scalix 1.1.0 → 1.3.2

package/dist/commands.js

@@ -1,5 +1,7 @@
 import fs from 'node:fs/promises';
+import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
+import { execSync } from 'node:child_process';
 import { logger } from './logger.js';
 import { PROJECT_LOOKUP_DIRS, PROJECT_CONFIG_DIR } from './constants.js';
 const COMMAND_DIRS = PROJECT_LOOKUP_DIRS.map(d => `${d}/commands`);
@@ -16,6 +18,9 @@ function parseFrontmatter(content) {
     }
     return { meta, body: match[2] };
 }
+function parseAllowedTools(spec) {
+    return spec.split(',').map(s => s.trim()).filter(Boolean);
+}
 export async function loadCustomCommands(cwd = process.cwd()) {
     const commands = [];
     for (const dir of COMMAND_DIRS) {
@@ -35,11 +40,17 @@ export async function loadCustomCommands(cwd = process.cwd()) {
                 const raw = await fs.readFile(filePath, 'utf-8');
                 const { meta, body } = parseFrontmatter(raw);
                 const name = entry.name.replace(/\.md$/, '');
+                const fm = meta;
                 commands.push({
                     name,
-                    description: meta.description || `Custom command: ${name}`,
+                    description: fm.description || `Custom command: ${name}`,
                     template: body.trim(),
                     source: filePath,
+                    frontmatter: fm,
+                    allowedTools: fm['allowed-tools'] ? parseAllowedTools(fm['allowed-tools']) : undefined,
+                    model: fm.model || undefined,
+                    argumentHint: fm['argument-hint'] || undefined,
+                    disableModelInvocation: fm['disable-model-invocation'] === 'true',
                 });
             }
             catch (err) {
@@ -49,15 +60,69 @@ export async function loadCustomCommands(cwd = process.cwd()) {
     }
     return commands;
 }
+function expandFileReferences(text, cwd) {
+    return text.replace(/@([\w./-]+\.\w+)/g, (_match, filePath) => {
+        // Reject path traversal so a command file can't pull in files outside the
+        // project via `@../../etc/passwd`.
+        if (filePath.split(/[\\/]/).includes('..')) {
+            return `@${filePath} (path traversal blocked)`;
+        }
+        const resolved = path.resolve(cwd, filePath);
+        if (!existsSync(resolved))
+            return `@${filePath} (file not found)`;
+        try {
+            const content = readFileSync(resolved, 'utf-8');
+            return `\n<file path="${filePath}">\n${content}\n</file>\n`;
+        }
+        catch {
+            return `@${filePath} (read error)`;
+        }
+    });
+}
+function expandInlineBash(text) {
+    return text.replace(/!`([^`]+)`/g, (_match, command) => {
+        try {
+            return execSync(command, { encoding: 'utf-8', timeout: 10_000 }).trim();
+        }
+        catch (err) {
+            return `(command failed: ${err.message})`;
+        }
+    });
+}
+// Apply the same sanitization used for $ARGS to a single argument so positional
+// args ($1..$9) can't smuggle shell metacharacters into a later `!`cmd`` inline
+// bash expansion.
+function sanitizeArg(arg) {
+    return arg
+        .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '')
+        .replace(/\$/g, '\\$')
+        .replace(/`/g, '\\`');
+}
+function expandPositionalArgs(text, args) {
+    const parts = args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [];
+    const cleaned = parts.map(p => sanitizeArg(p.replace(/^["']|["']$/g, '')));
+    let result = text;
+    for (let i = 0; i < 9; i++) {
+        const placeholder = `$${i + 1}`;
+        result = result.split(placeholder).join(cleaned[i] || '');
+    }
+    return result;
+}
 export function expandCommand(command, args) {
     const safeArgs = args
         .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '')
         .replace(/\$/g, '\\$')
         .replace(/`/g, '\\`');
     let prompt = command.template;
+    // Run inline bash (!`cmd`) FIRST, against the raw template only, so that no
+    // user-supplied argument can be substituted into a command line before it is
+    // executed. Any $ / backtick coming from args afterward stays inert text.
+    prompt = expandInlineBash(prompt);
+    prompt = expandPositionalArgs(prompt, args);
     prompt = prompt.replace(/\$ARGS/g, safeArgs);
     prompt = prompt.replace(/\$CWD/g, process.cwd());
     prompt = prompt.replace(/\$DATE/g, new Date().toISOString().split('T')[0]);
+    prompt = expandFileReferences(prompt, process.cwd());
     return prompt;
 }
 export function commandsSummary(commands) {
@@ -65,7 +130,10 @@ export function commandsSummary(commands) {
         return `No custom commands. Add .md files to ${PROJECT_CONFIG_DIR}/commands/`;
     const lines = ['Custom commands:'];
     for (const cmd of commands) {
-        lines.push(`  /${cmd.name} — ${cmd.description}`);
+        const hint = cmd.argumentHint ? ` <${cmd.argumentHint}>` : '';
+        const model = cmd.model ? ` [model: ${cmd.model}]` : '';
+        const tools = cmd.allowedTools ? ` [tools: ${cmd.allowedTools.length}]` : '';
+        lines.push(`  /${cmd.name}${hint} — ${cmd.description}${model}${tools}`);
     }
     return lines.join('\n');
 }

package/dist/constants.js

@@ -1,4 +1,4 @@
-export const VERSION = '1.1.0';
+export const VERSION = '1.3.0';
 export const PRODUCT_NAME = 'Scalix-Coder';
 export const USER_AGENT = `${PRODUCT_NAME}/${VERSION}`;
 export const DEFAULT_BASE_URL = process.env.SCALIX_BASE_URL || 'https://api.scalix.world/v1';
@@ -38,7 +38,7 @@ export const DEFAULT_INSTRUCTIONS = `You are an expert coding assistant. You wri
 
 ## Scalix Platform
 When helping users build AI applications, agents, or LLM-powered features:
-- Use the Scalix SDK (\`@scalix-world/sdk\` for TypeScript, \`scalix\` for Python) — not raw OpenAI/Anthropic/Google SDKs.
+- Use the Scalix SDK (\`@scalix-world/sdk\` for TypeScript, \`scalix-sdk\` for Python) — not raw OpenAI/Anthropic/Google SDKs.
 - Default to Scalix API (api.scalix.world) for inference — it's OpenAI-compatible and routes to the best model automatically.
 - For deployment, suggest \`scalix hosting\` before Vercel, Railway, or Fly.
 - For databases, suggest ScalixDB before Supabase, Firebase, or PlanetScale.
@@ -239,10 +239,10 @@ export const PROJECT_INDEX_DEFAULTS = {
     symbolFileLimit: 1_000,
     statusDisplayLimit: 50,
 };
-// ─── Git Identity (GitHub App bot) ───
+// ─── Git Identity ───
 export const GIT_BOT_IDENTITY = {
-    name: 'scalix-coder[bot]',
-    email: '280249884+scalix-coder[bot]@users.noreply.github.com',
+    name: 'Scalix Coder',
+    email: '283104927+scalix-coder@users.noreply.github.com',
 };
 // ─── Git Context Defaults ───
 export const GIT_CONTEXT_DEFAULTS = {
@@ -272,8 +272,11 @@ export const TOKEN_ESTIMATION = {
 export const PRIVATE_NETWORK_HOSTNAMES = new Set([
     'localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0',
     '::ffff:127.0.0.1', '[::ffff:127.0.0.1]',
+    '::', '[::]', '0:0:0:0:0:0:0:1', '[0:0:0:0:0:0:0:1]',
+    // common cloud metadata endpoints (also covered by 169.254/CIDR, listed for clarity)
+    'metadata.google.internal', 'metadata',
 ]);
-export const PRIVATE_NETWORK_SUFFIXES = ['.local', '.internal'];
+export const PRIVATE_NETWORK_SUFFIXES = ['.local', '.internal', '.localhost'];
 export const PRIVATE_NETWORK_CIDRS = [
     /^10\./,
     /^172\.(1[6-9]|2\d|3[01])\./,
@@ -292,6 +295,78 @@ export function setNetworkSecurityOverrides(overrides) {
         allowedHosts: overrides.allowedHosts ? new Set(overrides.allowedHosts.map(h => h.toLowerCase())) : undefined,
     };
 }
+/**
+ * Canonicalize a host string to a comparable IPv4 dotted-quad when it is a
+ * numeric address written in a non-standard form (decimal, hex, octal, or
+ * with fewer than 4 parts). Returns null when the input is not a bare IPv4-ish
+ * number. This closes SSRF bypasses like http://2130706433/ (=127.0.0.1),
+ * http://0x7f.1/ or http://127.1/.
+ */
+export function canonicalizeIpv4(host) {
+    const h = host.trim().replace(/^\[|\]$/g, '');
+    if (!/^[0-9a-fx.]+$/i.test(h))
+        return null;
+    const parts = h.split('.');
+    if (parts.length === 0 || parts.length > 4)
+        return null;
+    const nums = [];
+    for (const p of parts) {
+        if (p === '')
+            return null;
+        let n;
+        if (/^0x[0-9a-f]+$/i.test(p))
+            n = parseInt(p, 16);
+        else if (/^0[0-7]+$/.test(p))
+            n = parseInt(p, 8);
+        else if (/^[0-9]+$/.test(p))
+            n = parseInt(p, 10);
+        else
+            return null;
+        if (!Number.isFinite(n) || n < 0)
+            return null;
+        nums.push(n);
+    }
+    // Fold the trailing part as a "rest" value per inet_aton semantics.
+    let value;
+    if (nums.length === 1) {
+        value = nums[0];
+    }
+    else {
+        const last = nums[nums.length - 1];
+        const head = nums.slice(0, -1);
+        if (head.some(n => n > 255))
+            return null;
+        const restMax = Math.pow(256, 4 - head.length);
+        if (last >= restMax)
+            return null;
+        value = last;
+        for (let i = 0; i < head.length; i++) {
+            value += head[i] * Math.pow(256, 3 - i);
+        }
+    }
+    if (value < 0 || value > 0xffffffff)
+        return null;
+    return [
+        (value >>> 24) & 0xff,
+        (value >>> 16) & 0xff,
+        (value >>> 8) & 0xff,
+        value & 0xff,
+    ].join('.');
+}
+/**
+ * Check whether a concrete IP address (already resolved, or a literal) points
+ * at a private/loopback/link-local/metadata range. Use this after DNS
+ * resolution to defeat DNS-rebinding and numeric-encoding SSRF.
+ */
+export function isPrivateIp(ip) {
+    const canon = canonicalizeIpv4(ip);
+    const candidate = (canon ?? ip).toLowerCase();
+    if (PRIVATE_NETWORK_HOSTNAMES.has(candidate))
+        return true;
+    if (PRIVATE_NETWORK_CIDRS.some(re => re.test(candidate)))
+        return true;
+    return false;
+}
 export function isPrivateHost(hostname) {
     const lower = hostname.toLowerCase();
     if (_networkOverrides.allowAll)
@@ -300,6 +375,12 @@ export function isPrivateHost(hostname) {
         return false;
     if (_networkOverrides.blockedHosts?.has(lower))
         return true;
+    // Normalize numeric IPv4 encodings (decimal/hex/octal/short forms) so that
+    // e.g. 2130706433, 0x7f000001 and 127.1 are all recognized as loopback.
+    const canonical = canonicalizeIpv4(lower);
+    if (canonical && (PRIVATE_NETWORK_HOSTNAMES.has(canonical) || PRIVATE_NETWORK_CIDRS.some(re => re.test(canonical)))) {
+        return true;
+    }
     if (PRIVATE_NETWORK_HOSTNAMES.has(lower))
         return true;
     if (PRIVATE_NETWORK_SUFFIXES.some(s => lower.endsWith(s)))

package/dist/context-retriever.js

@@ -70,7 +70,7 @@ function scoreFiles(analysis, index) {
         deps.add(imp.to);
         importGraph.set(imp.from, deps);
     }
-    const recentFiles = new Set(index.files
+    const recentFiles = new Set([...index.files]
         .sort((a, b) => b.modifiedAt - a.modifiedAt)
         .slice(0, 20)
         .map((f) => f.relativePath));

package/dist/cost-tracker.js

@@ -1,6 +1,7 @@
 export class CostTracker {
     entries = [];
     sessionStart = Date.now();
+    restoredRequestCount = 0;
     record(model, usage) {
         this.entries.push({
             model,
@@ -24,7 +25,10 @@ export class CostTracker {
         return this.entries.reduce((s, e) => s + e.completionTokens, 0);
     }
     get requestCount() {
-        return this.entries.length;
+        // The single restored aggregate entry stands in for the previous session's
+        // request count, tracked separately so we don't over-count live requests.
+        const liveEntries = this.entries.filter((e) => e.model !== '(previous session)').length;
+        return liveEntries + this.restoredRequestCount;
     }
     get sessionDuration() {
         const s = Math.floor((Date.now() - this.sessionStart) / 1000);
@@ -57,25 +61,26 @@ export class CostTracker {
     }
     reset() {
         this.entries = [];
+        this.restoredRequestCount = 0;
         this.sessionStart = Date.now();
     }
     restore(state) {
         this.entries = [];
-        if (state.requestCount > 0 && state.totalTokens >= 0) {
-            const count = Math.max(1, state.requestCount);
-            const perReqTokens = Math.floor(state.totalTokens / count);
-            const remainder = state.totalTokens - perReqTokens * count;
-            const perReqCost = state.totalCost / count;
-            for (let i = 0; i < count; i++) {
-                this.entries.push({
-                    model: '(previous session)',
-                    promptTokens: 0,
-                    completionTokens: 0,
-                    totalTokens: perReqTokens + (i === 0 ? remainder : 0),
-                    cost: perReqCost,
-                    timestamp: Date.now(),
-                });
-            }
+        // Store a single aggregate entry rather than fabricating `requestCount`
+        // synthetic entries — a corrupted/huge count would otherwise allocate
+        // unboundedly. The original request count is preserved separately.
+        this.restoredRequestCount = Number.isFinite(state.requestCount) && state.requestCount > 0
+            ? Math.floor(state.requestCount)
+            : 0;
+        if (this.restoredRequestCount > 0 && state.totalTokens >= 0) {
+            this.entries.push({
+                model: '(previous session)',
+                promptTokens: 0,
+                completionTokens: 0,
+                totalTokens: state.totalTokens,
+                cost: state.totalCost,
+                timestamp: Date.now(),
+            });
         }
     }
     getState() {

package/dist/git-context.js

@@ -18,13 +18,13 @@ async function getBranch(cwd) {
     return (await run('git branch --show-current', cwd)) || (await run('git rev-parse --short HEAD', cwd)) || 'unknown';
 }
 async function getRemoteBranch(cwd) {
-    return run('git rev-parse --abbrev-ref @{upstream} 2>/dev/null', cwd);
+    return run('git rev-parse --abbrev-ref @{upstream}', cwd);
 }
 async function getRemoteUrl(cwd) {
-    return run('git remote get-url origin 2>/dev/null', cwd);
+    return run('git remote get-url origin', cwd);
 }
 async function getAheadBehind(cwd) {
-    const result = await run('git rev-list --left-right --count @{upstream}...HEAD 2>/dev/null', cwd);
+    const result = await run('git rev-list --left-right --count @{upstream}...HEAD', cwd);
     if (!result)
         return { ahead: 0, behind: 0 };
     const parts = result.split('\t');
@@ -33,7 +33,7 @@ async function getAheadBehind(cwd) {
     return { ahead: Number(parts[1]) || 0, behind: Number(parts[0]) || 0 };
 }
 async function getStashCount(cwd) {
-    const result = await run('git stash list 2>/dev/null', cwd);
+    const result = await run('git stash list', cwd);
     return result ? result.split('\n').filter(Boolean).length : 0;
 }
 async function getStatus(cwd) {
@@ -74,7 +74,10 @@ async function getStatus(cwd) {
 async function getRecentCommits(cwd, count = GIT_CONTEXT_DEFAULTS.recentCommitsCount) {
     const SEP = '<%>';
     const format = `%H${SEP}%h${SEP}%s${SEP}%an${SEP}%ar`;
-    const result = await run(`git log --pretty=format:"${format}" --shortstat -n ${count} 2>/dev/null`, cwd);
+    // No shell redirects here: `2>/dev/null` breaks under cmd.exe on Windows
+    // (redirects to a literal \dev\null path and fails the whole command).
+    // run() already discards stderr and swallows failures.
+    const result = await run(`git log --pretty=format:"${format}" --shortstat -n ${count}`, cwd);
     if (!result)
         return [];
     const commits = [];

package/dist/grounding-checker.js

@@ -20,7 +20,14 @@ function surroundingContext(text, pos, radius = 60) {
     const end = Math.min(text.length, pos + radius);
     return text.slice(start, end).replace(/\n/g, ' ').trim();
 }
-export function extractCodeClaims(text) {
+// Blank out fenced code blocks (```...```) with equal-length whitespace so the
+// model's own newly-authored symbols aren't flagged as ungrounded, while
+// keeping character offsets stable for surroundingContext().
+function maskFencedCodeBlocks(text) {
+    return text.replace(/```[\s\S]*?(?:```|$)/g, (block) => block.replace(/[^\n]/g, ' '));
+}
+export function extractCodeClaims(rawText) {
+    const text = maskFencedCodeBlocks(rawText);
     const seen = new Set();
     const claims = [];
     function add(type, value, position) {

package/dist/headless.js

@@ -22,6 +22,7 @@ import { loadMemory, autoDetectConventions, saveMemory, memoryToContext, addNote
 import { buildProjectIndex } from './project-index.js';
 import { buildProjectContext, contextToInstructions } from './context-builder.js';
 import { discoverPlugins, getPluginTools, pluginsSummary } from './plugins.js';
+import { isWorkspaceTrusted } from './workspace-trust.js';
 import { loadCustomCommands, expandCommand, commandsSummary } from './commands.js';
 import { hooksSummary } from './hooks.js';
 import { spawnSubAgent, pickCheapestModel } from './sub-agent.js';
@@ -39,6 +40,8 @@ export function parseArgs() {
     let format;
     let permissionMode;
     let outputSchema;
+    let worktree = false;
+    let worktreeName;
     for (let i = 0; i < args.length; i++) {
         if (args[i] === 'run' && i + 1 < args.length) {
             mode = 'run';
@@ -72,6 +75,13 @@ export function parseArgs() {
         else if (args[i] === '--ipc') {
             mode = 'ipc';
         }
+        else if (args[i] === '--worktree' || args[i] === '-w') {
+            worktree = true;
+            if (i + 1 < args.length && !args[i + 1].startsWith('-') && args[i + 1] !== 'run') {
+                worktreeName = args[i + 1];
+                i++;
+            }
+        }
         else if (args[i] === '--help' || args[i] === '-h') {
             console.log(`
 Scalix - Headless Mode
@@ -91,6 +101,7 @@ Options:
   --format <fmt>     Output format: text (default), json, json-schema, patch, markdown
   --output-format    Alias for --format
   --output-schema    Path to JSON schema file (implies --format json-schema)
+  --worktree, -w     Run in an isolated git worktree (optional: --worktree <name>)
   --help, -h         Show this help
 `);
             process.exit(0);
@@ -99,7 +110,7 @@ Options:
     if (!process.stdin.isTTY && mode === 'interactive') {
         mode = 'pipe';
     }
-    return { mode, prompt, output, format, permissionMode, outputSchema };
+    return { mode, prompt, output, format, permissionMode, outputSchema, worktree, worktreeName };
 }
 async function buildEnhancedInstructions() {
     let base = DEFAULT_INSTRUCTIONS;
@@ -120,7 +131,7 @@ async function buildEnhancedInstructions() {
     const ctx = await buildProjectContext(cwd);
     return contextToInstructions(base, ctx);
 }
-async function runSinglePrompt(prompt, output, format, outputSchemaPath) {
+async function runSinglePrompt(prompt, output, format, outputSchemaPath, beforeExit) {
     const apiKey = process.env[ENV_API_KEY];
     if (!apiKey) {
         console.error('Error: SCALIX_API_KEY is not set.\nSet it via: export SCALIX_API_KEY=sk-...\nOr run the interactive setup: scalix');
@@ -148,7 +159,12 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath) {
         process.exit(1);
     }
     const mcpTools = loadMcpServices();
-    const plugins = await discoverPlugins(process.cwd());
+    // Only discover/load project-local plugins in a trusted workspace — plugins
+    // dynamically import and execute code from the project directory.
+    const plugins = isWorkspaceTrusted() ? await discoverPlugins(process.cwd()) : [];
+    if (!isWorkspaceTrusted()) {
+        process.stderr.write('Project plugins skipped (untrusted workspace).\n');
+    }
     const pluginTools = getPluginTools(plugins);
     const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools, ...pluginTools];
     const instructions = await buildEnhancedInstructions();
@@ -191,16 +207,22 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath) {
         contextRetrieval: true,
     });
     let fullResponse = '';
-    agent.on('stream:end', (text) => { fullResponse = text; });
     agent.on('tool:call', (name) => process.stderr.write(`\x1b[33m▶ ${name}\x1b[0m\n`));
     agent.on('verify:pass', (r) => process.stderr.write(`\x1b[32m✓ ${r.checker} passed\x1b[0m\n`));
     agent.on('verify:fail', (r) => process.stderr.write(`\x1b[31m✗ ${r.checker} failed: ${r.output.split('\n')[0]}\x1b[0m\n`));
     agent.on('error', (err) => process.stderr.write(`\x1b[31mError: ${err.message}\x1b[0m\n`));
+    agent.on('usage', (data) => {
+        costTracker.record(data.model || selectedModel[0], data);
+    });
     try {
-        await agent.send(prompt);
+        // Use the return value (applies JSON extraction for --format json/json-schema)
+        // rather than the raw stream text.
+        fullResponse = await agent.send(prompt);
     }
     catch (err) {
         console.error(`Error: ${err.message}`);
+        if (beforeExit)
+            await beforeExit();
         process.exit(1);
     }
     let formatted;
@@ -234,9 +256,11 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath) {
         process.stdout.write(formatted + '\n');
     }
     await closeBrowser();
+    if (beforeExit)
+        await beforeExit();
     process.exit(0);
 }
-async function runPipeMode() {
+async function runPipeMode(beforeExit) {
     const MAX_PIPE_BYTES = 50 * 1024 * 1024;
     const chunks = [];
     let totalBytes = 0;
@@ -246,6 +270,8 @@ async function runPipeMode() {
             totalBytes += Buffer.byteLength(str);
             if (totalBytes > MAX_PIPE_BYTES) {
                 console.error(`Error: Pipe input exceeds ${MAX_PIPE_BYTES / 1024 / 1024}MB limit.`);
+                if (beforeExit)
+                    await beforeExit();
                 process.exit(1);
             }
             chunks.push(str);
@@ -253,14 +279,18 @@ async function runPipeMode() {
     }
     catch (err) {
         console.error(`Error reading pipe input: ${err.message}`);
+        if (beforeExit)
+            await beforeExit();
         process.exit(1);
     }
     const prompt = chunks.join('').trim();
     if (!prompt) {
         console.error('Error: No input received from stdin.');
+        if (beforeExit)
+            await beforeExit();
         process.exit(1);
     }
-    await runSinglePrompt(prompt);
+    await runSinglePrompt(prompt, undefined, undefined, undefined, beforeExit);
 }
 async function runInteractive() {
     const apiKey = process.env[ENV_API_KEY];
@@ -281,7 +311,12 @@ async function runInteractive() {
         throw new Error('No models configured. Set SCALIX_MODEL env var or run interactive setup.');
     }
     const mcpTools = loadMcpServices();
-    const plugins = await discoverPlugins(process.cwd());
+    // Only discover/load project-local plugins in a trusted workspace — plugins
+    // dynamically import and execute code from the project directory.
+    const plugins = isWorkspaceTrusted() ? await discoverPlugins(process.cwd()) : [];
+    if (!isWorkspaceTrusted()) {
+        process.stderr.write('Project plugins skipped (untrusted workspace).\n');
+    }
     const pluginTools = getPluginTools(plugins);
     const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools, ...pluginTools];
     const instructions = await buildEnhancedInstructions();
@@ -363,20 +398,27 @@ async function runInteractive() {
         console.log(`\x1b[36mPlugins:\x1b[0m ${plugins.map((p) => p.manifest.name).join(', ')}`);
     }
     console.log('');
-    function shutdown() {
+    let shuttingDown = false;
+    async function shutdown() {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
         const msgs = agent.getMessages();
         if (msgs.length > 0) {
-            saveSession(sessionId, msgs, agent.getModels()[0], undefined, costTracker.getState()).catch(() => { });
+            // Await the save so sessions aren't lost on SIGINT (process.exit would
+            // otherwise cut off the fire-and-forget write).
+            await saveSession(sessionId, msgs, agent.getModels()[0], undefined, costTracker.getState()).catch(() => { });
         }
         if (costTracker.totalTokens > 0) {
             console.log(`\n\x1b[36mSession: ${costTracker.totalTokens.toLocaleString()} tokens${costTracker.totalCost > 0 ? ` ($${costTracker.totalCost.toFixed(4)})` : ''}\x1b[0m`);
         }
         console.log('Goodbye!');
         rl.close();
-        closeBrowser().finally(() => process.exit(0));
+        await closeBrowser().catch(() => { });
+        process.exit(0);
     }
-    process.on('SIGINT', shutdown);
-    process.on('SIGTERM', shutdown);
+    process.on('SIGINT', () => { shutdown().catch(() => process.exit(1)); });
+    process.on('SIGTERM', () => { shutdown().catch(() => process.exit(1)); });
     const handleCommand = async (input) => {
         const cmd = input.split(' ')[0].toLowerCase();
         if (cmd === '/help') {
@@ -645,7 +687,7 @@ async function runInteractive() {
             return true;
         }
         if (cmd === '/quit' || cmd === '/exit') {
-            shutdown();
+            await shutdown();
             return true;
         }
         const customCmd = customCmds.find((c) => cmd === `/${c.name}`);
@@ -713,28 +755,69 @@ async function runInteractive() {
 }
 async function main() {
     setSandboxRoot(process.cwd());
-    const { mode, prompt, output, format, permissionMode: cliPermissionMode, outputSchema } = parseArgs();
+    const { mode, prompt, output, format, permissionMode: cliPermissionMode, outputSchema, worktree, worktreeName } = parseArgs();
     if (cliPermissionMode) {
         process.env.SCALIX_PERMISSION_MODE = cliPermissionMode;
     }
-    switch (mode) {
-        case 'run':
-            if (!prompt) {
-                console.error('Error: No prompt provided. Usage: scalix run "your prompt"');
-                process.exit(1);
-            }
-            await runSinglePrompt(prompt, output, format, outputSchema);
-            break;
-        case 'pipe':
-            await runPipeMode();
-            break;
-        case 'ipc':
-            await runIpcServer();
-            break;
-        case 'interactive':
-        default:
-            await runInteractive();
-            break;
+    // Set up worktree isolation if requested
+    let worktreeInfo = null;
+    // Capture the original cwd BEFORE any process.chdir so cleanup can restore it
+    // and resolve the worktree parent correctly.
+    const originalCwd = process.cwd();
+    let cleanup = async () => { };
+    if (worktree) {
+        const { createWorktree, removeWorktree } = await import('./worktree.js');
+        const name = worktreeName || `session-${Date.now().toString(36)}`;
+        try {
+            worktreeInfo = await createWorktree(name, originalCwd);
+            process.chdir(worktreeInfo.path);
+            setSandboxRoot(worktreeInfo.path);
+            console.log(`Working in isolated worktree: ${worktreeInfo.branch} → ${worktreeInfo.path}`);
+        }
+        catch (err) {
+            console.error(`Failed to create worktree: ${err.message}`);
+            process.exit(1);
+        }
+        let cleanedUp = false;
+        cleanup = async () => {
+            if (cleanedUp || !worktreeInfo)
+                return;
+            cleanedUp = true;
+            try {
+                // Return to the original directory before removing the worktree so we
+                // are not standing inside the directory being deleted.
+                process.chdir(originalCwd);
+                await removeWorktree(worktreeInfo, originalCwd);
+            }
+            catch { }
+        };
+        // 'exit' handlers cannot run async work — SIGINT awaits cleanup explicitly.
+        process.on('SIGINT', () => { cleanup().then(() => process.exit(0)).catch(() => process.exit(1)); });
+    }
+    try {
+        switch (mode) {
+            case 'run':
+                if (!prompt) {
+                    console.error('Error: No prompt provided. Usage: scalix run "your prompt"');
+                    await cleanup();
+                    process.exit(1);
+                }
+                await runSinglePrompt(prompt, output, format, outputSchema, cleanup);
+                break;
+            case 'pipe':
+                await runPipeMode(cleanup);
+                break;
+            case 'ipc':
+                await runIpcServer();
+                break;
+            case 'interactive':
+            default:
+                await runInteractive();
+                break;
+        }
+    }
+    finally {
+        await cleanup();
     }
 }
 main().catch((err) => {