scalix 0.0.1 → 1.0.0

package/dist/tools.js

@@ -0,0 +1,370 @@
+import { tool } from './tool-helper.js';
+import { z } from 'zod';
+import { exec, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
+import fsSync from 'node:fs';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { safeEvaluate } from './safe-math.js';
+import { sandboxPath, isBlockedCommand, detectInjection, sanitizeEnvForCommand, getShellInfo } from './sandbox.js';
+import { DEFAULT_LIMITS } from './settings.js';
+import { TOOL_DEFAULTS, BINARY_DETECT_BUFFER_SIZE } from './constants.js';
+import { computeDiff, formatDiff } from './diff.js';
+let _limits = DEFAULT_LIMITS;
+export function setToolLimits(limits) { _limits = limits; }
+const execAsync = promisify(exec);
+let persistentCwd = process.cwd();
+export function getPersistentCwd() { return persistentCwd; }
+export function setPersistentCwd(dir) { persistentCwd = dir; }
+export function resetPersistentCwd() { persistentCwd = process.cwd(); }
+export const backgroundProcesses = new Map();
+export const timeTool = tool({
+    name: 'get_current_time',
+    description: 'Get the current date and time',
+    inputSchema: z.object({
+        timezone: z.string().max(100).optional().describe('Timezone (e.g., "UTC", "America/New_York")')
+    }),
+    execute: async ({ timezone }) => {
+        const tz = timezone || 'UTC';
+        try {
+            return {
+                time: new Date().toLocaleString('en-US', { timeZone: tz }),
+                timezone: tz,
+            };
+        }
+        catch {
+            return { error: `Invalid timezone: "${tz}". Use IANA names like "America/New_York" or "UTC".` };
+        }
+    }
+});
+export const calculatorTool = tool({
+    name: 'calculate',
+    description: 'Perform mathematical calculations. Supports +, -, *, /, %, ^, parentheses, and functions (sqrt, abs, sin, cos, tan, log, floor, ceil, round, min, max, pow, pi, e)',
+    inputSchema: z.object({
+        expression: z.string().max(1000).describe('Math expression (e.g., "2 + 2", "sqrt(16)")')
+    }),
+    execute: async ({ expression }) => {
+        try {
+            const result = safeEvaluate(expression);
+            return { expression, result };
+        }
+        catch (err) {
+            return { expression, error: err.message };
+        }
+    }
+});
+// Extract cd target from a command to persist working directory
+function extractCdTarget(command) {
+    const match = command.match(/^\s*cd\s+("([^"]+)"|'([^']+)'|(\S+))\s*(&&|;|$)/);
+    if (match)
+        return match[2] || match[3] || match[4] || null;
+    return null;
+}
+export const runCommandTool = tool({
+    name: 'run_command',
+    description: 'Run a shell command using the system shell (bash/zsh on Unix, PowerShell/cmd on Windows). Working directory persists between calls. Supports background execution and configurable timeout.',
+    inputSchema: z.object({
+        command: z.string().max(10000).describe('The command to run'),
+        description: z.string().max(500).optional().describe('Short description of what the command does'),
+        timeout: z.number().max(TOOL_DEFAULTS.maxCommandTimeoutMs).optional().describe(`Timeout in ms (default ${TOOL_DEFAULTS.commandTimeoutMs}, max ${TOOL_DEFAULTS.maxCommandTimeoutMs})`),
+        cwd: z.string().max(500).optional().describe('Working directory override (relative to workspace root)'),
+        run_in_background: z.boolean().optional().describe('Run command in background and return PID immediately'),
+    }),
+    execute: async ({ command, timeout, cwd, run_in_background: runInBg }) => {
+        if (isBlockedCommand(command)) {
+            return { error: 'Command blocked: matches a destructive pattern', exitCode: -1 };
+        }
+        const injection = detectInjection(command);
+        if (injection) {
+            return { error: `Command blocked: ${injection}`, exitCode: -1, requiresReview: true };
+        }
+        // Resolve working directory: explicit cwd > persistent cwd > process cwd
+        let workingDir;
+        if (cwd) {
+            try {
+                workingDir = sandboxPath(cwd);
+            }
+            catch (err) {
+                return { error: `Invalid working directory: ${err.message}`, exitCode: -1 };
+            }
+        }
+        else {
+            workingDir = persistentCwd;
+        }
+        const shell = getShellInfo();
+        if (runInBg) {
+            const child = spawn(shell.path, [...shell.args, command], {
+                detached: true,
+                stdio: ['ignore', 'pipe', 'pipe'],
+                env: sanitizeEnvForCommand(),
+                cwd: workingDir,
+            });
+            if (!child.pid) {
+                return { error: 'Failed to spawn background process: no PID assigned', exitCode: -1 };
+            }
+            const pid = child.pid;
+            const entry = {
+                pid,
+                command,
+                stdout: '',
+                stderr: '',
+                exitCode: null,
+                startedAt: Date.now(),
+                lastRead: 0,
+            };
+            child.stdout?.on('data', (data) => {
+                const chunk = data.toString();
+                if (entry.stdout.length + chunk.length <= _limits.bgBufferMax) {
+                    entry.stdout += chunk;
+                }
+                else if (entry.stdout.length < _limits.bgBufferMax) {
+                    entry.stdout += chunk.slice(0, _limits.bgBufferMax - entry.stdout.length);
+                }
+            });
+            child.stdout?.on('error', () => { });
+            child.stderr?.on('data', (data) => {
+                const chunk = data.toString();
+                if (entry.stderr.length + chunk.length <= _limits.bgBufferMax) {
+                    entry.stderr += chunk;
+                }
+                else if (entry.stderr.length < _limits.bgBufferMax) {
+                    entry.stderr += chunk.slice(0, _limits.bgBufferMax - entry.stderr.length);
+                }
+            });
+            child.stderr?.on('error', () => { });
+            child.on('error', (err) => {
+                entry.exitCode = -1;
+                entry.stderr += `\nProcess error: ${err.message}`;
+            });
+            child.on('close', (code) => {
+                entry.exitCode = code ?? 1;
+                setTimeout(() => { backgroundProcesses.delete(pid); }, _limits.bgCleanupMs).unref();
+            });
+            backgroundProcesses.set(pid, entry);
+            child.unref();
+            return { pid, message: `Command started in background (PID: ${pid}). Use the monitor tool to check output.` };
+        }
+        // For cd-only commands, update persistent cwd directly
+        const cdTarget = extractCdTarget(command);
+        if (cdTarget && command.trim().match(/^cd\s/)) {
+            try {
+                const resolved = path.resolve(workingDir, cdTarget);
+                await fs.stat(resolved);
+                persistentCwd = resolved;
+                return { stdout: '', stderr: '', exitCode: 0, cwd: persistentCwd };
+            }
+            catch (err) {
+                return { error: `cd: ${cdTarget}: ${err.code === 'ENOENT' ? 'No such file or directory' : err.message}`, exitCode: 1 };
+            }
+        }
+        let fullCommand = command;
+        const CWD_MARKER = '__SCALIX_CWD_PROBE__';
+        if (cdTarget && !command.trim().match(/^cd\s+\S+\s*$/)) {
+            const cwdProbe = shell.type === 'cmd'
+                ? `${command} && echo ${CWD_MARKER} && cd`
+                : shell.type === 'pwsh'
+                    ? `${command}; Write-Host '${CWD_MARKER}'; Get-Location | Select-Object -ExpandProperty Path`
+                    : `${command} && echo '${CWD_MARKER}' && pwd`;
+            fullCommand = cwdProbe;
+        }
+        try {
+            const { stdout, stderr } = await execAsync(fullCommand, {
+                timeout: timeout ?? _limits.commandTimeoutMs,
+                maxBuffer: TOOL_DEFAULTS.maxExecBufferDefault,
+                env: sanitizeEnvForCommand(),
+                cwd: workingDir,
+                shell: shell.path,
+            });
+            if (cdTarget && fullCommand !== command) {
+                const markerIdx = stdout.indexOf(CWD_MARKER);
+                if (markerIdx !== -1) {
+                    const beforeMarker = stdout.slice(0, markerIdx).trimEnd();
+                    const afterMarker = stdout.slice(markerIdx + CWD_MARKER.length).trim();
+                    const newCwd = afterMarker.split('\n')[0]?.trim();
+                    if (newCwd && path.isAbsolute(newCwd)) {
+                        persistentCwd = newCwd;
+                        return { stdout: beforeMarker, stderr, exitCode: 0, cwd: persistentCwd };
+                    }
+                }
+            }
+            return { stdout, stderr, exitCode: 0, cwd: workingDir };
+        }
+        catch (error) {
+            const result = { stdout: error.stdout, stderr: error.stderr, exitCode: error.code || 1, error: error.message };
+            result.autoFixHint = 'The command failed. Analyze the error output above and suggest how to fix it. If it is a build/test/lint error, read the relevant file and fix the issue.';
+            return result;
+        }
+    }
+});
+export const readFileTool = tool({
+    name: 'read_file',
+    description: 'Read a local file with line numbers (lineN<tab>content). Returns the full file contents. Use read_file_lines if you only need a specific range.',
+    inputSchema: z.object({
+        filePath: z.string().max(500).describe('Relative path to the file'),
+        maxLines: z.number().min(1).optional().describe('Optional: limit output to first N lines'),
+    }),
+    execute: async ({ filePath, maxLines }) => {
+        try {
+            const safePath = sandboxPath(filePath);
+            const stat = await fs.stat(safePath);
+            if (stat.size > _limits.readFileMaxSize)
+                return { error: `File too large (${Math.round(stat.size / 1024)}KB, max ${Math.round(_limits.readFileMaxSize / 1024)}KB). Use read_file_lines to read specific sections.` };
+            const fd = await fs.open(safePath, 'r');
+            const header = Buffer.alloc(BINARY_DETECT_BUFFER_SIZE);
+            await fd.read(header, 0, Math.min(BINARY_DETECT_BUFFER_SIZE, stat.size), 0);
+            await fd.close();
+            if (header.slice(0, Math.min(BINARY_DETECT_BUFFER_SIZE, stat.size)).includes(0x00)) {
+                return { error: 'File appears to be binary. Use a specialized tool to inspect binary files.' };
+            }
+            const content = await fs.readFile(safePath, 'utf-8');
+            const lines = content.split('\n');
+            if (maxLines && lines.length > maxLines) {
+                const numbered = lines.slice(0, maxLines).map((line, i) => `${i + 1}\t${line}`).join('\n');
+                return {
+                    content: numbered,
+                    totalLines: lines.length,
+                    truncatedAt: maxLines,
+                    hint: `Showing first ${maxLines} of ${lines.length} lines.`,
+                };
+            }
+            const numbered = lines.map((line, i) => `${i + 1}\t${line}`).join('\n');
+            return { content: numbered, totalLines: lines.length };
+        }
+        catch (error) {
+            return { error: error.message };
+        }
+    }
+});
+export const writeFileTool = tool({
+    name: 'write_file',
+    description: 'Write text content to a local file (sandboxed to working directory). Requires user confirmation.',
+    inputSchema: z.object({
+        filePath: z.string().max(500).describe('Relative path to the file'),
+        content: z.string().max(1024 * 1024).describe('The entire text content to write')
+    }),
+    execute: async ({ filePath, content }) => {
+        try {
+            const safePath = sandboxPath(filePath);
+            let existed = false;
+            let oldContent = '';
+            try {
+                oldContent = await fs.readFile(safePath, 'utf-8');
+                existed = true;
+            }
+            catch { }
+            await fs.mkdir(path.dirname(safePath), { recursive: true });
+            await fs.writeFile(safePath, content, 'utf-8');
+            let diff;
+            if (existed) {
+                const diffResult = computeDiff(oldContent, content);
+                diff = formatDiff(diffResult, filePath);
+            }
+            return {
+                success: true,
+                message: `Wrote ${content.length} bytes to ${filePath}`,
+                ...(existed ? { warning: 'File already existed and was overwritten' } : {}),
+                ...(diff ? { diff } : {}),
+            };
+        }
+        catch (error) {
+            return { success: false, error: error.message };
+        }
+    }
+});
+export const listFilesTool = tool({
+    name: 'list_files',
+    description: 'List files and directories in a given path (sandboxed to working directory). Supports recursive listing with glob patterns.',
+    inputSchema: z.object({
+        dirPath: z.string().max(500).optional().describe('Relative path (defaults to current directory)'),
+        recursive: z.boolean().optional().describe('Recursively list files (default: false)'),
+        pattern: z.string().max(200).optional().describe('Glob pattern filter when recursive (e.g., "**/*.ts")'),
+        maxResults: z.number().max(1000).optional().describe('Max results for recursive listing (default: 200)'),
+    }),
+    execute: async ({ dirPath, recursive, pattern, maxResults }) => {
+        try {
+            const safePath = sandboxPath(dirPath || '.');
+            if (recursive) {
+                const fg = (await import('fast-glob')).default;
+                const globPattern = pattern || '**/*';
+                const files = await fg(globPattern, {
+                    cwd: safePath,
+                    ignore: ['node_modules/**', '.git/**', 'dist/**', 'coverage/**'],
+                    onlyFiles: true,
+                    stats: true,
+                    followSymbolicLinks: false,
+                });
+                const limit = maxResults ?? 200;
+                const sorted = files
+                    .sort((a, b) => (b.stats?.mtimeMs ?? 0) - (a.stats?.mtimeMs ?? 0))
+                    .slice(0, limit)
+                    .map((f) => ({
+                    name: f.path,
+                    size: f.stats?.size ?? 0,
+                    isDirectory: false,
+                }));
+                return { path: safePath, count: sorted.length, total: files.length, files: sorted };
+            }
+            const entries = await fs.readdir(safePath, { withFileTypes: true });
+            const results = await Promise.all(entries.map(async (e) => {
+                let size;
+                if (!e.isDirectory()) {
+                    try {
+                        const stat = await fs.stat(path.join(safePath, e.name));
+                        size = stat.size;
+                    }
+                    catch { }
+                }
+                return { name: e.name, isDirectory: e.isDirectory(), ...(size !== undefined ? { size } : {}) };
+            }));
+            const sorted = results.sort((a, b) => {
+                if (a.isDirectory !== b.isDirectory)
+                    return a.isDirectory ? -1 : 1;
+                return a.name.localeCompare(b.name);
+            });
+            return { path: safePath, count: sorted.length, files: sorted };
+        }
+        catch (error) {
+            return { error: error.message };
+        }
+    }
+});
+export const addMcpServerTool = tool({
+    name: 'add_mcp_server',
+    description: 'Add an HTTP MCP server persistently. Requires user confirmation.',
+    inputSchema: z.object({
+        label: z.string().min(1).max(100).describe('A logical name for the MCP server'),
+        url: z.string().url().describe('The HTTP SSE URL of the MCP server')
+    }),
+    execute: async ({ label, url }) => {
+        try {
+            const mcpConfigPath = path.resolve(process.cwd(), 'mcp-services.json');
+            let config = { mcpServers: [] };
+            try {
+                if (fsSync.existsSync(mcpConfigPath)) {
+                    const parsed = JSON.parse(fsSync.readFileSync(mcpConfigPath, 'utf-8'));
+                    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                        config = parsed;
+                        if (!Array.isArray(config.mcpServers))
+                            config.mcpServers = [];
+                    }
+                }
+            }
+            catch { }
+            config.mcpServers.push({ serverLabel: label, serverUrl: url });
+            await fs.writeFile(mcpConfigPath, JSON.stringify(config, null, 2), 'utf-8');
+            return { success: true, message: `Added MCP server ${label} at ${url}` };
+        }
+        catch (e) {
+            return { success: false, error: e.message };
+        }
+    }
+});
+export const defaultTools = [
+    timeTool,
+    calculatorTool,
+    runCommandTool,
+    readFileTool,
+    writeFileTool,
+    listFilesTool,
+    addMcpServerTool,
+];

package/dist/types.js

@@ -0,0 +1 @@
+export {};

package/docs/DISTRIBUTION.md

@@ -0,0 +1,301 @@
+# Scalix Coder — Distribution Guide
+
+This document covers how to build, distribute, and install Scalix Coder for end users **without exposing source code**.
+
+---
+
+## Table of Contents
+
+1. [Overview](#overview)
+2. [Building a Release](#building-a-release)
+3. [What's in the Release](#whats-in-the-release)
+4. [Hosting the Release](#hosting-the-release)
+5. [One-Line Installer Setup](#one-line-installer-setup)
+6. [Manual Installation](#manual-installation)
+7. [VS Code Extension](#vs-code-extension)
+8. [Updating Users](#updating-users)
+9. [Troubleshooting](#troubleshooting)
+
+---
+
+## Overview
+
+Scalix Coder is distributed as **compiled JavaScript** — no TypeScript source code is included. Users receive:
+
+- Pre-compiled `.js` files (from `dist/`)
+- A CLI entry point (`bin/scalix.js`)
+- One-click install scripts for Windows and Mac/Linux
+- The VS Code extension (`.vsix` file)
+
+**What's included:**
+- 31 built-in tools (shell, file, git, web, browser, vision, voice, and more)
+- Security sandbox with path restriction, command blocklist, and injection detection
+- IPC server mode for VS Code extension integration
+
+**Requirements for end users:**
+- Node.js 18 or higher
+- npm (comes with Node.js)
+- Windows 10+, macOS 12+, or Linux
+
+---
+
+## Building a Release
+
+From the project root, run:
+
+```bash
+npm run release
+```
+
+This will:
+1. Compile TypeScript to JavaScript (`tsc`)
+2. Package everything into `release/` directory
+3. Create both `.tar.gz` (Mac/Linux) and `.zip` (Windows) archives
+4. Include the VS Code extension `.vsix` if available
+5. Strip `devDependencies` and dev scripts from `package.json`
+
+**Output:**
+```
+release/
+├── scalix-coder-v3.0.0/          # Extracted release folder
+│   ├── dist/                      # Compiled JavaScript (NO source code)
+│   ├── bin/scalix.js              # CLI entry point
+│   ├── package.json               # Dependencies only
+│   ├── package-lock.json          # Lockfile
+│   ├── install.bat                # Windows installer
+│   ├── install.sh                 # Mac/Linux installer
+│   ├── scalix-coder-0.2.0.vsix   # VS Code extension
+│   ├── README.md
+│   ├── LICENSE
+│   └── CHANGELOG.md
+├── scalix-coder-v3.0.0.tar.gz    # Mac/Linux archive
+└── scalix-coder-v3.0.0.zip       # Windows archive
+```
+
+---
+
+## What's in the Release
+
+### Included
+| Item | Description |
+|---|---|
+| `dist/*.js` | Compiled JavaScript (agent, tools, CLI, etc.) |
+| `bin/scalix.js` | CLI entry point — runs `dist/cli.js` |
+| `package.json` | Production dependencies only |
+| `install.bat` | One-click Windows installer |
+| `install.sh` | One-click Mac/Linux installer |
+| `*.vsix` | VS Code extension package |
+| `README.md` | User documentation |
+| `LICENSE` | License file |
+
+### NOT Included (Protected)
+| Item | Why excluded |
+|---|---|
+| `src/*.ts` / `src/*.tsx` | Source code — proprietary |
+| `tests/` | Internal test suite |
+| `tsconfig.json` | Build configuration |
+| `eslint.config.js` | Lint configuration |
+| `vitest.config.ts` | Test configuration |
+| `scripts/` | Build scripts |
+| `.claude/` | Claude Code settings |
+| `.scalix/` | Project memory |
+| `devDependencies` | Development tools |
+
+---
+
+## Hosting the Release
+
+Upload the release archives to any file hosting. Options:
+
+### Option A: Your Own Website / Server
+```
+https://scalix.world/releases/scalix-coder-v3.0.0.tar.gz
+https://scalix.world/releases/scalix-coder-v3.0.0.zip
+https://scalix.world/install.sh
+https://scalix.world/install.ps1
+```
+
+### Option B: AWS S3 / Google Cloud Storage
+```bash
+# Upload to S3
+aws s3 cp release/scalix-coder-v3.0.0.tar.gz s3://your-bucket/releases/
+aws s3 cp release/scalix-coder-v3.0.0.zip s3://your-bucket/releases/
+aws s3 cp scripts/install-remote.sh s3://your-bucket/install.sh
+aws s3 cp scripts/install-remote.ps1 s3://your-bucket/install.ps1
+```
+
+### Option C: GitHub Releases (on a separate public repo)
+Create a public repo (e.g., `scalix-coder-releases`) and upload the archives as release assets.
+
+**After uploading, update the URLs in:**
+- `scripts/install-remote.sh` — change `your-domain.com` to your actual URL
+- `scripts/install-remote.ps1` — change `your-domain.com` to your actual URL
+
+---
+
+## One-Line Installer Setup
+
+Once files are hosted, users install with a single command:
+
+### Mac / Linux
+```bash
+curl -fsSL https://scalix.world/install.sh | bash
+```
+
+### Windows (PowerShell)
+```powershell
+irm https://scalix.world/install.ps1 | iex
+```
+
+### What the installer does:
+1. Checks Node.js 18+ is installed
+2. Downloads the release archive
+3. Extracts to `~/.scalix-coder/`
+4. Runs `npm install --omit=dev`
+5. Runs `npm link` to register the `scalix` command globally
+6. Done — user types `scalix` in any terminal
+
+### Custom Download URL
+Users can override the download URL:
+```bash
+SCALIX_DOWNLOAD_URL=https://internal.company.com/scalix.tar.gz curl -fsSL https://scalix.world/install.sh | bash
+```
+
+---
+
+## Manual Installation
+
+If users prefer manual installation:
+
+### Windows
+1. Download `scalix-coder-v3.0.0.zip`
+2. Extract the zip file
+3. Open the extracted folder
+4. Double-click `install.bat`
+5. Open any terminal and type `scalix`
+
+### Mac / Linux
+```bash
+tar -xzf scalix-coder-v3.0.0.tar.gz
+cd scalix-coder-v3.0.0
+./install.sh
+```
+
+### Manual (No Installer Script)
+```bash
+tar -xzf scalix-coder-v3.0.0.tar.gz
+cd scalix-coder-v3.0.0
+npm install --omit=dev --legacy-peer-deps
+sudo npm link    # or without sudo on Windows
+scalix
+```
+
+---
+
+## VS Code Extension
+
+The VS Code extension (`.vsix` file) is bundled in the release.
+
+### Install
+1. Open VS Code
+2. Press `Ctrl+Shift+P` (or `Cmd+Shift+P` on Mac)
+3. Type **"Extensions: Install from VSIX"**
+4. Select `scalix-coder-0.2.0.vsix` from the extracted folder
+5. Reload VS Code
+
+### Features
+- Sidebar chat panel with AI assistant
+- Right-click: Explain / Fix / Refactor code selection
+- Model picker and mode selector via slash commands
+- Integrated terminal (`Ctrl+Shift+T`)
+- Open chat in editor area (`Ctrl+Shift+K`)
+
+### Configure
+1. Press `Ctrl+,` to open Settings
+2. Search for "Scalix"
+3. Enter your API key
+4. Or type `/setup` in the chat
+
+---
+
+## Updating Users
+
+When releasing a new version:
+
+1. Update `version` in `package.json`
+2. Run `npm run release`
+3. Upload new archives to your hosting (overwrite or add new version)
+4. Update version number in `scripts/install-remote.sh` and `scripts/install-remote.ps1`
+5. Users re-run the one-liner to update:
+   ```bash
+   curl -fsSL https://scalix.world/install.sh | bash
+   ```
+
+### Versioning
+- CLI version: `package.json` → `version` (currently `3.1.0`)
+- Extension version: `vscode-extension/package.json` → `version` (currently `0.2.0`)
+- Both versions should be bumped together for coordinated releases
+
+---
+
+## Troubleshooting
+
+### "scalix" command not found after install
+```bash
+# Check if npm global bin is in PATH
+npm bin -g
+
+# On Mac/Linux, add to ~/.bashrc or ~/.zshrc:
+export PATH="$(npm bin -g):$PATH"
+
+# On Windows, npm global bin is usually already in PATH.
+# If not, run install.bat as Administrator.
+```
+
+### Permission denied on Mac/Linux
+```bash
+sudo npm link
+# or
+sudo ./install.sh
+```
+
+### Node.js version too old
+```bash
+node -v   # Must be v18+
+```
+Download latest from https://nodejs.org/
+
+### API key not working
+- Run `/setup` in the chat to re-enter your key
+- Or set the environment variable: `export SCALIX_API_KEY=sk-...`
+- Check Settings in VS Code: `Ctrl+,` → search "Scalix"
+
+### Rate limited
+The agent retries automatically up to 5 times with backoff. If you still see rate limit errors, wait 60 seconds and try again.
+
+---
+
+## Security Notes
+
+- **No source code** is distributed — only compiled JavaScript
+- API keys are stored locally at `~/.scalix-coder/config.json` (file permissions: 600)
+- Shell commands have a blocklist for destructive patterns
+- Path traversal is blocked — tools cannot access files outside the workspace
+- All buffers and collections are bounded to prevent memory exhaustion
+- Background processes auto-cleanup after 5 minutes
+- The VS Code extension uses VS Code's Content Security Policy for the webview
+- All webview user content is HTML-escaped before rendering
+
+---
+
+## Quick Reference
+
+| Task | Command |
+|---|---|
+| Build release | `npm run release` |
+| Build TypeScript | `npm run build` |
+| Run tests | `npm run test` |
+| Type-check | `npm run typecheck` |
+| Lint | `npm run lint` |
+| All checks | `npm run check` |
+| Build VS Code ext | `cd vscode-extension && npm run build && npm run package` |