scalix 1.1.0 → 1.2.0

package/dist/commands.js

@@ -1,5 +1,7 @@
 import fs from 'node:fs/promises';
+import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
+import { execSync } from 'node:child_process';
 import { logger } from './logger.js';
 import { PROJECT_LOOKUP_DIRS, PROJECT_CONFIG_DIR } from './constants.js';
 const COMMAND_DIRS = PROJECT_LOOKUP_DIRS.map(d => `${d}/commands`);
@@ -16,6 +18,9 @@ function parseFrontmatter(content) {
     }
     return { meta, body: match[2] };
 }
+function parseAllowedTools(spec) {
+    return spec.split(',').map(s => s.trim()).filter(Boolean);
+}
 export async function loadCustomCommands(cwd = process.cwd()) {
     const commands = [];
     for (const dir of COMMAND_DIRS) {
@@ -35,11 +40,17 @@ export async function loadCustomCommands(cwd = process.cwd()) {
                 const raw = await fs.readFile(filePath, 'utf-8');
                 const { meta, body } = parseFrontmatter(raw);
                 const name = entry.name.replace(/\.md$/, '');
+                const fm = meta;
                 commands.push({
                     name,
-                    description: meta.description || `Custom command: ${name}`,
+                    description: fm.description || `Custom command: ${name}`,
                     template: body.trim(),
                     source: filePath,
+                    frontmatter: fm,
+                    allowedTools: fm['allowed-tools'] ? parseAllowedTools(fm['allowed-tools']) : undefined,
+                    model: fm.model || undefined,
+                    argumentHint: fm['argument-hint'] || undefined,
+                    disableModelInvocation: fm['disable-model-invocation'] === 'true',
                 });
             }
             catch (err) {
@@ -49,15 +60,52 @@ export async function loadCustomCommands(cwd = process.cwd()) {
     }
     return commands;
 }
+function expandFileReferences(text, cwd) {
+    return text.replace(/@([\w./-]+\.\w+)/g, (_match, filePath) => {
+        const resolved = path.resolve(cwd, filePath);
+        if (!existsSync(resolved))
+            return `@${filePath} (file not found)`;
+        try {
+            const content = readFileSync(resolved, 'utf-8');
+            return `\n<file path="${filePath}">\n${content}\n</file>\n`;
+        }
+        catch {
+            return `@${filePath} (read error)`;
+        }
+    });
+}
+function expandInlineBash(text) {
+    return text.replace(/!`([^`]+)`/g, (_match, command) => {
+        try {
+            return execSync(command, { encoding: 'utf-8', timeout: 10_000 }).trim();
+        }
+        catch (err) {
+            return `(command failed: ${err.message})`;
+        }
+    });
+}
+function expandPositionalArgs(text, args) {
+    const parts = args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [];
+    const cleaned = parts.map(p => p.replace(/^["']|["']$/g, ''));
+    let result = text;
+    for (let i = 0; i < 9; i++) {
+        const placeholder = `$${i + 1}`;
+        result = result.split(placeholder).join(cleaned[i] || '');
+    }
+    return result;
+}
 export function expandCommand(command, args) {
     const safeArgs = args
         .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '')
         .replace(/\$/g, '\\$')
         .replace(/`/g, '\\`');
     let prompt = command.template;
+    prompt = expandPositionalArgs(prompt, args);
     prompt = prompt.replace(/\$ARGS/g, safeArgs);
     prompt = prompt.replace(/\$CWD/g, process.cwd());
     prompt = prompt.replace(/\$DATE/g, new Date().toISOString().split('T')[0]);
+    prompt = expandFileReferences(prompt, process.cwd());
+    prompt = expandInlineBash(prompt);
     return prompt;
 }
 export function commandsSummary(commands) {
@@ -65,7 +113,10 @@ export function commandsSummary(commands) {
         return `No custom commands. Add .md files to ${PROJECT_CONFIG_DIR}/commands/`;
     const lines = ['Custom commands:'];
     for (const cmd of commands) {
-        lines.push(`  /${cmd.name} — ${cmd.description}`);
+        const hint = cmd.argumentHint ? ` <${cmd.argumentHint}>` : '';
+        const model = cmd.model ? ` [model: ${cmd.model}]` : '';
+        const tools = cmd.allowedTools ? ` [tools: ${cmd.allowedTools.length}]` : '';
+        lines.push(`  /${cmd.name}${hint} — ${cmd.description}${model}${tools}`);
     }
     return lines.join('\n');
 }

package/dist/constants.js

@@ -239,10 +239,10 @@ export const PROJECT_INDEX_DEFAULTS = {
     symbolFileLimit: 1_000,
     statusDisplayLimit: 50,
 };
-// ─── Git Identity (GitHub App bot) ───
+// ─── Git Identity ───
 export const GIT_BOT_IDENTITY = {
-    name: 'scalix-coder[bot]',
-    email: '280249884+scalix-coder[bot]@users.noreply.github.com',
+    name: 'Scalix Coder',
+    email: '283104927+scalix-coder@users.noreply.github.com',
 };
 // ─── Git Context Defaults ───
 export const GIT_CONTEXT_DEFAULTS = {

package/dist/headless.js

@@ -1,5 +1,6 @@
 import readline from 'node:readline';
 import fs from 'node:fs/promises';
+import path from 'node:path';
 import { execSync } from 'node:child_process';
 import { createAgent } from './agent.js';
 import { defaultTools } from './tools.js';
@@ -39,6 +40,8 @@ export function parseArgs() {
     let format;
     let permissionMode;
     let outputSchema;
+    let worktree = false;
+    let worktreeName;
     for (let i = 0; i < args.length; i++) {
         if (args[i] === 'run' && i + 1 < args.length) {
             mode = 'run';
@@ -72,6 +75,13 @@ export function parseArgs() {
         else if (args[i] === '--ipc') {
             mode = 'ipc';
         }
+        else if (args[i] === '--worktree' || args[i] === '-w') {
+            worktree = true;
+            if (i + 1 < args.length && !args[i + 1].startsWith('-') && args[i + 1] !== 'run') {
+                worktreeName = args[i + 1];
+                i++;
+            }
+        }
         else if (args[i] === '--help' || args[i] === '-h') {
             console.log(`
 Scalix - Headless Mode
@@ -91,6 +101,7 @@ Options:
   --format <fmt>     Output format: text (default), json, json-schema, patch, markdown
   --output-format    Alias for --format
   --output-schema    Path to JSON schema file (implies --format json-schema)
+  --worktree, -w     Run in an isolated git worktree (optional: --worktree <name>)
   --help, -h         Show this help
 `);
             process.exit(0);
@@ -99,7 +110,7 @@ Options:
     if (!process.stdin.isTTY && mode === 'interactive') {
         mode = 'pipe';
     }
-    return { mode, prompt, output, format, permissionMode, outputSchema };
+    return { mode, prompt, output, format, permissionMode, outputSchema, worktree, worktreeName };
 }
 async function buildEnhancedInstructions() {
     let base = DEFAULT_INSTRUCTIONS;
@@ -713,10 +724,39 @@ async function runInteractive() {
 }
 async function main() {
     setSandboxRoot(process.cwd());
-    const { mode, prompt, output, format, permissionMode: cliPermissionMode, outputSchema } = parseArgs();
+    const { mode, prompt, output, format, permissionMode: cliPermissionMode, outputSchema, worktree, worktreeName } = parseArgs();
     if (cliPermissionMode) {
         process.env.SCALIX_PERMISSION_MODE = cliPermissionMode;
     }
+    // Set up worktree isolation if requested
+    let worktreeInfo = null;
+    if (worktree) {
+        const { createWorktree, removeWorktree } = await import('./worktree.js');
+        const name = worktreeName || `session-${Date.now().toString(36)}`;
+        try {
+            worktreeInfo = await createWorktree(name, process.cwd());
+            process.chdir(worktreeInfo.path);
+            setSandboxRoot(worktreeInfo.path);
+            console.log(`Working in isolated worktree: ${worktreeInfo.branch} → ${worktreeInfo.path}`);
+        }
+        catch (err) {
+            console.error(`Failed to create worktree: ${err.message}`);
+            process.exit(1);
+        }
+        const cleanup = async () => {
+            if (worktreeInfo) {
+                try {
+                    const origCwd = process.env.SCALIX_ORIGINAL_CWD || process.cwd();
+                    process.chdir(path.dirname(worktreeInfo.path));
+                    await removeWorktree(worktreeInfo, path.dirname(path.dirname(worktreeInfo.path)));
+                }
+                catch { }
+            }
+        };
+        process.on('exit', () => { cleanup().catch(() => { }); });
+        process.on('SIGINT', () => { cleanup().then(() => process.exit(0)).catch(() => process.exit(1)); });
+        process.env.SCALIX_ORIGINAL_CWD = process.cwd();
+    }
     switch (mode) {
         case 'run':
             if (!prompt) {

package/dist/hooks.js

@@ -29,26 +29,112 @@ function matchesHook(hook, toolName) {
         return true;
     if (!toolName)
         return false;
-    if (hook.match === toolName)
+    const patterns = hook.match.split('|').map(p => p.trim()).filter(Boolean);
+    return patterns.some(pattern => matchPattern(pattern, toolName));
+}
+function matchPattern(pattern, value) {
+    if (pattern === value)
+        return true;
+    if (pattern === '*')
         return true;
-    if (hook.match.endsWith('*')) {
-        return toolName.startsWith(hook.match.slice(0, -1));
+    if (pattern.endsWith('*') && !pattern.startsWith('/')) {
+        return value.startsWith(pattern.slice(0, -1));
+    }
+    if (pattern.startsWith('*') && !pattern.endsWith('*')) {
+        return value.endsWith(pattern.slice(1));
+    }
+    if (pattern.startsWith('/') && pattern.endsWith('/')) {
+        try {
+            return new RegExp(pattern.slice(1, -1)).test(value);
+        }
+        catch {
+            return false;
+        }
+    }
+    if (pattern.includes('*')) {
+        const regex = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
+        try {
+            return new RegExp(`^${regex}$`).test(value);
+        }
+        catch {
+            return false;
+        }
     }
     return false;
 }
-export async function executeHook(hook, env) {
+function buildHookInput(event, context) {
+    const input = {
+        event,
+        timestamp: new Date().toISOString(),
+    };
+    if (context.toolName)
+        input.tool_name = context.toolName;
+    if (context.toolArgs) {
+        try {
+            input.tool_args = JSON.parse(context.toolArgs);
+        }
+        catch {
+            input.tool_args = context.toolArgs;
+        }
+    }
+    if (context.toolResult !== undefined)
+        input.tool_result = context.toolResult;
+    if (context.error)
+        input.error = context.error;
+    if (context.prompt)
+        input.prompt = context.prompt.slice(0, 4096);
+    if (context.response)
+        input.response = context.response.slice(0, 4096);
+    if (context.notification)
+        input.notification = context.notification;
+    return JSON.stringify(input);
+}
+function parseHookOutput(stdout, exitCode) {
+    const trimmed = stdout.trim();
+    if (trimmed.startsWith('{')) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            return {
+                allowed: exitCode === 0 || exitCode === undefined,
+                output: parsed.output ?? trimmed,
+                message: parsed.message,
+                data: parsed,
+            };
+        }
+        catch { }
+    }
+    const allowed = exitCode === 0 || exitCode === undefined;
+    return {
+        allowed,
+        output: trimmed || undefined,
+        message: exitCode === 2 ? trimmed : undefined,
+    };
+}
+export async function executeHook(hook, env, stdinData) {
     const timeout = hook.timeout ?? HOOK_DEFAULTS.timeoutMs;
     const hookEnv = { ...process.env, ...env };
     const ac = new AbortController();
     const hardKill = setTimeout(() => ac.abort(), timeout + 5000);
     try {
-        const { stdout, stderr } = await execAsync(hook.command, {
+        const child = exec(hook.command, {
             timeout,
             env: hookEnv,
             maxBuffer: HOOK_DEFAULTS.maxBuffer,
             signal: ac.signal,
         });
-        return { allowed: true, output: (stdout || stderr).trim() || undefined };
+        if (stdinData && child.stdin) {
+            child.stdin.write(stdinData);
+            child.stdin.end();
+        }
+        const result = await new Promise((resolve, reject) => {
+            let stdout = '';
+            let stderr = '';
+            child.stdout?.on('data', (d) => { stdout += d; });
+            child.stderr?.on('data', (d) => { stderr += d; });
+            child.on('error', reject);
+            child.on('close', (code) => resolve({ stdout, stderr, code: code ?? 0 }));
+        });
+        return parseHookOutput(result.stdout, result.code);
     }
     catch (err) {
         if (err.killed || err.code === 'ETIMEDOUT' || err.name === 'AbortError') {
@@ -65,7 +151,25 @@ export async function executeHook(hook, env) {
     }
 }
 export async function runHooks(hooks, event, context) {
-    const matching = hooks.filter((h) => h.event === event && matchesHook(h, context.toolName));
+    const matching = hooks.filter((h) => {
+        if (h.event !== event)
+            return false;
+        if (!matchesHook(h, context.toolName))
+            return false;
+        if (h.type === 'prompt')
+            return false;
+        if (h.if) {
+            try {
+                const conditionMet = evaluateCondition(h.if, context);
+                if (!conditionMet)
+                    return false;
+            }
+            catch {
+                return false;
+            }
+        }
+        return true;
+    });
     if (matching.length === 0)
         return [];
     const env = {};
@@ -77,10 +181,15 @@ export async function runHooks(hooks, event, context) {
         env.SCALIX_ERROR = context.error;
     if (context.prompt)
         env.SCALIX_PROMPT = context.prompt.slice(0, 4096).replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '');
+    if (context.response)
+        env.SCALIX_RESPONSE = context.response.slice(0, 4096);
+    if (context.notification)
+        env.SCALIX_NOTIFICATION = context.notification;
     env.SCALIX_EVENT = event;
+    const stdinData = buildHookInput(event, context);
     const results = [];
     for (const hook of matching) {
-        const result = await executeHook(hook, env);
+        const result = await executeHook(hook, env, stdinData);
         results.push(result);
         logger.debug('Hook executed', { event, command: hook.command, allowed: result.allowed });
         if (!result.allowed && event === 'PreToolUse')
@@ -88,13 +197,36 @@ export async function runHooks(hooks, event, context) {
     }
     return results;
 }
+function evaluateCondition(condition, context) {
+    if (condition.startsWith('tool_name=')) {
+        const expected = condition.slice('tool_name='.length);
+        return matchPattern(expected, context.toolName || '');
+    }
+    if (condition.startsWith('tool_args~')) {
+        const pattern = condition.slice('tool_args~'.length);
+        try {
+            return new RegExp(pattern).test(context.toolArgs || '');
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+export function getPromptHooks(hooks, event, toolName) {
+    return hooks.filter(h => h.event === event &&
+        h.type === 'prompt' &&
+        matchesHook(h, toolName));
+}
 export function hooksSummary(hooks) {
     if (hooks.length === 0)
         return 'No hooks configured.';
     const lines = ['Configured hooks:'];
     for (const h of hooks) {
         const match = h.match ? ` (match: ${h.match})` : '';
-        lines.push(`  ${h.event}${match}: ${h.command}`);
+        const type = h.type === 'prompt' ? ' [prompt]' : '';
+        const cond = h.if ? ` [if: ${h.if}]` : '';
+        lines.push(`  ${h.event}${match}${type}${cond}: ${h.command}`);
     }
     return lines.join('\n');
 }

package/dist/keychain.js

@@ -0,0 +1,109 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const exec = promisify(execFile);
+const SERVICE = 'scalix-coder';
+const ACCOUNT = 'api-key';
+async function isMacOS() {
+    return process.platform === 'darwin';
+}
+async function isLinuxWithSecretTool() {
+    if (process.platform !== 'linux')
+        return false;
+    try {
+        await exec('which', ['secret-tool']);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function getApiKeyFromKeychain() {
+    try {
+        if (await isMacOS()) {
+            const { stdout } = await exec('security', [
+                'find-generic-password',
+                '-s', SERVICE,
+                '-a', ACCOUNT,
+                '-w',
+            ]);
+            return stdout.trim() || null;
+        }
+        if (await isLinuxWithSecretTool()) {
+            const { stdout } = await exec('secret-tool', [
+                'lookup', 'service', SERVICE, 'account', ACCOUNT,
+            ]);
+            return stdout.trim() || null;
+        }
+    }
+    catch {
+        // keychain item not found or command failed
+    }
+    return null;
+}
+export async function setApiKeyInKeychain(apiKey) {
+    try {
+        if (await isMacOS()) {
+            // Delete existing entry first (ignore errors if it doesn't exist)
+            try {
+                await exec('security', [
+                    'delete-generic-password',
+                    '-s', SERVICE,
+                    '-a', ACCOUNT,
+                ]);
+            }
+            catch {
+                // entry didn't exist
+            }
+            await exec('security', [
+                'add-generic-password',
+                '-s', SERVICE,
+                '-a', ACCOUNT,
+                '-w', apiKey,
+                '-U',
+            ]);
+            return true;
+        }
+        if (await isLinuxWithSecretTool()) {
+            const child = exec('secret-tool', [
+                'store',
+                '--label', 'Scalix Coder API Key',
+                'service', SERVICE,
+                'account', ACCOUNT,
+            ]);
+            // secret-tool reads the secret from stdin
+            child.child?.stdin?.write(apiKey);
+            child.child?.stdin?.end();
+            await child;
+            return true;
+        }
+    }
+    catch {
+        // keychain operation failed
+    }
+    return false;
+}
+export async function deleteApiKeyFromKeychain() {
+    try {
+        if (await isMacOS()) {
+            await exec('security', [
+                'delete-generic-password',
+                '-s', SERVICE,
+                '-a', ACCOUNT,
+            ]);
+            return true;
+        }
+        if (await isLinuxWithSecretTool()) {
+            await exec('secret-tool', [
+                'clear', 'service', SERVICE, 'account', ACCOUNT,
+            ]);
+            return true;
+        }
+    }
+    catch {
+        // entry didn't exist or command failed
+    }
+    return false;
+}
+export async function isKeychainAvailable() {
+    return await isMacOS() || await isLinuxWithSecretTool();
+}

package/dist/markdown.js

@@ -1,13 +1,42 @@
 import chalk from 'chalk';
 import { Marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
+let highlightFn = null;
+let highlightLoaded = false;
+function getHighlighter() {
+    if (highlightLoaded)
+        return highlightFn;
+    highlightLoaded = true;
+    try {
+        // cli-highlight is a dependency — provides 100+ language highlighting
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const mod = require('cli-highlight');
+        highlightFn = mod.highlight;
+    }
+    catch {
+        highlightFn = null;
+    }
+    return highlightFn;
+}
+function highlightCode(code, language) {
+    const hl = getHighlighter();
+    if (!hl)
+        return chalk.yellow(code);
+    try {
+        return hl(code, { language: language || undefined });
+    }
+    catch {
+        // Unknown language or highlight error — fall back to yellow
+        return chalk.yellow(code);
+    }
+}
 function createMarked(width) {
     const m = new Marked();
     const mt = markedTerminal({
         strong: chalk.bold,
         em: chalk.italic,
         codespan: chalk.cyan,
-        code: chalk.yellow,
+        code: highlightCode,
         heading: chalk.green.bold,
         firstHeading: chalk.magenta.bold,
         hr: chalk.dim,
@@ -25,15 +54,29 @@ function createMarked(width) {
 }
 let cachedWidth = 0;
 let cachedMarked = null;
+// Content-hash render cache to avoid re-rendering identical content
+const renderCache = new Map();
+const MAX_CACHE_SIZE = 128;
 export function renderMarkdown(text, cols) {
     const width = Math.max((cols ?? process.stdout.columns ?? 100) - 6, 40);
+    const cacheKey = `${width}:${text}`;
+    const cached = renderCache.get(cacheKey);
+    if (cached)
+        return cached;
     if (!cachedMarked || width !== cachedWidth) {
         cachedWidth = width;
         cachedMarked = createMarked(width);
     }
     try {
-        const result = cachedMarked.parse(text);
-        return result.replace(/\n{3,}/g, '\n\n').trim();
+        const result = cachedMarked.parse(text).replace(/\n{3,}/g, '\n\n').trim();
+        // Evict oldest entries when cache is full
+        if (renderCache.size >= MAX_CACHE_SIZE) {
+            const firstKey = renderCache.keys().next().value;
+            if (firstKey !== undefined)
+                renderCache.delete(firstKey);
+        }
+        renderCache.set(cacheKey, result);
+        return result;
     }
     catch {
         return text;