scalix 1.2.0 → 1.3.2

package/dist/commands.js

@@ -62,6 +62,11 @@ export async function loadCustomCommands(cwd = process.cwd()) {
 }
 function expandFileReferences(text, cwd) {
     return text.replace(/@([\w./-]+\.\w+)/g, (_match, filePath) => {
+        // Reject path traversal so a command file can't pull in files outside the
+        // project via `@../../etc/passwd`.
+        if (filePath.split(/[\\/]/).includes('..')) {
+            return `@${filePath} (path traversal blocked)`;
+        }
         const resolved = path.resolve(cwd, filePath);
         if (!existsSync(resolved))
             return `@${filePath} (file not found)`;
@@ -84,9 +89,18 @@ function expandInlineBash(text) {
         }
     });
 }
+// Apply the same sanitization used for $ARGS to a single argument so positional
+// args ($1..$9) can't smuggle shell metacharacters into a later `!`cmd`` inline
+// bash expansion.
+function sanitizeArg(arg) {
+    return arg
+        .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '')
+        .replace(/\$/g, '\\$')
+        .replace(/`/g, '\\`');
+}
 function expandPositionalArgs(text, args) {
     const parts = args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [];
-    const cleaned = parts.map(p => p.replace(/^["']|["']$/g, ''));
+    const cleaned = parts.map(p => sanitizeArg(p.replace(/^["']|["']$/g, '')));
     let result = text;
     for (let i = 0; i < 9; i++) {
         const placeholder = `$${i + 1}`;
@@ -100,12 +114,15 @@ export function expandCommand(command, args) {
         .replace(/\$/g, '\\$')
         .replace(/`/g, '\\`');
     let prompt = command.template;
+    // Run inline bash (!`cmd`) FIRST, against the raw template only, so that no
+    // user-supplied argument can be substituted into a command line before it is
+    // executed. Any $ / backtick coming from args afterward stays inert text.
+    prompt = expandInlineBash(prompt);
     prompt = expandPositionalArgs(prompt, args);
     prompt = prompt.replace(/\$ARGS/g, safeArgs);
     prompt = prompt.replace(/\$CWD/g, process.cwd());
     prompt = prompt.replace(/\$DATE/g, new Date().toISOString().split('T')[0]);
     prompt = expandFileReferences(prompt, process.cwd());
-    prompt = expandInlineBash(prompt);
     return prompt;
 }
 export function commandsSummary(commands) {

package/dist/constants.js

@@ -1,4 +1,4 @@
-export const VERSION = '1.1.0';
+export const VERSION = '1.3.0';
 export const PRODUCT_NAME = 'Scalix-Coder';
 export const USER_AGENT = `${PRODUCT_NAME}/${VERSION}`;
 export const DEFAULT_BASE_URL = process.env.SCALIX_BASE_URL || 'https://api.scalix.world/v1';
@@ -38,7 +38,7 @@ export const DEFAULT_INSTRUCTIONS = `You are an expert coding assistant. You wri
 
 ## Scalix Platform
 When helping users build AI applications, agents, or LLM-powered features:
-- Use the Scalix SDK (\`@scalix-world/sdk\` for TypeScript, \`scalix\` for Python) — not raw OpenAI/Anthropic/Google SDKs.
+- Use the Scalix SDK (\`@scalix-world/sdk\` for TypeScript, \`scalix-sdk\` for Python) — not raw OpenAI/Anthropic/Google SDKs.
 - Default to Scalix API (api.scalix.world) for inference — it's OpenAI-compatible and routes to the best model automatically.
 - For deployment, suggest \`scalix hosting\` before Vercel, Railway, or Fly.
 - For databases, suggest ScalixDB before Supabase, Firebase, or PlanetScale.
@@ -272,8 +272,11 @@ export const TOKEN_ESTIMATION = {
 export const PRIVATE_NETWORK_HOSTNAMES = new Set([
     'localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0',
     '::ffff:127.0.0.1', '[::ffff:127.0.0.1]',
+    '::', '[::]', '0:0:0:0:0:0:0:1', '[0:0:0:0:0:0:0:1]',
+    // common cloud metadata endpoints (also covered by 169.254/CIDR, listed for clarity)
+    'metadata.google.internal', 'metadata',
 ]);
-export const PRIVATE_NETWORK_SUFFIXES = ['.local', '.internal'];
+export const PRIVATE_NETWORK_SUFFIXES = ['.local', '.internal', '.localhost'];
 export const PRIVATE_NETWORK_CIDRS = [
     /^10\./,
     /^172\.(1[6-9]|2\d|3[01])\./,
@@ -292,6 +295,78 @@ export function setNetworkSecurityOverrides(overrides) {
         allowedHosts: overrides.allowedHosts ? new Set(overrides.allowedHosts.map(h => h.toLowerCase())) : undefined,
     };
 }
+/**
+ * Canonicalize a host string to a comparable IPv4 dotted-quad when it is a
+ * numeric address written in a non-standard form (decimal, hex, octal, or
+ * with fewer than 4 parts). Returns null when the input is not a bare IPv4-ish
+ * number. This closes SSRF bypasses like http://2130706433/ (=127.0.0.1),
+ * http://0x7f.1/ or http://127.1/.
+ */
+export function canonicalizeIpv4(host) {
+    const h = host.trim().replace(/^\[|\]$/g, '');
+    if (!/^[0-9a-fx.]+$/i.test(h))
+        return null;
+    const parts = h.split('.');
+    if (parts.length === 0 || parts.length > 4)
+        return null;
+    const nums = [];
+    for (const p of parts) {
+        if (p === '')
+            return null;
+        let n;
+        if (/^0x[0-9a-f]+$/i.test(p))
+            n = parseInt(p, 16);
+        else if (/^0[0-7]+$/.test(p))
+            n = parseInt(p, 8);
+        else if (/^[0-9]+$/.test(p))
+            n = parseInt(p, 10);
+        else
+            return null;
+        if (!Number.isFinite(n) || n < 0)
+            return null;
+        nums.push(n);
+    }
+    // Fold the trailing part as a "rest" value per inet_aton semantics.
+    let value;
+    if (nums.length === 1) {
+        value = nums[0];
+    }
+    else {
+        const last = nums[nums.length - 1];
+        const head = nums.slice(0, -1);
+        if (head.some(n => n > 255))
+            return null;
+        const restMax = Math.pow(256, 4 - head.length);
+        if (last >= restMax)
+            return null;
+        value = last;
+        for (let i = 0; i < head.length; i++) {
+            value += head[i] * Math.pow(256, 3 - i);
+        }
+    }
+    if (value < 0 || value > 0xffffffff)
+        return null;
+    return [
+        (value >>> 24) & 0xff,
+        (value >>> 16) & 0xff,
+        (value >>> 8) & 0xff,
+        value & 0xff,
+    ].join('.');
+}
+/**
+ * Check whether a concrete IP address (already resolved, or a literal) points
+ * at a private/loopback/link-local/metadata range. Use this after DNS
+ * resolution to defeat DNS-rebinding and numeric-encoding SSRF.
+ */
+export function isPrivateIp(ip) {
+    const canon = canonicalizeIpv4(ip);
+    const candidate = (canon ?? ip).toLowerCase();
+    if (PRIVATE_NETWORK_HOSTNAMES.has(candidate))
+        return true;
+    if (PRIVATE_NETWORK_CIDRS.some(re => re.test(candidate)))
+        return true;
+    return false;
+}
 export function isPrivateHost(hostname) {
     const lower = hostname.toLowerCase();
     if (_networkOverrides.allowAll)
@@ -300,6 +375,12 @@ export function isPrivateHost(hostname) {
         return false;
     if (_networkOverrides.blockedHosts?.has(lower))
         return true;
+    // Normalize numeric IPv4 encodings (decimal/hex/octal/short forms) so that
+    // e.g. 2130706433, 0x7f000001 and 127.1 are all recognized as loopback.
+    const canonical = canonicalizeIpv4(lower);
+    if (canonical && (PRIVATE_NETWORK_HOSTNAMES.has(canonical) || PRIVATE_NETWORK_CIDRS.some(re => re.test(canonical)))) {
+        return true;
+    }
     if (PRIVATE_NETWORK_HOSTNAMES.has(lower))
         return true;
     if (PRIVATE_NETWORK_SUFFIXES.some(s => lower.endsWith(s)))

package/dist/context-retriever.js

@@ -70,7 +70,7 @@ function scoreFiles(analysis, index) {
         deps.add(imp.to);
         importGraph.set(imp.from, deps);
     }
-    const recentFiles = new Set(index.files
+    const recentFiles = new Set([...index.files]
         .sort((a, b) => b.modifiedAt - a.modifiedAt)
         .slice(0, 20)
         .map((f) => f.relativePath));

package/dist/cost-tracker.js

@@ -1,6 +1,7 @@
 export class CostTracker {
     entries = [];
     sessionStart = Date.now();
+    restoredRequestCount = 0;
     record(model, usage) {
         this.entries.push({
             model,
@@ -24,7 +25,10 @@ export class CostTracker {
         return this.entries.reduce((s, e) => s + e.completionTokens, 0);
     }
     get requestCount() {
-        return this.entries.length;
+        // The single restored aggregate entry stands in for the previous session's
+        // request count, tracked separately so we don't over-count live requests.
+        const liveEntries = this.entries.filter((e) => e.model !== '(previous session)').length;
+        return liveEntries + this.restoredRequestCount;
     }
     get sessionDuration() {
         const s = Math.floor((Date.now() - this.sessionStart) / 1000);
@@ -57,25 +61,26 @@ export class CostTracker {
     }
     reset() {
         this.entries = [];
+        this.restoredRequestCount = 0;
         this.sessionStart = Date.now();
     }
     restore(state) {
         this.entries = [];
-        if (state.requestCount > 0 && state.totalTokens >= 0) {
-            const count = Math.max(1, state.requestCount);
-            const perReqTokens = Math.floor(state.totalTokens / count);
-            const remainder = state.totalTokens - perReqTokens * count;
-            const perReqCost = state.totalCost / count;
-            for (let i = 0; i < count; i++) {
-                this.entries.push({
-                    model: '(previous session)',
-                    promptTokens: 0,
-                    completionTokens: 0,
-                    totalTokens: perReqTokens + (i === 0 ? remainder : 0),
-                    cost: perReqCost,
-                    timestamp: Date.now(),
-                });
-            }
+        // Store a single aggregate entry rather than fabricating `requestCount`
+        // synthetic entries — a corrupted/huge count would otherwise allocate
+        // unboundedly. The original request count is preserved separately.
+        this.restoredRequestCount = Number.isFinite(state.requestCount) && state.requestCount > 0
+            ? Math.floor(state.requestCount)
+            : 0;
+        if (this.restoredRequestCount > 0 && state.totalTokens >= 0) {
+            this.entries.push({
+                model: '(previous session)',
+                promptTokens: 0,
+                completionTokens: 0,
+                totalTokens: state.totalTokens,
+                cost: state.totalCost,
+                timestamp: Date.now(),
+            });
         }
     }
     getState() {

package/dist/git-context.js

@@ -18,13 +18,13 @@ async function getBranch(cwd) {
     return (await run('git branch --show-current', cwd)) || (await run('git rev-parse --short HEAD', cwd)) || 'unknown';
 }
 async function getRemoteBranch(cwd) {
-    return run('git rev-parse --abbrev-ref @{upstream} 2>/dev/null', cwd);
+    return run('git rev-parse --abbrev-ref @{upstream}', cwd);
 }
 async function getRemoteUrl(cwd) {
-    return run('git remote get-url origin 2>/dev/null', cwd);
+    return run('git remote get-url origin', cwd);
 }
 async function getAheadBehind(cwd) {
-    const result = await run('git rev-list --left-right --count @{upstream}...HEAD 2>/dev/null', cwd);
+    const result = await run('git rev-list --left-right --count @{upstream}...HEAD', cwd);
     if (!result)
         return { ahead: 0, behind: 0 };
     const parts = result.split('\t');
@@ -33,7 +33,7 @@ async function getAheadBehind(cwd) {
     return { ahead: Number(parts[1]) || 0, behind: Number(parts[0]) || 0 };
 }
 async function getStashCount(cwd) {
-    const result = await run('git stash list 2>/dev/null', cwd);
+    const result = await run('git stash list', cwd);
     return result ? result.split('\n').filter(Boolean).length : 0;
 }
 async function getStatus(cwd) {
@@ -74,7 +74,10 @@ async function getStatus(cwd) {
 async function getRecentCommits(cwd, count = GIT_CONTEXT_DEFAULTS.recentCommitsCount) {
     const SEP = '<%>';
     const format = `%H${SEP}%h${SEP}%s${SEP}%an${SEP}%ar`;
-    const result = await run(`git log --pretty=format:"${format}" --shortstat -n ${count} 2>/dev/null`, cwd);
+    // No shell redirects here: `2>/dev/null` breaks under cmd.exe on Windows
+    // (redirects to a literal \dev\null path and fails the whole command).
+    // run() already discards stderr and swallows failures.
+    const result = await run(`git log --pretty=format:"${format}" --shortstat -n ${count}`, cwd);
     if (!result)
         return [];
     const commits = [];

package/dist/grounding-checker.js

@@ -20,7 +20,14 @@ function surroundingContext(text, pos, radius = 60) {
     const end = Math.min(text.length, pos + radius);
     return text.slice(start, end).replace(/\n/g, ' ').trim();
 }
-export function extractCodeClaims(text) {
+// Blank out fenced code blocks (```...```) with equal-length whitespace so the
+// model's own newly-authored symbols aren't flagged as ungrounded, while
+// keeping character offsets stable for surroundingContext().
+function maskFencedCodeBlocks(text) {
+    return text.replace(/```[\s\S]*?(?:```|$)/g, (block) => block.replace(/[^\n]/g, ' '));
+}
+export function extractCodeClaims(rawText) {
+    const text = maskFencedCodeBlocks(rawText);
     const seen = new Set();
     const claims = [];
     function add(type, value, position) {

package/dist/headless.js

@@ -1,6 +1,5 @@
 import readline from 'node:readline';
 import fs from 'node:fs/promises';
-import path from 'node:path';
 import { execSync } from 'node:child_process';
 import { createAgent } from './agent.js';
 import { defaultTools } from './tools.js';
@@ -23,6 +22,7 @@ import { loadMemory, autoDetectConventions, saveMemory, memoryToContext, addNote
 import { buildProjectIndex } from './project-index.js';
 import { buildProjectContext, contextToInstructions } from './context-builder.js';
 import { discoverPlugins, getPluginTools, pluginsSummary } from './plugins.js';
+import { isWorkspaceTrusted } from './workspace-trust.js';
 import { loadCustomCommands, expandCommand, commandsSummary } from './commands.js';
 import { hooksSummary } from './hooks.js';
 import { spawnSubAgent, pickCheapestModel } from './sub-agent.js';
@@ -131,7 +131,7 @@ async function buildEnhancedInstructions() {
     const ctx = await buildProjectContext(cwd);
     return contextToInstructions(base, ctx);
 }
-async function runSinglePrompt(prompt, output, format, outputSchemaPath) {
+async function runSinglePrompt(prompt, output, format, outputSchemaPath, beforeExit) {
     const apiKey = process.env[ENV_API_KEY];
     if (!apiKey) {
         console.error('Error: SCALIX_API_KEY is not set.\nSet it via: export SCALIX_API_KEY=sk-...\nOr run the interactive setup: scalix');
@@ -159,7 +159,12 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath) {
         process.exit(1);
     }
     const mcpTools = loadMcpServices();
-    const plugins = await discoverPlugins(process.cwd());
+    // Only discover/load project-local plugins in a trusted workspace — plugins
+    // dynamically import and execute code from the project directory.
+    const plugins = isWorkspaceTrusted() ? await discoverPlugins(process.cwd()) : [];
+    if (!isWorkspaceTrusted()) {
+        process.stderr.write('Project plugins skipped (untrusted workspace).\n');
+    }
     const pluginTools = getPluginTools(plugins);
     const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools, ...pluginTools];
     const instructions = await buildEnhancedInstructions();
@@ -202,16 +207,22 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath) {
         contextRetrieval: true,
     });
     let fullResponse = '';
-    agent.on('stream:end', (text) => { fullResponse = text; });
     agent.on('tool:call', (name) => process.stderr.write(`\x1b[33m▶ ${name}\x1b[0m\n`));
     agent.on('verify:pass', (r) => process.stderr.write(`\x1b[32m✓ ${r.checker} passed\x1b[0m\n`));
     agent.on('verify:fail', (r) => process.stderr.write(`\x1b[31m✗ ${r.checker} failed: ${r.output.split('\n')[0]}\x1b[0m\n`));
     agent.on('error', (err) => process.stderr.write(`\x1b[31mError: ${err.message}\x1b[0m\n`));
+    agent.on('usage', (data) => {
+        costTracker.record(data.model || selectedModel[0], data);
+    });
     try {
-        await agent.send(prompt);
+        // Use the return value (applies JSON extraction for --format json/json-schema)
+        // rather than the raw stream text.
+        fullResponse = await agent.send(prompt);
     }
     catch (err) {
         console.error(`Error: ${err.message}`);
+        if (beforeExit)
+            await beforeExit();
         process.exit(1);
     }
     let formatted;
@@ -245,9 +256,11 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath) {
         process.stdout.write(formatted + '\n');
     }
     await closeBrowser();
+    if (beforeExit)
+        await beforeExit();
     process.exit(0);
 }
-async function runPipeMode() {
+async function runPipeMode(beforeExit) {
     const MAX_PIPE_BYTES = 50 * 1024 * 1024;
     const chunks = [];
     let totalBytes = 0;
@@ -257,6 +270,8 @@ async function runPipeMode() {
             totalBytes += Buffer.byteLength(str);
             if (totalBytes > MAX_PIPE_BYTES) {
                 console.error(`Error: Pipe input exceeds ${MAX_PIPE_BYTES / 1024 / 1024}MB limit.`);
+                if (beforeExit)
+                    await beforeExit();
                 process.exit(1);
             }
             chunks.push(str);
@@ -264,14 +279,18 @@ async function runPipeMode() {
     }
     catch (err) {
         console.error(`Error reading pipe input: ${err.message}`);
+        if (beforeExit)
+            await beforeExit();
         process.exit(1);
     }
     const prompt = chunks.join('').trim();
     if (!prompt) {
         console.error('Error: No input received from stdin.');
+        if (beforeExit)
+            await beforeExit();
         process.exit(1);
     }
-    await runSinglePrompt(prompt);
+    await runSinglePrompt(prompt, undefined, undefined, undefined, beforeExit);
 }
 async function runInteractive() {
     const apiKey = process.env[ENV_API_KEY];
@@ -292,7 +311,12 @@ async function runInteractive() {
         throw new Error('No models configured. Set SCALIX_MODEL env var or run interactive setup.');
     }
     const mcpTools = loadMcpServices();
-    const plugins = await discoverPlugins(process.cwd());
+    // Only discover/load project-local plugins in a trusted workspace — plugins
+    // dynamically import and execute code from the project directory.
+    const plugins = isWorkspaceTrusted() ? await discoverPlugins(process.cwd()) : [];
+    if (!isWorkspaceTrusted()) {
+        process.stderr.write('Project plugins skipped (untrusted workspace).\n');
+    }
     const pluginTools = getPluginTools(plugins);
     const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools, ...pluginTools];
     const instructions = await buildEnhancedInstructions();
@@ -374,20 +398,27 @@ async function runInteractive() {
         console.log(`\x1b[36mPlugins:\x1b[0m ${plugins.map((p) => p.manifest.name).join(', ')}`);
     }
     console.log('');
-    function shutdown() {
+    let shuttingDown = false;
+    async function shutdown() {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
         const msgs = agent.getMessages();
         if (msgs.length > 0) {
-            saveSession(sessionId, msgs, agent.getModels()[0], undefined, costTracker.getState()).catch(() => { });
+            // Await the save so sessions aren't lost on SIGINT (process.exit would
+            // otherwise cut off the fire-and-forget write).
+            await saveSession(sessionId, msgs, agent.getModels()[0], undefined, costTracker.getState()).catch(() => { });
         }
         if (costTracker.totalTokens > 0) {
             console.log(`\n\x1b[36mSession: ${costTracker.totalTokens.toLocaleString()} tokens${costTracker.totalCost > 0 ? ` ($${costTracker.totalCost.toFixed(4)})` : ''}\x1b[0m`);
         }
         console.log('Goodbye!');
         rl.close();
-        closeBrowser().finally(() => process.exit(0));
+        await closeBrowser().catch(() => { });
+        process.exit(0);
     }
-    process.on('SIGINT', shutdown);
-    process.on('SIGTERM', shutdown);
+    process.on('SIGINT', () => { shutdown().catch(() => process.exit(1)); });
+    process.on('SIGTERM', () => { shutdown().catch(() => process.exit(1)); });
     const handleCommand = async (input) => {
         const cmd = input.split(' ')[0].toLowerCase();
         if (cmd === '/help') {
@@ -656,7 +687,7 @@ async function runInteractive() {
             return true;
         }
         if (cmd === '/quit' || cmd === '/exit') {
-            shutdown();
+            await shutdown();
             return true;
         }
         const customCmd = customCmds.find((c) => cmd === `/${c.name}`);
@@ -730,11 +761,15 @@ async function main() {
     }
     // Set up worktree isolation if requested
     let worktreeInfo = null;
+    // Capture the original cwd BEFORE any process.chdir so cleanup can restore it
+    // and resolve the worktree parent correctly.
+    const originalCwd = process.cwd();
+    let cleanup = async () => { };
     if (worktree) {
         const { createWorktree, removeWorktree } = await import('./worktree.js');
         const name = worktreeName || `session-${Date.now().toString(36)}`;
         try {
-            worktreeInfo = await createWorktree(name, process.cwd());
+            worktreeInfo = await createWorktree(name, originalCwd);
             process.chdir(worktreeInfo.path);
             setSandboxRoot(worktreeInfo.path);
             console.log(`Working in isolated worktree: ${worktreeInfo.branch} → ${worktreeInfo.path}`);
@@ -743,38 +778,46 @@ async function main() {
             console.error(`Failed to create worktree: ${err.message}`);
             process.exit(1);
         }
-        const cleanup = async () => {
-            if (worktreeInfo) {
-                try {
-                    const origCwd = process.env.SCALIX_ORIGINAL_CWD || process.cwd();
-                    process.chdir(path.dirname(worktreeInfo.path));
-                    await removeWorktree(worktreeInfo, path.dirname(path.dirname(worktreeInfo.path)));
-                }
-                catch { }
+        let cleanedUp = false;
+        cleanup = async () => {
+            if (cleanedUp || !worktreeInfo)
+                return;
+            cleanedUp = true;
+            try {
+                // Return to the original directory before removing the worktree so we
+                // are not standing inside the directory being deleted.
+                process.chdir(originalCwd);
+                await removeWorktree(worktreeInfo, originalCwd);
             }
+            catch { }
         };
-        process.on('exit', () => { cleanup().catch(() => { }); });
+        // 'exit' handlers cannot run async work — SIGINT awaits cleanup explicitly.
         process.on('SIGINT', () => { cleanup().then(() => process.exit(0)).catch(() => process.exit(1)); });
-        process.env.SCALIX_ORIGINAL_CWD = process.cwd();
     }
-    switch (mode) {
-        case 'run':
-            if (!prompt) {
-                console.error('Error: No prompt provided. Usage: scalix run "your prompt"');
-                process.exit(1);
-            }
-            await runSinglePrompt(prompt, output, format, outputSchema);
-            break;
-        case 'pipe':
-            await runPipeMode();
-            break;
-        case 'ipc':
-            await runIpcServer();
-            break;
-        case 'interactive':
-        default:
-            await runInteractive();
-            break;
+    try {
+        switch (mode) {
+            case 'run':
+                if (!prompt) {
+                    console.error('Error: No prompt provided. Usage: scalix run "your prompt"');
+                    await cleanup();
+                    process.exit(1);
+                }
+                await runSinglePrompt(prompt, output, format, outputSchema, cleanup);
+                break;
+            case 'pipe':
+                await runPipeMode(cleanup);
+                break;
+            case 'ipc':
+                await runIpcServer();
+                break;
+            case 'interactive':
+            default:
+                await runInteractive();
+                break;
+        }
+    }
+    finally {
+        await cleanup();
     }
 }
 main().catch((err) => {

package/dist/hooks.js

@@ -1,10 +1,42 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { resolve, join, basename } from 'node:path';
 import { exec } from 'node:child_process';
-import { promisify } from 'node:util';
 import { logger } from './logger.js';
 import { PROJECT_LOOKUP_DIRS, HOOK_DEFAULTS } from './constants.js';
-const execAsync = promisify(exec);
+import { sanitizeEnvForCommand } from './sandbox.js';
+// Hook commands are written in POSIX sh syntax ($VAR, pipes, etc). On Windows
+// the default exec shell is cmd.exe, which silently mangles them — so resolve
+// a real POSIX shell (Git Bash) when one is available. `null` = not resolved.
+let cachedHookShell = null;
+function isPosixShell(shellPath) {
+    const name = basename(shellPath).toLowerCase().replace(/\.exe$/, '');
+    return name === 'bash' || name === 'sh' || name === 'zsh' || name === 'dash';
+}
+function resolveHookShell() {
+    if (cachedHookShell !== null)
+        return cachedHookShell;
+    if (process.platform !== 'win32') {
+        cachedHookShell = undefined;
+        return undefined;
+    }
+    const candidates = [
+        process.env.SCALIX_HOOK_SHELL,
+        process.env.SHELL,
+        join(process.env.ProgramFiles ?? 'C:\\Program Files', 'Git', 'bin', 'bash.exe'),
+        join(process.env['ProgramFiles(x86)'] ?? 'C:\\Program Files (x86)', 'Git', 'bin', 'bash.exe'),
+        process.env.LOCALAPPDATA ? join(process.env.LOCALAPPDATA, 'Programs', 'Git', 'bin', 'bash.exe') : undefined,
+    ];
+    for (const c of candidates) {
+        // Skip WSL/System32 bash implicitly: only explicit paths are checked, and
+        // non-POSIX shells (e.g. a SHELL pointing at PowerShell) are rejected.
+        if (c && isPosixShell(c) && existsSync(c)) {
+            cachedHookShell = c;
+            return c;
+        }
+    }
+    cachedHookShell = undefined;
+    return undefined;
+}
 const HOOK_PATHS = PROJECT_LOOKUP_DIRS.map(d => `${d}/hooks.json`);
 export function loadHooks(cwd = process.cwd()) {
     for (const relPath of HOOK_PATHS) {
@@ -112,17 +144,24 @@ function parseHookOutput(stdout, exitCode) {
 }
 export async function executeHook(hook, env, stdinData) {
     const timeout = hook.timeout ?? HOOK_DEFAULTS.timeoutMs;
-    const hookEnv = { ...process.env, ...env };
+    // Strip secrets from the inherited environment so hook commands can't read
+    // API keys, tokens, cloud credentials, etc. The SCALIX_* context vars in
+    // `env` are still applied on top.
+    const hookEnv = { ...sanitizeEnvForCommand(process.env), ...env };
     const ac = new AbortController();
     const hardKill = setTimeout(() => ac.abort(), timeout + 5000);
     try {
+        const shell = resolveHookShell();
         const child = exec(hook.command, {
             timeout,
             env: hookEnv,
             maxBuffer: HOOK_DEFAULTS.maxBuffer,
             signal: ac.signal,
+            ...(shell ? { shell } : {}),
         });
         if (stdinData && child.stdin) {
+            // The hook may exit without reading stdin; swallow the resulting EPIPE.
+            child.stdin.on('error', () => { });
             child.stdin.write(stdinData);
             child.stdin.end();
         }
@@ -132,8 +171,19 @@ export async function executeHook(hook, env, stdinData) {
             child.stdout?.on('data', (d) => { stdout += d; });
             child.stderr?.on('data', (d) => { stderr += d; });
             child.on('error', reject);
-            child.on('close', (code) => resolve({ stdout, stderr, code: code ?? 0 }));
+            child.on('close', (code, signal) => resolve({
+                stdout,
+                stderr,
+                code: code ?? 0,
+                // A killed child reports code=null + a signal (or child.killed on
+                // Windows). We only ever kill on timeout/abort, so treat it as such —
+                // otherwise `code ?? 0` would misreport the hook as allowed.
+                killed: child.killed || signal !== null,
+            }));
         });
+        if (result.killed) {
+            return { allowed: false, error: `Hook timed out after ${timeout}ms` };
+        }
         return parseHookOutput(result.stdout, result.code);
     }
     catch (err) {