scalix 1.5.0 → 1.5.2

package/dist/project-index.js

@@ -205,42 +205,65 @@ async function extractSymbols(filePath, relativePath) {
     }
 }
 // Import patterns for dependency tracking
-const IMPORT_PATTERNS = [
-    // JS/TS: import { x } from './y' or import x from './y' or require('./y')
-    { ext: new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']),
-        pattern: /(?:import\s+(?:{([^}]+)}\s+from\s+|(\w+)\s+from\s+)?['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\))/g },
-    // Python: from x import y or import x
-    { ext: new Set(['.py']),
-        pattern: /(?:from\s+([\w.]+)\s+import\s+([\w,\s*]+)|import\s+([\w.]+))/g },
-    // Go: import "x" or import ( "x" )
-    { ext: new Set(['.go']),
-        pattern: /import\s+(?:(?:\w+\s+)?"([^"]+)"|[\s\S]*?"([^"]+)")/g },
-    // Rust: use x::y
-    { ext: new Set(['.rs']),
-        pattern: /use\s+([\w:]+(?:::\{[^}]+\})?)/g },
-];
+const JS_TS_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
 function extractImports(content, relativePath, ext) {
     const imports = [];
-    for (const { ext: exts, pattern } of IMPORT_PATTERNS) {
-        if (!exts.has(ext))
-            continue;
-        const regex = new RegExp(pattern.source, pattern.flags);
+    if (JS_TS_EXTS.has(ext)) {
+        // Matches: import ... from '...'; import '...'; export ... from '...'; require('...')
+        const jsPattern = /(?:(?:import|export)\s+(?:type\s+)?(?:(?:\*\s+as\s+\w+|{([\s\S]*?)}|[\w\s,]+)\s+from\s+)?['"]([^'"]+)['"]|require\s*\(\s*['"]([^'"]+)['"]\s*\))/g;
         let match;
-        while ((match = regex.exec(content)) !== null) {
-            const modulePath = match[3] || match[4] || match[1] || match[5] || match[6] || '';
+        while ((match = jsPattern.exec(content)) !== null) {
+            const modulePath = match[2] || match[3] || '';
             if (!modulePath)
                 continue;
-            // Only track local imports (starting with . or relative paths)
             const isLocal = modulePath.startsWith('.') || modulePath.startsWith('/');
             if (!isLocal)
                 continue;
-            const importedSymbols = (match[1] || match[2] || '').split(',').map((s) => s.trim().split(/\s+as\s+/)[0]).filter(Boolean);
+            const symbolsRaw = match[1] || '';
+            const symbols = symbolsRaw
+                ? symbolsRaw.split(',').map((s) => s.trim().replace(/^type\s+/, '').split(/\s+as\s+/)[0].trim()).filter(Boolean)
+                : [];
             imports.push({
                 from: relativePath,
                 to: modulePath,
-                symbols: importedSymbols,
+                symbols,
             });
         }
+        return imports;
+    }
+    if (ext === '.py') {
+        const pyPattern = /(?:from\s+([\w.]+)\s+import\s+([\w,\s*]+)|import\s+([\w.]+))/g;
+        let match;
+        while ((match = pyPattern.exec(content)) !== null) {
+            const modulePath = match[1] || match[3] || '';
+            if (!modulePath || !modulePath.startsWith('.'))
+                continue;
+            const symbols = (match[2] || '').split(',').map((s) => s.trim()).filter(Boolean);
+            imports.push({ from: relativePath, to: modulePath, symbols });
+        }
+        return imports;
+    }
+    if (ext === '.go') {
+        const goPattern = /import\s+(?:(?:\w+\s+)?"([^"]+)"|[\s\S]*?"([^"]+)")/g;
+        let match;
+        while ((match = goPattern.exec(content)) !== null) {
+            const modulePath = match[1] || match[2] || '';
+            if (!modulePath || (!modulePath.startsWith('.') && !modulePath.startsWith('/')))
+                continue;
+            imports.push({ from: relativePath, to: modulePath, symbols: [] });
+        }
+        return imports;
+    }
+    if (ext === '.rs') {
+        const rsPattern = /use\s+((?:crate|super|self)::[\w:]+(?:::\{[^}]+\})?)/g;
+        let match;
+        while ((match = rsPattern.exec(content)) !== null) {
+            const modulePath = match[1] || '';
+            if (!modulePath)
+                continue;
+            imports.push({ from: relativePath, to: modulePath, symbols: [] });
+        }
+        return imports;
     }
     return imports;
 }

package/dist/sandbox.js

@@ -15,8 +15,15 @@ function normalizeSep(p) {
     return process.platform === 'win32' ? p.replace(/\//g, '\\') : p;
 }
 export function isWithinRoot(p, root) {
-    const np = normalizeSep(p).toLowerCase();
-    const nr = normalizeSep(root).toLowerCase();
+    // Case-fold only where the filesystem does. Folding on Linux made
+    // `/srv/Secret/x` test as inside `/srv/secret` — two genuinely different
+    // directories — which is an escape, not a convenience. macOS is usually
+    // case-insensitive but can be formatted otherwise; comparing exactly there
+    // can only reject a path that is really inside the root, which fails closed,
+    // and callers realpath first so the on-disk casing already agrees.
+    const fold = (s) => (IS_WINDOWS ? s.toLowerCase() : s);
+    const np = fold(normalizeSep(p));
+    const nr = fold(normalizeSep(root));
     return np === nr || np.startsWith(nr + path.sep);
 }
 // Resolve symlinks on the longest existing prefix of `resolved` synchronously.
@@ -83,24 +90,44 @@ export function sandboxPath(filePath) {
     }
     return real;
 }
+// Async twin of realpathLongestExistingPrefix.
+async function realpathLongestExistingPrefixAsync(resolved) {
+    let existing = resolved;
+    const remainder = [];
+    while (true) {
+        try {
+            // fs/promises has no realpath.native, so strip the prefix defensively.
+            const real = stripExtendedLengthPrefix(await fs.realpath(existing));
+            return remainder.length > 0 ? path.join(real, ...remainder) : real;
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+            const parent = path.dirname(existing);
+            if (parent === existing)
+                return resolved;
+            remainder.unshift(path.basename(existing));
+            existing = parent;
+        }
+    }
+}
 export async function sandboxPathAsync(filePath) {
     const root = getSandboxRoot();
     const resolved = path.resolve(root, filePath);
     if (!isWithinRoot(resolved, root)) {
         throw new Error(`Path traversal blocked: "${filePath}" resolves outside working directory`);
     }
-    try {
-        const real = await fs.realpath(resolved);
-        if (!isWithinRoot(real, realSandboxRoot(root))) {
-            throw new Error(`Symlink traversal blocked: "${filePath}" resolves to "${real}" outside working directory`);
-        }
-        return real;
-    }
-    catch (err) {
-        if (err.code === 'ENOENT')
-            return resolved;
-        throw err;
+    // The path usually does NOT exist yet — every write of a new file lands here.
+    // Returning `resolved` unchecked on ENOENT was the hole: only the leaf has to
+    // be missing for the check to be skipped, so `<root>/link/new.txt`, where
+    // `link` is a symlink to /etc, wrote straight out of the sandbox. Resolve the
+    // longest ancestor that does exist and verify containment on that, exactly as
+    // the sync path already does.
+    const real = await realpathLongestExistingPrefixAsync(resolved);
+    if (!isWithinRoot(real, realSandboxRoot(root))) {
+        throw new Error(`Symlink traversal blocked: "${filePath}" resolves to "${real}" outside working directory`);
     }
+    return real;
 }
 let _scopedRules = [];
 export function setScopedPermissionRules(rules) {
@@ -115,6 +142,12 @@ function parseScopedToolSpec(spec) {
         return { tool: match[1], prefix: match[2].replace(/\*$/, '') };
     return { tool: spec };
 }
+// A prefix rule describes the command it names, not everything that can be
+// stapled onto it. `run_command(git *)` was matching `git status; curl x | sh`
+// with a plain startsWith, so one allow rule for a read-only command handed
+// over arbitrary execution. Anything here means the text after the prefix is no
+// longer the command the rule was written about.
+const SHELL_CHAINING_RE = /[;&|<>\n\r`]|\$\(/;
 export function checkScopedPermission(toolName, args) {
     if (_scopedRules.length === 0)
         return null;
@@ -125,17 +158,40 @@ export function checkScopedPermission(toolName, args) {
             continue;
         if (parsed.tool !== toolName)
             continue;
-        if (!parsed.prefix)
-            return rule.action;
-        if (argStr && argStr.startsWith(parsed.prefix))
-            return rule.action;
+        const deny = rule.action === 'deny';
+        // deny is an OR over its conditions, allow is an AND. Both directions round
+        // toward refusing: a deny rule fires if anything it names matches, and an
+        // allow rule fires only if everything it names matches. Previously both
+        // were an OR that `prefix`-less rules short-circuited past entirely, so
+        // `{tool:'run_command', regex:'^git status$', action:'allow'}` allowed
+        // every command the tool could run — the regex was never consulted.
+        let prefixHit = null;
+        if (parsed.prefix) {
+            prefixHit = !!argStr && argStr.startsWith(parsed.prefix);
+            // Only allow rules need the chaining check; a deny that matched should
+            // keep matching however the command continues.
+            if (prefixHit && !deny && toolName === 'run_command'
+                && SHELL_CHAINING_RE.test(argStr.slice(parsed.prefix.length))) {
+                prefixHit = false;
+            }
+        }
+        let regexHit = null;
         if (rule.regex) {
             try {
-                if (new RegExp(rule.regex).test(argStr || ''))
-                    return rule.action;
+                regexHit = new RegExp(rule.regex).test(argStr || '');
+            }
+            catch {
+                // An unparseable pattern is a config error. Honouring it as a match on
+                // a deny rule over-blocks; ignoring it on an allow rule under-permits.
+                regexHit = deny;
             }
-            catch { }
         }
+        const conditions = [prefixHit, regexHit].filter((c) => c !== null);
+        const matched = conditions.length === 0
+            ? true // bare `run_command` — the whole tool
+            : deny ? conditions.some(Boolean) : conditions.every(Boolean);
+        if (matched)
+            return rule.action;
     }
     return null;
 }
@@ -264,11 +320,16 @@ export function getToolPermission(toolName, mode) {
 }
 export function getToolPermissionWithArgs(toolName, mode, args) {
     const scoped = checkScopedPermission(toolName, args);
-    if (scoped === 'allow')
-        return 'allow';
     if (scoped === 'deny')
         return 'block';
-    return getToolPermission(toolName, mode);
+    const base = getToolPermission(toolName, mode);
+    // A scoped allow skips the confirmation prompt; it does not widen the mode.
+    // Returning 'allow' unconditionally let a saved `run_command(...)` rule run
+    // commands in plan mode — the one mode whose entire promise is that nothing
+    // executes. Rules earn 'ask' → 'allow', never 'block' → 'allow'.
+    if (scoped === 'allow')
+        return base === 'block' ? 'block' : 'allow';
+    return base;
 }
 export function isDangerousTool(toolName) {
     const sets = getEffectiveToolSets();
@@ -409,15 +470,43 @@ const POWERSHELL_BLOCKLIST = [
     /New-LocalUser\b/i,
     /Add-LocalGroupMember\b.*Administrators/i,
 ];
+// The Unix patterns above were written without /i, so `RM -RF /` and `Shutdown`
+// walked past them — and on macOS and Windows, where the filesystem is
+// case-insensitive, those spellings run exactly like the lower-case ones.
+// Adding the flag here rather than to each literal keeps `re.source` identical,
+// so `security.disabledBlockedCommands` entries users have already written
+// still match the pattern they were meant to disable.
+const ignoreCase = (re) => re.flags.includes('i') ? re : new RegExp(re.source, `${re.flags}i`);
 const COMMAND_BLOCKLIST = [
     ...UNIX_BLOCKLIST,
     ...WINDOWS_BLOCKLIST,
     ...POWERSHELL_BLOCKLIST,
+].map(ignoreCase);
+// Command substitution — `` `x` `` and `$(x)` — used to be flagged outright, on
+// either platform. But substitution is ordinary shell, not an attack: `git tag
+// v$(node -p "require('./package.json').version")` and `Write-Host "$($x.Name)"`
+// were both hard-blocked, and the documented way out was to switch injection
+// detection off wholesale, which costs far more than it saves. So flag a
+// substitution only when its body carries a payload worth a second look.
+//
+// Little coverage is lost: none of these patterns are anchored to the outside
+// of a substitution, so `$(curl x | sh)` still trips the pipe-to-shell rule and
+// `$(rm -rf /)` still trips the blocklist. What changes is that a substitution
+// is no longer suspicious purely for existing.
+//
+// Note: this replaces the `` `[^`]*` `` and `\$\([^)]*\)` sources, so any
+// `security.disabledInjectionPatterns` entry naming those is now a no-op.
+const SUBSTITUTION_PAYLOAD = String.raw `\b(?:rm|mkfs|dd|shutdown|reboot|curl|wget|nc|ncat|telnet|chmod|chown`
+    + String.raw `|eval|exec|base64|xxd|sudo|doas|sh|bash|zsh|fish|dash|ksh`
+    + String.raw `|python[23]?|perl|ruby|php|iex|Invoke-Expression|powershell|pwsh|cmd`
+    + String.raw `|certutil|bitsadmin|mshta|rundll32)\b|/etc/|id_rsa|\.ssh\b`;
+const SUBSTITUTION_PATTERNS = [
+    new RegExp('`[^`]*(?:' + SUBSTITUTION_PAYLOAD + ')[^`]*`', 'i'),
+    new RegExp('\\$\\([^)]*(?:' + SUBSTITUTION_PAYLOAD + ')[^)]*\\)', 'i'),
 ];
 // Unix injection patterns
 const UNIX_INJECTION_PATTERNS = [
-    /`[^`]*`/,
-    /\$\([^)]*\)/,
+    ...SUBSTITUTION_PATTERNS,
     /;\s*(rm|mkfs|dd|shutdown|reboot|curl|wget)\b/,
     /\|\s*(ba)?sh\b/,
     /\beval\s+/,
@@ -430,7 +519,6 @@ const UNIX_INJECTION_PATTERNS = [
 // Windows/PowerShell injection patterns
 const WINDOWS_INJECTION_PATTERNS = [
     /&\s*\{[^}]*\}/,
-    /\$\([^)]*\)/,
     /;\s*(del|rd|rmdir|format|diskpart|net\s+user|reg\s+delete)\b/i,
     /\|\s*powershell\b/i,
     /\|\s*pwsh\b/i,
@@ -445,7 +533,7 @@ const WINDOWS_INJECTION_PATTERNS = [
 const INJECTION_PATTERNS = [
     ...UNIX_INJECTION_PATTERNS,
     ...WINDOWS_INJECTION_PATTERNS,
-];
+].map(ignoreCase);
 const SENSITIVE_ENV_PATTERNS = [
     /API_KEY/i, /SECRET/i, /TOKEN/i, /PASSWORD/i, /CREDENTIAL/i, /AUTH/i, /PRIVATE/i,
     // Broad substrings that commonly carry secrets or connection strings.

package/dist/sessions.js

@@ -92,6 +92,18 @@ export async function listSessions() {
     }
     return sessions.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
 }
+export async function renameSession(id, newName) {
+    const session = await loadSession(id);
+    const trimmed = newName.trim();
+    if (trimmed) {
+        session.meta.name = trimmed;
+        session.meta.updatedAt = new Date().toISOString();
+    }
+    const tmpPath = path.join(SESSIONS_DIR, `scalix-session-${id}-${Date.now()}-${randomUUID().slice(0, 8)}.tmp`);
+    await fs.writeFile(tmpPath, JSON.stringify(session, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    await fs.rename(tmpPath, sessionPath(id));
+    return session.meta;
+}
 export async function deleteSession(id) {
     try {
         await fs.unlink(sessionPath(id));

package/dist/settings.js

@@ -91,6 +91,10 @@ function validateConfig(parsed) {
                 typeof s.contextWindow === 'number' && s.contextWindow > 0 &&
                 typeof s.maxOutputTokens === 'number' && s.maxOutputTokens > 0) {
                 validated[id] = { contextWindow: s.contextWindow, maxOutputTokens: s.maxOutputTokens };
+                // Keep the vision flag — dropping it made every user-declared vision
+                // model report supportsVision === false and silently strip images.
+                if (s.supportsVision === true)
+                    validated[id].supportsVision = true;
             }
         }
         if (Object.keys(validated).length > 0) {
@@ -387,6 +391,22 @@ export async function loadConfig() {
         return config;
     }
 }
+/**
+ * The GLOBAL config file only — no project-local settings.local.json, no
+ * managed-policy merge, no keychain resolution. This is the ONLY correct base
+ * for a read-modify-write persistence cycle: round-tripping loadConfig()
+ * (which merges overrides) through saveConfig() laundered project-local
+ * models/limits/customModels into ~/.scalix-coder/config.json permanently.
+ */
+export async function loadGlobalConfig() {
+    try {
+        const raw = await fs.readFile(getConfigFile(), 'utf-8');
+        return { ...DEFAULTS, ...validateConfig(JSON.parse(raw)) };
+    }
+    catch {
+        return { ...DEFAULTS };
+    }
+}
 export async function saveConfig(config) {
     await ensureDir();
     // Store API keys in keychain if available, strip from config file. The
@@ -436,23 +456,34 @@ export const OPENAI_KEYCHAIN_ACCOUNT = 'api-key-openai';
  * path is byte-identical to the pre-BYOK behavior. There is NO default
  * third-party URL — an openai selection without a baseUrl resolves with an
  * empty one and the caller surfaces the configuration error.
+ *
+ * Scalix Cloud credentials resolve separately so BYOK sessions keep the
+ * platform tools: under `openai` they come from `SCALIX_CLOUD_API_KEY` →
+ * `SCALIX_API_KEY` → the top-level `config.apiKey`, and are simply empty when
+ * the user never added one.
  */
 export function resolveActiveProvider(config, env = process.env) {
     const envProvider = env.SCALIX_PROVIDER?.trim().toLowerCase();
     const provider = isProviderId(envProvider)
         ? envProvider
         : (config.provider ?? 'scalix');
+    const scalixBaseUrl = env.SCALIX_BASE_URL?.trim() || config.baseUrl;
+    const scalixApiKey = env.SCALIX_API_KEY?.trim() || config.apiKey;
     if (provider === 'openai') {
         const creds = config.providers?.openai ?? {};
         return {
             provider,
             baseUrl: env.OPENAI_BASE_URL?.trim() || creds.baseUrl || '',
             apiKey: env.OPENAI_API_KEY?.trim() || creds.apiKey || '',
+            cloudBaseUrl: env.SCALIX_CLOUD_BASE_URL?.trim() || scalixBaseUrl,
+            cloudApiKey: env.SCALIX_CLOUD_API_KEY?.trim() || scalixApiKey || '',
         };
     }
     return {
         provider: 'scalix',
-        baseUrl: env.SCALIX_BASE_URL?.trim() || config.baseUrl,
-        apiKey: env.SCALIX_API_KEY?.trim() || config.apiKey,
+        baseUrl: scalixBaseUrl,
+        apiKey: scalixApiKey,
+        cloudBaseUrl: scalixBaseUrl,
+        cloudApiKey: scalixApiKey,
     };
 }

package/dist/slash-commands.js

@@ -16,16 +16,19 @@ export const SLASH_COMMANDS = [
     { cmd: '/mode', desc: 'Permission mode (plan/default/auto/yolo)' },
     { cmd: '/thinking', desc: 'Thinking mode (off/low/medium/high)' },
     { cmd: '/plan', desc: 'Enter plan mode (read-only)' },
+    { cmd: '/preset', desc: 'Set agent preset (persona)' },
     { cmd: '/compact', desc: 'Compress conversation context' },
     { cmd: '/context', desc: 'Show context usage & token count' },
     { cmd: '/cost', desc: 'Show token usage & cost' },
     { cmd: '/diff', desc: 'Show uncommitted changes' },
     { cmd: '/copy', desc: 'Copy last response to clipboard' },
     { cmd: '/save', desc: 'Save current session' },
+    { cmd: '/rename', desc: 'Rename current chat session' },
     { cmd: '/load', desc: 'Resume a saved session' },
     { cmd: '/resume', desc: 'Resume from crash recovery or saved session' },
     { cmd: '/fork', desc: 'Fork conversation from a point in history' },
     { cmd: '/export', desc: 'Export conversation as text' },
+    { cmd: '/feedback', desc: 'Submit user feedback & ratings' },
     { cmd: '/index', desc: 'Scan & index project files' },
     { cmd: '/init', desc: 'Initialize project config (SCALIX.md)' },
     { cmd: '/git', desc: 'Show git context' },
@@ -69,6 +72,7 @@ export const HELP_LINES = [
     '  /shortcuts    \u2014 keyboard shortcuts',
     '  /clear        \u2014 reset conversation',
     '  /save [name]  \u2014 save current session',
+    '  /rename [name]\u2014 rename current session',
     '  /load         \u2014 resume a saved session',
     '  /resume       \u2014 resume from crash recovery or saved session',
     '  /fork         \u2014 fork conversation from a point in history',
@@ -81,6 +85,7 @@ export const HELP_LINES = [
     '  /mode [m]     \u2014 permission mode (plan/default/auto/yolo)',
     '  /thinking [m] \u2014 thinking mode (off/low/medium/high)',
     '  /plan         \u2014 enter plan mode (read-only)',
+    '  /preset [p]   \u2014 set agent preset (cloud-architect/dba/devops/full-access)',
     '',
     'Context & Cost:',
     '  /compact      \u2014 compress conversation context',
@@ -109,6 +114,7 @@ export const HELP_LINES = [
     '',
     'Tools & Config:',
     '  /copy         \u2014 copy last response to clipboard',
+    '  /feedback [m] \u2014 submit user feedback',
     '  /cloud        \u2014 Scalix Cloud status (/cloud tools, /cloud refresh)',
     '  /login        \u2014 link your Scalix account (API key)',
     '  /status       \u2014 show version, model & connection info',

package/dist/sub-agent.js

@@ -1,6 +1,7 @@
 import { createAgent } from './agent.js';
 import { defaultTools } from './tools.js';
 import { extraTools } from './tools-extra.js';
+import { memoryTools } from './tools-memory.js';
 import { webTools } from './tools-web.js';
 import { advancedTools } from './tools-advanced.js';
 import { logger } from './logger.js';
@@ -15,10 +16,10 @@ import { createWorktree, removeWorktree, mergeWorktree } from './worktree.js';
 const READ_ONLY_TOOL_NAMES = new Set([
     'get_current_time', 'calculate', 'read_file', 'read_file_lines',
     'list_files', 'search_files', 'find_files', 'tree',
-    'git_status', 'git_diff', 'web_search', 'monitor',
+    'git_status', 'git_diff', 'web_search', 'monitor', 'get_memory',
 ]);
 function selectTools(level, allowAgentTool = false) {
-    const all = [...defaultTools, ...extraTools, ...webTools, ...advancedTools]
+    const all = [...defaultTools, ...extraTools, ...memoryTools, ...webTools, ...advancedTools]
         .filter((t) => {
         const name = t.function?.name || t.name;
         if (name === 'agent' && !allowAgentTool)