lazyclaw 6.3.1 → 6.5.0

package/commands/agents.mjs

@@ -1,10 +1,10 @@
 // Multi-agent commands: cmdAgent (one-shot run), cmdTask, cmdTeam, and the
 // agent registry (cmdAgentRegistry), extracted from cli.mjs (Phase D3).
 import path from 'node:path';
-import fs from 'node:fs';
 import { configPath, readConfig, _resolveAuthKey, _resolveBaseUrl } from '../lib/config.mjs';
 import { ensureRegistry, getRegistry } from '../lib/registry_boot.mjs';
 import { loadDotenvIfAny as _loadDotenvShared } from '../dotenv_min.mjs';
+import { defaultSandboxSpec } from '../sandbox/index.mjs';
 
 // Thin .env loader wrapper kept local so the module stays self-contained.
 export function _loadDotenvIfAny(cfgDir) { return _loadDotenvShared(cfgDir); }
@@ -326,6 +326,9 @@ export async function cmdTask(sub, positional, flags = {}) {
           maxAgentTurns: flags['max-turns'] ? parseInt(flags['max-turns'], 10) : undefined,
           approve,
           security: cfg.security,
+          // Default-on isolation: confine every tool the team runs (filesystem
+          // to cwd, secrets unreadable, net allowed). Opt out via cfg.sandbox.
+          sandbox: defaultSandboxSpec(cfg, { cwd: process.cwd(), configDir: cfgDir }),
         });
         emitJson({ id: result.task.id, status: result.task.status, iterations: result.iterations, stoppedBy: result.stoppedBy });
       } catch (err) {
@@ -470,198 +473,9 @@ export async function cmdTeam(sub, positional, flags = {}) {
   }
 }
 
-export async function cmdAgentRegistry(sub, positional, flags = {}) {
-  const agentsMod = await import('../agents.mjs');
-  const cfgDir = path.dirname(configPath());
-  const name = positional[0];
-
-  const emitJson = (obj) => process.stdout.write(JSON.stringify(obj, null, 2) + '\n');
-
-  switch (sub) {
-    case undefined:
-    case 'list': {
-      emitJson(agentsMod.listAgents(cfgDir));
-      return;
-    }
-    case 'add': {
-      if (!name) { console.error('Usage: lazyclaw agent add <name> [--role "..."] [--provider X] [--model Y] [--display "..."] [--tools bash,read,write,grep,skill_view] [--tags a,b] [--skill-write auto|manual|off]'); process.exit(2); }
-      const tools = agentsMod.parseToolsFlag(flags.tools);
-      try {
-        const a = agentsMod.registerAgent({
-          name,
-          displayName: flags.display || flags['display-name'],
-          role: flags.role || '',
-          provider: flags.provider || 'claude-cli',
-          model: flags.model || '',
-          tools: tools === null ? undefined : tools,
-          tags: agentsMod.parseToolsFlag(flags.tags) || [],
-          skillWrite: flags['skill-write'],
-        }, cfgDir);
-        emitJson(a);
-      } catch (err) {
-        console.error(`agent add: ${err?.message || err}`);
-        process.exit(2);
-      }
-      return;
-    }
-    case 'show': {
-      if (!name) { console.error('Usage: lazyclaw agent show <name>'); process.exit(2); }
-      const a = agentsMod.getAgent(name, cfgDir);
-      if (!a) { console.error(`agent show: no agent "${name}"`); process.exit(2); }
-      emitJson(a);
-      return;
-    }
-    case 'edit': {
-      if (!name) { console.error('Usage: lazyclaw agent edit <name> [--role "..."] [--provider X] [--model Y] [--display "..."] [--tools ...] [--skill-write auto|manual|off] [--memory-write auto|manual|off]'); process.exit(2); }
-      const patch = {};
-      if (flags.role !== undefined)         patch.role = String(flags.role);
-      if (flags.provider !== undefined)     patch.provider = String(flags.provider);
-      if (flags.model !== undefined)        patch.model = String(flags.model);
-      if (flags.display !== undefined)      patch.displayName = String(flags.display);
-      if (flags['display-name'] !== undefined) patch.displayName = String(flags['display-name']);
-      if (flags.tools !== undefined)        patch.tools = agentsMod.parseToolsFlag(flags.tools);
-      if (flags.tags !== undefined)         patch.tags = agentsMod.parseToolsFlag(flags.tags);
-      if (flags['skill-write'] !== undefined)  patch.skillWrite = String(flags['skill-write']);
-      if (flags['memory-write'] !== undefined) patch.memoryWrite = String(flags['memory-write']);
-      if (Object.keys(patch).length === 0) {
-        console.error('agent edit: no fields to update');
-        process.exit(2);
-      }
-      try { emitJson(agentsMod.patchAgent(name, patch, cfgDir)); }
-      catch (err) { console.error(`agent edit: ${err?.message || err}`); process.exit(2); }
-      return;
-    }
-    case 'remove':
-    case 'rm':
-    case 'delete': {
-      if (!name) { console.error('Usage: lazyclaw agent remove <name>'); process.exit(2); }
-      try { emitJson(agentsMod.removeAgent(name, cfgDir)); }
-      catch (err) { console.error(`agent remove: ${err?.message || err}`); process.exit(2); }
-      return;
-    }
-    case 'memory': {
-      // memory <show|edit|clear> <name>
-      const op = positional[0];
-      const memName = positional[1];
-      if (!op || !memName) {
-        console.error('Usage: lazyclaw agent memory <show|edit|clear> <name>');
-        process.exit(2);
-      }
-      const memMod = await import('../mas/agent_memory.mjs');
-      try {
-        if (op === 'show') {
-          const max = Number.isFinite(+flags['max-chars']) && +flags['max-chars'] > 0 ? +flags['max-chars'] : memMod.DEFAULT_MAX_CHARS;
-          const text = memMod.readMemory(memName, cfgDir, max);
-          if (!text) process.stderr.write(`(no memory for "${memName}")\n`);
-          else process.stdout.write(text + (text.endsWith('\n') ? '' : '\n'));
-        } else if (op === 'edit') {
-          const p = memMod.memoryPath(memName, cfgDir);
-          // Ensure file exists so $EDITOR doesn't start with a missing
-          // file warning.
-          if (!fs.existsSync(p)) {
-            fs.mkdirSync(path.dirname(p), { recursive: true });
-            fs.writeFileSync(p, `# ${memName} — memory\n\n`);
-          }
-          const editor = process.env.EDITOR || 'vi';
-          const { spawn } = await import('node:child_process');
-          await new Promise((resolve) => {
-            const ch = spawn(editor, [p], { stdio: 'inherit' });
-            ch.on('close', () => resolve());
-          });
-          process.stdout.write(`edited ${p}\n`);
-        } else if (op === 'clear') {
-          const removed = memMod.clear(memName, cfgDir);
-          process.stdout.write(removed ? `cleared memory for "${memName}"\n` : `(no memory for "${memName}")\n`);
-        } else {
-          console.error(`Usage: lazyclaw agent memory <show|edit|clear> <name>`);
-          process.exit(2);
-        }
-      } catch (err) {
-        console.error(`agent memory ${op}: ${err?.message || err}`);
-        process.exit(2);
-      }
-      return;
-    }
-    case 'reflect': {
-      const aname = positional[0];
-      const taskId = flags.task || positional[1];
-      if (!aname || !taskId) {
-        console.error('Usage: lazyclaw agent reflect <name> --task <id>');
-        process.exit(2);
-      }
-      const tasksMod = await import('../tasks.mjs');
-      const memMod = await import('../mas/agent_memory.mjs');
-      const a = agentsMod.getAgent(aname, cfgDir);
-      if (!a) { console.error(`agent reflect: no agent "${aname}"`); process.exit(2); }
-      const task = tasksMod.getTask(taskId, cfgDir);
-      if (!task) { console.error(`agent reflect: no task "${taskId}"`); process.exit(2); }
-      try { _loadDotenvIfAny(cfgDir); } catch { /* best-effort */ }
-      const cfg = readConfig();
-      const apiKey = _resolveAuthKey(cfg, a.provider);
-      const baseUrl = _resolveBaseUrl(a.provider);
-      try {
-        const body = await memMod.reflectOnce({ agent: a, task, apiKey, baseUrl });
-        if (!body || !body.trim()) {
-          process.stderr.write('reflection returned empty body — nothing to write\n');
-          return;
-        }
-        if (!flags['dry-run']) {
-          memMod.prependEntry(aname, { taskId: task.id, title: task.title, body }, cfgDir);
-        }
-        process.stdout.write(body + (body.endsWith('\n') ? '' : '\n'));
-      } catch (err) {
-        console.error(`agent reflect: ${err?.message || err}`);
-        process.exit(2);
-      }
-      return;
-    }
-    case 'skill-synth': {
-      const aname = positional[0];
-      const taskId = flags.task || positional[1];
-      if (!aname || !taskId) {
-        console.error('Usage: lazyclaw agent skill-synth <name> --task <id> [--dry-run]');
-        process.exit(2);
-      }
-      const tasksMod = await import('../tasks.mjs');
-      const synthMod = await import('../mas/skill_synth.mjs');
-      const skillsMod = await import('../skills.mjs');
-      const a = agentsMod.getAgent(aname, cfgDir);
-      if (!a) { console.error(`agent skill-synth: no agent "${aname}"`); process.exit(2); }
-      const task = tasksMod.getTask(taskId, cfgDir);
-      if (!task) { console.error(`agent skill-synth: no task "${taskId}"`); process.exit(2); }
-      try { _loadDotenvIfAny(cfgDir); } catch { /* best-effort */ }
-      const cfg = readConfig();
-      const apiKey = _resolveAuthKey(cfg, a.provider);
-      const baseUrl = _resolveBaseUrl(a.provider);
-      try {
-        const result = await synthMod.synthesizeSkill({ agent: a, task, apiKey, baseUrl });
-        if (!result) {
-          process.stderr.write('skill synthesis produced nothing worth saving\n');
-          return;
-        }
-        if (!flags['dry-run']) {
-          // installSynthesized reserves a collision-free name (never
-          // clobbers a human-authored skill) and version-bumps when it
-          // improves its own prior skill.
-          const installed = synthMod.installSynthesized(
-            { name: result.name, description: result.description, body: result.body, sourceTask: task.id },
-            cfgDir,
-          );
-          emitJson({ skill: installed.skill, description: result.description, version: installed.version, path: installed.path });
-        } else {
-          process.stdout.write(result.doc + (result.doc.endsWith('\n') ? '' : '\n'));
-        }
-      } catch (err) {
-        console.error(`agent skill-synth: ${err?.message || err}`);
-        process.exit(2);
-      }
-      return;
-    }
-    default:
-      console.error('Usage: lazyclaw agent <add|list|show|edit|remove|memory|reflect|skill-synth> ...');
-      process.exit(2);
-  }
-}
+// cmdAgentRegistry lives in a sibling module to keep this file under the
+// file-size gate. Re-exported here so cli.mjs's named import is unchanged.
+export { cmdAgentRegistry } from './agents_registry.mjs';
 
 // Best-effort .env loader for ~/.lazyclaw/.env. Only sets keys that are
 // not already present in process.env (so a shell-level export wins).

package/commands/agents_registry.mjs

@@ -0,0 +1,205 @@
+// Agent registry command (cmdAgentRegistry): the agent
+// add/list/show/edit/remove/memory/reflect/skill-synth handler. Extracted
+// from commands/agents.mjs as a sibling module for the file-size gate.
+import path from 'node:path';
+import fs from 'node:fs';
+import { configPath, readConfig, _resolveAuthKey, _resolveBaseUrl } from '../lib/config.mjs';
+import { loadDotenvIfAny } from '../dotenv_min.mjs';
+
+// Thin .env loader wrapper kept local so the module stays self-contained
+// (importing the wrapper back from agents.mjs would create a cycle).
+function _loadDotenvIfAny(cfgDir) { return loadDotenvIfAny(cfgDir); }
+
+export async function cmdAgentRegistry(sub, positional, flags = {}) {
+  const agentsMod = await import('../agents.mjs');
+  const cfgDir = path.dirname(configPath());
+  const name = positional[0];
+
+  const emitJson = (obj) => process.stdout.write(JSON.stringify(obj, null, 2) + '\n');
+
+  switch (sub) {
+    case undefined:
+    case 'list': {
+      emitJson(agentsMod.listAgents(cfgDir));
+      return;
+    }
+    case 'add': {
+      if (!name) { console.error('Usage: lazyclaw agent add <name> [--role "..."] [--provider X] [--model Y] [--display "..."] [--manager <agent>] [--tools bash,read,write,grep,skill_view] [--tags a,b] [--skill-write auto|manual|off]'); process.exit(2); }
+      const tools = agentsMod.parseToolsFlag(flags.tools);
+      try {
+        const a = agentsMod.registerAgent({
+          name,
+          displayName: flags.display || flags['display-name'],
+          role: flags.role || '',
+          provider: flags.provider || 'claude-cli',
+          model: flags.model || '',
+          tools: tools === null ? undefined : tools,
+          tags: agentsMod.parseToolsFlag(flags.tags) || [],
+          skillWrite: flags['skill-write'],
+          manager: flags.manager,
+        }, cfgDir);
+        emitJson(a);
+      } catch (err) {
+        console.error(`agent add: ${err?.message || err}`);
+        process.exit(2);
+      }
+      return;
+    }
+    case 'show': {
+      if (!name) { console.error('Usage: lazyclaw agent show <name>'); process.exit(2); }
+      const a = agentsMod.getAgent(name, cfgDir);
+      if (!a) { console.error(`agent show: no agent "${name}"`); process.exit(2); }
+      emitJson(a);
+      return;
+    }
+    case 'edit': {
+      if (!name) { console.error('Usage: lazyclaw agent edit <name> [--role "..."] [--provider X] [--model Y] [--display "..."] [--tools ...] [--skill-write auto|manual|off] [--memory-write auto|manual|off]'); process.exit(2); }
+      const patch = {};
+      if (flags.role !== undefined)         patch.role = String(flags.role);
+      if (flags.provider !== undefined)     patch.provider = String(flags.provider);
+      if (flags.model !== undefined)        patch.model = String(flags.model);
+      if (flags.display !== undefined)      patch.displayName = String(flags.display);
+      if (flags['display-name'] !== undefined) patch.displayName = String(flags['display-name']);
+      if (flags.tools !== undefined)        patch.tools = agentsMod.parseToolsFlag(flags.tools);
+      if (flags.tags !== undefined)         patch.tags = agentsMod.parseToolsFlag(flags.tags);
+      if (flags['skill-write'] !== undefined)  patch.skillWrite = String(flags['skill-write']);
+      if (flags['memory-write'] !== undefined) patch.memoryWrite = String(flags['memory-write']);
+      if (Object.keys(patch).length === 0) {
+        console.error('agent edit: no fields to update');
+        process.exit(2);
+      }
+      try { emitJson(agentsMod.patchAgent(name, patch, cfgDir)); }
+      catch (err) { console.error(`agent edit: ${err?.message || err}`); process.exit(2); }
+      return;
+    }
+    case 'remove':
+    case 'rm':
+    case 'delete': {
+      if (!name) { console.error('Usage: lazyclaw agent remove <name>'); process.exit(2); }
+      try { emitJson(agentsMod.removeAgent(name, cfgDir)); }
+      catch (err) { console.error(`agent remove: ${err?.message || err}`); process.exit(2); }
+      return;
+    }
+    case 'memory': {
+      // memory <show|edit|clear> <name>
+      const op = positional[0];
+      const memName = positional[1];
+      if (!op || !memName) {
+        console.error('Usage: lazyclaw agent memory <show|edit|clear> <name>');
+        process.exit(2);
+      }
+      const memMod = await import('../mas/agent_memory.mjs');
+      try {
+        if (op === 'show') {
+          const max = Number.isFinite(+flags['max-chars']) && +flags['max-chars'] > 0 ? +flags['max-chars'] : memMod.DEFAULT_MAX_CHARS;
+          const text = memMod.readMemory(memName, cfgDir, max);
+          if (!text) process.stderr.write(`(no memory for "${memName}")\n`);
+          else process.stdout.write(text + (text.endsWith('\n') ? '' : '\n'));
+        } else if (op === 'edit') {
+          const p = memMod.memoryPath(memName, cfgDir);
+          // Ensure file exists so $EDITOR doesn't start with a missing
+          // file warning.
+          if (!fs.existsSync(p)) {
+            fs.mkdirSync(path.dirname(p), { recursive: true });
+            fs.writeFileSync(p, `# ${memName} — memory\n\n`);
+          }
+          const editor = process.env.EDITOR || 'vi';
+          const { spawn } = await import('node:child_process');
+          await new Promise((resolve) => {
+            const ch = spawn(editor, [p], { stdio: 'inherit' });
+            ch.on('close', () => resolve());
+          });
+          process.stdout.write(`edited ${p}\n`);
+        } else if (op === 'clear') {
+          const removed = memMod.clear(memName, cfgDir);
+          process.stdout.write(removed ? `cleared memory for "${memName}"\n` : `(no memory for "${memName}")\n`);
+        } else {
+          console.error(`Usage: lazyclaw agent memory <show|edit|clear> <name>`);
+          process.exit(2);
+        }
+      } catch (err) {
+        console.error(`agent memory ${op}: ${err?.message || err}`);
+        process.exit(2);
+      }
+      return;
+    }
+    case 'reflect': {
+      const aname = positional[0];
+      const taskId = flags.task || positional[1];
+      if (!aname || !taskId) {
+        console.error('Usage: lazyclaw agent reflect <name> --task <id>');
+        process.exit(2);
+      }
+      const tasksMod = await import('../tasks.mjs');
+      const memMod = await import('../mas/agent_memory.mjs');
+      const a = agentsMod.getAgent(aname, cfgDir);
+      if (!a) { console.error(`agent reflect: no agent "${aname}"`); process.exit(2); }
+      const task = tasksMod.getTask(taskId, cfgDir);
+      if (!task) { console.error(`agent reflect: no task "${taskId}"`); process.exit(2); }
+      try { _loadDotenvIfAny(cfgDir); } catch { /* best-effort */ }
+      const cfg = readConfig();
+      const apiKey = _resolveAuthKey(cfg, a.provider);
+      const baseUrl = _resolveBaseUrl(a.provider);
+      try {
+        const body = await memMod.reflectOnce({ agent: a, task, apiKey, baseUrl });
+        if (!body || !body.trim()) {
+          process.stderr.write('reflection returned empty body — nothing to write\n');
+          return;
+        }
+        if (!flags['dry-run']) {
+          memMod.prependEntry(aname, { taskId: task.id, title: task.title, body }, cfgDir);
+        }
+        process.stdout.write(body + (body.endsWith('\n') ? '' : '\n'));
+      } catch (err) {
+        console.error(`agent reflect: ${err?.message || err}`);
+        process.exit(2);
+      }
+      return;
+    }
+    case 'skill-synth': {
+      const aname = positional[0];
+      const taskId = flags.task || positional[1];
+      if (!aname || !taskId) {
+        console.error('Usage: lazyclaw agent skill-synth <name> --task <id> [--dry-run]');
+        process.exit(2);
+      }
+      const tasksMod = await import('../tasks.mjs');
+      const synthMod = await import('../mas/skill_synth.mjs');
+      const skillsMod = await import('../skills.mjs');
+      const a = agentsMod.getAgent(aname, cfgDir);
+      if (!a) { console.error(`agent skill-synth: no agent "${aname}"`); process.exit(2); }
+      const task = tasksMod.getTask(taskId, cfgDir);
+      if (!task) { console.error(`agent skill-synth: no task "${taskId}"`); process.exit(2); }
+      try { _loadDotenvIfAny(cfgDir); } catch { /* best-effort */ }
+      const cfg = readConfig();
+      const apiKey = _resolveAuthKey(cfg, a.provider);
+      const baseUrl = _resolveBaseUrl(a.provider);
+      try {
+        const result = await synthMod.synthesizeSkill({ agent: a, task, apiKey, baseUrl });
+        if (!result) {
+          process.stderr.write('skill synthesis produced nothing worth saving\n');
+          return;
+        }
+        if (!flags['dry-run']) {
+          // installSynthesized reserves a collision-free name (never
+          // clobbers a human-authored skill) and version-bumps when it
+          // improves its own prior skill.
+          const installed = synthMod.installSynthesized(
+            { name: result.name, description: result.description, body: result.body, sourceTask: task.id },
+            cfgDir,
+          );
+          emitJson({ skill: installed.skill, description: result.description, version: installed.version, path: installed.path });
+        } else {
+          process.stdout.write(result.doc + (result.doc.endsWith('\n') ? '' : '\n'));
+        }
+      } catch (err) {
+        console.error(`agent skill-synth: ${err?.message || err}`);
+        process.exit(2);
+      }
+      return;
+    }
+    default:
+      console.error('Usage: lazyclaw agent <add|list|show|edit|remove|memory|reflect|skill-synth> ...');
+      process.exit(2);
+  }
+}

package/commands/auth_nodes.mjs

@@ -204,8 +204,26 @@ export async function cmdNodes(sub, positional, flags = {}) {
       console.log(JSON.stringify(store.revoke(deviceId)));
       return;
     }
+    case 'rotate': {
+      const deviceId = positional[0];
+      if (!deviceId) {
+        console.error('Usage: lazyclaw nodes rotate <deviceId> [--ttl <ms>]');
+        process.exit(2);
+      }
+      const ttlRaw = flags.ttl;
+      const ttlMs = (ttlRaw !== undefined && ttlRaw !== true) ? Number(ttlRaw) : undefined;
+      const { PairingStore } = await import('../gateway/device_auth.mjs');
+      const store = new PairingStore(path.dirname(configPath()));
+      try {
+        const { expiresAt } = store.rotate(deviceId, { ttlMs });
+        // Like approve, the token is intentionally NOT printed — the device
+        // receives its rotated token on its next /gateway/connect.
+        console.log(JSON.stringify({ ok: true, rotated: deviceId, ...(expiresAt ? { expiresAt } : {}), note: 'device receives its new token on next /gateway/connect' }));
+      } catch (e) { console.error(`error: ${e.message}`); process.exit(1); }
+      return;
+    }
     default:
-      console.error('Usage: lazyclaw nodes <list|register|remove|pending|approve <requestId>|revoke <deviceId>|devices> ...');
+      console.error('Usage: lazyclaw nodes <list|register|remove|pending|approve <requestId>|revoke <deviceId>|rotate <deviceId>|devices> ...');
       process.exit(2);
   }
 }

package/commands/automation.mjs

@@ -1,6 +1,7 @@
 // Automation commands: cron schedules, detached loop workers, and goals,
-// extracted from cli.mjs (Phase D3). Owns the _killLog/KILL_ESCALATE_MS
-// loop-kill escalation state.
+// extracted from cli.mjs (Phase D3). The `loops` subcommands and their
+// _killLog/KILL_ESCALATE_MS escalation state live in ./automation_loops.mjs
+// (re-exported below) to keep this file under the size gate.
 import path from 'node:path';
 import { configPath, readConfig, writeConfig, _resolveAuthKey } from '../lib/config.mjs';
 import { ensureRegistry, getRegistry } from '../lib/registry_boot.mjs';
@@ -10,6 +11,21 @@ import { loadDotenvIfAny as _loadDotenvShared } from '../dotenv_min.mjs';
 // Thin .env loader wrapper kept local so the module stays self-contained.
 export function _loadDotenvIfAny(cfgDir) { return _loadDotenvShared(cfgDir); }
 
+// Build the detached loop-worker argv. Pure + exported so the flag-forwarding
+// contract is unit-testable: --use-memory / --recall MUST reach the worker, or
+// `loop --detach --use-memory` silently runs with no memory (the worker only
+// builds a system message when it sees the flags).
+export function buildDetachArgv(worker, { loopId, prompt, max, provName, cfgDir, until, requestedSession, model, useMemory, recall } = {}) {
+  const argv = [worker, '--loop-id', loopId, '--prompt', prompt,
+    '--max', String(max), '--provider', provName, '--cfg-dir', cfgDir];
+  if (until) { argv.push('--until', String(until)); }
+  if (requestedSession) { argv.push('--session-existing', requestedSession); }
+  if (model) { argv.push('--model', String(model)); }
+  if (useMemory) { argv.push('--use-memory'); }
+  if (recall) { argv.push('--recall', String(recall)); }
+  return argv;
+}
+
 export async function cmdCron(sub, positional, flags = {}) {
   const cron = await import('../cron.mjs');
   const cfg = readConfig();
@@ -169,11 +185,11 @@ export async function cmdLoop(prompt, flags = {}) {
     // <repo>/scripts/loop-worker.mjs (was a sibling when cmdLoop was in cli.mjs).
     const here = path.dirname(new URL(import.meta.url).pathname);
     const worker = path.join(here, '..', 'scripts', 'loop-worker.mjs');
-    const argv = [worker, '--loop-id', loopId, '--prompt', prompt,
-      '--max', String(max), '--provider', provName, '--cfg-dir', cfgDir];
-    if (flags.until) { argv.push('--until', String(flags.until)); }
-    if (requestedSession) { argv.push('--session-existing', requestedSession); }
-    if (model) { argv.push('--model', String(model)); }
+    const argv = buildDetachArgv(worker, {
+      loopId, prompt, max, provName, cfgDir,
+      until: flags.until, requestedSession, model,
+      useMemory: flags['use-memory'], recall: flags.recall,
+    });
     const child = spawn(process.execPath, argv, {
       detached: true,
       stdio: 'ignore',
@@ -251,93 +267,11 @@ export async function cmdLoop(prompt, flags = {}) {
   }
 }
 
-// Kill registry — `lazyclaw loops kill <id>` SIGTERMs once and SIGKILLs
-// on a second invocation within KILL_ESCALATE_MS. Module-scoped so two
-// rapid invocations of `cmd loops kill <id>` from the same process see
-// each other; for separate processes the worker also handles SIGKILL by
-// the OS, so the escalation is a UX nicety rather than a correctness gate.
-const _killLog = new Map();
-const KILL_ESCALATE_MS = 5000;
-
-export async function cmdLoops(sub, positional, flags = {}) {
-  const loopsMod = await import('../loops.mjs');
-  const cfgDir = path.dirname(configPath());
-  switch (sub) {
-    case undefined:
-    case 'list': {
-      const items = loopsMod.listLoops(cfgDir).map(loopsMod.reconcileStatus);
-      console.log(JSON.stringify(items, null, 2));
-      return;
-    }
-    case 'show': {
-      const id = positional[0];
-      if (!id) { console.error('Usage: lazyclaw loops show <id>'); process.exit(2); }
-      const meta = loopsMod.reconcileStatus(loopsMod.readMeta(id, cfgDir));
-      if (!meta) { console.error(`no loop "${id}"`); process.exit(1); }
-      const iterations = loopsMod.readIterations(id, cfgDir);
-      const result = loopsMod.readResult(id, cfgDir);
-      console.log(JSON.stringify({ id, meta, iterations, result }, null, 2));
-      return;
-    }
-    case 'kill': {
-      const id = positional[0];
-      if (!id) { console.error('Usage: lazyclaw loops kill <id>'); process.exit(2); }
-      const meta = loopsMod.readMeta(id, cfgDir);
-      if (!meta) { console.error(`no loop "${id}"`); process.exit(1); }
-      if (!meta.pid) { console.error(`loop "${id}" has no pid`); process.exit(1); }
-      const last = _killLog.get(id) || 0;
-      const now = Date.now();
-      const escalate = (now - last) < KILL_ESCALATE_MS && last > 0;
-      const sig = escalate ? 'SIGKILL' : 'SIGTERM';
-      try { process.kill(meta.pid, sig); }
-      catch (e) {
-        if (e?.code !== 'ESRCH') throw e;
-        // Already gone — reconcile and report.
-        loopsMod.patchMeta(id, { status: 'killed', finishedAt: new Date().toISOString() }, cfgDir);
-        console.log(JSON.stringify({ id, pid: meta.pid, signal: sig, status: 'already_gone' }));
-        return;
-      }
-      _killLog.set(id, now);
-      console.log(JSON.stringify({ id, pid: meta.pid, signal: sig, escalated: escalate }));
-      return;
-    }
-    case 'tail': {
-      const id = positional[0];
-      if (!id) { console.error('Usage: lazyclaw loops tail <id>'); process.exit(2); }
-      const dir = loopsMod.loopDir(id, cfgDir);
-      const logPath = path.join(dir, 'iterations.log');
-      const fs = await import('node:fs');
-      if (!fs.existsSync(dir)) { console.error(`no loop "${id}"`); process.exit(1); }
-      // Print everything already on disk first, then poll for new lines
-      // until the worker exits / status is no longer "running".
-      let offset = 0;
-      if (fs.existsSync(logPath)) {
-        const buf = fs.readFileSync(logPath, 'utf8');
-        process.stdout.write(buf);
-        offset = buf.length;
-      }
-      const pollMs = Number(flags['poll-ms']) || 250;
-      const maxMs = Number(flags['max-wait-ms']) || 0; // 0 = wait indefinitely
-      const startedAt = Date.now();
-      while (true) {
-        await new Promise(r => setTimeout(r, pollMs));
-        let cur = '';
-        try { cur = fs.readFileSync(logPath, 'utf8'); } catch { /* file may briefly not exist */ }
-        if (cur.length > offset) {
-          process.stdout.write(cur.slice(offset));
-          offset = cur.length;
-        }
-        const meta = loopsMod.reconcileStatus(loopsMod.readMeta(id, cfgDir));
-        if (!meta || meta.status !== 'running') break;
-        if (maxMs > 0 && Date.now() - startedAt > maxMs) break;
-      }
-      return;
-    }
-    default:
-      console.error('Usage: lazyclaw loops <list|show|kill|tail> ...');
-      process.exit(2);
-  }
-}
+// `lazyclaw loops <list|show|kill|tail>` and its private _killLog/
+// KILL_ESCALATE_MS escalation state live in a sibling module to keep this
+// file under the size gate. Re-exported so cli.mjs's named import keeps
+// resolving against ./commands/automation.mjs.
+export { cmdLoops } from './automation_loops.mjs';
 
 // Install (or refresh) the system scheduler entry that fires
 // `lazyclaw goal tick <name>` on a schedule. Writes to cfg.cron and to