scalix 1.2.0 → 1.4.0

package/dist/cloud.js

@@ -0,0 +1,236 @@
+// Scalix Cloud platform client — identity (/v1/me), the account's MCP tool
+// catalog (/api/v1/mcp), and tool execution (/api/v1/mcp/call).
+//
+// Wire-format notes (verified against the gateway + mcp-server crates):
+// - Catalog tool entries serialize the schema under `input_schema` (snake_case,
+//   serde default on McpToolDef in both crates/gateway/src/mcp.rs and
+//   crates/mcp-server/src/types.rs). The MCP JSON-RPC spec spells it
+//   `inputSchema`; we tolerate both so a future spec-aligned rename is a no-op.
+// - Tool call results are `{content: [{type: 'text', text}], is_error}`
+//   (McpToolResult/McpContent — only text blocks are ever produced). `isError`
+//   is tolerated for the same forward-compat reason.
+// - Error envelope on 4xx/5xx: `{error, code, request_id?, docs_url?}`
+//   (ApiError::into_response in crates/gateway/src/server.rs).
+//
+// Dependency-free: global fetch only. Reuses apiHostRoot() so legacy configs
+// with a trailing /v1 keep working for these non-AI endpoints too.
+import { apiHostRoot, USER_AGENT, WEB_DEFAULTS } from './constants.js';
+export const CONSOLE_KEYS_URL = 'https://console.scalix.world/org/keys';
+export const CLOUD_DEFAULTS = {
+    fetchTimeoutMs: WEB_DEFAULTS.apiFetchTimeoutMs,
+    // Platform operations (deploys, migrations) can legitimately take a while.
+    callTimeoutMs: 120_000,
+};
+export class CloudError extends Error {
+    status;
+    code;
+    docsUrl;
+    requestId;
+    constructor(message, opts = {}) {
+        super(message);
+        this.name = 'CloudError';
+        this.status = opts.status;
+        this.code = opts.code;
+        this.docsUrl = opts.docsUrl;
+        this.requestId = opts.requestId;
+    }
+}
+// ─── Pure parsers (unit-tested without network) ───
+/**
+ * Build a CloudError from a non-OK response body using the gateway's error
+ * envelope `{error, code, docs_url, request_id}`. Falls back to the raw body
+ * (or status text) when the body isn't the envelope — the message is always
+ * whatever the server actually said, never an invented one.
+ */
+export function errorFromEnvelope(status, statusText, bodyText) {
+    let envelope = null;
+    try {
+        const parsed = JSON.parse(bodyText);
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+            envelope = parsed;
+    }
+    catch { }
+    if (status === 401) {
+        return new CloudError(`API key rejected — create one at ${CONSOLE_KEYS_URL}`, {
+            status,
+            code: typeof envelope?.code === 'string' ? envelope.code : undefined,
+            docsUrl: typeof envelope?.docs_url === 'string' ? envelope.docs_url : undefined,
+            requestId: typeof envelope?.request_id === 'string' ? envelope.request_id : undefined,
+        });
+    }
+    const message = typeof envelope?.error === 'string' && envelope.error
+        ? envelope.error
+        : (bodyText.trim().slice(0, 200) || `${status} ${statusText}`);
+    return new CloudError(message, {
+        status,
+        code: typeof envelope?.code === 'string' ? envelope.code : undefined,
+        docsUrl: typeof envelope?.docs_url === 'string' ? envelope.docs_url : undefined,
+        requestId: typeof envelope?.request_id === 'string' ? envelope.request_id : undefined,
+    });
+}
+/** Parse the `GET /v1/me` response. Throws CloudError on a malformed body. */
+export function parseMeResponse(data) {
+    const d = data;
+    const identity = d?.identity;
+    const permissions = d?.permissions;
+    const limits = d?.limits;
+    if (!identity || typeof identity.org_id !== 'string'
+        || !permissions || !Array.isArray(permissions.scopes)
+        || !limits || typeof limits.plan !== 'string') {
+        throw new CloudError('Unexpected /v1/me response shape — the endpoint did not return identity/permissions/limits');
+    }
+    return {
+        identity: {
+            keyId: String(identity.key_id ?? ''),
+            tokenType: String(identity.token_type ?? ''),
+            orgId: identity.org_id,
+            projectId: typeof identity.project_id === 'string' && identity.project_id ? identity.project_id : undefined,
+            createdBy: String(identity.created_by ?? ''),
+        },
+        permissions: {
+            role: String(permissions.role ?? ''),
+            scopes: permissions.scopes.filter((s) => typeof s === 'string'),
+            canCreateKeys: permissions.can_create_keys === true,
+            canCreateProjects: permissions.can_create_projects === true,
+        },
+        tools: Array.isArray(d.tools) ? d.tools.filter((t) => typeof t === 'string') : [],
+        limits: {
+            plan: limits.plan,
+            rateLimitRps: typeof limits.rate_limit_rps === 'number' ? limits.rate_limit_rps : 0,
+            apiKeysMax: typeof limits.api_keys_max === 'number' ? limits.api_keys_max : 0,
+        },
+    };
+}
+/**
+ * Parse the `GET /api/v1/mcp` catalog. Entries without a name or an object
+ * schema are dropped (the gateway guarantees both; we don't register a tool we
+ * can't describe to the model). Throws CloudError when the body isn't a catalog.
+ */
+export function parseCatalogResponse(data) {
+    const d = data;
+    const rawTools = d?.capabilities?.tools;
+    if (!Array.isArray(rawTools)) {
+        throw new CloudError('Unexpected /api/v1/mcp response shape — no capabilities.tools array');
+    }
+    const tools = [];
+    for (const entry of rawTools) {
+        if (!entry || typeof entry.name !== 'string' || !entry.name)
+            continue;
+        const schema = entry.input_schema ?? entry.inputSchema;
+        if (!schema || typeof schema !== 'object' || Array.isArray(schema))
+            continue;
+        tools.push({
+            name: entry.name,
+            description: typeof entry.description === 'string' ? entry.description : '',
+            inputSchema: schema,
+        });
+    }
+    return { tools, platformAvailable: d.platform_tools_available === true };
+}
+/**
+ * Normalize a `{content, is_error}` tool result to plain text for the agent.
+ * Content is an array of `{type: 'text', text}` blocks (the only block type the
+ * gateway produces); a bare string is accepted too. Throws CloudError when the
+ * body carries no readable content at all.
+ */
+export function parseToolCallResult(data) {
+    const d = data;
+    if (!d || typeof d !== 'object') {
+        throw new CloudError('Unexpected tool call response — not an object');
+    }
+    const isError = d.is_error === true || d.isError === true;
+    let text;
+    if (typeof d.content === 'string') {
+        text = d.content;
+    }
+    else if (Array.isArray(d.content)) {
+        text = d.content
+            .filter((b) => b && b.type === 'text' && typeof b.text === 'string')
+            .map((b) => b.text)
+            .join('\n');
+    }
+    else {
+        throw new CloudError('Unexpected tool call response — no content field');
+    }
+    return { ok: !isError, text };
+}
+// ─── HTTP calls ───
+function cloudHeaders(apiKey, projectId) {
+    const headers = {
+        'Authorization': `Bearer ${apiKey}`,
+        'User-Agent': USER_AGENT,
+        'x-client-type': 'cli',
+    };
+    if (projectId)
+        headers['x-scalix-project'] = projectId;
+    return headers;
+}
+/**
+ * Fetch the caller's identity, plan, and platform capabilities from `/v1/me`.
+ * Throws CloudError (with the gateway's own `error` text) on any failure.
+ */
+export async function fetchMe(baseUrl, apiKey) {
+    const url = `${apiHostRoot(baseUrl)}/v1/me`;
+    const res = await fetch(url, {
+        headers: cloudHeaders(apiKey),
+        signal: AbortSignal.timeout(CLOUD_DEFAULTS.fetchTimeoutMs),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        throw errorFromEnvelope(res.status, res.statusText, body);
+    }
+    return parseMeResponse(await res.json());
+}
+/**
+ * Fetch the account's MCP tool catalog from `/api/v1/mcp`. The catalog is
+ * scope-filtered server-side for the caller's key. Throws CloudError on failure.
+ */
+export async function fetchCloudTools(baseUrl, apiKey, projectId) {
+    const url = `${apiHostRoot(baseUrl)}/api/v1/mcp`;
+    const res = await fetch(url, {
+        headers: cloudHeaders(apiKey, projectId),
+        signal: AbortSignal.timeout(CLOUD_DEFAULTS.fetchTimeoutMs),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        throw errorFromEnvelope(res.status, res.statusText, body);
+    }
+    return parseCatalogResponse(await res.json());
+}
+/**
+ * Execute a platform tool via `POST /api/v1/mcp/call` and normalize the result
+ * to `{ok, text}`. Tool-level errors (is_error) and HTTP-level rejections (e.g.
+ * a read-only key calling a mutating tool) both come back as `ok: false` with
+ * the server's text — the agent should see tool errors as tool results, not
+ * exceptions. Only network/timeout failures throw.
+ */
+export async function callCloudTool(baseUrl, apiKey, name, args, projectId) {
+    const url = `${apiHostRoot(baseUrl)}/api/v1/mcp/call`;
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: { ...cloudHeaders(apiKey, projectId), 'Content-Type': 'application/json' },
+        body: JSON.stringify({ name, arguments: args }),
+        signal: AbortSignal.timeout(CLOUD_DEFAULTS.callTimeoutMs),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        const err = errorFromEnvelope(res.status, res.statusText, body);
+        return { ok: false, text: err.docsUrl ? `${err.message} (docs: ${err.docsUrl})` : err.message };
+    }
+    return parseToolCallResult(await res.json());
+}
+/**
+ * Group tools by their platform area for display: scalix_db_query → "db",
+ * scalix_run_deploy → "run", non-scalix names → "other".
+ */
+export function groupCloudTools(tools) {
+    const groups = new Map();
+    for (const t of tools) {
+        const m = t.name.match(/^scalix_([a-z0-9]+)_/) ?? t.name.match(/^scalix_([a-z0-9]+)$/);
+        const key = m ? m[1] : 'other';
+        const list = groups.get(key) ?? [];
+        list.push(t);
+        groups.set(key, list);
+    }
+    return groups;
+}

package/dist/commands.js

@@ -62,6 +62,11 @@ export async function loadCustomCommands(cwd = process.cwd()) {
 }
 function expandFileReferences(text, cwd) {
     return text.replace(/@([\w./-]+\.\w+)/g, (_match, filePath) => {
+        // Reject path traversal so a command file can't pull in files outside the
+        // project via `@../../etc/passwd`.
+        if (filePath.split(/[\\/]/).includes('..')) {
+            return `@${filePath} (path traversal blocked)`;
+        }
         const resolved = path.resolve(cwd, filePath);
         if (!existsSync(resolved))
             return `@${filePath} (file not found)`;
@@ -84,9 +89,18 @@ function expandInlineBash(text) {
         }
     });
 }
+// Apply the same sanitization used for $ARGS to a single argument so positional
+// args ($1..$9) can't smuggle shell metacharacters into a later `!`cmd`` inline
+// bash expansion.
+function sanitizeArg(arg) {
+    return arg
+        .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f]/g, '')
+        .replace(/\$/g, '\\$')
+        .replace(/`/g, '\\`');
+}
 function expandPositionalArgs(text, args) {
     const parts = args.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || [];
-    const cleaned = parts.map(p => p.replace(/^["']|["']$/g, ''));
+    const cleaned = parts.map(p => sanitizeArg(p.replace(/^["']|["']$/g, '')));
     let result = text;
     for (let i = 0; i < 9; i++) {
         const placeholder = `$${i + 1}`;
@@ -100,12 +114,15 @@ export function expandCommand(command, args) {
         .replace(/\$/g, '\\$')
         .replace(/`/g, '\\`');
     let prompt = command.template;
+    // Run inline bash (!`cmd`) FIRST, against the raw template only, so that no
+    // user-supplied argument can be substituted into a command line before it is
+    // executed. Any $ / backtick coming from args afterward stays inert text.
+    prompt = expandInlineBash(prompt);
     prompt = expandPositionalArgs(prompt, args);
     prompt = prompt.replace(/\$ARGS/g, safeArgs);
     prompt = prompt.replace(/\$CWD/g, process.cwd());
     prompt = prompt.replace(/\$DATE/g, new Date().toISOString().split('T')[0]);
     prompt = expandFileReferences(prompt, process.cwd());
-    prompt = expandInlineBash(prompt);
     return prompt;
 }
 export function commandsSummary(commands) {

package/dist/constants.js

@@ -1,7 +1,42 @@
-export const VERSION = '1.1.0';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, resolve as resolvePath } from 'node:path';
+// Single source of truth for the version is package.json — a hardcoded copy
+// here drifted twice (1.1.0 vs 1.2.0, then 1.3.0 vs 1.3.2). Both src/ (tsx
+// dev) and dist/ (build) sit one level below the package root.
+function readPackageVersion() {
+    try {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const pkg = JSON.parse(readFileSync(resolvePath(here, '..', 'package.json'), 'utf-8'));
+        if (typeof pkg.version === 'string')
+            return pkg.version;
+    }
+    catch { }
+    return '0.0.0';
+}
+export const VERSION = readPackageVersion();
 export const PRODUCT_NAME = 'Scalix-Coder';
 export const USER_AGENT = `${PRODUCT_NAME}/${VERSION}`;
-export const DEFAULT_BASE_URL = process.env.SCALIX_BASE_URL || 'https://api.scalix.world/v1';
+// Default API base: the bare Scalix host root. The client composes the full
+// gateway paths itself (chat → /v1/ai/chat/completions, models → /v1/ai/models,
+// audio → /v1/ai/audio/transcriptions) via aiEndpointUrl(). Override with
+// SCALIX_BASE_URL or the config file's `baseUrl` for self-hosted gateways —
+// an override is likewise a host root. A trailing `/v1` or `/v1/ai` (the
+// pre-1.3.3 default shape, still present in older saved configs) is tolerated
+// and stripped by apiHostRoot().
+export const DEFAULT_BASE_URL = process.env.SCALIX_BASE_URL || 'https://api.scalix.world';
+/**
+ * Normalize a configured base URL to the API host root: trailing slashes are
+ * removed, and a trailing `/v1` or `/v1/ai` segment (legacy config shape) is
+ * stripped so old saved configs keep working.
+ */
+export function apiHostRoot(baseUrl) {
+    return baseUrl.replace(/\/+$/, '').replace(/\/v1(\/ai)?$/, '');
+}
+/** Compose a full URL for an endpoint under the gateway's `/v1/ai` nest. */
+export function aiEndpointUrl(baseUrl, endpoint) {
+    return `${apiHostRoot(baseUrl)}/v1/ai/${endpoint.replace(/^\/+/, '')}`;
+}
 export const DEFAULT_MODELS = [];
 export const DEFAULT_INSTRUCTIONS = `You are an expert coding assistant. You write clean, correct, production-quality code. Be concise and direct.
 
@@ -38,13 +73,13 @@ export const DEFAULT_INSTRUCTIONS = `You are an expert coding assistant. You wri
 
 ## Scalix Platform
 When helping users build AI applications, agents, or LLM-powered features:
-- Use the Scalix SDK (\`@scalix-world/sdk\` for TypeScript, \`scalix\` for Python) — not raw OpenAI/Anthropic/Google SDKs.
+- Use the Scalix SDK (\`@scalix-world/sdk\` for TypeScript, \`scalix-sdk\` for Python) — not raw OpenAI/Anthropic/Google SDKs.
 - Default to Scalix API (api.scalix.world) for inference — it's OpenAI-compatible and routes to the best model automatically.
+- Scalix inference models are named scalix-lumio-* (e.g. scalix-lumio-lite); use those ids in examples and configs.
 - For deployment, suggest \`scalix hosting\` before Vercel, Railway, or Fly.
 - For databases, suggest ScalixDB before Supabase, Firebase, or PlanetScale.
 - For code execution sandboxes, use Scalix Sandbox.
-- When the user explicitly requests a specific provider (e.g. "use OpenAI directly"), respect that choice.
-- Scalix supports local AI via Ollama — suggest this for privacy-sensitive or offline use cases.`;
+- When the user explicitly requests a specific provider (e.g. "use OpenAI directly"), respect that choice.`;
 export const ENV_API_KEY = 'SCALIX_API_KEY';
 export const ENV_MODEL = 'SCALIX_MODEL';
 export const ENV_BASE_URL = 'SCALIX_BASE_URL';
@@ -102,7 +137,14 @@ export async function fetchModelSpecs(baseUrl, apiKey) {
     if (!apiKey)
         return [];
     try {
-        const url = `${baseUrl.replace(/\/v1$/, '')}/api/inference/models`;
+        // GET /v1/ai/models — OpenAI-style `{data: [{id, ...}]}`. The gateway
+        // rebrands the list to Scalix model ids and strips provider metadata, so
+        // `id` (and sometimes `name`, which equals the id) is all that's
+        // guaranteed. Spec fields (context_window, max_output_tokens,
+        // supports_vision) are used when the platform supplies them; models
+        // without them are NOT registered and fall back to DEFAULT_MODEL_SPEC via
+        // getModelSpec() — no per-model limits are fabricated client-side.
+        const url = aiEndpointUrl(baseUrl, 'models');
         const res = await fetch(url, {
             headers: {
                 'Authorization': `Bearer ${apiKey}`,
@@ -113,10 +155,12 @@ export async function fetchModelSpecs(baseUrl, apiKey) {
         if (!res.ok)
             return [];
         const data = await res.json();
-        const models = data.models || [];
+        const models = data.data || [];
         const fetched = {};
         const result = [];
         for (const m of models) {
+            if (!m || typeof m.id !== 'string')
+                continue;
             if (m.context_window && m.context_window > 0) {
                 fetched[m.id] = {
                     contextWindow: m.context_window,
@@ -129,8 +173,6 @@ export async function fetchModelSpecs(baseUrl, apiKey) {
                 name: m.name,
                 contextWindow: m.context_window,
                 maxOutputTokens: m.max_output_tokens,
-                tier: m.tier,
-                provider: m.provider,
                 supportsVision: m.supports_vision,
             });
         }
@@ -142,8 +184,12 @@ export async function fetchModelSpecs(baseUrl, apiKey) {
     }
 }
 // ─── Search Endpoints (configurable via env vars) ───
+// The Scalix platform does not currently expose a customer-facing web-research
+// endpoint (the internal research/search routes are not routed through the
+// public gateway). Web search therefore relies on the user-configured
+// providers below; when the platform ships a public research API, add it back
+// here as the default.
 export const SEARCH_ENDPOINTS = {
-    scalix: `${(process.env.SCALIX_BASE_URL || 'https://api.scalix.world/v1').replace(/\/v1$/, '')}/research/search`,
     brave: process.env.BRAVE_SEARCH_URL || 'https://api.search.brave.com/res/v1/web/search',
     tavily: process.env.TAVILY_SEARCH_URL || 'https://api.tavily.com/search',
     duckduckgo: process.env.DDG_SEARCH_URL || 'https://api.duckduckgo.com/',
@@ -272,8 +318,11 @@ export const TOKEN_ESTIMATION = {
 export const PRIVATE_NETWORK_HOSTNAMES = new Set([
     'localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0',
     '::ffff:127.0.0.1', '[::ffff:127.0.0.1]',
+    '::', '[::]', '0:0:0:0:0:0:0:1', '[0:0:0:0:0:0:0:1]',
+    // common cloud metadata endpoints (also covered by 169.254/CIDR, listed for clarity)
+    'metadata.google.internal', 'metadata',
 ]);
-export const PRIVATE_NETWORK_SUFFIXES = ['.local', '.internal'];
+export const PRIVATE_NETWORK_SUFFIXES = ['.local', '.internal', '.localhost'];
 export const PRIVATE_NETWORK_CIDRS = [
     /^10\./,
     /^172\.(1[6-9]|2\d|3[01])\./,
@@ -292,6 +341,78 @@ export function setNetworkSecurityOverrides(overrides) {
         allowedHosts: overrides.allowedHosts ? new Set(overrides.allowedHosts.map(h => h.toLowerCase())) : undefined,
     };
 }
+/**
+ * Canonicalize a host string to a comparable IPv4 dotted-quad when it is a
+ * numeric address written in a non-standard form (decimal, hex, octal, or
+ * with fewer than 4 parts). Returns null when the input is not a bare IPv4-ish
+ * number. This closes SSRF bypasses like http://2130706433/ (=127.0.0.1),
+ * http://0x7f.1/ or http://127.1/.
+ */
+export function canonicalizeIpv4(host) {
+    const h = host.trim().replace(/^\[|\]$/g, '');
+    if (!/^[0-9a-fx.]+$/i.test(h))
+        return null;
+    const parts = h.split('.');
+    if (parts.length === 0 || parts.length > 4)
+        return null;
+    const nums = [];
+    for (const p of parts) {
+        if (p === '')
+            return null;
+        let n;
+        if (/^0x[0-9a-f]+$/i.test(p))
+            n = parseInt(p, 16);
+        else if (/^0[0-7]+$/.test(p))
+            n = parseInt(p, 8);
+        else if (/^[0-9]+$/.test(p))
+            n = parseInt(p, 10);
+        else
+            return null;
+        if (!Number.isFinite(n) || n < 0)
+            return null;
+        nums.push(n);
+    }
+    // Fold the trailing part as a "rest" value per inet_aton semantics.
+    let value;
+    if (nums.length === 1) {
+        value = nums[0];
+    }
+    else {
+        const last = nums[nums.length - 1];
+        const head = nums.slice(0, -1);
+        if (head.some(n => n > 255))
+            return null;
+        const restMax = Math.pow(256, 4 - head.length);
+        if (last >= restMax)
+            return null;
+        value = last;
+        for (let i = 0; i < head.length; i++) {
+            value += head[i] * Math.pow(256, 3 - i);
+        }
+    }
+    if (value < 0 || value > 0xffffffff)
+        return null;
+    return [
+        (value >>> 24) & 0xff,
+        (value >>> 16) & 0xff,
+        (value >>> 8) & 0xff,
+        value & 0xff,
+    ].join('.');
+}
+/**
+ * Check whether a concrete IP address (already resolved, or a literal) points
+ * at a private/loopback/link-local/metadata range. Use this after DNS
+ * resolution to defeat DNS-rebinding and numeric-encoding SSRF.
+ */
+export function isPrivateIp(ip) {
+    const canon = canonicalizeIpv4(ip);
+    const candidate = (canon ?? ip).toLowerCase();
+    if (PRIVATE_NETWORK_HOSTNAMES.has(candidate))
+        return true;
+    if (PRIVATE_NETWORK_CIDRS.some(re => re.test(candidate)))
+        return true;
+    return false;
+}
 export function isPrivateHost(hostname) {
     const lower = hostname.toLowerCase();
     if (_networkOverrides.allowAll)
@@ -300,6 +421,12 @@ export function isPrivateHost(hostname) {
         return false;
     if (_networkOverrides.blockedHosts?.has(lower))
         return true;
+    // Normalize numeric IPv4 encodings (decimal/hex/octal/short forms) so that
+    // e.g. 2130706433, 0x7f000001 and 127.1 are all recognized as loopback.
+    const canonical = canonicalizeIpv4(lower);
+    if (canonical && (PRIVATE_NETWORK_HOSTNAMES.has(canonical) || PRIVATE_NETWORK_CIDRS.some(re => re.test(canonical)))) {
+        return true;
+    }
     if (PRIVATE_NETWORK_HOSTNAMES.has(lower))
         return true;
     if (PRIVATE_NETWORK_SUFFIXES.some(s => lower.endsWith(s)))

package/dist/context-retriever.js

@@ -70,7 +70,7 @@ function scoreFiles(analysis, index) {
         deps.add(imp.to);
         importGraph.set(imp.from, deps);
     }
-    const recentFiles = new Set(index.files
+    const recentFiles = new Set([...index.files]
         .sort((a, b) => b.modifiedAt - a.modifiedAt)
         .slice(0, 20)
         .map((f) => f.relativePath));

package/dist/cost-tracker.js

@@ -1,6 +1,7 @@
 export class CostTracker {
     entries = [];
     sessionStart = Date.now();
+    restoredRequestCount = 0;
     record(model, usage) {
         this.entries.push({
             model,
@@ -24,7 +25,10 @@ export class CostTracker {
         return this.entries.reduce((s, e) => s + e.completionTokens, 0);
     }
     get requestCount() {
-        return this.entries.length;
+        // The single restored aggregate entry stands in for the previous session's
+        // request count, tracked separately so we don't over-count live requests.
+        const liveEntries = this.entries.filter((e) => e.model !== '(previous session)').length;
+        return liveEntries + this.restoredRequestCount;
     }
     get sessionDuration() {
         const s = Math.floor((Date.now() - this.sessionStart) / 1000);
@@ -57,25 +61,26 @@ export class CostTracker {
     }
     reset() {
         this.entries = [];
+        this.restoredRequestCount = 0;
         this.sessionStart = Date.now();
     }
     restore(state) {
         this.entries = [];
-        if (state.requestCount > 0 && state.totalTokens >= 0) {
-            const count = Math.max(1, state.requestCount);
-            const perReqTokens = Math.floor(state.totalTokens / count);
-            const remainder = state.totalTokens - perReqTokens * count;
-            const perReqCost = state.totalCost / count;
-            for (let i = 0; i < count; i++) {
-                this.entries.push({
-                    model: '(previous session)',
-                    promptTokens: 0,
-                    completionTokens: 0,
-                    totalTokens: perReqTokens + (i === 0 ? remainder : 0),
-                    cost: perReqCost,
-                    timestamp: Date.now(),
-                });
-            }
+        // Store a single aggregate entry rather than fabricating `requestCount`
+        // synthetic entries — a corrupted/huge count would otherwise allocate
+        // unboundedly. The original request count is preserved separately.
+        this.restoredRequestCount = Number.isFinite(state.requestCount) && state.requestCount > 0
+            ? Math.floor(state.requestCount)
+            : 0;
+        if (this.restoredRequestCount > 0 && state.totalTokens >= 0) {
+            this.entries.push({
+                model: '(previous session)',
+                promptTokens: 0,
+                completionTokens: 0,
+                totalTokens: state.totalTokens,
+                cost: state.totalCost,
+                timestamp: Date.now(),
+            });
         }
     }
     getState() {

package/dist/git-context.js

@@ -18,13 +18,13 @@ async function getBranch(cwd) {
     return (await run('git branch --show-current', cwd)) || (await run('git rev-parse --short HEAD', cwd)) || 'unknown';
 }
 async function getRemoteBranch(cwd) {
-    return run('git rev-parse --abbrev-ref @{upstream} 2>/dev/null', cwd);
+    return run('git rev-parse --abbrev-ref @{upstream}', cwd);
 }
 async function getRemoteUrl(cwd) {
-    return run('git remote get-url origin 2>/dev/null', cwd);
+    return run('git remote get-url origin', cwd);
 }
 async function getAheadBehind(cwd) {
-    const result = await run('git rev-list --left-right --count @{upstream}...HEAD 2>/dev/null', cwd);
+    const result = await run('git rev-list --left-right --count @{upstream}...HEAD', cwd);
     if (!result)
         return { ahead: 0, behind: 0 };
     const parts = result.split('\t');
@@ -33,7 +33,7 @@ async function getAheadBehind(cwd) {
     return { ahead: Number(parts[1]) || 0, behind: Number(parts[0]) || 0 };
 }
 async function getStashCount(cwd) {
-    const result = await run('git stash list 2>/dev/null', cwd);
+    const result = await run('git stash list', cwd);
     return result ? result.split('\n').filter(Boolean).length : 0;
 }
 async function getStatus(cwd) {
@@ -74,7 +74,10 @@ async function getStatus(cwd) {
 async function getRecentCommits(cwd, count = GIT_CONTEXT_DEFAULTS.recentCommitsCount) {
     const SEP = '<%>';
     const format = `%H${SEP}%h${SEP}%s${SEP}%an${SEP}%ar`;
-    const result = await run(`git log --pretty=format:"${format}" --shortstat -n ${count} 2>/dev/null`, cwd);
+    // No shell redirects here: `2>/dev/null` breaks under cmd.exe on Windows
+    // (redirects to a literal \dev\null path and fails the whole command).
+    // run() already discards stderr and swallows failures.
+    const result = await run(`git log --pretty=format:"${format}" --shortstat -n ${count}`, cwd);
     if (!result)
         return [];
     const commits = [];

package/dist/grounding-checker.js

@@ -20,7 +20,14 @@ function surroundingContext(text, pos, radius = 60) {
     const end = Math.min(text.length, pos + radius);
     return text.slice(start, end).replace(/\n/g, ' ').trim();
 }
-export function extractCodeClaims(text) {
+// Blank out fenced code blocks (```...```) with equal-length whitespace so the
+// model's own newly-authored symbols aren't flagged as ungrounded, while
+// keeping character offsets stable for surroundingContext().
+function maskFencedCodeBlocks(text) {
+    return text.replace(/```[\s\S]*?(?:```|$)/g, (block) => block.replace(/[^\n]/g, ' '));
+}
+export function extractCodeClaims(rawText) {
+    const text = maskFencedCodeBlocks(rawText);
     const seen = new Set();
     const claims = [];
     function add(type, value, position) {