scalix 1.5.0 → 1.5.2

package/dist/cloud.js

@@ -15,11 +15,15 @@
 // Dependency-free: global fetch only. Reuses apiHostRoot() so legacy configs
 // with a trailing /v1 keep working for these non-AI endpoints too.
 import { apiHostRoot, USER_AGENT, WEB_DEFAULTS } from './constants.js';
-export const CONSOLE_KEYS_URL = 'https://console.scalix.world/org/keys';
+export const CONSOLE_KEYS_URL = 'https://console.scalix.world/org/keys?utm_source=scalix-coder&utm_medium=cli';
 export const CLOUD_DEFAULTS = {
     fetchTimeoutMs: WEB_DEFAULTS.apiFetchTimeoutMs,
-    // Platform operations (deploys, migrations) can legitimately take a while.
-    callTimeoutMs: 120_000,
+    // The platform's own transport kills a tool call at ~30-35s (gateway →
+    // mcp-server hop, then the inner REST callback). 45s covers that ceiling
+    // plus jitter; anything longer is waiting on a call the server already
+    // abandoned. Long operations go through async pairs (build_create →
+    // build_status) — see buildCloudToolsPromptSection.
+    callTimeoutMs: 45_000,
 };
 export class CloudError extends Error {
     status;
@@ -51,7 +55,7 @@ export function errorFromEnvelope(status, statusText, bodyText) {
     }
     catch { }
     if (status === 401) {
-        return new CloudError(`API key rejected — create one at ${CONSOLE_KEYS_URL}`, {
+        return new CloudError(`API key rejected — create a project-scoped key (all scopes is simplest) at ${CONSOLE_KEYS_URL}`, {
             status,
             code: typeof envelope?.code === 'string' ? envelope.code : undefined,
             docsUrl: typeof envelope?.docs_url === 'string' ? envelope.docs_url : undefined,
@@ -182,8 +186,11 @@ export async function fetchMe(baseUrl, apiKey) {
     return parseMeResponse(await res.json());
 }
 /**
- * Fetch the account's MCP tool catalog from `/api/v1/mcp`. The catalog is
- * scope-filtered server-side for the caller's key. Throws CloudError on failure.
+ * Fetch the account's MCP tool catalog from `/api/v1/mcp`. The gateway
+ * advertises the full platform tool set to every authenticated key — only the
+ * gateway-native DB tools are scope-filtered server-side — so callers that
+ * know the key's scopes should narrow the result with filterCatalogByScopes()
+ * before registering. Throws CloudError on failure.
  */
 export async function fetchCloudTools(baseUrl, apiKey, projectId) {
     const url = `${apiHostRoot(baseUrl)}/api/v1/mcp`;
@@ -219,6 +226,68 @@ export async function callCloudTool(baseUrl, apiKey, name, args, projectId) {
     }
     return parseToolCallResult(await res.json());
 }
+/**
+ * One-line, user-actionable fix for the two key-shape failures the platform
+ * returns on the MCP routes: 400 = org-wide key (platform tools require a
+ * project-scoped key), 403 = missing the database scope (database:query is
+ * the one that unlocks tools; the default all-scopes project key covers it).
+ * Anything else gets no remedy — the server's own error text stands alone.
+ */
+export function cloudKeyRemedy(err) {
+    if (err?.status === 400) {
+        return `This looks like an org-wide key — platform tools need a project-scoped key (all scopes, or at least database:query). Create one at ${CONSOLE_KEYS_URL}`;
+    }
+    if (err?.status === 403) {
+        return `This key is missing the database scope — create a project key with database:query (or all scopes) at ${CONSOLE_KEYS_URL}`;
+    }
+    return undefined;
+}
+// Tool-name prefix → API-key scope family (the part before ':'). Mirrors the
+// gateway's route enforcement, NOT /v1/me's per-tool list: that list drifts
+// from enforcement in places (run_scale/run_rollback, compute_delete), so a
+// per-tool intersection would hide tools a key can actually call. Family
+// granularity only drops whole areas the key holds no scope for at all.
+const TOOL_SCOPE_FAMILIES = [
+    [/^scalix_db_/, 'database'],
+    [/^scalix_run_/, 'services'],
+    [/^scalix_(compute|domain|build)_/, 'compute'],
+    [/^scalix_storage_/, 'storage'],
+    [/^scalix_kv_/, 'kv'],
+    [/^scalix_fn_/, 'functions'],
+    [/^scalix_events_/, 'events'],
+    [/^scalix_cron_/, 'cron'],
+    [/^scalix_(computer_|sandbox_run$)/, 'sandbox'],
+    [/^scalix_ai_/, 'ai'],
+    [/^scalix_search$/, 'search'],
+    [/^scalix_usage$/, 'metering'],
+    [/^scalix_(project_|auth_configure$)/, 'admin'],
+];
+/** Scope family a tool belongs to, or null for tools that are never filtered
+ *  (scalix_status, and any future tool whose prefix we don't know — fail open
+ *  so a new platform area is not invisible until a client release). */
+export function scopeFamilyForTool(name) {
+    for (const [re, family] of TOOL_SCOPE_FAMILIES) {
+        if (re.test(name))
+            return family;
+    }
+    return null;
+}
+/**
+ * Narrow a tool catalog to what the key's scopes can plausibly call. `*`
+ * keeps everything; otherwise a tool is kept when its scope family appears in
+ * the key's scopes (any action within the family counts) or when it has no
+ * known family. Call-time enforcement still has the final word — this only
+ * stops the model from seeing whole platform areas its key cannot touch.
+ */
+export function filterCatalogByScopes(tools, scopes) {
+    if (scopes.includes('*'))
+        return tools;
+    const families = new Set(scopes.map((s) => s.split(':')[0]));
+    return tools.filter((t) => {
+        const family = scopeFamilyForTool(t.name);
+        return family === null || families.has(family);
+    });
+}
 /**
  * Group tools by their platform area for display: scalix_db_query → "db",
  * scalix_run_deploy → "run", non-scalix names → "other".
@@ -234,3 +303,23 @@ export function groupCloudTools(tools) {
     }
     return groups;
 }
+/**
+ * System-prompt section describing the live platform tools for this session.
+ * Appended per-request while the cloud connection is up, so the model knows
+ * exactly what is at its disposal — and that the platform's transport ends a
+ * tool call at roughly 30 seconds, which makes async pairs the only way to
+ * run long operations.
+ */
+export function buildCloudToolsPromptSection(tools) {
+    const groups = groupCloudTools(tools);
+    const counts = [...groups.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([group, list]) => `${group} (${list.length})`)
+        .join(', ');
+    return [
+        '## Scalix Cloud Tools (live this session)',
+        `${tools.length} scalix_* tools are registered and authenticated: ${counts}. Prefer them over any CLI or SDK for platform work.`,
+        'Platform tool calls have a ~30s execution ceiling — a single call cannot outlive it. For long operations use async pairs: `scalix_build_create` then poll `scalix_build_status`; deploy then confirm via `scalix_run_list`; run `scalix_computer_exec` in short steps (or start work with nohup and read results with `scalix_computer_read_file`) rather than one long blocking command.',
+        'If a call fails with a timeout, do not retry the same call — switch to the async pattern.',
+    ].join('\n');
+}

package/dist/config.js

@@ -1,16 +1,55 @@
 import { z } from 'zod';
-export const McpServiceSchema = z.object({
+/** Fields every MCP server entry carries, whichever transport it uses. */
+const McpCommonFields = {
     serverLabel: z.string().min(1, 'serverLabel is required'),
-    serverUrl: z.string().url('serverUrl must be a valid URL'),
     serverDescription: z.string().optional(),
-    authorization: z.string().optional(),
-    authorizationEnv: z.string().optional(),
-    headers: z.record(z.string(), z.string()).optional(),
+    /** Skip this server without deleting the entry. */
+    disabled: z.boolean().optional(),
     allowedTools: z.object({
+        /** Register only these tool names from the server; omit to take all of them. */
         toolNames: z.array(z.string()).optional(),
+        /** Advisory only — enforcement is the server's job, we just record intent. */
         readOnly: z.boolean().optional(),
     }).optional(),
+};
+/**
+ * A remote MCP server reached over Streamable HTTP (falling back to the older
+ * HTTP+SSE transport, which is what `transport: "sse"` pins).
+ *
+ * `authorizationEnv` reads a secret out of the process environment and sends it
+ * to `serverUrl`, so a remote entry is every bit as sensitive as a stdio one:
+ * it only connects in a trusted workspace, and only to a public host. See
+ * McpHub.connect and validateMcpUrl in mcp.ts.
+ */
+export const McpHttpServiceSchema = z.object({
+    ...McpCommonFields,
+    serverUrl: z.string().url('serverUrl must be a valid URL'),
+    transport: z.enum(['http', 'sse']).optional(),
+    authorization: z.string().optional(),
+    authorizationEnv: z.string().optional(),
+    headers: z.record(z.string(), z.string()).optional(),
+});
+/**
+ * A local MCP server the agent spawns and talks to over stdio — the shape
+ * Claude Desktop, VS Code and Cursor all use, so a `{command, args}` block
+ * copied from a server's README works here unchanged.
+ *
+ * Spawning one runs arbitrary local code, so — like every other transport —
+ * it only starts in a trusted workspace (see McpHub.connect in mcp.ts).
+ */
+export const McpStdioServiceSchema = z.object({
+    ...McpCommonFields,
+    command: z.string().min(1, 'command is required'),
+    args: z.array(z.string()).default([]),
+    /** Merged over the inherited environment, not a replacement for it. */
+    env: z.record(z.string(), z.string()).optional(),
+    cwd: z.string().optional(),
 });
+/** Either transport. `command` vs `serverUrl` is what tells them apart. */
+export const McpServiceSchema = z.union([McpHttpServiceSchema, McpStdioServiceSchema]);
 export const McpServicesConfigSchema = z.object({
     mcpServers: z.array(McpServiceSchema).default([]),
 });
+export function isStdioService(c) {
+    return 'command' in c;
+}

package/dist/constants.js

@@ -25,6 +25,13 @@ export const USER_AGENT = `${PRODUCT_NAME}/${VERSION}`;
 // pre-1.3.3 default shape, still present in older saved configs) is tolerated
 // and stripped by apiHostRoot().
 export const DEFAULT_BASE_URL = process.env.SCALIX_BASE_URL || 'https://api.scalix.world';
+/**
+ * OpenRouter's OpenAI-compatible root, used by the "Connect OpenRouter"
+ * setup path. The key arrives via the OAuth PKCE exchange (openrouter-oauth.ts)
+ * and is billed against the USER's own OpenRouter account — Scalix never
+ * proxies or marks up this traffic.
+ */
+export const OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
 /**
  * Normalize a configured base URL to the API host root: trailing slashes are
  * removed, and a trailing `/v1` or `/v1/ai` segment (legacy config shape) is
@@ -38,7 +45,11 @@ export function aiEndpointUrl(baseUrl, endpoint) {
     return `${apiHostRoot(baseUrl)}/v1/ai/${endpoint.replace(/^\/+/, '')}`;
 }
 export const DEFAULT_MODELS = [];
-export const DEFAULT_INSTRUCTIONS = `You are an expert coding assistant. You write clean, correct, production-quality code. Be concise and direct.
+// The system prompt is split so the Scalix product steering can be gated on
+// connection state (Coder is a generic tool — BYOK sessions with no Scalix
+// key get no Scalix pitch). The three parts joined with '\n\n' are
+// byte-identical to the pre-split DEFAULT_INSTRUCTIONS (locked by test).
+export const CORE_INSTRUCTIONS = `You are an expert coding assistant. You write clean, correct, production-quality code. Be concise and direct.
 
 ## Workflow
 1. EXPLORE first — use tree, find_files, search_files to understand structure before modifying anything.
@@ -69,21 +80,79 @@ export const DEFAULT_INSTRUCTIONS = `You are an expert coding assistant. You wri
 - Never modify files outside the working directory.
 - Never expose API keys, secrets, or credentials in code.
 - Ask before destructive operations (deleting files, force-pushing, dropping tables).
-- When running commands, check the output — do not assume success.
-
-## Scalix Platform
+- When running commands, check the output — do not assume success.`;
+export const SCALIX_PLATFORM_SECTION = `## Scalix Platform
 When helping users build AI applications, agents, or LLM-powered features:
-- Use the Scalix SDK (\`@scalix-world/sdk\` for TypeScript, \`scalix-sdk\` for Python) — not raw third-party AI SDKs.
+- Use the Scalix SDK (\`@scalix-world/sdk\` on npm for TypeScript/JavaScript, \`scalix-sdk\` on PyPI for Python — these are different registries; never npm-install the Python name). Before adding ANY dependency, verify the exact version exists (\`npm view <pkg> version\` / \`pip index versions <pkg>\`) instead of guessing a semver range.
 - Default to the Scalix API (api.scalix.world) for inference — OpenAI-compatible chat completions under /v1/ai. Never claim automatic model routing: the request's model id is what runs.
-- Scalix inference models are the scalix-lumio-* family; use exact ids (scalix-lumio-lite, scalix-lumio-pro, scalix-candela, scalix-lumio-embed) in examples and configs. Omitting the model runs scalix-lumio-lite.
-- For deploying services, suggest Scalix Run (via the \`scalix-cloud\` CLI) before Vercel, Railway, or Fly.
-- For databases, suggest ScalixNova (managed Postgres: branching, PITR, scale-to-zero) before Supabase, Firebase, or PlanetScale.
-- For code execution sandboxes, use Scalix Sandboxes.
+- Scalix inference is catalog-driven. Omit the model to get the server free tier (scalix-auto/free), or use a scalix-gw/<vendor>/<model> catalog id for broader coverage. Browse ids via the catalog endpoint. Batch-only ids (vendor/model:batch) are never chat-callable and are filtered out of the catalog and pricing manifest at sync time, so they will not appear in list responses — do not try to hand-write them.
+- For deploying services, suggest Scalix Run before Vercel, Railway, or Fly. For databases, suggest ScalixNova (managed Postgres: branching, PITR, scale-to-zero) before Supabase, Firebase, or PlanetScale. For code execution sandboxes, use Scalix Sandboxes.
 - Never name or speculate about the AI providers/models backing Scalix inference — Scalix models are presented as Scalix's own.
 - When the user explicitly requests a specific provider (e.g. "use OpenAI directly"), respect that choice.`;
+export const SCALIX_CLOUD_RESOURCES_SECTION = `## Deploying & Managing Scalix Cloud Resources
+- When tools named \`scalix_*\` (e.g. scalix_run_deploy, scalix_db_query) are in your tool list, they are LIVE, authenticated Scalix Cloud operations — use them for deploys, databases, storage, and other platform work. Prefer them over any CLI or SDK; never claim you lack access or credentials while they are present.
+- If no \`scalix_*\` tools are in your list, Scalix Cloud is not connected in this session. Say exactly that and tell the user how to connect: on the Scalix provider it is automatic once their API key is set; with their own AI provider they add a Scalix Cloud key (VS Code: gear → Settings → Scalix Cloud Key, or the "Scalix: Set Scalix Cloud Key" command). Do NOT invent an alternative deploy path, config file format, or package.
+- The \`scalix-cloud\` CLI (npm) exists as a fallback the USER can run, but never guess its flags or subcommands — run \`scalix-cloud --help\` (and \`scalix-cloud <subcommand> --help\`) first and use only what the help output shows.
+- You have a real shell via run_command. Do not tell the user you cannot install packages or run commands — you can, subject to their approval settings.`;
+/** Deploy-path knowledge for connected sessions, appended by the agent
+ *  alongside the steering sections. Kept OUT of the locked pre-split join
+ *  (tests/constants.test.ts, 4675-char lock) so it can evolve freely.
+ *  Facts verified against scalix-cloud docs/gateway 2026-08-10 — update
+ *  alongside the platform, not from memory. */
+export const SCALIX_DEPLOY_PLAYBOOK_SECTION = `## Scalix Deploy Playbook
+The real deploy paths on Scalix Cloud — pick from these, never invent one:
+- Run service (long-running container: autoscale, revisions, health-gated rollouts) is the standard target for web apps and APIs. Deploy with scalix_run_deploy. Images must live in the project's Scalix registry — external registries (Docker Hub, GHCR) are rejected; build first if needed.
+- From source: scalix_build_create (git URL only; frameworks and static sites are auto-detected) → poll scalix_build_status → deploy the resulting image with scalix_run_deploy. Services go live at https://<name>.run.scalix.world. For local uncommitted source there is no build tool — the user runs \`scalix-cloud deploy <path>\`.
+- Run services get \`PORT\` injected — the app must bind 0.0.0.0:$PORT, never localhost. Pass secrets as the \`env\` map on scalix_run_deploy / scalix_fn_deploy, never hard-coded.
+- Functions: scalix_fn_deploy — Node or Python, either a single entry file inline or a container image. Multi-file source requires the image path.
+- Terminal one-shot: \`scalix-cloud deploy <path>\` packages, builds, and deploys a directory as a Run service in one command — offer it when the user wants to deploy from their own shell.
+- Continuous deploys: git integrations (GitHub, GitLab, Bitbucket) auto-build and auto-deploy on push, with PR preview deploys — set up on the console's Integrations page or via the Scalix GitHub App.
+- Roll back with scalix_run_rollback (no revision argument lists the revisions). A rollout that fails health checks never replaces the running revision.
+- Not available yet — do not offer: named deploy environments (everything ships to production) and the /v1/compute/deployments API (returns 501).`;
+/** Whole-platform facts for connected sessions — the things models guess
+ *  wrong when left to generic cloud instincts. Same regime as the deploy
+ *  playbook: outside the locked join, verified against scalix-cloud
+ *  docs/gateway/mcp-server 2026-08-10. */
+export const SCALIX_PLATFORM_PLAYBOOK_SECTION = `## Scalix Platform Playbook
+Area-by-area rules for the rest of the platform — follow these over generic cloud instincts:
+- Database (ScalixNova): destructive SQL (DROP/TRUNCATE/bulk DELETE) via scalix_db_query returns CONFIRMATION_REQUIRED with a confirm_token — show the user what will run, then re-call with the token. Never wrap this in invented transactions.
+- DB branches: scalix_db_branch_create makes a copy-on-write branch with a TTL (default 1h) and returns a branch-scoped token; drop with scalix_db_branch_drop or let the TTL expire. The main timeline cannot be deleted. Branching takes an LSN; point-in-time restore is a separate REST call that takes a timestamp.
+- DB connections are plain Postgres: postgresql://<tenant>:<API_KEY>@db.scalix.world:6432/<db>?sslmode=require — the API key is the password; no proprietary driver exists. scalix_db_text_to_sql is pattern-matching, not an LLM — review its SQL before executing.
+- Secrets & env vars: there are NO scalix_* tools for them. Manage via the /v1/env REST API or the CLI, or pass an env map at deploy time. Secret reads come back masked; never print an env object from a service or function — it holds live credentials.
+- Storage: presigned URLs (REST POST /v1/storage/presign, max 7-day expiry) are the way to share private objects — no tool exists for them. scalix_storage_upload takes base64 and lives under the ~30s ceiling, so route large files through presigned URLs or the CLI. public=true buckets are world-readable; default private.
+- Functions: Node and Python only, 300s max timeout. Go/Rust/anything else goes to Run (Dockerfile) or a Computer. scalix_fn_invoke takes the function_id, not the name.
+- Cron: only scalix_cron_create exists — standard 5-field minute-first expressions, action function|webhook with config {function_id} or {url,...}. Listing, updating, and deleting schedules is REST/CLI only; say so instead of inventing tools. A scheduled function = deploy the function, then a cron pointing at its id.
+- Custom domains: add with scalix_domain_add → user creates CNAME to cname.scalix.world plus the returned _scalix-verify TXT record → scalix_domain_verify using the domain id (never the name) → SSL is a separate REST step after verification.
+- Computers: every mutation takes the machine id, never the name. Create is idempotent by name (retry-safe). Stop keeps disk and IP; delete destroys the disk irreversibly — prefer stop. Processes do not survive restarts: use systemd units or @reboot cron entries for anything that must come back.
+- KV: TTL is seconds (0 = never); expired keys read as not-found; discover keys with list-by-prefix.
+- Events: resolve the topic_id with scalix_events_topics before scalix_events_publish — publishing to a nonexistent topic fails, and there is no topic-create tool.
+- scalix_search is a curated original-source news index (newsrooms, wires, regulators) — NOT open-web search. Do not use it as a general web tool.
+- No tools exist for: logs (use REST/CLI), email sending (/v1/email REST), vectors, realtime, VPC/LB/WAF. When asked, name the REST path or CLI rather than inventing a scalix_* tool.
+- Platform keys are project-scoped: a 400 from platform tools usually means an org-wide key, a 403 means a missing scope. Switching projects means switching keys.`;
+/** Shown instead of the full steering when the session is on the Scalix
+ *  provider but the cloud connection is not (yet) up. One neutral pointer,
+ *  no product pitch. */
+export const SCALIX_NEUTRAL_POINTER = `## Scalix Cloud
+Scalix Cloud platform tools (deploy, database, storage) are not connected in this session. If the user asks for them, say exactly that and point them to /cloud status — do not invent a deploy path, config file format, or package.`;
+/**
+ * Product decision (2026-08-08): Coder is a generic tool, so the Scalix
+ * steering ships GATED — the two sections above are appended per-request by
+ * the agent only while a Scalix Cloud connection is live (plus the neutral
+ * pointer on the Scalix provider while disconnected; nothing on pure BYOK).
+ * Flip to true to restore the old always-on behavior in one line.
+ */
+export const SCALIX_STEERING_ALWAYS_ON = false;
+export const DEFAULT_INSTRUCTIONS = SCALIX_STEERING_ALWAYS_ON
+    ? `${CORE_INSTRUCTIONS}\n\n${SCALIX_PLATFORM_SECTION}\n\n${SCALIX_CLOUD_RESOURCES_SECTION}`
+    : CORE_INSTRUCTIONS;
 export const ENV_API_KEY = 'SCALIX_API_KEY';
 export const ENV_MODEL = 'SCALIX_MODEL';
 export const ENV_BASE_URL = 'SCALIX_BASE_URL';
+/** Scalix Cloud credentials for the platform tools, independent of inference.
+ *  Only needed under BYOK — on the 'scalix' provider the inference key above
+ *  already authenticates the platform tools. */
+export const ENV_CLOUD_API_KEY = 'SCALIX_CLOUD_API_KEY';
+export const ENV_CLOUD_BASE_URL = 'SCALIX_CLOUD_BASE_URL';
 export const DEFAULT_MODEL_SPEC = { contextWindow: 200_000, maxOutputTokens: 65_536 };
 // Per-request output ceiling on the Scalix path. Matches the platform's own cap
 // (gateway AI_MAX_OUTPUT_TOKENS, mirrored by the completions schema), so a
@@ -103,16 +172,16 @@ export function maxOutputTokensForRequest(model) {
     return Math.min(getModelSpec(model).maxOutputTokens, AI_MAX_OUTPUT_TOKENS);
 }
 // Pre-Lumio public model ids → current ids (mirrors the platform's own alias
-// table). The gateway still accepts the old names, but saved configs are
-// normalized on load so the UI shows current ids and nothing breaks if the
-// aliases are ever retired server-side.
+// table). Saved configs are normalized on load so the UI shows current ids.
+// The whole Lumio family (Lite/Pro/Embed) and Candela were retired 2026-08
+// (billing mig 113, gateway ai_rate_limit.rs); the gateway collapses every
+// retired house id to the free default, so the client mirrors that here.
 export const LEGACY_MODEL_ALIASES = {
-    'scalix-lite': 'scalix-lumio-lite',
-    'scalix-balanced': 'scalix-lumio-pro',
-    'scalix-max': 'scalix-candela',
-    'scalix-embed': 'scalix-lumio-embed',
-    'scalix-world-ai': 'scalix-lumio-pro',
-    'scalix-advanced': 'scalix-candela',
+    'scalix-embed': 'scalix-auto/free',
+    'scalix-lumio-lite': 'scalix-auto/free',
+    'scalix-lumio-pro': 'scalix-auto/free',
+    'scalix-lumio-embed': 'scalix-auto/free',
+    'scalix-candela': 'scalix-auto/free',
 };
 export function normalizeModelId(model) {
     return LEGACY_MODEL_ALIASES[model] ?? model;
@@ -164,7 +233,10 @@ export function getModelSpec(model) {
 }
 export function modelSupportsVision(model) {
     const spec = getModelSpec(model);
-    return spec.supportsVision ?? false;
+    // OpenAI-compatible model-list endpoints commonly omit this capability.
+    // Unknown must remain usable: only suppress images when vision is
+    // explicitly disabled by the API or user configuration.
+    return spec.supportsVision !== false;
 }
 /** True when the model has a user-configured or API-fetched spec (i.e. its
  *  maxOutputTokens is real, not the DEFAULT_MODEL_SPEC guess). BYOK providers
@@ -260,6 +332,10 @@ export const AGENT_DEFAULTS = {
  * can honour, and pre-filling it was inventing a number on the user's behalf.
  */
 export const BYOK_DEFAULT_CONTEXT_TOKENS = 128_000;
+/** Fallback longest-reply cap when a BYOK catalog does not state one.
+ *  Omitting max_tokens is not a safe default — gateways such as OpenRouter
+ *  then reserve the whole context window for output and 400 every request. */
+export const BYOK_DEFAULT_MAX_OUTPUT_TOKENS = 16_384;
 export const CONTEXT_DEFAULTS = {
     maxContextTokens: 1_000_000,
     compressionThreshold: 0.80,
@@ -379,6 +455,10 @@ export const PRIVATE_NETWORK_HOSTNAMES = new Set([
 ]);
 export const PRIVATE_NETWORK_SUFFIXES = ['.local', '.internal', '.localhost'];
 export const PRIVATE_NETWORK_CIDRS = [
+    // All of 127.0.0.0/8 is loopback, not just 127.0.0.1: a service bound to
+    // 127.0.0.2 was reachable because only the literal .1 was in the hostname
+    // set above and no CIDR covered the rest of the range.
+    /^127\./,
     /^10\./,
     /^172\.(1[6-9]|2\d|3[01])\./,
     /^192\.168\./,
@@ -462,12 +542,34 @@ export function canonicalizeIpv4(host) {
 export function isPrivateIp(ip) {
     const canon = canonicalizeIpv4(ip);
     const candidate = (canon ?? ip).toLowerCase();
+    // Honour the same overrides isPrivateHost does. Without this the two
+    // functions disagreed: a host added to `security.allowedPrivateHosts` passed
+    // the hostname check and was then blocked by the post-DNS check anyway, so
+    // the setting did nothing for the internal hosts it exists to permit.
+    if (_networkOverrides.allowAll)
+        return false;
+    if (_networkOverrides.allowedHosts?.has(candidate)
+        || _networkOverrides.allowedHosts?.has(ip.toLowerCase()))
+        return false;
+    if (_networkOverrides.blockedHosts?.has(candidate))
+        return true;
     if (PRIVATE_NETWORK_HOSTNAMES.has(candidate))
         return true;
     if (PRIVATE_NETWORK_CIDRS.some(re => re.test(candidate)))
         return true;
     return false;
 }
+/**
+ * Whether this exact hostname was named in `security.allowedPrivateHosts` (or
+ * network security was turned off wholesale). Callers that resolve DNS and
+ * re-check the resulting address need this: the operator allowed a *name*, and
+ * that name is expected to resolve into a private range.
+ */
+export function isHostExplicitlyAllowed(hostname) {
+    if (_networkOverrides.allowAll)
+        return true;
+    return _networkOverrides.allowedHosts?.has(hostname.toLowerCase()) ?? false;
+}
 export function isPrivateHost(hostname) {
     const lower = hostname.toLowerCase();
     if (_networkOverrides.allowAll)

package/dist/context-builder.js

@@ -4,6 +4,7 @@ import { collectGitInfo, gitInfoToContext } from './git-context.js';
 import { loadMemory, memoryToContext } from './project-memory.js';
 import { buildProjectIndex, indexToContext } from './project-index.js';
 import { loadScopedRules, rulesToContext } from './scoped-rules.js';
+import { readBoardFile, boardToContext } from './board-context.js';
 import { retrieveContext, snippetsToContext, RETRIEVAL_DEFAULTS } from './context-retriever.js';
 async function readJsonSafe(filePath) {
     try {
@@ -102,11 +103,12 @@ export async function buildProjectContext(cwd) {
     const scripts = await detectAvailableScripts(cwd);
     const projectType = await detectProjectType(cwd);
     // Gather context in parallel
-    const [gitCtx, memory, rules, projectConfig] = await Promise.all([
+    const [gitCtx, memory, rules, projectConfig, boardCtx] = await Promise.all([
         collectGitInfo(cwd).then(gitInfoToContext).catch(() => ''),
         loadMemory(cwd).then(memoryToContext).catch(() => ''),
         loadScopedRules(cwd).then(rulesToContext).catch(() => ''),
         loadProjectConfig(cwd),
+        readBoardFile(cwd).then(boardToContext).catch(() => ''),
     ]);
     // Project index (uses cache)
     let indexCtx = '';
@@ -121,6 +123,7 @@ export async function buildProjectContext(cwd) {
         projectIndex: indexCtx,
         projectMemory: memory,
         scopedRules: rules,
+        boardContext: boardCtx,
         availableScripts: scripts,
         projectConfig,
     };
@@ -145,6 +148,11 @@ export function contextToInstructions(baseInstructions, ctx) {
     if (ctx.projectMemory) {
         sections.push(ctx.projectMemory);
     }
+    // After memory (durable knowledge), before rules: the board is the freshest
+    // section and the one a member should act on first when they conflict.
+    if (ctx.boardContext) {
+        sections.push(ctx.boardContext);
+    }
     if (ctx.scopedRules) {
         sections.push(ctx.scopedRules);
     }

package/dist/feedback.js

@@ -0,0 +1,51 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { USER_CONFIG_DIR, VERSION } from './constants.js';
+import { logger } from './logger.js';
+const FEEDBACK_FILE = path.join(process.env.HOME || process.env.USERPROFILE || '.', USER_CONFIG_DIR, 'feedback.json');
+export async function saveFeedback(item) {
+    const fullItem = {
+        id: randomUUID(),
+        timestamp: new Date().toISOString(),
+        systemInfo: item.systemInfo || {
+            version: VERSION,
+            nodeVersion: process.version,
+            platform: os.platform(),
+            arch: os.arch(),
+        },
+        ...item,
+    };
+    try {
+        await fs.mkdir(path.dirname(FEEDBACK_FILE), { recursive: true });
+        let existing = [];
+        try {
+            const raw = await fs.readFile(FEEDBACK_FILE, 'utf-8');
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed))
+                existing = parsed;
+        }
+        catch { }
+        existing.unshift(fullItem);
+        // Keep last 100 feedback submissions locally
+        if (existing.length > 100)
+            existing = existing.slice(0, 100);
+        await fs.writeFile(FEEDBACK_FILE, JSON.stringify(existing, null, 2), { encoding: 'utf-8', mode: 0o600 });
+        logger.info('Feedback recorded locally', { id: fullItem.id, category: fullItem.category });
+    }
+    catch (err) {
+        logger.warn('Failed to persist feedback locally', { error: err.message });
+    }
+    return fullItem;
+}
+export async function listFeedback() {
+    try {
+        const raw = await fs.readFile(FEEDBACK_FILE, 'utf-8');
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}