scalix 1.1.0 → 1.2.0

package/dist/plugins.js

@@ -130,3 +130,135 @@ export function pluginsSummary(plugins) {
     }
     return lines.join('\n');
 }
+export async function installPlugin(projectRoot, source) {
+    const pluginsDir = path.join(projectRoot, PLUGINS_DIR);
+    await fs.mkdir(pluginsDir, { recursive: true });
+    // Source can be a local directory path or a git repo URL
+    if (source.startsWith('http') || source.includes('github.com') || source.includes('.git')) {
+        const { execFile } = await import('node:child_process');
+        const { promisify } = await import('node:util');
+        const execFileAsync = promisify(execFile);
+        const name = path.basename(source.replace(/\.git$/, ''));
+        const targetDir = path.join(pluginsDir, name);
+        try {
+            await fs.access(targetDir);
+            return null; // already installed
+        }
+        catch {
+            // directory doesn't exist, proceed
+        }
+        try {
+            await execFileAsync('git', ['clone', '--depth', '1', source, targetDir], { timeout: 30_000 });
+        }
+        catch (err) {
+            throw new Error(`Failed to clone plugin: ${err.message}`);
+        }
+        const plugin = await loadPlugin(targetDir);
+        if (!plugin) {
+            await fs.rm(targetDir, { recursive: true, force: true });
+            throw new Error(`Cloned repo is not a valid plugin (no plugin.json found)`);
+        }
+        _pluginCache.delete(projectRoot);
+        return { name: plugin.manifest.name, version: plugin.manifest.version };
+    }
+    // Local directory: copy or symlink
+    const sourcePath = path.resolve(source);
+    try {
+        await fs.access(path.join(sourcePath, 'plugin.json'));
+    }
+    catch {
+        throw new Error(`Source directory does not contain plugin.json: ${source}`);
+    }
+    const raw = await fs.readFile(path.join(sourcePath, 'plugin.json'), 'utf-8');
+    const manifest = JSON.parse(raw);
+    const name = manifest.name || path.basename(sourcePath);
+    const targetDir = path.join(pluginsDir, name);
+    try {
+        await fs.access(targetDir);
+        return null; // already installed
+    }
+    catch {
+        // proceed
+    }
+    await fs.symlink(sourcePath, targetDir, 'dir');
+    _pluginCache.delete(projectRoot);
+    return { name: manifest.name, version: manifest.version || '0.0.0' };
+}
+export async function uninstallPlugin(projectRoot, pluginName) {
+    const pluginsDir = path.join(projectRoot, PLUGINS_DIR);
+    const targetDir = path.join(pluginsDir, pluginName);
+    try {
+        await fs.access(targetDir);
+    }
+    catch {
+        return false;
+    }
+    await fs.rm(targetDir, { recursive: true, force: true });
+    _pluginCache.delete(projectRoot);
+    return true;
+}
+export async function listInstalledPlugins(projectRoot) {
+    const pluginsDir = path.join(projectRoot, PLUGINS_DIR);
+    const results = [];
+    try {
+        await fs.access(pluginsDir);
+    }
+    catch {
+        return [];
+    }
+    const entries = await fs.readdir(pluginsDir, { withFileTypes: true });
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const pluginDir = path.join(pluginsDir, entry.name);
+        const manifestPath = path.join(pluginDir, 'plugin.json');
+        try {
+            const raw = await fs.readFile(manifestPath, 'utf-8');
+            const manifest = JSON.parse(raw);
+            const disabledMarker = path.join(pluginDir, '.disabled');
+            let enabled = true;
+            try {
+                await fs.access(disabledMarker);
+                enabled = false;
+            }
+            catch {
+                // not disabled
+            }
+            results.push({
+                name: manifest.name || entry.name,
+                version: manifest.version || '0.0.0',
+                path: pluginDir,
+                enabled,
+            });
+        }
+        catch {
+            // not a valid plugin, skip
+        }
+    }
+    return results;
+}
+export async function enablePlugin(projectRoot, pluginName) {
+    const pluginsDir = path.join(projectRoot, PLUGINS_DIR);
+    const disabledMarker = path.join(pluginsDir, pluginName, '.disabled');
+    try {
+        await fs.unlink(disabledMarker);
+        _pluginCache.delete(projectRoot);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function disablePlugin(projectRoot, pluginName) {
+    const pluginsDir = path.join(projectRoot, PLUGINS_DIR);
+    const pluginDir = path.join(pluginsDir, pluginName);
+    try {
+        await fs.access(pluginDir);
+        await fs.writeFile(path.join(pluginDir, '.disabled'), '', { mode: 0o644 });
+        _pluginCache.delete(projectRoot);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/project-index.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
 import path from 'node:path';
 import fg from 'fast-glob';
 import { PROJECT_INDEX_DEFAULTS } from './constants.js';
@@ -243,8 +244,26 @@ function extractImports(content, relativePath, ext) {
     }
     return imports;
 }
+function loadScalixIgnore(root) {
+    const ignorePaths = ['.scalixignore', '.scalix/.ignore'];
+    for (const relPath of ignorePaths) {
+        try {
+            const fullPath = path.join(root, relPath);
+            const content = readFileSync(fullPath, 'utf-8');
+            return content.split('\n')
+                .map(l => l.trim())
+                .filter(l => l && !l.startsWith('#'));
+        }
+        catch { }
+    }
+    return [];
+}
 async function buildProjectIndexFresh(root) {
-    const ignorePattern = IGNORE_DIRS.map((d) => `**/${d}/**`);
+    const customIgnores = loadScalixIgnore(root);
+    const ignorePattern = [
+        ...IGNORE_DIRS.map((d) => `**/${d}/**`),
+        ...customIgnores,
+    ];
     const globbed = await fg('**/*', {
         cwd: root,
         ignore: ignorePattern,

package/dist/sandbox.js

@@ -45,6 +45,64 @@ export async function sandboxPathAsync(filePath) {
         throw err;
     }
 }
+let _scopedRules = [];
+export function setScopedPermissionRules(rules) {
+    _scopedRules = rules;
+}
+export function getScopedPermissionRules() {
+    return _scopedRules;
+}
+function parseScopedToolSpec(spec) {
+    const match = spec.match(/^(\w+)\(([^)]+)\)$/);
+    if (match)
+        return { tool: match[1], prefix: match[2].replace(/\*$/, '') };
+    return { tool: spec };
+}
+export function checkScopedPermission(toolName, args) {
+    if (_scopedRules.length === 0)
+        return null;
+    const argStr = extractPrimaryArg(toolName, args);
+    for (const rule of _scopedRules) {
+        const parsed = parseScopedToolSpec(rule.tool);
+        if (!parsed)
+            continue;
+        if (parsed.tool !== toolName)
+            continue;
+        if (!parsed.prefix)
+            return rule.action;
+        if (argStr && argStr.startsWith(parsed.prefix))
+            return rule.action;
+        if (rule.regex) {
+            try {
+                if (new RegExp(rule.regex).test(argStr || ''))
+                    return rule.action;
+            }
+            catch { }
+        }
+    }
+    return null;
+}
+function extractPrimaryArg(toolName, args) {
+    if (!args || typeof args !== 'object')
+        return null;
+    const a = args;
+    if (toolName === 'run_command' && typeof a.command === 'string')
+        return a.command;
+    if (typeof a.filePath === 'string')
+        return a.filePath;
+    if (typeof a.file_path === 'string')
+        return a.file_path;
+    if (typeof a.path === 'string')
+        return a.path;
+    if (typeof a.pattern === 'string')
+        return a.pattern;
+    if (typeof a.query === 'string')
+        return a.query;
+    if (typeof a.url === 'string')
+        return a.url;
+    const first = Object.values(a).find(v => typeof v === 'string');
+    return typeof first === 'string' ? first : null;
+}
 // ─── Security Configuration ───
 let _securityConfig = {};
 export function setSecurityConfig(config) {
@@ -147,6 +205,14 @@ export function getToolPermission(toolName, mode) {
             return 'ask';
     }
 }
+export function getToolPermissionWithArgs(toolName, mode, args) {
+    const scoped = checkScopedPermission(toolName, args);
+    if (scoped === 'allow')
+        return 'allow';
+    if (scoped === 'deny')
+        return 'block';
+    return getToolPermission(toolName, mode);
+}
 export function isDangerousTool(toolName) {
     const sets = getEffectiveToolSets();
     return sets.dangerous.has(toolName) || sets.write.has(toolName);

package/dist/sessions.js

@@ -104,3 +104,62 @@ export async function deleteSession(id) {
 export function generateSessionId() {
     return randomUUID();
 }
+const CRASH_FILE = path.join(SESSIONS_DIR, '.crash-recovery.json');
+export async function saveCrashState(sessionId, messages, model, costState) {
+    try {
+        await ensureDir();
+        const data = {
+            sessionId,
+            messages,
+            model,
+            costState,
+            savedAt: new Date().toISOString(),
+        };
+        await fs.writeFile(CRASH_FILE, JSON.stringify(data), { mode: 0o600 });
+    }
+    catch { }
+}
+export async function loadCrashState() {
+    try {
+        const raw = await fs.readFile(CRASH_FILE, 'utf-8');
+        const data = JSON.parse(raw);
+        if (data?.sessionId && Array.isArray(data?.messages)) {
+            return data;
+        }
+    }
+    catch { }
+    return null;
+}
+export async function clearCrashState() {
+    try {
+        await fs.unlink(CRASH_FILE);
+    }
+    catch { }
+}
+export async function forkSession(sourceId, forkPoint) {
+    const source = await loadSession(sourceId);
+    const forkedMessages = source.messages.slice(0, forkPoint);
+    const newId = generateSessionId();
+    const meta = await saveSession(newId, forkedMessages, source.meta.model, `Fork of ${source.meta.name} (at msg ${forkPoint})`, source.costState);
+    return { id: newId, meta };
+}
+export async function getSessionDiff(id) {
+    const session = await loadSession(id);
+    const diffs = [];
+    for (const msg of session.messages) {
+        if (msg.role !== 'assistant' || !msg.tool_calls)
+            continue;
+        for (const tc of msg.tool_calls) {
+            if (tc.function.name === 'edit_file' || tc.function.name === 'write_file') {
+                try {
+                    const args = JSON.parse(tc.function.arguments);
+                    diffs.push(`${tc.function.name}: ${args.file_path || args.filePath || 'unknown'}`);
+                }
+                catch {
+                    diffs.push(`${tc.function.name}: (parse error)`);
+                }
+            }
+        }
+    }
+    return diffs;
+}

package/dist/settings.js

@@ -1,7 +1,8 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { setSecurityConfig } from './sandbox.js';
+import { setSecurityConfig, setScopedPermissionRules } from './sandbox.js';
 import { DEFAULT_BASE_URL, DEFAULT_MODELS, AGENT_DEFAULTS, CONTEXT_DEFAULTS, WEB_DEFAULTS, TOOL_DEFAULTS, SUB_AGENT_DEFAULTS, MULTI_AGENT_DEFAULTS, USER_CONFIG_DIR, registerUserModels, setNetworkSecurityOverrides, } from './constants.js';
+import { getApiKeyFromKeychain, setApiKeyInKeychain, isKeychainAvailable } from './keychain.js';
 function getConfigDir() {
     return path.join(process.env.HOME || process.env.USERPROFILE || '.', USER_CONFIG_DIR);
 }
@@ -233,27 +234,107 @@ export function applySecurityConfig(security) {
         allowedHosts: security.allowedPrivateHosts,
     });
 }
+async function loadLocalOverrides(config) {
+    const localPaths = [
+        path.join(process.cwd(), '.scalix', 'settings.local.json'),
+        path.join(process.cwd(), '.scalix-coder', 'settings.local.json'),
+    ];
+    for (const localPath of localPaths) {
+        try {
+            const raw = await fs.readFile(localPath, 'utf-8');
+            const overrides = JSON.parse(raw);
+            if (overrides.models)
+                config.models = overrides.models;
+            if (overrides.permissionMode)
+                config.permissionMode = overrides.permissionMode;
+            if (overrides.thinkingMode)
+                config.thinkingMode = overrides.thinkingMode;
+            if (overrides.limits)
+                config.limits = { ...config.limits, ...overrides.limits };
+            if (overrides.security)
+                config.security = { ...config.security, ...overrides.security };
+            if (overrides.scopedPermissions)
+                config.scopedPermissions = overrides.scopedPermissions;
+            if (overrides.customModels)
+                config.customModels = { ...config.customModels, ...overrides.customModels };
+            break;
+        }
+        catch { }
+    }
+    return config;
+}
+async function loadManagedSettings(config) {
+    const managedPaths = [
+        path.join(getConfigDir(), 'managed-settings.json'),
+    ];
+    for (const managedPath of managedPaths) {
+        try {
+            const raw = await fs.readFile(managedPath, 'utf-8');
+            const managed = JSON.parse(raw);
+            if (managed.permissionMode)
+                config.permissionMode = managed.permissionMode;
+            if (managed.security)
+                config.security = { ...config.security, ...managed.security };
+            if (managed.scopedPermissions)
+                config.scopedPermissions = [
+                    ...(config.scopedPermissions || []),
+                    ...managed.scopedPermissions,
+                ];
+            if (managed.disableUpdateCheck !== undefined)
+                config.disableUpdateCheck = managed.disableUpdateCheck;
+            break;
+        }
+        catch { }
+    }
+    return config;
+}
 export async function loadConfig() {
     try {
         const raw = await fs.readFile(getConfigFile(), 'utf-8');
         const parsed = JSON.parse(raw);
         const validated = validateConfig(parsed);
-        const config = { ...DEFAULTS, ...validated };
+        let config = { ...DEFAULTS, ...validated };
+        // Try keychain for API key (preferred over plaintext config)
+        if (!config.apiKey || config.apiKey === '') {
+            const keychainKey = await getApiKeyFromKeychain().catch(() => null);
+            if (keychainKey)
+                config.apiKey = keychainKey;
+        }
+        // Apply local overrides (project-level, gitignored)
+        config = await loadLocalOverrides(config);
+        // Apply managed/organization settings (enterprise policy)
+        config = await loadManagedSettings(config);
         if (config.customModels && Object.keys(config.customModels).length > 0) {
             registerUserModels(config.customModels);
         }
         if (config.security && Object.keys(config.security).length > 0) {
             applySecurityConfig(config.security);
         }
+        if (config.scopedPermissions && config.scopedPermissions.length > 0) {
+            setScopedPermissionRules(config.scopedPermissions);
+        }
         return config;
     }
     catch {
-        return { ...DEFAULTS };
+        // Even if config file fails, try keychain
+        const config = { ...DEFAULTS };
+        const keychainKey = await getApiKeyFromKeychain().catch(() => null);
+        if (keychainKey)
+            config.apiKey = keychainKey;
+        return config;
     }
 }
 export async function saveConfig(config) {
     await ensureDir();
-    await fs.writeFile(getConfigFile(), JSON.stringify(config, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    // Store API key in keychain if available, strip from config file
+    const configToWrite = { ...config };
+    if (config.apiKey && await isKeychainAvailable()) {
+        const stored = await setApiKeyInKeychain(config.apiKey).catch(() => false);
+        if (stored) {
+            configToWrite.apiKey = '';
+        }
+    }
+    await fs.writeFile(getConfigFile(), JSON.stringify(configToWrite, null, 2), { encoding: 'utf-8', mode: 0o600 });
 }
 export function isConfigured(config) {
     return config.apiKey.length > 0 && config.models.length > 0;