scalix 1.2.0 → 1.4.0

package/dist/headless.js

@@ -1,6 +1,5 @@
 import readline from 'node:readline';
 import fs from 'node:fs/promises';
-import path from 'node:path';
 import { execSync } from 'node:child_process';
 import { createAgent } from './agent.js';
 import { defaultTools } from './tools.js';
@@ -23,6 +22,7 @@ import { loadMemory, autoDetectConventions, saveMemory, memoryToContext, addNote
 import { buildProjectIndex } from './project-index.js';
 import { buildProjectContext, contextToInstructions } from './context-builder.js';
 import { discoverPlugins, getPluginTools, pluginsSummary } from './plugins.js';
+import { isWorkspaceTrusted } from './workspace-trust.js';
 import { loadCustomCommands, expandCommand, commandsSummary } from './commands.js';
 import { hooksSummary } from './hooks.js';
 import { spawnSubAgent, pickCheapestModel } from './sub-agent.js';
@@ -102,6 +102,7 @@ Options:
   --output-format    Alias for --format
   --output-schema    Path to JSON schema file (implies --format json-schema)
   --worktree, -w     Run in an isolated git worktree (optional: --worktree <name>)
+  --version, -v      Print the installed version
   --help, -h         Show this help
 `);
             process.exit(0);
@@ -131,7 +132,7 @@ async function buildEnhancedInstructions() {
     const ctx = await buildProjectContext(cwd);
     return contextToInstructions(base, ctx);
 }
-async function runSinglePrompt(prompt, output, format, outputSchemaPath) {
+async function runSinglePrompt(prompt, output, format, outputSchemaPath, beforeExit) {
     const apiKey = process.env[ENV_API_KEY];
     if (!apiKey) {
         console.error('Error: SCALIX_API_KEY is not set.\nSet it via: export SCALIX_API_KEY=sk-...\nOr run the interactive setup: scalix');
@@ -159,7 +160,12 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath) {
         process.exit(1);
     }
     const mcpTools = loadMcpServices();
-    const plugins = await discoverPlugins(process.cwd());
+    // Only discover/load project-local plugins in a trusted workspace — plugins
+    // dynamically import and execute code from the project directory.
+    const plugins = isWorkspaceTrusted() ? await discoverPlugins(process.cwd()) : [];
+    if (!isWorkspaceTrusted()) {
+        process.stderr.write('Project plugins skipped (untrusted workspace).\n');
+    }
     const pluginTools = getPluginTools(plugins);
     const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools, ...pluginTools];
     const instructions = await buildEnhancedInstructions();
@@ -201,17 +207,29 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath) {
         groundingCheck: true,
         contextRetrieval: true,
     });
+    // Register the account's Scalix Cloud platform tools (one attempt; failure
+    // is stated once and the run continues with local tools only).
+    const cloudStatus = await agent.refreshCloudTools();
+    if (cloudStatus.state === 'unavailable') {
+        process.stderr.write(`\x1b[33m☁ Scalix Cloud unavailable — running with local tools only. ${cloudStatus.error ?? ''}\x1b[0m\n`);
+    }
     let fullResponse = '';
-    agent.on('stream:end', (text) => { fullResponse = text; });
     agent.on('tool:call', (name) => process.stderr.write(`\x1b[33m▶ ${name}\x1b[0m\n`));
     agent.on('verify:pass', (r) => process.stderr.write(`\x1b[32m✓ ${r.checker} passed\x1b[0m\n`));
     agent.on('verify:fail', (r) => process.stderr.write(`\x1b[31m✗ ${r.checker} failed: ${r.output.split('\n')[0]}\x1b[0m\n`));
     agent.on('error', (err) => process.stderr.write(`\x1b[31mError: ${err.message}\x1b[0m\n`));
+    agent.on('usage', (data) => {
+        costTracker.record(data.model || selectedModel[0], data);
+    });
     try {
-        await agent.send(prompt);
+        // Use the return value (applies JSON extraction for --format json/json-schema)
+        // rather than the raw stream text.
+        fullResponse = await agent.send(prompt);
     }
     catch (err) {
         console.error(`Error: ${err.message}`);
+        if (beforeExit)
+            await beforeExit();
         process.exit(1);
     }
     let formatted;
@@ -245,9 +263,11 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath) {
         process.stdout.write(formatted + '\n');
     }
     await closeBrowser();
+    if (beforeExit)
+        await beforeExit();
     process.exit(0);
 }
-async function runPipeMode() {
+async function runPipeMode(beforeExit) {
     const MAX_PIPE_BYTES = 50 * 1024 * 1024;
     const chunks = [];
     let totalBytes = 0;
@@ -257,6 +277,8 @@ async function runPipeMode() {
             totalBytes += Buffer.byteLength(str);
             if (totalBytes > MAX_PIPE_BYTES) {
                 console.error(`Error: Pipe input exceeds ${MAX_PIPE_BYTES / 1024 / 1024}MB limit.`);
+                if (beforeExit)
+                    await beforeExit();
                 process.exit(1);
             }
             chunks.push(str);
@@ -264,14 +286,18 @@ async function runPipeMode() {
     }
     catch (err) {
         console.error(`Error reading pipe input: ${err.message}`);
+        if (beforeExit)
+            await beforeExit();
         process.exit(1);
     }
     const prompt = chunks.join('').trim();
     if (!prompt) {
         console.error('Error: No input received from stdin.');
+        if (beforeExit)
+            await beforeExit();
         process.exit(1);
     }
-    await runSinglePrompt(prompt);
+    await runSinglePrompt(prompt, undefined, undefined, undefined, beforeExit);
 }
 async function runInteractive() {
     const apiKey = process.env[ENV_API_KEY];
@@ -292,7 +318,12 @@ async function runInteractive() {
         throw new Error('No models configured. Set SCALIX_MODEL env var or run interactive setup.');
     }
     const mcpTools = loadMcpServices();
-    const plugins = await discoverPlugins(process.cwd());
+    // Only discover/load project-local plugins in a trusted workspace — plugins
+    // dynamically import and execute code from the project directory.
+    const plugins = isWorkspaceTrusted() ? await discoverPlugins(process.cwd()) : [];
+    if (!isWorkspaceTrusted()) {
+        process.stderr.write('Project plugins skipped (untrusted workspace).\n');
+    }
     const pluginTools = getPluginTools(plugins);
     const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools, ...pluginTools];
     const instructions = await buildEnhancedInstructions();
@@ -367,27 +398,41 @@ async function runInteractive() {
             console.log(`\x1b[33m\u26A0 Context usage: ${info.percentage}% (${info.tokens}/${info.maxTokens} tokens)\x1b[0m`);
         }
     });
-    const toolCount = allTools.length;
+    // Register the account's Scalix Cloud platform tools (one attempt; failure
+    // is stated once and the session continues with local tools only).
+    const cloudStatus = await agent.refreshCloudTools();
+    if (cloudStatus.state === 'unavailable') {
+        console.log(`\x1b[33m☁ Scalix Cloud unavailable — running with local tools only. ${cloudStatus.error ?? ''}\x1b[0m`);
+    }
+    const toolCount = allTools.length + cloudStatus.toolCount;
     const modelDisplay = selectedModel.map(shortModel).join(' | ');
-    console.log(`\x1b[36mAgent ready\x1b[0m (${modelDisplay}) with ${toolCount} tools. Type /help for commands.`);
+    const cloudSuffix = cloudStatus.state === 'connected' ? ` (${cloudStatus.toolCount} from Scalix Cloud)` : '';
+    console.log(`\x1b[36mAgent ready\x1b[0m (${modelDisplay}) with ${toolCount} tools${cloudSuffix}. Type /help for commands.`);
     if (plugins.length > 0) {
         console.log(`\x1b[36mPlugins:\x1b[0m ${plugins.map((p) => p.manifest.name).join(', ')}`);
     }
     console.log('');
-    function shutdown() {
+    let shuttingDown = false;
+    async function shutdown() {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
         const msgs = agent.getMessages();
         if (msgs.length > 0) {
-            saveSession(sessionId, msgs, agent.getModels()[0], undefined, costTracker.getState()).catch(() => { });
+            // Await the save so sessions aren't lost on SIGINT (process.exit would
+            // otherwise cut off the fire-and-forget write).
+            await saveSession(sessionId, msgs, agent.getModels()[0], undefined, costTracker.getState()).catch(() => { });
         }
         if (costTracker.totalTokens > 0) {
             console.log(`\n\x1b[36mSession: ${costTracker.totalTokens.toLocaleString()} tokens${costTracker.totalCost > 0 ? ` ($${costTracker.totalCost.toFixed(4)})` : ''}\x1b[0m`);
         }
         console.log('Goodbye!');
         rl.close();
-        closeBrowser().finally(() => process.exit(0));
+        await closeBrowser().catch(() => { });
+        process.exit(0);
     }
-    process.on('SIGINT', shutdown);
-    process.on('SIGTERM', shutdown);
+    process.on('SIGINT', () => { shutdown().catch(() => process.exit(1)); });
+    process.on('SIGTERM', () => { shutdown().catch(() => process.exit(1)); });
     const handleCommand = async (input) => {
         const cmd = input.split(' ')[0].toLowerCase();
         if (cmd === '/help') {
@@ -656,7 +701,7 @@ async function runInteractive() {
             return true;
         }
         if (cmd === '/quit' || cmd === '/exit') {
-            shutdown();
+            await shutdown();
             return true;
         }
         const customCmd = customCmds.find((c) => cmd === `/${c.name}`);
@@ -730,11 +775,15 @@ async function main() {
     }
     // Set up worktree isolation if requested
     let worktreeInfo = null;
+    // Capture the original cwd BEFORE any process.chdir so cleanup can restore it
+    // and resolve the worktree parent correctly.
+    const originalCwd = process.cwd();
+    let cleanup = async () => { };
     if (worktree) {
         const { createWorktree, removeWorktree } = await import('./worktree.js');
         const name = worktreeName || `session-${Date.now().toString(36)}`;
         try {
-            worktreeInfo = await createWorktree(name, process.cwd());
+            worktreeInfo = await createWorktree(name, originalCwd);
             process.chdir(worktreeInfo.path);
             setSandboxRoot(worktreeInfo.path);
             console.log(`Working in isolated worktree: ${worktreeInfo.branch} → ${worktreeInfo.path}`);
@@ -743,38 +792,46 @@ async function main() {
             console.error(`Failed to create worktree: ${err.message}`);
             process.exit(1);
         }
-        const cleanup = async () => {
-            if (worktreeInfo) {
-                try {
-                    const origCwd = process.env.SCALIX_ORIGINAL_CWD || process.cwd();
-                    process.chdir(path.dirname(worktreeInfo.path));
-                    await removeWorktree(worktreeInfo, path.dirname(path.dirname(worktreeInfo.path)));
-                }
-                catch { }
+        let cleanedUp = false;
+        cleanup = async () => {
+            if (cleanedUp || !worktreeInfo)
+                return;
+            cleanedUp = true;
+            try {
+                // Return to the original directory before removing the worktree so we
+                // are not standing inside the directory being deleted.
+                process.chdir(originalCwd);
+                await removeWorktree(worktreeInfo, originalCwd);
             }
+            catch { }
         };
-        process.on('exit', () => { cleanup().catch(() => { }); });
+        // 'exit' handlers cannot run async work — SIGINT awaits cleanup explicitly.
         process.on('SIGINT', () => { cleanup().then(() => process.exit(0)).catch(() => process.exit(1)); });
-        process.env.SCALIX_ORIGINAL_CWD = process.cwd();
     }
-    switch (mode) {
-        case 'run':
-            if (!prompt) {
-                console.error('Error: No prompt provided. Usage: scalix run "your prompt"');
-                process.exit(1);
-            }
-            await runSinglePrompt(prompt, output, format, outputSchema);
-            break;
-        case 'pipe':
-            await runPipeMode();
-            break;
-        case 'ipc':
-            await runIpcServer();
-            break;
-        case 'interactive':
-        default:
-            await runInteractive();
-            break;
+    try {
+        switch (mode) {
+            case 'run':
+                if (!prompt) {
+                    console.error('Error: No prompt provided. Usage: scalix run "your prompt"');
+                    await cleanup();
+                    process.exit(1);
+                }
+                await runSinglePrompt(prompt, output, format, outputSchema, cleanup);
+                break;
+            case 'pipe':
+                await runPipeMode(cleanup);
+                break;
+            case 'ipc':
+                await runIpcServer();
+                break;
+            case 'interactive':
+            default:
+                await runInteractive();
+                break;
+        }
+    }
+    finally {
+        await cleanup();
     }
 }
 main().catch((err) => {

package/dist/hooks.js

@@ -1,10 +1,42 @@
 import { existsSync, readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { resolve, join, basename } from 'node:path';
 import { exec } from 'node:child_process';
-import { promisify } from 'node:util';
 import { logger } from './logger.js';
 import { PROJECT_LOOKUP_DIRS, HOOK_DEFAULTS } from './constants.js';
-const execAsync = promisify(exec);
+import { sanitizeEnvForCommand } from './sandbox.js';
+// Hook commands are written in POSIX sh syntax ($VAR, pipes, etc). On Windows
+// the default exec shell is cmd.exe, which silently mangles them — so resolve
+// a real POSIX shell (Git Bash) when one is available. `null` = not resolved.
+let cachedHookShell = null;
+function isPosixShell(shellPath) {
+    const name = basename(shellPath).toLowerCase().replace(/\.exe$/, '');
+    return name === 'bash' || name === 'sh' || name === 'zsh' || name === 'dash';
+}
+function resolveHookShell() {
+    if (cachedHookShell !== null)
+        return cachedHookShell;
+    if (process.platform !== 'win32') {
+        cachedHookShell = undefined;
+        return undefined;
+    }
+    const candidates = [
+        process.env.SCALIX_HOOK_SHELL,
+        process.env.SHELL,
+        join(process.env.ProgramFiles ?? 'C:\\Program Files', 'Git', 'bin', 'bash.exe'),
+        join(process.env['ProgramFiles(x86)'] ?? 'C:\\Program Files (x86)', 'Git', 'bin', 'bash.exe'),
+        process.env.LOCALAPPDATA ? join(process.env.LOCALAPPDATA, 'Programs', 'Git', 'bin', 'bash.exe') : undefined,
+    ];
+    for (const c of candidates) {
+        // Skip WSL/System32 bash implicitly: only explicit paths are checked, and
+        // non-POSIX shells (e.g. a SHELL pointing at PowerShell) are rejected.
+        if (c && isPosixShell(c) && existsSync(c)) {
+            cachedHookShell = c;
+            return c;
+        }
+    }
+    cachedHookShell = undefined;
+    return undefined;
+}
 const HOOK_PATHS = PROJECT_LOOKUP_DIRS.map(d => `${d}/hooks.json`);
 export function loadHooks(cwd = process.cwd()) {
     for (const relPath of HOOK_PATHS) {
@@ -112,17 +144,24 @@ function parseHookOutput(stdout, exitCode) {
 }
 export async function executeHook(hook, env, stdinData) {
     const timeout = hook.timeout ?? HOOK_DEFAULTS.timeoutMs;
-    const hookEnv = { ...process.env, ...env };
+    // Strip secrets from the inherited environment so hook commands can't read
+    // API keys, tokens, cloud credentials, etc. The SCALIX_* context vars in
+    // `env` are still applied on top.
+    const hookEnv = { ...sanitizeEnvForCommand(process.env), ...env };
     const ac = new AbortController();
     const hardKill = setTimeout(() => ac.abort(), timeout + 5000);
     try {
+        const shell = resolveHookShell();
         const child = exec(hook.command, {
             timeout,
             env: hookEnv,
             maxBuffer: HOOK_DEFAULTS.maxBuffer,
             signal: ac.signal,
+            ...(shell ? { shell } : {}),
         });
         if (stdinData && child.stdin) {
+            // The hook may exit without reading stdin; swallow the resulting EPIPE.
+            child.stdin.on('error', () => { });
             child.stdin.write(stdinData);
             child.stdin.end();
         }
@@ -132,8 +171,19 @@ export async function executeHook(hook, env, stdinData) {
             child.stdout?.on('data', (d) => { stdout += d; });
             child.stderr?.on('data', (d) => { stderr += d; });
             child.on('error', reject);
-            child.on('close', (code) => resolve({ stdout, stderr, code: code ?? 0 }));
+            child.on('close', (code, signal) => resolve({
+                stdout,
+                stderr,
+                code: code ?? 0,
+                // A killed child reports code=null + a signal (or child.killed on
+                // Windows). We only ever kill on timeout/abort, so treat it as such —
+                // otherwise `code ?? 0` would misreport the hook as allowed.
+                killed: child.killed || signal !== null,
+            }));
         });
+        if (result.killed) {
+            return { allowed: false, error: `Hook timed out after ${timeout}ms` };
+        }
         return parseHookOutput(result.stdout, result.code);
     }
     catch (err) {

package/dist/injection-detector.js

@@ -38,7 +38,24 @@ const SENSITIVITY_THRESHOLDS = {
     medium: { highConfidence: 3, mediumConfidence: 2 },
     high: { highConfidence: 2, mediumConfidence: 1 },
 };
-export function detectPromptInjection(content, source, sensitivity = 'medium', customPatterns) {
+// Strip zero-width and other invisible/formatting characters that are used to
+// smuggle instructions past pattern matching (zero-width space/joiner, BOM,
+// word joiner, bidi controls, soft hyphen, etc.).
+const INVISIBLE_CHARS_RE = new RegExp('[' +
+    '\\u00AD' + // soft hyphen
+    '\\u200B-\\u200F' + // zero-width space/non-joiner/joiner, LRM/RLM
+    '\\u202A-\\u202E' + // bidi embedding/override controls
+    '\\u2060-\\u2064' + // word joiner, invisible operators
+    '\\u206A-\\u206F' + // deprecated format controls
+    '\\uFEFF' + // BOM / zero-width no-break space
+    ']', 'g');
+function normalizeForDetection(text) {
+    // NFKC folds homoglyph/compatibility variants (e.g. fullwidth chars) to their
+    // canonical forms so evasions collapse onto the same patterns.
+    return text.normalize('NFKC').replace(INVISIBLE_CHARS_RE, '');
+}
+export function detectPromptInjection(rawContent, source, sensitivity = 'medium', customPatterns) {
+    const content = normalizeForDetection(rawContent);
     const matched = [];
     let totalWeight = 0;
     for (const rule of ALL_PATTERNS) {

package/dist/ipc-server.js

@@ -21,6 +21,7 @@ import { browserTools, closeBrowser } from './tools-browser.js';
 import { loadMcpServices } from './mcp.js';
 import { loadConfig, DEFAULT_LIMITS } from './settings.js';
 import { discoverPlugins, getPluginTools } from './plugins.js';
+import { isWorkspaceTrusted } from './workspace-trust.js';
 import { DEFAULT_MODELS, DEFAULT_INSTRUCTIONS, ENV_API_KEY, ENV_MODEL, ENV_BASE_URL, fetchModelSpecs } from './constants.js';
 import { loadMemory, autoDetectConventions, saveMemory } from './project-memory.js';
 import { buildProjectContext, contextToInstructions } from './context-builder.js';
@@ -68,7 +69,12 @@ export async function runIpcServer() {
     const baseUrl = process.env[ENV_BASE_URL] || config.baseUrl;
     fetchModelSpecs(baseUrl, apiKey).catch(() => { });
     const mcpTools = loadMcpServices();
-    const plugins = await discoverPlugins(process.cwd());
+    // Only discover/load project-local plugins in a trusted workspace — plugins
+    // dynamically import and execute code from the project directory.
+    const plugins = isWorkspaceTrusted() ? await discoverPlugins(process.cwd()) : [];
+    if (!isWorkspaceTrusted()) {
+        process.stderr.write('IPC: project plugins skipped (untrusted workspace)\n');
+    }
     const pluginTools = getPluginTools(plugins);
     const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools, ...pluginTools];
     const instructions = await buildInstructions();

package/dist/keychain.js

@@ -1,11 +1,101 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { USER_CONFIG_DIR } from './constants.js';
 const exec = promisify(execFile);
 const SERVICE = 'scalix-coder';
 const ACCOUNT = 'api-key';
+/**
+ * SCALIX_NO_KEYCHAIN=1 disables OS keychain integration entirely — the API
+ * key stays in the config file. Intended for CI, headless environments, and
+ * hermetic tests where spawning security/secret-tool/PowerShell is unwanted.
+ */
+function keychainDisabled() {
+    const flag = process.env.SCALIX_NO_KEYCHAIN;
+    return flag === '1' || flag?.toLowerCase() === 'true';
+}
+function isWindows() {
+    return process.platform === 'win32';
+}
 async function isMacOS() {
     return process.platform === 'darwin';
 }
+// ─── Windows DPAPI (user-scoped) via PowerShell ───
+function windowsCredentialPath() {
+    // Resolve the home directory the same way the rest of the codebase does
+    // (settings/sessions/workspace-trust) so the credential store stays
+    // consistent and honors HOME (set by Git Bash and by tests).
+    return path.join(process.env.HOME || process.env.USERPROFILE || os.homedir() || '.', USER_CONFIG_DIR, 'credential.dat');
+}
+async function runPowerShell(script, stdinData) {
+    const psExe = process.env.SystemRoot
+        ? path.join(process.env.SystemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')
+        : 'powershell.exe';
+    const child = exec(psExe, ['-NoProfile', '-NonInteractive', '-Command', script], {
+        windowsHide: true,
+        maxBuffer: 1024 * 1024,
+    });
+    if (stdinData !== undefined) {
+        const stdin = child.child?.stdin;
+        if (!stdin)
+            throw new Error('PowerShell stdin unavailable');
+        stdin.write(stdinData);
+        stdin.end();
+    }
+    const { stdout } = await child;
+    return stdout;
+}
+async function setApiKeyWindows(apiKey) {
+    try {
+        const credPath = windowsCredentialPath();
+        await fs.mkdir(path.dirname(credPath), { recursive: true });
+        // Read the secret from stdin, encrypt it with user-scoped DPAPI, and print
+        // the encrypted string. Reading from stdin avoids putting the secret on the
+        // command line (where it could be seen in the process table).
+        const script = '$s = [Console]::In.ReadToEnd();' +
+            '$sec = ConvertTo-SecureString -String $s -AsPlainText -Force;' +
+            '[Console]::Out.Write((ConvertFrom-SecureString -SecureString $sec))';
+        const encrypted = (await runPowerShell(script, apiKey)).trim();
+        if (!encrypted)
+            return false;
+        await fs.writeFile(credPath, encrypted, { encoding: 'utf-8', mode: 0o600 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function getApiKeyWindows() {
+    try {
+        const credPath = windowsCredentialPath();
+        const encrypted = (await fs.readFile(credPath, 'utf-8')).trim();
+        if (!encrypted)
+            return null;
+        // Decrypt the DPAPI blob back to plaintext via Marshal. Pass the blob over
+        // stdin to avoid quoting/length issues on the command line.
+        const script = '$enc = [Console]::In.ReadToEnd().Trim();' +
+            '$sec = ConvertTo-SecureString -String $enc;' +
+            '$ptr = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($sec);' +
+            'try { [Console]::Out.Write([Runtime.InteropServices.Marshal]::PtrToStringBSTR($ptr)) }' +
+            'finally { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($ptr) }';
+        const plaintext = await runPowerShell(script, encrypted);
+        return plaintext.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function deleteApiKeyWindows() {
+    try {
+        await fs.unlink(windowsCredentialPath());
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 async function isLinuxWithSecretTool() {
     if (process.platform !== 'linux')
         return false;
@@ -18,7 +108,12 @@ async function isLinuxWithSecretTool() {
     }
 }
 export async function getApiKeyFromKeychain() {
+    if (keychainDisabled())
+        return null;
     try {
+        if (isWindows()) {
+            return await getApiKeyWindows();
+        }
         if (await isMacOS()) {
             const { stdout } = await exec('security', [
                 'find-generic-password',
@@ -41,7 +136,12 @@ export async function getApiKeyFromKeychain() {
     return null;
 }
 export async function setApiKeyInKeychain(apiKey) {
+    if (keychainDisabled())
+        return false;
     try {
+        if (isWindows()) {
+            return await setApiKeyWindows(apiKey);
+        }
         if (await isMacOS()) {
             // Delete existing entry first (ignore errors if it doesn't exist)
             try {
@@ -70,9 +170,15 @@ export async function setApiKeyInKeychain(apiKey) {
                 'service', SERVICE,
                 'account', ACCOUNT,
             ]);
-            // secret-tool reads the secret from stdin
-            child.child?.stdin?.write(apiKey);
-            child.child?.stdin?.end();
+            // secret-tool reads the secret from stdin. If stdin isn't available we
+            // cannot deliver the secret — treat that as a failure rather than
+            // silently reporting success (which would lose the key entirely).
+            const stdin = child.child?.stdin;
+            if (!stdin) {
+                return false;
+            }
+            stdin.write(apiKey);
+            stdin.end();
             await child;
             return true;
         }
@@ -83,7 +189,12 @@ export async function setApiKeyInKeychain(apiKey) {
     return false;
 }
 export async function deleteApiKeyFromKeychain() {
+    if (keychainDisabled())
+        return false;
     try {
+        if (isWindows()) {
+            return await deleteApiKeyWindows();
+        }
         if (await isMacOS()) {
             await exec('security', [
                 'delete-generic-password',
@@ -105,5 +216,7 @@ export async function deleteApiKeyFromKeychain() {
     return false;
 }
 export async function isKeychainAvailable() {
-    return await isMacOS() || await isLinuxWithSecretTool();
+    if (keychainDisabled())
+        return false;
+    return isWindows() || await isMacOS() || await isLinuxWithSecretTool();
 }

package/dist/markdown.js

@@ -1,6 +1,10 @@
 import chalk from 'chalk';
 import { Marked } from 'marked';
 import { markedTerminal } from 'marked-terminal';
+import { createRequire } from 'node:module';
+// This package is ESM ("type":"module"), so the CommonJS `require` global is
+// not defined. Build one bound to this module's URL so cli-highlight loads.
+const require = createRequire(import.meta.url);
 let highlightFn = null;
 let highlightLoaded = false;
 function getHighlighter() {
@@ -9,7 +13,6 @@ function getHighlighter() {
     highlightLoaded = true;
     try {
         // cli-highlight is a dependency — provides 100+ language highlighting
-        // eslint-disable-next-line @typescript-eslint/no-require-imports
         const mod = require('cli-highlight');
         highlightFn = mod.highlight;
     }

package/dist/model-router.js

@@ -19,6 +19,17 @@ export function classifyComplexity(query, toolCallCount = 0, config) {
         return 'complex';
     return 'moderate';
 }
+/**
+ * Complexity-based model selection.
+ *
+ * Intended use: a caller that owns a {@link RouterConfig} (see
+ * `createRouterConfig`/`getRouterStatus`, wired from cli.tsx) can call this per
+ * user turn to pick a cheaper/stronger model for the request. It is
+ * deliberately conservative — it only diverges from the caller's default when
+ * the router config is `enabled` (which `createRouterConfig` defaults to
+ * `false`), so importing/calling it does NOT change default behavior. When
+ * disabled, or with no tiers, it always returns `config.defaultModel`.
+ */
 export function selectModel(query, config, toolCallCount = 0) {
     if (!config.enabled || config.tiers.length === 0) {
         return config.defaultModel;