scalix 1.0.0 → 1.2.0

package/dist/sandbox.js

@@ -45,7 +45,75 @@ export async function sandboxPathAsync(filePath) {
         throw err;
     }
 }
-const READ_ONLY_TOOLS = new Set([
+let _scopedRules = [];
+export function setScopedPermissionRules(rules) {
+    _scopedRules = rules;
+}
+export function getScopedPermissionRules() {
+    return _scopedRules;
+}
+function parseScopedToolSpec(spec) {
+    const match = spec.match(/^(\w+)\(([^)]+)\)$/);
+    if (match)
+        return { tool: match[1], prefix: match[2].replace(/\*$/, '') };
+    return { tool: spec };
+}
+export function checkScopedPermission(toolName, args) {
+    if (_scopedRules.length === 0)
+        return null;
+    const argStr = extractPrimaryArg(toolName, args);
+    for (const rule of _scopedRules) {
+        const parsed = parseScopedToolSpec(rule.tool);
+        if (!parsed)
+            continue;
+        if (parsed.tool !== toolName)
+            continue;
+        if (!parsed.prefix)
+            return rule.action;
+        if (argStr && argStr.startsWith(parsed.prefix))
+            return rule.action;
+        if (rule.regex) {
+            try {
+                if (new RegExp(rule.regex).test(argStr || ''))
+                    return rule.action;
+            }
+            catch { }
+        }
+    }
+    return null;
+}
+function extractPrimaryArg(toolName, args) {
+    if (!args || typeof args !== 'object')
+        return null;
+    const a = args;
+    if (toolName === 'run_command' && typeof a.command === 'string')
+        return a.command;
+    if (typeof a.filePath === 'string')
+        return a.filePath;
+    if (typeof a.file_path === 'string')
+        return a.file_path;
+    if (typeof a.path === 'string')
+        return a.path;
+    if (typeof a.pattern === 'string')
+        return a.pattern;
+    if (typeof a.query === 'string')
+        return a.query;
+    if (typeof a.url === 'string')
+        return a.url;
+    const first = Object.values(a).find(v => typeof v === 'string');
+    return typeof first === 'string' ? first : null;
+}
+// ─── Security Configuration ───
+let _securityConfig = {};
+export function setSecurityConfig(config) {
+    _securityConfig = config;
+    _effectiveToolSets = null; // invalidate cache
+}
+export function getSecurityConfig() {
+    return _securityConfig;
+}
+// ─── Tool Classification (configurable) ───
+const DEFAULT_READ_ONLY_TOOLS = new Set([
     'get_current_time',
     'calculate',
     'read_file',
@@ -59,31 +127,76 @@ const READ_ONLY_TOOLS = new Set([
     'web_search',
     'monitor',
 ]);
-const WRITE_TOOLS = new Set([
+const DEFAULT_WRITE_TOOLS = new Set([
     'write_file',
     'edit_file',
     'web_fetch',
     'todo_write',
     'notebook_edit',
+    'send_message',
+    'task_create',
+    'task_claim',
+    'task_update',
+    'task_list',
 ]);
-const DANGEROUS_TOOLS = new Set([
+const DEFAULT_DANGEROUS_TOOLS = new Set([
     'run_command',
     'git_commit',
     'add_mcp_server',
     'agent',
 ]);
+let _effectiveToolSets = null;
+function getEffectiveToolSets() {
+    if (_effectiveToolSets)
+        return _effectiveToolSets;
+    const readOnly = new Set(DEFAULT_READ_ONLY_TOOLS);
+    const write = new Set(DEFAULT_WRITE_TOOLS);
+    const dangerous = new Set(DEFAULT_DANGEROUS_TOOLS);
+    if (_securityConfig.additionalReadOnlyTools) {
+        for (const t of _securityConfig.additionalReadOnlyTools)
+            readOnly.add(t);
+    }
+    if (_securityConfig.additionalWriteTools) {
+        for (const t of _securityConfig.additionalWriteTools)
+            write.add(t);
+    }
+    if (_securityConfig.additionalDangerousTools) {
+        for (const t of _securityConfig.additionalDangerousTools)
+            dangerous.add(t);
+    }
+    if (_securityConfig.toolOverrides) {
+        for (const [tool, level] of Object.entries(_securityConfig.toolOverrides)) {
+            readOnly.delete(tool);
+            write.delete(tool);
+            dangerous.delete(tool);
+            if (level === 'read-only')
+                readOnly.add(tool);
+            else if (level === 'write')
+                write.add(tool);
+            else if (level === 'dangerous')
+                dangerous.add(tool);
+        }
+    }
+    _effectiveToolSets = { readOnly, write, dangerous };
+    return _effectiveToolSets;
+}
+// Keep backward-compatible exports
+const READ_ONLY_TOOLS = DEFAULT_READ_ONLY_TOOLS;
+const WRITE_TOOLS = DEFAULT_WRITE_TOOLS;
+const DANGEROUS_TOOLS = DEFAULT_DANGEROUS_TOOLS;
 export function getToolPermission(toolName, mode) {
+    const sets = getEffectiveToolSets();
     switch (mode) {
         case 'plan':
-            return READ_ONLY_TOOLS.has(toolName) ? 'allow' : 'block';
+            return sets.readOnly.has(toolName) ? 'allow' : 'block';
         case 'default':
-            if (READ_ONLY_TOOLS.has(toolName))
+            if (sets.readOnly.has(toolName))
                 return 'allow';
             return 'ask';
         case 'auto':
-            if (READ_ONLY_TOOLS.has(toolName))
+            if (sets.readOnly.has(toolName))
                 return 'allow';
-            if (WRITE_TOOLS.has(toolName))
+            if (sets.write.has(toolName))
                 return 'allow';
             return 'ask';
         case 'yolo':
@@ -92,8 +205,17 @@ export function getToolPermission(toolName, mode) {
             return 'ask';
     }
 }
+export function getToolPermissionWithArgs(toolName, mode, args) {
+    const scoped = checkScopedPermission(toolName, args);
+    if (scoped === 'allow')
+        return 'allow';
+    if (scoped === 'deny')
+        return 'block';
+    return getToolPermission(toolName, mode);
+}
 export function isDangerousTool(toolName) {
-    return DANGEROUS_TOOLS.has(toolName) || WRITE_TOOLS.has(toolName);
+    const sets = getEffectiveToolSets();
+    return sets.dangerous.has(toolName) || sets.write.has(toolName);
 }
 export function getModeDescription(mode) {
     switch (mode) {
@@ -255,11 +377,63 @@ const INJECTION_PATTERNS = [
 const SENSITIVE_ENV_PATTERNS = [
     /API_KEY/i, /SECRET/i, /TOKEN/i, /PASSWORD/i, /CREDENTIAL/i, /AUTH/i, /PRIVATE/i,
 ];
+function getEffectiveBlocklist() {
+    const disabled = new Set(_securityConfig.disabledBlockedCommands || []);
+    const base = disabled.size > 0
+        ? COMMAND_BLOCKLIST.filter(re => !disabled.has(re.source))
+        : COMMAND_BLOCKLIST;
+    const additional = (_securityConfig.additionalBlockedCommands || []).map(p => {
+        try {
+            return new RegExp(p);
+        }
+        catch {
+            return null;
+        }
+    }).filter((r) => r !== null);
+    return [...base, ...additional];
+}
+function getEffectiveInjectionPatterns() {
+    const disabled = new Set(_securityConfig.disabledInjectionPatterns || []);
+    const base = disabled.size > 0
+        ? INJECTION_PATTERNS.filter(re => !disabled.has(re.source))
+        : INJECTION_PATTERNS;
+    const additional = (_securityConfig.additionalInjectionPatterns || []).map(p => {
+        try {
+            return new RegExp(p);
+        }
+        catch {
+            return null;
+        }
+    }).filter((r) => r !== null);
+    return [...base, ...additional];
+}
+function getEffectiveEnvPatterns() {
+    const additional = (_securityConfig.additionalSensitiveEnvPatterns || []).map(p => {
+        try {
+            return new RegExp(p);
+        }
+        catch {
+            return null;
+        }
+    }).filter((r) => r !== null);
+    const allowedPatterns = (_securityConfig.allowedEnvPatterns || []).map(p => {
+        try {
+            return new RegExp(p);
+        }
+        catch {
+            return null;
+        }
+    }).filter((r) => r !== null);
+    return {
+        sensitive: [...SENSITIVE_ENV_PATTERNS, ...additional],
+        allowed: new Set(), // will check against allowedPatterns dynamically
+    };
+}
 export function isBlockedCommand(command) {
-    return COMMAND_BLOCKLIST.some((re) => re.test(command));
+    return getEffectiveBlocklist().some((re) => re.test(command));
 }
 export function detectInjection(command) {
-    for (const pattern of INJECTION_PATTERNS) {
+    for (const pattern of getEffectiveInjectionPatterns()) {
         if (pattern.test(command)) {
             return `Suspicious pattern detected: ${pattern.source}`;
         }
@@ -267,13 +441,29 @@ export function detectInjection(command) {
     return null;
 }
 export function sanitizeEnvForCommand() {
+    const { sensitive } = getEffectiveEnvPatterns();
+    const allowedPatterns = (_securityConfig.allowedEnvPatterns || []).map(p => {
+        try {
+            return new RegExp(p);
+        }
+        catch {
+            return null;
+        }
+    }).filter((r) => r !== null);
     const clean = {};
     for (const [key, val] of Object.entries(process.env)) {
         if (val === undefined)
             continue;
-        if (SENSITIVE_ENV_PATTERNS.some((p) => p.test(key)))
+        if (sensitive.some((p) => p.test(key))) {
+            if (allowedPatterns.length > 0 && allowedPatterns.some(p => p.test(key))) {
+                clean[key] = val;
+            }
             continue;
+        }
         clean[key] = val;
     }
     return clean;
 }
+export function getMaxImageSize() {
+    return _securityConfig.maxImageSize ?? 20 * 1024 * 1024;
+}

package/dist/sessions.js

@@ -5,8 +5,34 @@ import { randomUUID } from 'node:crypto';
 import { logger } from './logger.js';
 import { USER_CONFIG_DIR } from './constants.js';
 const SESSIONS_DIR = path.join(process.env.HOME || process.env.USERPROFILE || '.', USER_CONFIG_DIR, 'sessions');
+let cleanupDone = false;
+async function cleanupStaleTempFiles() {
+    if (cleanupDone)
+        return;
+    cleanupDone = true;
+    try {
+        const tmpDir = os.tmpdir();
+        const entries = await fs.readdir(tmpDir);
+        const oneHourAgo = Date.now() - 3600_000;
+        for (const entry of entries) {
+            if (!entry.startsWith('scalix-session-') || !entry.endsWith('.tmp'))
+                continue;
+            try {
+                const fullPath = path.join(tmpDir, entry);
+                const stat = await fs.stat(fullPath);
+                if (stat.mtimeMs < oneHourAgo) {
+                    await fs.unlink(fullPath);
+                    logger.debug('Cleaned up stale temp file', { file: entry });
+                }
+            }
+            catch { }
+        }
+    }
+    catch { }
+}
 async function ensureDir() {
     await fs.mkdir(SESSIONS_DIR, { recursive: true });
+    await cleanupStaleTempFiles();
 }
 function sessionPath(id) {
     return path.join(SESSIONS_DIR, `${id}.json`);
@@ -32,12 +58,19 @@ export async function saveSession(id, messages, model, name, costState) {
 }
 export async function loadSession(id) {
     const raw = await fs.readFile(sessionPath(id), 'utf-8');
+    let data;
     try {
-        return JSON.parse(raw);
+        data = JSON.parse(raw);
     }
     catch {
         throw new Error(`Corrupted session file: ${id}`);
     }
+    if (!data || typeof data !== 'object' ||
+        !('meta' in data) || !('messages' in data) ||
+        !Array.isArray(data.messages)) {
+        throw new Error(`Invalid session structure: ${id}`);
+    }
+    return data;
 }
 export async function listSessions() {
     await ensureDir();
@@ -49,7 +82,9 @@ export async function listSessions() {
         try {
             const raw = await fs.readFile(path.join(SESSIONS_DIR, file), 'utf-8');
             const data = JSON.parse(raw);
-            sessions.push(data.meta);
+            if (data?.meta?.id && data?.meta?.updatedAt) {
+                sessions.push(data.meta);
+            }
         }
         catch (e) {
             logger.warn('Failed to read session file', { file, error: e.message });
@@ -69,3 +104,62 @@ export async function deleteSession(id) {
 export function generateSessionId() {
     return randomUUID();
 }
+const CRASH_FILE = path.join(SESSIONS_DIR, '.crash-recovery.json');
+export async function saveCrashState(sessionId, messages, model, costState) {
+    try {
+        await ensureDir();
+        const data = {
+            sessionId,
+            messages,
+            model,
+            costState,
+            savedAt: new Date().toISOString(),
+        };
+        await fs.writeFile(CRASH_FILE, JSON.stringify(data), { mode: 0o600 });
+    }
+    catch { }
+}
+export async function loadCrashState() {
+    try {
+        const raw = await fs.readFile(CRASH_FILE, 'utf-8');
+        const data = JSON.parse(raw);
+        if (data?.sessionId && Array.isArray(data?.messages)) {
+            return data;
+        }
+    }
+    catch { }
+    return null;
+}
+export async function clearCrashState() {
+    try {
+        await fs.unlink(CRASH_FILE);
+    }
+    catch { }
+}
+export async function forkSession(sourceId, forkPoint) {
+    const source = await loadSession(sourceId);
+    const forkedMessages = source.messages.slice(0, forkPoint);
+    const newId = generateSessionId();
+    const meta = await saveSession(newId, forkedMessages, source.meta.model, `Fork of ${source.meta.name} (at msg ${forkPoint})`, source.costState);
+    return { id: newId, meta };
+}
+export async function getSessionDiff(id) {
+    const session = await loadSession(id);
+    const diffs = [];
+    for (const msg of session.messages) {
+        if (msg.role !== 'assistant' || !msg.tool_calls)
+            continue;
+        for (const tc of msg.tool_calls) {
+            if (tc.function.name === 'edit_file' || tc.function.name === 'write_file') {
+                try {
+                    const args = JSON.parse(tc.function.arguments);
+                    diffs.push(`${tc.function.name}: ${args.file_path || args.filePath || 'unknown'}`);
+                }
+                catch {
+                    diffs.push(`${tc.function.name}: (parse error)`);
+                }
+            }
+        }
+    }
+    return diffs;
+}

package/dist/settings.js

@@ -1,9 +1,16 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { DEFAULT_BASE_URL, DEFAULT_MODELS, AGENT_DEFAULTS, CONTEXT_DEFAULTS, WEB_DEFAULTS, TOOL_DEFAULTS, SUB_AGENT_DEFAULTS, USER_CONFIG_DIR, registerUserModels, } from './constants.js';
-const CONFIG_DIR = path.join(process.env.HOME || process.env.USERPROFILE || '.', USER_CONFIG_DIR);
-const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
+import { setSecurityConfig, setScopedPermissionRules } from './sandbox.js';
+import { DEFAULT_BASE_URL, DEFAULT_MODELS, AGENT_DEFAULTS, CONTEXT_DEFAULTS, WEB_DEFAULTS, TOOL_DEFAULTS, SUB_AGENT_DEFAULTS, MULTI_AGENT_DEFAULTS, USER_CONFIG_DIR, registerUserModels, setNetworkSecurityOverrides, } from './constants.js';
+import { getApiKeyFromKeychain, setApiKeyInKeychain, isKeychainAvailable } from './keychain.js';
+function getConfigDir() {
+    return path.join(process.env.HOME || process.env.USERPROFILE || '.', USER_CONFIG_DIR);
+}
+function getConfigFile() {
+    return path.join(getConfigDir(), 'config.json');
+}
 export const THINKING_MODES = ['off', 'low', 'medium', 'high'];
+export const DEFAULT_SECURITY = {};
 export const DEFAULT_LIMITS = {
     maxSteps: AGENT_DEFAULTS.maxSteps,
     maxMessages: AGENT_DEFAULTS.maxMessages,
@@ -41,6 +48,9 @@ export const DEFAULT_LIMITS = {
     maxNotebookSource: TOOL_DEFAULTS.maxNotebookSource,
     maxWebFetchLength: TOOL_DEFAULTS.maxWebFetchLength,
     slidingWindowTarget: CONTEXT_DEFAULTS.slidingWindowTarget,
+    maxConcurrentAgents: MULTI_AGENT_DEFAULTS.maxConcurrentAgents,
+    maxAgentDepth: MULTI_AGENT_DEFAULTS.maxDepth,
+    globalTokenBudget: MULTI_AGENT_DEFAULTS.globalTokenBudget,
 };
 const DEFAULTS = {
     apiKey: '',
@@ -50,6 +60,9 @@ const DEFAULTS = {
     limits: { ...DEFAULT_LIMITS },
     permissionMode: 'default',
     thinkingMode: 'off',
+    security: { ...DEFAULT_SECURITY },
+    injectionDetection: { enabled: true, sensitivity: 'medium' },
+    disableUpdateCheck: false,
 };
 function safeNumber(val, min, max, fallback) {
     if (typeof val === 'number' && Number.isFinite(val) && val >= min && val <= max)
@@ -121,34 +134,207 @@ function validateConfig(parsed) {
             maxNotebookSource: safeNumber(l.maxNotebookSource, 1000, Infinity, DEFAULT_LIMITS.maxNotebookSource),
             maxWebFetchLength: safeNumber(l.maxWebFetchLength, 1000, Infinity, DEFAULT_LIMITS.maxWebFetchLength),
             slidingWindowTarget: safeNumber(l.slidingWindowTarget, 0.1, 0.99, DEFAULT_LIMITS.slidingWindowTarget),
+            maxConcurrentAgents: safeNumber(l.maxConcurrentAgents, 1, 100, DEFAULT_LIMITS.maxConcurrentAgents),
+            maxAgentDepth: safeNumber(l.maxAgentDepth, 1, 20, DEFAULT_LIMITS.maxAgentDepth),
+            globalTokenBudget: safeNumber(l.globalTokenBudget, 10_000, Infinity, DEFAULT_LIMITS.globalTokenBudget),
         };
     }
     if (typeof parsed.thinkingMode === 'string' && THINKING_MODES.includes(parsed.thinkingMode)) {
         safe.thinkingMode = parsed.thinkingMode;
     }
+    if (parsed.security && typeof parsed.security === 'object' && !Array.isArray(parsed.security)) {
+        safe.security = validateSecurityConfig(parsed.security);
+    }
+    if (parsed.injectionDetection && typeof parsed.injectionDetection === 'object') {
+        const id = parsed.injectionDetection;
+        const config = {
+            enabled: typeof id.enabled === 'boolean' ? id.enabled : true,
+            sensitivity: ['low', 'medium', 'high'].includes(id.sensitivity) ? id.sensitivity : 'medium',
+        };
+        if (isStringArray(id.customPatterns)) {
+            config.customPatterns = validateRegexStrings(id.customPatterns);
+        }
+        safe.injectionDetection = config;
+    }
+    if (typeof parsed.disableUpdateCheck === 'boolean') {
+        safe.disableUpdateCheck = parsed.disableUpdateCheck;
+    }
     return safe;
 }
+function isStringArray(val) {
+    return Array.isArray(val) && val.every((v) => typeof v === 'string');
+}
+function validateRegexStrings(patterns) {
+    return patterns.filter(p => {
+        try {
+            new RegExp(p);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+function validateSecurityConfig(raw) {
+    const sec = {};
+    if (isStringArray(raw.additionalBlockedCommands)) {
+        sec.additionalBlockedCommands = validateRegexStrings(raw.additionalBlockedCommands);
+    }
+    if (isStringArray(raw.disabledBlockedCommands)) {
+        sec.disabledBlockedCommands = raw.disabledBlockedCommands;
+    }
+    if (isStringArray(raw.additionalInjectionPatterns)) {
+        sec.additionalInjectionPatterns = validateRegexStrings(raw.additionalInjectionPatterns);
+    }
+    if (isStringArray(raw.disabledInjectionPatterns)) {
+        sec.disabledInjectionPatterns = raw.disabledInjectionPatterns;
+    }
+    if (isStringArray(raw.additionalReadOnlyTools))
+        sec.additionalReadOnlyTools = raw.additionalReadOnlyTools;
+    if (isStringArray(raw.additionalWriteTools))
+        sec.additionalWriteTools = raw.additionalWriteTools;
+    if (isStringArray(raw.additionalDangerousTools))
+        sec.additionalDangerousTools = raw.additionalDangerousTools;
+    if (raw.toolOverrides && typeof raw.toolOverrides === 'object' && !Array.isArray(raw.toolOverrides)) {
+        const valid = {};
+        const levels = new Set(['read-only', 'write', 'dangerous']);
+        for (const [tool, level] of Object.entries(raw.toolOverrides)) {
+            if (typeof level === 'string' && levels.has(level)) {
+                valid[tool] = level;
+            }
+        }
+        if (Object.keys(valid).length > 0)
+            sec.toolOverrides = valid;
+    }
+    if (typeof raw.allowPrivateNetworkAccess === 'boolean')
+        sec.allowPrivateNetworkAccess = raw.allowPrivateNetworkAccess;
+    if (isStringArray(raw.additionalBlockedHosts))
+        sec.additionalBlockedHosts = raw.additionalBlockedHosts;
+    if (isStringArray(raw.allowedPrivateHosts))
+        sec.allowedPrivateHosts = raw.allowedPrivateHosts;
+    if (isStringArray(raw.additionalSensitiveEnvPatterns)) {
+        sec.additionalSensitiveEnvPatterns = validateRegexStrings(raw.additionalSensitiveEnvPatterns);
+    }
+    if (isStringArray(raw.allowedEnvPatterns)) {
+        sec.allowedEnvPatterns = validateRegexStrings(raw.allowedEnvPatterns);
+    }
+    if (typeof raw.maxImageSize === 'number' && raw.maxImageSize > 0) {
+        sec.maxImageSize = raw.maxImageSize;
+    }
+    return sec;
+}
 async function ensureDir() {
-    await fs.mkdir(CONFIG_DIR, { recursive: true });
+    await fs.mkdir(getConfigDir(), { recursive: true });
+}
+export function applySecurityConfig(security) {
+    setSecurityConfig(security);
+    setNetworkSecurityOverrides({
+        allowAll: security.allowPrivateNetworkAccess,
+        blockedHosts: security.additionalBlockedHosts,
+        allowedHosts: security.allowedPrivateHosts,
+    });
+}
+async function loadLocalOverrides(config) {
+    const localPaths = [
+        path.join(process.cwd(), '.scalix', 'settings.local.json'),
+        path.join(process.cwd(), '.scalix-coder', 'settings.local.json'),
+    ];
+    for (const localPath of localPaths) {
+        try {
+            const raw = await fs.readFile(localPath, 'utf-8');
+            const overrides = JSON.parse(raw);
+            if (overrides.models)
+                config.models = overrides.models;
+            if (overrides.permissionMode)
+                config.permissionMode = overrides.permissionMode;
+            if (overrides.thinkingMode)
+                config.thinkingMode = overrides.thinkingMode;
+            if (overrides.limits)
+                config.limits = { ...config.limits, ...overrides.limits };
+            if (overrides.security)
+                config.security = { ...config.security, ...overrides.security };
+            if (overrides.scopedPermissions)
+                config.scopedPermissions = overrides.scopedPermissions;
+            if (overrides.customModels)
+                config.customModels = { ...config.customModels, ...overrides.customModels };
+            break;
+        }
+        catch { }
+    }
+    return config;
+}
+async function loadManagedSettings(config) {
+    const managedPaths = [
+        path.join(getConfigDir(), 'managed-settings.json'),
+    ];
+    for (const managedPath of managedPaths) {
+        try {
+            const raw = await fs.readFile(managedPath, 'utf-8');
+            const managed = JSON.parse(raw);
+            if (managed.permissionMode)
+                config.permissionMode = managed.permissionMode;
+            if (managed.security)
+                config.security = { ...config.security, ...managed.security };
+            if (managed.scopedPermissions)
+                config.scopedPermissions = [
+                    ...(config.scopedPermissions || []),
+                    ...managed.scopedPermissions,
+                ];
+            if (managed.disableUpdateCheck !== undefined)
+                config.disableUpdateCheck = managed.disableUpdateCheck;
+            break;
+        }
+        catch { }
+    }
+    return config;
 }
 export async function loadConfig() {
     try {
-        const raw = await fs.readFile(CONFIG_FILE, 'utf-8');
+        const raw = await fs.readFile(getConfigFile(), 'utf-8');
         const parsed = JSON.parse(raw);
         const validated = validateConfig(parsed);
-        const config = { ...DEFAULTS, ...validated };
+        let config = { ...DEFAULTS, ...validated };
+        // Try keychain for API key (preferred over plaintext config)
+        if (!config.apiKey || config.apiKey === '') {
+            const keychainKey = await getApiKeyFromKeychain().catch(() => null);
+            if (keychainKey)
+                config.apiKey = keychainKey;
+        }
+        // Apply local overrides (project-level, gitignored)
+        config = await loadLocalOverrides(config);
+        // Apply managed/organization settings (enterprise policy)
+        config = await loadManagedSettings(config);
         if (config.customModels && Object.keys(config.customModels).length > 0) {
             registerUserModels(config.customModels);
         }
+        if (config.security && Object.keys(config.security).length > 0) {
+            applySecurityConfig(config.security);
+        }
+        if (config.scopedPermissions && config.scopedPermissions.length > 0) {
+            setScopedPermissionRules(config.scopedPermissions);
+        }
         return config;
     }
     catch {
-        return { ...DEFAULTS };
+        // Even if config file fails, try keychain
+        const config = { ...DEFAULTS };
+        const keychainKey = await getApiKeyFromKeychain().catch(() => null);
+        if (keychainKey)
+            config.apiKey = keychainKey;
+        return config;
     }
 }
 export async function saveConfig(config) {
     await ensureDir();
-    await fs.writeFile(CONFIG_FILE, JSON.stringify(config, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    // Store API key in keychain if available, strip from config file
+    const configToWrite = { ...config };
+    if (config.apiKey && await isKeychainAvailable()) {
+        const stored = await setApiKeyInKeychain(config.apiKey).catch(() => false);
+        if (stored) {
+            configToWrite.apiKey = '';
+        }
+    }
+    await fs.writeFile(getConfigFile(), JSON.stringify(configToWrite, null, 2), { encoding: 'utf-8', mode: 0o600 });
 }
 export function isConfigured(config) {
     return config.apiKey.length > 0 && config.models.length > 0;