scalix 1.2.0 → 1.3.2

package/dist/cli.js

@@ -1,11 +1,12 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useState, useEffect, useCallback, useRef, useMemo, memo } from 'react';
-import { render, Box, Text, useInput, useApp, useStdout } from 'ink';
+import { render, Box, Text, useInput, useApp } from 'ink';
 import Spinner from 'ink-spinner';
 import TextInput from 'ink-text-input';
 import Gradient from 'ink-gradient';
 import BigText from 'ink-big-text';
-import { execSync, execFileSync } from 'node:child_process';
+import { execSync, execFileSync, execFile, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
 import os from 'node:os';
 import fs from 'node:fs/promises';
 import { existsSync, readFileSync } from 'node:fs';
@@ -42,7 +43,42 @@ import { loadSkills, skillsSummary, getSkillByTrigger, getSkillContent } from '.
 import { AgentRegistry } from './agent-registry.js';
 import { createWorktree, listWorktrees, removeWorktree, cleanupStaleWorktrees } from './worktree.js';
 import { sendNotification, getTerminalType } from './terminal-notify.js';
+import { stringWidth, truncateText } from './text-utils.js';
+import { isWorkspaceTrusted, trustWorkspace, hasProjectExecSurface } from './workspace-trust.js';
 logger.setLevel('silent');
+// Promisified async child_process helpers (keep the TUI responsive vs execSync).
+const execFileAsync = promisify(execFile);
+// Run a shell command asynchronously, resolving with stdout/stderr like execSync's
+// error shape (so callers can read err.stdout / err.stderr). Never blocks the event loop.
+function runShellAsync(command, opts = {}) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, {
+            shell: true,
+            cwd: opts.cwd ?? process.cwd(),
+            timeout: opts.timeout,
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout?.on('data', (d) => { stdout += d.toString(); });
+        child.stderr?.on('data', (d) => { stderr += d.toString(); });
+        child.on('error', (err) => { err.stdout = stdout; err.stderr = stderr; reject(err); });
+        child.on('close', (code) => {
+            if (code === 0)
+                resolve({ stdout, stderr });
+            else {
+                const err = new Error(`Command failed: ${command}`);
+                err.code = code;
+                err.stdout = stdout;
+                err.stderr = stderr;
+                reject(err);
+            }
+        });
+        if (opts.input !== undefined) {
+            child.stdin?.write(opts.input);
+            child.stdin?.end();
+        }
+    });
+}
 setSandboxRoot(process.cwd());
 // Suppress noisy React 19 development-mode reconciler warnings that leak to stderr
 const _origConsoleError = console.error;
@@ -51,28 +87,42 @@ console.error = (...args) => {
         return;
     _origConsoleError(...args);
 };
-// Disable bracketed paste mode — terminals (via zsh) may leave it enabled,
-// which wraps pasted text in escape sequences that corrupt TextInput values.
-process.stdout.write('\x1b[?2004l');
+// Enable bracketed paste mode so multi-line pastes arrive as a single chunk
+// wrapped in \x1b[200~ … \x1b[201~ markers. We strip those markers (see
+// sanitizeInput) and buffer the pasted content into the input value instead of
+// treating each embedded newline as a separate Enter (which caused many submits).
+process.stdout.write('\x1b[?2004h');
 const mcpTools = loadMcpServices();
 let pluginTools = [];
 const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools];
 // ─── Confirmation bridge (event-driven) ───
 import { EventEmitter } from 'node:events';
 const confirmEmitter = new EventEmitter();
-let pendingConfirm = null;
+// FIFO queue of pending confirmations. Using a queue (instead of a single slot)
+// ensures a second concurrent confirm can't overwrite/hang the first — each
+// resolves in order and the next one is surfaced to the UI when the prior clears.
+const confirmQueue = [];
+// Resolve every queued confirmation (as denied) — used on abort / clear so no
+// tool call is left hanging waiting for a decision that will never come.
+function drainConfirmQueue(value = false) {
+    while (confirmQueue.length > 0) {
+        confirmQueue.shift().resolve(value);
+    }
+}
 const alwaysAllowedTools = new Set();
 const recentDenials = [];
 const confirmToolCall = async (toolName, args) => {
+    // Evaluate scoped permissions BEFORE consulting the session "Always allow" set,
+    // so a scoped `deny` still blocks even after the user pressed "Always".
+    const scoped = checkScopedPermission(toolName, args);
+    if (scoped === 'deny')
+        return false;
     if (alwaysAllowedTools.has(toolName))
         return true;
-    const scoped = checkScopedPermission(toolName, args);
     if (scoped === 'allow')
         return true;
-    if (scoped === 'deny')
-        return false;
     return new Promise((resolve) => {
-        pendingConfirm = { resolve, toolName, args };
+        confirmQueue.push({ resolve, toolName, args });
         confirmEmitter.emit('pending');
     });
 };
@@ -85,6 +135,26 @@ let loadedPlugins = [];
 let projectMemory = null;
 let customCommands = [];
 let loadedSkills = [];
+// Set during initAgent when the workspace is untrusted but has project-local
+// exec surface (plugins/hooks/rules/settings) that we skipped loading. The App
+// reads this on mount to inform the user they can run /trust to enable them.
+let workspaceUntrustedNotice = false;
+// Discover and register project-local plugin tools for the given agent.
+// Gated on workspace trust; reused by initAgent and the /trust command.
+function discoverPluginsForAgent(targetAgent) {
+    loadedPlugins = [];
+    if (!isWorkspaceTrusted(process.cwd()))
+        return Promise.resolve();
+    return discoverPlugins(process.cwd()).then((plugins) => {
+        loadedPlugins = plugins;
+        const pTools = getPluginTools(plugins);
+        pluginTools = pTools;
+        for (const pt of pTools)
+            targetAgent.addTool(pt);
+    }).catch((err) => {
+        logger.warn('Plugin discovery failed', { error: err.message });
+    });
+}
 async function buildEnhancedInstructions() {
     let instructions = baseInstructions;
     const cwd = process.cwd();
@@ -114,13 +184,17 @@ async function buildEnhancedInstructions() {
         instructions += '\n\n' + indexToContext(projectIndex);
     }
     catch { }
-    try {
-        const rules = await loadScopedRules(cwd);
-        const rulesCtx = rulesToContext(rules);
-        if (rulesCtx)
-            instructions += '\n\n' + rulesCtx;
+    // Scoped rules are project-local content injected into the model context —
+    // only load them from a trusted workspace.
+    if (isWorkspaceTrusted(cwd)) {
+        try {
+            const rules = await loadScopedRules(cwd);
+            const rulesCtx = rulesToContext(rules);
+            if (rulesCtx)
+                instructions += '\n\n' + rulesCtx;
+        }
+        catch { }
     }
-    catch { }
     return instructions;
 }
 function initAgent(config) {
@@ -152,16 +226,11 @@ function initAgent(config) {
         thinkingMode: config.thinkingMode || 'off',
     });
     const currentAgent = agent;
-    loadedPlugins = [];
-    discoverPlugins(process.cwd()).then((plugins) => {
-        loadedPlugins = plugins;
-        const pTools = getPluginTools(plugins);
-        pluginTools = pTools;
-        for (const pt of pTools)
-            currentAgent.addTool(pt);
-    }).catch((err) => {
-        logger.warn('Plugin discovery failed', { error: err.message });
-    });
+    // Project-local plugins/hooks/rules are exec surface — only load from a
+    // trusted workspace. When skipped but present, flag it so the App can nudge
+    // the user toward /trust.
+    workspaceUntrustedNotice = !isWorkspaceTrusted(process.cwd()) && hasProjectExecSurface(process.cwd());
+    discoverPluginsForAgent(currentAgent);
     buildEnhancedInstructions().then((enhanced) => {
         currentAgent.setInstructions(enhanced);
     }).catch((err) => {
@@ -179,22 +248,36 @@ function initAgent(config) {
 function shortModel(m) {
     return m.split('/').pop().replace(/:free$/, '').replace(/-instruct$/, '');
 }
+const termSizeSubscribers = new Set();
+let termSize = {
+    cols: process.stdout?.columns ?? 80,
+    rows: process.stdout?.rows ?? 24,
+};
+let termResizeListenerAttached = false;
+function onTermResize() {
+    const cols = process.stdout?.columns ?? 80;
+    const rows = process.stdout?.rows ?? 24;
+    if (cols === termSize.cols && rows === termSize.rows)
+        return;
+    termSize = { cols, rows };
+    for (const notify of termSizeSubscribers)
+        notify();
+}
+function subscribeTermSize(cb) {
+    termSizeSubscribers.add(cb);
+    if (!termResizeListenerAttached) {
+        process.stdout?.on('resize', onTermResize);
+        termResizeListenerAttached = true;
+    }
+    return () => { termSizeSubscribers.delete(cb); };
+}
 function useTermSize() {
-    const { stdout } = useStdout();
-    const [size, setSize] = useState({ cols: stdout?.columns ?? 80, rows: stdout?.rows ?? 24 });
+    const [size, setSize] = useState(termSize);
     useEffect(() => {
-        const fn = () => {
-            const newCols = stdout?.columns ?? 80;
-            const newRows = stdout?.rows ?? 24;
-            setSize((prev) => {
-                if (prev.cols === newCols && prev.rows === newRows)
-                    return prev;
-                return { cols: newCols, rows: newRows };
-            });
-        };
-        stdout?.on('resize', fn);
-        return () => { stdout?.off('resize', fn); };
-    }, [stdout]);
+        // Sync any change that happened between initial render and subscribe.
+        setSize(termSize);
+        return subscribeTermSize(() => setSize(termSize));
+    }, []);
     return size;
 }
 function elapsed(start) {
@@ -219,17 +302,27 @@ function formatTokens(n) {
 const Banner = memo(function Banner() {
     return (_jsx(Box, { flexDirection: "column", alignItems: "center", marginBottom: 0, children: _jsx(Gradient, { name: "teen", children: _jsx(BigText, { text: PRODUCT_NAME.toLowerCase(), font: "tiny" }) }) }));
 });
-// Strip bracketed paste markers and control chars that leak through ink's parser
+// Strip bracketed paste markers and control chars that leak through ink's parser.
+// Keeps newlines (\x0a) and tabs (\x09) so pasted multi-line content is preserved
+// and buffered into the input value rather than being submitted line-by-line.
 function sanitizeInput(v) {
-    return v.replace(/\[20[01]~/g, '').replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '');
+    return v
+        // Full bracketed-paste markers (ESC [ 200~ / 201~) and the leftover form
+        // after ink strips the ESC byte ([200~ / [201~).
+        .replace(/\x1b?\[20[01]~/g, '')
+        // Strip control chars but preserve \t (\x09) and \n (\x0a).
+        .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '');
 }
 async function tryPasteImage() {
     const platform = os.platform();
     const tmpFile = path.join(os.tmpdir(), `scalix-paste-${Date.now()}.png`);
+    // Quote the temp path so directories with spaces (e.g. "C:\Users\First Last")
+    // don't break the shell commands below.
+    const q = `"${tmpFile}"`;
     try {
         if (platform === 'darwin') {
             try {
-                execSync(`pngpaste ${tmpFile}`, { stdio: 'pipe', timeout: 3000 });
+                execSync(`pngpaste ${q}`, { stdio: 'pipe', timeout: 3000 });
             }
             catch {
                 const hasImage = execSync(`osascript -e 'clipboard info' 2>/dev/null | grep -q 'TIFF\\|PNG\\|JPEG' && echo yes || echo no`, { encoding: 'utf-8', timeout: 3000 }).trim();
@@ -238,8 +331,15 @@ async function tryPasteImage() {
                 execSync(`osascript -e 'set imgData to (the clipboard as «class PNGf»)' -e 'set fp to open for access POSIX file "${tmpFile}" with write permission' -e 'write imgData to fp' -e 'close access fp'`, { stdio: 'pipe', timeout: 5000 });
             }
         }
+        else if (platform === 'win32') {
+            // Save the clipboard image via PowerShell. Get-Clipboard -Format Image
+            // returns a System.Drawing.Bitmap; Save() writes PNG to the temp path.
+            const psScript = `$img = Get-Clipboard -Format Image; ` +
+                `if ($img -ne $null) { $img.Save('${tmpFile.replace(/'/g, "''")}'); }`;
+            execFileSync('powershell', ['-NoProfile', '-NonInteractive', '-Command', psScript], { stdio: 'pipe', timeout: 5000 });
+        }
         else {
-            execSync(`xclip -selection clipboard -t image/png -o > ${tmpFile}`, { stdio: 'pipe', timeout: 3000 });
+            execSync(`xclip -selection clipboard -t image/png -o > ${q}`, { stdio: 'pipe', timeout: 3000 });
         }
         const { readFileSync, unlinkSync } = await import('node:fs');
         const data = readFileSync(tmpFile);
@@ -458,7 +558,20 @@ const StatusBar = memo(function StatusBar({ status, model, toolCount, thinkStart
     const modeColor = mode === 'yolo' ? 'red' : mode === 'auto' ? 'yellow' : mode === 'plan' ? 'blue' : 'green';
     const statusIcon = status === 'thinking' ? '\u25D4' : status === 'error' ? '\u2718' : '\u25CF';
     const statusColor = status === 'thinking' ? 'yellow' : status === 'error' ? 'red' : 'green';
-    const activeAgents = AgentRegistry.getInstance().listActive().length;
+    // Subscribe to registry changes so this memoized component re-renders when
+    // agents spawn/complete, instead of reading a stale count during render only.
+    const [activeAgents, setActiveAgents] = useState(() => AgentRegistry.getInstance().listActive().length);
+    useEffect(() => {
+        const registry = AgentRegistry.getInstance();
+        const refresh = () => setActiveAgents(registry.listActive().length);
+        refresh();
+        registry.on('agent:spawned', refresh);
+        registry.on('agent:completed', refresh);
+        return () => {
+            registry.off('agent:spawned', refresh);
+            registry.off('agent:completed', refresh);
+        };
+    }, []);
     const leftParts = [];
     leftParts.push(shortModel(model));
     if (tokens > 0)
@@ -610,15 +723,28 @@ function ConfirmPrompt({ toolName, args, onRespond, onScrollUp, onScrollDown })
     const isCommand = toolName === 'run_command';
     const isWrite = toolName === 'write_file' || toolName === 'edit_file' || toolName === 'notebook_edit';
     const isGit = toolName === 'git_commit';
+    // Flatten newlines to a single-line glyph so multi-line values (e.g. write_file
+    // content, edit_file old/new strings) can't shatter the box border.
+    const flatten = (s) => s.replace(/\r?\n/g, '\u23CE');
     const highlight = parsed.command ?? parsed.filePath ?? parsed.file_path ?? parsed.notebook_path ?? parsed.message ?? null;
     const highlightLabel = isCommand ? 'Command' : isGit ? 'Message' : isWrite ? 'File' : 'Args';
-    const highlightStr = highlight ? String(highlight) : null;
-    const extraFields = Object.entries(parsed).filter(([k]) => !['command', 'filePath', 'file_path', 'notebook_path', 'message', 'content'].includes(k));
+    const highlightStr = highlight ? flatten(String(highlight)) : null;
+    // Exclude large multi-line payloads (content + edit old/new strings) from the
+    // extra-field rows \u2014 showing them here just corrupts the box layout.
+    const extraFields = Object.entries(parsed).filter(([k]) => !['command', 'filePath', 'file_path', 'notebook_path', 'message', 'content',
+        'oldString', 'newString', 'old_string', 'new_string'].includes(k));
     const boxWidth = Math.min(cols - 2, 80);
     const border = '\u2500'.repeat(boxWidth - 2);
-    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsxs(Text, { color: "yellow", children: ['\u250C', border, '\u2510'] }), _jsxs(Text, { color: "yellow", children: ['\u2502', " ", _jsxs(Text, { color: "yellow", bold: true, children: ['\u26A0', " Permission Required"] }), _jsx(Text, { children: ' '.repeat(Math.max(0, boxWidth - 24)) }), '\u2502'] }), _jsxs(Text, { color: "yellow", children: ['\u2502', " ", _jsx(Text, { dimColor: true, children: "Tool:" }), " ", _jsx(Text, { color: "cyan", bold: true, children: toolName }), _jsx(Text, { children: ' '.repeat(Math.max(0, boxWidth - 9 - toolName.length)) }), '\u2502'] }), highlightStr && (_jsxs(Text, { color: "yellow", children: ['\u2502', " ", _jsxs(Text, { dimColor: true, children: [highlightLabel, ":"] }), " ", _jsx(Text, { color: "white", bold: true, children: truncate(highlightStr, boxWidth - highlightLabel.length - 6) }), _jsx(Text, { children: ' '.repeat(Math.max(0, boxWidth - highlightLabel.length - 4 - Math.min(highlightStr.length, boxWidth - highlightLabel.length - 6))) }), '\u2502'] })), extraFields.slice(0, 3).map(([k, v]) => {
-                const val = truncate(String(v), boxWidth - k.length - 6);
-                return (_jsxs(Text, { color: "yellow", children: ['\u2502', " ", _jsxs(Text, { dimColor: true, children: [k, ":"] }), " ", _jsx(Text, { children: val }), _jsx(Text, { children: ' '.repeat(Math.max(0, boxWidth - k.length - 4 - val.length)) }), '\u2502'] }, k));
+    // Pad the interior of a box row to (boxWidth - 2) columns using display width
+    // (stringWidth), so wide/CJK chars keep the right border aligned. `used` is the
+    // display width already emitted between the two \u2502 borders.
+    const pad = (used) => ' '.repeat(Math.max(0, boxWidth - 2 - used));
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsxs(Text, { color: "yellow", children: ['\u250C', border, '\u2510'] }), _jsxs(Text, { color: "yellow", children: ['\u2502', " ", _jsxs(Text, { color: "yellow", bold: true, children: ['\u26A0', " Permission Required"] }), _jsx(Text, { children: ' '.repeat(Math.max(0, boxWidth - 24)) }), '\u2502'] }), _jsxs(Text, { color: "yellow", children: ['\u2502', " ", _jsx(Text, { dimColor: true, children: "Tool:" }), " ", _jsx(Text, { color: "cyan", bold: true, children: toolName }), _jsx(Text, { children: pad(7 + stringWidth(toolName)) }), '\u2502'] }), highlightStr && (() => {
+                const shown = truncateText(highlightStr, boxWidth - highlightLabel.length - 6);
+                return (_jsxs(Text, { color: "yellow", children: ['\u2502', " ", _jsxs(Text, { dimColor: true, children: [highlightLabel, ":"] }), " ", _jsx(Text, { color: "white", bold: true, children: shown }), _jsx(Text, { children: pad(highlightLabel.length + 3 + stringWidth(shown)) }), '\u2502'] }));
+            })(), extraFields.slice(0, 3).map(([k, v]) => {
+                const val = truncateText(flatten(String(v)), boxWidth - k.length - 6);
+                return (_jsxs(Text, { color: "yellow", children: ['\u2502', " ", _jsxs(Text, { dimColor: true, children: [k, ":"] }), " ", _jsx(Text, { children: val }), _jsx(Text, { children: pad(k.length + 3 + stringWidth(val)) }), '\u2502'] }, k));
             }), _jsxs(Text, { color: "yellow", children: ['\u251C', border, '\u2524'] }), _jsxs(Text, { color: "yellow", children: ['\u2502', " ", _jsx(Text, { color: "green", bold: true, children: "[Y]" }), _jsx(Text, { children: " Allow  " }), _jsx(Text, { color: "cyan", bold: true, children: "[A]" }), _jsx(Text, { children: " Always  " }), _jsx(Text, { color: "red", bold: true, children: "[N]" }), _jsx(Text, { children: " Deny  " }), _jsx(Text, { dimColor: true, children: "ESC deny" }), _jsx(Text, { children: ' '.repeat(Math.max(0, boxWidth - 42)) }), '\u2502'] }), _jsxs(Text, { color: "yellow", children: ['\u2514', border, '\u2518'] })] }));
 }
 function ModelPicker({ currentModels, onSelect, onCancel }) {
@@ -805,7 +931,7 @@ function SettingsEditor({ onSave, onClose }) {
                     }
                 } })] }));
 }
-const InputSection = memo(function InputSection({ onSubmit, disabled, onAbort, onClear, onScrollUp, onScrollDown, onHeightChange, onToggleToolGroups, onImagePaste }) {
+const InputSection = memo(function InputSection({ onSubmit, disabled, onAbort, onClear, onScrollUp, onScrollDown, onHeightChange, onToggleToolGroups, onImagePaste, onExit }) {
     const { exit } = useApp();
     const { cols } = useTermSize();
     const line = useMemo(() => '\u2500'.repeat(Math.max(cols - 6, 20)), [cols]);
@@ -837,6 +963,9 @@ const InputSection = memo(function InputSection({ onSubmit, disabled, onAbort, o
         setHistoryIndex(-1);
         setValue('');
         valueRef.current = '';
+        // Clear image chips: pending images were consumed by this submit, so the
+        // indicators shouldn't linger and imply they'll attach to the next message.
+        setImageChips([]);
         onSubmit(trimmed);
     }, [onSubmit]);
     useInput((ch, key) => {
@@ -851,16 +980,20 @@ const InputSection = memo(function InputSection({ onSubmit, disabled, onAbort, o
                 onChange('');
                 return;
             }
-            setCtrlCCount((prev) => {
-                if (prev >= 1) {
-                    exit();
-                    return 0;
-                }
+            // Keep the state updater pure — decide whether to exit outside of it,
+            // so StrictMode's double-invoke can't trigger exit() on the first press.
+            if (ctrlCCount >= 1) {
+                if (ctrlCTimer.current)
+                    clearTimeout(ctrlCTimer.current);
+                setCtrlCCount(0);
+                exit();
+            }
+            else {
                 if (ctrlCTimer.current)
                     clearTimeout(ctrlCTimer.current);
                 ctrlCTimer.current = setTimeout(() => setCtrlCCount(0), 3000);
-                return prev + 1;
-            });
+                setCtrlCCount(1);
+            }
             return;
         }
         // ── Ctrl+D: exit when input is empty ──
@@ -1002,13 +1135,34 @@ const InputSection = memo(function InputSection({ onSubmit, disabled, onAbort, o
                 onChange(matches[0]);
             return;
         }
-        // ── Escape: close command picker or exit ──
+        // ── Escape: close picker → clear input → abort task → exit ──
         if (key.escape) {
+            // 1. @-file picker open → close it by removing the trailing @query.
+            const atOpen = !!projectIndex && /@(\S*)$/.test(val);
+            if (atOpen) {
+                onChange(val.replace(/@\S*$/, ''));
+                return;
+            }
+            // 2. Command picker open → close it.
             if (val.startsWith('/') && !val.includes(' ')) {
                 onChange('');
                 return;
             }
-            exit();
+            // 3. Typed input present → clear it (don't lose work by exiting).
+            if (val.length > 0) {
+                onChange('');
+                return;
+            }
+            // 4. A task is running → abort it rather than exit.
+            if (disabled) {
+                onAbort();
+                return;
+            }
+            // 5. Nothing typed and idle → save session and exit (like /exit).
+            if (onExit)
+                onExit();
+            else
+                exit();
             return;
         }
         // ── When command picker is open, handle input manually since TextInput is unfocused ──
@@ -1092,6 +1246,7 @@ const InputSection = memo(function InputSection({ onSubmit, disabled, onAbort, o
         { cmd: '/remember', desc: 'Save a note about this project' },
         { cmd: '/replay', desc: 'Show session timeline' },
         { cmd: '/plugins', desc: 'Show loaded plugins' },
+        { cmd: '/trust', desc: 'Trust this workspace (load project plugins/hooks/rules)' },
         { cmd: '/router', desc: 'Show model routing status' },
         { cmd: '/status', desc: 'Version, model & connection info' },
         { cmd: '/doctor', desc: 'Diagnose installation' },
@@ -1179,10 +1334,11 @@ function estimateLines(item, cols) {
     // Account for paddingLeft=3 + paddingRight=2 used by most message components
     const textWidth = Math.max(cols - 7, 20);
     const lines = item.text.split('\n');
-    // Count wrapped lines per actual line
+    // Count wrapped lines per actual line using display width (wide/CJK chars
+    // occupy two columns), so scrollback estimates don't overflow.
     let totalLines = 0;
     for (const line of lines) {
-        totalLines += Math.max(1, Math.ceil((line.length || 1) / textWidth));
+        totalLines += Math.max(1, Math.ceil((stringWidth(line) || 1) / textWidth));
     }
     switch (item.kind) {
         case 'user': return totalLines + 2; // marginTop=1 + prompt icon row
@@ -1388,9 +1544,13 @@ function App({ config }) {
             }
         };
         const onToolCall = (name, args) => {
+            // A tool running is progress, not a stall — reset the timer so long
+            // builds/tests don't trip the "Stream appears stalled" warning.
+            resetStallTimer();
             add('tool-call', typeof args === 'string' ? args : JSON.stringify(args), name);
         };
         const onToolResult = (name, result) => {
+            resetStallTimer();
             // Extract diff from write_file / edit_file results and show separately
             let parsed = null;
             if (typeof result === 'object' && result !== null) {
@@ -1521,6 +1681,12 @@ function App({ config }) {
             }
         }).catch(() => { });
     }, [add]);
+    // Untrusted-workspace notice: project-local plugins/hooks/rules were skipped.
+    useEffect(() => {
+        if (workspaceUntrustedNotice) {
+            add('system', 'This workspace has project plugins/hooks/rules that were skipped because the workspace is not trusted. Run /trust to load them.');
+        }
+    }, [add]);
     // Idle session nudge: suggest /clear after 75+ minutes of inactivity
     const lastActivityRef = useRef(Date.now());
     const idleNudgedRef = useRef(false);
@@ -1539,19 +1705,28 @@ function App({ config }) {
     useEffect(() => {
         if (!agent)
             return;
+        // Capture the agent for cleanup so .off() detaches from the same instance
+        // even after the agent is re-initialized (e.g. /setup).
+        const currentAgent = agent;
         const onStreamEnd = () => {
-            if (!document.hasFocus?.() || process.env.SCALIX_NOTIFY !== '0') {
+            // `document` doesn't exist in Node (referencing it threw a ReferenceError
+            // on every stream:end). Gate purely on the env var; only consult a focus
+            // check when running somewhere that actually has `document`.
+            const doc = globalThis.document;
+            const hasFocus = doc ? doc.hasFocus?.() : false;
+            if (process.env.SCALIX_NOTIFY !== '0' && !hasFocus) {
                 sendNotification('Scalix', 'Task complete');
             }
         };
-        agent.on('stream:end', onStreamEnd);
-        return () => { agent.off('stream:end', onStreamEnd); };
+        currentAgent.on('stream:end', onStreamEnd);
+        return () => { currentAgent.off('stream:end', onStreamEnd); };
     }, [agentVersion]);
-    // Confirmation bridge (event-driven)
+    // Confirmation bridge (event-driven). Surfaces the head of the FIFO queue.
     useEffect(() => {
         const onPending = () => {
-            if (pendingConfirm && !confirmInfo) {
-                setConfirmInfo({ toolName: pendingConfirm.toolName, args: pendingConfirm.args });
+            if (confirmQueue.length > 0 && !confirmInfo) {
+                const head = confirmQueue[0];
+                setConfirmInfo({ toolName: head.toolName, args: head.args });
             }
         };
         confirmEmitter.on('pending', onPending);
@@ -1563,22 +1738,24 @@ function App({ config }) {
             add('system', banner);
     }, [add]);
     const handleConfirm = useCallback((ok, always) => {
-        if (pendingConfirm) {
+        const current = confirmQueue.shift();
+        if (current) {
             if (ok && always)
-                alwaysAllowedTools.add(pendingConfirm.toolName);
+                alwaysAllowedTools.add(current.toolName);
             if (!ok) {
                 recentDenials.push({
-                    toolName: pendingConfirm.toolName,
-                    args: JSON.stringify(pendingConfirm.args).slice(0, 100),
+                    toolName: current.toolName,
+                    args: JSON.stringify(current.args).slice(0, 100),
                     timestamp: Date.now(),
                 });
                 if (recentDenials.length > 20)
                     recentDenials.shift();
             }
-            pendingConfirm.resolve(ok);
-            pendingConfirm = null;
+            current.resolve(ok);
         }
-        setConfirmInfo(null);
+        // Surface the next queued confirmation, if any.
+        const next = confirmQueue[0];
+        setConfirmInfo(next ? { toolName: next.toolName, args: next.args } : null);
     }, []);
     const handleCommand = useCallback((text) => {
         const cmd = text.split(' ')[0].toLowerCase();
@@ -1635,6 +1812,7 @@ function App({ config }) {
                 '  /mcp <l> <u>  \u2014 add MCP server',
                 '  /plugins      \u2014 show loaded plugins',
                 '  /plugin       \u2014 install/enable/disable/uninstall plugins',
+                '  /trust        \u2014 trust workspace (load project plugins/hooks/rules)',
                 '  /notify       \u2014 test terminal notification',
                 '  /router       \u2014 show model routing status',
                 '  /replay       \u2014 show session timeline',
@@ -1655,10 +1833,7 @@ function App({ config }) {
         }
         if (cmd === '/clear') {
             agent.abort();
-            if (pendingConfirm) {
-                pendingConfirm.resolve(false);
-                pendingConfirm = null;
-            }
+            drainConfirmQueue(false);
             const msgs = agent.getMessages();
             if (msgs.length > 0) {
                 saveSession(sessionId, msgs, models[0] || 'unknown', undefined, costTracker.getState()).then((meta) => {
@@ -1936,6 +2111,27 @@ function App({ config }) {
             add('system', pluginsSummary(loadedPlugins));
             return true;
         }
+        if (cmd === '/trust') {
+            const cwd = process.cwd();
+            if (isWorkspaceTrusted(cwd)) {
+                add('system', 'Workspace is already trusted.');
+                return true;
+            }
+            trustWorkspace(cwd);
+            workspaceUntrustedNotice = false;
+            add('system', `Workspace trusted: ${cwd}`);
+            // Re-run project-local discovery now that the workspace is trusted.
+            discoverPluginsForAgent(agent).then(() => {
+                add('system', `Loaded ${loadedPlugins.length} plugin(s).`);
+            }).catch(() => { });
+            buildEnhancedInstructions().then((enhanced) => {
+                agent.setInstructions(enhanced);
+                add('system', 'Reloaded project rules into context.');
+            }).catch(() => { });
+            loadCustomCommands(cwd).then((cmds) => { customCommands = cmds; }).catch(() => { });
+            loadSkills(cwd).then((skills) => { loadedSkills = skills; }).catch(() => { });
+            return true;
+        }
         if (cmd === '/replay') {
             const replay = agent.getReplay();
             const timeline = replay.getTimeline();
@@ -2188,17 +2384,18 @@ function App({ config }) {
             add('system', 'Generating commit...');
             (async () => {
                 try {
+                    const gitOpts = { timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() };
                     // Check for staged changes
                     let diff = '';
                     try {
-                        diff = execSync('git diff --staged', { encoding: 'utf-8', timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() }).trim();
+                        diff = (await execFileAsync('git', ['diff', '--staged'], gitOpts)).stdout.trim();
                     }
                     catch { }
                     if (!diff) {
                         // Nothing staged — stage tracked files only (safer than -A)
                         try {
-                            execSync('git add -u', { encoding: 'utf-8', timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() });
-                            diff = execSync('git diff --staged', { encoding: 'utf-8', timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() }).trim();
+                            await execFileAsync('git', ['add', '-u'], gitOpts);
+                            diff = (await execFileAsync('git', ['diff', '--staged'], gitOpts)).stdout.trim();
                         }
                         catch (e) {
                             add('error', `Failed to stage files: ${e.message}`);
@@ -2220,7 +2417,7 @@ function App({ config }) {
                     add('system', `Commit message: ${cleanMsg}`);
                     try {
                         const fullMsg = cleanMsg + `\n\nCo-Authored-By: ${GIT_BOT_IDENTITY.name} <${GIT_BOT_IDENTITY.email}>`;
-                        const result = execFileSync('git', ['commit', '-m', fullMsg], { encoding: 'utf-8', timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() }).trim();
+                        const result = (await execFileAsync('git', ['commit', '-m', fullMsg], gitOpts)).stdout.trim();
                         add('system', result);
                     }
                     catch (e) {
@@ -2245,26 +2442,27 @@ function App({ config }) {
             add('system', 'Running code review...');
             (async () => {
                 try {
+                    const gitOpts = { timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() };
                     let diff = '';
                     let baseBranch = 'main';
                     try {
-                        baseBranch = execSync('git symbolic-ref refs/remotes/origin/HEAD', { encoding: 'utf-8', timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() }).trim().replace('refs/remotes/origin/', '');
+                        baseBranch = (await execFileAsync('git', ['symbolic-ref', 'refs/remotes/origin/HEAD'], gitOpts)).stdout.trim().replace('refs/remotes/origin/', '');
                     }
                     catch {
                         try {
-                            const branches = execSync('git branch --list main master', { encoding: 'utf-8', timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() }).trim();
+                            const branches = (await execFileAsync('git', ['branch', '--list', 'main', 'master'], gitOpts)).stdout.trim();
                             if (branches.includes('master'))
                                 baseBranch = 'master';
                         }
                         catch { }
                     }
                     try {
-                        diff = execSync(`git diff ${baseBranch}...HEAD`, { encoding: 'utf-8', timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() }).trim();
+                        diff = (await execFileAsync('git', ['diff', `${baseBranch}...HEAD`], gitOpts)).stdout.trim();
                     }
                     catch { }
                     if (!diff) {
                         try {
-                            diff = execSync('git diff', { encoding: 'utf-8', timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() }).trim();
+                            diff = (await execFileAsync('git', ['diff'], gitOpts)).stdout.trim();
                         }
                         catch { }
                     }
@@ -2300,7 +2498,8 @@ function App({ config }) {
                 const MAX_RETRIES = 5;
                 for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
                     try {
-                        const output = execSync(watchCmd, { encoding: 'utf-8', timeout: TOOL_DEFAULTS.maxCommandTimeoutMs, cwd: process.cwd() }).trim();
+                        const { stdout } = await runShellAsync(watchCmd, { timeout: TOOL_DEFAULTS.maxCommandTimeoutMs, cwd: process.cwd() });
+                        const output = stdout.trim();
                         if (output)
                             add('system', output.length > 2000 ? output.slice(0, 2000) + '\n... (truncated)' : output);
                         add('system', `Watch: command succeeded on attempt ${attempt}.`);
@@ -2351,30 +2550,33 @@ function App({ config }) {
             return true;
         }
         if (cmd === '/diff') {
-            try {
-                let diff = '';
-                try {
-                    diff = execSync('git diff', { encoding: 'utf-8', timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() }).trim();
-                }
-                catch { }
-                let staged = '';
+            (async () => {
                 try {
-                    staged = execSync('git diff --staged', { encoding: 'utf-8', timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() }).trim();
-                }
-                catch { }
-                if (staged)
-                    diff = (diff ? diff + '\n' : '') + '--- Staged changes ---\n' + staged;
-                if (!diff) {
-                    add('system', 'No uncommitted changes.');
+                    const gitOpts = { timeout: TOOL_DEFAULTS.gitTimeoutMs, cwd: process.cwd() };
+                    let diff = '';
+                    try {
+                        diff = (await execFileAsync('git', ['diff'], gitOpts)).stdout.trim();
+                    }
+                    catch { }
+                    let staged = '';
+                    try {
+                        staged = (await execFileAsync('git', ['diff', '--staged'], gitOpts)).stdout.trim();
+                    }
+                    catch { }
+                    if (staged)
+                        diff = (diff ? diff + '\n' : '') + '--- Staged changes ---\n' + staged;
+                    if (!diff) {
+                        add('system', 'No uncommitted changes.');
+                    }
+                    else {
+                        const truncated = diff.length > 5000 ? diff.slice(0, 5000) + '\n... (truncated, full diff is ' + diff.length + ' chars)' : diff;
+                        truncated.split('\n').forEach((l) => add('system', l));
+                    }
                 }
-                else {
-                    const truncated = diff.length > 5000 ? diff.slice(0, 5000) + '\n... (truncated, full diff is ' + diff.length + ' chars)' : diff;
-                    truncated.split('\n').forEach((l) => add('system', l));
+                catch (e) {
+                    add('error', `Failed to get diff: ${e.message}`);
                 }
-            }
-            catch (e) {
-                add('error', `Failed to get diff: ${e.message}`);
-            }
+            })();
             return true;
         }
         if (cmd === '/copy') {
@@ -2602,43 +2804,13 @@ function App({ config }) {
     const multilineRef = useRef([]);
     const messageQueueRef = useRef([]);
     const pendingImagesRef = useRef([]);
-    const handleSubmit = useCallback(async (text) => {
-        const trimmed = text.trim();
-        if (!trimmed)
-            return;
-        // Reset idle nudge on any user activity
-        lastActivityRef.current = Date.now();
-        idleNudgedRef.current = false;
-        // Allow /mode even while the agent is working
-        if (isLoadingRef.current && trimmed.startsWith('/mode')) {
-            handleCommand(trimmed);
-            return;
-        }
-        // Queue messages while agent is working
-        if (isLoadingRef.current) {
-            messageQueueRef.current.push(trimmed);
-            add('system', `Queued (${messageQueueRef.current.length}): ${truncate(trimmed, 60)}`);
-            return;
-        }
-        if (trimmed.endsWith('\\')) {
-            if (multilineRef.current.length >= 50) {
-                add('system', 'Multiline limit reached (50 lines). Sending now.');
-            }
-            else {
-                multilineRef.current.push(trimmed.slice(0, -1));
-                add('system', '... (continue typing, submit without \\ to send)');
-                return;
-            }
-        }
-        let finalText;
-        if (multilineRef.current.length > 0) {
-            multilineRef.current.push(trimmed);
-            finalText = multilineRef.current.join('\n');
-            multilineRef.current = [];
-        }
-        else {
-            finalText = trimmed;
-        }
+    // Process ONE finalized user message through the full input pipeline:
+    // slash-command → `!` shell → skill/correction → send to agent. Shared by the
+    // main submit path and the queue-drain loop so queued /compact, /clear, !ls,
+    // etc. behave identically to freshly typed input. Returns true if the message
+    // was handled inline (command/shell) and did NOT go to the agent.
+    const processFinalizedInput = useCallback(async (rawFinalText) => {
+        let finalText = rawFinalText;
         if (finalText.startsWith('/') && handleCommand(finalText))
             return;
         const triggeredSkill = getSkillByTrigger(loadedSkills, finalText);
@@ -2652,7 +2824,8 @@ function App({ config }) {
                 return;
             add('system', `$ ${shellCmd}`);
             try {
-                let output = execSync(shellCmd, { encoding: 'utf-8', timeout: HEADLESS_DEFAULTS.commandTimeoutMs, cwd: process.cwd() }).trim();
+                const { stdout } = await runShellAsync(shellCmd, { timeout: HEADLESS_DEFAULTS.commandTimeoutMs, cwd: process.cwd() });
+                let output = stdout.trim();
                 if (output) {
                     if (output.length > 2000) {
                         output = output.slice(0, 2000) + `\n... (${(output.length - 2000).toLocaleString()} chars truncated)`;
@@ -2677,7 +2850,6 @@ function App({ config }) {
             add('user', finalText);
         }
         pendingImagesRef.current = [];
-        setIsLoading(true);
         setStatus('thinking');
         setThinkStart(Date.now());
         try {
@@ -2689,30 +2861,73 @@ function App({ config }) {
         catch (e) {
             add('error', e.message || 'Unknown error');
         }
+    }, [add, handleCommand]);
+    const handleSubmit = useCallback(async (text) => {
+        const trimmed = text.trim();
+        if (!trimmed)
+            return;
+        // Reset idle nudge on any user activity
+        lastActivityRef.current = Date.now();
+        idleNudgedRef.current = false;
+        // Allow /mode even while the agent is working
+        if (isLoadingRef.current && trimmed.startsWith('/mode')) {
+            handleCommand(trimmed);
+            return;
+        }
+        // Queue messages while agent is working
+        if (isLoadingRef.current) {
+            messageQueueRef.current.push(trimmed);
+            add('system', `Queued (${messageQueueRef.current.length}): ${truncate(trimmed, 60)}`);
+            return;
+        }
+        if (trimmed.endsWith('\\')) {
+            if (multilineRef.current.length >= 50) {
+                add('system', 'Multiline limit reached (50 lines). Sending now.');
+            }
+            else {
+                multilineRef.current.push(trimmed.slice(0, -1));
+                add('system', '... (continue typing, submit without \\ to send)');
+                return;
+            }
+        }
+        let finalText;
+        if (multilineRef.current.length > 0) {
+            multilineRef.current.push(trimmed);
+            finalText = multilineRef.current.join('\n');
+            multilineRef.current = [];
+        }
+        else {
+            finalText = trimmed;
+        }
+        // Inline commands/shell that never enter the loading state and don't touch
+        // the queue: run them and return without flipping isLoading.
+        if (finalText.startsWith('/') && handleCommand(finalText))
+            return;
+        if (finalText.startsWith('!')) {
+            await processFinalizedInput(finalText);
+            return;
+        }
+        setIsLoading(true);
+        setStatus('thinking');
+        setThinkStart(Date.now());
+        try {
+            await processFinalizedInput(finalText);
+        }
         finally {
-            // Process queued messages sequentially
+            // Process queued messages sequentially through the SAME pipeline, so a
+            // queued /compact, /clear, !ls, etc. behaves like freshly typed input.
             while (messageQueueRef.current.length > 0) {
                 const next = messageQueueRef.current.shift();
                 const remaining = messageQueueRef.current.length;
                 if (remaining > 0)
                     add('system', `${remaining} more queued`);
-                add('user', next);
-                setStatus('thinking');
-                setThinkStart(Date.now());
-                try {
-                    const qResult = await agent.send(next);
-                    if (!qResult || !qResult.trim())
-                        add('system', 'Agent returned no response.');
-                }
-                catch (e) {
-                    add('error', e.message || 'Unknown error');
-                }
+                await processFinalizedInput(next);
             }
             setIsLoading(false);
             setStatus('ready');
             setThinkStart(null);
         }
-    }, [add, handleCommand]);
+    }, [add, handleCommand, processFinalizedInput]);
     const handleSessionSelect = useCallback((session) => {
         setSessionList(null);
         setIsLoading(true);
@@ -2748,10 +2963,7 @@ function App({ config }) {
     }, [add]);
     const handleAbort = useCallback(() => {
         agent.abort();
-        if (pendingConfirm) {
-            pendingConfirm.resolve(false);
-            pendingConfirm = null;
-        }
+        drainConfirmQueue(false);
         setConfirmInfo(null);
         setIsLoading(false);
         setStatus('ready');
@@ -2775,6 +2987,19 @@ function App({ config }) {
         setRateLimitWarn(false);
         sessionId = generateSessionId();
     }, [models]);
+    // Save the session (with the current model) and exit — mirrors /exit so that
+    // Escape on an empty, idle prompt doesn't lose work.
+    const handleExit = useCallback(() => {
+        const msgs = agent?.getMessages() ?? [];
+        if (msgs.length > 0) {
+            saveSession(sessionId, msgs, models[0] || 'unknown', undefined, costTracker.getState())
+                .catch((err) => { logger.warn('Failed to save session on exit', { error: err.message }); })
+                .finally(() => process.exit(0));
+        }
+        else {
+            process.exit(0);
+        }
+    }, [models]);
     const handleSetupDone = useCallback((newConfig) => {
         setShowSetup(false);
         try {
@@ -2800,7 +3025,7 @@ function App({ config }) {
             catch {
                 parsed = {};
             }
-            const extraCount = Math.min(Object.keys(parsed).filter(k => !['command', 'filePath', 'file_path', 'notebook_path', 'message', 'content'].includes(k)).length, 3);
+            const extraCount = Math.min(Object.keys(parsed).filter(k => !['command', 'filePath', 'file_path', 'notebook_path', 'message', 'content', 'oldString', 'newString', 'old_string', 'new_string'].includes(k)).length, 3);
             const hasHighlight = !!(parsed.command ?? parsed.filePath ?? parsed.file_path ?? parsed.notebook_path ?? parsed.message);
             return 5 + (hasHighlight ? 1 : 0) + extraCount;
         }
@@ -2877,7 +3102,7 @@ function App({ config }) {
                         }).catch(() => {
                             add('error', 'Failed to load config.');
                         });
-                    }, onClose: () => setEditingSettings(false) })) : sessionList ? (_jsx(SessionPicker, { sessions: sessionList, onSelect: handleSessionSelect, onCancel: () => setSessionList(null) })) : (_jsx(InputSection, { onSubmit: handleInputSubmit, disabled: isLoading, onAbort: handleAbort, onClear: handleClearScreen, onScrollUp: scrollUp, onScrollDown: scrollDown, onHeightChange: handleInputHeightChange, onToggleToolGroups: toggleToolGroups, onImagePaste: (dataUrl) => { pendingImagesRef.current.push(dataUrl); } })) })] }));
+                    }, onClose: () => setEditingSettings(false) })) : sessionList ? (_jsx(SessionPicker, { sessions: sessionList, onSelect: handleSessionSelect, onCancel: () => setSessionList(null) })) : (_jsx(InputSection, { onSubmit: handleInputSubmit, disabled: isLoading, onAbort: handleAbort, onClear: handleClearScreen, onScrollUp: scrollUp, onScrollDown: scrollDown, onHeightChange: handleInputHeightChange, onToggleToolGroups: toggleToolGroups, onImagePaste: (dataUrl) => { pendingImagesRef.current.push(dataUrl); }, onExit: handleExit })) })] }));
 }
 // ─── Root (config loading + setup gate) ───
 function Root() {