scalix 1.5.0 → 1.5.2

package/.env.example

@@ -1,8 +1,10 @@
 # Required — your Scalix API key
-SCALIX_API_KEY=sk-...
+SCALIX_API_KEY=scalix_sk_...
 
-# Optional — custom API base URL (defaults to Scalix cloud)
-# SCALIX_BASE_URL=https://api.scalix.world/v1
+# Optional — API base URL. This is the host root, NOT the /v1 endpoint: the
+# client appends /v1/ai/... itself. Point it at a self-hosted gateway if you
+# have one; the default is Scalix cloud.
+# SCALIX_BASE_URL=https://api.scalix.world
 
 # Optional — override the default model
 # SCALIX_MODEL=

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to Scalix Coder will be documented in this file.
 
+## [1.5.1] - 2026-08-08
+
+### Added
+- **Scalix Cloud key for BYOK sessions.** The platform tools (deploy, database, storage, …) now run on their own credential pair, independent of inference: `SCALIX_CLOUD_API_KEY` / `SCALIX_CLOUD_BASE_URL` env, a keychain slot and settings row in the VS Code extension, and a wizard step in the CLI. Inference on your own endpoint, deploys still on Scalix — the BYOK key never reaches Scalix and the Scalix key never reaches your endpoint. The IPC engine now registers the cloud tools at startup; the GUI previously had none at all, and models asked to deploy invented SDKs and CLI flags instead.
+- **Guided setup.** Full-page setup panel in the extension (provider presets, key/model/limits, engine and terminal-CLI status with an install button) that auto-opens on first run and lands in chat after save; `/setup` slash command in both surfaces.
+- **The agent knows what is at its disposal.** While a cloud connection is live, every request carries a section listing the registered `scalix_*` tool groups and the platform's ~30s per-call execution ceiling, steering long operations to the async pairs (`scalix_build_create` → poll `scalix_build_status`) instead of one blocking call that the transport would kill.
+- **Scope-aware tool catalog.** The catalog is filtered client-side by the API key's scope families, so the model only sees tools its key can plausibly call; `/cloud status` reports "N of M available to this key" and says when the key's own project binding overrides a configured project id (the platform ignores the header for API keys — the key wins).
+- **Key-shape guidance.** Platform tools need a project-scoped key with the `database:query` scope; setup copy now says so everywhere a key is entered, and the two known rejections map to one-line remedies (400 = org-wide key, 403 = missing database scope) in the wizard, `/cloud status`, headless warnings and the extension banner.
+- `/status` marks the context window as *assumed* when neither the user nor the API supplied a spec for the active model, and points at the `/setup` context-window override — no invented numbers.
+
+### Changed
+- **Scalix product steering is gated on connection state.** Full platform guidance only while Scalix Cloud is connected; a single neutral pointer on the Scalix provider while disconnected; nothing Scalix-specific on pure BYOK sessions. Coder is a generic tool — the pitch arrives with the tools, not before.
+- Cloud tool-call budget cut from 120s to 45s: the platform transport ends a call at ~30–35s, so the extra 75s only ever waited on a dead call.
+- Request timeout raised to 300s to match the platform's own walls (env-overridable via `SCALIX_REQUEST_TIMEOUT_MS`).
+
+### Fixed
+- **Model switching, 24 audited fixes + 3 from dogfooding videos.** `setModel` preserves the failover chain and mutates in place (sub-agents saw stale model lists), and resets the breaker; fresh sends no longer round-robin the chain; BYOK model specs are registered on every switch surface, so no more `max_tokens`-less requests that OpenRouter 400s; the TUI `/model` no longer fires mid-stream via the `/mode` prefix collision and persists chain-preservingly to the global config (project overrides no longer laundered); `/settings` reports live-vs-next-launch truthfully; a `SCALIX_MODEL` override is announced; the IPC engine survives stray rejections — a 429 used to kill the whole session.
+- The system prompt forbids inventing `scalix` packages or CLI flags and explains the `scalix_*` tools, with pinned SDK names (`@scalix-world/sdk` on npm, `scalix-sdk` on PyPI) and exact model ids.
+
+### Fixed (VS Code extension)
+- Scalix keys are verified against `/v1/me` before storing — a rejected key gets a dialog with the reason instead of failing silently later. BYOK keys are never probed.
+- Model QuickPick accepts mouse clicks under Antigravity's event ordering; model/command updates broadcast to every chat surface (the editor tab used to go stale); the shared-config watcher ignores its own writes, so adopting a config no longer reverts a fresh model switch; the settings Models tab was rebuilt — stable refresh, live active badge, auto-reload on provider/endpoint/key change.
+- `vsce` packaging: the extension manifest carries the `repository` field CI packaging requires.
+
 ## [1.5.0] - 2026-08-02
 
 ### Added

package/LICENSE

@@ -2,7 +2,6 @@ SCALIX WORLD PRIVATE LIMITED
 END USER LICENSE AGREEMENT (EULA)
 
 Copyright (c) 2025-2026 Scalix World Pvt Ltd. All rights reserved.
-A subsidiary of Energy FW Ltd (UK Company No. 14600160)
 
 IMPORTANT — READ CAREFULLY BEFORE USING THIS SOFTWARE.
 

package/README.md

@@ -2,7 +2,7 @@
 
 AI-powered coding agent for the terminal and [VS Code](https://marketplace.visualstudio.com/items?itemName=scalix.scalix) — built by [Scalix World](https://scalix.world).
 
-![Version](https://img.shields.io/badge/version-1.4.0-blue)
+[![npm](https://img.shields.io/npm/v/scalix?color=blue)](https://www.npmjs.com/package/scalix)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-green)
 ![License](https://img.shields.io/badge/license-EULA-orange)
 
@@ -61,12 +61,28 @@ Notes:
 
 ### Install
 
+```bash
+npm install -g scalix
+```
+
+Requires Node 18 or newer. If `npm install -g` needs `sudo` on your machine, that
+is a sign npm's global prefix points somewhere root-owned — point it at your home
+directory (`npm config set prefix ~/.npm-global`) rather than installing as root.
+
+<details>
+<summary>From source (contributors)</summary>
+
+The repository is private; you need access before this will clone.
+
 ```bash
 git clone https://github.com/scalixworld/scalix-coder.git && cd scalix-coder
 npm install
-sudo npm link
+npm run build
+npm link
 ```
 
+</details>
+
 ### Run
 
 ```bash
@@ -239,6 +255,35 @@ Config is stored in `~/.scalix-coder/config.json`.
 | `.scalix/rules/*.md`    | Scoped rules                  |
 | `mcp-services.json`     | MCP server config             |
 
+### MCP servers
+
+Servers listed in `mcp-services.json` (project root, or `.scalix/` as a
+fallback) are connected at startup and their tools are offered to the model as
+`mcp__<server>__<tool>`. Both transports are supported:
+
+```json
+{
+  "mcpServers": [
+    { "serverLabel": "github", "command": "npx", "args": ["-y", "@modelcontextprotocol/server-github"],
+      "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_…" } },
+    { "serverLabel": "docs", "serverUrl": "https://docs.example.com/mcp", "authorizationEnv": "DOCS_TOKEN" }
+  ]
+}
+```
+
+The Claude Desktop / VS Code object-map dialect (`"mcpServers": {"github": {…}}`)
+is accepted too, so an existing config can be dropped in unchanged.
+
+- `disabled: true` skips an entry without deleting it; `allowedTools.toolNames`
+  registers only the named tools from that server.
+- A server that fails to start is logged and skipped — it never takes the run
+  down with it. `/mcp` lists the status of each.
+- **Command (stdio) servers only start in a trusted workspace**, because
+  spawning one runs arbitrary local code. They get a clean environment, not the
+  agent's, so they cannot read its API keys.
+- MCP tools are external, so they require confirmation under the default
+  permission mode.
+
 ## VS Code Extension
 
 Install from the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=scalix.scalix) — or from [Open VSX](https://open-vsx.org/extension/scalix/scalix) if you use Cursor, Windsurf, or VSCodium:

package/dist/agent-presets.js

@@ -0,0 +1,33 @@
+export const AGENT_PRESETS = [
+    {
+        id: 'cloud-architect',
+        name: 'Cloud Architect',
+        description: 'Full Scalix Cloud tools access with architecture-first planning',
+        systemPromptAdditions: 'You are an expert Scalix Cloud Architect. Prioritize robust, scalable infrastructure. Plan changes carefully.',
+        permissionMode: 'default'
+    },
+    {
+        id: 'dba',
+        name: 'Database Administrator',
+        description: 'Focused on database migrations and SQL optimization',
+        systemPromptAdditions: 'You are a Senior DBA. Prioritize data integrity and query performance. Always verify schemas before altering.',
+        permissionMode: 'default'
+    },
+    {
+        id: 'devops',
+        name: 'DevOps Engineer',
+        description: 'CI/CD, deployments, and infrastructure management',
+        systemPromptAdditions: 'You are a DevOps engineer focused on CI/CD pipelines, containerization, and safe deployments.',
+        permissionMode: 'default'
+    },
+    {
+        id: 'full-access',
+        name: 'Full Access (Auto)',
+        description: 'All tools enabled, autonomous execution mode',
+        systemPromptAdditions: 'You are fully autonomous. Execute the required steps directly.',
+        permissionMode: 'auto'
+    }
+];
+export function getPreset(id) {
+    return AGENT_PRESETS.find(p => p.id === id);
+}