scalix 1.5.0 → 1.5.2

package/dist/tools-browser.js

@@ -4,9 +4,11 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { sandboxPath, getSandboxRoot } from './sandbox.js';
 import { isPrivateHost } from './constants.js';
+import { checkLocalAccess, isLocalOriginApproved } from './browser-access.js';
 import { encodeImageToDataUrl } from './tools-vision.js';
-// Validate a navigation target before handing it to Playwright: http/https only
-// and never a localhost/private-network host (defeats browser-based SSRF).
+// Validate a navigation target's shape before handing it to Playwright:
+// http/https only. Whether a *local* target is reachable is a separate,
+// user-answerable question — see checkLocalAccess in browser-access.ts.
 // Returns an error string when the URL must be rejected, otherwise null.
 function validateNavigationUrl(rawUrl) {
     let parsed;
@@ -19,18 +21,17 @@ function validateNavigationUrl(rawUrl) {
     if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
         return `Blocked: only http/https URLs are allowed (got ${parsed.protocol})`;
     }
-    if (isPrivateHost(parsed.hostname)) {
-        return 'Blocked: navigation to localhost and private networks is not allowed';
-    }
     return null;
 }
 // Re-check the URL a page actually landed on (post-redirect) and reject when it
-// resolved to a private host.
+// resolved to a private host the user has not cleared. A redirect is not a
+// moment to interrupt with a prompt, so an unapproved local origin is simply
+// refused here — the model can navigate to it directly and be asked properly.
 function validateResolvedUrl(rawUrl) {
     try {
         const parsed = new URL(rawUrl);
         if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {
-            if (isPrivateHost(parsed.hostname)) {
+            if (isPrivateHost(parsed.hostname) && !isLocalOriginApproved(rawUrl)) {
                 return 'Blocked: navigation redirected to a private network address';
             }
         }
@@ -40,6 +41,27 @@ function validateResolvedUrl(rawUrl) {
     }
     return null;
 }
+let frameSink = null;
+/** Front ends that can display the agent's browser register here. */
+export function setBrowserFrameSink(fn) {
+    frameSink = fn;
+}
+// Capture is best-effort and must never turn a working action into a failed
+// one: a page that navigated away mid-shot is a missing frame, not an error.
+async function emitFrame(page, action) {
+    if (!frameSink)
+        return;
+    try {
+        const buf = await page.screenshot({ type: 'jpeg', quality: 55 });
+        frameSink({
+            action,
+            url: page.url(),
+            title: await page.title().catch(() => ''),
+            dataUrl: `data:image/jpeg;base64,${buf.toString('base64')}`,
+        });
+    }
+    catch { }
+}
 let browserInstance = null;
 let browserContext = null;
 let browserPage = null;
@@ -76,12 +98,30 @@ async function ensureBrowser() {
             browserPage = null;
         }
     }
-    browserInstance = await pw.chromium.launch({ headless: true });
-    browserContext = await browserInstance.newContext({
-        viewport: { width: 1280, height: 720 },
-    });
-    browserPage = await browserContext.newPage();
-    return { browser: browserInstance, page: browserPage };
+    try {
+        browserInstance = await pw.chromium.launch({ headless: true });
+        browserContext = await browserInstance.newContext({
+            viewport: { width: 1280, height: 720 },
+        });
+        browserPage = await browserContext.newPage();
+        return { browser: browserInstance, page: browserPage };
+    }
+    catch (err) {
+        if (browserInstance) {
+            try {
+                await browserInstance.close();
+            }
+            catch { }
+            browserInstance = null;
+        }
+        browserContext = null;
+        browserPage = null;
+        const msg = err?.message || String(err);
+        if (msg.includes('Executable doesn\'t exist') || msg.includes('playwright install') || msg.includes('chromium')) {
+            throw new Error(`Playwright browser binaries not found. Run 'npx playwright install chromium' to enable browser automation.`);
+        }
+        throw err;
+    }
 }
 export async function closeBrowser() {
     if (browserContext) {
@@ -111,6 +151,11 @@ export const browserNavigateTool = tool({
         const preCheck = validateNavigationUrl(url);
         if (preCheck)
             return { error: preCheck };
+        // localhost and the LAN need the user's say-so, once per origin per
+        // project. This is what lets the agent open the dev server it just edited.
+        const localGate = await checkLocalAccess(url);
+        if (localGate)
+            return { error: localGate };
         const session = await ensureBrowser();
         if (!session) {
             return { error: 'Playwright not available. Install it: npm install playwright && npx playwright install chromium' };
@@ -130,6 +175,7 @@ export const browserNavigateTool = tool({
                 return { error: postCheck, url: currentUrl };
             }
             const title = await session.page.title();
+            await emitFrame(session.page, `navigate ${currentUrl}`);
             return {
                 url: currentUrl,
                 title,
@@ -228,7 +274,7 @@ export const browserScreenshotTool = tool({
                         overlay.remove();
                 });
             }
-            return {
+            const shot = {
                 url: session.page.url(),
                 title: await session.page.title(),
                 path: outputPath || undefined,
@@ -236,6 +282,11 @@ export const browserScreenshotTool = tool({
                 dataUrl,
                 annotations,
             };
+            // Reuse the shot the model is about to look at rather than taking a
+            // second one — the annotated overlay is exactly what is worth showing.
+            if (frameSink)
+                frameSink({ action: 'screenshot', url: shot.url, title: shot.title, dataUrl });
+            return shot;
         }
         catch (error) {
             return { error: `Screenshot failed: ${error.message}` };
@@ -273,6 +324,7 @@ export const browserClickTool = tool({
             }
             await session.page.waitForTimeout(500);
             const target = typeof x === 'number' ? `coords:(${x},${y})` : selector || `text:"${text}"`;
+            await emitFrame(session.page, `click ${target}`);
             return { clicked: target, url: session.page.url() };
         }
         catch (error) {
@@ -323,6 +375,7 @@ export const browserMouseTool = tool({
                     await session.page.waitForTimeout(300);
                     break;
             }
+            await emitFrame(session.page, `${action} (${x},${y})`);
             return { action, x, y, url: session.page.url() };
         }
         catch (error) {
@@ -355,6 +408,7 @@ export const browserTypeTool = tool({
                 await session.page.press(selector, 'Enter');
                 await session.page.waitForTimeout(500);
             }
+            await emitFrame(session.page, `type into ${selector}`);
             return { typed: text.length > 50 ? text.slice(0, 50) + '...' : text, selector, url: session.page.url() };
         }
         catch (error) {
@@ -489,7 +543,16 @@ export const browserSessionRestoreTool = tool({
                 browserPage = null;
             }
             if (!browserInstance) {
-                browserInstance = await pw.chromium.launch({ headless: true });
+                try {
+                    browserInstance = await pw.chromium.launch({ headless: true });
+                }
+                catch (err) {
+                    const msg = err?.message || String(err);
+                    if (msg.includes('Executable doesn\'t exist') || msg.includes('playwright install') || msg.includes('chromium')) {
+                        return { error: `Session restore failed: Playwright browser binaries not found. Run 'npx playwright install chromium' to enable browser automation.` };
+                    }
+                    return { error: `Session restore failed: ${msg}` };
+                }
             }
             browserContext = await browserInstance.newContext({
                 viewport: session.viewport,
@@ -497,7 +560,11 @@ export const browserSessionRestoreTool = tool({
             });
             browserPage = await browserContext.newPage();
             if (session.url && session.url !== 'about:blank') {
-                const preCheck = validateNavigationUrl(session.url);
+                const preCheck = validateNavigationUrl(session.url)
+                    // A saved session is a stored URL replayed without the model naming
+                    // it, so a local target still has to clear the same consent gate as
+                    // a fresh navigation.
+                    || await checkLocalAccess(session.url);
                 if (preCheck) {
                     return { error: `Session restore blocked: saved URL rejected — ${preCheck}` };
                 }
@@ -575,6 +642,10 @@ export const browserCloseTool = tool({
         }
         catch { }
         await closeBrowser();
+        // An empty frame means "the agent's browser is gone" — the viewer keeps the
+        // last picture but stops implying it is live.
+        if (frameSink)
+            frameSink({ action: 'closed', url: '', title: '', dataUrl: '' });
         return { status: 'closed', sessionSaved: saveSession || undefined };
     },
 });

package/dist/tools-extra.js

@@ -160,9 +160,21 @@ export const searchFilesTool = tool({
                 }
             }
             // Fallback: built-in search using fast-glob + regex
-            const globPattern = fileGlob || '**/*';
-            const files = await fg(globPattern, {
-                cwd,
+            let searchCwd = cwd;
+            let targetPattern = fileGlob || '**/*';
+            if (searchPath) {
+                const safeTarget = sandboxPath(searchPath);
+                const st = await fs.stat(safeTarget).catch(() => null);
+                if (st && !st.isDirectory()) {
+                    searchCwd = path.dirname(safeTarget);
+                    targetPattern = path.basename(safeTarget);
+                }
+                else {
+                    searchCwd = safeTarget;
+                }
+            }
+            const files = await fg(targetPattern, {
+                cwd: searchCwd,
                 ignore: ['node_modules/**', '.git/**', 'dist/**', 'coverage/**', '*.lock'],
                 absolute: true,
                 onlyFiles: true,

package/dist/tools-memory.js

@@ -0,0 +1,74 @@
+import { tool } from './tool-helper.js';
+import { z } from 'zod';
+import { loadMemory, addConvention, addPattern, addNote } from './project-memory.js';
+import { getPersistentCwd } from './tools.js';
+export const saveMemoryTool = tool({
+    name: 'save_memory',
+    description: 'Save a project convention, architectural pattern, or durable note into the project memory (.scalix/memory.json). Use whenever the user asks you to remember something, corrects a convention, or when establishing project standards.',
+    inputSchema: z.object({
+        category: z.enum(['convention', 'pattern', 'note']).describe('Type of memory to store'),
+        key: z.string().max(100).optional().describe('Convention key (e.g., "package_manager", "database", "api_base", "styling") when category is "convention"'),
+        value: z.string().max(1000).optional().describe('Convention value (e.g., "pnpm", "PostgreSQL", "Tailwind CSS") when category is "convention"'),
+        note: z.string().max(2000).optional().describe('Text note/guideline/rule when category is "note"'),
+        pattern: z.object({
+            name: z.string().max(100).describe('Pattern name (e.g., "Repository Pattern", "Zod Validation")'),
+            description: z.string().max(2000).describe('Detailed explanation of how and when to use this pattern'),
+            example: z.string().max(2000).optional().describe('Code snippet or usage example'),
+        }).optional().describe('Pattern definition when category is "pattern"'),
+    }),
+    execute: async ({ category, key, value, note, pattern }) => {
+        const cwd = getPersistentCwd() || process.cwd();
+        if (category === 'convention') {
+            if (!key || !value) {
+                return { success: false, error: 'Both "key" and "value" are required when saving a convention.' };
+            }
+            await addConvention(cwd, key, value, 'user');
+            return { success: true, message: `Saved convention: ${key} = ${value}` };
+        }
+        if (category === 'pattern') {
+            if (!pattern || !pattern.name || !pattern.description) {
+                return { success: false, error: '"pattern.name" and "pattern.description" are required when saving a pattern.' };
+            }
+            await addPattern(cwd, pattern);
+            return { success: true, message: `Saved pattern: ${pattern.name}` };
+        }
+        if (category === 'note') {
+            if (!note || !note.trim()) {
+                return { success: false, error: '"note" text is required when saving a note.' };
+            }
+            await addNote(cwd, note.trim());
+            return { success: true, message: `Saved note: "${note.trim()}"` };
+        }
+        return { success: false, error: `Unsupported category "${category}"` };
+    },
+});
+export const getMemoryTool = tool({
+    name: 'get_memory',
+    description: 'Retrieve stored project memory (.scalix/memory.json), including conventions, architectural patterns, and user notes.',
+    inputSchema: z.object({
+        category: z.enum(['all', 'conventions', 'patterns', 'notes']).optional().describe('Filter by memory category (default: "all")'),
+    }),
+    execute: async ({ category = 'all' }) => {
+        const cwd = getPersistentCwd() || process.cwd();
+        const mem = await loadMemory(cwd);
+        if (category === 'conventions') {
+            return { conventions: mem.conventions, lastUpdated: mem.lastUpdated };
+        }
+        if (category === 'patterns') {
+            return { patterns: mem.patterns, lastUpdated: mem.lastUpdated };
+        }
+        if (category === 'notes') {
+            return { notes: mem.notes, lastUpdated: mem.lastUpdated };
+        }
+        return {
+            conventions: mem.conventions,
+            patterns: mem.patterns,
+            notes: mem.notes,
+            lastUpdated: mem.lastUpdated,
+        };
+    },
+});
+export const memoryTools = [
+    saveMemoryTool,
+    getMemoryTool,
+];

package/dist/tools-web.js

@@ -5,7 +5,7 @@ import path from 'node:path';
 import dns from 'node:dns';
 import { sandboxPath } from './sandbox.js';
 import { logger } from './logger.js';
-import { USER_AGENT, SEARCH_ENDPOINTS, WEB_DEFAULTS, TOOL_DEFAULTS, HTML_STRIP_TAGS, isPrivateHost, isPrivateIp, } from './constants.js';
+import { USER_AGENT, SEARCH_ENDPOINTS, WEB_DEFAULTS, TOOL_DEFAULTS, HTML_STRIP_TAGS, isPrivateHost, isPrivateIp, isHostExplicitlyAllowed, } from './constants.js';
 import { detectPromptInjection } from './injection-detector.js';
 import { DEFAULT_LIMITS } from './settings.js';
 const MAX_FETCH_REDIRECTS = 5;
@@ -20,6 +20,10 @@ async function validateFetchTarget(target) {
     if (isPrivateHost(hostname)) {
         return 'Blocked: requests to localhost and private networks are not allowed';
     }
+    // An operator who allow-listed this exact name did so knowing it points into
+    // a private range; re-checking the resolved address would only undo that.
+    if (isHostExplicitlyAllowed(hostname))
+        return null;
     try {
         const addresses = await dns.promises.lookup(hostname, { all: true });
         if (addresses.some((a) => isPrivateIp(a.address))) {
@@ -325,30 +329,86 @@ export const treeTool = tool({
         return { tree: lines.join('\n') };
     },
 });
+// The tool advertises itself as the one to reach for on large files, so it is
+// the last place that should read the whole file into a string first. Above
+// `readFileMaxSize` it streams and stops at the requested end line; below it,
+// the whole-file read stays (it is cheaper and gives an exact totalLines).
+// Either way the span itself is capped — `endLine: 10_000_000` used to return
+// every line in the file and blow the context window open.
+const MAX_LINE_SPAN = 2000;
+const MAX_LINE_CHARS = 4000;
+async function streamLineRange(safePath, start, end) {
+    const { createReadStream } = await import('node:fs');
+    const readline = await import('node:readline');
+    const rl = readline.createInterface({
+        input: createReadStream(safePath, { encoding: 'utf-8' }),
+        crlfDelay: Infinity,
+    });
+    const lines = [];
+    let n = 0;
+    let reachedEof = true;
+    try {
+        for await (const line of rl) {
+            n++;
+            if (n < start)
+                continue;
+            lines.push({ lineNumber: n, text: line.slice(0, MAX_LINE_CHARS) });
+            if (n >= end) {
+                reachedEof = false;
+                break;
+            }
+        }
+    }
+    finally {
+        rl.close();
+    }
+    return { lines, reachedEof, scanned: n };
+}
 export const readFileLinesTool = tool({
     name: 'read_file_lines',
     description: 'Read specific line range from a file. Useful for large files. Returns lines with line numbers.',
     inputSchema: z.object({
         filePath: z.string().max(500).describe('Relative path to the file'),
         startLine: z.number().min(1).describe('First line to read (1-based)'),
-        endLine: z.number().min(1).optional().describe('Last line to read (default: startLine + 100)'),
+        endLine: z.number().min(1).optional().describe(`Last line to read (default: startLine + 100, at most ${MAX_LINE_SPAN} lines per call)`),
     }),
     execute: async ({ filePath, startLine, endLine }) => {
         try {
             const safePath = sandboxPath(filePath);
-            const content = await fs.readFile(safePath, 'utf-8');
-            const allLines = content.split('\n');
             const start = Math.max(1, startLine);
             if (endLine !== undefined && endLine < start) {
                 return { error: `endLine (${endLine}) must be >= startLine (${start})` };
             }
+            const requestedEnd = endLine ?? (start + 100);
+            const cappedEnd = Math.min(requestedEnd, start + MAX_LINE_SPAN - 1);
+            const spanCapped = cappedEnd < requestedEnd;
+            const stat = await fs.stat(safePath);
+            if (stat.isDirectory())
+                return { error: `${filePath} is a directory` };
+            if (stat.size > _limits.readFileMaxSize) {
+                const { lines, reachedEof, scanned } = await streamLineRange(safePath, start, cappedEnd);
+                if (lines.length === 0) {
+                    return { error: `startLine (${start}) exceeds file length (${scanned} lines)`, totalLines: scanned };
+                }
+                const last = lines[lines.length - 1].lineNumber;
+                return {
+                    filePath,
+                    startLine: start,
+                    endLine: last,
+                    ...(reachedEof ? { totalLines: scanned } : { hint: `Showing lines ${start}-${last}; file exceeds ${_limits.readFileMaxSize} bytes so the total line count was not counted` }),
+                    ...(spanCapped ? { truncated: `Capped at ${MAX_LINE_SPAN} lines per call; continue from line ${last + 1}` } : {}),
+                    lines,
+                };
+            }
+            const content = await fs.readFile(safePath, 'utf-8');
+            const allLines = content.split('\n');
             if (start > allLines.length) {
                 return { error: `startLine (${start}) exceeds file length (${allLines.length} lines)`, totalLines: allLines.length };
             }
-            const end = Math.min(endLine ?? (startLine + 100), allLines.length);
+            const end = Math.min(cappedEnd, allLines.length);
             const selectedLines = allLines.slice(start - 1, end).map((line, i) => ({
                 lineNumber: start + i,
-                text: line,
+                text: line.slice(0, MAX_LINE_CHARS),
             }));
             return {
                 filePath,
@@ -356,6 +416,7 @@ export const readFileLinesTool = tool({
                 startLine: start,
                 endLine: end,
                 ...(end < allLines.length ? { hint: `Showing lines ${start}-${end} of ${allLines.length}` } : {}),
+                ...(spanCapped ? { truncated: `Capped at ${MAX_LINE_SPAN} lines per call; continue from line ${end + 1}` } : {}),
                 lines: selectedLines,
             };
         }

package/dist/tools.js

@@ -8,8 +8,9 @@ import path from 'node:path';
 import { safeEvaluate } from './safe-math.js';
 import { sandboxPath, isBlockedCommand, detectInjection, sanitizeEnvForCommand, getShellInfo, isWithinRoot, getSandboxRoot } from './sandbox.js';
 import { DEFAULT_LIMITS } from './settings.js';
-import { TOOL_DEFAULTS, BINARY_DETECT_BUFFER_SIZE, isPrivateHost } from './constants.js';
+import { TOOL_DEFAULTS, BINARY_DETECT_BUFFER_SIZE } from './constants.js';
 import { computeDiff, formatDiff } from './diff.js';
+import { normalizeMcpConfig, validateMcpUrl } from './mcp.js';
 let _limits = DEFAULT_LIMITS;
 export function setToolLimits(limits) { _limits = limits; }
 const execAsync = promisify(exec);
@@ -359,24 +360,21 @@ export const addMcpServerTool = tool({
     }),
     execute: async ({ label, url }) => {
         try {
-            let parsedUrl;
-            try {
-                parsedUrl = new URL(url);
-            }
-            catch {
-                return { success: false, error: `Invalid MCP server URL: "${url}" is not a valid URL` };
-            }
-            if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
-                return { success: false, error: `Invalid MCP server URL: only http/https schemes are allowed (got ${parsedUrl.protocol})` };
-            }
-            if (isPrivateHost(parsedUrl.hostname)) {
-                return { success: false, error: 'Blocked: MCP server URL points at localhost or a private network address' };
+            // Shared with the config-file and /mcp paths so all three refuse the
+            // same URLs — this check used to live only here, which is how the
+            // config file ended up being the way around it.
+            const blocked = validateMcpUrl(url);
+            if (blocked) {
+                return { success: false, error: `Invalid MCP server URL: ${blocked}` };
             }
             const mcpConfigPath = path.resolve(process.cwd(), 'mcp-services.json');
             let config = { mcpServers: [] };
             try {
                 if (fsSync.existsSync(mcpConfigPath)) {
-                    const parsed = JSON.parse(fsSync.readFileSync(mcpConfigPath, 'utf-8'));
+                    // Through normalizeMcpConfig, because the IDE panel writes the
+                    // object-map dialect. Blindly resetting a non-array mcpServers to []
+                    // here would silently delete every server the user configured there.
+                    const parsed = normalizeMcpConfig(JSON.parse(fsSync.readFileSync(mcpConfigPath, 'utf-8')));
                     if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
                         config = parsed;
                         if (!Array.isArray(config.mcpServers))
@@ -385,6 +383,9 @@ export const addMcpServerTool = tool({
                 }
             }
             catch { }
+            if (config.mcpServers.some((s) => s?.serverLabel === label)) {
+                return { success: false, error: `An MCP server labelled "${label}" is already configured` };
+            }
             config.mcpServers.push({ serverLabel: label, serverUrl: url });
             await fs.writeFile(mcpConfigPath, JSON.stringify(config, null, 2), 'utf-8');
             return { success: true, message: `Added MCP server ${label} at ${url}` };

package/dist/workspace-trust.js

@@ -3,6 +3,7 @@
  *
  * Scalix Coder loads and executes code/config from the current project
  * directory — plugin handler modules (dynamic import), hooks (shell commands),
+ * MCP servers (a spawned process, or a URL we hand an environment secret to),
  * scoped rules (injected into the model context) and local settings overrides
  * (which can change permission mode / security). Opening the tool in an
  * untrusted / freshly-cloned repository must NOT silently run any of that.
@@ -43,7 +44,12 @@ function normalize(cwd) {
 export function hasProjectExecSurface(cwd = process.cwd()) {
     const candidates = ['mcp-services.json'];
     for (const dir of PROJECT_LOOKUP_DIRS) {
-        candidates.push(path.join(dir, 'plugins'), path.join(dir, 'hooks.json'), path.join(dir, 'rules'), path.join(dir, 'settings.local.json'));
+        candidates.push(path.join(dir, 'plugins'), path.join(dir, 'hooks.json'), 
+        // resolveMcpConfigPath() falls back to .scalix/mcp-services.json, so a
+        // repo can carry MCP config without a root-level file. Listing only the
+        // root filename meant an MCP-only clone looked inert and the user was
+        // never offered the trust prompt for the one thing it did have.
+        path.join(dir, 'mcp-services.json'), path.join(dir, 'rules'), path.join(dir, 'settings.local.json'));
     }
     return candidates.some(rel => {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scalix",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "AI coding agent for the terminal — edit code, run commands, and build with Scalix",
   "main": "dist/headless.js",
   "bin": {
@@ -17,6 +17,7 @@
     "start:headless": "tsx src/headless.ts",
     "dev": "tsx watch src/cli.tsx",
     "build": "tsc",
+    "bundle:ide": "node scripts/bundle-ide.mjs",
     "typecheck": "tsc --noEmit",
     "lint": "eslint src/ tests/",
     "test": "vitest run",
@@ -51,6 +52,7 @@
   },
   "type": "module",
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "chalk": "^5.6.2",
     "cli-highlight": "^2.1.11",
     "eventemitter3": "^5.0.4",