scalix 1.5.1 → 1.6.0

package/.env.example

@@ -1,8 +1,10 @@
 # Required — your Scalix API key
-SCALIX_API_KEY=sk-...
+SCALIX_API_KEY=scalix_sk_...
 
-# Optional — custom API base URL (defaults to Scalix cloud)
-# SCALIX_BASE_URL=https://api.scalix.world/v1
+# Optional — API base URL. This is the host root, NOT the /v1 endpoint: the
+# client appends /v1/ai/... itself. Point it at a self-hosted gateway if you
+# have one; the default is Scalix cloud.
+# SCALIX_BASE_URL=https://api.scalix.world
 
 # Optional — override the default model
 # SCALIX_MODEL=

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 All notable changes to Scalix Coder will be documented in this file.
 
+## [1.6.0] - 2026-11-11
+
+### Added
+- **`/marketplace` — the Scalix curated plugin catalog.** Browse, inspect and install catalog listings from the TUI: MCP servers into `mcp-services.json`, skills into `.scalix/skills/`, rules into `.scalix/rules/`, subagents into `.scalix/agents/`. Every listing is re-validated client-side before anything touches disk (https-only public-host remote entries, bare stdio command names, relative file paths, env-var names only — never credential values), stdio installs require explicit confirmation, and install telemetry is best-effort and anonymous. New module `src/marketplace.ts`; 21 unit tests.
+
+### Security
+- **Repo-supplied slash commands are trust-gated and run with a sanitized environment.** `.scalix/commands/*.md` templates were loaded in every front end without the workspace-trust check that plugins and hooks get, and their `` !`cmd` `` inline-bash expansions executed with the full parent environment — API keys readable. Inline bash now runs with `sanitizeEnvForCommand()`, loading is gated on `isWorkspaceTrusted()` (with a skip notice), and a repo carrying `commands/` now triggers the trust prompt. (Audit F1)
+- **`browser_session_save` / `restore` reject traversal names.** The `name` argument became a filename via `path.join` without validation, so `../../..` wrote and read JSON outside the sandbox. Names are now restricted to `[A-Za-z0-9._-]` at the schema and in `saveSessionState`. (F2)
+- **`search_files` ripgrep fast path is sandbox-contained.** The rg branch took any absolute `path` and read it; the JS fallback already validated. The target now goes through `sandboxPath()` before any backend runs, with rg output relativized to preserve the old shape. (F3)
+- **Project `settings.local.json` can no longer escalate permissions.** A trusted repo could set `permissionMode: "yolo"`, reclassify tools via `toolOverrides`, disable blocklist/injection patterns, or add scoped "allow" rules. Project files may now only tighten: `plan` mode, deny-only scoped rules, and a whitelist of tightening security fields; escalation attempts are ignored with a notice. Managed settings (`managed-settings.json`) are now validated with the same validators as user config. (F4)
+- **`@file` prompt references are sandbox-contained.** `@/abs/path.ext` in a prompt read any file on disk in the TUI and was attacker-influenceable via `--pipe`; both `agent.ts` and `commands.ts` expansion now route through the sandbox check. (F5)
+- **Alibaba Cloud metadata IP `100.100.100.200` is treated as private** by `web_fetch` and the browser tools — it sits outside every previously-listed range and exposed instance credentials on ECS. (F9)
+- MCP `serverUrl` values are redacted (userinfo stripped) before logging; MCP fetch now downgrades 301/302/303 redirects of POST requests to GET and drops the body per the fetch spec. (F12 + redirect semantics)
+- IPC `setPermissionMode` validates the mode against `PERMISSION_MODES` instead of applying any string. (F14)
+
+### Fixed
+- **A user abort no longer pollutes the model circuit breaker.** Aborting mid-request was recorded as a model failure — five Escapes within the reset window silently rotated the model. The abort path now returns `'[interrupted]'` consistently whether it lands between tool calls or mid-request. (Audit: agent abort contract)
+- **Retry backoff, stream-fallback waits, and tool-confirmation prompts are abort-aware.** Cancelling during a Retry-After wait (up to 60s) or a pending confirmation (up to 300s) returns immediately instead of parking the loop.
+- **Conflicted sub-agent worktree merges keep their branch.** Teardown ran `git branch -D` unconditionally, destroying the sub-agent's unmerged commits right after reporting the conflict; removal now uses a safe delete and keeps unmerged `scalix-agent/*` branches for recovery. A failed merge probe is reported as a failure (with `error`) instead of `{merged: true, commitCount: 0}`.
+- **`/delegate` works on BYOK sessions.** The headless sub-agent config omitted `provider` (and cloud credentials), so the sub-agent called the Scalix URL shape against a third-party base URL and 404'd on every request.
+- **Per-request timeout defaults to 300s.** The comment promised it but unset `SCALIX_REQUEST_TIMEOUT_MS` meant *no* timeout; a wedged connection hung the turn forever.
+- The capability probe (`streamsToolCalls`) can no longer fail a turn — errors default to the conservative non-streaming answer.
+- `clearHistory()` / `loadMessages()` reset the output-format instruction index, so a `/load` followed by a JSON-format request can no longer overwrite an unrelated system message.
+- Streaming TTFT and per-turn metrics reset each loop iteration, so `turn:summary` reports the turn that produced the final response.
+- `scalix run` no longer double-prints errors (REPORTED_ERROR dedup applied to headless).
+
+### VS Code extension
+- **Fixed the send dead-latch.** The chat panel set the tab's `isRunning` flag before reading it, so the direct-send branch was dead code: every message queued as "Queued: …" and was only released when an unrelated engine status event arrived.
+- **Chat tabs stay in sync with the engine.** Switching tabs now posts `switchSession` (the host previously kept sending to the previous tab's session, and background-tab streams were dropped); `send`/`abort` honor the message's own `sessionId` with the host value as fallback. Queued messages now carry their images through the queue.
+- **Feedback is actually stored.** The submit-feedback flow thanked the user and discarded everything; it now records through `FeedbackService` (local history, capped at 100 — nothing leaves the machine).
+- **Tool-approval handler cleanup on dispose.** With a sidebar and an editor-tab chat open, closing the editor tab left its dead confirm handler registered, so in-panel approvals silently stopped for the surviving surface.
+- `scalix.cliPath`, `scalix.baseUrl`, `scalix.openaiBaseUrl`, `scalix.provider`, and `scalix.permissionMode` are now machine-scoped — a repo's `.vscode/settings.json` can no longer point the engine spawn at arbitrary code or redirect the API key's destination endpoint.
+
+### Known issues (from the 2026-10-14 audit, not yet addressed)
+- The webview's per-tab `innerHTML` cache destroys event listeners on restored tabs (dead confirm-card buttons after a tab round-trip) — needs the data-driven re-render refactor.
+- Background-tab stream events are still dropped rather than buffered per session.
+- The OS command sandbox (seatbelt/bwrap) remains opt-in and default-off; the regex command blocklist is explicitly not a security boundary.
+- DNS-rebinding TOCTOU remains in `web_fetch`/MCP fetch (validation and fetch resolve DNS independently).
+- `vscode-extension/tests` are still not wired into either publish workflow.
+
 ## [1.5.1] - 2026-08-08
 
 ### Added

package/LICENSE

@@ -2,7 +2,6 @@ SCALIX WORLD PRIVATE LIMITED
 END USER LICENSE AGREEMENT (EULA)
 
 Copyright (c) 2025-2026 Scalix World Pvt Ltd. All rights reserved.
-A subsidiary of Energy FW Ltd (UK Company No. 14600160)
 
 IMPORTANT — READ CAREFULLY BEFORE USING THIS SOFTWARE.
 

package/README.md

@@ -2,7 +2,7 @@
 
 AI-powered coding agent for the terminal and [VS Code](https://marketplace.visualstudio.com/items?itemName=scalix.scalix) — built by [Scalix World](https://scalix.world).
 
-![Version](https://img.shields.io/badge/version-1.4.0-blue)
+[![npm](https://img.shields.io/npm/v/scalix?color=blue)](https://www.npmjs.com/package/scalix)
 ![Node](https://img.shields.io/badge/node-%3E%3D18-green)
 ![License](https://img.shields.io/badge/license-EULA-orange)
 
@@ -61,12 +61,28 @@ Notes:
 
 ### Install
 
+```bash
+npm install -g scalix
+```
+
+Requires Node 18 or newer. If `npm install -g` needs `sudo` on your machine, that
+is a sign npm's global prefix points somewhere root-owned — point it at your home
+directory (`npm config set prefix ~/.npm-global`) rather than installing as root.
+
+<details>
+<summary>From source (contributors)</summary>
+
+The repository is private; you need access before this will clone.
+
 ```bash
 git clone https://github.com/scalixworld/scalix-coder.git && cd scalix-coder
 npm install
-sudo npm link
+npm run build
+npm link
 ```
 
+</details>
+
 ### Run
 
 ```bash
@@ -83,6 +99,7 @@ First launch opens a setup wizard to configure your Scalix API key, endpoint, an
 | `SCALIX_MODEL`    | Comma-separated model IDs        |
 | `SCALIX_BASE_URL` | API base URL                     |
 | `SCALIX_PROJECT`  | Project ID for org-wide keys (sent as `x-scalix-project` on platform tool calls) |
+| `SCALIX_COMMAND_SANDBOX` | OS-level command sandbox: `off` \| `filesystem` \| `strict` (overrides config) |
 | `BRAVE_API_KEY`   | Brave Search API key             |
 | `TAVILY_API_KEY`  | Tavily Search API key            |
 
@@ -106,6 +123,7 @@ scalix run "generate a migration" --output migration.sql --format patch
 | `/models`          | List active models           |
 | `/model`           | Switch model                 |
 | `/mode`            | Set permission mode          |
+| `/sandbox`         | Set the OS command sandbox (off \| filesystem \| strict) |
 | `/compact`         | Compress context             |
 | `/cost`            | Token usage & cost           |
 | `/budget`          | Budget status                |
@@ -208,7 +226,9 @@ scalix run "generate a migration" --output migration.sql --format patch
 | `notebook_edit`  | Jupyter notebook operations |
 | `monitor`        | Background process output   |
 | `agent`          | Spawn sub-agents            |
-| `add_mcp_server` | Register MCP servers        |
+| `write_artifact`  | Write a reviewable plan / walkthrough / tasklist / summary to `.scalix/artifacts/` |
+| `list_artifacts`  | List previously written artifacts (newest first) |
+| `add_mcp_server` | Register MCP servers |
 
 ## Configuration
 
@@ -239,6 +259,74 @@ Config is stored in `~/.scalix-coder/config.json`.
 | `.scalix/rules/*.md`    | Scoped rules                  |
 | `mcp-services.json`     | MCP server config             |
 
+### Command sandbox (opt-in)
+
+`run_command` can execute inside a kernel-enforced sandbox — the OS-level wall
+behind the logical checks (blocklist, injection detection, path containment).
+Set `commandSandbox` in `~/.scalix-coder/config.json` (or `SCALIX_COMMAND_SANDBOX`):
+
+| Mode         | What it does |
+| ------------ | ------------ |
+| `off`        | Default. No sandbox — behaviour unchanged. |
+| `filesystem` | macOS seatbelt / Linux bubblewrap: writes confined to the workspace + system temp, reads unrestricted, network allowed. |
+| `strict`     | `filesystem` plus no network (unshared netns / seatbelt `deny network*`). For untrusted builds. |
+
+Notes: Windows is not supported — with a mode set there, commands fail closed
+with the reason instead of running unsandboxed. Package managers that cache in
+`$HOME` (pip, cargo) will fail cache writes in `filesystem` mode; that is the
+wall working. The backend binary must exist (`sandbox-exec` on macOS ships with
+the OS; `bwrap` must be installed on Linux) — a missing backend is reported,
+never skipped.
+
+### MCP servers
+
+Servers listed in `mcp-services.json` (project root, or `.scalix/` as a
+fallback) are connected at startup and their tools are offered to the model as
+`mcp__<server>__<tool>`. Both transports are supported:
+
+```json
+{
+  "mcpServers": [
+    { "serverLabel": "github", "command": "npx", "args": ["-y", "@modelcontextprotocol/server-github"],
+      "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_…" } },
+    { "serverLabel": "docs", "serverUrl": "https://docs.example.com/mcp", "authorizationEnv": "DOCS_TOKEN" }
+  ]
+}
+```
+
+The Claude Desktop / VS Code object-map dialect (`"mcpServers": {"github": {…}}`)
+is accepted too, so an existing config can be dropped in unchanged.
+
+- `disabled: true` skips an entry without deleting it; `allowedTools.toolNames`
+  registers only the named tools from that server.
+- A server that fails to start is logged and skipped — it never takes the run
+  down with it. `/mcp` lists the status of each.
+- **Command (stdio) servers only start in a trusted workspace**, because
+  spawning one runs arbitrary local code. They get a clean environment, not the
+  agent's, so they cannot read its API keys.
+- MCP tools are external, so they require confirmation under the default
+  permission mode.
+
+### Scalix Marketplace (`/marketplace`)
+
+Browse the curated plugin catalog and install it in one command:
+
+```
+/marketplace                 featured listings
+/marketplace <query>         search the catalog
+/marketplace info <id>       detail + what an install would write
+/marketplace install <id>    install (stdio MCP needs `--confirm`)
+```
+
+Four artifact kinds are installed into this workspace: **MCP servers**
+(`mcp-services.json`), **skills** (`.scalix/skills/<name>/`), **rules**
+(`.scalix/rules/`) and **subagents** (`.scalix/agents/`). Every listing carries
+a trust tier — ★ official, ✔ verified, · community — and an env-var reference
+is stored by NAME only (you set the value in your environment). The catalog is
+fetched from `https://api.scalix.world/v1/marketplace` (override with
+`SCALIX_MARKETPLACE_URL`); payloads are re-validated before anything is
+written to disk. Full contract: `scalix-cloud/docs/MARKETPLACE.md`.
+
 ## VS Code Extension
 
 Install from the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=scalix.scalix) — or from [Open VSX](https://open-vsx.org/extension/scalix/scalix) if you use Cursor, Windsurf, or VSCodium:

package/dist/agent-presets.js

@@ -0,0 +1,33 @@
+export const AGENT_PRESETS = [
+    {
+        id: 'cloud-architect',
+        name: 'Cloud Architect',
+        description: 'Full Scalix Cloud tools access with architecture-first planning',
+        systemPromptAdditions: 'You are an expert Scalix Cloud Architect. Prioritize robust, scalable infrastructure. Plan changes carefully.',
+        permissionMode: 'default'
+    },
+    {
+        id: 'dba',
+        name: 'Database Administrator',
+        description: 'Focused on database migrations and SQL optimization',
+        systemPromptAdditions: 'You are a Senior DBA. Prioritize data integrity and query performance. Always verify schemas before altering.',
+        permissionMode: 'default'
+    },
+    {
+        id: 'devops',
+        name: 'DevOps Engineer',
+        description: 'CI/CD, deployments, and infrastructure management',
+        systemPromptAdditions: 'You are a DevOps engineer focused on CI/CD pipelines, containerization, and safe deployments.',
+        permissionMode: 'default'
+    },
+    {
+        id: 'full-access',
+        name: 'Full Access (Auto)',
+        description: 'All tools enabled, autonomous execution mode',
+        systemPromptAdditions: 'You are fully autonomous. Execute the required steps directly.',
+        permissionMode: 'auto'
+    }
+];
+export function getPreset(id) {
+    return AGENT_PRESETS.find(p => p.id === id);
+}