnSyncSandboxed, stdin, ...rest } = opts;
+  return rest;
+}
+
+// CAPABILITY-ONLY sandbox seam (default-on isolation, step iv-b). When
+// opts.sandbox is truthy the child is created through the sandbox dispatcher
+// (containment ADDED); a null/absent spec keeps the byte-identical bare spawn
+// path. _spawnSandboxed is a test injection seam — defaults to the real impl.
 function runCmd(cmd, args, opts = {}) {
   return new Promise((resolve) => {
-    const child = spawn(cmd, args, opts);
+    const child = opts.sandbox
+      ? (opts._spawnSandboxed || spawnSandboxed)(opts.sandbox, cmd, args, spawnOptsOf(opts))
+      : spawn(cmd, args, opts);
     let out = '', err = '';
     child.stdout?.on('data', d => out += d.toString());
     child.stderr?.on('data', d => err += d.toString());
@@ -21,19 +37,38 @@ function runCmd(cmd, args, opts = {}) {
   });
 }
 
+// Synchronous mirror of runCmd. When opts.sandbox is truthy the invocation is
+// routed through spawnSyncSandboxed (injectable via opts._spawnSyncSandboxed);
+// otherwise the bare spawnSync path is byte-identical to the historical call.
+function runCmdSync(cmd, args, opts = {}) {
+  return opts.sandbox
+    ? (opts._spawnSyncSandboxed || spawnSyncSandboxed)(opts.sandbox, cmd, args, spawnOptsOf(opts))
+    : spawnSync(cmd, args, spawnOptsOf(opts));
+}
+
+// Pull the sandbox seam out of ctx so each tool can thread it uniformly.
+function sandboxSeam(ctx) {
+  return {
+    sandbox: ctx?.sandbox,
+    _spawnSandboxed: ctx?._spawnSandboxed,
+    _spawnSyncSandboxed: ctx?._spawnSyncSandboxed,
+  };
+}
+
 const clipboard_read = {
   name: 'clipboard_read', category: 'os', sensitive: true,
   description: 'Read the OS clipboard (text).',
   parameters: { type: 'object', properties: {} },
   async exec(_args, ctx) {
     const p = platformOf(ctx);
+    const seam = sandboxSeam(ctx);
     if (p === 'darwin') {
-      const r = spawnSync('pbpaste', [], { encoding: 'utf8' });
+      const r = runCmdSync('pbpaste', [], { encoding: 'utf8', ...seam });
       return r.status === 0 ? { ok: true, text: r.stdout } : { ok: false, error: r.stderr || 'pbpaste failed' };
     }
     if (p === 'linux') {
       for (const [bin, args] of [['wl-paste', []], ['xclip', ['-selection', 'clipboard', '-o']], ['xsel', ['--clipboard', '--output']]]) {
-        const r = spawnSync(bin, args, { encoding: 'utf8' });
+        const r = runCmdSync(bin, args, { encoding: 'utf8', ...seam });
         if (r.status === 0) return { ok: true, text: r.stdout };
       }
       return { ok: false, error: 'clipboard_read: no clipboard helper (install wl-clipboard or xclip)' };
@@ -48,10 +83,11 @@ const clipboard_write = {
   parameters: { type: 'object', properties: { text: { type: 'string' } }, required: ['text'] },
   async exec(args, ctx) {
     const p = platformOf(ctx);
-    if (p === 'darwin') return runCmd('pbcopy', [], { stdin: args.text });
+    const seam = sandboxSeam(ctx);
+    if (p === 'darwin') return runCmd('pbcopy', [], { stdin: args.text, ...seam });
     if (p === 'linux') {
       for (const [bin, ar] of [['wl-copy', []], ['xclip', ['-selection', 'clipboard']], ['xsel', ['--clipboard', '--input']]]) {
-        const r = await runCmd(bin, ar, { stdin: args.text });
+        const r = await runCmd(bin, ar, { stdin: args.text, ...seam });
         if (r.ok) return { ok: true };
       }
       return { ok: false, error: 'clipboard_write: no clipboard helper' };
@@ -67,13 +103,14 @@ const screenshot = {
   async exec(args, ctx) {
     const p = platformOf(ctx);
     const out = args?.path || path.join(os.tmpdir(), `lzc-${Date.now()}.png`);
+    const seam = sandboxSeam(ctx);
     if (p === 'darwin') {
-      const r = spawnSync('screencapture', ['-x', out]);
+      const r = runCmdSync('screencapture', ['-x', out], { ...seam });
       return r.status === 0 ? { ok: true, path: out } : { ok: false, error: 'screencapture failed' };
     }
     if (p === 'linux') {
       for (const [bin, ar] of [['grim', [out]], ['gnome-screenshot', ['-f', out]], ['scrot', [out]]]) {
-        const r = spawnSync(bin, ar);
+        const r = runCmdSync(bin, ar, { ...seam });
         if (r.status === 0) return { ok: true, path: out };
       }
       return { ok: false, error: 'screenshot: no helper found (grim/gnome-screenshot/scrot)' };
@@ -92,14 +129,15 @@ const notify = {
   },
   async exec(args, ctx) {
     const p = platformOf(ctx);
+    const seam = sandboxSeam(ctx);
     const title = args.title;
     const body = args.body || '';
     if (p === 'darwin') {
-      spawnSync('osascript', ['-e', `display notification ${JSON.stringify(body)} with title ${JSON.stringify(title)}`]);
+      runCmdSync('osascript', ['-e', `display notification ${JSON.stringify(body)} with title ${JSON.stringify(title)}`], { ...seam });
       return { ok: true };
     }
     if (p === 'linux') {
-      spawnSync('notify-send', [title, body]);
+      runCmdSync('notify-send', [title, body], { ...seam });
       return { ok: true };
     }
     return { ok: false, error: `notify: unsupported platform ${p}` };
@@ -116,12 +154,29 @@ const open_url = {
       if (u.protocol !== 'http:' && u.protocol !== 'https:') return { ok: false, error: 'open_url: http(s) only' };
     } catch { return { ok: false, error: 'open_url: bad URL' }; }
     const p = platformOf(ctx);
-    if (p === 'darwin') return runCmd('open', [args.url]);
-    if (p === 'linux') return runCmd('xdg-open', [args.url]);
+    const seam = sandboxSeam(ctx);
+    if (p === 'darwin') return runCmd('open', [args.url], { ...seam });
+    if (p === 'linux') return runCmd('xdg-open', [args.url], { ...seam });
     return { ok: false, error: `open_url: unsupported platform ${p}` };
   },
 };
 
+// Build the osascript `choose file` expression. The prompt is model-supplied
+// and gets interpolated into an AppleScript STRING literal, so it must escape
+// backslashes (first) and double-quotes, and strip newlines/control chars — a
+// raw `"`/`\`/newline would otherwise break out of the literal and run an
+// injected AppleScript expression (e.g. `do shell script`). Exported for tests.
+export function _buildChooseScript(kind, prompt) {
+  const fallback = kind === 'save' ? 'Save' : 'Choose';
+  const safe = String(prompt || fallback)
+    .replace(/[\r\n\t\v\f\0]+/g, ' ')
+    .replace(/\\/g, '\\\\')
+    .replace(/"/g, '\\"');
+  return kind === 'save'
+    ? `POSIX path of (choose file name with prompt "${safe}")`
+    : `POSIX path of (choose file with prompt "${safe}")`;
+}
+
 const file_dialog = {
   name: 'file_dialog', category: 'os', sensitive: true,
   description: 'Show an OS file picker. Returns selected path (or null on cancel).',
@@ -131,17 +186,16 @@ const file_dialog = {
   },
   async exec(args, ctx) {
     const p = platformOf(ctx);
+    const seam = sandboxSeam(ctx);
     if (p === 'darwin') {
-      const script = (args.kind === 'save')
-        ? 'POSIX path of (choose file name with prompt "' + (args.prompt || 'Save').replace(/"/g, '\\"') + '")'
-        : 'POSIX path of (choose file with prompt "'      + (args.prompt || 'Choose').replace(/"/g, '\\"') + '")';
-      const r = spawnSync('osascript', ['-e', script], { encoding: 'utf8' });
+      const script = _buildChooseScript(args.kind, args.prompt);
+      const r = runCmdSync('osascript', ['-e', script], { encoding: 'utf8', ...seam });
       if (r.status !== 0) return { ok: true, path: null };
       return { ok: true, path: r.stdout.trim() };
     }
     if (p === 'linux') {
       const ar = args.kind === 'save' ? ['--file-selection', '--save'] : ['--file-selection'];
-      const r = spawnSync('zenity', ar, { encoding: 'utf8' });
+      const r = runCmdSync('zenity', ar, { encoding: 'utf8', ...seam });
       if (r.status !== 0) return { ok: true, path: null };
       return { ok: true, path: r.stdout.trim() };
     }

package/mas/tools/recall.mjs

@@ -46,6 +46,13 @@ function _defaultConfigDir() {
   return process.env.LAZYCLAW_CONFIG_DIR || path.join(os.homedir(), '.lazyclaw');
 }
 
+// Read config.json from the tool's own configDir (not the env), so hybrid
+// recall reads the right config when the dir is passed explicitly. Best-effort.
+function _readCfg(configDir) {
+  try { return JSON.parse(fs.readFileSync(path.join(configDir || _defaultConfigDir(), 'config.json'), 'utf8')); }
+  catch { return {}; }
+}
+
 // Minimal frontmatter parser — read just the cross_cli_tested provider
 // list for a skill by name. Returns [] when the file is missing or
 // parse fails (best-effort ranking helper, not a strict loader).
@@ -105,8 +112,21 @@ export async function exec(args, { configDir } = {}) {
     } catch (err) {
       return { ok: false, error: `recall: openIndex failed — ${err?.message || err}` };
     }
+    // Hybrid recall: when cfg.recall.embeddings is enabled, embed the query and
+    // pass the vector so index_db re-ranks candidates by semantic similarity.
+    // Opt-in + best-effort — any embed failure falls back to pure FTS5.
+    let queryVector, weights;
+    try {
+      const cfg = _readCfg(configDir);
+      const { getEmbedder } = await import('../embedder.mjs');
+      const embedder = getEmbedder(cfg);
+      if (embedder) {
+        const [v] = await embedder.embed([query]);
+        if (v && v.length) { queryVector = v; weights = cfg.recall?.embeddings?.weights; }
+      }
+    } catch { /* fall back to pure FTS */ }
     try {
-      out = indexRecall(query, { configDir, scope: scopes, k });
+      out = indexRecall(query, { configDir, scope: scopes, k, ...(queryVector ? { queryVector, weights } : {}) });
     } catch (err) {
       return { ok: false, error: `recall: query failed — ${err?.message || err}` };
     }
@@ -120,7 +140,13 @@ export async function exec(args, { configDir } = {}) {
       const meta = h.metadata || {};
       for (const key of filterKeys) {
         if (key === 'since') {
-          if (Number(meta.ts || 0) < Number(filter.since)) return false;
+          // Only fts_sessions carries a ts column; skills/trajectories/
+          // memories have no ts. A "since" bound must NOT silently drop
+          // those ts-less hits — only drop a hit that HAS a ts older than
+          // the bound. (meta.ts === undefined / '' means "no timestamp".)
+          if (meta.ts !== undefined && meta.ts !== null && meta.ts !== '') {
+            if (Number(meta.ts) < Number(filter.since)) return false;
+          }
         } else if (String(meta[key] ?? '') !== String(filter[key])) {
           return false;
         }

package/mcp/client.mjs

@@ -59,7 +59,14 @@ export async function startServer({ name, command, args = [], env = {}, allowGlo
             .filter(c => c.type === 'text')
             .map(c => c.text)
             .join('\n');
-          return { ok: true, text, raw: res };
+          // MCP reports TOOL-level failures as { isError: true } WITHOUT
+          // throwing (only protocol/transport faults throw). Surface it as a
+          // failure so the agent doesn't reason forward on a failed call.
+          if (res?.isError) {
+            return { ok: false, error: `${toolName}: ${text || 'tool reported isError'}`, raw: res };
+          }
+          // Pass structuredContent through when the server provides it.
+          return { ok: true, text, structured: res?.structuredContent, raw: res };
         } catch (e) {
           return { ok: false, error: `${toolName}: ${e.message}` };
         }

package/mcp/server_spawn.mjs

@@ -12,7 +12,11 @@ export async function startConfigured(cfg) {
   const servers = cfg?.mcp?.servers || [];
   const results = [];
   for (const s of servers) {
-    try { results.push(await startServer(s)); }
+    // §8: MCP tools invoke external server code, so they MUST stay behind the
+    // fail-closed approval gate. Force sensitive:true at boot — config can
+    // narrow exposure (allowGlob) but can never downgrade an MCP tool to
+    // ungated. A config-supplied sensitive:false is ignored, not honored.
+    try { results.push(await startServer({ ...s, sensitive: true })); }
     catch (e) { results.push({ ok: false, name: s.name, error: e.message }); }
   }
   return results;

package/memory.mjs

@@ -18,11 +18,22 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
+import { tightenIfLoose } from './secure_write.mjs';
 
 const MEMORY_DIRNAME = 'memory';
 const RECENT_CAP = 200;
 const RECENT_KEEP_AFTER_DREAM = 50;
 
+// Best-effort, lazy write-through into the durable FTS recall index. Lazy so
+// better-sqlite3 stays off the chat hot path (this leaf module is touched on
+// every turn via appendRecent) until something actually curates memory; the
+// promise is swallowed so an index hiccup never breaks a memory write.
+function _indexMemorySafe(row, configDir) {
+  import('./mas/index_db.mjs')
+    .then((idx) => { try { idx.indexMemory(row, configDir); } catch { /* best-effort */ } })
+    .catch(() => { /* index module unavailable — recall just stays stale */ });
+}
+
 export function defaultConfigDir() {
   return process.env.LAZYCLAW_CONFIG_DIR || path.join(os.homedir(), '.lazyclaw');
 }
@@ -41,6 +52,10 @@ export function loadCore(configDir = defaultConfigDir()) {
 export function setCore(text, configDir = defaultConfigDir()) {
   fs.mkdirSync(memoryDir(configDir), { recursive: true });
   fs.writeFileSync(corePath(configDir), String(text || ''));
+  tightenIfLoose(corePath(configDir)); // curated memory may hold pasted secrets → owner-only
+  // Mirror into the recall index so curated core memory is durably searchable
+  // (the README "durable recall over … memory" claim) — not just readable.
+  _indexMemorySafe({ topic: 'core', kind: 'core', content: String(text || '') }, configDir);
 }
 
 export function loadRecent(n = 20, configDir = defaultConfigDir()) {
@@ -78,6 +93,7 @@ export function appendRecent(sessionId, role, content, configDir = defaultConfig
       ts: Date.now(),
     }) + '\n';
     fs.appendFileSync(recentPath(configDir), line);
+    tightenIfLoose(recentPath(configDir)); // recency log may hold pasted secrets → owner-only
     // Cheap stat-based check to avoid read-rewrite on every append.
     const st = fs.statSync(recentPath(configDir));
     if (st.size > 1_000_000) {
@@ -125,11 +141,18 @@ export async function dream(sessionId, { provider, model, apiKey } = {}, configD
 
   fs.mkdirSync(episodicDir(configDir), { recursive: true });
   const written = [];
+  // Index the episodic topics in the same pass. dream() is async, so we await
+  // the (lazy) index import once for a deterministic write-through; a failure
+  // is swallowed so consolidation still succeeds even if recall can't index.
+  let indexDb = null;
+  try { indexDb = await import('./mas/index_db.mjs'); } catch { /* recall stays stale */ }
   for (const t of topics) {
     if (!t || !t.topic) continue;
     const slug = String(t.topic).toLowerCase().replace(/[^a-z0-9_.-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 80) || 'untitled';
     const p = path.join(episodicDir(configDir), `${slug}.md`);
     fs.writeFileSync(p, `# ${slug}\n\n${t.summary || ''}\n`);
+    tightenIfLoose(p); // episodic summaries are conversation-derived → owner-only
+    if (indexDb) { try { indexDb.indexMemory({ topic: slug, kind: 'episodic', content: String(t.summary || '') }, configDir); } catch { /* best-effort */ } }
     written.push(slug);
   }
 
@@ -139,6 +162,7 @@ export async function dream(sessionId, { provider, model, apiKey } = {}, configD
     const lines = fs.readFileSync(rp, 'utf8').split('\n').filter(Boolean);
     if (lines.length > RECENT_KEEP_AFTER_DREAM) {
       fs.writeFileSync(rp, lines.slice(-RECENT_KEEP_AFTER_DREAM).join('\n') + '\n');
+      tightenIfLoose(rp);
     }
   }
   return { topics: written };