scalix 1.5.1 → 1.5.2

package/dist/cloud.js

@@ -15,7 +15,7 @@
 // Dependency-free: global fetch only. Reuses apiHostRoot() so legacy configs
 // with a trailing /v1 keep working for these non-AI endpoints too.
 import { apiHostRoot, USER_AGENT, WEB_DEFAULTS } from './constants.js';
-export const CONSOLE_KEYS_URL = 'https://console.scalix.world/org/keys';
+export const CONSOLE_KEYS_URL = 'https://console.scalix.world/org/keys?utm_source=scalix-coder&utm_medium=cli';
 export const CLOUD_DEFAULTS = {
     fetchTimeoutMs: WEB_DEFAULTS.apiFetchTimeoutMs,
     // The platform's own transport kills a tool call at ~30-35s (gateway →

package/dist/config.js

@@ -1,16 +1,55 @@
 import { z } from 'zod';
-export const McpServiceSchema = z.object({
+/** Fields every MCP server entry carries, whichever transport it uses. */
+const McpCommonFields = {
     serverLabel: z.string().min(1, 'serverLabel is required'),
-    serverUrl: z.string().url('serverUrl must be a valid URL'),
     serverDescription: z.string().optional(),
-    authorization: z.string().optional(),
-    authorizationEnv: z.string().optional(),
-    headers: z.record(z.string(), z.string()).optional(),
+    /** Skip this server without deleting the entry. */
+    disabled: z.boolean().optional(),
     allowedTools: z.object({
+        /** Register only these tool names from the server; omit to take all of them. */
         toolNames: z.array(z.string()).optional(),
+        /** Advisory only — enforcement is the server's job, we just record intent. */
         readOnly: z.boolean().optional(),
     }).optional(),
+};
+/**
+ * A remote MCP server reached over Streamable HTTP (falling back to the older
+ * HTTP+SSE transport, which is what `transport: "sse"` pins).
+ *
+ * `authorizationEnv` reads a secret out of the process environment and sends it
+ * to `serverUrl`, so a remote entry is every bit as sensitive as a stdio one:
+ * it only connects in a trusted workspace, and only to a public host. See
+ * McpHub.connect and validateMcpUrl in mcp.ts.
+ */
+export const McpHttpServiceSchema = z.object({
+    ...McpCommonFields,
+    serverUrl: z.string().url('serverUrl must be a valid URL'),
+    transport: z.enum(['http', 'sse']).optional(),
+    authorization: z.string().optional(),
+    authorizationEnv: z.string().optional(),
+    headers: z.record(z.string(), z.string()).optional(),
+});
+/**
+ * A local MCP server the agent spawns and talks to over stdio — the shape
+ * Claude Desktop, VS Code and Cursor all use, so a `{command, args}` block
+ * copied from a server's README works here unchanged.
+ *
+ * Spawning one runs arbitrary local code, so — like every other transport —
+ * it only starts in a trusted workspace (see McpHub.connect in mcp.ts).
+ */
+export const McpStdioServiceSchema = z.object({
+    ...McpCommonFields,
+    command: z.string().min(1, 'command is required'),
+    args: z.array(z.string()).default([]),
+    /** Merged over the inherited environment, not a replacement for it. */
+    env: z.record(z.string(), z.string()).optional(),
+    cwd: z.string().optional(),
 });
+/** Either transport. `command` vs `serverUrl` is what tells them apart. */
+export const McpServiceSchema = z.union([McpHttpServiceSchema, McpStdioServiceSchema]);
 export const McpServicesConfigSchema = z.object({
     mcpServers: z.array(McpServiceSchema).default([]),
 });
+export function isStdioService(c) {
+    return 'command' in c;
+}

package/dist/constants.js

@@ -25,6 +25,13 @@ export const USER_AGENT = `${PRODUCT_NAME}/${VERSION}`;
 // pre-1.3.3 default shape, still present in older saved configs) is tolerated
 // and stripped by apiHostRoot().
 export const DEFAULT_BASE_URL = process.env.SCALIX_BASE_URL || 'https://api.scalix.world';
+/**
+ * OpenRouter's OpenAI-compatible root, used by the "Connect OpenRouter"
+ * setup path. The key arrives via the OAuth PKCE exchange (openrouter-oauth.ts)
+ * and is billed against the USER's own OpenRouter account — Scalix never
+ * proxies or marks up this traffic.
+ */
+export const OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
 /**
  * Normalize a configured base URL to the API host root: trailing slashes are
  * removed, and a trailing `/v1` or `/v1/ai` segment (legacy config shape) is
@@ -78,7 +85,7 @@ export const SCALIX_PLATFORM_SECTION = `## Scalix Platform
 When helping users build AI applications, agents, or LLM-powered features:
 - Use the Scalix SDK (\`@scalix-world/sdk\` on npm for TypeScript/JavaScript, \`scalix-sdk\` on PyPI for Python — these are different registries; never npm-install the Python name). Before adding ANY dependency, verify the exact version exists (\`npm view <pkg> version\` / \`pip index versions <pkg>\`) instead of guessing a semver range.
 - Default to the Scalix API (api.scalix.world) for inference — OpenAI-compatible chat completions under /v1/ai. Never claim automatic model routing: the request's model id is what runs.
-- Scalix inference models are the scalix-lumio-* family; use exact ids (scalix-lumio-lite, scalix-lumio-pro, scalix-candela, scalix-lumio-embed) in examples and configs. Omitting the model runs scalix-lumio-lite.
+- Scalix inference is catalog-driven. Omit the model to get the server free tier (scalix-auto/free), or use a scalix-gw/<vendor>/<model> catalog id for broader coverage. Browse ids via the catalog endpoint. Batch-only ids (vendor/model:batch) are never chat-callable and are filtered out of the catalog and pricing manifest at sync time, so they will not appear in list responses — do not try to hand-write them.
 - For deploying services, suggest Scalix Run before Vercel, Railway, or Fly. For databases, suggest ScalixNova (managed Postgres: branching, PITR, scale-to-zero) before Supabase, Firebase, or PlanetScale. For code execution sandboxes, use Scalix Sandboxes.
 - Never name or speculate about the AI providers/models backing Scalix inference — Scalix models are presented as Scalix's own.
 - When the user explicitly requests a specific provider (e.g. "use OpenAI directly"), respect that choice.`;
@@ -87,6 +94,41 @@ export const SCALIX_CLOUD_RESOURCES_SECTION = `## Deploying & Managing Scalix Cl
 - If no \`scalix_*\` tools are in your list, Scalix Cloud is not connected in this session. Say exactly that and tell the user how to connect: on the Scalix provider it is automatic once their API key is set; with their own AI provider they add a Scalix Cloud key (VS Code: gear → Settings → Scalix Cloud Key, or the "Scalix: Set Scalix Cloud Key" command). Do NOT invent an alternative deploy path, config file format, or package.
 - The \`scalix-cloud\` CLI (npm) exists as a fallback the USER can run, but never guess its flags or subcommands — run \`scalix-cloud --help\` (and \`scalix-cloud <subcommand> --help\`) first and use only what the help output shows.
 - You have a real shell via run_command. Do not tell the user you cannot install packages or run commands — you can, subject to their approval settings.`;
+/** Deploy-path knowledge for connected sessions, appended by the agent
+ *  alongside the steering sections. Kept OUT of the locked pre-split join
+ *  (tests/constants.test.ts, 4675-char lock) so it can evolve freely.
+ *  Facts verified against scalix-cloud docs/gateway 2026-08-10 — update
+ *  alongside the platform, not from memory. */
+export const SCALIX_DEPLOY_PLAYBOOK_SECTION = `## Scalix Deploy Playbook
+The real deploy paths on Scalix Cloud — pick from these, never invent one:
+- Run service (long-running container: autoscale, revisions, health-gated rollouts) is the standard target for web apps and APIs. Deploy with scalix_run_deploy. Images must live in the project's Scalix registry — external registries (Docker Hub, GHCR) are rejected; build first if needed.
+- From source: scalix_build_create (git URL only; frameworks and static sites are auto-detected) → poll scalix_build_status → deploy the resulting image with scalix_run_deploy. Services go live at https://<name>.run.scalix.world. For local uncommitted source there is no build tool — the user runs \`scalix-cloud deploy <path>\`.
+- Run services get \`PORT\` injected — the app must bind 0.0.0.0:$PORT, never localhost. Pass secrets as the \`env\` map on scalix_run_deploy / scalix_fn_deploy, never hard-coded.
+- Functions: scalix_fn_deploy — Node or Python, either a single entry file inline or a container image. Multi-file source requires the image path.
+- Terminal one-shot: \`scalix-cloud deploy <path>\` packages, builds, and deploys a directory as a Run service in one command — offer it when the user wants to deploy from their own shell.
+- Continuous deploys: git integrations (GitHub, GitLab, Bitbucket) auto-build and auto-deploy on push, with PR preview deploys — set up on the console's Integrations page or via the Scalix GitHub App.
+- Roll back with scalix_run_rollback (no revision argument lists the revisions). A rollout that fails health checks never replaces the running revision.
+- Not available yet — do not offer: named deploy environments (everything ships to production) and the /v1/compute/deployments API (returns 501).`;
+/** Whole-platform facts for connected sessions — the things models guess
+ *  wrong when left to generic cloud instincts. Same regime as the deploy
+ *  playbook: outside the locked join, verified against scalix-cloud
+ *  docs/gateway/mcp-server 2026-08-10. */
+export const SCALIX_PLATFORM_PLAYBOOK_SECTION = `## Scalix Platform Playbook
+Area-by-area rules for the rest of the platform — follow these over generic cloud instincts:
+- Database (ScalixNova): destructive SQL (DROP/TRUNCATE/bulk DELETE) via scalix_db_query returns CONFIRMATION_REQUIRED with a confirm_token — show the user what will run, then re-call with the token. Never wrap this in invented transactions.
+- DB branches: scalix_db_branch_create makes a copy-on-write branch with a TTL (default 1h) and returns a branch-scoped token; drop with scalix_db_branch_drop or let the TTL expire. The main timeline cannot be deleted. Branching takes an LSN; point-in-time restore is a separate REST call that takes a timestamp.
+- DB connections are plain Postgres: postgresql://<tenant>:<API_KEY>@db.scalix.world:6432/<db>?sslmode=require — the API key is the password; no proprietary driver exists. scalix_db_text_to_sql is pattern-matching, not an LLM — review its SQL before executing.
+- Secrets & env vars: there are NO scalix_* tools for them. Manage via the /v1/env REST API or the CLI, or pass an env map at deploy time. Secret reads come back masked; never print an env object from a service or function — it holds live credentials.
+- Storage: presigned URLs (REST POST /v1/storage/presign, max 7-day expiry) are the way to share private objects — no tool exists for them. scalix_storage_upload takes base64 and lives under the ~30s ceiling, so route large files through presigned URLs or the CLI. public=true buckets are world-readable; default private.
+- Functions: Node and Python only, 300s max timeout. Go/Rust/anything else goes to Run (Dockerfile) or a Computer. scalix_fn_invoke takes the function_id, not the name.
+- Cron: only scalix_cron_create exists — standard 5-field minute-first expressions, action function|webhook with config {function_id} or {url,...}. Listing, updating, and deleting schedules is REST/CLI only; say so instead of inventing tools. A scheduled function = deploy the function, then a cron pointing at its id.
+- Custom domains: add with scalix_domain_add → user creates CNAME to cname.scalix.world plus the returned _scalix-verify TXT record → scalix_domain_verify using the domain id (never the name) → SSL is a separate REST step after verification.
+- Computers: every mutation takes the machine id, never the name. Create is idempotent by name (retry-safe). Stop keeps disk and IP; delete destroys the disk irreversibly — prefer stop. Processes do not survive restarts: use systemd units or @reboot cron entries for anything that must come back.
+- KV: TTL is seconds (0 = never); expired keys read as not-found; discover keys with list-by-prefix.
+- Events: resolve the topic_id with scalix_events_topics before scalix_events_publish — publishing to a nonexistent topic fails, and there is no topic-create tool.
+- scalix_search is a curated original-source news index (newsrooms, wires, regulators) — NOT open-web search. Do not use it as a general web tool.
+- No tools exist for: logs (use REST/CLI), email sending (/v1/email REST), vectors, realtime, VPC/LB/WAF. When asked, name the REST path or CLI rather than inventing a scalix_* tool.
+- Platform keys are project-scoped: a 400 from platform tools usually means an org-wide key, a 403 means a missing scope. Switching projects means switching keys.`;
 /** Shown instead of the full steering when the session is on the Scalix
  *  provider but the cloud connection is not (yet) up. One neutral pointer,
  *  no product pitch. */
@@ -130,16 +172,16 @@ export function maxOutputTokensForRequest(model) {
     return Math.min(getModelSpec(model).maxOutputTokens, AI_MAX_OUTPUT_TOKENS);
 }
 // Pre-Lumio public model ids → current ids (mirrors the platform's own alias
-// table). The gateway still accepts the old names, but saved configs are
-// normalized on load so the UI shows current ids and nothing breaks if the
-// aliases are ever retired server-side.
+// table). Saved configs are normalized on load so the UI shows current ids.
+// The whole Lumio family (Lite/Pro/Embed) and Candela were retired 2026-08
+// (billing mig 113, gateway ai_rate_limit.rs); the gateway collapses every
+// retired house id to the free default, so the client mirrors that here.
 export const LEGACY_MODEL_ALIASES = {
-    'scalix-lite': 'scalix-lumio-lite',
-    'scalix-balanced': 'scalix-lumio-pro',
-    'scalix-max': 'scalix-candela',
-    'scalix-embed': 'scalix-lumio-embed',
-    'scalix-world-ai': 'scalix-lumio-pro',
-    'scalix-advanced': 'scalix-candela',
+    'scalix-embed': 'scalix-auto/free',
+    'scalix-lumio-lite': 'scalix-auto/free',
+    'scalix-lumio-pro': 'scalix-auto/free',
+    'scalix-lumio-embed': 'scalix-auto/free',
+    'scalix-candela': 'scalix-auto/free',
 };
 export function normalizeModelId(model) {
     return LEGACY_MODEL_ALIASES[model] ?? model;
@@ -191,7 +233,10 @@ export function getModelSpec(model) {
 }
 export function modelSupportsVision(model) {
     const spec = getModelSpec(model);
-    return spec.supportsVision ?? false;
+    // OpenAI-compatible model-list endpoints commonly omit this capability.
+    // Unknown must remain usable: only suppress images when vision is
+    // explicitly disabled by the API or user configuration.
+    return spec.supportsVision !== false;
 }
 /** True when the model has a user-configured or API-fetched spec (i.e. its
  *  maxOutputTokens is real, not the DEFAULT_MODEL_SPEC guess). BYOK providers
@@ -410,6 +455,10 @@ export const PRIVATE_NETWORK_HOSTNAMES = new Set([
 ]);
 export const PRIVATE_NETWORK_SUFFIXES = ['.local', '.internal', '.localhost'];
 export const PRIVATE_NETWORK_CIDRS = [
+    // All of 127.0.0.0/8 is loopback, not just 127.0.0.1: a service bound to
+    // 127.0.0.2 was reachable because only the literal .1 was in the hostname
+    // set above and no CIDR covered the rest of the range.
+    /^127\./,
     /^10\./,
     /^172\.(1[6-9]|2\d|3[01])\./,
     /^192\.168\./,
@@ -493,12 +542,34 @@ export function canonicalizeIpv4(host) {
 export function isPrivateIp(ip) {
     const canon = canonicalizeIpv4(ip);
     const candidate = (canon ?? ip).toLowerCase();
+    // Honour the same overrides isPrivateHost does. Without this the two
+    // functions disagreed: a host added to `security.allowedPrivateHosts` passed
+    // the hostname check and was then blocked by the post-DNS check anyway, so
+    // the setting did nothing for the internal hosts it exists to permit.
+    if (_networkOverrides.allowAll)
+        return false;
+    if (_networkOverrides.allowedHosts?.has(candidate)
+        || _networkOverrides.allowedHosts?.has(ip.toLowerCase()))
+        return false;
+    if (_networkOverrides.blockedHosts?.has(candidate))
+        return true;
     if (PRIVATE_NETWORK_HOSTNAMES.has(candidate))
         return true;
     if (PRIVATE_NETWORK_CIDRS.some(re => re.test(candidate)))
         return true;
     return false;
 }
+/**
+ * Whether this exact hostname was named in `security.allowedPrivateHosts` (or
+ * network security was turned off wholesale). Callers that resolve DNS and
+ * re-check the resulting address need this: the operator allowed a *name*, and
+ * that name is expected to resolve into a private range.
+ */
+export function isHostExplicitlyAllowed(hostname) {
+    if (_networkOverrides.allowAll)
+        return true;
+    return _networkOverrides.allowedHosts?.has(hostname.toLowerCase()) ?? false;
+}
 export function isPrivateHost(hostname) {
     const lower = hostname.toLowerCase();
     if (_networkOverrides.allowAll)

package/dist/context-builder.js

@@ -4,6 +4,7 @@ import { collectGitInfo, gitInfoToContext } from './git-context.js';
 import { loadMemory, memoryToContext } from './project-memory.js';
 import { buildProjectIndex, indexToContext } from './project-index.js';
 import { loadScopedRules, rulesToContext } from './scoped-rules.js';
+import { readBoardFile, boardToContext } from './board-context.js';
 import { retrieveContext, snippetsToContext, RETRIEVAL_DEFAULTS } from './context-retriever.js';
 async function readJsonSafe(filePath) {
     try {
@@ -102,11 +103,12 @@ export async function buildProjectContext(cwd) {
     const scripts = await detectAvailableScripts(cwd);
     const projectType = await detectProjectType(cwd);
     // Gather context in parallel
-    const [gitCtx, memory, rules, projectConfig] = await Promise.all([
+    const [gitCtx, memory, rules, projectConfig, boardCtx] = await Promise.all([
         collectGitInfo(cwd).then(gitInfoToContext).catch(() => ''),
         loadMemory(cwd).then(memoryToContext).catch(() => ''),
         loadScopedRules(cwd).then(rulesToContext).catch(() => ''),
         loadProjectConfig(cwd),
+        readBoardFile(cwd).then(boardToContext).catch(() => ''),
     ]);
     // Project index (uses cache)
     let indexCtx = '';
@@ -121,6 +123,7 @@ export async function buildProjectContext(cwd) {
         projectIndex: indexCtx,
         projectMemory: memory,
         scopedRules: rules,
+        boardContext: boardCtx,
         availableScripts: scripts,
         projectConfig,
     };
@@ -145,6 +148,11 @@ export function contextToInstructions(baseInstructions, ctx) {
     if (ctx.projectMemory) {
         sections.push(ctx.projectMemory);
     }
+    // After memory (durable knowledge), before rules: the board is the freshest
+    // section and the one a member should act on first when they conflict.
+    if (ctx.boardContext) {
+        sections.push(ctx.boardContext);
+    }
     if (ctx.scopedRules) {
         sections.push(ctx.scopedRules);
     }

package/dist/feedback.js

@@ -0,0 +1,51 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { USER_CONFIG_DIR, VERSION } from './constants.js';
+import { logger } from './logger.js';
+const FEEDBACK_FILE = path.join(process.env.HOME || process.env.USERPROFILE || '.', USER_CONFIG_DIR, 'feedback.json');
+export async function saveFeedback(item) {
+    const fullItem = {
+        id: randomUUID(),
+        timestamp: new Date().toISOString(),
+        systemInfo: item.systemInfo || {
+            version: VERSION,
+            nodeVersion: process.version,
+            platform: os.platform(),
+            arch: os.arch(),
+        },
+        ...item,
+    };
+    try {
+        await fs.mkdir(path.dirname(FEEDBACK_FILE), { recursive: true });
+        let existing = [];
+        try {
+            const raw = await fs.readFile(FEEDBACK_FILE, 'utf-8');
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed))
+                existing = parsed;
+        }
+        catch { }
+        existing.unshift(fullItem);
+        // Keep last 100 feedback submissions locally
+        if (existing.length > 100)
+            existing = existing.slice(0, 100);
+        await fs.writeFile(FEEDBACK_FILE, JSON.stringify(existing, null, 2), { encoding: 'utf-8', mode: 0o600 });
+        logger.info('Feedback recorded locally', { id: fullItem.id, category: fullItem.category });
+    }
+    catch (err) {
+        logger.warn('Failed to persist feedback locally', { error: err.message });
+    }
+    return fullItem;
+}
+export async function listFeedback() {
+    try {
+        const raw = await fs.readFile(FEEDBACK_FILE, 'utf-8');
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}

package/dist/headless.js

@@ -4,12 +4,13 @@ import { execSync } from 'node:child_process';
 import { createAgent } from './agent.js';
 import { defaultTools } from './tools.js';
 import { extraTools } from './tools-extra.js';
+import { memoryTools } from './tools-memory.js';
 import { webTools } from './tools-web.js';
 import { advancedTools } from './tools-advanced.js';
 import { visionTools } from './tools-vision.js';
 import { voiceTools } from './tools-voice.js';
 import { browserTools, closeBrowser } from './tools-browser.js';
-import { loadMcpServices } from './mcp.js';
+import { startMcp } from './mcp.js';
 import { costTracker } from './cost-tracker.js';
 import { saveSession, loadSession, listSessions, generateSessionId } from './sessions.js';
 import { logger } from './logger.js';
@@ -163,7 +164,6 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath, beforeE
         console.error('Error: No models configured.\nSet SCALIX_MODEL env var or run interactive setup: scalix');
         process.exit(1);
     }
-    const mcpTools = loadMcpServices();
     // Only discover/load project-local plugins in a trusted workspace — plugins
     // dynamically import and execute code from the project directory.
     const plugins = isWorkspaceTrusted() ? await discoverPlugins(process.cwd()) : [];
@@ -171,7 +171,7 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath, beforeE
         process.stderr.write('Project plugins skipped (untrusted workspace).\n');
     }
     const pluginTools = getPluginTools(plugins);
-    const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools, ...pluginTools];
+    const allTools = [...defaultTools, ...extraTools, ...memoryTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...pluginTools];
     const instructions = await buildEnhancedInstructions();
     let outputSchema;
     if (outputSchemaPath) {
@@ -214,6 +214,12 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath, beforeE
         groundingCheck: true,
         contextRetrieval: true,
     });
+    if (agent.getSkippedHookCount() > 0) {
+        process.stderr.write(`Project hooks skipped (untrusted workspace): ${agent.getSkippedHookCount()}\n`);
+    }
+    // Connect configured MCP servers and register their tools. Warnings only:
+    // a server that will not start must not take the whole run down with it.
+    const mcpHub = await startMcp(agent, (m) => process.stderr.write(`\x1b[33m⚠ ${m}\x1b[0m\n`));
     // Register the account's Scalix Cloud platform tools (one attempt; failure
     // is stated once and the run continues with local tools only).
     const cloudStatus = await agent.refreshCloudTools();
@@ -271,6 +277,7 @@ async function runSinglePrompt(prompt, output, format, outputSchemaPath, beforeE
         process.stdout.write(formatted + '\n');
     }
     await closeBrowser();
+    await mcpHub.close(); // stdio servers are child processes; don't orphan them
     if (beforeExit)
         await beforeExit();
     process.exit(0);
@@ -329,7 +336,6 @@ async function runInteractive() {
     if (selectedModel.length === 0) {
         throw new Error('No models configured. Set SCALIX_MODEL env var or run interactive setup.');
     }
-    const mcpTools = loadMcpServices();
     // Only discover/load project-local plugins in a trusted workspace — plugins
     // dynamically import and execute code from the project directory.
     const plugins = isWorkspaceTrusted() ? await discoverPlugins(process.cwd()) : [];
@@ -337,7 +343,7 @@ async function runInteractive() {
         process.stderr.write('Project plugins skipped (untrusted workspace).\n');
     }
     const pluginTools = getPluginTools(plugins);
-    const allTools = [...defaultTools, ...extraTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...mcpTools, ...pluginTools];
+    const allTools = [...defaultTools, ...extraTools, ...memoryTools, ...webTools, ...advancedTools, ...visionTools, ...voiceTools, ...browserTools, ...pluginTools];
     const instructions = await buildEnhancedInstructions();
     const rl = readline.createInterface({
         input: process.stdin,
@@ -383,6 +389,9 @@ async function runInteractive() {
             return answer.trim().toLowerCase() === 'y';
         },
     });
+    if (agent.getSkippedHookCount() > 0) {
+        process.stderr.write(`Project hooks skipped (untrusted workspace): ${agent.getSkippedHookCount()}\n`);
+    }
     let sessionId = generateSessionId();
     agent.on('thinking:start', () => process.stdout.write('\n\x1b[33mThinking...\x1b[0m'));
     agent.on('tool:call', (name, args) => {
@@ -413,6 +422,9 @@ async function runInteractive() {
             console.log(`\x1b[33m\u26A0 Context usage: ${info.percentage}% (${info.tokens}/${info.maxTokens} tokens)\x1b[0m`);
         }
     });
+    // Connect configured MCP servers and register their tools. Warnings only:
+    // a server that will not start must not take the whole run down with it.
+    const mcpHub = await startMcp(agent, (m) => process.stderr.write(`\x1b[33m⚠ ${m}\x1b[0m\n`));
     // Register the account's Scalix Cloud platform tools (one attempt; failure
     // is stated once and the session continues with local tools only).
     const cloudStatus = await agent.refreshCloudTools();
@@ -445,6 +457,7 @@ async function runInteractive() {
         console.log('Goodbye!');
         rl.close();
         await closeBrowser().catch(() => { });
+        await mcpHub.close().catch(() => { }); // stdio servers are our children
         process.exit(0);
     }
     process.on('SIGINT', () => { shutdown().catch(() => process.exit(1)); });
@@ -610,6 +623,10 @@ async function runInteractive() {
             return true;
         }
         if (cmd === '/hooks') {
+            const skipped = agent.getSkippedHookCount();
+            if (skipped > 0) {
+                console.log(`\n${skipped} project hook(s) skipped — untrusted workspace.`);
+            }
             console.log('\n' + hooksSummary(agent.getHooks()) + '\n');
             return true;
         }