scalix 1.1.0 → 1.3.2

package/dist/hooks.js

@@ -1,10 +1,42 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { resolve, join, basename } from 'node:path';
 import { exec } from 'node:child_process';
-import { promisify } from 'node:util';
 import { logger } from './logger.js';
 import { PROJECT_LOOKUP_DIRS, HOOK_DEFAULTS } from './constants.js';
-const execAsync = promisify(exec);
+import { sanitizeEnvForCommand } from './sandbox.js';
+// Hook commands are written in POSIX sh syntax ($VAR, pipes, etc). On Windows
+// the default exec shell is cmd.exe, which silently mangles them — so resolve
+// a real POSIX shell (Git Bash) when one is available. `null` = not resolved.
+let cachedHookShell = null;
+function isPosixShell(shellPath) {
+    const name = basename(shellPath).toLowerCase().replace(/\.exe$/, '');
+    return name === 'bash' || name === 'sh' || name === 'zsh' || name === 'dash';
+}
+function resolveHookShell() {
+    if (cachedHookShell !== null)
+        return cachedHookShell;
+    if (process.platform !== 'win32') {
+        cachedHookShell = undefined;
+        return undefined;
+    }
+    const candidates = [
+        process.env.SCALIX_HOOK_SHELL,
+        process.env.SHELL,
+        join(process.env.ProgramFiles ?? 'C:\\Program Files', 'Git', 'bin', 'bash.exe'),
+        join(process.env['ProgramFiles(x86)'] ?? 'C:\\Program Files (x86)', 'Git', 'bin', 'bash.exe'),
+        process.env.LOCALAPPDATA ? join(process.env.LOCALAPPDATA, 'Programs', 'Git', 'bin', 'bash.exe') : undefined,
+    ];
+    for (const c of candidates) {
+        // Skip WSL/System32 bash implicitly: only explicit paths are checked, and
+        // non-POSIX shells (e.g. a SHELL pointing at PowerShell) are rejected.
+        if (c && isPosixShell(c) && existsSync(c)) {
+            cachedHookShell = c;
+            return c;
+        }
+    }
+    cachedHookShell = undefined;
+    return undefined;
+}
 const HOOK_PATHS = PROJECT_LOOKUP_DIRS.map(d => `${d}/hooks.json`);
 export function loadHooks(cwd = process.cwd()) {
     for (const relPath of HOOK_PATHS) {
@@ -29,26 +61,130 @@ function matchesHook(hook, toolName) {
         return true;
     if (!toolName)
         return false;
-    if (hook.match === toolName)
+    const patterns = hook.match.split('|').map(p => p.trim()).filter(Boolean);
+    return patterns.some(pattern => matchPattern(pattern, toolName));
+}
+function matchPattern(pattern, value) {
+    if (pattern === value)
         return true;
-    if (hook.match.endsWith('*')) {
-        return toolName.startsWith(hook.match.slice(0, -1));
+    if (pattern === '*')
+        return true;
+    if (pattern.endsWith('*') && !pattern.startsWith('/')) {
+        return value.startsWith(pattern.slice(0, -1));
+    }
+    if (pattern.startsWith('*') && !pattern.endsWith('*')) {
+        return value.endsWith(pattern.slice(1));
+    }
+    if (pattern.startsWith('/') && pattern.endsWith('/')) {
+        try {
+            return new RegExp(pattern.slice(1, -1)).test(value);
+        }
+        catch {
+            return false;
+        }
+    }
+    if (pattern.includes('*')) {
+        const regex = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
+        try {
+            return new RegExp(`^${regex}$`).test(value);
+        }
+        catch {
+            return false;
+        }
     }
     return false;
 }
-export async function executeHook(hook, env) {
+function buildHookInput(event, context) {
+    const input = {
+        event,
+        timestamp: new Date().toISOString(),
+    };
+    if (context.toolName)
+        input.tool_name = context.toolName;
+    if (context.toolArgs) {
+        try {
+            input.tool_args = JSON.parse(context.toolArgs);
+        }
+        catch {
+            input.tool_args = context.toolArgs;
+        }
+    }
+    if (context.toolResult !== undefined)
+        input.tool_result = context.toolResult;
+    if (context.error)
+        input.error = context.error;
+    if (context.prompt)
+        input.prompt = context.prompt.slice(0, 4096);
+    if (context.response)
+        input.response = context.response.slice(0, 4096);
+    if (context.notification)
+        input.notification = context.notification;
+    return JSON.stringify(input);
+}
+function parseHookOutput(stdout, exitCode) {
+    const trimmed = stdout.trim();
+    if (trimmed.startsWith('{')) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            return {
+                allowed: exitCode === 0 || exitCode === undefined,
+                output: parsed.output ?? trimmed,
+                message: parsed.message,
+                data: parsed,
+            };
+        }
+        catch { }
+    }
+    const allowed = exitCode === 0 || exitCode === undefined;
+    return {
+        allowed,
+        output: trimmed || undefined,
+        message: exitCode === 2 ? trimmed : undefined,
+    };
+}
+export async function executeHook(hook, env, stdinData) {
     const timeout = hook.timeout ?? HOOK_DEFAULTS.timeoutMs;
-    const hookEnv = { ...process.env, ...env };
+    // Strip secrets from the inherited environment so hook commands can't read
+    // API keys, tokens, cloud credentials, etc. The SCALIX_* context vars in
+    // `env` are still applied on top.
+    const hookEnv = { ...sanitizeEnvForCommand(process.env), ...env };
     const ac = new AbortController();
     const hardKill = setTimeout(() => ac.abort(), timeout + 5000);
     try {
-        const { stdout, stderr } = await execAsync(hook.command, {
+        const shell = resolveHookShell();
+        const child = exec(hook.command, {
             timeout,
             env: hookEnv,
             maxBuffer: HOOK_DEFAULTS.maxBuffer,
             signal: ac.signal,
+            ...(shell ? { shell } : {}),
         });
-        return { allowed: true, output: (stdout || stderr).trim() || undefined };
+        if (stdinData && child.stdin) {
+            // The hook may exit without reading stdin; swallow the resulting EPIPE.
+            child.stdin.on('error', () => { });
+            child.stdin.write(stdinData);
+            child.stdin.end();
+        }
+        const result = await new Promise((resolve, reject) => {
+            let stdout = '';
+            let stderr = '';
+            child.stdout?.on('data', (d) => { stdout += d; });
+            child.stderr?.on('data', (d) => { stderr += d; });
+            child.on('error', reject);
+            child.on('close', (code, signal) => resolve({
+                stdout,
+                stderr,
+                code: code ?? 0,
+                // A killed child reports code=null + a signal (or child.killed on
+                // Windows). We only ever kill on timeout/abort, so treat it as such —
+                // otherwise `code ?? 0` would misreport the hook as allowed.
+                killed: child.killed || signal !== null,
+            }));
+        });
+        if (result.killed) {
+            return { allowed: false, error: `Hook timed out after ${timeout}ms` };
+        }
+        return parseHookOutput(result.stdout, result.code);
     }
     catch (err) {
         if (err.killed || err.code === 'ETIMEDOUT' || err.name === 'AbortError') {
@@ -65,7 +201,25 @@ export async function executeHook(hook, env) {
     }
 }
 export async function runHooks(hooks, event, context) {
-    const matching = hooks.filter((h) => h.event === event && matchesHook(h, context.toolName));
+    const matching = hooks.filter((h) => {
+        if (h.event !== event)
+            return false;
+        if (!matchesHook(h, context.toolName))
+            return false;
+        if (h.type === 'prompt')
+            return false;
+        if (h.if) {
+            try {
+                const conditionMet = evaluateCondition(h.if, context);
+                if (!conditionMet)
+                    return false;
+            }
+            catch {
+                return false;
+            }
+        }
+        return true;
+    });
     if (matching.length === 0)
         return [];
     const env = {};
@@ -77,10 +231,15 @@ export async function runHooks(hooks, event, context) {
         env.SCALIX_ERROR = context.error;
     if (context.prompt)
         env.SCALIX_PROMPT = context.prompt.slice(0, 4096).replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '');
+    if (context.response)
+        env.SCALIX_RESPONSE = context.response.slice(0, 4096);
+    if (context.notification)
+        env.SCALIX_NOTIFICATION = context.notification;
     env.SCALIX_EVENT = event;
+    const stdinData = buildHookInput(event, context);
     const results = [];
     for (const hook of matching) {
-        const result = await executeHook(hook, env);
+        const result = await executeHook(hook, env, stdinData);
         results.push(result);
         logger.debug('Hook executed', { event, command: hook.command, allowed: result.allowed });
         if (!result.allowed && event === 'PreToolUse')
@@ -88,13 +247,36 @@ export async function runHooks(hooks, event, context) {
     }
     return results;
 }
+function evaluateCondition(condition, context) {
+    if (condition.startsWith('tool_name=')) {
+        const expected = condition.slice('tool_name='.length);
+        return matchPattern(expected, context.toolName || '');
+    }
+    if (condition.startsWith('tool_args~')) {
+        const pattern = condition.slice('tool_args~'.length);
+        try {
+            return new RegExp(pattern).test(context.toolArgs || '');
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+export function getPromptHooks(hooks, event, toolName) {
+    return hooks.filter(h => h.event === event &&
+        h.type === 'prompt' &&
+        matchesHook(h, toolName));
+}
 export function hooksSummary(hooks) {
     if (hooks.length === 0)
         return 'No hooks configured.';
     const lines = ['Configured hooks:'];
     for (const h of hooks) {
         const match = h.match ? ` (match: ${h.match})` : '';
-        lines.push(`  ${h.event}${match}: ${h.command}`);
+        const type = h.type === 'prompt' ? ' [prompt]' : '';
+        const cond = h.if ? ` [if: ${h.if}]` : '';
+        lines.push(`  ${h.event}${match}${type}${cond}: ${h.command}`);
     }
     return lines.join('\n');
 }

package/dist/injection-detector.js

@@ -38,7 +38,24 @@ const SENSITIVITY_THRESHOLDS = {
     medium: { highConfidence: 3, mediumConfidence: 2 },
     high: { highConfidence: 2, mediumConfidence: 1 },
 };
-export function detectPromptInjection(content, source, sensitivity = 'medium', customPatterns) {
+// Strip zero-width and other invisible/formatting characters that are used to
+// smuggle instructions past pattern matching (zero-width space/joiner, BOM,
+// word joiner, bidi controls, soft hyphen, etc.).
+const INVISIBLE_CHARS_RE = new RegExp('[' +
+    '\\u00AD' + // soft hyphen
+    '\\u200B-\\u200F' + // zero-width space/non-joiner/joiner, LRM/RLM
+    '\\u202A-\\u202E' + // bidi embedding/override controls
+    '\\u2060-\\u2064' + // word joiner, invisible operators
+    '\\u206A-\\u206F' + // deprecated format controls
+    '\\uFEFF' + // BOM / zero-width no-break space
+    ']', 'g');
+function normalizeForDetection(text) {
+    // NFKC folds homoglyph/compatibility variants (e.g. fullwidth chars) to their
+    // canonical forms so evasions collapse onto the same patterns.
+    return text.normalize('NFKC').replace(INVISIBLE_CHARS_RE, '');
+}
+export function detectPromptInjection(rawContent, source, sensitivity = 'medium', customPatterns) {
+    const content = normalizeForDetection(rawContent);
     const matched = [];
     let totalWeight = 0;
     for (const rule of ALL_PATTERNS) {

package/dist/ipc-server.js

@@ -21,6 +21,7 @@ import { browserTools, closeBrowser } from './tools-browser.js';
 import { loadMcpServices } from './mcp.js';
 import { loadConfig, DEFAULT_LIMITS } from './settings.js';
 import { discoverPlugins, getPluginTools } from './plugins.js';
+import { isWorkspaceTrusted } from './workspace-trust.js';
 import { DEFAULT_MODELS, DEFAULT_INSTRUCTIONS, ENV_API_KEY, ENV_MODEL, ENV_BASE_URL, fetchModelSpecs } from './constants.js';
 import { loadMemory, autoDetectConventions, saveMemory } from './project-memory.js';
 import { buildProjectContext, contextToInstructions } from './context-builder.js';
@@ -68,7 +69,12 @@ export async function runIpcServer() {
     const baseUrl = process.env[ENV_BASE_URL] || config.baseUrl;
     fetchModelSpecs(baseUrl, apiKey).catch(() => { });
     const mcpTools = loadMcpServices();
-    const plugins = await discoverPlugins(process.cwd());
+    // Only discover/load project-local plugins in a trusted workspace — plugins
+    // dynamically import and execute code from the project directory.
+    const plugins = isWorkspaceTrusted() ? await discoverPlugins(process.cwd()) : [];
+    if (!isWorkspaceTrusted()) {
+        process.stderr.write('IPC: project plugins skipped (untrusted workspace)\n');
+    }
     const pluginTools = getPluginTools(plugins);
     const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools, ...pluginTools];
     const instructions = await buildInstructions();

package/dist/keychain.js

@@ -0,0 +1,222 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { USER_CONFIG_DIR } from './constants.js';
+const exec = promisify(execFile);
+const SERVICE = 'scalix-coder';
+const ACCOUNT = 'api-key';
+/**
+ * SCALIX_NO_KEYCHAIN=1 disables OS keychain integration entirely — the API
+ * key stays in the config file. Intended for CI, headless environments, and
+ * hermetic tests where spawning security/secret-tool/PowerShell is unwanted.
+ */
+function keychainDisabled() {
+    const flag = process.env.SCALIX_NO_KEYCHAIN;
+    return flag === '1' || flag?.toLowerCase() === 'true';
+}
+function isWindows() {
+    return process.platform === 'win32';
+}
+async function isMacOS() {
+    return process.platform === 'darwin';
+}
+// ─── Windows DPAPI (user-scoped) via PowerShell ───
+function windowsCredentialPath() {
+    // Resolve the home directory the same way the rest of the codebase does
+    // (settings/sessions/workspace-trust) so the credential store stays
+    // consistent and honors HOME (set by Git Bash and by tests).
+    return path.join(process.env.HOME || process.env.USERPROFILE || os.homedir() || '.', USER_CONFIG_DIR, 'credential.dat');
+}
+async function runPowerShell(script, stdinData) {
+    const psExe = process.env.SystemRoot
+        ? path.join(process.env.SystemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')
+        : 'powershell.exe';
+    const child = exec(psExe, ['-NoProfile', '-NonInteractive', '-Command', script], {
+        windowsHide: true,
+        maxBuffer: 1024 * 1024,
+    });
+    if (stdinData !== undefined) {
+        const stdin = child.child?.stdin;
+        if (!stdin)
+            throw new Error('PowerShell stdin unavailable');
+        stdin.write(stdinData);
+        stdin.end();
+    }
+    const { stdout } = await child;
+    return stdout;
+}
+async function setApiKeyWindows(apiKey) {
+    try {
+        const credPath = windowsCredentialPath();
+        await fs.mkdir(path.dirname(credPath), { recursive: true });
+        // Read the secret from stdin, encrypt it with user-scoped DPAPI, and print
+        // the encrypted string. Reading from stdin avoids putting the secret on the
+        // command line (where it could be seen in the process table).
+        const script = '$s = [Console]::In.ReadToEnd();' +
+            '$sec = ConvertTo-SecureString -String $s -AsPlainText -Force;' +
+            '[Console]::Out.Write((ConvertFrom-SecureString -SecureString $sec))';
+        const encrypted = (await runPowerShell(script, apiKey)).trim();
+        if (!encrypted)
+            return false;
+        await fs.writeFile(credPath, encrypted, { encoding: 'utf-8', mode: 0o600 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function getApiKeyWindows() {
+    try {
+        const credPath = windowsCredentialPath();
+        const encrypted = (await fs.readFile(credPath, 'utf-8')).trim();
+        if (!encrypted)
+            return null;
+        // Decrypt the DPAPI blob back to plaintext via Marshal. Pass the blob over
+        // stdin to avoid quoting/length issues on the command line.
+        const script = '$enc = [Console]::In.ReadToEnd().Trim();' +
+            '$sec = ConvertTo-SecureString -String $enc;' +
+            '$ptr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($sec);' +
+            'try { [Console]::Out.Write([Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr)) }' +
+            'finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr) }';
+        const plaintext = await runPowerShell(script, encrypted);
+        return plaintext.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function deleteApiKeyWindows() {
+    try {
+        await fs.unlink(windowsCredentialPath());
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function isLinuxWithSecretTool() {
+    if (process.platform !== 'linux')
+        return false;
+    try {
+        await exec('which', ['secret-tool']);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function getApiKeyFromKeychain() {
+    if (keychainDisabled())
+        return null;
+    try {
+        if (isWindows()) {
+            return await getApiKeyWindows();
+        }
+        if (await isMacOS()) {
+            const { stdout } = await exec('security', [
+                'find-generic-password',
+                '-s', SERVICE,
+                '-a', ACCOUNT,
+                '-w',
+            ]);
+            return stdout.trim() || null;
+        }
+        if (await isLinuxWithSecretTool()) {
+            const { stdout } = await exec('secret-tool', [
+                'lookup', 'service', SERVICE, 'account', ACCOUNT,
+            ]);
+            return stdout.trim() || null;
+        }
+    }
+    catch {
+        // keychain item not found or command failed
+    }
+    return null;
+}
+export async function setApiKeyInKeychain(apiKey) {
+    if (keychainDisabled())
+        return false;
+    try {
+        if (isWindows()) {
+            return await setApiKeyWindows(apiKey);
+        }
+        if (await isMacOS()) {
+            // Delete existing entry first (ignore errors if it doesn't exist)
+            try {
+                await exec('security', [
+                    'delete-generic-password',
+                    '-s', SERVICE,
+                    '-a', ACCOUNT,
+                ]);
+            }
+            catch {
+                // entry didn't exist
+            }
+            await exec('security', [
+                'add-generic-password',
+                '-s', SERVICE,
+                '-a', ACCOUNT,
+                '-w', apiKey,
+                '-U',
+            ]);
+            return true;
+        }
+        if (await isLinuxWithSecretTool()) {
+            const child = exec('secret-tool', [
+                'store',
+                '--label', 'Scalix Coder API Key',
+                'service', SERVICE,
+                'account', ACCOUNT,
+            ]);
+            // secret-tool reads the secret from stdin. If stdin isn't available we
+            // cannot deliver the secret — treat that as a failure rather than
+            // silently reporting success (which would lose the key entirely).
+            const stdin = child.child?.stdin;
+            if (!stdin) {
+                return false;
+            }
+            stdin.write(apiKey);
+            stdin.end();
+            await child;
+            return true;
+        }
+    }
+    catch {
+        // keychain operation failed
+    }
+    return false;
+}
+export async function deleteApiKeyFromKeychain() {
+    if (keychainDisabled())
+        return false;
+    try {
+        if (isWindows()) {
+            return await deleteApiKeyWindows();
+        }
+        if (await isMacOS()) {
+            await exec('security', [
+                'delete-generic-password',
+                '-s', SERVICE,
+                '-a', ACCOUNT,
+            ]);
+            return true;
+        }
+        if (await isLinuxWithSecretTool()) {
+            await exec('secret-tool', [
+                'clear', 'service', SERVICE, 'account', ACCOUNT,
+            ]);
+            return true;
+        }
+    }
+    catch {
+        // entry didn't exist or command failed
+    }
+    return false;
+}
+export async function isKeychainAvailable() {
+    if (keychainDisabled())
+        return false;
+    return isWindows() || await isMacOS() || await isLinuxWithSecretTool();
+}

package/dist/markdown.js

@@ -1,13 +1,45 @@
 import chalk from 'chalk';
 import { Marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
+import { createRequire } from 'node:module';
+// This package is ESM ("type":"module"), so the CommonJS `require` global is
+// not defined. Build one bound to this module's URL so cli-highlight loads.
+const require = createRequire(import.meta.url);
+let highlightFn = null;
+let highlightLoaded = false;
+function getHighlighter() {
+    if (highlightLoaded)
+        return highlightFn;
+    highlightLoaded = true;
+    try {
+        // cli-highlight is a dependency — provides 100+ language highlighting
+        const mod = require('cli-highlight');
+        highlightFn = mod.highlight;
+    }
+    catch {
+        highlightFn = null;
+    }
+    return highlightFn;
+}
+function highlightCode(code, language) {
+    const hl = getHighlighter();
+    if (!hl)
+        return chalk.yellow(code);
+    try {
+        return hl(code, { language: language || undefined });
+    }
+    catch {
+        // Unknown language or highlight error — fall back to yellow
+        return chalk.yellow(code);
+    }
+}
 function createMarked(width) {
     const m = new Marked();
     const mt = markedTerminal({
         strong: chalk.bold,
         em: chalk.italic,
         codespan: chalk.cyan,
-        code: chalk.yellow,
+        code: highlightCode,
         heading: chalk.green.bold,
         firstHeading: chalk.magenta.bold,
         hr: chalk.dim,
@@ -25,15 +57,29 @@ function createMarked(width) {
 }
 let cachedWidth = 0;
 let cachedMarked = null;
+// Content-hash render cache to avoid re-rendering identical content
+const renderCache = new Map();
+const MAX_CACHE_SIZE = 128;
 export function renderMarkdown(text, cols) {
     const width = Math.max((cols ?? process.stdout.columns ?? 100) - 6, 40);
+    const cacheKey = `${width}:${text}`;
+    const cached = renderCache.get(cacheKey);
+    if (cached)
+        return cached;
     if (!cachedMarked || width !== cachedWidth) {
         cachedWidth = width;
         cachedMarked = createMarked(width);
     }
     try {
-        const result = cachedMarked.parse(text);
-        return result.replace(/\n{3,}/g, '\n\n').trim();
+        const result = cachedMarked.parse(text).replace(/\n{3,}/g, '\n\n').trim();
+        // Evict oldest entries when cache is full
+        if (renderCache.size >= MAX_CACHE_SIZE) {
+            const firstKey = renderCache.keys().next().value;
+            if (firstKey !== undefined)
+                renderCache.delete(firstKey);
+        }
+        renderCache.set(cacheKey, result);
+        return result;
     }
     catch {
         return text;

package/dist/model-router.js

@@ -19,6 +19,17 @@ export function classifyComplexity(query, toolCallCount = 0, config) {
         return 'complex';
     return 'moderate';
 }
+/**
+ * Complexity-based model selection.
+ *
+ * Intended use: a caller that owns a {@link RouterConfig} (see
+ * `createRouterConfig`/`getRouterStatus`, wired from cli.tsx) can call this per
+ * user turn to pick a cheaper/stronger model for the request. It is
+ * deliberately conservative — it only diverges from the caller's default when
+ * the router config is `enabled` (which `createRouterConfig` defaults to
+ * `false`), so importing/calling it does NOT change default behavior. When
+ * disabled, or with no tiers, it always returns `config.defaultModel`.
+ */
 export function selectModel(query, config, toolCallCount = 0) {
     if (!config.enabled || config.tiers.length === 0) {
         return config.defaultModel;