lazyclaw 6.6.0 → 6.8.0

package/cli.mjs

@@ -403,6 +403,11 @@ async function main() {
       await (await import('./commands/config.mjs')).cmdDoctor();
       break;
     }
+    case 'login': {
+      const code = await (await import('./commands/login.mjs')).cmdLogin(rest.positional, rest.flags);
+      if (code) process.exitCode = code;
+      break;
+    }
     case 'status': {
       await (await import('./commands/config.mjs')).cmdStatus();
       break;

package/commands/chat.mjs

@@ -11,6 +11,7 @@ import {
 } from '../lib/config.mjs';
 import { ensureRegistry, requireRegistry, getRegistry } from '../lib/registry_boot.mjs';
 import { SUBCOMMANDS, parseArgs, AGENT_REG_SUBS } from '../lib/args.mjs';
+import { LAZYCLAW_META_GUARD } from '../lib/nl_config_command.mjs';
 import {
   _attachGhostAutocomplete, _fetchModelsForProvider,
   _pickProviderInteractive, _printChatBanner,
@@ -176,7 +177,7 @@ export async function cmdChat(flags = {}) {
         } catch (err) { console.error(`skill error: ${err.message}`); process.exit(2); }
       }
       if (_inkSysParts.length && !_inkMessages.some((m) => m.role === 'system')) {
-        const merged = _inkSysParts.join('\n\n---\n\n');
+        const merged = [..._inkSysParts, LAZYCLAW_META_GUARD].join('\n\n---\n\n');
         _inkMessages.unshift({ role: 'system', content: merged });
         if (_inkSessionId) sessionsMod.appendTurn(_inkSessionId, 'system', merged, _inkCfgDir);
       }
@@ -455,7 +456,7 @@ export async function cmdChat(flags = {}) {
     }
   }
   if (sysParts.length && !messages.some(m => m.role === 'system')) {
-    const merged = sysParts.join('\n\n---\n\n');
+    const merged = [...sysParts, LAZYCLAW_META_GUARD].join('\n\n---\n\n');
     messages.unshift({ role: 'system', content: merged });
     if (sessionId) sessionsMod.appendTurn(sessionId, 'system', merged, cfgDir);
   }
@@ -651,11 +652,8 @@ export async function cmdChat(flags = {}) {
 // listener from a previous run doesn't crash the launch with EADDRINUSE.
 // Mirrors the Python server's auto-kill behaviour described in CLAUDE.md.
 
-
-
 // sandbox subcommands — list/test/add/use (Phase D).
 
-
 // Interactive launcher — fired when the user types `lazyclaw` with
 // no subcommand AND we're attached to a TTY. OpenClaw's launcher
 // pattern: ASCII banner + provider/model status + arrow-key menu of

package/commands/login.mjs

@@ -0,0 +1,108 @@
+// commands/login.mjs — `lazyclaw login [claude]`.
+//
+// lazyclaw is keyless: chatting via the claude-cli provider spawns the `claude`
+// binary, which carries its own login. But the model-LISTING path makes a
+// direct api.anthropic.com call that needs a bearer, and on macOS the `claude`
+// login lives in the Keychain (no credential file), so listing failed with
+// "set ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN". This command resolves the
+// credential across env / file / Keychain and, when none is present, mints a
+// long-lived token via `claude setup-token`. The minted token is stored in
+// <config>/.env (0600, gitignored) — the same env path model listing reads.
+
+import path from 'node:path';
+import { execFileSync, spawn } from 'node:child_process';
+import { _claudeCodeOAuthToken } from '../providers/model_catalogue.mjs';
+import { readClaudeKeychainToken } from '../providers/claude_keychain.mjs';
+import { writeDotenvMerge } from '../dotenv_min.mjs';
+import { configPath } from '../lib/config.mjs';
+
+// Where the claude-cli bearer comes from, in priority order. Pure + injectable.
+export function resolveClaudeAuth({ env = process.env, home, readFileSync, keychainReader } = {}) {
+  if (env.CLAUDE_CODE_OAUTH_TOKEN) return { authenticated: true, source: 'env' };
+  if (env.ANTHROPIC_API_KEY) return { authenticated: true, source: 'apiKey' };
+  // Credential file (Linux / non-keychain) — keychain disabled here so we can
+  // distinguish the two sources for the status message.
+  const fileTok = _claudeCodeOAuthToken({ home, readFileSync, keychainReader: () => null });
+  if (fileTok) return { authenticated: true, source: 'file' };
+  const kcTok = (keychainReader || readClaudeKeychainToken)();
+  if (kcTok) return { authenticated: true, source: 'keychain' };
+  return { authenticated: false, source: 'none' };
+}
+
+function _hasClaudeBinary() {
+  try { execFileSync('claude', ['--version'], { stdio: 'ignore', timeout: 4000 }); return true; }
+  catch { return false; }
+}
+
+function _runSetupToken() {
+  return new Promise((resolve) => {
+    try {
+      const p = spawn('claude', ['setup-token'], { stdio: 'inherit' });
+      p.on('exit', (code) => resolve(code ?? 1));
+      p.on('error', () => resolve(1));
+    } catch { resolve(1); }
+  });
+}
+
+const SOURCE_LABEL = {
+  env: 'CLAUDE_CODE_OAUTH_TOKEN env var',
+  apiKey: 'ANTHROPIC_API_KEY env var',
+  file: 'claude credential file (~/.claude)',
+  keychain: 'macOS Keychain (your `claude login`)',
+};
+
+export async function cmdLogin(positional = [], flags = {}, deps = {}) {
+  const log = deps.log || ((s) => process.stdout.write(s + '\n'));
+  const err = deps.err || ((s) => process.stderr.write(s + '\n'));
+  const provider = String(positional[0] || 'claude').toLowerCase();
+  if (provider !== 'claude' && provider !== 'claude-cli') {
+    err(`login: only 'claude' is supported right now (got "${provider}"). Other providers use their own CLI login.`);
+    return 2;
+  }
+  const cfgDir = deps.cfgDir || path.dirname(configPath());
+  const resolve = deps.resolve || resolveClaudeAuth;
+  const writeEnv = deps.writeEnv || ((vars) => writeDotenvMerge(cfgDir, vars));
+
+  // Save a token the user already minted (e.g. via `claude setup-token`).
+  if (flags.token) {
+    const tok = String(flags.token).trim();
+    if (!tok) { err('login: --token was empty'); return 2; }
+    writeEnv({ CLAUDE_CODE_OAUTH_TOKEN: tok });
+    log('✓ saved CLAUDE_CODE_OAUTH_TOKEN to <config>/.env (0600). claude-cli model listing + recall will use it.');
+    return 0;
+  }
+
+  const status = resolve();
+  if (status.authenticated) {
+    log(`✓ claude-cli is already authenticated — via ${SOURCE_LABEL[status.source] || status.source}.`);
+    log('  Model listing, recall, and the keyless trainer will work. Nothing to do.');
+    return 0;
+  }
+
+  if (flags.check) {
+    err('✗ no claude-cli credential found (no env token, ~/.claude credential file, or macOS Keychain login).');
+    return 1;
+  }
+
+  const hasClaude = deps.hasClaudeBinary ? deps.hasClaudeBinary() : _hasClaudeBinary();
+  if (!hasClaude) {
+    err('No claude-cli credential found, and no `claude` binary on PATH.');
+    log('Install the Claude CLI and log in:');
+    log('  npm i -g @anthropic-ai/claude-code');
+    log('  claude login');
+    log('Then re-run `lazyclaw login`. (Headless/CI: set CLAUDE_CODE_OAUTH_TOKEN, or `lazyclaw login --token <token>`.)');
+    return 1;
+  }
+
+  log('No usable credential found. Launching `claude setup-token` to mint a long-lived token…');
+  log('(A browser opens for OAuth; the token is printed when it finishes.)\n');
+  const code = deps.runSetupToken ? await deps.runSetupToken() : await _runSetupToken();
+  if (code !== 0) {
+    err('\n`claude setup-token` did not complete. Alternatively run `claude login`, then re-run `lazyclaw login`.');
+    return 1;
+  }
+  log('\nDone. Copy the token printed above, then save it with EITHER:');
+  log('  lazyclaw login --token <paste-token>      # writes <config>/.env (recommended)');
+  log('  export CLAUDE_CODE_OAUTH_TOKEN=<paste-token>');
+  return 0;
+}

package/commands/setup.mjs

@@ -12,6 +12,7 @@ import {
 } from '../lib/config.mjs';
 import { ensureRegistry, requireRegistry, getRegistry } from '../lib/registry_boot.mjs';
 import { SUBCOMMANDS, parseArgs, AGENT_REG_SUBS } from '../lib/args.mjs';
+import { runPermissionStep } from './setup_permission.mjs';
 import {
   _attachGhostAutocomplete, _fetchModelsForProvider, _pauseChatForSubMenu,
   _pickModelInteractive, _pickProviderInteractive, _printChatBanner,
@@ -94,10 +95,6 @@ export async function cmdOnboard(flags) {
   console.log(JSON.stringify({ ok: true, written: configPath(), provider: next.provider, model: next.model || null, hasApiKey: !!next['api-key'] }));
 }
 
-
-
-
-
 export function cmdHelp(name) {
   if (!name) {
     process.stdout.write('lazyclaw — terminal AI assistant + workflow engine\n\n');
@@ -118,8 +115,6 @@ export function cmdHelp(name) {
   process.stdout.write(detail + '\n');
 }
 
-
-
 export async function cmdSetup(_sub, _positional, flags = {}) {
   await ensureRegistry();
   const accent = (s) => `\x1b[38;2;217;179;90m${s}\x1b[0m`;
@@ -178,6 +173,10 @@ export async function cmdSetup(_sub, _positional, flags = {}) {
   // Context window — asked right after the model pick (optional; Enter keeps
   // defaults). Not a numbered step: it's part of the core model setup.
   await runContextStep({ prompt: _quickPrompt, colors });
+
+  // Tool-permission mode (cfg.chat.permissionMode) — part of the core chat
+  // setup. Extracted to ./setup_permission.mjs (file-size gate).
+  await runPermissionStep({ prompt: _quickPrompt, colors, cfg: cfgAfterOnboard });
   }
 
   // ── Step 2/7: Verify one clean chat works ───────────────────
@@ -703,4 +702,3 @@ export async function cmdLauncher() {
   process.exit(0);
 }
 
-

package/commands/setup_permission.mjs

@@ -0,0 +1,31 @@
+// commands/setup_permission.mjs — the setup-wizard "tool permissions" step,
+// extracted from commands/setup.mjs to stay under the file-size gate (D8) and
+// to match the other modular steps (runContextStep / runChannelStep / …).
+//
+// Asks how the claude-cli agent should handle tool permissions and stores the
+// choice at cfg.chat.permissionMode. lib/permission_mode.resolvePermissionMode
+// reads it for every claude spawn; unset defaults to bypass (no nagging).
+
+import { readConfig, writeConfig } from '../lib/config.mjs';
+import { parsePermissionChoice } from '../lib/permission_mode.mjs';
+
+export async function runPermissionStep({ prompt, colors, cfg } = {}) {
+  const accent = (colors && colors.accent) || ((s) => s);
+  const dim = (colors && colors.dim) || ((s) => s);
+  const ok = (colors && colors.ok) || ((s) => s);
+  const provider = String((cfg || readConfig()).provider || '');
+  // Only relevant to the claude-cli agent path (the one that spawns `claude`).
+  if (!/claude/.test(provider)) return;
+
+  process.stdout.write(`  ${dim('Tool permissions — when the agent edits files or runs commands:')}\n`);
+  process.stdout.write(`  ${dim('    bypass = never ask (fast) · ask = prompt each time · acceptEdits = auto-accept edits only · plan = read-only')}\n`);
+  const mode = parsePermissionChoice(await prompt(`  ${accent('permission')} [bypass/ask/acceptEdits/plan] ${dim('(Enter = bypass)')}: `));
+  if (mode) {
+    const c = readConfig();
+    c.chat = { ...(c.chat || {}), permissionMode: mode };
+    writeConfig(c);
+    process.stdout.write(`  ${ok('✓ permission mode:')} ${mode}\n\n`);
+  } else {
+    process.stdout.write(`  ${dim('(unrecognised — kept the current setting)')}\n\n`);
+  }
+}

package/lib/args.mjs

@@ -10,7 +10,7 @@ export const SUBCOMMANDS = [
   'run', 'resume', 'inspect', 'clear', 'validate', 'graph',
   'workflow',
   'config', 'chat', 'agent',
-  'doctor', 'status', 'onboard',
+  'doctor', 'status', 'onboard', 'login',
   'sessions', 'skills', 'providers',
   'daemon', 'version', 'completion', 'help',
   'export', 'import',

package/lib/nl_config_command.mjs

@@ -0,0 +1,103 @@
+// lib/nl_config_command.mjs — turn a few high-signal natural-language requests
+// into REAL lazyclaw config changes, so the chat model can't just reply
+// "done" without anything happening (the user's bug: orchestrator on/off and
+// planner/worker model swaps typed in chat were hallucinated as success).
+//
+// Deliberately CONSERVATIVE — it must never hijack a genuine chat turn. It only
+// fires on short, imperative messages that clearly name a setting + an action,
+// and bails on anything that looks like a question. Everything it doesn't catch
+// falls through to the model (where the system-prompt honesty guard tells it to
+// point at the real command instead of claiming success).
+
+import { resolveModelAlias } from '../providers/claude_cli.mjs';
+import { orchestratorGet, orchestratorSet, orchestratorEnable } from '../config_features.mjs';
+
+// Appended to the chat system prompt (when one exists) so the model stops
+// claiming it changed a setting it can't reach. The common orchestrator on/off
+// and planner/worker swaps ARE applied for real by detectConfigCommand above;
+// everything else must be redirected to a command, not faked.
+export const LAZYCLAW_META_GUARD =
+  'You are running inside the lazyclaw CLI. You CANNOT change lazyclaw\'s own configuration ' +
+  '(provider, orchestrator planner/workers, models, agents, teams) from this chat — you have no tool for it. ' +
+  'If the user asks you to change a setting, do NOT claim you did it. Instead give the exact command: ' +
+  '`/orchestrator off | planner <provider:model> | worker add <provider:model>`, `lazyclaw agent add …`, ' +
+  '`lazyclaw team …`, or `lazyclaw config set <key> <value>`. ' +
+  '(Plain-language orchestrator on/off and planner/worker model changes are applied automatically — others are not.)';
+
+const ORCH = /오케스트라|오케스트레이터|오케스트레이션|orchestrat/i;
+const OFF = /\boff\b|\bdisable\b|끄|꺼|비활성/i;
+const ON = /\bon\b|\benable\b|켜|활성/i;
+const KO_MODEL = [['소넷', 'sonnet'], ['쏘넷', 'sonnet'], ['하이쿠', 'haiku'], ['오퍼스', 'opus'], ['오푸스', 'opus']];
+const MODEL_TOKEN = /\b(opus|sonnet|haiku|gpt-?[0-9][\w.-]*|gemini-?[0-9][\w.-]*|o[0-9]|claude-[a-z0-9-]+)\b/i;
+
+// Questions / explanations must pass straight through to the model.
+function looksLikeQuestion(t) {
+  return /[?？]/.test(t) ||
+    /(법|방법|어떻게|어케|뭐|무엇|설명|알려|차이|왜|how\b|what\b|why\b|explain|difference|\bvs\b)/i.test(t);
+}
+
+function extractModel(t) {
+  for (const [ko, en] of KO_MODEL) if (t.includes(ko)) return en;
+  const m = MODEL_TOKEN.exec(t);
+  if (!m) return null;
+  const tok = m[1].toLowerCase();
+  return resolveModelAlias(tok) || tok;
+}
+
+// Returns an intent object or null. Intents:
+//   { kind: 'orchestrator', enable: boolean }
+//   { kind: 'planner'|'worker', model: string }
+export function detectConfigCommand(text) {
+  const t = String(text || '').trim();
+  if (!t || t.length > 80) return null;       // long → a real task, not a command
+  if (looksLikeQuestion(t)) return null;
+
+  if (ORCH.test(t)) {
+    if (OFF.test(t)) return { kind: 'orchestrator', enable: false }; // 비활성 → off (checked first)
+    if (ON.test(t)) return { kind: 'orchestrator', enable: true };
+  }
+
+  const wantsPlanner = /플래너|planner/i.test(t);
+  const wantsWorker = /워커|worker/i.test(t);
+  if (wantsPlanner && wantsWorker) return null;  // ambiguous — do them in separate messages
+  if (wantsPlanner || wantsWorker) {
+    const model = extractModel(t);
+    if (model) return { kind: wantsPlanner ? 'planner' : 'worker', model };
+  }
+  return null;
+}
+
+const provOf = (spec) => {
+  const s = String(spec || '');
+  return s.includes(':') ? s.split(':')[0] : (s || 'claude-cli');
+};
+
+// Apply a detected intent for real. deps: { readConfig, writeConfig, ctxCfg? }.
+// Returns a short confirmation string to show the user.
+export function applyConfigCommand(intent, deps) {
+  const cfg = deps.readConfig();
+  const syncCtx = () => {
+    if (deps.ctxCfg) { deps.ctxCfg.provider = cfg.provider; deps.ctxCfg.orchestrator = cfg.orchestrator; }
+  };
+
+  if (intent.kind === 'orchestrator') {
+    orchestratorEnable(cfg, intent.enable);
+    deps.writeConfig(cfg); syncCtx();
+    return intent.enable
+      ? '✓ Orchestrator ON — chats route through planner + workers. Set models with `/orchestrator planner <provider:model>` and `/orchestrator worker add <provider:model>`.'
+      : `✓ Orchestrator off — chats route to \`${cfg.provider}\`.`;
+  }
+
+  const o = orchestratorGet(cfg);
+  if (intent.kind === 'planner') {
+    const spec = `${provOf(o.planner)}:${intent.model}`;
+    orchestratorSet(cfg, { planner: spec });
+    deps.writeConfig(cfg); syncCtx();
+    return `✓ Planner → \`${spec}\`.`;
+  }
+  // worker — set the workers list to the chosen model (preserves the provider).
+  const spec = `${provOf((o.workers && o.workers[0]) || o.planner)}:${intent.model}`;
+  orchestratorSet(cfg, { workers: [spec] });
+  deps.writeConfig(cfg); syncCtx();
+  return `✓ Workers → [\`${spec}\`].`;
+}

package/lib/permission_mode.mjs

@@ -0,0 +1,36 @@
+// lib/permission_mode.mjs — the claude-cli permission mode lazyclaw passes to
+// the spawned `claude` (`--permission-mode <mode>`).
+//
+// lazyclaw is an autonomous-agent CLI: the agentic / team path already runs the
+// agent with bypassPermissions so it doesn't stop to ask before every tool. The
+// interactive chat path historically passed no flag, so claude fell back to its
+// own "default" mode and prompted on each tool — annoying when you just want it
+// to run. This centralises the choice: `cfg.chat.permissionMode` (asked at
+// setup) drives every claude spawn; unset defaults to bypassPermissions so the
+// out-of-the-box experience doesn't nag. Cautious users pick 'default' (prompt
+// each time), 'acceptEdits' (auto-accept edits, prompt for the rest), or 'plan'.
+
+export const PERMISSION_MODES = ['default', 'acceptEdits', 'bypassPermissions', 'plan'];
+
+export const DEFAULT_PERMISSION_MODE = 'bypassPermissions';
+
+// Resolve the effective mode from config. An unset or unrecognised value falls
+// back to the default rather than handing claude an invalid --permission-mode.
+export function resolvePermissionMode(cfg) {
+  const m = cfg && cfg.chat && cfg.chat.permissionMode;
+  return PERMISSION_MODES.includes(m) ? m : DEFAULT_PERMISSION_MODE;
+}
+
+// Map a setup-wizard answer to a permission mode. Empty (Enter) → the default
+// (bypass). Returns null for an unrecognised answer so the caller can keep the
+// current value rather than guess.
+const CHOICE_MAP = {
+  '': DEFAULT_PERMISSION_MODE, bypass: 'bypassPermissions', b: 'bypassPermissions',
+  ask: 'default', default: 'default', d: 'default', prompt: 'default',
+  acceptedits: 'acceptEdits', accept: 'acceptEdits', edits: 'acceptEdits', e: 'acceptEdits',
+  plan: 'plan', p: 'plan',
+};
+export function parsePermissionChoice(answer) {
+  const k = String(answer ?? '').trim().toLowerCase();
+  return Object.prototype.hasOwnProperty.call(CHOICE_MAP, k) ? CHOICE_MAP[k] : null;
+}

package/mas/index_db.mjs

@@ -42,6 +42,33 @@ function _logIndexFailure(configDir, scope, err) {
   } catch { /* swallow — surface only via console.warn below */ }
 }
 
+// The native better-sqlite3 addon fails to load when node_modules was built
+// against a different Node.js ABI than the one running lazyclaw (a Node switch
+// via nvm/brew, or copied node_modules). Every index op then throws the same
+// thing — so instead of dumping the raw stack on each write, recognise it and
+// print ONE actionable hint, then stay quiet. Chat is unaffected; only recall /
+// skill search degrade until the addon is rebuilt.
+let _nativeHintShown = false;
+export function _resetNativeHint() { _nativeHintShown = false; } // test seam
+export function _isNativeAbiError(e) {
+  return /NODE_MODULE_VERSION|was compiled against a different Node|better_sqlite3\.node|invalid ELF header|dlopen\(/i
+    .test(String(e?.message || e || ''));
+}
+export function _warnIndexFailure(label, e) {
+  if (_isNativeAbiError(e)) {
+    if (_nativeHintShown) return;
+    _nativeHintShown = true;
+    // eslint-disable-next-line no-console
+    console.warn(
+      '[index_db] recall index disabled — better-sqlite3 was built for a different Node.js version.\n' +
+      '           Re-enable it once with:  npm rebuild better-sqlite3   (in the lazyclaw install dir),\n' +
+      '           or reinstall deps with the Node you run lazyclaw with. Chat is unaffected.');
+    return;
+  }
+  // eslint-disable-next-line no-console
+  console.warn(`[index_db] ${label}:`, e.message);
+}
+
 function dbPath(configDir) {
   return path.join(configDir, 'index.db');
 }
@@ -180,8 +207,7 @@ export function indexSessionTurn(row, configDir = defaultConfigDir()) {
     );
   } catch (e) {
     _logIndexFailure(configDir, 'sessions', e);
-    // eslint-disable-next-line no-console
-    console.warn('[index_db] indexSessionTurn failed:', e.message);
+    _warnIndexFailure('indexSessionTurn failed', e);
   }
 }
 
@@ -196,8 +222,7 @@ export function indexSkill(row, configDir = defaultConfigDir()) {
     );
   } catch (e) {
     _logIndexFailure(configDir, 'skills', e);
-    // eslint-disable-next-line no-console
-    console.warn('[index_db] indexSkill failed:', e.message);
+    _warnIndexFailure('indexSkill failed', e);
   }
 }
 
@@ -212,8 +237,7 @@ export function deleteSkill(skillName, configDir = defaultConfigDir()) {
     s.deleteSkill.run(String(skillName || ''));
   } catch (e) {
     _logIndexFailure(configDir, 'skills', e);
-    // eslint-disable-next-line no-console
-    console.warn('[index_db] deleteSkill failed:', e.message);
+    _warnIndexFailure('deleteSkill failed', e);
   }
 }
 
@@ -228,8 +252,7 @@ export function indexTrajectory(row, configDir = defaultConfigDir()) {
     );
   } catch (e) {
     _logIndexFailure(configDir, 'trajectories', e);
-    // eslint-disable-next-line no-console
-    console.warn('[index_db] indexTrajectory failed:', e.message);
+    _warnIndexFailure('indexTrajectory failed', e);
   }
 }
 
@@ -243,8 +266,7 @@ export function indexMemory(row, configDir = defaultConfigDir()) {
     );
   } catch (e) {
     _logIndexFailure(configDir, 'memories', e);
-    // eslint-disable-next-line no-console
-    console.warn('[index_db] indexMemory failed:', e.message);
+    _warnIndexFailure('indexMemory failed', e);
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lazyclaw",
-  "version": "6.6.0",
+  "version": "6.8.0",
   "description": "Lazy, elegant terminal CLI for chatting with Claude / OpenAI / Gemini / Ollama, orchestrating multi-step LLM workflows, and running multi-agent Slack teams with cross-task memory. Banner-on-launch, slash-command ghost autocomplete, persistent sessions, local HTTP gateway.",
   "keywords": [
     "claude",

package/providers/claude_cli.mjs

@@ -142,6 +142,10 @@ export function buildArgs(prompt, opts = {}) {
   const maxTurns = opts.maxTurns == null ? 1 : opts.maxTurns;
   if (maxTurns > 0) args.push('--max-turns', String(maxTurns));
   args.push('--tools', opts.tools == null ? '' : String(opts.tools));
+  // Permission mode (e.g. bypassPermissions) so the agent doesn't stop to ask
+  // before every tool. Only emitted when set — the caller centralises the
+  // default via lib/permission_mode.resolvePermissionMode.
+  if (opts.permissionMode) args.push('--permission-mode', String(opts.permissionMode));
   const modelAlias = resolveModelAlias(opts.model);
   if (modelAlias) args.push('--model', modelAlias);
   return args;
@@ -174,7 +178,7 @@ export const claudeCliProvider = {
         const { getSession } = await import('./claude_cli_session.mjs');
         const session = getSession(opts.sessionKey, {
           bin, model: opts.model, cwd: opts.cwd, lean: opts.lean,
-          maxTurns: opts.maxTurns, tools: opts.tools,
+          maxTurns: opts.maxTurns, tools: opts.tools, permissionMode: opts.permissionMode,
           system: opts.sessionSystem || opts.system || messages.find((m) => m.role === 'system')?.content,
         });
         let yielded = false;

package/providers/claude_cli_session.mjs

@@ -52,6 +52,7 @@ class ClaudeSession {
     const mt = o.maxTurns == null ? 1 : o.maxTurns;
     if (mt > 0) args.push('--max-turns', String(mt));
     args.push('--tools', o.tools == null ? '' : String(o.tools));
+    if (o.permissionMode) args.push('--permission-mode', String(o.permissionMode));
     const model = resolveModelAlias(o.model);
     if (model) args.push('--model', model);
     if (o.system && String(o.system).trim()) args.push('--append-system-prompt', String(o.system));

package/providers/claude_keychain.mjs

@@ -0,0 +1,40 @@
+// claude_keychain.mjs — read the Claude Code OAuth token from the macOS login
+// Keychain.
+//
+// `claude login` on macOS stores its credential in the OS Keychain (there is no
+// ~/.claude/.credentials.json file like on Linux), so lazyclaw's keyless paths
+// (model listing, trainer detection) couldn't see an existing, working login
+// and fell back to an "authenticate first" error. This reads that Keychain item
+// — the same JSON blob the Linux file holds — and returns its accessToken.
+//
+// Read-only and macOS-only. The token is only ever sent to api.anthropic.com,
+// never logged. The first read may surface a one-time Keychain access prompt;
+// granting it ("Always Allow") makes subsequent reads silent.
+
+import { execFileSync } from 'node:child_process';
+
+// macOS stores the Claude Code credential under this generic-password service.
+const KEYCHAIN_SERVICE = 'Claude Code-credentials';
+
+// Pull the accessToken out of the credential blob (same shape as the Linux
+// ~/.claude/.credentials.json file). Returns a non-empty string or null.
+export function _extractAccessToken(raw) {
+  if (!raw || !String(raw).trim()) return null;
+  let j;
+  try { j = JSON.parse(raw); } catch { return null; }
+  const o = (j && j.claudeAiOauth) || j || {};
+  const tok = o.accessToken || o.access_token || (j && j.accessToken);
+  return (typeof tok === 'string' && tok) ? tok : null;
+}
+
+// Read the Claude Code OAuth access token from the macOS Keychain. Returns the
+// token string, or null on non-macOS, a missing item, denied access, or an
+// unparseable blob. `exec`/`platform` are injectable for tests.
+export function readClaudeKeychainToken({ platform = process.platform, exec } = {}) {
+  if (platform !== 'darwin') return null;
+  const run = exec || ((args) => execFileSync('security', args, { encoding: 'utf8', timeout: 8000 }));
+  let raw;
+  try { raw = run(['find-generic-password', '-s', KEYCHAIN_SERVICE, '-w']); }
+  catch { return null; }
+  return _extractAccessToken(raw);
+}

package/providers/model_catalogue.mjs

@@ -14,6 +14,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { readClaudeKeychainToken } from './claude_keychain.mjs';
 
 /**
  * Whether a provider exposes a model catalogue we can live-fetch. True for
@@ -146,7 +147,7 @@ export function modelCatalogueFor({ cfg, registryMod, resolveAuthKey, providerId
 // (no file), so this returns null there — the caller falls through to its
 // honest "set ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN" error. Read-only;
 // the token is only ever sent to api.anthropic.com, never logged.
-export function _claudeCodeOAuthToken({ home, readFileSync } = {}) {
+export function _claudeCodeOAuthToken({ home, readFileSync, keychainReader } = {}) {
   const h = home || os.homedir();
   const read = readFileSync || fs.readFileSync;
   for (const rel of ['.claude/.credentials.json', '.config/claude/.credentials.json']) {
@@ -156,7 +157,9 @@ export function _claudeCodeOAuthToken({ home, readFileSync } = {}) {
       if (typeof tok === 'string' && tok) return tok;
     } catch { /* missing / unreadable / not JSON — try the next location */ }
   }
-  return null;
+  // macOS keeps the login in the Keychain (no file) — read it there.
+  const fromKeychain = (keychainReader || readClaudeKeychainToken)();
+  return fromKeychain || null;
 }
 
 // A plain API key stored by `codex login --api-key` in ~/.codex/auth.json.

package/tui/run_turn.mjs

@@ -28,6 +28,9 @@
 import { Chalk } from 'chalk';
 import { chatAgenticGet, chatPlanModeGet, effectiveChatTools } from '../config_features.mjs';
 import { defaultSandboxSpec } from '../sandbox/index.mjs';
+import { resolvePermissionMode } from '../lib/permission_mode.mjs';
+import { detectConfigCommand, applyConfigCommand } from '../lib/nl_config_command.mjs';
+import { readConfig as _readCfg, writeConfig as _writeCfg } from '../lib/config.mjs';
 
 // Force ANSI on these turn-status markers regardless of stdout TTY detection:
 // the Ink path routes them through React state (Ink preserves embedded SGR
@@ -206,6 +209,25 @@ async function _runAgenticTurn({ ctx, messages, sysMsg, activeProvName, activeMo
 export function makeRunTurn({ ctx, writeFn }) {
   return async function runTurn(text, signal) {
     if (signal?.aborted) return;
+
+    // Natural-language config commands (orchestrator on/off, planner/worker
+    // model) are applied for REAL here — otherwise the model just replies
+    // "done" while nothing changes (the reported bug). Conservative matcher;
+    // anything it doesn't catch falls through to the model below.
+    const _cmd = detectConfigCommand(text);
+    if (_cmd) {
+      const _msgs = ctx.getMessages();
+      _msgs.push({ role: 'user', content: text });
+      ctx.persistTurn('user', text);
+      let reply;
+      try { reply = applyConfigCommand(_cmd, { readConfig: _readCfg, writeConfig: _writeCfg, ctxCfg: ctx.cfg }); }
+      catch (e) { reply = `⚠ couldn't apply that change: ${e?.message || e}`; }
+      try { writeFn(reply + '\n'); } catch { /* sink best-effort */ }
+      _msgs.push({ role: 'assistant', content: reply });
+      ctx.persistTurn('assistant', reply);
+      return;
+    }
+
     const messages = ctx.getMessages();
     messages.push({ role: 'user', content: text });
     try { ctx.onCharsSent && ctx.onCharsSent(text.length); }
@@ -296,6 +318,9 @@ export function makeRunTurn({ ctx, writeFn }) {
         // a one-shot spawn on any session failure, and the session respawns if
         // the system prompt changes (plan-mode toggle) so it can't go stale.
         persistent: ctx.cfg?.chat?.persistentSession !== false,
+        // claude-cli permission mode (cfg.chat.permissionMode, asked at setup;
+        // defaults to bypassPermissions). claude-cli reads it; others ignore it.
+        permissionMode: resolvePermissionMode(ctx.cfg),
         sessionKey: (ctx.getSessionId && ctx.getSessionId()) || ctx.syntheticChatSessionId,
         ...(sysMsg ? { sessionSystem: sysMsg.content } : {}),
         ...(maxTokens !== undefined ? { maxTokens } : {}),